From e15a6d6d10ecf60784c64affa0e1ea437ca4f11d Mon Sep 17 00:00:00 2001 From: Bill Nguyen Date: Mon, 28 Sep 2026 14:07:18 +1000 Subject: [PATCH] tool: don't grant PDs their parent's fault EP cap The capDL migration in 9d6b4e0 unintentionally gave child PDs a cap to their parent's fault endpoint. In 2.3.1, this lets a PD send the parent fake faults with arbitrary messages. In 2.3.0 and earlier, it lets a PD receive, and so consume, fault IPCs meant for the parent. Fix this by not granting the cap. Signed-off-by: Bill Nguyen --- tool/microkit/src/capdl/builder.rs | 7 ------- 1 file changed, 7 deletions(-) diff --git a/tool/microkit/src/capdl/builder.rs b/tool/microkit/src/capdl/builder.rs index 4360d8367..a45e82d4b 100644 --- a/tool/microkit/src/capdl/builder.rs +++ b/tool/microkit/src/capdl/builder.rs @@ -77,7 +77,6 @@ const MON_BASE_NOTIFICATION_CAP: u64 = MON_BASE_SCHED_CONTEXT_CAP + 64; // Where caps must be in a PD's CSpace const PD_INPUT_CAP_IDX: u64 = 1; -const PD_FAULT_EP_CAP_IDX: u64 = 2; const PD_VSPACE_CAP_IDX: u64 = 3; const PD_REPLY_CAP_IDX: u64 = 4; // Valid only if the PD is passive. @@ -1201,12 +1200,6 @@ pub fn build_capdl_spec( pd_fault_ep_badge, ); - pd_shadow_cspace.insert_cap_into_microkit_cnode( - &mut spec_container, - PD_FAULT_EP_CAP_IDX as u32, - pd_fault_ep_cap.clone(), - ); - if let Object::Tcb(pd_tcb) = &mut spec_container .get_root_object_mut(pd_shadow_cspace.tcb) .unwrap()