Re: [PATCH OLK-5.10 V2 14/44] x86/sgx: Add SGX_IOC_ENCLAVE_PROVISION

Reviewed-by: Bamvor Zhang bamvor.zhang@suse.com

在 2/15/22 11:05 AM, Laibin Qiu 写道:

From: Jarkko Sakkinen jarkko@kernel.org

mainline inclusion from mainline-v5.11-rc1 commit c82c61865024b9981f00358433bebed92ca20c00 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4SIGI CVE: NA

---

The whole point of SGX is to create a hardware protected place to do “stuff”. But, before someone is willing to hand over the keys to the castle , an enclave must often prove that it is running on an SGX-protected processor. Provisioning enclaves play a key role in providing proof.

There are actually three different enclaves in play in order to make this happen:

1. The application enclave. The familiar one we know and love that runs the actual code that’s doing real work. There can be many of these on a single system, or even in a single application.

2. The quoting enclave (QE). The QE is mentioned in lots of silly whitepapers, but, for the purposes of kernel enabling, just pretend they do not exist.

3. The provisioning enclave. There is typically only one of these enclaves per system. Provisioning enclaves have access to a special hardware key.

   They can use this key to help to generate certificates which serve as proof that enclaves are running on trusted SGX hardware. These certificates can be passed around without revealing the special key.

Any user who can create a provisioning enclave can access the processor-unique Provisioning Certificate Key which has privacy and fingerprinting implications. Even if a user is permitted to create normal application enclaves (via /dev/sgx_enclave), they should not be able to create provisioning enclaves. That means a separate permissions scheme is needed to control provisioning enclave privileges.

Implement a separate device file (/dev/sgx_provision) which allows creating provisioning enclaves. This device will typically have more strict permissions than the plain enclave device.

The actual device “driver” is an empty stub. Open file descriptors for this device will represent a token which allows provisioning enclave duty. This file descriptor can be passed around and ultimately given as an argument to the /dev/sgx_enclave driver ioctl().

[ bp: Touchups. ]

Intel-SIG: commit c82c61865024 x86/sgx: Add SGX_IOC_ENCLAVE_PROVISION Backport for SGX Foundations support

Suggested-by: Andy Lutomirski luto@kernel.org Signed-off-by: Jarkko Sakkinen jarkko@kernel.org Signed-off-by: Borislav Petkov bp@suse.de Cc: linux-security-module@vger.kernel.org Link: https://lkml.kernel.org/r/20201112220135.165028-16-jarkko@kernel.org Signed-off-by: Fan Du fan.du@intel.com #openEuler_contributor Signed-off-by: Laibin Qiu qiulaibin@huawei.com

---

arch/x86/include/uapi/asm/sgx.h | 11 ++++++++++ arch/x86/kernel/cpu/sgx/driver.c | 24 ++++++++++++++++++++- arch/x86/kernel/cpu/sgx/driver.h | 2 ++ arch/x86/kernel/cpu/sgx/ioctl.c | 37 ++++++++++++++++++++++++++++++++ 4 files changed, 73 insertions(+), 1 deletion(-)

diff --git a/arch/x86/include/uapi/asm/sgx.h b/arch/x86/include/uapi/asm/sgx.h index 66f2d32cb4d7..c32210235bf5 100644 --- a/arch/x86/include/uapi/asm/sgx.h +++ b/arch/x86/include/uapi/asm/sgx.h @@ -25,6 +25,8 @@ enum sgx_page_flags { _IOWR(SGX_MAGIC, 0x01, struct sgx_enclave_add_pages) #define SGX_IOC_ENCLAVE_INIT \ _IOW(SGX_MAGIC, 0x02, struct sgx_enclave_init) +#define SGX_IOC_ENCLAVE_PROVISION \

• _IOW(SGX_MAGIC, 0x03, struct sgx_enclave_provision)

  /**

  • struct sgx_enclave_create - parameter structure for the

@@ -63,4 +65,13 @@ struct sgx_enclave_init { __u64 sigstruct; };

+/**

• • struct sgx_enclave_provision - parameter structure for the

• • 		  %SGX_IOC_ENCLAVE_PROVISION ioctl
    

• • @fd: file handle of /dev/sgx_provision
• */

+struct sgx_enclave_provision {

• __u64 fd;

+};

