Skip to content

Prevent attacker from manipulating FPU tag word used in SGX enclave #73471

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Jun 20, 2020
Merged

Prevent attacker from manipulating FPU tag word used in SGX enclave #73471

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
daedb79
Prevent attacker from manipulating FPU tag word used in SGX enclave
raoulstrackx Jun 17, 2020
33b304c
Using xsave restore to restore complete FPU state
raoulstrackx Jun 19, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 8 additions & 12 deletions src/libstd/sys/sgx/abi/entry.S
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,18 +26,10 @@ IMAGE_BASE:
.Lxsave_clear:
.org .+24
.Lxsave_mxcsr:
.int 0
.short 0x1f80

/* We can store a bunch of data in the gap between MXCSR and the XSAVE header */

/* MXCSR initialization value for ABI */
.Lmxcsr_init:
.int 0x1f80

/* x87 FPU control word initialization value for ABI */
.Lfpucw_init:
.int 0x037f

/* The following symbols point at read-only data that will be filled in by the */
/* post-linker. */

Expand Down Expand Up @@ -177,13 +169,17 @@ sgx_entry:
jz .Lskip_debug_init
mov %r10,%gs:tcsls_debug_panic_buf_ptr
.Lskip_debug_init:
/* reset cpu state */
mov %rdx, %r10
mov $-1, %rax
mov $-1, %rdx
xrstor .Lxsave_clear(%rip)
mov %r10, %rdx

/* check if returning from usercall */
mov %gs:tcsls_last_rsp,%r11
test %r11,%r11
jnz .Lusercall_ret
/* reset user state */
ldmxcsr .Lmxcsr_init(%rip)
fldcw .Lfpucw_init(%rip)
/* setup stack */
mov %gs:tcsls_tos,%rsp /* initially, RSP is not set to the correct value */
/* here. This is fixed below under "adjust stack". */
Expand Down