linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Don Porter <porter@cs.unc.edu>
To: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>,
	Thomas Gleixner <tglx@linutronix.de>
Cc: Andi Kleen <ak@linux.intel.com>, Sasha Levin <sashal@kernel.org>,
	linux-kernel@vger.kernel.org, bp@alien8.de, luto@kernel.org,
	hpa@zytor.com, dave.hansen@intel.com, tony.luck@intel.com,
	ravi.v.shankar@intel.com, chang.seok.bae@intel.com
Subject: Re: Re: [PATCH v12 00/18] Enable FSGSBASE instructions
Date: Fri, 22 May 2020 16:14:20 -0400	[thread overview]
Message-ID: <7eb45e02-03bf-0af0-c915-794bf49d66d7@cs.unc.edu> (raw)
In-Reply-To: <20200519164853.GA19706@linux.intel.com>

On 5/19/20 12:48 PM, Jarkko Sakkinen wrote:
> On Tue, May 19, 2020 at 01:03:25AM +0200, Thomas Gleixner wrote:
>> Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> writes:
>>> On Mon, 2020-05-18 at 08:34 -0700, Andi Kleen wrote:
>>>>> Yes, for SGX this is functional feature because enclave entry points,
>>>>> thread control structures (aka TCS's), reset FSBASE and GSBASE registers
>>>>> to fixed (albeit user defined) values. And syscall's can be done only
>>>>> outside of enclave.
>>>>>
>>>>> This is a required feature for fancier runtimes (such as Graphene).
>>>>
>>>> Can you please explain a bit more? What do they need GS for?
>>>
>>> Apparently, uses only wrfsbase:
>>>
>>> https://raw.githubusercontent.com/oscarlab/graphene/master/Pal/src/host/Linux-SGX/db_misc.c
>>>
>>> I'm not too familiar with the codebase yet but by reading some research
>>> papers in the past the idea is to multiplex one TCS for multiple virtual
>>> threads inside the enclave.
>>>
>>> E.g. TCS could represent a vcpu for a libos type of container and on
>>> entry would pick on a thread and set fsbase accordingly for a thread
>>> control block.
>>
>> That justifies to write books which recommend to load a kernel module
>> which creates a full unpriviledged root hole. I bet none of these papers
>> ever mentioned that.
> 
> Fully agree that oot lkm for this is a worst idea ever.
> 
> That's why I want to help with this.
> 
> /Jarkko
> 

 >

Hi all, and apologies for the resend,

I wanted to clarify that we never intended the Graphene kernel module 
you mention for production use, as well as to comment in support of this 
patch.

Setting the fs register in userspace is an essential feature for running 
legacy code in SGX.  We have been following LKML discussions on this 
instruction for years, and hoping this feature would be supported by 
Linux, so that we can retire this module.  To our knowledge, every SGX 
library OS has a similar module, waiting for this or a similar patch to 
be merged into Linux.  This indicates a growing user base that needs 
this instruction.

Just for some history, Graphene was originally a research 
proof-of-concept that started in my lab, and has since received 
substantial contributions as an open source project from companies 
including Intel.  This code base is explicitly not intended or ready for 
production use at this point, as it is still missing essential features.

We wrote the kernel module as a way to get something working quickly, so 
that we could focus on studying more difficult aspects of porting code 
to SGX.  We had always assumed that the Linux community would eventually 
offer a correct and safe mechanism to enable this instruction, but we 
generally err on the side of publishing code we write for research 
studies as open source in the interest of supporting reproducibility and 
further science.

Nonetheless, Graphene is moving towards adoption in production systems, 
and we are actively working to make the code base secure and robust. 
This issue has been on our to-do list before a production release.  It 
would certainly make our lives easier to deprecate our module and just 
use a robust, in-kernel implementation.

All the best,
Don Porter
Graphene Maintainer
https://grapheneproject.io/

  reply	other threads:[~2020-05-22 20:14 UTC|newest]

