linux-kernel - Re: [PATCH v21 00/28] Intel SGX foundations

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 7 Aug 2019 06:40:30 +0000
From:   Jethro Beekman <jethro@...tanix.com>
To:     Jarkko Sakkinen <jarkko.sakkinen@...ux.intel.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "x86@...nel.org" <x86@...nel.org>,
        "linux-sgx@...r.kernel.org" <linux-sgx@...r.kernel.org>
CC:     "akpm@...ux-foundation.org" <akpm@...ux-foundation.org>,
        "dave.hansen@...el.com" <dave.hansen@...el.com>,
        "sean.j.christopherson@...el.com" <sean.j.christopherson@...el.com>,
        "nhorman@...hat.com" <nhorman@...hat.com>,
        "npmccallum@...hat.com" <npmccallum@...hat.com>,
        "serge.ayoun@...el.com" <serge.ayoun@...el.com>,
        "shay.katz-zamir@...el.com" <shay.katz-zamir@...el.com>,
        "haitao.huang@...el.com" <haitao.huang@...el.com>,
        "andriy.shevchenko@...ux.intel.com" 
        <andriy.shevchenko@...ux.intel.com>,
        "tglx@...utronix.de" <tglx@...utronix.de>,
        "kai.svahn@...el.com" <kai.svahn@...el.com>,
        "bp@...en8.de" <bp@...en8.de>,
        "josh@...htriplett.org" <josh@...htriplett.org>,
        "luto@...nel.org" <luto@...nel.org>,
        "kai.huang@...el.com" <kai.huang@...el.com>,
        "rientjes@...gle.com" <rientjes@...gle.com>,
        "cedric.xing@...el.com" <cedric.xing@...el.com>
Subject: Re: [PATCH v21 00/28] Intel SGX foundations

On 2019-07-14 07:36, Jarkko Sakkinen wrote:
> On Sat, Jul 13, 2019 at 08:07:36PM +0300, Jarkko Sakkinen wrote:
>> v21:
>> * Check on mmap() that the VMA does cover an area that does not have
>>    enclave pages. Only mapping with PROT_NONE can do that to reserve
>>    initial address space for an enclave.
>> * Check om mmap() and mprotect() that the VMA permissions do not
>>    surpass the enclave permissions.
>> * Remove two refcounts from vma_close(): mm_list and encl->refcount.
>>    Enclave refcount is only need for swapper/enclave sync and we can
>>    remove mm_list refcount by destroying mm_struct when the process
>>    is closed. By not having vm_close() the Linux MM can merge VMAs.
>> * Do not naturally align MAP_FIXED address.
>> * Numerous small fixes and clean ups.
>> * Use SRCU for synchronizing the list of mm_struct's.
>> * Move to stack based call convention in the vDSO.
> 
> I forgot something:
> 
> * CONFIG_INTEL_SGX_DRIVER is not bistate i.e. no more LKM support. It is
>    still useful to have the compile-time option because VM host does not
>    need to have it enabled. Now sgx_init() calls explicitly sgx_drv_init().
>    In addition, platform driver has been ripped a way because we no
>    longer need ACPI hotplug. In effect, the device is now parentless.
> 

I think you also missed in the changelog that you're now checking page 
permissions in EADD.

--
Jethro Beekman | Fortanix


Download attachment "smime.p7s" of type "application/pkcs7-signature" (3990 bytes)