CONFIG_ZERO_CALL_USED_REGS: Enable register zeroing on function exit

General informations

The Linux kernel configuration item CONFIG_ZERO_CALL_USED_REGS:

• prompt: Enable register zeroing on function exit
• type: bool
• depends on: CONFIG_CC_HAS_ZERO_CALL_USED_REGS
• defined in security/Kconfig.hardening
• found in Linux kernels: 5.15–5.19, 6.0–6.12

Help text

At the end of functions, always zero any caller-used register contents. This helps ensure that temporary values are not leaked beyond the function boundary. This means that register contents are less likely to be available for side channels and information exposures. Additionally, this helps reduce the number of useful ROP gadgets by about 20% (and removes compiler generated "write-what-where" gadgets) in the resulting kernel image. This has a less than 1% performance impact on most workloads. Image size growth depends on architecture, and should be evaluated for suitability. For example, x86_64 grows by less than 1%, and arm64 grows by about 5%.

Hardware

LKDDb

Raw data from LKDDb:

• (none)

Sources

This page is automaticly generated with free (libre, open) software lkddb(see lkddb-sources).

The data is retrived from:

• Linux kernel
• Linux Kernel Driver DataBase (LKDDb)

Automatic links from Google (and ads)

Custom Search

Popular queries: