Commit bfed6efb authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'x86_sgx_for_v5.17_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 

Pull x86 SGX updates from Borislav Petkov:

 - Add support for handling hw errors in SGX pages: poisoning,
   recovering from poison memory and error injection into SGX pages

 - A bunch of changes to the SGX selftests to simplify and allow of SGX
   features testing without the need of a whole SGX software stack

 - Add a sysfs attribute which is supposed to show the amount of SGX
   memory in a NUMA node, similar to what /proc/meminfo is to normal
   memory

 - The usual bunch of fixes and cleanups too

* tag 'x86_sgx_for_v5.17_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (24 commits)
  x86/sgx: Fix NULL pointer dereference on non-SGX systems
  selftests/sgx: Fix corrupted cpuid macro invocation
  x86/sgx: Add an attribute for the amount of SGX memory in a NUMA node
  x86/sgx: Fix minor documentation issues
  selftests/sgx: Add test for multiple TCS entry
  selftests/sgx: Enable multiple thread support
  selftests/sgx: Add page permission and exception test
  selftests/sgx: Rename test properties in preparation for more enclave tests
  selftests/sgx: Provide per-op parameter structs for the test enclave
  selftests/sgx: Add a new kselftest: Unclobbered_vdso_oversubscribed
  selftests/sgx: Move setup_test_encl() to each TEST_F()
  selftests/sgx: Encpsulate the test enclave creation
  selftests/sgx: Dump segments and /proc/self/maps only on failure
  selftests/sgx: Create a heap for the test enclave
  selftests/sgx: Make data measurement for an enclave segment optional
  selftests/sgx: Assign source for each segment
  selftests/sgx: Fix a benign linker warning
  x86/sgx: Add check for SGX pages to ghes_do_memory_failure()
  x86/sgx: Add hook to error injection address validation
  x86/sgx: Hook arch_memory_failure() into mainline code
  ...
parents d3c20bfb 2056e298

Documentation/ABI/stable/sysfs-devices-node

+6 −0
Original line number Diff line number Diff line
@@ -176,3 +176,9 @@ Contact: Keith Busch <keith.busch@intel.com> 
Description:

		The cache write policy: 0 for write-back, 1 for write-through,

		other or unknown.



What:		/sys/devices/system/node/nodeX/x86/sgx_total_bytes

Date:		November 2021

Contact:	Jarkko Sakkinen <jarkko@kernel.org>

Description:

		The total amount of SGX physical memory in bytes.

Documentation/firmware-guide/acpi/apei/einj.rst

+19 −0
Original line number Diff line number Diff line
@@ -181,5 +181,24 @@ You should see something like this in dmesg:: 
  [22715.834759] EDAC sbridge MC3: PROCESSOR 0:306e7 TIME 1422553404 SOCKET 0 APIC 0

  [22716.616173] EDAC MC3: 1 CE memory read error on CPU_SrcID#0_Channel#0_DIMM#0 (channel:0 slot:0 page:0x12345 offset:0x0 grain:32 syndrome:0x0 -  area:DRAM err_code:0001:0090 socket:0 channel_mask:1 rank:0)



Special notes for injection into SGX enclaves:



There may be a separate BIOS setup option to enable SGX injection.



The injection process consists of setting some special memory controller

trigger that will inject the error on the next write to the target

address. But the h/w prevents any software outside of an SGX enclave

from accessing enclave pages (even BIOS SMM mode).



The following sequence can be used:

  1) Determine physical address of enclave page

  2) Use "notrigger=1" mode to inject (this will setup

     the injection address, but will not actually inject)

  3) Enter the enclave

  4) Store data to the virtual address matching physical address from step 1

  5) Execute CLFLUSH for that virtual address

  6) Spin delay for 250ms

  7) Read from the virtual address. This will trigger the error



For more information about EINJ, please refer to ACPI specification

version 4.0, section 17.5 and ACPI 5.0, section 18.6.

Documentation/x86/sgx.rst

+7 −7
Original line number Diff line number Diff line
@@ -10,7 +10,7 @@ Overview 
Software Guard eXtensions (SGX) hardware enables for user space applications

to set aside private memory regions of code and data:



* Privileged (ring-0) ENCLS functions orchestrate the construction of the.

