Intel(R) SGX is a set of CPU instructions that can be used by applications
to set aside private regions of code and data. The code outside the enclave
is disallowed to access the memory inside the enclave by the CPU access
control.
There is a new hardware unit in the processor called Memory Encryption
Engine (MEE) starting from the Skylake microacrhitecture. BIOS can define
one or many MEE regions that can hold enclave data by configuring them with
PRMRR registers.
The MEE automatically encrypts the data leaving the processor package to
the MEE regions. The data is encrypted using a random key whose life-time
is exactly one power cycle.
The current implementation requires that the firmware sets
IA32_SGXLEPUBKEYHASH* MSRs as writable so that ultimately the kernel can
decide what enclaves it wants run. The implementation does not create
any bottlenecks to support read-only MSRs later on.
You can tell if your CPU supports SGX by looking into /proc/cpuinfo:
cat /proc/cpuinfo | grep sgx
v39 (2020-10-03):
* A new GIT tree location.
git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-sgx.git
* Return -ERESTARTSYS instead of -EINTR in SGX_IOC_ENCLAVE_ADD_PAGES.
https://lore.kernel.org/linux-sgx/[email protected]/T/#u
* Do not initialize 'encl_size' in sgx_encl_create before
sgx_validate_secs() is called.
https://lore.kernel.org/linux-sgx/[email protected]/
* Revert 'count' back to struct sgx_enclave_add_pages, move the check of
-EIO to sgx_ioc_enclave_pages() instead of being buried in subfunctions.
https://lore.kernel.org/linux-sgx/[email protected]/
* Fix documentation for the 'encl' parameter in sgx_ioc_enclave_create(),
sgx_ioc_enclave_init() and sgx_ioc_enclave_provision().
https://lore.kernel.org/linux-sgx/[email protected]/
* Refine sgx_ioc_enclave_create() kdoc to better describe the meaning and
purpose of SECS validation done by sgx_validate_secs().
https://lore.kernel.org/linux-sgx/[email protected]/
* Improve documentation sgx_ioc_enclave_add_pages() on IO failures.
https://lore.kernel.org/linux-sgx/[email protected]/
* Fix a bug in __sgx_encl_add_page(). When get_user_pages() fails, we must
return -EFAULT instead of mistakenly returning the page count.
Reported by Haitao Huang.
* Rewrite the commit message for vm_ops->mprotect() (courtesy of Dave Hansen)
https://lore.kernel.org/linux-sgx/[email protected]/
* Fix ptrace support coding style issues.
https://lore.kernel.org/linux-sgx/[email protected]/
* Fix the documentation.
https://lore.kernel.org/linux-sgx/[email protected]/
* Always write MSRs for the public key before EINIT.
https://lore.kernel.org/linux-sgx/[email protected]/
* Categorically disabled enclaves from noexec partitions.
https://lore.kernel.org/linux-sgx/[email protected]/
* Properly document the EWB flow, i.e. why there is three trials for EWB.
https://lore.kernel.org/linux-sgx/[email protected]/
* Add kdoc about batch processing to sgx_reclaim_pages().
https://lore.kernel.org/linux-sgx/[email protected]/
https://lore.kernel.org/linux-mm/[email protected]/
* Documentation fixes.
https://lore.kernel.org/linux-sgx/[email protected]/T/#me637011aba9f45698eba88ff195452c0491c07fe
* SGX vDSO clean ups.
https://lore.kernel.org/linux-sgx/[email protected]/T/#ma2204bba8d8e8a09bf9164fc1bb5c55813997b4a
* Add the commit message from "x86/vdso: Add support for exception fixup in vDSO functions" to Documentation/x86/sgx.rst
https://lore.kernel.org/linux-sgx/[email protected]/
* Update correct attributes variable when allowing provisioning.
https://lore.kernel.org/linux-sgx/[email protected]/T/#t
* Remove sgx_exception and put its fields to sgx_exception.
https://lore.kernel.org/linux-sgx/[email protected]/T/#u
* Remove 'exit_reason' and put EEXIT to 'self' field of sgx_enclave_run.
https://lore.kernel.org/linux-sgx/[email protected]/T/#u
* Refine clarity of the field names in struct sgx_enclave_run and vsgx.S, and rewrite kdoc.
https://lore.kernel.org/linux-sgx/[email protected]/T/#u
* Fix memory validation in vsgx.S. The reserved areas was not zero validated,
which causes unnecessary risk for memory corruption bugs. In effect, 'flags'
field can be removed from struct sgx_enclave_run.
https://lore.kernel.org/linux-sgx/[email protected]/T/#u
* Reduce the size of sgx_enclave_run from 256 bytes to 64 bytes, i.e. size of
a cache line. This leave 24 bytes of free space to waste in future.
https://lore.kernel.org/linux-sgx/[email protected]/T/#u
* Verify atttributes, miscsselect and xfrm also in EINIT against SIGSTRUCT set
limits.
https://lore.kernel.org/linux-sgx/[email protected]/
* Use plain lfence instead of retpoline in the vDSO because retpoline has
the potential to cause forward compatibility issues with the future
microarchitecture features. One such in already sight is CET-SS.
https://lore.kernel.org/linux-sgx/[email protected]/T/#ma65748158e2b967dbc1d9ac3b214a1415066d61c
v38:
* Fast iteration because I had email server issues with v37. Using
temporary SMTP for this (mail.kapsi.fi).
* Return -EINTR when no data is processed, just like read().
https://patchwork.kernel.org/patch/11773941/
* Remove cruft from SGX_IOC_ENCLAVE_ADD_PAGES and fix the return value.
https://lore.kernel.org/linux-sgx/[email protected]/T/#mc643ef2ab477f5f7aa5d463d883d1308eb44d6f1
v37:
* Remove MODULE_*().
https://lore.kernel.org/linux-sgx/[email protected]/
* Fix mmap() type check.
https://lore.kernel.org/linux-sgx/20200827152051.GB22351@sjchrist-ice/
* Fix ioctl-number.txt.
https://lore.kernel.org/linux-sgx/[email protected]/
* Fix SPDX identifier in arch/x86/include/uapi/asm/sgx.h
https://lore.kernel.org/linux-sgx/[email protected]/
* Consistently document "@encl: an enclave pointer".
https://lore.kernel.org/linux-sgx/[email protected]/
* Renamed SGX_IOC_ENCLAVE_SET_ATTRIBUTE as SGX_IOC_ENCLAVE_PROVISION and
cleaned up associated code. Also fixed issues of code introduced too
early that were caused by the split. Now it should be more streamlined.
https://lore.kernel.org/linux-sgx/[email protected]/
* Fixed signed integer shift overflow:
https://github.com/intel/linux-sgx-driver/pull/16/commits d27ca6071b2b28e2e789d265eda796dd9fc65a64
* Fixed off-by-one error in a size calculation:
https://github.com/intel/SGXDataCenterAttestationPrimitives/commit/e44cc238becf584cc079aef40b557c6af9a03f38
* Rework vDSO API with a context structure for IO data.
https://lore.kernel.org/linux-sgx/[email protected]/
* Refined commentary about retry-loop with ENCLS[EINIT] based on Sean's response.
https://lore.kernel.org/linux-sgx/[email protected]/
* Return positive number from SGX_IOC_ENCLAVE_ADD_PAGES indicating the
number of pages processed and set a fixed 1MB limit for length. In addition,
on interrupt, return 0 and number of processed pages instead of -EINTR.
https://lore.kernel.org/linux-sgx/[email protected]/
v36:
* Make a self-contained mprotect() handler.
* Move from radix_tree to xarray, which is more modern and robust data
structure for managing large sparse arrays. Rename encl->page_tree as
encl->page_array.
v35:
* Add missing SGX_ENCL_DEAD check to sgx_ioctl().
v34:
* Remove SGX_ENCL_DEAD checks from ioctl.c, as the file is open while
executing an ioctl.
* Split driver patch into base patch and one patch for each ioctl.
* Move encl->flags check to the beginning of each ioctl. Return
consistently -EINVAL if they don't match the expected values. Before,
sometimes -EFAULT was returned instead of -EINVAL.
* Rename vm_ops->may_mprotect as vm_ops->mprotect() and move the call
right before call to mprotect_fixup().
v33:
* Rebased to v5.8-rc1. Given the core changes (mmap_lock and #DB
handling), it made sense to update the series.
* Refined documentation about how remote attestation is done in SGX.
v32:
* v31 contained not fully cleaned up main.c after merger of main.c and
reclaim.c. Fixed in this version.
* Rebased to v5.7. Forgot to do this for v31.
v31:
* Unset SGX_ENCL_IOCTL in the error path of checking encl->flags in order
to prevent leaving it set and thus block any further ioctl calls.
* Added missing cleanup_srcu_struct() call to sgx_encl_release().
* Take encl->lock in sgx_encl_add_page() in order to prevent races with
the page reclaimer.
* Fix a use-after-free bug from the page reclaimer. Call kref_put() for
encl->refcount only after putting enclave page back to the active page
list because it could be the last ref to the enclave.
* Filter any CPU disallowed values from sigstruct->vendor
SGX_IOC_ENCLAVE_INIT.
* Use bits 0-7 of page descriptor for the EPC section index. This
should be enough for long term needs.
* Refined naming for functions that allocate and free EPC pages to
be more sound and consistent.
* Merge main.c and reclaim.c into one.
v30:
Bunch of tags added. No actual code changes.
v29:
* The selftest has been moved to selftests/sgx. Because SGX is an execution
environment of its own, it really isn't a great fit with more "standard"
x86 tests.
The RSA key is now generated on fly and the whole signing process has
been made as part of the enclave loader instead of signing the enclave
during the compilation time.
Finally, the enclave loader loads now the test enclave directly from its
ELF file, which means that ELF file does not need to be coverted as raw
binary during the build process.
* Version the mm_list instead of using on synchronize_mm() when adding new
entries. We hold the write lock for the mm_struct, and dup_mm() can thus
deadlock with the page reclaimer, which could hold the lock for the old
mm_struct.
* Disallow mmap(PROT_NONE) from /dev/sgx. Any mapping (e.g. anonymous) can
be used to reserve the address range. Now /dev/sgx supports only opaque
mappings to the (initialized) enclave data.
* Make the vDSO callable directly from C by preserving RBX and taking leaf
from RCX.
v28:
* Documented to Documentation/x86/sgx.rst how the kernel manages the
enclave ownership.
* Removed non-LC flow from sgx_einit().
* Removed struct sgx_einittoken since only the size of the corresponding
microarchitectural structure is used in the series ATM.
v27:
* Disallow RIE processes to use enclaves as there could a permission
conflict between VMA and enclave permissions.
* In the documentation, replace "grep /proc/cpuinfo" with
"grep sgx /proc/cpuinfo".
v26:
* Fixed the commit author in "x86/sgx: Linux Enclave Driver", which was
changed in v25 by mistake.
* Addressed a bunch of grammar mistakes in sgx.rst (thanks Randy once
again for such a detailed feedback).
* Added back the MAINTAINERS update commit, which was mistakenly removed
in v25.
* EREMOVE's for SECS cannot be done while sanitizing an EPC section. The
CPU does not allow to remove a SECS page before all of its children have
been removed, and a child page can be in some other section than the one
currently being processed. Thus, removed special SECS processing from
sgx_sanitize_page() and instead put sections through it twice. In the
2nd round the lists should only contain SECS pages.
v25:
* Fix a double-free issue when SGX_IOC_ENCLAVE_ADD_PAGES
fails on executing ENCLS[EADD]. The rollback path executed
radix_tree_delete() on the same address twice when this happened.
* Return -EINTR instead of -ERESTARTSYS in SGX_IOC_ENCLAVE_ADD_PAGES when
a signal is pending.
* As requested by Borislav, move the CPUID 0x12 features to their own word
in cpufeatures.
* Sean fixed a bug from sgx_reclaimer_write() where sgx_encl_put_backing()
was called with an uninitialized pointer when sgx_encl_get_backing()
fails.
* Migrated /dev/sgx/* to misc. This is future-proof as struct miscdevice
has 'groups' for setting up sysfs attributes for the device.
* Use device_initcall instead of subsys_initcall so that misc_class is
initialized before SGX is initialized.
* Return -EACCES in SGX_IOC_ENCLAVE_INIT when caller tries to select
enclave attributes that we the kernel does not allow it to set instead
of -EINVAL.
* Unless SGX public key MSRs are writable always deny the feature from
Linux. Previously this was only denied from driver. How VMs should be
supported is not really part of initial patch set, which makes this
an obvious choice.
* Cleaned up and refined documentation to be more approachable.
v24:
* Reclaim unmeasured and TCS pages (regression in v23).
* Replace usages of GFP_HIGHUSER with GFP_KERNEL.
* Return -EIO on when EADD or EEXTEND fails in %SGX_IOC_ENCLAVE_ADD_PAGES
and use the same rollback (destroy enclave). This can happen when host
suspends itself unknowingly to a VM running enclaves. From -EIO the user
space can deduce what happened.
* Have a separate @count in struct sgx_enclave_add_pages to output number
of bytes processed instead of overwriting the input parameters for
clarity and more importantly that the API provides means for partial
processing (@count could be less than @length in success case).
v23:
* Replace SGX_ENCLAVE_ADD_PAGE with SGX_ENCLAVE_ADD_PAGES. Replace @mrmask
with %SGX_PAGE_MEASURE flag.
