From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.7 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D1EAFC5519F for ; Thu, 19 Nov 2020 01:39:58 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 2C4AC246D1 for ; Thu, 19 Nov 2020 01:39:57 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 2C4AC246D1 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.intel.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 3708E6B0036; Wed, 18 Nov 2020 20:39:57 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 2FB056B005C; Wed, 18 Nov 2020 20:39:57 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 1C36A6B005D; Wed, 18 Nov 2020 20:39:57 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0214.hostedemail.com [216.40.44.214]) by kanga.kvack.org (Postfix) with ESMTP id DB5816B0036 for ; Wed, 18 Nov 2020 20:39:56 -0500 (EST) Received: from smtpin05.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id 826DD180AD82F for ; Thu, 19 Nov 2020 01:39:56 +0000 (UTC) X-FDA: 77499461592.05.spot72_5110b5b2733e Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin05.hostedemail.com (Postfix) with ESMTP id 6BE361826B6B4 for ; Thu, 19 Nov 2020 01:39:56 +0000 (UTC) X-HE-Tag: spot72_5110b5b2733e X-Filterd-Recvd-Size: 5554 Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) by imf22.hostedemail.com (Postfix) with ESMTP for ; Thu, 19 Nov 2020 01:39:55 +0000 (UTC) IronPort-SDR: Qo8yAO8VQJ+8rjyNMenLygaVVUaAEXGoZdUjWEkmUGW9AI17jb8ld9Z1zCzkemnj5cNmz1EQkG Ll19SzR6T6eg== X-IronPort-AV: E=McAfee;i="6000,8403,9809"; a="170433918" X-IronPort-AV: E=Sophos;i="5.77,489,1596524400"; d="scan'208";a="170433918" X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga008.jf.intel.com ([10.7.209.65]) by fmsmga103.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 18 Nov 2020 17:39:54 -0800 IronPort-SDR: FyWagM392snwNLeLy57jhT52y7risszr7gvIqKkdnUCQ2fCR+7Ug/PTQ97Pn3kQzGqz3CsCMqK 4bAGK705/1Uw== X-IronPort-AV: E=Sophos;i="5.77,489,1596524400"; d="scan'208";a="357214172" Received: from hhuan26-mobl1.amr.corp.intel.com (HELO fgctuval.land.test) ([10.209.121.50]) by orsmga008-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-SHA; 18 Nov 2020 17:39:51 -0800 Content-Type: text/plain; charset=iso-8859-15; format=flowed; delsp=yes To: "Andy Lutomirski" , "Dr. Greg" Cc: "Dave Hansen" , "Jarkko Sakkinen" , "X86 ML" , linux-sgx@vger.kernel.org, LKML , "Sean Christopherson" , Linux-MM , "Andrew Morton" , "Matthew Wilcox" , "Jethro Beekman" , "Darren Kenny" , "Andy Shevchenko" , asapek@google.com, "Borislav Petkov" , "Xing, Cedric" , chenalexchen@google.com, "Conrad Parker" , cyhanish@google.com, "Huang, Haitao" , "Huang, Kai" , "Svahn, Kai" , "Keith Moyer" , "Christian Ludloff" , "Neil Horman" , "Nathaniel McCallum" , "Patrick Uiterwijk" , "David Rientjes" , "Thomas Gleixner" , yaozhangx@google.com, "Mikko Ylinen" Subject: Re: [PATCH v40 10/24] mm: Add 'mprotect' hook to struct vm_operations_struct References: <20201104145430.300542-1-jarkko.sakkinen@linux.intel.com> <20201104145430.300542-11-jarkko.sakkinen@linux.intel.com> <20201106174359.GA24109@wind.enjellic.com> <20201107150930.GA29530@wind.enjellic.com> <20201112205819.GA9172@wind.enjellic.com> <5c22300c-0956-48ed-578d-00cf62cb5c09@intel.com> <20201116180023.GA32481@wind.enjellic.com> Date: Wed, 18 Nov 2020 19:39:50 -0600 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: "Haitao Huang" Organization: Intel Corp Message-ID: In-Reply-To: <20201116180023.GA32481@wind.enjellic.com> User-Agent: Opera Mail/1.0 (Win32) X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Mon, 16 Nov 2020 12:00:23 -0600, Dr. Greg wrote: > On Thu, Nov 12, 2020 at 02:41:00PM -0800, Andy Lutomirski wrote: > > Good morning, I hope the week is starting well for everyone. > >> On Thu, Nov 12, 2020 at 1:31 PM Dave Hansen >> wrote: >> > >> > On 11/12/20 12:58 PM, Dr. Greg wrote: >> > > @@ -270,11 +270,10 @@ static int sgx_vma_mprotect(struct >> vm_area_struct *vma, >> > > struct vm_area_struct **pprev, unsigned >> long start, >> > > unsigned long end, unsigned long newflags) >> > > { >> > > - int ret; >> > > + struct sgx_encl *encl = vma->vm_private_data; >> > > >> > > - ret = sgx_encl_may_map(vma->vm_private_data, start, end, >> newflags); >> > > - if (ret) >> > > - return ret; >> > > + if ( test_bit(SGX_ENCL_INITIALIZED, &encl->flags) ) >> > > + return -EACCES; >> > > >> > > return mprotect_fixup(vma, pprev, start, end, newflags); >> > > } >> > >> > This rules out mprotect() on running enclaves. Does that break any >> > expectations from enclave authors, or take away capabilities that >> folks >> > need? > >> It certainly prevents any scheme in which an enclave coordinates >> with the outside world to do W-and-then-X JIT inside. I'm also not >> convinced it has any real effect at all unless there's some magic I >> missed to prevent someone from using mmap(2) to effectively change >> permissions. > > The patch that I posted yesterday addresses the security issue for > both mmap and mprotect by trapping the permission change request at > the level of the sgx_encl_may_map() function. > > With respect to the W-and-then-X JIT issue, the stated purpose of the > driver is to implement basic SGX functionality, which is SGX1 > semantics, it has been stated formally for a year by the developers > themselves that they are not entertaining a driver that addresses any > of the issues associated with non-static memory permissions. > The JIT issue is applicable even to SGX1 platforms. We can do EADD with EPCM.RWX in sec_info and with PTE.RW, EINIT, then mprotect to set PTE.RX when JIT is done. Haitao