Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Message-ID: <e2d675f7-319b-4816-ad5e-4154cbf69f2b@intel.com>
Date:   Fri, 14 Jan 2022 16:41:59 -0800
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101
 Firefox/91.0 Thunderbird/91.5.0
Subject: Re: [PATCH 05/25] x86/sgx: Introduce runtime protection bits
Content-Language: en-US
To:     Jarkko Sakkinen <jarkko@kernel.org>
CC:     Nathaniel McCallum <nathaniel@profian.com>,
        Haitao Huang <haitao.huang@linux.intel.com>,
        Andy Lutomirski <luto@kernel.org>,
        <dave.hansen@linux.intel.com>, <tglx@linutronix.de>,
        <bp@alien8.de>, <mingo@redhat.com>, <linux-sgx@vger.kernel.org>,
        <x86@kernel.org>, <seanjc@google.com>, <kai.huang@intel.com>,
        <cathy.zhang@intel.com>, <cedric.xing@intel.com>,
        <haitao.huang@intel.com>, <mark.shanahan@intel.com>,
        <hpa@zytor.com>, <linux-kernel@vger.kernel.org>
References: <YdzjEzjF0YKn+pZ6@iki.fi>
 <4195402f-cbf9-bc75-719d-22cea8e36e60@intel.com> <Yd9pMq4lUy56B+50@iki.fi>
 <Yd9qmMx7NO450mzZ@iki.fi>
 <CAHAy0tRi2q+wG+yBttq0FYeK-5wUAoK_=ZCtWsfQf0m8oPc1-w@mail.gmail.com>
 <168fb2c9-de3f-384a-bb17-ab84db2cf533@intel.com> <YeHwzwnfsUcxiNbw@iki.fi>
 <b0e5c1fc-aa6d-4e26-c18b-d93d93c2131a@intel.com> <YeIEKayEUidj0Dlb@iki.fi>
 <6e1cb295-b86e-ae09-2cf0-cfefd1a10e65@intel.com> <YeIU6e6wetrifn+b@iki.fi>
From:   Reinette Chatre <reinette.chatre@intel.com>
In-Reply-To: <YeIU6e6wetrifn+b@iki.fi>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?c2M5MFBZRHgzb1RjMkNYU1BtRVVnampmRVNuelR1ODBLeFBLUG5zeFNrN1JK?=
 =?utf-8?B?cXNNWC95RkhFeVZtZjBLS2Z6KzdwMkRCMUgweW5UMy9Yb3p6ZElVYkJDNGRK?=
 =?utf-8?B?bnRyaldtaUZ5aDhUQytTSmNGQ3BLRU5xek13V05KaEpTMFkyaDdwc3BTSEZq?=
 =?utf-8?B?b3dwNzh0N2hEQlV6bWtVbFZPWHgwY3hQV2RreWVHNzA2bmxXYWdrNDhydFgx?=
 =?utf-8?B?aTQ5L3VPcmZ6M3ExU0JQNzF1N3J1L3Izc3RnMnBrem51blVJaTFBeFB2bEQw?=
 =?utf-8?B?b015TGsxTTI4dDJnckdmOFB2TFZhVWtFalFrUEZTSlQrMzRrUUZjWmhkSUtB?=
 =?utf-8?B?SkhJbUFLTTExcWkvNkEwS0FTZGpJSkpYSnUzWlN5OFQ5R3F5ekdQY2JyczZi?=
 =?utf-8?B?YVAwMlp3S0lld2xhVGIzSTJCV21QUm8rYmN5QmRqTHdTaTNVNEE3bUZ5Qyts?=
 =?utf-8?B?SDJ3VW9IQ0R5Q1RGRTBkRlE3eUxuU2JaYjVLYnhHdktYTGZyRFVyOUJMalBi?=
 =?utf-8?B?RTRMcUJ4ZkVCd0c0WStLZWVNVm14MEk5TDMzY2FmeGNIeWM3aUExcmdoei91?=
 =?utf-8?B?cWI2YklXZ2F6VjdURVdwOTNCRGhET2xvU0Z3SUJMSkErckRqUzNuQkQ0RlAw?=
 =?utf-8?B?TmVFbTV1VnNzOFZ3ejZFRVRTMXcxNUdRc2t2TUJBS1hIcHcvc21uNzJtcFE4?=
 =?utf-8?B?VHdXYURaTGl0clRmR0xYM3Q4NWNqQm90T2YrSHYxWmhNbXRHdVpYRmtOeFpO?=
 =?utf-8?B?djVLYXp6eDZEa1lCTVBLRTc1aHJCOVQzU0pLSU1TTG1ZNk8xaC9xNjkxaEw0?=
 =?utf-8?B?TVNzVlZ0U0U5dFRRUWtJWXNNK0QrU01jMnJIRENQVS8rL0xWRkRvQ0tMSEwz?=
 =?utf-8?B?MTNxbDJZRXNOcGFGL0N2eTlEWDFHNTNwb0pUbmVqeGZiY3Z0WlpPQXMrRmUy?=
 =?utf-8?B?UGp5c0FPUk1JYTR2NS9QUFN6b1ZQSWI0djN3UnVXWU9YamJZRkVZNE83VG5k?=
 =?utf-8?B?V1M1QjJJWi9KRmdvdktmdnVMZXlxNmhYN3psRzlYMWJCOHVhd0FVS0pwNlBM?=
 =?utf-8?B?OWYzNGJmZ2o3L2FqTm1rczUyOHV6TWxaZXcra1RUUWFxdzZoUkR1WHNqSGhW?=
 =?utf-8?B?QU5YN0pSbGF6ZmRjTkNzcHNvYWZNYjBnYUN4NEx0Z25RaEMwM1hhd0hxK2lZ?=
 =?utf-8?B?ZzVvNFRleHk2dDFKRWpoWVhHZjhOb0wwM2NUbEc5YWxndG0reWd3WU5tK3M3?=
 =?utf-8?B?a2ZKTUdFYzVmMjRHRDloZlJXM2ZGZUZXNkxpM0lOMFptQk1NVlhyODZ4OXNQ?=
 =?utf-8?B?bmdIQlpQTjhuSUNUeXBzRS9DeG8wZ2lLakxJWG85OG5aR3hFSHFuUXZJS0cx?=
 =?utf-8?B?dFVvYXNlRnMvaUpaRXdra3VXL0s4b2JvUi9venllSHVmajluYzdYMXY3bGl1?=
 =?utf-8?B?Ykh0Vi9INEV5eTZDQmprQ3pFSW9PNVFxb3hhQnhOQ3dDYmw2ekNYVm9abDBi?=
 =?utf-8?B?TlJpVlVFRkdJU1htd0F4WHhSaVhFdTJRQmM2aFlHT2pBSy82S0VZZFdCZzI5?=
 =?utf-8?B?ZFZyRjhFVm9JcGNRSHA1VUlFWTFGdXVGRmdPSjBaSVdLNmh4bjRxeXJLV1Bm?=
 =?utf-8?B?ZGZOc1FTSUxaRDNENFdqU21VNXFxd0lrNTdHMEcwVVBMaVJjejl4cmZpSkJz?=
 =?utf-8?B?V0gxTno3a0xyUXUwUTFabkF1akJWOXljNTR1a3lSaEt3VUlXaDNMWnB1cmx2?=
 =?utf-8?B?NWhQZXRFemhtTTMrd1N6L3BSYlA1aWpuYTYzT3lnOVNSc0drS2NpRG5qNGla?=
 =?utf-8?B?aFdvRHhUaE5GQzIxOGFWbkFPaGNiR2hpTSswQ29BNXZSSUZTUDFMTDBlSS9X?=
 =?utf-8?B?MFR5TndUclF3cTRaT2RNTjRTWDRvdnBaN1RsdzVDN1lXbVZROHAxNmNJY1pB?=
 =?utf-8?B?MjhqTnR2aHI5dFhqRFp3YU1XejhQdXdzdXJ5QXFZV1BrcG5kcE41V3dlclYz?=
 =?utf-8?B?VjFaMFUrcjQ0VU1ZQkJ5am0vOXhVNnIxbXVSWHdCLzcwTmFCSjgrVHZONDFl?=
 =?utf-8?B?dUg1d2NWTDlvcnBwUHFNVDhTbG9taWpsWEZweUQyeWNNQ0c4YzRrNTBGdUtP?=
 =?utf-8?B?N0NrbWhGY0xHbjNyWmxqdy9Ldm1JTS9IRm83L1dRa1BESm1sQmhzdXRscHJr?=
 =?utf-8?B?VUhaeWJyNFlpL0tMaUZlZWFXU24vRktiTFVwZTZrSEkxTXVyakljYktYaFZj?=
 =?utf-8?Q?iZWzcJEDSSWvu5JkW6Ovs0Vvc88pxg63Hkv+qiHt2c=3D?=
X-MS-Exchange-CrossTenant-Network-Message-Id: 75d4a5a4-03c7-49d6-eaac-08d9d7bfda01
X-MS-Exchange-CrossTenant-AuthSource: BN0PR11MB5744.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Jan 2022 00:42:04.8107
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: ixRNOUcLKztsQW49h4We9AX+sEaSom1IOQYiYOGcsNcp4kpgytCFMzjoX4jxB8QI1gETdscXFYsDiGpJv3gC9KbUTiB6/q8tRWKLMwAMcXE=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR11MB3068
X-OriginatorOrg: intel.com
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Hi Jarkko,