* Return -EIO instead of -ECANCELED when ptrace() fails to read a TCS page.
* In the reclaimer, pin page before ENCLS[EBLOCK] because pinning can fail
(because of OOM) even in legit behaviour and after EBLOCK the reclaiming
flow can be only reverted by killing the whole enclave.
* Fixed SGX_ATTR_RESERVED_MASK. Bit 7 was marked as reserved while in fact
it should have been bit 6 (Table 37-3 in the SDM).
* Return -EPERM from SGX_IOC_ENCLAVE_INIT when ENCLS[EINIT] returns an SGX
error code.
v22:
* Refined bunch commit messages and added associated SDM references as
many of them were too exhausting and some outdated.
* Alignment checks have been removed from mmap() because it does not define
the ELRANGE. VMAs only act as windows to the enclave. The semantics
compare somewhat how mmap() works with regular files.
* We now require user space addresses given to SGX_IOC_ENCLAVE_ADD_PAGE to be
page aligned so that we can pass the page directly to EADD and do not have
to do an extra copy. This was made effectively possible by removing the
worker thread for adding pages.
* The selftest build files have been refined throughout of various glitches
and work properly in a cross compilation environment such as BuildRoot.
In addition, libcalls fail the build with an assertion in the linker
script, if they end up to the enclave binary.
* CONFIG_INTEL_SGX_DRIVER has been removed because you cannot use SGX core
for anything without having the driver. This could change when KVM support
is added.
* We require zero permissions in SECINFO for TCS pages because the CPU
overwrites SECINFO flags with zero permissions and measures the page
only after that. Allowing to pass TCS with non-zero permissions would
cause mismatching measurement between the one provided in SIGSTRUCT and
the one computed by the CPU.
* Obviously lots of small fixes and clean ups (does make sense to
document them all).
v21:
* Check on mmap() that the VMA does cover an area that does not have
enclave pages. Only mapping with PROT_NONE can do that to reserve
initial address space for an enclave.
* Check om mmap() and mprotect() that the VMA permissions do not
surpass the enclave permissions.
* Remove two refcounts from vma_close(): mm_list and encl->refcount.
Enclave refcount is only need for swapper/enclave sync and we can
remove mm_list refcount by destroying mm_struct when the process
is closed. By not having vm_close() the Linux MM can merge VMAs.
* Do not naturally align MAP_FIXED address.
* Numerous small fixes and clean ups.
* Use SRCU for synchronizing the list of mm_struct's.
* Move to stack based call convention in the vDSO.
v20:
* Fine-tune Kconfig messages and spacing and remove MMU_NOTIFIER
dependency as MMU notifiers are no longer used in the driver.
* Use mm_users instead of mm_count as refcount for mm_struct as mm_count
only protects from deleting mm_struct, not removing its contents.
* Sanitize EPC when the reclaimer thread starts by doing EREMOVE for all
of them. They could be in initialized state when the kernel starts
because it might be spawned by kexec().
* Documentation overhaul.
* Use a device /dev/sgx/provision for delivering the provision token
instead of securityfs.
* Create a reference to the enclave when already when opening
/dev/sgx/enclave. The file is then associated with this enclave only.
mmap() can be done at free at any point and always get a reference to
the enclave. To summarize the file now represents the enclave.
v19:
* Took 3-4 months but in some sense this was more like a rewrite of most
of the corners of the source code. If I've forgotten to deal with some
feedback, please don't shout me. Make a remark and I will fix it for
the next version. Hopefully there won't be this big turnovers anymore.
* Validate SECS attributes properly against CPUID given attributes and
against allowed attributes. SECS attributes are the ones that are
enforced whereas SIGSTRUCT attributes tell what is required to run
the enclave.
* Add KSS (Key Sharing Support) to the enclave attributes.
* Deny MAP_PRIVATE as an enclave is always a shared memory entity.
* Revert back to shmem backing storage so that it can be easily shared
by multiple processes.
* Split the recognization of an ENCLS leaf failure by using three
functions to detect it: encsl_faulted(), encls_returned_code() and
sgx_failed(). encls_failed() is only caused by a spurious expections that
should never happen. Thus, it is not defined as an inline function in
order to easily insert a kprobe to it.
* Move low-level enclave management routines, page fault handler and page
reclaiming routines from driver to the core. These cannot be separated
from each other as they are heavily interdependent. The rationale is that
the core does not call any code from the driver.
* Allow the driver to be compiled as a module now that it no code is using
its routines and it only uses exported symbols. Now the driver is
essentially just a thin ioctl layer.
* Reworked the driver to maintain a list of mm_struct's. The VMA callbacks
add new entries to this list as the process is forked. Each entry has
its own refcount because they have a different life-cycle as the enclave
does. In effect @tgid and @mm have been removed from struct sgx_encl
and we allow forking by removing VM_DONTCOPY from vm flags.
* Generate a cpu mask in the reclaimer from the cpu mask's of all
mm_struct's. This will kick out the hardware threads out of the enclave
from multiple processes. It is not a local variable because it would
eat too much of the stack space but instead a field in struct
sgx_encl.
* Allow forking i.e. remove VM_DONTCOPY. I did not change the API
because the old API scaled to the workload that Andy described. The
codebase is now mostly API independent i.e. changing the API is a
small task. For me the proper trigger to chanage it is a as concrete
as possible workload that cannot be fulfilled. I hope you understand
my thinking here. I don't want to change anything w/o proper basis
but I'm ready to change anything if there is a proper basis. I do
not have any kind of attachment to any particular type of API.
* Add Sean's vDSO ENCLS(EENTER) patches and update selftest to use the
new vDSO.
v18:
* Update the ioctl-number.txt.
* Move the driver under arch/x86.
* Add SGX features (SGX, SGX1, SGX2) to the disabled-features.h.
* Rename the selftest as test_sgx (previously sgx-selftest).
* In order to enable process accounting, swap EPC pages and PCMD's to a VMA
instead of shmem.
* Allow only to initialize and run enclaves with a subset of
{DEBUG, MODE64BIT} set.
* Add SGX_IOC_ENCLAVE_SET_ATTRIBUTE to allow an enclave to have privileged
attributes e.g. PROVISIONKEY.
v17:
* Add a simple selftest.
* Fix a null pointer dereference to section->pages when its
allocation fails.
* Add Sean's description of the exception handling to the documentation.
v16:
* Fixed SOB's in the commits that were a bit corrupted in v15.
* Implemented exceptio handling properly to detect_sgx().
* Use GENMASK() to define SGX_CPUID_SUB_LEAF_TYPE_MASK.
* Updated the documentation to use rst definition lists.
* Added the missing Documentation/x86/index.rst, which has a link to
intel_sgx.rst. Now the SGX and uapi documentation is properly generated
with 'make htmldocs'.
* While enumerating EPC sections, if an undefined section is found, fail
the driver initialization instead of continuing the initialization.
* Issue a warning if there are more than %SGX_MAX_EPC_SECTIONS.
* Remove copyright notice from arch/x86/include/asm/sgx.h.
* Migrated from ioremap_cache() to memremap().
v15:
* Split into more digestable size patches.
* Lots of small fixes and clean ups.
* Signal a "plain" SIGSEGV on an EPCM violation.
v14:
* Change the comment about X86_FEATURE_SGX_LC from “SGX launch
configuration” to “SGX launch control”.
* Move the SGX-related CPU feature flags as part of the Linux defined
virtual leaf 8.
* Add SGX_ prefix to the constants defining the ENCLS leaf functions.
* Use GENMASK*() and BIT*() in sgx_arch.h instead of raw hex numbers.
* Refine the long description for CONFIG_INTEL_SGX_CORE.
* Do not use pr_*_ratelimited() in the driver. The use of the rate limited
versions is legacy cruft from the prototyping phase.
* Detect sleep with SGX_INVALID_EINIT_TOKEN instead of counting power
cycles.
* Manually prefix with “sgx:” in the core SGX code instead of redefining
pr_fmt.
* Report if IA32_SGXLEPUBKEYHASHx MSRs are not writable in the driver
instead of core because it is a driver requirement.
* Change prompt to bool in the entry for CONFIG_INTEL_SGX_CORE because the
default is ‘n’.
* Rename struct sgx_epc_bank as struct sgx_epc_section in order to match
the SDM.
* Allocate struct sgx_epc_page instances one at a time.
* Use “__iomem void *” pointers for the mapped EPC memory consistently.
* Retry once on SGX_INVALID_TOKEN in sgx_einit() instead of counting power
cycles.
* Call enclave swapping operations directly from the driver instead of
calling them .indirectly through struct sgx_epc_page_ops because indirect
calls are not required yet as the patch set does not contain the KVM
support.
* Added special signal SEGV_SGXERR to notify about SGX EPCM violation
errors.
v13:
* Always use SGX_CPUID constant instead of a hardcoded value.
* Simplified and documented the macros and functions for ENCLS leaves.
* Enable sgx_free_page() to free active enclave pages on demand
in order to allow sgx_invalidate() to delete enclave pages.
It no longer performs EREMOVE if a page is in the process of
being reclaimed.
* Use PM notifier per enclave so that we don't have to traverse
the global list of active EPC pages to find enclaves.
* Removed unused SGX_LE_ROLLBACK constant from uapi/asm/sgx.h
* Always use ioremap() to map EPC banks as we only support 64-bit kernel.
* Invalidate IA32_SGXLEPUBKEYHASH cache used by sgx_einit() when going
to sleep.
v12:
* Split to more narrow scoped commits in order to ease the review process and
use co-developed-by tag for co-authors of commits instead of listing them in
the source files.
* Removed cruft EXPORT_SYMBOL() declarations and converted to static variables.
* Removed in-kernel LE i.e. this version of the SGX software stack only
supports unlocked IA32_SGXLEPUBKEYHASHx MSRs.
* Refined documentation on launching enclaves, swapping and enclave
construction.
* Refined sgx_arch.h to include alignment information for every struct that
requires it and removed structs that are not needed without an LE.
* Got rid of SGX_CPUID.
* SGX detection now prints log messages about firmware configuration issues.
v11:
* Polished ENCLS wrappers with refined exception handling.
* ksgxswapd was not stopped (regression in v5) in
sgx_page_cache_teardown(), which causes a leaked kthread after driver
deinitialization.
* Shutdown sgx_le_proxy when going to suspend because its EPC pages will be
invalidated when resuming, which will cause it not function properly
anymore.
* Set EINITTOKEN.VALID to zero for a token that is passed when
SGXLEPUBKEYHASH matches MRSIGNER as alloc_page() does not give a zero
page.
* Fixed the check in sgx_edbgrd() for a TCS page. Allowed to read offsets
around the flags field, which causes a #GP. Only flags read is readable.
* On read access memcpy() call inside sgx_vma_access() had src and dest
parameters in wrong order.
* The build issue with CONFIG_KASAN is now fixed. Added undefined symbols
to LE even if “KASAN_SANITIZE := false” was set in the makefile.
* Fixed a regression in the #PF handler. If a page has
SGX_ENCL_PAGE_RESERVED flag the #PF handler should unconditionally fail.
It did not, which caused weird races when trying to change other parts of
swapping code.
* EPC management has been refactored to a flat LRU cache and moved to
arch/x86. The swapper thread reads a cluster of EPC pages and swaps all
of them. It can now swap from multiple enclaves in the same round.
* For the sake of consistency with SGX_IOC_ENCLAVE_ADD_PAGE, return -EINVAL
when an enclave is already initialized or dead instead of zero.
v10:
* Cleaned up anon inode based IPC between the ring-0 and ring-3 parts
of the driver.
* Unset the reserved flag from an enclave page if EDBGRD/WR fails
(regression in v6).
* Close the anon inode when LE is stopped (regression in v9).
* Update the documentation with a more detailed description of SGX.
v9:
* Replaced kernel-LE IPC based on pipes with an anonymous inode.
The driver does not require anymore new exports.
v8:
* Check that public key MSRs match the LE public key hash in the
driver initialization when the MSRs are read-only.
* Fix the race in VA slot allocation by checking the fullness
immediately after succeesful allocation.
* Fix the race in hash mrsigner calculation between the launch
enclave and user enclaves by having a separate lock for hash
calculation.
v7:
* Fixed offset calculation in sgx_edbgr/wr(). Address was masked with PAGE_MASK
when it should have been masked with ~PAGE_MASK.
* Fixed a memory leak in sgx_ioc_enclave_create().
* Simplified swapping code by using a pointer array for a cluster
instead of a linked list.
* Squeezed struct sgx_encl_page to 32 bytes.
* Fixed deferencing of an RSA key on OpenSSL 1.1.0.
* Modified TC's CMAC to use kernel AES-NI. Restructured the code
a bit in order to better align with kernel conventions.
v6:
* Fixed semaphore underrun when accessing /dev/sgx from the launch enclave.
* In sgx_encl_create() s/IS_ERR(secs)/IS_ERR(encl)/.
* Removed virtualization chapter from the documentation.
* Changed the default filename for the signing key as signing_key.pem.
