x86/vdso: Do not attempt to fixup #DB or #BP exceptions
Subsystems (4)
PATCH 1/1 x86/vdso: Do not attempt to fixup #DB or #BP exceptions
Do not fixup #DB or #BP exceptions that are reported on the SGX vDSO's ENCLU, as it's impossible to determine whether or not the exception originated from within an enclave, e.g. a #DB in an enclave will look identical to a #DB on the ENCLU itself. Even if hardware provided a magic flag to identify enclave exceptions, #DB still has scenarios where the intended recipient is ambiguous, e.g. a data breakpoint encountered in the enclave but on an address outside of the enclave, a breakpoint encountered in the enclave and a simultaneouls code breakpoint on ENCLU, and so on and so forth.
An alternative solution would be to simply not call the vDSO fixup routine for #DB or #BP. Rejecting fixup from within vDSO explicitly documents that #DB/#BP are intentionally skipped and provides a single location for determining what exceptions are indeed handled by vDSO fixup.
--- arch/x86/entry/vdso/extable.c | 9 +++++++++ 1 file changed, 9 insertions(+)
arch/x86/entry/vdso/extable.c +9 -0
@@ -2,6 +2,7 @@#include <linux/err.h> #include <linux/mm.h> #include <asm/current.h> +#include <asm/traps.h> #include <asm/vdso.h> struct vdso_exception_table_entry {
@@ -16,6 +17,14 @@ bool fixup_vdso_exception(struct pt_regs *regs, int trapnr,unsigned int nr_entries, i;unsigned long base; +/* +* Do not attempt to fixup #DB or #BP. It's impossible to identify +* whether or not a #DB/#BP originated from within an SGX enclave and +* SGX enclaves are currently the only use case for vDSO fixup. +*/ +if (trapnr ==X86_TRAP_DB || trapnr ==X86_TRAP_BP ) +return false; +if (!current->mm->context.vdso)return false;
Signature · 1 line
2.22.0
Quoted 9 lines · Sean Christopherson
Do not fixup #DB or #BP exceptions that are reported on the SGX vDSO's > ENCLU, as it's impossible to determine whether or not the exception originated from within an enclave, e.g. a #DB in an enclave will look
identical to a #DB on the ENCLU itself. Even if hardware provided a
magic flag to identify enclave exceptions, #DB still has scenarios where
the intended recipient is ambiguous, e.g. a data breakpoint encountered
in the enclave but on an address outside of the enclave, a breakpoint
encountered in the enclave and a simultaneouls code breakpoint on ENCLU,
and so on and so forth.
Quoted 5 lines
An alternative solution would be to simply not call the vDSO fixup routine for #DB or #BP. Rejecting fixup from within vDSO explicitly documents that #DB/#BP are intentionally skipped and provides a single location for determining what exceptions are indeed handled by vDSO fixup.
I think this is better and good use of the boolean return value i.e. consolidate the decision to a single place.
Quoted 36 lines
Signed-off-by Sean Christopherson <[email protected]>--- arch/x86/entry/vdso/extable.c | 9 +++++++++ 1 file changed, 9 insertions(+)arch/x86/entry/vdso/extable.c +9
-0@@ -2,6 +2,7 @@#include <linux/err.h> #include <linux/mm.h> #include <asm/current.h> +#include <asm/traps.h> #include <asm/vdso.h> struct vdso_exception_table_entry {@@ -16,6 +17,14 @@ bool fixup_vdso_exception(struct pt_regs *regs, int trapnr,unsigned int nr_entries, i;unsigned long base; +/* +* Do not attempt to fixup #DB or #BP. It's impossible to identify +* whether or not a #DB/#BP originated from within an SGX enclave and +* SGX enclaves are currently the only use case for vDSO fixup. +*/ +if (trapnr ==X86_TRAP_DB || trapnr ==X86_TRAP_BP ) +return false; +if (!current->mm->context.vdso)return false;Signature · 1 line
2.22.0
/Jarkko