src/trusted/service_runtime/arch/x86_64/nacl_switch_64.S - Issue 10829110: Fix two register leaks in the trusted->untrusted context switch

Side by Side Diff

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Keyboard Shortcuts

	File
u :	up to issue
j / k :	jump to file after / before current file
J / K :	jump to next file with a comment after / before current file
	Side-by-side diff
i :	toggle intra-line diffs
e :	expand all comments
c :	collapse all comments
s :	toggle showing all comments
n / p :	next / previous diff chunk or comment
N / P :	next / previous comment
<Up> / <Down> :	next / previous line

	Issue
u :	up to list of issues
j / k :	jump to patch after / before current patch
o / <Enter> :	open current patch in side-by-side view
i :	open current patch in unified diff view

	Issue List
j / k :	jump to issue after / before current issue
o / <Enter> :	open current issue

Side by Side Diff: src/trusted/service_runtime/arch/x86_64/nacl_switch_64.S

Issue 10829110: Fix two register leaks in the trusted->untrusted context switch (Closed) Base URL: svn://svn.chromium.org/native_client/trunk/src/native_client

Patch Set: Fix comment Created 8 years, 4 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View unified diff | Download patch | Annotate | Revision Log

OLD	NEW
1 /*	1 /*

2 * Copyright (c) 2012 The Native Client Authors. All rights reserved.	2 * Copyright (c) 2012 The Native Client Authors. All rights reserved.

3 * Use of this source code is governed by a BSD-style license that can be	3 * Use of this source code is governed by a BSD-style license that can be

4 * found in the LICENSE file.	4 * found in the LICENSE file.

5 */	5 */

6	6

7 /*	7 /*

8 * This code gets executed when switching from the service	8 * This code gets executed when switching from the service

9 * runtime to the NaCl module. NaClSwitch has one parameter only,	9 * runtime to the NaCl module. NaClSwitch has one parameter only,

10 * which is a struct passed by reference.	10 * which is a struct passed by reference.

(...skipping 78 matching lines...) Expand 10 before \| Expand all \| Expand 10 after Loading...
89 * been adjusted to one word below there, to insert a dummy	89 * been adjusted to one word below there, to insert a dummy

90 * return address for the user entry point function.	90 * return address for the user entry point function.

91 */	91 */

92 leal 8(%rsp), %edi	92 leal 8(%rsp), %edi

93	93

94 /*	94 /*

95 * Zero all unused registers. The 32-bit instructions	95 * Zero all unused registers. The 32-bit instructions

96 * are a byte shorter than their 64-bit counterparts	96 * are a byte shorter than their 64-bit counterparts

97 * when the target register is one of the first eight,	97 * when the target register is one of the first eight,

98 * and they implicitly zero the high halves.	98 * and they implicitly zero the high halves.

	99 *

	100 * The 'xorl' instruction also resets most flags to known

	101 * values.

99 */	102 */

100 xorl %edx, %edx	103 xorl %edx, %edx

101 movl %edx, %esi	104 movl %edx, %esi

102 movq %rdx, %r8	105 movq %rdx, %r8

103 movq %rdx, %r9	106 movq %rdx, %r9

104 movq %rdx, %r10	107 movq %rdx, %r10

105 movq %rdx, %r11	108 movq %rdx, %r11

106	109

107 /*	110 /*

108 * Clear the x87 state. Then restore the untrusted code's control word.	111 * Clear the x87 state. Then restore the untrusted code's control word.

(...skipping 45 matching lines...) Expand 10 before \| Expand all \| Expand 10 after Loading...
154 * "jmp *0x88(%rcx)" so that we do not leak the address of the	157 * "jmp *0x88(%rcx)" so that we do not leak the address of the

155 * struct NaClThreadContext to untrusted code. Knowing this	158 * struct NaClThreadContext to untrusted code. Knowing this

156 * address would make bugs in the sandbox easier to exploit.	159 * address would make bugs in the sandbox easier to exploit.

157 */	160 */

158 movq NACL_THREAD_CONTEXT_OFFSET_NEW_PROG_CTR(%rcx), %rcx	161 movq NACL_THREAD_CONTEXT_OFFSET_NEW_PROG_CTR(%rcx), %rcx

159 jmp *%rcx	162 jmp *%rcx

160 ENDMACRO	163 ENDMACRO

161	164

162 switcher NaClSwitchSSE, 0	165 switcher NaClSwitchSSE, 0

163 switcher NaClSwitchAVX, 1	166 switcher NaClSwitchAVX, 1

OLD	NEW

« no previous file with comments | « src/trusted/service_runtime/arch/x86_32/springboard.S ('k') | src/trusted/service_runtime/arch/x86_64/nacl_syscall_64.S » ('j') | no next file with comments »