* Reworked EPC management in a way that instead of a linked list of
struct sgx_epc_page instances there is an array of integers that
encodes address and bank of an EPC page (the same data as 'pa' field
earlier). The locking has been moved to the EPC bank level instead
of a global lock.
* Relaxed locking requirements for EPC management. EPC pages can be
released back to the EPC bank concurrently.
* Cleaned up ptrace() code.
* Refined commit messages for new architectural constants.
* Sorted includes in every source file.
* Sorted local variable declarations according to the line length in
every function.
* Style fixes based on Darren's comments to sgx_le.c.
v5:
* Described IPC between the Launch Enclave and kernel in the commit messages.
* Fixed all relevant checkpatch.pl issues that I have forgot fix in earlier
versions except those that exist in the imported TinyCrypt code.
* Fixed spelling mistakes in the documentation.
* Forgot to check the return value of sgx_drv_subsys_init().
* Encapsulated properly page cache init and teardown.
* Collect epc pages to a temp list in sgx_add_epc_bank
* Removed SGX_ENCLAVE_INIT_ARCH constant.
v4:
* Tied life-cycle of the sgx_le_proxy process to /dev/sgx.
* Removed __exit annotation from sgx_drv_subsys_exit().
* Fixed a leak of a backing page in sgx_process_add_page_req() in the
case when vm_insert_pfn() fails.
* Removed unused symbol exports for sgx_page_cache.c.
* Updated sgx_alloc_page() to require encl parameter and documented the
behavior (Sean Christopherson).
* Refactored a more lean API for sgx_encl_find() and documented the behavior.
* Moved #PF handler to sgx_fault.c.
* Replaced subsys_system_register() with plain bus_register().
* Retry EINIT 2nd time only if MSRs are not locked.
v3:
* Check that FEATURE_CONTROL_LOCKED and FEATURE_CONTROL_SGX_ENABLE are set.
* Return -ERESTARTSYS in __sgx_encl_add_page() when sgx_alloc_page() fails.
* Use unused bits in epc_page->pa to store the bank number.
* Removed #ifdef for WQ_NONREENTRANT.
* If mmu_notifier_register() fails with -EINTR, return -ERESTARTSYS.
* Added --remove-section=.got.plt to objcopy flags in order to prevent a
dummy .got.plt, which will cause an inconsistent size for the LE.
* Documented sgx_encl_* functions.
* Added remark about AES implementation used inside the LE.
* Removed redundant sgx_sys_exit() from le/main.c.
* Fixed struct sgx_secinfo alignment from 128 to 64 bytes.
* Validate miscselect in sgx_encl_create().
* Fixed SSA frame size calculation to take the misc region into account.
* Implemented consistent exception handling to __encls() and __encls_ret().
* Implemented a proper device model in order to allow sysfs attributes
and in-kernel API.
* Cleaned up various "find enclave" implementations to the unified
sgx_encl_find().
* Validate that vm_pgoff is zero.
* Discard backing pages with shmem_truncate_range() after EADD.
* Added missing EEXTEND operations to LE signing and launch.
* Fixed SSA size for GPRS region from 168 to 184 bytes.
* Fixed the checks for TCS flags. Now DBGOPTIN is allowed.
* Check that TCS addresses are in ELRANGE and not just page aligned.
* Require kernel to be compiled with X64_64 and CPU_SUP_INTEL.
* Fixed an incorrect value for SGX_ATTR_DEBUG from 0x01 to 0x02.
v2:
* get_rand_uint32() changed the value of the pointer instead of value
where it is pointing at.
* Launch enclave incorrectly used sigstruct attributes-field instead of
enclave attributes-field.
* Removed unused struct sgx_add_page_req from sgx_ioctl.c
* Removed unused sgx_has_sgx2.
* Updated arch/x86/include/asm/sgx.h so that it provides stub
implementations when sgx in not enabled.
* Removed cruft rdmsr-calls from sgx_set_pubkeyhash_msrs().
* return -ENOMEM in sgx_alloc_page() when VA pages consume too much space
* removed unused global sgx_nr_pids
* moved sgx_encl_release to sgx_encl.c
* return -ERESTARTSYS instead of -EINTR in sgx_encl_init()
Jarkko Sakkinen (14):
x86/sgx: Add SGX microarchitectural data structures
x86/sgx: Add wrappers for ENCLS leaf functions
x86/cpu/intel: Add nosgx kernel parameter
x86/sgx: Add __sgx_alloc_epc_page() and sgx_free_epc_page()
x86/sgx: Add SGX enclave driver
x86/sgx: Add SGX_IOC_ENCLAVE_CREATE
x86/sgx: Add SGX_IOC_ENCLAVE_ADD_PAGES
x86/sgx: Add SGX_IOC_ENCLAVE_INIT
x86/sgx: Add SGX_IOC_ENCLAVE_PROVISION
x86/sgx: Add a page reclaimer
x86/sgx: Add ptrace() support for the SGX driver
selftests/x86: Add a selftest for SGX
docs: x86/sgx: Document SGX micro architecture and kernel internals
x86/sgx: Update MAINTAINERS
Sean Christopherson (10):
x86/cpufeatures: x86/msr: Add Intel SGX hardware bits
x86/cpufeatures: x86/msr: Add Intel SGX Launch Control hardware bits
x86/mm: x86/sgx: Signal SIGSEGV with PF_SGX
x86/cpu/intel: Detect SGX support
x86/sgx: Initialize metadata for Enclave Page Cache (EPC) sections
mm: Add 'mprotect' hook to struct vm_operations_struct
x86/vdso: Add support for exception fixup in vDSO functions
x86/fault: Add helper function to sanitize error code
x86/traps: Attempt to fixup exceptions in vDSO before signaling
x86/vdso: Implement a vDSO for Intel SGX enclave call
.../admin-guide/kernel-parameters.txt | 2 +
.../userspace-api/ioctl/ioctl-number.rst | 1 +
Documentation/x86/index.rst | 1 +
Documentation/x86/sgx.rst | 284 ++++++
MAINTAINERS | 11 +
arch/x86/Kconfig | 17 +
arch/x86/entry/vdso/Makefile | 8 +-
arch/x86/entry/vdso/extable.c | 46 +
arch/x86/entry/vdso/extable.h | 28 +
arch/x86/entry/vdso/vdso-layout.lds.S | 9 +-
arch/x86/entry/vdso/vdso.lds.S | 1 +
arch/x86/entry/vdso/vdso2c.h | 50 +-
arch/x86/entry/vdso/vsgx.S | 157 ++++
arch/x86/include/asm/cpufeature.h | 5 +-
arch/x86/include/asm/cpufeatures.h | 8 +-
arch/x86/include/asm/disabled-features.h | 18 +-
arch/x86/include/asm/enclu.h | 9 +
arch/x86/include/asm/msr-index.h | 8 +
arch/x86/include/asm/required-features.h | 2 +-
arch/x86/include/asm/trap_pf.h | 1 +
arch/x86/include/asm/vdso.h | 5 +
arch/x86/include/uapi/asm/sgx.h | 175 ++++
arch/x86/kernel/cpu/Makefile | 1 +
arch/x86/kernel/cpu/common.c | 4 +
arch/x86/kernel/cpu/feat_ctl.c | 41 +-
arch/x86/kernel/cpu/sgx/Makefile | 5 +
arch/x86/kernel/cpu/sgx/arch.h | 341 +++++++
arch/x86/kernel/cpu/sgx/driver.c | 204 +++++
arch/x86/kernel/cpu/sgx/driver.h | 32 +
arch/x86/kernel/cpu/sgx/encl.c | 760 ++++++++++++++++
arch/x86/kernel/cpu/sgx/encl.h | 128 +++
arch/x86/kernel/cpu/sgx/encls.h | 238 +++++
arch/x86/kernel/cpu/sgx/ioctl.c | 829 ++++++++++++++++++
arch/x86/kernel/cpu/sgx/main.c | 770 ++++++++++++++++
arch/x86/kernel/cpu/sgx/sgx.h | 65 ++
arch/x86/kernel/traps.c | 10 +
arch/x86/mm/fault.c | 44 +-
include/linux/mm.h | 3 +
mm/mprotect.c | 5 +-
tools/testing/selftests/Makefile | 1 +
tools/testing/selftests/sgx/.gitignore | 2 +
tools/testing/selftests/sgx/Makefile | 53 ++
tools/testing/selftests/sgx/call.S | 44 +
tools/testing/selftests/sgx/defines.h | 21 +
tools/testing/selftests/sgx/load.c | 277 ++++++
tools/testing/selftests/sgx/main.c | 243 +++++
tools/testing/selftests/sgx/main.h | 38 +
tools/testing/selftests/sgx/sigstruct.c | 395 +++++++++
tools/testing/selftests/sgx/test_encl.c | 20 +
tools/testing/selftests/sgx/test_encl.lds | 40 +
.../selftests/sgx/test_encl_bootstrap.S | 89 ++
51 files changed, 5528 insertions(+), 21 deletions(-)
create mode 100644 Documentation/x86/sgx.rst
create mode 100644 arch/x86/entry/vdso/extable.c
create mode 100644 arch/x86/entry/vdso/extable.h
create mode 100644 arch/x86/entry/vdso/vsgx.S
create mode 100644 arch/x86/include/asm/enclu.h
create mode 100644 arch/x86/include/uapi/asm/sgx.h
create mode 100644 arch/x86/kernel/cpu/sgx/Makefile
create mode 100644 arch/x86/kernel/cpu/sgx/arch.h
create mode 100644 arch/x86/kernel/cpu/sgx/driver.c
create mode 100644 arch/x86/kernel/cpu/sgx/driver.h
create mode 100644 arch/x86/kernel/cpu/sgx/encl.c
create mode 100644 arch/x86/kernel/cpu/sgx/encl.h
create mode 100644 arch/x86/kernel/cpu/sgx/encls.h
create mode 100644 arch/x86/kernel/cpu/sgx/ioctl.c
create mode 100644 arch/x86/kernel/cpu/sgx/main.c
create mode 100644 arch/x86/kernel/cpu/sgx/sgx.h
create mode 100644 tools/testing/selftests/sgx/.gitignore
create mode 100644 tools/testing/selftests/sgx/Makefile
create mode 100644 tools/testing/selftests/sgx/call.S
create mode 100644 tools/testing/selftests/sgx/defines.h
create mode 100644 tools/testing/selftests/sgx/load.c
create mode 100644 tools/testing/selftests/sgx/main.c
create mode 100644 tools/testing/selftests/sgx/main.h
create mode 100644 tools/testing/selftests/sgx/sigstruct.c
create mode 100644 tools/testing/selftests/sgx/test_encl.c
create mode 100644 tools/testing/selftests/sgx/test_encl.lds
create mode 100644 tools/testing/selftests/sgx/test_encl_bootstrap.S
--
2.25.1
From: Sean Christopherson <[email protected]>
Background
==========
1. SGX enclave pages are populated with data by copying data to them from
normal memory via an ioctl() (SGX_IOC_ENCLAVE_ADD_PAGES).
2. It is desirable to be able to restrict those normal memory data sources.
For instance, to ensure that the source data is executable before
copying data to an executable enclave page.
3. Enclave page permissions are dynamic (just like normal permissions) and
can be adjusted at runtime with mprotect().
4. The original data source may have long since vanished at the time when
enclave page permissions are established (mmap() or mprotect()).
The solution (elsewhere in this series) is to force enclaves creators to
declare their paging permission *intent* up front to the ioctl(). This
intent can me immediately compared to the source data’s mapping (and
rejected if necessary).
The intent is also stashed off for later comparison with enclave PTEs.
This ensures that any future mmap()/mprotect() operations performed by the
enclave creator or done on behalf of the enclave can be compared with the
earlier declared permissions.
Problem
=======
There is an existing mmap() hook which allows SGX to perform this
permission comparison at mmap() time. However, there is no corresponding
->mprotect() hook.
Solution
========
Add a vm_ops->mprotect() hook so that mprotect() operations which are
inconsistent with any page's stashed intent can be rejected by the driver.
Cc: [email protected]
Cc: Andrew Morton <[email protected]>
Cc: Matthew Wilcox <[email protected]>
Acked-by: Jethro Beekman <[email protected]>
Reviewed-by: Darren Kenny <[email protected]>
Signed-off-by: Sean Christopherson <[email protected]>
Co-developed-by: Jarkko Sakkinen <[email protected]>
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
include/linux/mm.h | 3 +++
mm/mprotect.c | 5 ++++-
2 files changed, 7 insertions(+), 1 deletion(-)
diff --git a/include/linux/mm.h b/include/linux/mm.h
index b2f370f0b420..dca57fe80555 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -551,6 +551,9 @@ struct vm_operations_struct {
void (*close)(struct vm_area_struct * area);
int (*split)(struct vm_area_struct * area, unsigned long addr);
int (*mremap)(struct vm_area_struct * area);
+ int (*mprotect)(struct vm_area_struct *vma,
+ struct vm_area_struct **pprev, unsigned long start,
+ unsigned long end, unsigned long newflags);
vm_fault_t (*fault)(struct vm_fault *vmf);
vm_fault_t (*huge_fault)(struct vm_fault *vmf,
enum page_entry_size pe_size);
diff --git a/mm/mprotect.c b/mm/mprotect.c
index ce8b8a5eacbb..f170f3da8a4f 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -610,7 +610,10 @@ static int do_mprotect_pkey(unsigned long start, size_t len,
tmp = vma->vm_end;
if (tmp > end)
tmp = end;
- error = mprotect_fixup(vma, &prev, nstart, tmp, newflags);
+ if (vma->vm_ops && vma->vm_ops->mprotect)
+ error = vma->vm_ops->mprotect(vma, &prev, nstart, tmp, newflags);
+ else
+ error = mprotect_fixup(vma, &prev, nstart, tmp, newflags);
if (error)
goto out;
nstart = tmp;
--
2.25.1
Intel Software Guard eXtensions (SGX) is a set of CPU instructions that can
be used by applications to set aside private regions of code and data. The
code outside the SGX hosted software entity is prevented from accessing the
memory inside the enclave by the CPU. We call these entities enclaves.
