| Index: src/trusted/service_runtime/arch/x86_64/nacl_syscall_64.S
|
| diff --git a/src/trusted/service_runtime/arch/x86_64/nacl_syscall_64.S b/src/trusted/service_runtime/arch/x86_64/nacl_syscall_64.S
|
| index 52121614a2b4edeb22a724f8a2b7043f09f2f710..2f181e92c343cced9548c4482b9f3b13d78593ee 100644
|
| --- a/src/trusted/service_runtime/arch/x86_64/nacl_syscall_64.S
|
| +++ b/src/trusted/service_runtime/arch/x86_64/nacl_syscall_64.S
|
| @@ -214,11 +214,17 @@ DEFINE_GLOBAL_HIDDEN_IDENTIFIER(NaClGetTlsFastPath):
|
| leaq IDENTIFIER(nacl_tls)(%rip), %rdx
|
| leaq (%rdx,%rax,4), %rdx
|
| movl 0x0(%rdx), %eax
|
| - xorl %edx, %edx /* do not leak nacl_tls[thread_id] address */
|
| /* sandbox the return, straight off the untrusted stack */
|
| movq 0x8(%rsp), %rcx
|
| addq $0x10, %rsp
|
| addl $31, %ecx
|
| andl $0xffffffe0, %ecx
|
| addq %r15, %rcx
|
| + /*
|
| + * Set %rdx to zero so that we do not leak nacl_tls[thread_id]
|
| + * address. This also resets flags. Resetting flags to fixed
|
| + * values by doing this last simplifies testing that we do not
|
| + * leak any information via flags.
|
| + */
|
| + xorl %edx, %edx
|
| jmp *%rcx
|
|
|