Message-ID: <573e0836-6ac2-30a4-0c21-d4763707ac96@intel.com>
Date:   Thu, 6 Jan 2022 09:46:06 -0800
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101
 Firefox/91.0 Thunderbird/91.4.0
Subject: Re: [PATCH 05/25] x86/sgx: Introduce runtime protection bits
Content-Language: en-US
To:     Jarkko Sakkinen <jarkko@kernel.org>
CC:     Andy Lutomirski <luto@kernel.org>, <dave.hansen@linux.intel.com>,
        <tglx@linutronix.de>, <bp@alien8.de>, <mingo@redhat.com>,
        <linux-sgx@vger.kernel.org>, <x86@kernel.org>, <seanjc@google.com>,
        <kai.huang@intel.com>, <cathy.zhang@intel.com>,
        <cedric.xing@intel.com>, <haitao.huang@intel.com>,
        <mark.shanahan@intel.com>, <hpa@zytor.com>,
        <linux-kernel@vger.kernel.org>
References: <cover.1638381245.git.reinette.chatre@intel.com>
 <2f6b04dd8949591ee6139072c72eb93da3dd07b0.1638381245.git.reinette.chatre@intel.com>
 <db9b7bc9-fdca-4dd2-2c3f-3b7354c165bb@kernel.org> <YawAWmodeNaUbzV8@iki.fi>
 <a1b14f33-5142-8cab-3b5f-4cc79b62091e@intel.com>
 <a24bc46e4ba8a69938a7f73012019ce0f61005c2.camel@kernel.org>
 <f6a55943-13ef-41ef-609a-6406cffef513@intel.com> <YcsklLw1uFyppSji@iki.fi>
From:   Reinette Chatre <reinette.chatre@intel.com>
In-Reply-To: <YcsklLw1uFyppSji@iki.fi>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?cmV6ekVFQ21hUk80clBkOW5EMnFXTHRrbjBqSXRJTEF3K0xzazM2NzEzc29s?=
 =?utf-8?B?L2pLckd6U1U3WEhWaHJ2dGZHVmJTT1NhYVVBWEx5TmhyV3ZSdG85eEp3ZkV6?=
 =?utf-8?B?SXhYMGNxVkdQMTdnb01BcHNoKzR2SUdRdmhvdVBmbnZXMjZqVSs3L0VNdFJR?=
 =?utf-8?B?V3pjY3Z2UlBtaUNhaGc5bzdNclpwbTJqN2Y4NHMrektiUTh1bG9JUVYvUHQ2?=
 =?utf-8?B?RG41dzJPMmRqVVV6QkNHK082RStrbmFBcnFkTHBTWkwwdlJVZHlMbkFZaXRG?=
 =?utf-8?B?aUhvTHJWTUFicW5ueGRhREcrTzRCM2QvRlBMYndkMXVDMUtiNmx1NnA2VXl3?=
 =?utf-8?B?T2t5STNvNDRKck9wODVWbWtUbXN3MzJpWi9qWU0vOXB0a2Z6dUxFNlRPeXJE?=
 =?utf-8?B?OTZmT0pOR3hjNWlLeFhDZUZqUGhuWUxDbmtTRTEvaUtObFVkdmxEUTdzN0hJ?=
 =?utf-8?B?U1QwSkI2bEFSNUVDZzUrbmVrM3hRZDlyODdnYkEwaWZzZkFPVElWY0Eyd3gw?=
 =?utf-8?B?bzI5YWw4YTNHOFl1Z1dVbnk3SFQweHgwMDFvMGh4ZXZ0MmpyVlFtT0dWMHRV?=
 =?utf-8?B?UWdEMGQzWTdGZGxCUHRlbXlTSDJNRDQ2cHBVNGRtYlZBZTBMNHNwbGppMGZm?=
 =?utf-8?B?SGY3ZXpmbC8xYm1ablVXem0zbEhCZjdIN1prQTR3dmNUUzFjdnBBZ01qa2V4?=
 =?utf-8?B?MngyY2FuT2NRQklPaWE3TnlnS096b3RIcjRERGd3bEY4bmU5TDAwNVM5WXFK?=
