linux-kernel - Re: [PATCH RESEND 0/3] x86/sgx: eextend ioctl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ece49a38-c84d-dba7-6039-b409511e7303@fortanix.com>
Date:   Thu, 1 Apr 2021 16:56:13 +0200
From:   Raoul Strackx <raoul.strackx@...tanix.com>
To:     Dave Hansen <dave.hansen@...el.com>,
        Jarkko Sakkinen <jarkko@...nel.org>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
        x86@...nel.org, "H. Peter Anvin" <hpa@...or.com>,
        linux-sgx@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH RESEND 0/3] x86/sgx: eextend ioctl

On 3/31/21 5:53 PM, Dave Hansen wrote:
> On 3/31/21 5:50 AM, Raoul Strackx wrote:
>> The sgx driver can only load enclaves whose pages are fully measured.
>> This may exclude existing enclaves from running. This patch adds a
>> new ioctl to measure 256 byte chunks at a time.
> 
> The changelogs here are pretty sparse.  Could you explain in a bit more
> detail what's going on?
> 
> A review of the relevant pieces of the SGX architecture would be
> appreciated.
> 

Yes the explanation was very succinct. A more elaborate explanation:

BACKGROUND
Creation of an SGX enclave consists of three steps. First, a new enclave 
environment is created by the ECREATE leaf function. Some enclave settings 
are specified at this step by passing an SGX Enclave Control Structure 
(SECS) that contains the enclave MRENCLAVE, MRSIGNER, etc. This 
instruction also starts a cryptographic log of the enclave being built. 
(This log should eventually result in the MRENCLAVE.)
Second, pages are added to the enclave. The EADD leaf function copies 4KB 
data to an empty EPC page. The cryptographic log records (among other 
properties) the location and access rights of the page being added. It 
_does not_ include a measurement of the page content. When the enclave 
writer wishes to ensure the content of the enclave page as well, she must 
use the EEXTEND leaf function. Extending the enclave cryptographic log can 
only be done per 256 bytes. Extending the log with a full 4K page thus 
requires 16 invocations of the EEXTEND leaf function.
Finally, the enclave is finalized by the EINIT leaf function. Any new 
invocations of the EADD or EEXTEND leaf functions will result in a fault. 
With EINIT a number of checks are performed as well. A cryptographic hash 
is computed over the final cryptographic log and compared to the MRENCLAVE 
field of the SECS structure passed to the ECREATE leaf function (see step 
one). The signature (MRSIGNER) over this MRENCLAVE is verified as well. 
When all checks pass, the enclave enters an executable state.

PROBLEM STATEMENT
The SGX driver currently only supports extending the cryptographic log as 
part of the EADD leaf function and _must_ measure full 4K pages. Not all 
enclaves may have been constructed within these constraints. Such enclaves 
currently cannot be build on the Linux platform. Trying to do so will 
result in a different cryptographic log; the MRENCLAVE specified at 
enclave creation time will not match the cryptographic log kept by the 
processor and EINIT will fail.

SOLUTION OF THIS PATCH
This patch adds a new ioctl to enable userspace to execute EEXTEND leaf 
functions per 256 bytes of enclave memory. This enables enclaves to be 
build as specified by enclave providers.

I'm still very new to how Linux kernel patches are handled. Where
would such a more elaborate description usually go: the cover page, the
commit that introduces the ioctl or both?

Regards,
Raoul