Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

SGX: Clear additional flag on enclave entry #65810

Merged
merged 4 commits into from
Oct 25, 2019
Merged

SGX: Clear additional flag on enclave entry #65810

Changes from 2 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
fc50036
fixed ac vulnerability
raoulstrackx Oct 21, 2019
d257c20
removed unnecessary push
raoulstrackx Oct 25, 2019
34f5d59
cleaning up code
raoulstrackx Oct 25, 2019
5aafa98
forgot pushfq/popqfq: fixed
raoulstrackx Oct 25, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions src/libstd/sys/sgx/abi/entry.S
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,6 +121,15 @@ sgx_entry:
fnstcw %gs:tcsls_user_fcw
/* reset user state */
cld /* x86-64 ABI requires DF to be unset at function entry/exit */

/* making sure AC flag is not set in rflags */
/* avoid using the 'clac' instruction to be compatible with older compilers */
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

older CPUs

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

clac was introduced in 5th generation Intel CPUs, SGX in 6th generation, so this isn't an issue

pushfq
popq %rcx
and $0xFFFFFFFFFFFBFFFF, %rcx
push %rcx
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You can clear DF and AC in a single instruction. e.g. andq $~0x40400, (%rsp)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

agreed. Fixed :)

popfq

/* check for debug buffer pointer */
testb $0xff,DEBUG(%rip)
jz .Lskip_debug_init
Expand Down