Thread overview: 76+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-05-11  4:52 [PATCH v12 00/18] Enable FSGSBASE instructions Sasha Levin
2020-05-11  4:52 ` [PATCH v12 01/18] x86/ptrace: Prevent ptrace from clearing the FS/GS selector Sasha Levin
2020-05-11  4:52 ` [PATCH v12 02/18] selftests/x86/fsgsbase: Test GS selector on ptracer-induced GS base write Sasha Levin
2020-05-11  4:52 ` [PATCH v12 03/18] x86/cpu: Add 'unsafe_fsgsbase' to enable CR4.FSGSBASE Sasha Levin
2020-05-11  4:52 ` [PATCH v12 04/18] x86/entry/64: Clean up paranoid exit Sasha Levin
2020-05-11  4:52 ` [PATCH v12 05/18] x86/entry/64: Switch CR3 before SWAPGS in paranoid entry Sasha Levin
2020-05-11  4:52 ` [PATCH v12 06/18] x86/entry/64: Introduce the FIND_PERCPU_BASE macro Sasha Levin
2020-05-11  4:53 ` [PATCH v12 07/18] x86/entry/64: Handle FSGSBASE enabled paranoid entry/exit Sasha Levin
2020-05-11  4:53 ` [PATCH v12 08/18] x86/entry/64: Document GSBASE handling in the paranoid path Sasha Levin
2020-05-11  4:53 ` [PATCH v12 09/18] x86/fsgsbase/64: Add intrinsics for FSGSBASE instructions Sasha Levin
2020-05-11  4:53 ` [PATCH v12 10/18] x86/fsgsbase/64: Enable FSGSBASE instructions in helper functions Sasha Levin
2020-05-18 18:20   ` Thomas Gleixner
2020-05-18 20:24     ` Sasha Levin
2020-05-18 22:59       ` Thomas Gleixner
2020-05-19 12:20       ` David Laight
2020-05-19 14:48         ` Thomas Gleixner
2020-05-20  9:13           ` David Laight
2020-05-11  4:53 ` [PATCH v12 11/18] x86/fsgsbase/64: Use FSGSBASE in switch_to() if available Sasha Levin
2020-05-11  4:53 ` [PATCH v12 12/18] x86/fsgsbase/64: move save_fsgs to header file Sasha Levin
2020-05-11  4:53 ` [PATCH v12 13/18] x86/fsgsbase/64: Use FSGSBASE instructions on thread copy and ptrace Sasha Levin
2020-05-11  4:53 ` [PATCH v12 14/18] x86/speculation/swapgs: Check FSGSBASE in enabling SWAPGS mitigation Sasha Levin
2020-05-11  4:53 ` [PATCH v12 15/18] selftests/x86/fsgsbase: Test ptracer-induced GS base write with FSGSBASE Sasha Levin
2020-05-11  4:53 ` [PATCH v12 16/18] x86/fsgsbase/64: Enable FSGSBASE on 64bit by default and add a chicken bit Sasha Levin
2020-05-11  4:53 ` [PATCH v12 17/18] x86/elf: Enumerate kernel FSGSBASE capability in AT_HWCAP2 Sasha Levin
2020-05-11  4:53 ` [PATCH v12 18/18] Documentation/x86/64: Add documentation for GS/FS addressing mode Sasha Levin
2020-05-15  9:24 ` [PATCH v12 00/18] Enable FSGSBASE instructions Jarkko Sakkinen
2020-05-15 16:40   ` Sasha Levin
2020-05-15 17:55     ` Andi Kleen
2020-05-15 23:07       ` Sasha Levin
2020-05-16 12:21       ` Jarkko Sakkinen
2020-05-16  9:50     ` Jarkko Sakkinen
2020-05-18 15:34       ` Andi Kleen
2020-05-18 20:01         ` Jarkko Sakkinen
2020-05-18 23:03           ` Thomas Gleixner
2020-05-19 16:48             ` Jarkko Sakkinen
2020-05-22 20:14               ` Don Porter [this message]
2020-05-22 20:55                 ` Dave Hansen
2020-05-23  0:45                 ` Thomas Gleixner
2020-05-24 19:45                   ` hpa
2020-05-24 21:19                     ` Sasha Levin
2020-05-24 23:44                       ` hpa
2020-05-25  7:54                       ` Richard Weinberger
2020-05-25 21:56                         ` Tony Luck
2020-05-26  8:12                         ` David Laight
2020-05-26  8:23                           ` Richard Weinberger
2020-05-27  8:31                     ` Jarkko Sakkinen
2020-05-26 12:42                   ` Don Porter
2020-05-26 20:27                     ` Sasha Levin
2020-05-26 22:03                       ` Don Porter
2020-05-26 22:51                         ` Sasha Levin
2020-05-28 17:37                           ` Don Porter
2020-05-28 10:29                     ` Thomas Gleixner
2020-05-28 17:40                       ` Don Porter
2020-05-28 18:38                         ` Andy Lutomirski
2020-05-29 15:27                           ` Wojtek Porczyk
2020-06-25 15:27                             ` Don Porter
2020-06-25 21:37                               ` Jarkko Sakkinen
2020-07-18 18:19                                 ` Don Porter
2020-07-23  3:23                                   ` Jarkko Sakkinen
2020-05-28 19:19                         ` Jarkko Sakkinen
2020-05-28 19:41                           ` Sasha Levin
2020-05-29  3:07                             ` Jarkko Sakkinen
2020-05-29  3:10                               ` Jarkko Sakkinen
2020-06-25 15:30                                 ` Don Porter
2020-06-25 21:40                                   ` Jarkko Sakkinen
2020-05-23  4:19                 ` Andi Kleen
2020-05-28 10:36                   ` Thomas Gleixner
2020-05-27  8:20                 ` Jarkko Sakkinen
2020-05-27 12:42                   ` Wojtek Porczyk
2020-05-18  9:51     ` Thomas Gleixner
2020-05-18 15:16       ` Sasha Levin
2020-05-18 18:28         ` Thomas Gleixner
2020-05-18 19:36       ` Jarkko Sakkinen
2020-05-18  6:18 ` Christoph Hellwig
2020-05-18 12:33   ` Sasha Levin
2020-05-18 14:53 ` Thomas Gleixner

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=7eb45e02-03bf-0af0-c915-794bf49d66d7@cs.unc.edu \
    --to=porter@cs.unc.edu \
    --cc=ak@linux.intel.com \
    --cc=bp@alien8.de \
    --cc=chang.seok.bae@intel.com \
    --cc=dave.hansen@intel.com \
    --cc=hpa@zytor.com \
    --cc=jarkko.sakkinen@linux.intel.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=luto@kernel.org \
    --cc=ravi.v.shankar@intel.com \
    --cc=sashal@kernel.org \
    --cc=tglx@linutronix.de \
    --cc=tony.luck@intel.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).