From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753418AbeBERsh (ORCPT ); Mon, 5 Feb 2018 12:48:37 -0500 Received: from mx1.redhat.com ([209.132.183.28]:38100 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752925AbeBERsa (ORCPT ); Mon, 5 Feb 2018 12:48:30 -0500 Date: Mon, 5 Feb 2018 11:48:29 -0600 From: Josh Poimboeuf To: Andy Lutomirski Cc: Ingo Molnar , Dan Williams , Thomas Gleixner , Andi Kleen , X86 ML , LKML , Ingo Molnar , "H. Peter Anvin" , Linus Torvalds Subject: Re: [PATCH v2 1/3] x86/entry: Clear extra registers beyond syscall arguments for 64bit kernels Message-ID: <20180205174829.d7rflcxigbx2snra@treble> References: <151776623555.23236.14152911329227555005.stgit@dwillia2-desk3.amr.corp.intel.com> <151776624080.23236.1865339140666550495.stgit@dwillia2-desk3.amr.corp.intel.com> <20180205114250.zd3nbe5yl2mnd54m@gmail.com> <6CCF65EF-325A-4207-9C5E-2CD2D8E2A7E4@amacapital.net> <20180205163046.zeic6bqhkypbsutt@gmail.com> <20180205172638.briyyjtbxxd7wyjh@treble> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.6.0.1 (2016-04-01) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, Feb 05, 2018 at 05:31:39PM +0000, Andy Lutomirski wrote: > On Mon, Feb 5, 2018 at 5:26 PM, Josh Poimboeuf wrote: > > On Mon, Feb 05, 2018 at 04:37:26PM +0000, Andy Lutomirski wrote: > >> On Mon, Feb 5, 2018 at 4:30 PM, Ingo Molnar wrote: > >> > > >> > * Andy Lutomirski wrote: > >> > > >> >> > >> >> > >> >> > On Feb 5, 2018, at 3:42 AM, Ingo Molnar wrote: > >> >> > > >> >> > > >> >> > * Dan Williams wrote: > >> >> > > >> >> >> + /* > >> >> >> + * Sanitize extra registers of values that a speculation attack > >> >> >> + * might want to exploit. In the CONFIG_FRAME_POINTER=y case, > >> >> >> + * the expectation is that %ebp will be clobbered before it > >> >> >> + * could be used. > >> >> >> + */ > >> >> >> + .macro CLEAR_EXTRA_REGS_NOSPEC > >> >> >> + xorq %r15, %r15 > >> >> >> + xorq %r14, %r14 > >> >> >> + xorq %r13, %r13 > >> >> >> + xorq %r12, %r12 > >> >> >> + xorl %ebx, %ebx > >> >> >> +#ifndef CONFIG_FRAME_POINTER > >> >> >> + xorl %ebp, %ebp > >> >> >> +#endif > >> >> >> + .endm > >> >> > > >> >> > Yeah, so this series look pretty good to me, but there's one small detail: I think > >> >> > RBP should be cleared unconditionally here, even in the CONFIG_FRAME_POINTERS=y > >> >> > case, because: > >> >> > >> >> ENCODE_FRAME_POINTER should take care of rbp, though. > >> > > >> > AFAICS there's various entry paths where it's not used I think: for example the > >> > compat system calls in entry_64_compat.S don't seem to encode RBP in such a > >> > fashion (unless I missed some macro side effect). > >> > >> Then that's a separate bug that should be fixed. Josh? > > > > We don't encode the frame pointer on syscalls, because "fast path" > > (though that's obviously no longer a consideration). > > Should we start encoding the frame pointer? Perhaps, but I should clarify it's not a bug. For syscalls, we instead just standardized the location of the last stack frame. But that's a bit fragile and I was never too happy with it. Encoding the frame pointer would be a lot more straightforward, though we'd still need to figure out a way to detect the "end" of the stack for kthreads. We could probably encode that information as well: "here's the end, but there are no pt_regs". Could just be an "encoded" NULL. -- Josh