From patchwork Wed Nov 18 17:18:24 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: thermal-bot for Julien Panis X-Patchwork-Id: 11915483 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.5 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 974F9C5519F for ; Wed, 18 Nov 2020 17:18:31 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id D7674248B8 for ; Wed, 18 Nov 2020 17:18:30 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="HmXLRPvL"; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="uOgaBK5v" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org D7674248B8 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linutronix.de Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id E06DF6B008A; Wed, 18 Nov 2020 12:18:29 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id DB5EC6B008C; Wed, 18 Nov 2020 12:18:29 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id CF4266B0092; Wed, 18 Nov 2020 12:18:29 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0099.hostedemail.com [216.40.44.99]) by kanga.kvack.org (Postfix) with ESMTP id A45446B008A for ; Wed, 18 Nov 2020 12:18:29 -0500 (EST) Received: from smtpin23.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id 40A68181AEF2A for ; Wed, 18 Nov 2020 17:18:29 +0000 (UTC) X-FDA: 77498197938.23.brush43_5306a632733b Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin23.hostedemail.com (Postfix) with ESMTP id 24A5B37608 for ; Wed, 18 Nov 2020 17:18:29 +0000 (UTC) X-HE-Tag: brush43_5306a632733b X-Filterd-Recvd-Size: 6677 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) by imf43.hostedemail.com (Postfix) with ESMTP for ; Wed, 18 Nov 2020 17:18:27 +0000 (UTC) Date: Wed, 18 Nov 2020 17:18:24 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1605719905; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=D8nvGAloLJJ+ql8yUirlpnKjefPIphkSY9wZqt7KbrU=; b=HmXLRPvL6PMY28DoLg8vFxmeMzLmDS/aanFDrDA0oHMsTV0kFY2TOMoz+uE89FHthZwDMm UsoYbrgWzukpzd20d2fqUbL/0+IflPX/17U8Oih0IJfb5rH9oJBZdCrKtupnd3p0bTLR4Y eBRQ2ecI/5ECsT6YEIzCPgycjWE3fm4kXb7ky2eKX1FOyMNg2k83e+0RdG46q5Y3h7BpMI g4g9zjhsrpopCMTFnJgyiyOnxxYpiVIgIYJK5lnPU6gPiw4X7Xt5+hEFlvoJAOV1YkyBl0 c1KUsEj5Fl5QgHm2i9zpzng31rKERTbn7rEha0QYEIdOUw9LJkbYJvqbvC1R5g== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1605719905; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=D8nvGAloLJJ+ql8yUirlpnKjefPIphkSY9wZqt7KbrU=; b=uOgaBK5vemufPZWUYT3IMXINBNMLwhm00NKsUyMuSTibbrQKJWLHEhQ2Jv5isvjWNOh0Un Xp9W/wmlEYr5dnCQ== From: "tip-bot2 for Sean Christopherson" Reply-to: linux-kernel@vger.kernel.org To: linux-tip-commits@vger.kernel.org Subject: [tip: x86/sgx] mm: Add 'mprotect' hook to struct vm_operations_struct Cc: Sean Christopherson , Jarkko Sakkinen , Borislav Petkov , Jethro Beekman , Dave Hansen , Mel Gorman , Hillf Danton , linux-mm@kvack.org, x86@kernel.org, linux-kernel@vger.kernel.org In-Reply-To: <20201112220135.165028-11-jarkko@kernel.org> References: <20201112220135.165028-11-jarkko@kernel.org> MIME-Version: 1.0 Message-ID: <160571990472.11244.16622523428160178953.tip-bot2@tip-bot2> Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails X-Bogosity: Ham, tests=bogofilter, spamicity=0.000684, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: The following commit has been merged into the x86/sgx branch of tip: Commit-ID: 95bb7c42ac8a94ce3d0eb059ad64430390351ccb Gitweb: https://git.kernel.org/tip/95bb7c42ac8a94ce3d0eb059ad64430390351ccb Author: Sean Christopherson AuthorDate: Fri, 13 Nov 2020 00:01:21 +02:00 Committer: Borislav Petkov CommitterDate: Tue, 17 Nov 2020 14:36:14 +01:00 mm: Add 'mprotect' hook to struct vm_operations_struct Background ========== 1. SGX enclave pages are populated with data by copying from normal memory via ioctl() (SGX_IOC_ENCLAVE_ADD_PAGES), which will be added later in this series. 2. It is desirable to be able to restrict those normal memory data sources. For instance, to ensure that the source data is executable before copying data to an executable enclave page. 3. Enclave page permissions are dynamic (just like normal permissions) and can be adjusted at runtime with mprotect(). This creates a problem because the original data source may have long since vanished at the time when enclave page permissions are established (mmap() or mprotect()). The solution (elsewhere in this series) is to force enclave creators to declare their paging permission *intent* up front to the ioctl(). This intent can be immediately compared to the source data’s mapping and rejected if necessary. The “intent” is also stashed off for later comparison with enclave PTEs. This ensures that any future mmap()/mprotect() operations performed by the enclave creator or done on behalf of the enclave can be compared with the earlier declared permissions. Problem ======= There is an existing mmap() hook which allows SGX to perform this permission comparison at mmap() time. However, there is no corresponding ->mprotect() hook. Solution ======== Add a vm_ops->mprotect() hook so that mprotect() operations which are inconsistent with any page's stashed intent can be rejected by the driver. Signed-off-by: Sean Christopherson Co-developed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen Signed-off-by: Borislav Petkov Acked-by: Jethro Beekman Acked-by: Dave Hansen Acked-by: Mel Gorman Acked-by: Hillf Danton Cc: linux-mm@kvack.org Link: https://lkml.kernel.org/r/20201112220135.165028-11-jarkko@kernel.org --- include/linux/mm.h | 7 +++++++ mm/mprotect.c | 7 +++++++ 2 files changed, 14 insertions(+) diff --git a/include/linux/mm.h b/include/linux/mm.h index db6ae4d..1813fa8 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -559,6 +559,13 @@ struct vm_operations_struct { void (*close)(struct vm_area_struct * area); int (*split)(struct vm_area_struct * area, unsigned long addr); int (*mremap)(struct vm_area_struct * area); + /* + * Called by mprotect() to make driver-specific permission + * checks before mprotect() is finalised. The VMA must not + * be modified. Returns 0 if eprotect() can proceed. + */ + int (*mprotect)(struct vm_area_struct *vma, unsigned long start, + unsigned long end, unsigned long newflags); vm_fault_t (*fault)(struct vm_fault *vmf); vm_fault_t (*huge_fault)(struct vm_fault *vmf, enum page_entry_size pe_size); diff --git a/mm/mprotect.c b/mm/mprotect.c index 56c02be..ab70902 100644 --- a/mm/mprotect.c +++ b/mm/mprotect.c @@ -616,9 +616,16 @@ static int do_mprotect_pkey(unsigned long start, size_t len, tmp = vma->vm_end; if (tmp > end) tmp = end; + + if (vma->vm_ops && vma->vm_ops->mprotect) + error = vma->vm_ops->mprotect(vma, nstart, tmp, newflags); + if (error) + goto out; + error = mprotect_fixup(vma, &prev, nstart, tmp, newflags); if (error) goto out; + nstart = tmp; if (nstart < prev->vm_end)