Messages in this thread | | | Date | Mon, 3 Oct 2022 17:01:09 +0300 | From | "Kirill A . Shutemov" <> | Subject | Re: [PATCH v2 07/39] x86/cet: Add user control-protection fault handler |
| |
On Thu, Sep 29, 2022 at 03:29:04PM -0700, Rick Edgecombe wrote: > +#else > +static void do_user_control_protection_fault(struct pt_regs *regs, > + unsigned long error_code) > +{ > + WARN_ONCE(1, "User-mode control protection fault with shadow support disabled\n");
Why is this a warning, but runtime check for !X86_FEATURE_IBT and !X86_FEATURE_SHSTK below is fatal?
> +} > +#endif > + > +#ifdef CONFIG_X86_KERNEL_IBT > + > +static __ro_after_init bool ibt_fatal = true; > + > +extern void ibt_selftest_ip(void); /* code label defined in asm below */ > > +static void do_kernel_control_protection_fault(struct pt_regs *regs) > +{ > if (unlikely(regs->ip == (unsigned long)&ibt_selftest_ip)) { > regs->ax = 0; > return; > @@ -283,9 +335,29 @@ static int __init ibt_setup(char *str) > } > > __setup("ibt=", ibt_setup); > - > +#else > +static void do_kernel_control_protection_fault(struct pt_regs *regs) > +{ > + WARN_ONCE(1, "Kernel-mode control protection fault with IBT disabled\n");
Ditto.
> +} > #endif /* CONFIG_X86_KERNEL_IBT */ > > +#if defined(CONFIG_X86_KERNEL_IBT) || defined(CONFIG_X86_SHADOW_STACK) > +DEFINE_IDTENTRY_ERRORCODE(exc_control_protection) > +{ > + if (!cpu_feature_enabled(X86_FEATURE_IBT) && > + !cpu_feature_enabled(X86_FEATURE_SHSTK)) { > + pr_err("Unexpected #CP\n"); > + BUG(); > + } > + > + if (user_mode(regs)) > + do_user_control_protection_fault(regs, error_code); > + else > + do_kernel_control_protection_fault(regs); > +} > +#endif /* defined(CONFIG_X86_KERNEL_IBT) || defined(CONFIG_X86_SHADOW_STACK) */ > + > #ifdef CONFIG_X86_F00F_BUG > void handle_invalid_op(struct pt_regs *regs) > #else
-- Kiryl Shutsemau / Kirill A. Shutemov
| |