| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <m2ft8zsyrr.fsf@oracle.com>
Date: Thu, 06 Aug 2020 14:13:28 +0100
From: Darren Kenny <darren.kenny@...cle.com>
To: Jarkko Sakkinen <jarkko.sakkinen@...ux.intel.com>, x86@...nel.org,
linux-sgx@...r.kernel.org
Cc: linux-kernel@...r.kernel.org,
Sean Christopherson <sean.j.christopherson@...el.com>,
Borislav Petkov <bp@...en8.de>,
Jethro Beekman <jethro@...tanix.com>,
Jarkko Sakkinen <jarkko.sakkinen@...ux.intel.com>,
akpm@...ux-foundation.org, andriy.shevchenko@...ux.intel.com,
asapek@...gle.com, cedric.xing@...el.com, chenalexchen@...gle.com,
conradparker@...gle.com, cyhanish@...gle.com,
dave.hansen@...el.com, haitao.huang@...el.com,
josh@...htriplett.org, kai.huang@...el.com, kai.svahn@...el.com,
kmoy@...gle.com, ludloff@...gle.com, luto@...nel.org,
nhorman@...hat.com, npmccallum@...hat.com, puiterwijk@...hat.com,
rientjes@...gle.com, tglx@...utronix.de, yaozhangx@...gle.com
Subject: Re: [PATCH v36 01/24] x86/cpufeatures: x86/msr: Add Intel SGX
hardware bits
On Thursday, 2020-07-16 at 16:52:40 +03, Jarkko Sakkinen wrote:
> From: Sean Christopherson <sean.j.christopherson@...el.com>
>
> Add X86_FEATURE_SGX from CPUID.(EAX=7, ECX=1), which informs whether the
> CPU has SGX.
>
> Add X86_FEATURE_SGX1 and X86_FEATURE_SGX2 from CPUID.(EAX=12H, ECX=0),
> which describe the level of SGX support available [1].
>
> Add IA32_FEATURE_CONTROL.SGX_ENABLE. BIOS can use this bit to opt-in SGX
> before locking the feature control MSR [2].
>
> [1] Intel SDM: 36.7.2 Intel® SGX Resource Enumeration Leaves
> [2] Intel SDM: 36.7.1 Intel® SGX Opt-In Configuration
>
> Reviewed-by: Borislav Petkov <bp@...en8.de>
> Acked-by: Jethro Beekman <jethro@...tanix.com>
> Signed-off-by: Sean Christopherson <sean.j.christopherson@...el.com>
> Co-developed-by: Jarkko Sakkinen <jarkko.sakkinen@...ux.intel.com>
Reviewed-by: Darren Kenny <darren.kenny@...cle.com>
> Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@...ux.intel.com>
> ---
> arch/x86/include/asm/cpufeature.h | 5 +++--
> arch/x86/include/asm/cpufeatures.h | 7 ++++++-
> arch/x86/include/asm/disabled-features.h | 18 +++++++++++++++---
> arch/x86/include/asm/msr-index.h | 1 +
> arch/x86/include/asm/required-features.h | 2 +-
> arch/x86/kernel/cpu/common.c | 4 ++++
> 6 files changed, 30 insertions(+), 7 deletions(-)
>
> diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
> index 59bf91c57aa8..efbdba5170a3 100644
> --- a/arch/x86/include/asm/cpufeature.h
> +++ b/arch/x86/include/asm/cpufeature.h
> @@ -30,6 +30,7 @@ enum cpuid_leafs
> CPUID_7_ECX,
> CPUID_8000_0007_EBX,
> CPUID_7_EDX,
> + CPUID_12_EAX,
> };
>
> #ifdef CONFIG_X86_FEATURE_NAMES
> @@ -89,7 +90,7 @@ extern const char * const x86_bug_flags[NBUGINTS*32];
> CHECK_BIT_IN_MASK_WORD(REQUIRED_MASK, 17, feature_bit) || \