Add a driver that provides an ioctl API to construct and run enclaves.
Enclaves are constructed from pages residing in reserved physical memory
areas. The contents of these pages can only be accessed when they are
mapped as part of an enclave, by a hardware thread running inside the
enclave.
The starting state of an enclave consists of a fixed measured set of
pages that are copied to the EPC during the construction process by
using the opcode ENCLS leaf functions and Software Enclave Control
Structure (SECS) that defines the enclave properties.
Enclaves are constructed by using ENCLS leaf functions ECREATE, EADD and
EINIT. ECREATE initializes SECS, EADD copies pages from system memory to
the EPC and EINIT checks a given signed measurement and moves the enclave
into a state ready for execution.
An initialized enclave can only be accessed through special Thread Control
Structure (TCS) pages by using ENCLU (ring-3 only) leaf EENTER. This leaf
function converts a thread into enclave mode and continues the execution in
the offset defined by the TCS provided to EENTER. An enclave is exited
through syscall, exception, interrupts or by explicitly calling another
ENCLU leaf EEXIT.
The mmap() permissions are capped by the contained enclave page
permissions. The mapped areas must also be populated, i.e. each page
address must contain a page. This logic is implemented in
sgx_encl_may_map().
Cc: [email protected]
Cc: [email protected]
Cc: Andrew Morton <[email protected]>
Cc: Matthew Wilcox <[email protected]>
Acked-by: Jethro Beekman <[email protected]>
Tested-by: Jethro Beekman <[email protected]>
Tested-by: Haitao Huang <[email protected]>
Tested-by: Chunyang Hui <[email protected]>
Tested-by: Jordan Hand <[email protected]>
Tested-by: Nathaniel McCallum <[email protected]>
Tested-by: Seth Moore <[email protected]>
Tested-by: Darren Kenny <[email protected]>
Reviewed-by: Darren Kenny <[email protected]>
Co-developed-by: Sean Christopherson <[email protected]>
Signed-off-by: Sean Christopherson <[email protected]>
Co-developed-by: Suresh Siddha <[email protected]>
Signed-off-by: Suresh Siddha <[email protected]>
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
arch/x86/kernel/cpu/sgx/Makefile | 2 +
arch/x86/kernel/cpu/sgx/driver.c | 173 ++++++++++++++++
arch/x86/kernel/cpu/sgx/driver.h | 29 +++
arch/x86/kernel/cpu/sgx/encl.c | 331 +++++++++++++++++++++++++++++++
arch/x86/kernel/cpu/sgx/encl.h | 85 ++++++++
arch/x86/kernel/cpu/sgx/main.c | 11 +
6 files changed, 631 insertions(+)
create mode 100644 arch/x86/kernel/cpu/sgx/driver.c
create mode 100644 arch/x86/kernel/cpu/sgx/driver.h
create mode 100644 arch/x86/kernel/cpu/sgx/encl.c
create mode 100644 arch/x86/kernel/cpu/sgx/encl.h
diff --git a/arch/x86/kernel/cpu/sgx/Makefile b/arch/x86/kernel/cpu/sgx/Makefile
index 79510ce01b3b..3fc451120735 100644
--- a/arch/x86/kernel/cpu/sgx/Makefile
+++ b/arch/x86/kernel/cpu/sgx/Makefile
@@ -1,2 +1,4 @@
obj-y += \
+ driver.o \
+ encl.o \
main.o
diff --git a/arch/x86/kernel/cpu/sgx/driver.c b/arch/x86/kernel/cpu/sgx/driver.c
new file mode 100644
index 000000000000..f54da5f19c2b
--- /dev/null
+++ b/arch/x86/kernel/cpu/sgx/driver.c
@@ -0,0 +1,173 @@
+// SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause)
+// Copyright(c) 2016-18 Intel Corporation.
+
+#include <linux/acpi.h>
+#include <linux/miscdevice.h>
+#include <linux/mman.h>
+#include <linux/security.h>
+#include <linux/suspend.h>
+#include <asm/traps.h>
+#include "driver.h"
+#include "encl.h"
+
+u64 sgx_encl_size_max_32;
+u64 sgx_encl_size_max_64;
+u32 sgx_misc_reserved_mask;
+u64 sgx_attributes_reserved_mask;
+u64 sgx_xfrm_reserved_mask = ~0x3;
+u32 sgx_xsave_size_tbl[64];
+
+static int sgx_open(struct inode *inode, struct file *file)
+{
+ struct sgx_encl *encl;
+ int ret;
+
+ encl = kzalloc(sizeof(*encl), GFP_KERNEL);
+ if (!encl)
+ return -ENOMEM;
+
+ atomic_set(&encl->flags, 0);
+ kref_init(&encl->refcount);
+ xa_init(&encl->page_array);
+ mutex_init(&encl->lock);
+ INIT_LIST_HEAD(&encl->mm_list);
+ spin_lock_init(&encl->mm_lock);
+
+ ret = init_srcu_struct(&encl->srcu);
+ if (ret) {
+ kfree(encl);
+ return ret;
+ }
+
+ file->private_data = encl;
+
+ return 0;
+}
+
+static int sgx_release(struct inode *inode, struct file *file)
+{
+ struct sgx_encl *encl = file->private_data;
+ struct sgx_encl_mm *encl_mm;
+
+ for ( ; ; ) {
+ spin_lock(&encl->mm_lock);
+
+ if (list_empty(&encl->mm_list)) {
+ encl_mm = NULL;
+ } else {
+ encl_mm = list_first_entry(&encl->mm_list,
+ struct sgx_encl_mm, list);
+ list_del_rcu(&encl_mm->list);
+ }
+
+ spin_unlock(&encl->mm_lock);
+
+ /* The list is empty, ready to go. */
+ if (!encl_mm)
+ break;
+
+ synchronize_srcu(&encl->srcu);
+ mmu_notifier_unregister(&encl_mm->mmu_notifier, encl_mm->mm);
+ kfree(encl_mm);
+ }
+
+ mutex_lock(&encl->lock);
+ atomic_or(SGX_ENCL_DEAD, &encl->flags);
+ mutex_unlock(&encl->lock);
+
+ kref_put(&encl->refcount, sgx_encl_release);
+ return 0;
+}
+
+static int sgx_mmap(struct file *file, struct vm_area_struct *vma)
+{
+ struct sgx_encl *encl = file->private_data;
+ int ret;
+
+ ret = sgx_encl_may_map(encl, vma->vm_start, vma->vm_end, vma->vm_flags);
+ if (ret)
+ return ret;
+
+ ret = sgx_encl_mm_add(encl, vma->vm_mm);
+ if (ret)
+ return ret;
+
+ vma->vm_ops = &sgx_vm_ops;
+ vma->vm_flags |= VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP | VM_IO;
+ vma->vm_private_data = encl;
+
+ return 0;
+}
+
+static unsigned long sgx_get_unmapped_area(struct file *file,
+ unsigned long addr,
+ unsigned long len,
+ unsigned long pgoff,
+ unsigned long flags)
+{
+ if ((flags & MAP_TYPE) == MAP_PRIVATE)
+ return -EINVAL;
+
+ if (flags & MAP_FIXED)
+ return addr;
+
+ return current->mm->get_unmapped_area(file, addr, len, pgoff, flags);
+}
+
+static const struct file_operations sgx_encl_fops = {
+ .owner = THIS_MODULE,
+ .open = sgx_open,
+ .release = sgx_release,
+ .mmap = sgx_mmap,
+ .get_unmapped_area = sgx_get_unmapped_area,
+};
+
+static struct miscdevice sgx_dev_enclave = {
+ .minor = MISC_DYNAMIC_MINOR,
+ .name = "enclave",
+ .nodename = "sgx/enclave",
+ .fops = &sgx_encl_fops,
+};
+
+int __init sgx_drv_init(void)
+{
+ unsigned int eax, ebx, ecx, edx;
+ u64 attr_mask, xfrm_mask;
+ int ret;
+ int i;
+
+ if (!boot_cpu_has(X86_FEATURE_SGX_LC)) {
+ pr_info("The public key MSRs are not writable.\n");
+ return -ENODEV;
+ }
+
+ cpuid_count(SGX_CPUID, 0, &eax, &ebx, &ecx, &edx);
+ sgx_misc_reserved_mask = ~ebx | SGX_MISC_RESERVED_MASK;
+ sgx_encl_size_max_64 = 1ULL << ((edx >> 8) & 0xFF);
+ sgx_encl_size_max_32 = 1ULL << (edx & 0xFF);
+
+ cpuid_count(SGX_CPUID, 1, &eax, &ebx, &ecx, &edx);
+
+ attr_mask = (((u64)ebx) << 32) + (u64)eax;
+ sgx_attributes_reserved_mask = ~attr_mask | SGX_ATTR_RESERVED_MASK;
+
+ if (boot_cpu_has(X86_FEATURE_OSXSAVE)) {
+ xfrm_mask = (((u64)edx) << 32) + (u64)ecx;
+
+ for (i = 2; i < 64; i++) {
+ cpuid_count(0x0D, i, &eax, &ebx, &ecx, &edx);
+ if ((1UL << i) & xfrm_mask)
+ sgx_xsave_size_tbl[i] = eax + ebx;
+ }
+
+ sgx_xfrm_reserved_mask = ~xfrm_mask;
+ }
+
+ ret = misc_register(&sgx_dev_enclave);
+ if (ret) {
+ pr_err("Creating /dev/sgx/enclave failed with %d.\n", ret);
+ return ret;
+ }
+
+ return 0;
+}
diff --git a/arch/x86/kernel/cpu/sgx/driver.h b/arch/x86/kernel/cpu/sgx/driver.h
new file mode 100644
index 000000000000..f7ce40dedc91
--- /dev/null
+++ b/arch/x86/kernel/cpu/sgx/driver.h
@@ -0,0 +1,29 @@
+/* SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause) */
+#ifndef __ARCH_SGX_DRIVER_H__
+#define __ARCH_SGX_DRIVER_H__
+
+#include <crypto/hash.h>
+#include <linux/kref.h>
+#include <linux/mmu_notifier.h>
+#include <linux/radix-tree.h>
+#include <linux/rwsem.h>
+#include <linux/sched.h>
+#include <linux/workqueue.h>
+#include "sgx.h"
+
+#define SGX_EINIT_SPIN_COUNT 20
+#define SGX_EINIT_SLEEP_COUNT 50
+#define SGX_EINIT_SLEEP_TIME 20
+
+extern u64 sgx_encl_size_max_32;
+extern u64 sgx_encl_size_max_64;
+extern u32 sgx_misc_reserved_mask;
+extern u64 sgx_attributes_reserved_mask;
+extern u64 sgx_xfrm_reserved_mask;
+extern u32 sgx_xsave_size_tbl[64];
+
+long sgx_ioctl(struct file *filep, unsigned int cmd, unsigned long arg);
+
+int sgx_drv_init(void);
+
+#endif /* __ARCH_X86_SGX_DRIVER_H__ */
diff --git a/arch/x86/kernel/cpu/sgx/encl.c b/arch/x86/kernel/cpu/sgx/encl.c
new file mode 100644
index 000000000000..c2c4a77af36b
--- /dev/null
+++ b/arch/x86/kernel/cpu/sgx/encl.c
@@ -0,0 +1,331 @@
+// SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause)
+// Copyright(c) 2016-18 Intel Corporation.
+
+#include <linux/lockdep.h>
+#include <linux/mm.h>
+#include <linux/mman.h>
+#include <linux/shmem_fs.h>
+#include <linux/suspend.h>
+#include <linux/sched/mm.h>
+#include "arch.h"
+#include "encl.h"
+#include "encls.h"
+#include "sgx.h"
+
+static struct sgx_encl_page *sgx_encl_load_page(struct sgx_encl *encl,
+ unsigned long addr)
+{
+ struct sgx_encl_page *entry;
+ unsigned int flags;
+
+ /* If process was forked, VMA is still there but vm_private_data is set
+ * to NULL.
