lkml.org 
[lkml]   [2020]   [Sep]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH v38 10/24] mm: Add vm_ops->mprotect()'
On Fri, Sep 18, 2020 at 08:09:04AM -0700, Andy Lutomirski wrote:
> On Tue, Sep 15, 2020 at 4:28 AM Jarkko Sakkinen
> <jarkko.sakkinen@linux.intel.com> wrote:
> >
> > From: Sean Christopherson <sean.j.christopherson@intel.com>
> >
> > Add vm_ops()->mprotect() for additional constraints for a VMA.
> >
> > Intel Software Guard eXtensions (SGX) will use this callback to add two
> > constraints:
> >
> > 1. Verify that the address range does not have holes: each page address
> > must be filled with an enclave page.
> > 2. Verify that VMA permissions won't surpass the permissions of any enclave
> > page within the address range. Enclave cryptographically sealed
> > permissions for each page address that set the upper limit for possible
> > VMA permissions. Not respecting this can cause #GP's to be emitted.
>
> It's been awhile since I looked at this. Can you remind us: is this
> just preventing userspace from shooting itself in the foot or is this
> something more important?
>
> --Andy

Haitao found this:

https://patchwork.kernel.org/patch/10978327/

The way I understand it, for an LSM hook it makes sense that the
mprotect() can deduce a single permission for an enclave address range.
With those constraints it is possible.

/Jarkko

\
 
 \ /
  Last update: 2020-09-19 01:26    [W:0.734 / U:0.660 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site