Zero call-used registers on function return

[kees]

As a defense against stale register contents being used in ROP attacks or as a side-channel or speculation path, the compiler could zero all used caller-used general registers at function exit, with virtually no performance impact (i.e. XORing general registers is highly pipelined).

-fzero-call-used-regs=... implementation:

• GCC: since v11, earlier development thread
• Clang: bug
  • x86: since v15+
  • arm64: since 6.1+
• Kernel: since v5.15

[madaidan]

The patch was renamed https://github.com/clearlinux-pkgs/gcc/blob/master/0001-x86-Add-mzero-caller.patch

[rengolin]

Clang thread: http://lists.llvm.org/pipermail/llvm-dev/2020-August/144082.html

[kees]

https://www.semanticscholar.org/paper/Clean-the-Scratch-Registers%3A-A-Way-to-Mitigate-Rong-Xie/6f2ce4fd31baa0f6c02f9eb5c57b90d39fe5fa13

[tsautereau-anssi]

The patch landed in GCC.

[kees]

The format is -fzero-call-used-regs=[skip|used-gpr-arg|used-arg|all-gpr-arg|all-arg|used-gpr|all-gpr|used|all]

This needs an implementation in Clang now.

[kees]

(outdated) Clang bug: https://bugs.llvm.org/show_bug.cgi?id=49902

[kees]

CBL issue: ClangBuiltLinux#20

[nickdesaulniers]

Clang bug: https://bugs.llvm.org/show_bug.cgi?id=37880

[kees]

https://lore.kernel.org/lkml/20210505191804.4015873-1-keescook@chromium.org/

[kees]

https://lore.kernel.org/lkml/20210714220129.844345-1-keescook@chromium.org/T/#u