+ */
+ if (!encl)
+ return ERR_PTR(-EFAULT);
+
+ flags = atomic_read(&encl->flags);
+ if ((flags & SGX_ENCL_DEAD) || !(flags & SGX_ENCL_INITIALIZED))
+ return ERR_PTR(-EFAULT);
+
+ entry = xa_load(&encl->page_array, PFN_DOWN(addr));
+ if (!entry)
+ return ERR_PTR(-EFAULT);
+
+ /* Page is already resident in the EPC. */
+ if (entry->epc_page)
+ return entry;
+
+ return ERR_PTR(-EFAULT);
+}
+
+static void sgx_mmu_notifier_release(struct mmu_notifier *mn,
+ struct mm_struct *mm)
+{
+ struct sgx_encl_mm *encl_mm = container_of(mn, struct sgx_encl_mm, mmu_notifier);
+ struct sgx_encl_mm *tmp = NULL;
+
+ /*
+ * The enclave itself can remove encl_mm. Note, objects can't be moved
+ * off an RCU protected list, but deletion is ok.
+ */
+ spin_lock(&encl_mm->encl->mm_lock);
+ list_for_each_entry(tmp, &encl_mm->encl->mm_list, list) {
+ if (tmp == encl_mm) {
+ list_del_rcu(&encl_mm->list);
+ break;
+ }
+ }
+ spin_unlock(&encl_mm->encl->mm_lock);
+
+ if (tmp == encl_mm) {
+ synchronize_srcu(&encl_mm->encl->srcu);
+ mmu_notifier_put(mn);
+ }
+}
+
+static void sgx_mmu_notifier_free(struct mmu_notifier *mn)
+{
+ struct sgx_encl_mm *encl_mm = container_of(mn, struct sgx_encl_mm, mmu_notifier);
+
+ kfree(encl_mm);
+}
+
+static const struct mmu_notifier_ops sgx_mmu_notifier_ops = {
+ .release = sgx_mmu_notifier_release,
+ .free_notifier = sgx_mmu_notifier_free,
+};
+
+static struct sgx_encl_mm *sgx_encl_find_mm(struct sgx_encl *encl,
+ struct mm_struct *mm)
+{
+ struct sgx_encl_mm *encl_mm = NULL;
+ struct sgx_encl_mm *tmp;
+ int idx;
+
+ idx = srcu_read_lock(&encl->srcu);
+
+ list_for_each_entry_rcu(tmp, &encl->mm_list, list) {
+ if (tmp->mm == mm) {
+ encl_mm = tmp;
+ break;
+ }
+ }
+
+ srcu_read_unlock(&encl->srcu, idx);
+
+ return encl_mm;
+}
+
+int sgx_encl_mm_add(struct sgx_encl *encl, struct mm_struct *mm)
+{
+ struct sgx_encl_mm *encl_mm;
+ int ret;
+
+ /* mm_list can be accessed only by a single thread at a time. */
+ mmap_assert_write_locked(mm);
+
+ if (atomic_read(&encl->flags) & SGX_ENCL_DEAD)
+ return -EINVAL;
+
+ /*
+ * mm_structs are kept on mm_list until the mm or the enclave dies,
+ * i.e. once an mm is off the list, it's gone for good, therefore it's
+ * impossible to get a false positive on @mm due to a stale mm_list.
+ */
+ if (sgx_encl_find_mm(encl, mm))
+ return 0;
+
+ encl_mm = kzalloc(sizeof(*encl_mm), GFP_KERNEL);
+ if (!encl_mm)
+ return -ENOMEM;
+
+ encl_mm->encl = encl;
+ encl_mm->mm = mm;
+ encl_mm->mmu_notifier.ops = &sgx_mmu_notifier_ops;
+
+ ret = __mmu_notifier_register(&encl_mm->mmu_notifier, mm);
+ if (ret) {
+ kfree(encl_mm);
+ return ret;
+ }
+
+ spin_lock(&encl->mm_lock);
+ list_add_rcu(&encl_mm->list, &encl->mm_list);
+ spin_unlock(&encl->mm_lock);
+
+ return 0;
+}
+
+static void sgx_vma_open(struct vm_area_struct *vma)
+{
+ struct sgx_encl *encl = vma->vm_private_data;
+
+ if (!encl)
+ return;
+
+ if (sgx_encl_mm_add(encl, vma->vm_mm))
+ vma->vm_private_data = NULL;
+}
+
+static unsigned int sgx_vma_fault(struct vm_fault *vmf)
+{
+ unsigned long addr = (unsigned long)vmf->address;
+ struct vm_area_struct *vma = vmf->vma;
+ struct sgx_encl *encl = vma->vm_private_data;
+ struct sgx_encl_page *entry;
+ int ret = VM_FAULT_NOPAGE;
+ unsigned long pfn;
+
+ if (!encl)
+ return VM_FAULT_SIGBUS;
+
+ mutex_lock(&encl->lock);
+
+ entry = sgx_encl_load_page(encl, addr);
+ if (IS_ERR(entry)) {
+ if (unlikely(PTR_ERR(entry) != -EBUSY))
+ ret = VM_FAULT_SIGBUS;
+
+ goto out;
+ }
+
+ if (!follow_pfn(vma, addr, &pfn))
+ goto out;
+
+ ret = vmf_insert_pfn(vma, addr, PFN_DOWN(entry->epc_page->desc));
+ if (ret != VM_FAULT_NOPAGE) {
+ ret = VM_FAULT_SIGBUS;
+ goto out;
+ }
+
+out:
+ mutex_unlock(&encl->lock);
+ return ret;
+}
+
+/**
+ * sgx_encl_may_map() - Check if a requested VMA mapping is allowed
+ * @encl: an enclave pointer
+ * @start: lower bound of the address range, inclusive
+ * @end: upper bound of the address range, exclusive
+ * @vm_prot_bits: requested protections of the address range
+ *
+ * Iterate through the enclave pages contained within [@start, @end) to verify
+ * the permissions requested by @vm_prot_bits do not exceed that of any enclave
+ * page to be mapped.
+ *
+ * Return:
+ * 0 on success,
+ * -EACCES if VMA permissions exceed enclave page permissions
+ */
+int sgx_encl_may_map(struct sgx_encl *encl, unsigned long start,
+ unsigned long end, unsigned long vm_flags)
+{
+ unsigned long vm_prot_bits = vm_flags & (VM_READ | VM_WRITE | VM_EXEC);
+ unsigned long idx_start = PFN_DOWN(start);
+ unsigned long idx_end = PFN_DOWN(end - 1);
+ struct sgx_encl_page *page;
+
+ XA_STATE(xas, &encl->page_array, idx_start);
+
+ /*
+ * Disallow READ_IMPLIES_EXEC tasks as their VMA permissions might
+ * conflict with the enclave page permissions.
+ */
+ if (current->personality & READ_IMPLIES_EXEC)
+ return -EACCES;
+
+ xas_for_each(&xas, page, idx_end)
+ if (!page || (~page->vm_max_prot_bits & vm_prot_bits))
+ return -EACCES;
+
+ return 0;
+}
+
+static int sgx_vma_mprotect(struct vm_area_struct *vma,
+ struct vm_area_struct **pprev, unsigned long start,
+ unsigned long end, unsigned long newflags)
+{
+ int ret;
+
+ ret = sgx_encl_may_map(vma->vm_private_data, start, end, newflags);
+ if (ret)
+ return ret;
+
+ return mprotect_fixup(vma, pprev, start, end, newflags);
+}
+
+const struct vm_operations_struct sgx_vm_ops = {
+ .open = sgx_vma_open,
+ .fault = sgx_vma_fault,
+ .mprotect = sgx_vma_mprotect,
+};
+
+/**
+ * sgx_encl_find - find an enclave
+ * @mm: mm struct of the current process
+ * @addr: address in the ELRANGE
+ * @vma: the resulting VMA
+ *
+ * Find an enclave identified by the given address. Give back a VMA that is
+ * part of the enclave and located in that address. The VMA is given back if it
+ * is a proper enclave VMA even if an &sgx_encl instance does not exist yet
+ * (enclave creation has not been performed).
+ *
+ * Return:
+ * 0 on success,
+ * -EINVAL if an enclave was not found,
+ * -ENOENT if the enclave has not been created yet
+ */
+int sgx_encl_find(struct mm_struct *mm, unsigned long addr,
+ struct vm_area_struct **vma)
+{
+ struct vm_area_struct *result;
+ struct sgx_encl *encl;
+
+ result = find_vma(mm, addr);
+ if (!result || result->vm_ops != &sgx_vm_ops || addr < result->vm_start)
+ return -EINVAL;
+
+ encl = result->vm_private_data;
+ *vma = result;
+
+ return encl ? 0 : -ENOENT;
+}
+
+/**
+ * sgx_encl_destroy() - destroy enclave resources
+ * @encl: an enclave pointer
+ */
+void sgx_encl_destroy(struct sgx_encl *encl)
+{
+ struct sgx_encl_page *entry;
+ unsigned long index;
+
+ atomic_or(SGX_ENCL_DEAD, &encl->flags);
+
+ xa_for_each(&encl->page_array, index, entry) {
+ if (entry->epc_page) {
+ sgx_free_epc_page(entry->epc_page);
+ encl->secs_child_cnt--;
+ entry->epc_page = NULL;
+ }
+
+ kfree(entry);
+ }
+
+ xa_destroy(&encl->page_array);
+
+ if (!encl->secs_child_cnt && encl->secs.epc_page) {
+ sgx_free_epc_page(encl->secs.epc_page);
+ encl->secs.epc_page = NULL;
+ }
+}
+
+/**
+ * sgx_encl_release - Destroy an enclave instance
+ * @kref: address of a kref inside &sgx_encl
+ *
+ * Used together with kref_put(). Frees all the resources associated with the
+ * enclave and the instance itself.
+ */
+void sgx_encl_release(struct kref *ref)
+{
+ struct sgx_encl *encl = container_of(ref, struct sgx_encl, refcount);
+
+ sgx_encl_destroy(encl);
+
+ if (encl->backing)
+ fput(encl->backing);
+
+ cleanup_srcu_struct(&encl->srcu);
+
+ WARN_ON_ONCE(!list_empty(&encl->mm_list));
+
+ /* Detect EPC page leak's. */
+ WARN_ON_ONCE(encl->secs_child_cnt);
+ WARN_ON_ONCE(encl->secs.epc_page);
+
+ kfree(encl);
+}
diff --git a/arch/x86/kernel/cpu/sgx/encl.h b/arch/x86/kernel/cpu/sgx/encl.h
new file mode 100644
index 000000000000..8ff445476657
--- /dev/null
+++ b/arch/x86/kernel/cpu/sgx/encl.h
@@ -0,0 +1,85 @@
+/* SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause) */
+/**
+ * Copyright(c) 2016-19 Intel Corporation.
+ */
+#ifndef _X86_ENCL_H
+#define _X86_ENCL_H
+
+#include <linux/cpumask.h>
+#include <linux/kref.h>
+#include <linux/list.h>
+#include <linux/mm_types.h>
+#include <linux/mmu_notifier.h>
+#include <linux/mutex.h>
+#include <linux/notifier.h>
+#include <linux/srcu.h>
+#include <linux/workqueue.h>
+#include <linux/xarray.h>
+#include "sgx.h"
+
+/**
+ * enum sgx_encl_page_desc - defines bits for an enclave page's descriptor
+ * %SGX_ENCL_PAGE_ADDR_MASK: Holds the virtual address of the page.
+ *
+ * The page address for SECS is zero and is used by the subsystem to recognize
+ * the SECS page.
+ */
+enum sgx_encl_page_desc {
+ /* Bits 11:3 are available when the page is not swapped. */
+ SGX_ENCL_PAGE_ADDR_MASK = PAGE_MASK,
+};
+
+#define SGX_ENCL_PAGE_ADDR(page) \
+ ((page)->desc & SGX_ENCL_PAGE_ADDR_MASK)
+
+struct sgx_encl_page {
+ unsigned long desc;
+ unsigned long vm_max_prot_bits;
+ struct sgx_epc_page *epc_page;
+ struct sgx_encl *encl;
+};
+
+enum sgx_encl_flags {
+ SGX_ENCL_CREATED = BIT(0),
+ SGX_ENCL_INITIALIZED = BIT(1),
+ SGX_ENCL_DEBUG = BIT(2),
+ SGX_ENCL_DEAD = BIT(3),
+ SGX_ENCL_IOCTL = BIT(4),
+};
+
+struct sgx_encl_mm {
+ struct sgx_encl *encl;
+ struct mm_struct *mm;
+ struct list_head list;
+ struct mmu_notifier mmu_notifier;
+};
+
+struct sgx_encl {
+ atomic_t flags;
+ unsigned int page_cnt;
+ unsigned int secs_child_cnt;
+ struct mutex lock;
+ struct list_head mm_list;
+ spinlock_t mm_lock;
+ struct file *backing;
+ struct kref refcount;
+ struct srcu_struct srcu;
+ unsigned long base;
+ unsigned long size;
+ unsigned long ssaframesize;
+ struct xarray page_array;
+ struct sgx_encl_page secs;
+ cpumask_t cpumask;
+};
+
+extern const struct vm_operations_struct sgx_vm_ops;
+
+int sgx_encl_find(struct mm_struct *mm, unsigned long addr,
+ struct vm_area_struct **vma);
+void sgx_encl_destroy(struct sgx_encl *encl);
+void sgx_encl_release(struct kref *ref);
+int sgx_encl_mm_add(struct sgx_encl *encl, struct mm_struct *mm);
+int sgx_encl_may_map(struct sgx_encl *encl, unsigned long start,
+ unsigned long end, unsigned long vm_flags);
+
+#endif /* _X86_ENCL_H */
diff --git a/arch/x86/kernel/cpu/sgx/main.c b/arch/x86/kernel/cpu/sgx/main.c
index 97c6895fb6c9..4137254fb29e 100644
--- a/arch/x86/kernel/cpu/sgx/main.c
+++ b/arch/x86/kernel/cpu/sgx/main.c
@@ -9,6 +9,8 @@
#include <linux/sched/mm.h>
#include <linux/sched/signal.h>
#include <linux/slab.h>
+#include "driver.h"
+#include "encl.h"
#include "encls.h"
struct sgx_epc_section sgx_epc_sections[SGX_MAX_EPC_SECTIONS];
@@ -260,6 +262,8 @@ static bool __init sgx_page_cache_init(void)
static void __init sgx_init(void)
{
+ int ret;
+
if (!boot_cpu_has(X86_FEATURE_SGX))
return;
@@ -269,8 +273,15 @@ static void __init sgx_init(void)
if (!sgx_page_reclaimer_init())
goto err_page_cache;
+ ret = sgx_drv_init();
+ if (ret)
+ goto err_kthread;
+
return;
+err_kthread:
+ kthread_stop(ksgxswapd_tsk);
+
err_page_cache:
sgx_page_cache_teardown();
}
--
2.25.1
From: Sean Christopherson <[email protected]>
Configure SGX as part of feature control MSR initialization and update
the associated X86_FEATURE flags accordingly. Because the kernel will
require the LE hash MSRs to be writable when running native enclaves,
disable X86_FEATURE_SGX (and all derivatives) if SGX Launch Control is
not (or cannot) be fully enabled via feature control MSR.