• #endif /* _UAPI_ASM_X86_SGX_H */

diff --git a/arch/x86/kernel/cpu/sgx/driver.c b/arch/x86/kernel/cpu/sgx/driver.c index bf5c4a36a548..899c18499d1a 100644 --- a/arch/x86/kernel/cpu/sgx/driver.c +++ b/arch/x86/kernel/cpu/sgx/driver.c @@ -112,6 +112,10 @@ static const struct file_operations sgx_encl_fops = { .get_unmapped_area = sgx_get_unmapped_area, };

+const struct file_operations sgx_provision_fops = {

• .owner = THIS_MODULE,

+};

• static struct miscdevice sgx_dev_enclave = { .minor = MISC_DYNAMIC_MINOR, .name = "sgx_enclave",

@@ -119,11 +123,19 @@ static struct miscdevice sgx_dev_enclave = { .fops = &sgx_encl_fops, };

+static struct miscdevice sgx_dev_provision = {

• .minor = MISC_DYNAMIC_MINOR,
• .name = "sgx_provision",
• .nodename = "sgx_provision",
• .fops = &sgx_provision_fops,

+};

• int __init sgx_drv_init(void) { unsigned int eax, ebx, ecx, edx; u64 attr_mask; u64 xfrm_mask;

• int ret;

  if (!cpu_feature_enabled(X86_FEATURE_SGX_LC)) return -ENODEV;

@@ -147,5 +159,15 @@ int __init sgx_drv_init(void) sgx_xfrm_reserved_mask = ~xfrm_mask; }

• return misc_register(&sgx_dev_enclave);

• ret = misc_register(&sgx_dev_enclave);
• if (ret)

• return ret;
  

• ret = misc_register(&sgx_dev_provision);
• if (ret) {

• misc_deregister(&sgx_dev_enclave);
  

• return ret;
  

• }
• return 0; }

diff --git a/arch/x86/kernel/cpu/sgx/driver.h b/arch/x86/kernel/cpu/sgx/driver.h index 6b0063221659..4eddb4d571ef 100644 --- a/arch/x86/kernel/cpu/sgx/driver.h +++ b/arch/x86/kernel/cpu/sgx/driver.h @@ -20,6 +20,8 @@ extern u64 sgx_attributes_reserved_mask; extern u64 sgx_xfrm_reserved_mask; extern u32 sgx_misc_reserved_mask;

+extern const struct file_operations sgx_provision_fops;

• long sgx_ioctl(struct file *filep, unsigned int cmd, unsigned long arg);

  int sgx_drv_init(void);

diff --git a/arch/x86/kernel/cpu/sgx/ioctl.c b/arch/x86/kernel/cpu/sgx/ioctl.c index e036819ea5c1..0ba0e670e2f0 100644 --- a/arch/x86/kernel/cpu/sgx/ioctl.c +++ b/arch/x86/kernel/cpu/sgx/ioctl.c @@ -569,6 +569,40 @@ static long sgx_ioc_enclave_init(struct sgx_encl *encl, void __user *arg) return ret; }

+/**

• • sgx_ioc_enclave_provision() - handler for %SGX_IOC_ENCLAVE_PROVISION
• • @enclave: an enclave pointer
• • @arg: userspace pointer to a struct sgx_enclave_provision instance
• • Allow ATTRIBUTE.PROVISION_KEY for an enclave by providing a file handle to
• • /dev/sgx_provision.
• • Return:
• • • 0: Success.
• • • -errno: Otherwise.
• */

+static long sgx_ioc_enclave_provision(struct sgx_encl *encl, void __user *arg) +{

• struct sgx_enclave_provision params;
• struct file *file;
• if (copy_from_user(&params, arg, sizeof(params)))

• return -EFAULT;
  

• file = fget(params.fd);
• if (!file)

• return -EINVAL;
  

• if (file->f_op != &sgx_provision_fops) {

• fput(file);
  

• return -EINVAL;
  

• }
• encl->attributes_mask |= SGX_ATTR_PROVISIONKEY;
• fput(file);
• return 0;

+}

long sgx_ioctl(struct file *filep, unsigned int cmd, unsigned long arg) { @@ -588,6 +622,9 @@ long sgx_ioctl(struct file *filep, unsigned int cmd, unsigned long arg) case SGX_IOC_ENCLAVE_INIT: ret = sgx_ioc_enclave_init(encl, (void __user *)arg); break;

• case SGX_IOC_ENCLAVE_PROVISION:

• ret = sgx_ioc_enclave_provision(encl, (void __user *)arg);
  

• break;
  

  default: ret = -ENOIOCTLCMD; break;