x86/entry/64: Clear registers for exceptions/interrupts, to reduce speculation attack surface (3ac6d8c7) · Commits · 戴 / test

Clear the 'extra' registers on entering the 64-bit kernel for exceptions and interrupts. The common registers are not cleared since they are likely clobbered well before they can be exploited in a speculative execution attack. Originally-From: Andi Kleen <ak@linux.intel.com> Signed-off-by:

Dan Williams <dan.j.williams@intel.com> Cc: <stable@vger.kernel.org> Cc: Andy Lutomirski <luto@kernel.org> Cc: Borislav Petkov <bp@alien8.de> Cc: Brian Gerst <brgerst@gmail.com> Cc: Denys Vlasenko <dvlasenk@redhat.com> Cc: H. Peter Anvin <hpa@zytor.com> Cc: Josh Poimboeuf <jpoimboe@redhat.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Link: http://lkml.kernel.org/r/151787989146.7847.15749181712358213254.stgit@dwillia2-desk3.amr.corp.intel.com [ Made small improvements to the changelog and the code comments. ] Signed-off-by:

Ingo Molnar <mingo@kernel.org>

arch/x86/entry/calling.h

+19 −0

Original line number	Diff line number	Diff line
		@@ -147,6 +147,25 @@ For 32-bit we have the following conventions - kernel is built with
		UNWIND_HINT_REGS offset=\offset
		.endm

		/*
		* Sanitize registers of values that a speculation attack
		* might otherwise want to exploit. The lower registers are
		* likely clobbered well before they could be put to use in
		* a speculative execution gadget:
		*/
		.macro CLEAR_REGS_NOSPEC
		xorl %ebp, %ebp
		xorl %ebx, %ebx
		xorq %r8, %r8
		xorq %r9, %r9
		xorq %r10, %r10
		xorq %r11, %r11
		xorq %r12, %r12
		xorq %r13, %r13
		xorq %r14, %r14
		xorq %r15, %r15
		.endm

		.macro POP_EXTRA_REGS
		popq %r15
		popq %r14

arch/x86/entry/entry_64.S

+5 −1

Original line number	Diff line number	Diff line
		@@ -575,6 +575,7 @@ END(irq_entries_start)
		ALLOC_PT_GPREGS_ON_STACK
		SAVE_C_REGS
		SAVE_EXTRA_REGS
		CLEAR_REGS_NOSPEC
		ENCODE_FRAME_POINTER

		testb $3, CS(%rsp)
		@@ -1133,6 +1134,7 @@ ENTRY(xen_failsafe_callback)
		ALLOC_PT_GPREGS_ON_STACK
		SAVE_C_REGS
		SAVE_EXTRA_REGS
		CLEAR_REGS_NOSPEC
		ENCODE_FRAME_POINTER
		jmp error_exit
		END(xen_failsafe_callback)
		@@ -1178,6 +1180,7 @@ ENTRY(paranoid_entry)
		cld
		SAVE_C_REGS 8
		SAVE_EXTRA_REGS 8
		CLEAR_REGS_NOSPEC
		ENCODE_FRAME_POINTER 8
		movl $1, %ebx
		movl $MSR_GS_BASE, %ecx
		@@ -1230,8 +1233,8 @@ ENTRY(error_entry)
		cld
		SAVE_C_REGS 8
		SAVE_EXTRA_REGS 8
		CLEAR_REGS_NOSPEC
		ENCODE_FRAME_POINTER 8
		xorl %ebx, %ebx
		testb $3, CS+8(%rsp)
		jz .Lerror_kernelspace

		@@ -1428,6 +1431,7 @@ ENTRY(nmi)
		pushq %r14 /* pt_regs->r14 */
		pushq %r15 /* pt_regs->r15 */
		UNWIND_HINT_REGS
		CLEAR_REGS_NOSPEC
		ENCODE_FRAME_POINTER

		/*

Admin message