The check is done for every CPU, not just BSP, in order to verify that
MSR_IA32_FEATURE_CONTROL is correctly configured on all CPUs. The other
parts of the kernel, like the enclave driver, expect the same
configuration from all CPUs.
Note, unlike VMX, clear the X86_FEATURE_SGX* flags for all CPUs if any
CPU lacks SGX support as the kernel expects SGX to be available on all
CPUs. X86_FEATURE_VMX is intentionally cleared only for the current CPU
so that KVM can provide additional information if KVM fails to load,
e.g. print which CPU doesn't support VMX. KVM/VMX requires additional
per-CPU enabling, e.g. to set CR4.VMXE and do VMXON, and so already has
the necessary infrastructure to do per-CPU checks. SGX on the other
hand doesn't require additional enabling, so clearing the feature flags
on all CPUs means the SGX subsystem doesn't need to manually do support
checks on a per-CPU basis.
Acked-by: Jethro Beekman <[email protected]>
Reviewed-by: Darren Kenny <[email protected]>
Signed-off-by: Sean Christopherson <[email protected]>
Co-developed-by: Jarkko Sakkinen <[email protected]>
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
arch/x86/kernel/cpu/feat_ctl.c | 32 +++++++++++++++++++++++++++++++-
1 file changed, 31 insertions(+), 1 deletion(-)
diff --git a/arch/x86/kernel/cpu/feat_ctl.c b/arch/x86/kernel/cpu/feat_ctl.c
index 29a3bedabd06..c3afcd2e4342 100644
--- a/arch/x86/kernel/cpu/feat_ctl.c
+++ b/arch/x86/kernel/cpu/feat_ctl.c
@@ -93,16 +93,35 @@ static void init_vmx_capabilities(struct cpuinfo_x86 *c)
}
#endif /* CONFIG_X86_VMX_FEATURE_NAMES */
+static void clear_sgx_caps(void)
+{
+ setup_clear_cpu_cap(X86_FEATURE_SGX);
+ setup_clear_cpu_cap(X86_FEATURE_SGX_LC);
+ setup_clear_cpu_cap(X86_FEATURE_SGX1);
+ setup_clear_cpu_cap(X86_FEATURE_SGX2);
+}
+
void init_ia32_feat_ctl(struct cpuinfo_x86 *c)
{
bool tboot = tboot_enabled();
+ bool enable_sgx;
u64 msr;
if (rdmsrl_safe(MSR_IA32_FEAT_CTL, &msr)) {
clear_cpu_cap(c, X86_FEATURE_VMX);
+ clear_sgx_caps();
return;
}
+ /*
+ * Enable SGX if and only if the kernel supports SGX and Launch Control
+ * is supported, i.e. disable SGX if the LE hash MSRs can't be written.
+ */
+ enable_sgx = cpu_has(c, X86_FEATURE_SGX) &&
+ cpu_has(c, X86_FEATURE_SGX1) &&
+ cpu_has(c, X86_FEATURE_SGX_LC) &&
+ IS_ENABLED(CONFIG_INTEL_SGX);
+
if (msr & FEAT_CTL_LOCKED)
goto update_caps;
@@ -124,13 +143,16 @@ void init_ia32_feat_ctl(struct cpuinfo_x86 *c)
msr |= FEAT_CTL_VMX_ENABLED_INSIDE_SMX;
}
+ if (enable_sgx)
+ msr |= FEAT_CTL_SGX_ENABLED | FEAT_CTL_SGX_LC_ENABLED;
+
wrmsrl(MSR_IA32_FEAT_CTL, msr);
update_caps:
set_cpu_cap(c, X86_FEATURE_MSR_IA32_FEAT_CTL);
if (!cpu_has(c, X86_FEATURE_VMX))
- return;
+ goto update_sgx;
if ( (tboot && !(msr & FEAT_CTL_VMX_ENABLED_INSIDE_SMX)) ||
(!tboot && !(msr & FEAT_CTL_VMX_ENABLED_OUTSIDE_SMX))) {
@@ -143,4 +165,12 @@ void init_ia32_feat_ctl(struct cpuinfo_x86 *c)
init_vmx_capabilities(c);
#endif
}
+
+update_sgx:
+ if (!(msr & FEAT_CTL_SGX_ENABLED) ||
+ !(msr & FEAT_CTL_SGX_LC_ENABLED) || !enable_sgx) {
+ if (enable_sgx)
+ pr_err_once("SGX disabled by BIOS\n");
+ clear_sgx_caps();
+ }
}
--
2.25.1
ENCLS is a ring 0 instruction, which contains a set of leaf functions for
managing an enclave. Enclaves are measured and signed software entities,
which are protected by asserting the outside memory accesses and memory
encryption.
Add a two-layer macro system along with an encoding scheme to allow
wrappers to return trap numbers along ENCLS-specific error codes. The
bottom layer of the macro system splits between the leafs that return an
error code and those that do not. The second layer generates the correct
input/output annotations based on the number of operands for each leaf
function.
ENCLS leaf functions are documented in
Intel SDM: 36.6 ENCLAVE INSTRUCTIONS AND INTEL®
Acked-by: Jethro Beekman <[email protected]>
Tested-by: Darren Kenny <[email protected]>
Co-developed-by: Sean Christopherson <[email protected]>
Signed-off-by: Sean Christopherson <[email protected]>
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
arch/x86/kernel/cpu/sgx/encls.h | 238 ++++++++++++++++++++++++++++++++
1 file changed, 238 insertions(+)
create mode 100644 arch/x86/kernel/cpu/sgx/encls.h
diff --git a/arch/x86/kernel/cpu/sgx/encls.h b/arch/x86/kernel/cpu/sgx/encls.h
new file mode 100644
index 000000000000..a87f15ea5cca
--- /dev/null
+++ b/arch/x86/kernel/cpu/sgx/encls.h
@@ -0,0 +1,238 @@
+/* SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause) */
+#ifndef _X86_ENCLS_H
+#define _X86_ENCLS_H
+
+#include <linux/bitops.h>
+#include <linux/err.h>
+#include <linux/io.h>
+#include <linux/rwsem.h>
+#include <linux/types.h>
+#include <asm/asm.h>
+#include <asm/traps.h>
+#include "sgx.h"
+
+enum sgx_encls_leaf {
+ ECREATE = 0x00,
+ EADD = 0x01,
+ EINIT = 0x02,
+ EREMOVE = 0x03,
+ EDGBRD = 0x04,
+ EDGBWR = 0x05,
+ EEXTEND = 0x06,
+ ELDU = 0x08,
+ EBLOCK = 0x09,
+ EPA = 0x0A,
+ EWB = 0x0B,
+ ETRACK = 0x0C,
+};
+
+/**
+ * ENCLS_FAULT_FLAG - flag signifying an ENCLS return code is a trapnr
+ *
+ * ENCLS has its own (positive value) error codes and also generates
+ * ENCLS specific #GP and #PF faults. And the ENCLS values get munged
+ * with system error codes as everything percolates back up the stack.
+ * Unfortunately (for us), we need to precisely identify each unique
+ * error code, e.g. the action taken if EWB fails varies based on the
+ * type of fault and on the exact SGX error code, i.e. we can't simply
+ * convert all faults to -EFAULT.
+ *
+ * To make all three error types coexist, we set bit 30 to identify an
+ * ENCLS fault. Bit 31 (technically bits N:31) is used to differentiate
+ * between positive (faults and SGX error codes) and negative (system
+ * error codes) values.
+ */
+#define ENCLS_FAULT_FLAG 0x40000000
+
+/* Retrieve the encoded trapnr from the specified return code. */
+#define ENCLS_TRAPNR(r) ((r) & ~ENCLS_FAULT_FLAG)
+
+/* Issue a WARN() about an ENCLS leaf. */
+#define ENCLS_WARN(r, name) { \
+ do { \
+ int _r = (r); \
+ WARN_ONCE(_r, "%s returned %d (0x%x)\n", (name), _r, _r); \
+ } while (0); \
+}
+
+/**
+ * encls_failed() - Check if an ENCLS leaf function failed
+ * @ret: the return value of an ENCLS leaf function call
+ *
+ * Check if an ENCLS leaf function failed. This happens when the leaf function
+ * causes a fault that is not caused by an EPCM conflict or when the leaf
+ * function returns a non-zero value.
+ */
+static inline bool encls_failed(int ret)
+{
+ int epcm_trapnr;
+
+ if (boot_cpu_has(X86_FEATURE_SGX2))
+ epcm_trapnr = X86_TRAP_PF;
+ else
+ epcm_trapnr = X86_TRAP_GP;
+
+ if (ret & ENCLS_FAULT_FLAG)
+ return ENCLS_TRAPNR(ret) != epcm_trapnr;
+
+ return !!ret;
+}
+
+/**
+ * __encls_ret_N - encode an ENCLS leaf that returns an error code in EAX
+ * @rax: leaf number
+ * @inputs: asm inputs for the leaf
+ *
+ * Emit assembly for an ENCLS leaf that returns an error code, e.g. EREMOVE.
+ * And because SGX isn't complex enough as it is, leafs that return an error
+ * code also modify flags.
+ *
+ * Return:
+ * 0 on success,
+ * SGX error code on failure
+ */
+#define __encls_ret_N(rax, inputs...) \
+ ({ \
+ int ret; \
+ asm volatile( \
+ "1: .byte 0x0f, 0x01, 0xcf;\n\t" \
+ "2:\n" \
+ ".section .fixup,\"ax\"\n" \
+ "3: orl $"__stringify(ENCLS_FAULT_FLAG)",%%eax\n" \
+ " jmp 2b\n" \
+ ".previous\n" \
+ _ASM_EXTABLE_FAULT(1b, 3b) \
+ : "=a"(ret) \
+ : "a"(rax), inputs \
+ : "memory", "cc"); \
+ ret; \
+ })
+
+#define __encls_ret_1(rax, rcx) \
+ ({ \
+ __encls_ret_N(rax, "c"(rcx)); \
+ })
+
+#define __encls_ret_2(rax, rbx, rcx) \
+ ({ \
+ __encls_ret_N(rax, "b"(rbx), "c"(rcx)); \
+ })
+
+#define __encls_ret_3(rax, rbx, rcx, rdx) \
+ ({ \
+ __encls_ret_N(rax, "b"(rbx), "c"(rcx), "d"(rdx)); \
+ })
+
+/**
+ * __encls_N - encode an ENCLS leaf that doesn't return an error code
+ * @rax: leaf number
+ * @rbx_out: optional output variable
+ * @inputs: asm inputs for the leaf
+ *
+ * Emit assembly for an ENCLS leaf that does not return an error code,
+ * e.g. ECREATE. Leaves without error codes either succeed or fault.
+ * @rbx_out is an optional parameter for use by EDGBRD, which returns
+ * the requested value in RBX.
