Re: [PATCH v3 3/3] x86/entry: Clear registers for compat syscalls

[Dan Williams]

On Mon, Feb 5, 2018 at 11:26 PM, Ingo Molnar <mingo@xxxxxxxxxx> wrote:
>
> * Dan Williams <dan.j.williams@xxxxxxxxx> wrote:
>
>> From: Andi Kleen <ak@xxxxxxxxxxxxxxx>
>>
>> At entry userspace may have populated registers with values that could
>> be useful in a speculative execution attack. Clear them to minimize the
>> kernel's attack surface.
>>
>> [djbw: interleave the clearing with setting up the stack ]
>> Cc: Thomas Gleixner <tglx@xxxxxxxxxxxxx>
>> Cc: Ingo Molnar <mingo@xxxxxxxxxx>
>> Cc: "H. Peter Anvin" <hpa@xxxxxxxxx>
>> Cc: x86@xxxxxxxxxx
>> Cc: Andy Lutomirski <luto@xxxxxxxxxx>
>> Signed-off-by: Andi Kleen <ak@xxxxxxxxxxxxxxx>
>> Signed-off-by: Dan Williams <dan.j.williams@xxxxxxxxx>
>> ---
>>  arch/x86/entry/entry_64_compat.S |   30 ++++++++++++++++++++++++++++++
>>  1 file changed, 30 insertions(+)
>>
>> diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S
>> index 98d5358e4041..fd65e016e413 100644
>> --- a/arch/x86/entry/entry_64_compat.S
>> +++ b/arch/x86/entry/entry_64_compat.S
>> @@ -85,15 +85,25 @@ ENTRY(entry_SYSENTER_compat)
>>       pushq   %rcx                    /* pt_regs->cx */
>>       pushq   $-ENOSYS                /* pt_regs->ax */
>>       pushq   $0                      /* pt_regs->r8  = 0 */
>> +     xorq    %r8, %r8                /* nospec   r8 */
>>       pushq   $0                      /* pt_regs->r9  = 0 */
>> +     xorq    %r9, %r9                /* nospec   r9 */
>>       pushq   $0                      /* pt_regs->r10 = 0 */
>> +     xorq    %r10, %r10              /* nospec   r10 */
>>       pushq   $0                      /* pt_regs->r11 = 0 */
>> +     xorq    %r11, %r11              /* nospec   r11 */
>>       pushq   %rbx                    /* pt_regs->rbx */
>> +     xorl    %ebx, %ebx              /* nospec   rbx */
>>       pushq   %rbp                    /* pt_regs->rbp (will be overwritten) */
>> +     xorl    %ebp, %ebp              /* nospec   rbp */
>>       pushq   $0                      /* pt_regs->r12 = 0 */
>> +     xorq    %r12, %r12              /* nospec   r12 */
>>       pushq   $0                      /* pt_regs->r13 = 0 */
>> +     xorq    %r13, %r13              /* nospec   r13 */
>>       pushq   $0                      /* pt_regs->r14 = 0 */
>> +     xorq    %r14, %r14              /* nospec   r14 */
>>       pushq   $0                      /* pt_regs->r15 = 0 */
>> +     xorq    %r15, %r15              /* nospec   r15 */
>>       cld
>>
>>       /*
>> @@ -214,15 +224,25 @@ GLOBAL(entry_SYSCALL_compat_after_hwframe)
>>       pushq   %rbp                    /* pt_regs->cx (stashed in bp) */
>>       pushq   $-ENOSYS                /* pt_regs->ax */
>>       pushq   $0                      /* pt_regs->r8  = 0 */
>> +     xorq    %r8, %r8                /* nospec   r8 */
>>       pushq   $0                      /* pt_regs->r9  = 0 */
>> +     xorq    %r9, %r9                /* nospec   r9 */
>>       pushq   $0                      /* pt_regs->r10 = 0 */
>> +     xorq    %r10, %r10              /* nospec   r10 */
>>       pushq   $0                      /* pt_regs->r11 = 0 */
>> +     xorq    %r11, %r11              /* nospec   r11 */
>>       pushq   %rbx                    /* pt_regs->rbx */
>> +     xorl    %ebx, %ebx              /* nospec   rbx */
>>       pushq   %rbp                    /* pt_regs->rbp (will be overwritten) */
>> +     xorl    %ebp, %ebp              /* nospec   rbp */
>>       pushq   $0                      /* pt_regs->r12 = 0 */
>> +     xorq    %r12, %r12              /* nospec   r12 */
>>       pushq   $0                      /* pt_regs->r13 = 0 */
>> +     xorq    %r13, %r13              /* nospec   r13 */
>>       pushq   $0                      /* pt_regs->r14 = 0 */
>> +     xorq    %r14, %r14              /* nospec   r14 */
>>       pushq   $0                      /* pt_regs->r15 = 0 */
>> +     xorq    %r15, %r15              /* nospec   r15 */
>
> I really love it how you've aligned the comment fields vertically - nice!
>
>>       /*
>>        * User mode is traced as though IRQs are on, and SYSENTER
>> @@ -338,15 +358,25 @@ ENTRY(entry_INT80_compat)
>>       pushq   %rcx                    /* pt_regs->cx */
>>       pushq   $-ENOSYS                /* pt_regs->ax */
>>       pushq   $0                      /* pt_regs->r8  = 0 */
>> +     xorq    %r8, %r8                /* nospec   r8 */
>>       pushq   $0                      /* pt_regs->r9  = 0 */
>> +     xorq    %r9, %r9                /* nospec   r9 */
>>       pushq   $0                      /* pt_regs->r10 = 0 */
>> +     xorq    %r10, %r10              /* nospec   r10 */
>>       pushq   $0                      /* pt_regs->r11 = 0 */
>> +     xorq    %r11, %r11              /* nospec   r11 */
>>       pushq   %rbx                    /* pt_regs->rbx */
>> +     xorl    %ebx, %ebx              /* nospec   rbx */
>>       pushq   %rbp                    /* pt_regs->rbp */
>> +     xorl    %ebp, %ebp              /* nospec   rbp */
>>       pushq   %r12                    /* pt_regs->r12 */
>> +     xorq    %r12, %r12              /* nospec   r12 */
>>       pushq   %r13                    /* pt_regs->r13 */
>> +     xorq    %r13, %r13              /* nospec   r13 */
>>       pushq   %r14                    /* pt_regs->r14 */
>> +     xorq    %r14, %r14              /* nospec   r14 */
>>       pushq   %r15                    /* pt_regs->r15 */
>> +     xorq    %r15, %r15              /* nospec   r15 */
>>       cld
>
> BTW., these last two patches have changed *significantly* from Andi's original
> patches that were submitted originally, so I changed them over to:
>
>   From: Dan Williams <dan.j.williams@xxxxxxxxx>
>   ...
>   Originally-From: Andi Kleen <ak@xxxxxxxxxxxxxxx>
>   Signed-off-by: Dan Williams <dan.j.williams@xxxxxxxxx>
>
> ... to better show authorship history.
>
> Please let me know if that's not OK.

Works for me.

Thanks Ingo.