 =?utf-8?B?dmFWTDRPZ1NjK2hQaDR0TWJGTm8yOEJXT2NCQWRHOTRmNnhudkdsaHRZenpu?=
 =?utf-8?B?Q3hTSlJjcWp2RElwWUVpRmMyNGN6ZHl6RDlxQmx0Q2E3dytvOGZNOXlKbWxx?=
 =?utf-8?B?N2RNeERpcjlsQ1V4RkU4WnJNTlhlK0RIQjNqSklndCtMNU03MmxvYTVleHhr?=
 =?utf-8?B?bFZrNUVRS1QvcC95YWxkZlgwcXdkaWxDQVlDM2U5T0o1OVZINlRlKzdld0NW?=
 =?utf-8?B?Uyt2YVV6b1U4bTBtTDlhaDFJY2Fmckl4NUVPYjlYb3ZWL1k4cWFBa3F1bFlh?=
 =?utf-8?B?bW8wUkJRR3JaaVdiWk0zdVcvMlliNzRJTHovVThuck1oNnBMZEsyR0dDZmM4?=
 =?utf-8?B?UzZXSG1hRVpSaUwyZFF2cE5ZZXJDUW1CcWdnTFo1Y0Vvei9BRTBWQVNyQlJ3?=
 =?utf-8?B?bGZzQ1B3TEZMUkZ0T0M3T1hnR2dZclRiY0R0WGR1YVRXb212ZGEwSEY2MzVZ?=
 =?utf-8?B?dzlubWZyV1dOU3pLRzdrdXk2a2U0VHB3MzNiVDFaT1lxU2pSS3FiOFYzYi85?=
 =?utf-8?B?SW9QZlpBdU9kRVJpcDhDYzdFYTk0aUxjdi9wSVRkN0l6a0VqSXowM29IdDNo?=
 =?utf-8?B?bWJGdG9wNzhJYUNqaDYwdndZYTF5d2h5aHZVK2grcmY4OUhTQWhjdUFRTHQw?=
 =?utf-8?B?djlaMGxGcTZVMEVidXp6OVRBdk45V0E3T2k3R1pRL01MUGEvb013Tks1eXpE?=
 =?utf-8?B?SEFwZzBzYU9PbjJWNlR5VDhkemFJT2R6MGlwZG42aktPQ3c2MWFzT01ZWWFl?=
 =?utf-8?B?MFl5U255YmlNSng3QXc2TnV5NC9NODVBVTdhSTVkUGVMdkdKS3EyZDdRQ1J2?=
 =?utf-8?B?SFVLeXIxZjhIMng2NC9pQkxIeHhpNll6VXdMdEVyQTlDWEtWRFFxdmV5S1BI?=
 =?utf-8?B?Y241U3NmQ1NZTjF4OGxhMHBsT0tJVm44TVdjUW5PZk9KQzVjYnZJQWt2K282?=
 =?utf-8?B?T3ZJUXppZUZacW10R2YyL2djZU5pL3hGLy9LVUczakQrM2VJZ2szUTZGaC81?=
 =?utf-8?B?T0FLNzNDaDlWWEQ5ZWxOVWQ4ZkJhTStlLzVMc3hpK0FkTDlXamd6VUpLOWFL?=
 =?utf-8?B?VlpydDJKeWh4L0ZOQlR2Z1luaE5SVllzNFFWRDNSeEhVK1QrcUxYNUlId2V4?=
 =?utf-8?B?YkhzUlRTQ0hpS0UraFlacktmdU45MVNFeEtWRGVDeHc0SFlxeTdEemJSenFF?=
 =?utf-8?B?NFludUpVT1UvSUdRYVVwa2gwS0tXZ2VDdVhRcVBHcWNnMHVWK1NGY1F1N1NG?=
 =?utf-8?B?eWlPMWcyUnN6K1V4VG1YdTJ0a0RSUnZnVUc0d0h0T2xJaU1RaFVNNFRqUFB0?=
 =?utf-8?B?MHFEeXpyQ0JqSDhEenFnYzkwY295Uk9aUithM0VaQ3ZzM1ZBeEx0T1BLLzNv?=
 =?utf-8?B?cmdrR28vQkV4M1g5VStTcmJIMG1aL2xlMW5ZczRlekVUT05kaEVFVlBrbDdr?=
 =?utf-8?B?SVVqQVNZdEtGeVdqc2p2ejNHMG9RPT0=?=
X-MS-Exchange-CrossTenant-Network-Message-Id: 14280606-b965-42d4-39b3-08d9d13c6cd6
X-MS-Exchange-CrossTenant-AuthSource: BN0PR11MB5744.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 06 Jan 2022 17:46:10.8544
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: QMJDBdFLuk3uK2WmHEcI2o3vYAQn7EMdLipm39xydIpIG23EK90AlQCfnNLy6tVcH8aYV8SDVzAwFVTcz8iN48ubJjyvYG4kTR+CTBrF+I4=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN7PR11MB2738