> CHECK_BIT_IN_MASK_WORD(REQUIRED_MASK, 18, feature_bit) || \
> REQUIRED_MASK_CHECK || \
> - BUILD_BUG_ON_ZERO(NCAPINTS != 19))
> + BUILD_BUG_ON_ZERO(NCAPINTS != 20))
>
> #define DISABLED_MASK_BIT_SET(feature_bit) \
> ( CHECK_BIT_IN_MASK_WORD(DISABLED_MASK, 0, feature_bit) || \
> @@ -112,7 +113,7 @@ extern const char * const x86_bug_flags[NBUGINTS*32];
> CHECK_BIT_IN_MASK_WORD(DISABLED_MASK, 17, feature_bit) || \
> CHECK_BIT_IN_MASK_WORD(DISABLED_MASK, 18, feature_bit) || \
> DISABLED_MASK_CHECK || \
> - BUILD_BUG_ON_ZERO(NCAPINTS != 19))
> + BUILD_BUG_ON_ZERO(NCAPINTS != 20))
>
> #define cpu_has(c, bit) \
> (__builtin_constant_p(bit) && REQUIRED_MASK_BIT_SET(bit) ? 1 : \
> diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
> index 02dabc9e77b0..545ac3e0e269 100644
> --- a/arch/x86/include/asm/cpufeatures.h
> +++ b/arch/x86/include/asm/cpufeatures.h
> @@ -13,7 +13,7 @@
> /*
> * Defines x86 CPU feature bits
> */
> -#define NCAPINTS 19 /* N 32-bit words worth of info */
> +#define NCAPINTS 20 /* N 32-bit words worth of info */
> #define NBUGINTS 1 /* N 32-bit bug flags */
>
> /*
> @@ -238,6 +238,7 @@
> /* Intel-defined CPU features, CPUID level 0x00000007:0 (EBX), word 9 */
> #define X86_FEATURE_FSGSBASE ( 9*32+ 0) /* RDFSBASE, WRFSBASE, RDGSBASE, WRGSBASE instructions*/
> #define X86_FEATURE_TSC_ADJUST ( 9*32+ 1) /* TSC adjustment MSR 0x3B */
> +#define X86_FEATURE_SGX ( 9*32+ 2) /* Software Guard Extensions */
> #define X86_FEATURE_BMI1 ( 9*32+ 3) /* 1st group bit manipulation extensions */
> #define X86_FEATURE_HLE ( 9*32+ 4) /* Hardware Lock Elision */
> #define X86_FEATURE_AVX2 ( 9*32+ 5) /* AVX2 instructions */
> @@ -373,6 +374,10 @@
> #define X86_FEATURE_CORE_CAPABILITIES (18*32+30) /* "" IA32_CORE_CAPABILITIES MSR */
> #define X86_FEATURE_SPEC_CTRL_SSBD (18*32+31) /* "" Speculative Store Bypass Disable */
>
> +/* Intel-defined SGX features, CPUID level 0x00000012:0 (EAX), word 19 */
> +#define X86_FEATURE_SGX1 (19*32+ 0) /* SGX1 leaf functions */
> +#define X86_FEATURE_SGX2 (19*32+ 1) /* SGX2 leaf functions */
> +
> /*
> * BUG word(s)
> */
> diff --git a/arch/x86/include/asm/disabled-features.h b/arch/x86/include/asm/disabled-features.h
> index 4ea8584682f9..dbe534d5153f 100644
> --- a/arch/x86/include/asm/disabled-features.h
> +++ b/arch/x86/include/asm/disabled-features.h
> @@ -28,13 +28,18 @@
> # define DISABLE_CYRIX_ARR (1<<(X86_FEATURE_CYRIX_ARR & 31))
> # define DISABLE_CENTAUR_MCR (1<<(X86_FEATURE_CENTAUR_MCR & 31))
> # define DISABLE_PCID 0
> +# define DISABLE_SGX1 0
> +# define DISABLE_SGX2 0
> #else
> # define DISABLE_VME 0
> # define DISABLE_K6_MTRR 0
> # define DISABLE_CYRIX_ARR 0
> # define DISABLE_CENTAUR_MCR 0
> # define DISABLE_PCID (1<<(X86_FEATURE_PCID & 31))
> -#endif /* CONFIG_X86_64 */
> +# define DISABLE_SGX1 (1<<(X86_FEATURE_SGX1 & 31))
