From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS,URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B033BC43465 for ; Sat, 19 Sep 2020 00:15:38 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 1A87021582 for ; Sat, 19 Sep 2020 00:15:38 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=amacapital-net.20150623.gappssmtp.com header.i=@amacapital-net.20150623.gappssmtp.com header.b="pTu609JD" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 1A87021582 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=amacapital.net Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 678226B0062; Fri, 18 Sep 2020 20:15:36 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 627CD6B0068; Fri, 18 Sep 2020 20:15:36 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 517B96B006C; Fri, 18 Sep 2020 20:15:36 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0228.hostedemail.com [216.40.44.228]) by kanga.kvack.org (Postfix) with ESMTP id 3D4846B0062 for ; Fri, 18 Sep 2020 20:15:36 -0400 (EDT) Received: from smtpin15.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id EAE4B8249980 for ; Sat, 19 Sep 2020 00:15:35 +0000 (UTC) X-FDA: 77277892230.15.coal77_0b1481a2712f Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin15.hostedemail.com (Postfix) with ESMTP id C3AB21814B0C1 for ; Sat, 19 Sep 2020 00:15:35 +0000 (UTC) X-HE-Tag: coal77_0b1481a2712f X-Filterd-Recvd-Size: 7501 Received: from mail-pl1-f195.google.com (mail-pl1-f195.google.com [209.85.214.195]) by imf21.hostedemail.com (Postfix) with ESMTP for ; Sat, 19 Sep 2020 00:15:35 +0000 (UTC) Received: by mail-pl1-f195.google.com with SMTP id c3so3835372plz.5 for ; Fri, 18 Sep 2020 17:15:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amacapital-net.20150623.gappssmtp.com; s=20150623; h=content-transfer-encoding:from:mime-version:subject:date:message-id :references:cc:in-reply-to:to; bh=JjoTQD9k/YNjHDMyF9HkazPPcdhfN64N/oHVL1W2cNg=; b=pTu609JDpceDsCQlOeQUbpODmjkUkHE2LjL3lRajVYkKFo+X4VzhgldeoEJB/Deex0 iPiwYL+AIk/T655F3Aur+njmUTo4THqYIU6uqPlbdG25ZLz1kx9qxVfr2gjoE84foBLv Juee/4vSKawywOKJTGP+MAQCuu31IAw843xlmEHxXlbYP5KBM0eclk/V48SVRUHv/fmL NhBrYzPE0/6yTWb4WaMu0I7GL0fmsjosndNfI6yC/O8htEiPFvkEyfVJXZ7WE3BOo2fq eUTEtIyyKuE+xeU9fw8fkgvDqWq2nNoU7yYWal1FP54ZvmlkvAQvLYFNIRsmEk0L2u5Q O5SA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:content-transfer-encoding:from:mime-version :subject:date:message-id:references:cc:in-reply-to:to; bh=JjoTQD9k/YNjHDMyF9HkazPPcdhfN64N/oHVL1W2cNg=; b=JeYVLjPvivnTux1cSp45foUnzjRVZPDv8zDDA/uarel5ECxHguNz21m5a8mMGQ5iWg yFx14amUuXpjNQDYXUIhFEsHkVWG3zTcGX9su3O+fkLoTDoxEZWRAo7RApvWn2Sr2KI0 O75YgiXccIpyE5+IbX6ibL1+pOmoBP9d+ml2YvPblO+opCLk6S96l+j40aO5sIuSISGr +P/qw/WIYBPGJy/FuvqyLi5qTghLM1/b7IvRP2+AovqC0aNr39ElplHuzu8EHUhTNGmS OFz5Y95xVtYUWc9juWEErfzOCDFk9zq2X88oiRPSwjLIHhfEIwC4SYCXP3YGdPH3txFx BvIw== X-Gm-Message-State: AOAM532HDFPTIN1zwx8rRJYCV0G3fr7TQPjOJV/q5+ZUYX7ElYs3Fx5R 56G57v/P3uK6M+mfBuDUjNaHYQ== X-Google-Smtp-Source: ABdhPJzgaC77hTi4MmsduZHXcJkp4OVVRQSWL+E7Vd4DtZRT3kuy3vlwB6EmliXRcr7GIOm9JoACRQ== X-Received: by 2002:a17:902:b7c4:b029:d2:173:34ba with SMTP id v4-20020a170902b7c4b02900d2017334bamr8356996plz.57.1600474534178; Fri, 18 Sep 2020 17:15:34 -0700 (PDT) Received: from localhost.localdomain ([2601:646:c200:1ef2:f83f:aa5b:2153:6724]) by smtp.gmail.com with ESMTPSA id g32sm4321339pgl.89.2020.09.18.17.15.33 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Fri, 18 Sep 2020 17:15:33 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable From: Andy Lutomirski Mime-Version: 1.0 (1.0) Subject: Re: [PATCH v38 10/24] mm: Add vm_ops->mprotect() Date: Fri, 18 Sep 2020 17:15:32 -0700 Message-Id: <1B23E216-0229-4BDD-8B09-807256A54AF5@amacapital.net> References: <20200918235337.GA21189@sjchrist-ice> Cc: Andy Lutomirski , Jarkko Sakkinen , X86 ML , linux-sgx@vger.kernel.org, LKML , Linux-MM , Andrew Morton , Matthew Wilcox , Jethro Beekman , Darren Kenny , Andy Shevchenko , asapek@google.com, Borislav Petkov , "Xing, Cedric" , chenalexchen@google.com, Conrad Parker , cyhanish@google.com, Dave Hansen , "Huang, Haitao" , Josh Triplett , "Huang, Kai" , "Svahn, Kai" , Keith Moyer , Christian Ludloff , Neil Horman , Nathaniel McCallum , Patrick Uiterwijk , David Rientjes , Thomas Gleixner , yaozhangx@google.com In-Reply-To: <20200918235337.GA21189@sjchrist-ice> To: Sean Christopherson X-Mailer: iPhone Mail (18A373) X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: > On Sep 18, 2020, at 4:53 PM, Sean Christopherson wrote: >=20 > =EF=BB=BFOn Fri, Sep 18, 2020 at 08:09:04AM -0700, Andy Lutomirski wrote: >>> On Tue, Sep 15, 2020 at 4:28 AM Jarkko Sakkinen >>> wrote: >>>=20 >>> From: Sean Christopherson >>>=20 >>> Add vm_ops()->mprotect() for additional constraints for a VMA. >>>=20 >>> Intel Software Guard eXtensions (SGX) will use this callback to add two >>> constraints: >>>=20 >>> 1. Verify that the address range does not have holes: each page address >>> must be filled with an enclave page. >>> 2. Verify that VMA permissions won't surpass the permissions of any encl= ave >>> page within the address range. Enclave cryptographically sealed >>> permissions for each page address that set the upper limit for possibl= e >>> VMA permissions. Not respecting this can cause #GP's to be emitted. >=20 > Side note, #GP is wrong. EPCM violations are #PFs. Skylake CPUs #GP, but= > that's technically an errata. But this isn't the real motivation, e.g. > userspace can already trigger #GP/#PF by reading/writing a bad address, SG= X > simply adds another flavor. >=20 >> It's been awhile since I looked at this. Can you remind us: is this >> just preventing userspace from shooting itself in the foot or is this >> something more important? >=20 > Something more important, it's used to prevent userspace from circumventin= g > a noexec filesystem by loading code into an enclave, and to give the kerne= l the > option of adding enclave specific LSM policies in the future. >=20 > The source file (if one exists) for the enclave is long gone when the encl= ave > is actually mmap()'d and mprotect()'d. To enforce noexec, the requested > permissions for a given page are snapshotted when the page is added to the= > enclave, i.e. when the enclave is built. Enclave pages that will be execu= table > must originate from an a MAYEXEC VMA, e.g. the source page can't come from= a > noexec file system. >=20 > The ->mprotect() hook allows SGX to reject mprotect() if userspace is decl= aring > permissions beyond what are allowed, e.g. trying to map an enclave page wi= th > EXEC permissions when the page was added to the enclave without EXEC. >=20 > Future LSM policies have a similar need due to vm_file always pointing at > /dev/sgx/enclave, e.g. policies couldn't be attached to a specific enclave= . > ->mprotect() again allows enforcing permissions at map time that were chec= ked > at enclave build time, e.g. via an LSM hook. >=20 > Deferring ->mprotect() until LSM support is added (if it ever is) would be= > problematic due to SGX2. With SGX2, userspace can extend permissions of a= n > enclave page (for the CPU's EPC Map entry, not the kernel's page tables) > without bouncing through the kernel. Without ->mprotect () enforcement. > userspace could do EADD(RW) -> mprotect(RWX) -> EMODPE(X) to gain W+X. We= > want to disallow such a flow now, i.e. force userspace to do EADD(RW,X), s= o > that the hypothetical LSM hook would have all information at EADD(), i.e. > would be aware of the EXEC permission, without creating divergent behavior= > based on whether or not an LSM is active. That=E2=80=99s what I thought. Can we get this in the changelog?=