+ *
+ * Return:
+ * 0 on success,
+ * trapnr with ENCLS_FAULT_FLAG set on fault
+ */
+#define __encls_N(rax, rbx_out, inputs...) \
+ ({ \
+ int ret; \
+ asm volatile( \
+ "1: .byte 0x0f, 0x01, 0xcf;\n\t" \
+ " xor %%eax,%%eax;\n" \
+ "2:\n" \
+ ".section .fixup,\"ax\"\n" \
+ "3: orl $"__stringify(ENCLS_FAULT_FLAG)",%%eax\n" \
+ " jmp 2b\n" \
+ ".previous\n" \
+ _ASM_EXTABLE_FAULT(1b, 3b) \
+ : "=a"(ret), "=b"(rbx_out) \
+ : "a"(rax), inputs \
+ : "memory"); \
+ ret; \
+ })
+
+#define __encls_2(rax, rbx, rcx) \
+ ({ \
+ unsigned long ign_rbx_out; \
+ __encls_N(rax, ign_rbx_out, "b"(rbx), "c"(rcx)); \
+ })
+
+#define __encls_1_1(rax, data, rcx) \
+ ({ \
+ unsigned long rbx_out; \
+ int ret = __encls_N(rax, rbx_out, "c"(rcx)); \
+ if (!ret) \
+ data = rbx_out; \
+ ret; \
+ })
+
+static inline int __ecreate(struct sgx_pageinfo *pginfo, void *secs)
+{
+ return __encls_2(ECREATE, pginfo, secs);
+}
+
+static inline int __eextend(void *secs, void *addr)
+{
+ return __encls_2(EEXTEND, secs, addr);
+}
+
+static inline int __eadd(struct sgx_pageinfo *pginfo, void *addr)
+{
+ return __encls_2(EADD, pginfo, addr);
+}
+
+static inline int __einit(void *sigstruct, void *token, void *secs)
+{
+ return __encls_ret_3(EINIT, sigstruct, secs, token);
+}
+
+static inline int __eremove(void *addr)
+{
+ return __encls_ret_1(EREMOVE, addr);
+}
+
+static inline int __edbgwr(void *addr, unsigned long *data)
+{
+ return __encls_2(EDGBWR, *data, addr);
+}
+
+static inline int __edbgrd(void *addr, unsigned long *data)
+{
+ return __encls_1_1(EDGBRD, *data, addr);
+}
+
+static inline int __etrack(void *addr)
+{
+ return __encls_ret_1(ETRACK, addr);
+}
+
+static inline int __eldu(struct sgx_pageinfo *pginfo, void *addr,
+ void *va)
+{
+ return __encls_ret_3(ELDU, pginfo, addr, va);
+}
+
+static inline int __eblock(void *addr)
+{
+ return __encls_ret_1(EBLOCK, addr);
+}
+
+static inline int __epa(void *addr)
+{
+ unsigned long rbx = SGX_PAGE_TYPE_VA;
+
+ return __encls_2(EPA, rbx, addr);
+}
+
+static inline int __ewb(struct sgx_pageinfo *pginfo, void *addr,
+ void *va)
+{
+ return __encls_ret_3(EWB, pginfo, addr, va);
+}
+
+#endif /* _X86_ENCLS_H */
--
2.25.1
Add kernel parameter to disable Intel SGX kernel support.
Tested-by: Sean Christopherson <[email protected]>
Reviewed-by: Sean Christopherson <[email protected]>
Reviewed-by: Darren Kenny <[email protected]>
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
Documentation/admin-guide/kernel-parameters.txt | 2 ++
arch/x86/kernel/cpu/feat_ctl.c | 9 +++++++++
2 files changed, 11 insertions(+)
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 115c50f4e927..7ff2b35a1b8e 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -3356,6 +3356,8 @@
nosep [BUGS=X86-32] Disables x86 SYSENTER/SYSEXIT support.
+ nosgx [X86-64,SGX] Disables Intel SGX kernel support.
+
nosmp [SMP] Tells an SMP kernel to act as a UP kernel,
and disable the IO APIC. legacy for "maxcpus=0".
diff --git a/arch/x86/kernel/cpu/feat_ctl.c b/arch/x86/kernel/cpu/feat_ctl.c
index c3afcd2e4342..1837df39527f 100644
--- a/arch/x86/kernel/cpu/feat_ctl.c
+++ b/arch/x86/kernel/cpu/feat_ctl.c
@@ -101,6 +101,15 @@ static void clear_sgx_caps(void)
setup_clear_cpu_cap(X86_FEATURE_SGX2);
}
+static int __init nosgx(char *str)
+{
+ clear_sgx_caps();
+
+ return 0;
+}
+
+early_param("nosgx", nosgx);
+
void init_ia32_feat_ctl(struct cpuinfo_x86 *c)
{
bool tboot = tboot_enabled();
--
2.25.1
Add an ioctl, which performs ENCLS[EADD] that adds new visible page to an
enclave, and optionally ENCLS[EEXTEND] operations that hash the page to the
enclave measurement. By visible we mean a page that can be mapped to the
address range of an enclave.
Acked-by: Jethro Beekman <[email protected]>
Tested-by: Jethro Beekman <[email protected]>
Tested-by: Haitao Huang <[email protected]>
Tested-by: Chunyang Hui <[email protected]>
Tested-by: Jordan Hand <[email protected]>
Tested-by: Nathaniel McCallum <[email protected]>
Tested-by: Seth Moore <[email protected]>
Tested-by: Darren Kenny <[email protected]>
Reviewed-by: Darren Kenny <[email protected]>
Co-developed-by: Sean Christopherson <[email protected]>
Signed-off-by: Sean Christopherson <[email protected]>
Co-developed-by: Suresh Siddha <[email protected]>
Signed-off-by: Suresh Siddha <[email protected]>
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
arch/x86/include/uapi/asm/sgx.h | 30 ++++
arch/x86/kernel/cpu/sgx/ioctl.c | 299 ++++++++++++++++++++++++++++++++
arch/x86/kernel/cpu/sgx/sgx.h | 1 +
3 files changed, 330 insertions(+)
diff --git a/arch/x86/include/uapi/asm/sgx.h b/arch/x86/include/uapi/asm/sgx.h
index c75b375f3770..10cd48d06318 100644
--- a/arch/x86/include/uapi/asm/sgx.h
+++ b/arch/x86/include/uapi/asm/sgx.h
@@ -8,10 +8,21 @@
#include <linux/types.h>
#include <linux/ioctl.h>
+/**
+ * enum sgx_epage_flags - page control flags
+ * %SGX_PAGE_MEASURE: Measure the page contents with a sequence of
+ * ENCLS[EEXTEND] operations.
+ */
+enum sgx_page_flags {
+ SGX_PAGE_MEASURE = 0x01,
+};
+
#define SGX_MAGIC 0xA4
#define SGX_IOC_ENCLAVE_CREATE \
_IOW(SGX_MAGIC, 0x00, struct sgx_enclave_create)
+#define SGX_IOC_ENCLAVE_ADD_PAGES \
+ _IOWR(SGX_MAGIC, 0x01, struct sgx_enclave_add_pages)
/**
* struct sgx_enclave_create - parameter structure for the
@@ -22,4 +33,23 @@ struct sgx_enclave_create {
__u64 src;
};
+/**
+ * struct sgx_enclave_add_pages - parameter structure for the
+ * %SGX_IOC_ENCLAVE_ADD_PAGE ioctl
+ * @src: start address for the page data
+ * @offset: starting page offset
+ * @length: length of the data (multiple of the page size)
+ * @secinfo: address for the SECINFO data
+ * @flags: page control flags
+ * @count: number of bytes added (multiple of the page size)
+ */
+struct sgx_enclave_add_pages {
+ __u64 src;
+ __u64 offset;
+ __u64 length;
+ __u64 secinfo;
+ __u64 flags;
+ __u64 count;
+};
+
#endif /* _UAPI_ASM_X86_SGX_H */
diff --git a/arch/x86/kernel/cpu/sgx/ioctl.c b/arch/x86/kernel/cpu/sgx/ioctl.c
index 9bb4694e57c1..e13e04737683 100644
--- a/arch/x86/kernel/cpu/sgx/ioctl.c
+++ b/arch/x86/kernel/cpu/sgx/ioctl.c
@@ -194,6 +194,302 @@ static long sgx_ioc_enclave_create(struct sgx_encl *encl, void __user *arg)
return ret;
}
+static struct sgx_encl_page *sgx_encl_page_alloc(struct sgx_encl *encl,
+ unsigned long offset,
+ u64 secinfo_flags)
+{
+ struct sgx_encl_page *encl_page;
+ unsigned long prot;
+
+ encl_page = kzalloc(sizeof(*encl_page), GFP_KERNEL);
+ if (!encl_page)
+ return ERR_PTR(-ENOMEM);
+
+ encl_page->desc = encl->base + offset;
+ encl_page->encl = encl;
+
+ prot = _calc_vm_trans(secinfo_flags, SGX_SECINFO_R, PROT_READ) |
+ _calc_vm_trans(secinfo_flags, SGX_SECINFO_W, PROT_WRITE) |
+ _calc_vm_trans(secinfo_flags, SGX_SECINFO_X, PROT_EXEC);
+
+ /*
+ * TCS pages must always RW set for CPU access while the SECINFO
+ * permissions are *always* zero - the CPU ignores the user provided
+ * values and silently overwrites them with zero permissions.
+ */
+ if ((secinfo_flags & SGX_SECINFO_PAGE_TYPE_MASK) == SGX_SECINFO_TCS)
+ prot |= PROT_READ | PROT_WRITE;
+
+ /* Calculate maximum of the VM flags for the page. */
+ encl_page->vm_max_prot_bits = calc_vm_prot_bits(prot, 0);
+
+ return encl_page;
+}
+
+static int sgx_validate_secinfo(struct sgx_secinfo *secinfo)
+{
+ u64 perm = secinfo->flags & SGX_SECINFO_PERMISSION_MASK;
+ u64 pt = secinfo->flags & SGX_SECINFO_PAGE_TYPE_MASK;
+
+ if (pt != SGX_SECINFO_REG && pt != SGX_SECINFO_TCS)
+ return -EINVAL;
+
+ if ((perm & SGX_SECINFO_W) && !(perm & SGX_SECINFO_R))
+ return -EINVAL;
+
+ /*
+ * CPU will silently overwrite the permissions as zero, which means
+ * that we need to validate it ourselves.
+ */
+ if (pt == SGX_SECINFO_TCS && perm)
+ return -EINVAL;
+
+ if (secinfo->flags & SGX_SECINFO_RESERVED_MASK)
+ return -EINVAL;
+
+ if (memchr_inv(secinfo->reserved, 0, sizeof(secinfo->reserved)))
+ return -EINVAL;
+
+ return 0;
+}
+
+static int __sgx_encl_add_page(struct sgx_encl *encl,
+ struct sgx_encl_page *encl_page,
+ struct sgx_epc_page *epc_page,
+ struct sgx_secinfo *secinfo, unsigned long src)
+{
+ struct sgx_pageinfo pginfo;
+ struct vm_area_struct *vma;
+ struct page *src_page;
+ int ret;
+
+ /* Deny noexec. */
+ vma = find_vma(current->mm, src);
+ if (!vma)
+ return -EFAULT;
+
+ if (!(vma->vm_flags & VM_MAYEXEC))
+ return -EACCES;
+
+ ret = get_user_pages(src, 1, 0, &src_page, NULL);
+ if (ret < 1)
+ return -EFAULT;
+
+ pginfo.secs = (unsigned long)sgx_get_epc_addr(encl->secs.epc_page);
+ pginfo.addr = SGX_ENCL_PAGE_ADDR(encl_page);
+ pginfo.metadata = (unsigned long)secinfo;
+ pginfo.contents = (unsigned long)kmap_atomic(src_page);
+
+ ret = __eadd(&pginfo, sgx_get_epc_addr(epc_page));
+
+ kunmap_atomic((void *)pginfo.contents);
+ put_page(src_page);
+
+ return ret ? -EIO : 0;
+}
+
+/*
+ * If the caller requires measurement of the page as a proof for the content,
+ * use EEXTEND to add a measurement for 256 bytes of the page. Repeat this
+ * operation until the entire page is measured."
+ */
+static int __sgx_encl_extend(struct sgx_encl *encl,
+ struct sgx_epc_page *epc_page)
+{
+ int ret;
+ int i;
+
+ for (i = 0; i < 16; i++) {
+ ret = __eextend(sgx_get_epc_addr(encl->secs.epc_page),
+ sgx_get_epc_addr(epc_page) + (i * 0x100));
+ if (ret) {
+ if (encls_failed(ret))
+ ENCLS_WARN(ret, "EEXTEND");
+ return -EIO;
+ }
+ }
+
+ return 0;
+}
+
+static int sgx_encl_add_page(struct sgx_encl *encl, unsigned long src,
+ unsigned long offset, struct sgx_secinfo *secinfo,
+ unsigned long flags)
+{
+ struct sgx_encl_page *encl_page;
+ struct sgx_epc_page *epc_page;
+ int ret;
+
+ encl_page = sgx_encl_page_alloc(encl, offset, secinfo->flags);
+ if (IS_ERR(encl_page))
+ return PTR_ERR(encl_page);
+
+ epc_page = __sgx_alloc_epc_page();
+ if (IS_ERR(epc_page)) {
+ kfree(encl_page);
+ return PTR_ERR(epc_page);
+ }
+
+ mmap_read_lock(current->mm);
+ mutex_lock(&encl->lock);
+
+ /*
+ * Insert prior to EADD in case of OOM. EADD modifies MRENCLAVE, i.e.
+ * can't be gracefully unwound, while failure on EADD/EXTEND is limited
+ * to userspace errors (or kernel/hardware bugs).
+ */
+ ret = xa_insert(&encl->page_array, PFN_DOWN(encl_page->desc),
+ encl_page, GFP_KERNEL);
+ if (ret)
+ goto err_out_unlock;
+
+ ret = __sgx_encl_add_page(encl, encl_page, epc_page, secinfo,
+ src);
+ if (ret)
+ goto err_out;
+
+ /*
+ * Complete the "add" before doing the "extend" so that the "add"
+ * isn't in a half-baked state in the extremely unlikely scenario
+ * the enclave will be destroyed in response to EEXTEND failure.
