search

keystone-enclave / riscv-pk

Security monitor for Keystone Enclave (mirror of riscv-pk). Will be deprecated when openSBI port is ready
Other
36 stars 14 forks source link

Need to restrict SBIs the enclave can use #25

Open dayeol opened 5 years ago

dayeol commented 5 years ago

Now SM is embedded into the bbl, which basically provides a lot of SBI that can enable DoS against the OS as well as some potential attacks. For example, the enclave can shut down the entire machine using an SBI, and also request IPIs (e.g., TLB flush). Once we make the SM keep track of the CPU states, we should be able to put some gaskets in those interfaces that prevents enclave from doing these.

dkohlbre commented 5 years ago

This should, imo, be part of our rework of enclave lifecycles into explicit fsms. We can define the valid hart transitions along with the valid enclave state transitions and check it all at once on the SBI call.