Re: [PATCH v21 06/26] x86/cet: Add control-protection fault handler

[Yu, Yu-cheng]

On 2/24/2021 8:13 AM, Borislav Petkov wrote:

On Wed, Feb 17, 2021 at 02:27:10PM -0800, Yu-cheng Yu wrote:

+/*
+ * When a control protection exception occurs, send a signal to the responsible
+ * application.  Currently, control protection is only enabled for user mode.
+ * This exception should not come from kernel mode.
+ */
+DEFINE_IDTENTRY_ERRORCODE(exc_control_protection)
+{
+       static DEFINE_RATELIMIT_STATE(rs, DEFAULT_RATELIMIT_INTERVAL,
+                                     DEFAULT_RATELIMIT_BURST);

[...]

+
+               rdmsrl(MSR_IA32_PL3_SSP, ssp);
+               pr_emerg("%s[%d] control protection ip:%lx sp:%lx ssp:%lx 
error:%lx(%s)",
+                        tsk->comm, task_pid_nr(tsk),
+                        regs->ip, regs->sp, ssp, error_code,
+                        control_protection_err[err]);
+               print_vma_addr(KERN_CONT " in ", regs->ip);
+               pr_cont("\n");
+       }
+
+       force_sig_fault(SIGSEGV, SEGV_CPERR,
+                       (void __user *)uprobe_get_trap_addr(regs));

Why is this calling an uprobes function?

I will change it to error_get_trap_addr().

Also, do not break that line even if it is longer than 80.

+       cond_local_irq_disable(regs);
+}
+#endif
+
  static bool do_int3(struct pt_regs *regs)
  {
        int res;
diff --git a/include/uapi/asm-generic/siginfo.h 
b/include/uapi/asm-generic/siginfo.h
index d2597000407a..1c2ea91284a0 100644
--- a/include/uapi/asm-generic/siginfo.h
+++ b/include/uapi/asm-generic/siginfo.h
@@ -231,7 +231,8 @@ typedef struct siginfo {
  #define SEGV_ADIPERR  7       /* Precise MCD exception */
  #define SEGV_MTEAERR  8       /* Asynchronous ARM MTE error */
  #define SEGV_MTESERR  9       /* Synchronous ARM MTE exception */
-#define NSIGSEGV       9
+#define SEGV_CPERR     10      /* Control protection fault */
+#define NSIGSEGV       10

I still don't see the patch adding this to the manpage of sigaction(2).

There's a git repo there: https://www.kernel.org/doc/man-pages/

and I'm pretty sure Michael takes patches.

I will send a patch.

--
Yu-cheng