X-OriginatorOrg: intel.com
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Hi Jarkko,

On 12/28/2021 6:52 AM, Jarkko Sakkinen wrote:
> On Mon, Dec 13, 2021 at 02:10:17PM -0800, Reinette Chatre wrote:
>> Hi Jarkko,
>>
>> On 12/10/2021 11:42 PM, Jarkko Sakkinen wrote:
>>> On Mon, 2021-12-06 at 13:20 -0800, Reinette Chatre wrote:
>>>>> This is a valid question. Since EMODPE exists why not just make things for
>>>>> EMODPE, and ignore EMODPR altogether?
>>>>>
>>>>
>>>> I believe that we should support the best practice of principle of least
>>>> privilege - once a page no longer needs a particular permission there
>>>> should be a way to remove it (the unneeded permission).
>>>
>>> What if EMODPR was not used at all, since EMODPE is there anyway?
>>
>> EMODPR and EMODPE are not equivalent.
>>
>> EMODPE can only be used to "extend"/relax permissions while EMODPR can only
>> be used to restrict permissions.
>>
>> Notice in the EMODPE instruction reference of the SDM:
>>
>> (* Update EPCM permissions *)
>> EPCM(DS:RCX).R := EPCM(DS:RCX).R | SCRATCH_SECINFO.FLAGS.R;
>> EPCM(DS:RCX).W := EPCM(DS:RCX).W | SCRATCH_SECINFO.FLAGS.W;
>> EPCM(DS:RCX).X := EPCM(DS:RCX).X | SCRATCH_SECINFO.FLAGS.X;
>>
>> So, when using EMODPE it is only possible to add permissions, not remove
>> permissions.
>>
>> If a user wants to remove permissions from an EPCM page it is only possible
>> when using EMODPR. Notice in its instruction reference found in the SDM how
>> it in turn can only be used to restrict permissions:
>>
>> (* Update EPCM permissions *)
>> EPCM(DS:RCX).R := EPCM(DS:RCX).R & SCRATCH_SECINFO.FLAGS.R;
>> EPCM(DS:RCX).W := EPCM(DS:RCX).W & SCRATCH_SECINFO.FLAGS.W;
>> EPCM(DS:RCX).X := EPCM(DS:RCX).X & SCRATCH_SECINFO.FLAGS.X;
> 
> OK, so the question is: do we need both or would a mechanism just to extend
> permissions be sufficient?

I do believe that we need both in order to support pages having only
the permissions required to support their intended use during the time the
particular access is required. While technically it is possible to grant
pages all permissions they may need during their lifetime it is safer to
remove permissions when no longer required.

Reinette