Re: [PATCH OLK-5.10 V3 21/45] x86/sgx: Add ptrace() support for the SGX driver

Reviewed-by: Bamvor Zhang bamvor.zhang@suse.com

在 2/18/22 4:16 PM, Laibin Qiu 写道:

From: Jarkko Sakkinen jarkko@kernel.org

mainline inclusion from mainline-v5.11-rc1 commit 947c6e11fa4310b31c10016ae9816cdca3f1694e category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4SIGI CVE: NA

---

Enclave memory is normally inaccessible from outside the enclave. This makes enclaves hard to debug. However, enclaves can be put in a debug mode when they are being built. In that mode, enclave data *can* be read and/or written by using the ENCLS[EDBGRD] and ENCLS[EDBGWR] functions.

This is obviously only for debugging and destroys all the protections present with normal enclaves. But, enclaves know their own debug status and can adjust their behavior appropriately.

Add a vm_ops->access() implementation which can be used to read and write memory inside debug enclaves. This is typically used via ptrace() APIs.

[ bp: Massage. ]

Intel-SIG: commit 947c6e11fa43 x86/sgx: Add ptrace() support for the SGX driver Backport for SGX Foundations support

Signed-off-by: Jarkko Sakkinen jarkko@kernel.org Signed-off-by: Borislav Petkov bp@suse.de Tested-by: Jethro Beekman jethro@fortanix.com Link: https://lkml.kernel.org/r/20201112220135.165028-23-jarkko@kernel.org Signed-off-by: Fan Du fan.du@intel.com #openEuler_contributor Signed-off-by: Laibin Qiu qiulaibin@huawei.com

---

arch/x86/kernel/cpu/sgx/encl.c | 111 +++++++++++++++++++++++++++++++++ 1 file changed, 111 insertions(+)

diff --git a/arch/x86/kernel/cpu/sgx/encl.c b/arch/x86/kernel/cpu/sgx/encl.c index b74dadf85989..ee50a5010277 100644 --- a/arch/x86/kernel/cpu/sgx/encl.c +++ b/arch/x86/kernel/cpu/sgx/encl.c @@ -272,10 +272,121 @@ static int sgx_vma_mprotect(struct vm_area_struct *vma, unsigned long start, return sgx_encl_may_map(vma->vm_private_data, start, end, newflags); }

+static int sgx_encl_debug_read(struct sgx_encl *encl, struct sgx_encl_page *page,

• 	       unsigned long addr, void *data)
  

+{

• unsigned long offset = addr & ~PAGE_MASK;
• int ret;
• ret = __edbgrd(sgx_get_epc_virt_addr(page->epc_page) + offset, data);
• if (ret)

• return -EIO;
  

• return 0;

+}

+static int sgx_encl_debug_write(struct sgx_encl *encl, struct sgx_encl_page *page,

• 		unsigned long addr, void *data)
  

+{

• unsigned long offset = addr & ~PAGE_MASK;
• int ret;
• ret = __edbgwr(sgx_get_epc_virt_addr(page->epc_page) + offset, data);
• if (ret)

• return -EIO;
  

• return 0;

+}

+/*

• • Load an enclave page to EPC if required, and take encl->lock.
• */

+static struct sgx_encl_page *sgx_encl_reserve_page(struct sgx_encl *encl,

• 				   unsigned long addr,
  

• 				   unsigned long vm_flags)
  

+{

• struct sgx_encl_page *entry;
• for ( ; ; ) {

• mutex_lock(&encl->lock);
  

• entry = sgx_encl_load_page(encl, addr, vm_flags);
  

• if (PTR_ERR(entry) != -EBUSY)
  

• 	break;
  

• mutex_unlock(&encl->lock);
  

• }
• if (IS_ERR(entry))

• mutex_unlock(&encl->lock);
  

• return entry;

+}

+static int sgx_vma_access(struct vm_area_struct *vma, unsigned long addr,

• 	  void *buf, int len, int write)
  

+{

• struct sgx_encl *encl = vma->vm_private_data;
• struct sgx_encl_page *entry = NULL;
• char data[sizeof(unsigned long)];
• unsigned long align;
• int offset;
• int cnt;
• int ret = 0;
• int i;
• /*

• * If process was forked, VMA is still there but vm_private_data is set
  

• * to NULL.
  

• */
  

• if (!encl)

• return -EFAULT;
  

• if (!test_bit(SGX_ENCL_DEBUG, &encl->flags))

• return -EFAULT;
  

• for (i = 0; i < len; i += cnt) {

• entry = sgx_encl_reserve_page(encl, (addr + i) & PAGE_MASK,
  

• 			      vma->vm_flags);
  

• if (IS_ERR(entry)) {
  

• 	ret = PTR_ERR(entry);
  

• 	break;
  

• }
  

• align = ALIGN_DOWN(addr + i, sizeof(unsigned long));
  

• offset = (addr + i) & (sizeof(unsigned long) - 1);
  

• cnt = sizeof(unsigned long) - offset;
  

• cnt = min(cnt, len - i);
  

• ret = sgx_encl_debug_read(encl, entry, align, data);
  

• if (ret)
  

• 	goto out;
  

• if (write) {
  

• 	memcpy(data + offset, buf + i, cnt);
  

• 	ret = sgx_encl_debug_write(encl, entry, align, data);
  

• 	if (ret)
  

• 		goto out;
  

• } else {
  

• 	memcpy(buf + i, data + offset, cnt);
  

• }
  

+out:

• mutex_unlock(&encl->lock);
  

• if (ret)
  

• 	break;
  

• }
• return ret < 0 ? ret : i;

+}

• const struct vm_operations_struct sgx_vm_ops = { .fault = sgx_vma_fault, .mprotect = sgx_vma_mprotect, .open = sgx_vma_open,

• .access = sgx_vma_access, };

  /**