> +# define DISABLE_SGX2 (1<<(X86_FEATURE_SGX2 & 31))
> + #endif /* CONFIG_X86_64 */
> +
>
> #ifdef CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS
> # define DISABLE_PKU 0
> @@ -56,6 +61,12 @@
> # define DISABLE_PTI (1 << (X86_FEATURE_PTI & 31))
> #endif
>
> +#ifdef CONFIG_INTEL_SGX
> +# define DISABLE_SGX 0
> +#else
> +# define DISABLE_SGX (1 << (X86_FEATURE_SGX & 31))
> +#endif
> +
> /*
> * Make sure to add features to the correct mask
> */
> @@ -68,7 +79,7 @@
> #define DISABLED_MASK6 0
> #define DISABLED_MASK7 (DISABLE_PTI)
> #define DISABLED_MASK8 0
> -#define DISABLED_MASK9 (DISABLE_SMAP)
> +#define DISABLED_MASK9 (DISABLE_SMAP|DISABLE_SGX)
> #define DISABLED_MASK10 0
> #define DISABLED_MASK11 0
> #define DISABLED_MASK12 0
> @@ -78,6 +89,7 @@
> #define DISABLED_MASK16 (DISABLE_PKU|DISABLE_OSPKE|DISABLE_LA57|DISABLE_UMIP)
> #define DISABLED_MASK17 0
> #define DISABLED_MASK18 0
> -#define DISABLED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 19)
> +#define DISABLED_MASK19 (DISABLE_SGX1|DISABLE_SGX2)
> +#define DISABLED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 20)
>
> #endif /* _ASM_X86_DISABLED_FEATURES_H */
> diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
> index e8370e64a155..18e08da19f16 100644
> --- a/arch/x86/include/asm/msr-index.h
> +++ b/arch/x86/include/asm/msr-index.h
> @@ -582,6 +582,7 @@
> #define FEAT_CTL_LOCKED BIT(0)
> #define FEAT_CTL_VMX_ENABLED_INSIDE_SMX BIT(1)
> #define FEAT_CTL_VMX_ENABLED_OUTSIDE_SMX BIT(2)
> +#define FEAT_CTL_SGX_ENABLED BIT(18)
> #define FEAT_CTL_LMCE_ENABLED BIT(20)
>
> #define MSR_IA32_TSC_ADJUST 0x0000003b
> diff --git a/arch/x86/include/asm/required-features.h b/arch/x86/include/asm/required-features.h
> index 6847d85400a8..039e58be2fe6 100644
> --- a/arch/x86/include/asm/required-features.h
> +++ b/arch/x86/include/asm/required-features.h
> @@ -101,6 +101,6 @@
> #define REQUIRED_MASK16 0
> #define REQUIRED_MASK17 0
> #define REQUIRED_MASK18 0
> -#define REQUIRED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 19)
> +#define REQUIRED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 20)
>
> #endif /* _ASM_X86_REQUIRED_FEATURES_H */
> diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
> index 95c090a45b4b..7aecf5d07c70 100644
> --- a/arch/x86/kernel/cpu/common.c
> +++ b/arch/x86/kernel/cpu/common.c
> @@ -914,6 +914,10 @@ void get_cpu_cap(struct cpuinfo_x86 *c)
> c->x86_capability[CPUID_D_1_EAX] = eax;
> }
>
> + /* Additional Intel-defined SGX flags: level 0x00000012 */
> + if (c->cpuid_level >= 0x00000012)
> + c->x86_capability[CPUID_12_EAX] = cpuid_eax(0x00000012);
> +
> /* AMD-defined flags: level 0x80000001 */
> eax = cpuid_eax(0x80000000);
> c->extended_cpuid_level = eax;
> --
> 2.25.1
Powered by blists - more mailing lists