On 1/14/2022 4:27 PM, Jarkko Sakkinen wrote:
> On Fri, Jan 14, 2022 at 04:01:33PM -0800, Reinette Chatre wrote:
>> Hi Jarkko,
>>
>> On 1/14/2022 3:15 PM, Jarkko Sakkinen wrote:
>>> On Fri, Jan 14, 2022 at 03:05:21PM -0800, Reinette Chatre wrote:
>>>> Hi Jarkko,
>>>
>>> How enclave can check a page range that EPCM has the expected permissions?
>>
>> Only way to change EPCM permissions from outside enclave is to run ENCLS[EMODPR]
>> that needs to be accepted from within the enclave via ENCLU[EACCEPT]. At that
>> time the enclave provides the expected permissions and that will fail
>> if there is a mismatch with the EPCM permissions (SGX_PAGE_ATTRIBUTES_MISMATCH).
> 
> This is a very valid point but that does make the introspection possible
> only at the time of EACCEPT.
> 
> It does not give tools for enclave to make sure that EMODPR-ETRACK dance
> was ever exercised.

Could you please elaborate? EACCEPT is available to the enclave as a tool
and it would fail if ETRACK was not completed (error SGX_NOT_TRACKED).

Here is the relevant snippet from the SDM from the section where it
describes EACCEPT:

IF (Tracking not correct)
    THEN
        RFLAGS.ZF := 1;
        RAX := SGX_NOT_TRACKED;
        GOTO DONE;
FI;

Reinette