* Privileged (ring-0) ENCLS functions orchestrate the construction of the

  regions.

* Unprivileged (ring-3) ENCLU functions allow an application to enter and

  execute inside the regions.
@@ -91,7 +91,7 @@ In addition to the traditional compiler and linker build process, SGX has a 
separate enclave “build” process.  Enclaves must be built before they can be

executed (entered). The first step in building an enclave is opening the

**/dev/sgx_enclave** device.  Since enclave memory is protected from direct

access, special privileged instructions are Then used to copy data into enclave

access, special privileged instructions are then used to copy data into enclave

pages and establish enclave page permissions.



.. kernel-doc:: arch/x86/kernel/cpu/sgx/ioctl.c
@@ -126,13 +126,13 @@ the need to juggle signal handlers. 
ksgxd

=====



SGX support includes a kernel thread called *ksgxwapd*.

SGX support includes a kernel thread called *ksgxd*.



EPC sanitization

----------------



ksgxd is started when SGX initializes.  Enclave memory is typically ready

For use when the processor powers on or resets.  However, if SGX has been in

for use when the processor powers on or resets.  However, if SGX has been in

use since the reset, enclave pages may be in an inconsistent state.  This might

occur after a crash and kexec() cycle, for instance.  At boot, ksgxd

reinitializes all enclave pages so that they can be allocated and re-used.
@@ -147,7 +147,7 @@ Page reclaimer 


Similar to the core kswapd, ksgxd, is responsible for managing the

overcommitment of enclave memory.  If the system runs out of enclave memory,

*ksgxwapd* “swaps” enclave memory to normal memory.

*ksgxd* “swaps” enclave memory to normal memory.



Launch Control

==============
@@ -156,7 +156,7 @@ SGX provides a launch control mechanism. After all enclave pages have been 
copied, kernel executes EINIT function, which initializes the enclave. Only after

this the CPU can execute inside the enclave.



ENIT function takes an RSA-3072 signature of the enclave measurement.  The function

EINIT function takes an RSA-3072 signature of the enclave measurement.  The function

checks that the measurement is correct and signature is signed with the key

hashed to the four **IA32_SGXLEPUBKEYHASH{0, 1, 2, 3}** MSRs representing the

SHA256 of a public key.
@@ -184,7 +184,7 @@ CPUs starting from Icelake use Total Memory Encryption (TME) in the place of 
MEE. TME-based SGX implementations do not have an integrity Merkle tree, which

means integrity and replay-attacks are not mitigated.  B, it includes

additional changes to prevent cipher text from being returned and SW memory

aliases from being Created.

aliases from being created.



DMA to enclave memory is blocked by range registers on both MEE and TME systems

(SDM section 41.10).

arch/Kconfig

+4 −0
Original line number Diff line number Diff line
@@ -1312,6 +1312,10 @@ config ARCH_HAS_PARANOID_L1D_FLUSH 
config DYNAMIC_SIGFRAME

	bool



# Select, if arch has a named attribute group bound to NUMA device nodes.

config HAVE_ARCH_NODE_DEV_GROUP

	bool



source "kernel/gcov/Kconfig"



source "scripts/gcc-plugins/Kconfig"

arch/x86/Kconfig

+2 −0
Original line number Diff line number Diff line
@@ -269,6 +269,7 @@ config X86 
	select HAVE_ARCH_KCSAN			if X86_64

	select X86_FEATURE_NAMES		if PROC_FS

	select PROC_PID_ARCH_STATUS		if PROC_FS

	select HAVE_ARCH_NODE_DEV_GROUP		if X86_SGX

	imply IMA_SECURE_AND_OR_TRUSTED_BOOT    if EFI



config INSTRUCTION_DECODER
@@ -1921,6 +1922,7 @@ config X86_SGX 
	select SRCU

	select MMU_NOTIFIER

	select NUMA_KEEP_MEMINFO if NUMA

	select XARRAY_MULTI

	help

	  Intel(R) Software Guard eXtensions (SGX) is a set of CPU instructions

	  that can be used by applications to set aside private regions of code