+ */
+ encl_page->encl = encl;
+ encl_page->epc_page = epc_page;
+ encl->secs_child_cnt++;
+
+ if (flags & SGX_PAGE_MEASURE) {
+ ret = __sgx_encl_extend(encl, epc_page);
+ if (ret)
+ goto err_out;
+ }
+
+ mutex_unlock(&encl->lock);
+ mmap_read_unlock(current->mm);
+ return ret;
+
+err_out:
+ xa_erase(&encl->page_array, PFN_DOWN(encl_page->desc));
+
+err_out_unlock:
+ mutex_unlock(&encl->lock);
+ mmap_read_unlock(current->mm);
+
+ sgx_free_epc_page(epc_page);
+ kfree(encl_page);
+
+ return ret;
+}
+
+/**
+ * sgx_ioc_enclave_add_pages() - The handler for %SGX_IOC_ENCLAVE_ADD_PAGES
+ * @encl: an enclave pointer
+ * @arg: a user pointer to a struct sgx_enclave_add_pages instance
+ *
+ * Add one or more pages to an uninitialized enclave, and optionally extend the
+ * measurement with the contents of the page. The SECINFO and measurement mask
+ * are applied to all pages.
+ *
+ * A SECINFO for a TCS is required to always contain zero permissions because
+ * CPU silently zeros them. Allowing anything else would cause a mismatch in
+ * the measurement.
+ *
+ * mmap()'s protection bits are capped by the page permissions. For each page
+ * address, the maximum protection bits are computed with the following
+ * heuristics:
+ *
+ * 1. A regular page: PROT_R, PROT_W and PROT_X match the SECINFO permissions.
+ * 2. A TCS page: PROT_R | PROT_W.
+ *
+ * mmap() is not allowed to surpass the minimum of the maximum protection bits
+ * within the given address range.
+ *
+ * The function deinitializes kernel data structures for enclave and returns
+ * -EIO in any of the following conditions:
+ *
+ * - Enclave Page Cache (EPC), the physical memory holding enclaves, has
+ * been invalidated. This will cause EADD and EEXTEND to fail.
+ * - If the source address is corrupted somehow when executing EADD.
+ *
+ * Return:
+ * length of the data processed on success,
+ * -EACCES if an executable source page is located in a noexec partition,
+ * -ENOMEM if the system is out of EPC pages,
+ * -EINTR if the call was interrupted before any data was processed,
+ * -EIO if the enclave was lost
+ * -errno otherwise
+ */
+static long sgx_ioc_enclave_add_pages(struct sgx_encl *encl, void __user *arg)
+{
+ struct sgx_enclave_add_pages addp;
+ struct sgx_secinfo secinfo;
+ unsigned long c;
+ int ret;
+
+ if ((atomic_read(&encl->flags) & SGX_ENCL_INITIALIZED) ||
+ !(atomic_read(&encl->flags) & SGX_ENCL_CREATED))
+ return -EINVAL;
+
+ if (copy_from_user(&addp, arg, sizeof(addp)))
+ return -EFAULT;
+
+ if (!IS_ALIGNED(addp.offset, PAGE_SIZE) ||
+ !IS_ALIGNED(addp.src, PAGE_SIZE))
+ return -EINVAL;
+
+ if (!(access_ok(addp.src, PAGE_SIZE)))
+ return -EFAULT;
+
+ if (addp.length & (PAGE_SIZE - 1))
+ return -EINVAL;
+
+ if (addp.offset + addp.length - PAGE_SIZE >= encl->size)
+ return -EINVAL;
+
+ if (copy_from_user(&secinfo, (void __user *)addp.secinfo,
+ sizeof(secinfo)))
+ return -EFAULT;
+
+ if (sgx_validate_secinfo(&secinfo))
+ return -EINVAL;
+
+ for (c = 0 ; c < addp.length; c += PAGE_SIZE) {
+ if (signal_pending(current)) {
+ if (!c)
+ ret = -ERESTARTSYS;
+
+ break;
+ }
+
+ if (c == SGX_MAX_ADD_PAGES_LENGTH)
+ break;
+
+ if (need_resched())
+ cond_resched();
+
+ ret = sgx_encl_add_page(encl, addp.src + c, addp.offset + c,
+ &secinfo, addp.flags);
+ if (ret)
+ break;
+ }
+
+ addp.count = c;
+
+ if (copy_to_user(arg, &addp, sizeof(addp)))
+ return -EFAULT;
+
+ /*
+ * If the enlave was lost, deinitialize the internal data structures
+ * for the enclave.
+ */
+ if (ret == -EIO) {
+ mutex_lock(&encl->lock);
+ sgx_encl_destroy(encl);
+ mutex_unlock(&encl->lock);
+ }
+
+ return ret;
+}
+
long sgx_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
{
struct sgx_encl *encl = filep->private_data;
@@ -212,6 +508,9 @@ long sgx_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
case SGX_IOC_ENCLAVE_CREATE:
ret = sgx_ioc_enclave_create(encl, (void __user *)arg);
break;
+ case SGX_IOC_ENCLAVE_ADD_PAGES:
+ ret = sgx_ioc_enclave_add_pages(encl, (void __user *)arg);
+ break;
default:
ret = -ENOIOCTLCMD;
break;
diff --git a/arch/x86/kernel/cpu/sgx/sgx.h b/arch/x86/kernel/cpu/sgx/sgx.h
index fce756c3434b..8d126070db1e 100644
--- a/arch/x86/kernel/cpu/sgx/sgx.h
+++ b/arch/x86/kernel/cpu/sgx/sgx.h
@@ -34,6 +34,7 @@ struct sgx_epc_section {
#define SGX_EPC_SECTION_MASK GENMASK(7, 0)
#define SGX_MAX_EPC_SECTIONS (SGX_EPC_SECTION_MASK + 1)
+#define SGX_MAX_ADD_PAGES_LENGTH 0x100000
extern struct sgx_epc_section sgx_epc_sections[SGX_MAX_EPC_SECTIONS];
--
2.25.1
Add an ioctl that performs ENCLS[EINIT], which locks down the measurement
and initializes the enclave for entrance. After this, new pages can no
longer be added.
Acked-by: Jethro Beekman <[email protected]>
Tested-by: Jethro Beekman <[email protected]>
Tested-by: Haitao Huang <[email protected]>
Tested-by: Chunyang Hui <[email protected]>
Tested-by: Jordan Hand <[email protected]>
Tested-by: Nathaniel McCallum <[email protected]>
Tested-by: Seth Moore <[email protected]>
Tested-by: Darren Kenny <[email protected]>
Reviewed-by: Darren Kenny <[email protected]>
Co-developed-by: Sean Christopherson <[email protected]>
Signed-off-by: Sean Christopherson <[email protected]>
Co-developed-by: Suresh Siddha <[email protected]>
Signed-off-by: Suresh Siddha <[email protected]>
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
arch/x86/include/uapi/asm/sgx.h | 11 ++
arch/x86/kernel/cpu/sgx/encl.h | 2 +
arch/x86/kernel/cpu/sgx/ioctl.c | 193 ++++++++++++++++++++++++++++++++
3 files changed, 206 insertions(+)
diff --git a/arch/x86/include/uapi/asm/sgx.h b/arch/x86/include/uapi/asm/sgx.h
index 10cd48d06318..e401fa72eaab 100644
--- a/arch/x86/include/uapi/asm/sgx.h
+++ b/arch/x86/include/uapi/asm/sgx.h
@@ -23,6 +23,8 @@ enum sgx_page_flags {
_IOW(SGX_MAGIC, 0x00, struct sgx_enclave_create)
#define SGX_IOC_ENCLAVE_ADD_PAGES \
_IOWR(SGX_MAGIC, 0x01, struct sgx_enclave_add_pages)
+#define SGX_IOC_ENCLAVE_INIT \
+ _IOW(SGX_MAGIC, 0x02, struct sgx_enclave_init)
/**
* struct sgx_enclave_create - parameter structure for the
@@ -52,4 +54,13 @@ struct sgx_enclave_add_pages {
__u64 count;
};
+/**
+ * struct sgx_enclave_init - parameter structure for the
+ * %SGX_IOC_ENCLAVE_INIT ioctl
+ * @sigstruct: address for the SIGSTRUCT data
+ */
+struct sgx_enclave_init {
+ __u64 sigstruct;
+};
+
#endif /* _UAPI_ASM_X86_SGX_H */
diff --git a/arch/x86/kernel/cpu/sgx/encl.h b/arch/x86/kernel/cpu/sgx/encl.h
index 8ff445476657..0448d22d3010 100644
--- a/arch/x86/kernel/cpu/sgx/encl.h
+++ b/arch/x86/kernel/cpu/sgx/encl.h
@@ -70,6 +70,8 @@ struct sgx_encl {
struct xarray page_array;
struct sgx_encl_page secs;
cpumask_t cpumask;
+ unsigned long attributes;
+ unsigned long attributes_mask;
};
extern const struct vm_operations_struct sgx_vm_ops;
diff --git a/arch/x86/kernel/cpu/sgx/ioctl.c b/arch/x86/kernel/cpu/sgx/ioctl.c
index e13e04737683..cf5a43d6daa2 100644
--- a/arch/x86/kernel/cpu/sgx/ioctl.c
+++ b/arch/x86/kernel/cpu/sgx/ioctl.c
@@ -128,6 +128,9 @@ static int sgx_encl_create(struct sgx_encl *encl, struct sgx_secs *secs)
encl->base = secs->base;
encl->size = secs->size;
encl->ssaframesize = secs->ssa_frame_size;
+ encl->attributes = secs->attributes;
+ encl->attributes_mask = SGX_ATTR_DEBUG | SGX_ATTR_MODE64BIT |
+ SGX_ATTR_KSS;
/*
* Set SGX_ENCL_CREATED only after the enclave is fully prepped. This
@@ -490,6 +493,193 @@ static long sgx_ioc_enclave_add_pages(struct sgx_encl *encl, void __user *arg)
return ret;
}
+static int __sgx_get_key_hash(struct crypto_shash *tfm, const void *modulus,
+ void *hash)
+{
+ SHASH_DESC_ON_STACK(shash, tfm);
+
+ shash->tfm = tfm;
+
+ return crypto_shash_digest(shash, modulus, SGX_MODULUS_SIZE, hash);
+}
+
+static int sgx_get_key_hash(const void *modulus, void *hash)
+{
+ struct crypto_shash *tfm;
+ int ret;
+
+ tfm = crypto_alloc_shash("sha256", 0, CRYPTO_ALG_ASYNC);
+ if (IS_ERR(tfm))
+ return PTR_ERR(tfm);
+
+ ret = __sgx_get_key_hash(tfm, modulus, hash);
+
+ crypto_free_shash(tfm);
+ return ret;
+}
+
+static int sgx_encl_init(struct sgx_encl *encl, struct sgx_sigstruct *sigstruct,
+ void *token)
+{
+ u64 mrsigner[4];
+ void *addr;
+ int ret;
+ int i;
+ int j;
+
+ /*
+ * Deny initializing enclaves with attributes (namely provisioning)
+ * that have not been explicitly allowed.
+ */
+ if (encl->attributes & ~encl->attributes_mask)
+ return -EACCES;
+
+ /*
+ * Attributes should not be enforced *only* against what's available on
+ * platform (done in sgx_encl_create) but checked and enforced against
+ * the mask for enforcement in sigstruct. For example an enclave could
+ * opt to sign with AVX bit in xfrm, but still be loadable on a platform
+ * without it if the sigstruct->body.attributes_mask does not turn that
+ * bit on.
+ */
+ if (sigstruct->body.attributes & sigstruct->body.attributes_mask &
+ sgx_attributes_reserved_mask)
+ return -EINVAL;
+
+ if (sigstruct->body.miscselect & sigstruct->body.misc_mask &
+ sgx_misc_reserved_mask)
+ return -EINVAL;
+
+ if (sigstruct->body.xfrm & sigstruct->body.xfrm_mask &
+ sgx_xfrm_reserved_mask)
+ return -EINVAL;
+
+ ret = sgx_get_key_hash(sigstruct->modulus, mrsigner);
+ if (ret)
+ return ret;
+
+ mutex_lock(&encl->lock);
+
+ /*
+ * ENCLS[EINIT] is interruptible because it has such a high latency,
+ * e.g. 50k+ cycles on success. If an IRQ/NMI/SMI becomes pending,
+ * EINIT may fail with SGX_UNMASKED_EVENT so that the event can be
+ * serviced.
+ */
+ for (i = 0; i < SGX_EINIT_SLEEP_COUNT; i++) {
+ for (j = 0; j < SGX_EINIT_SPIN_COUNT; j++) {
+ addr = sgx_get_epc_addr(encl->secs.epc_page);
+
+ preempt_disable();
+
+ for (i = 0; i < 4; i++)
+ wrmsrl(MSR_IA32_SGXLEPUBKEYHASH0 + i, mrsigner[i]);
+
+ ret = __einit(sigstruct, token, addr);
+
+ preempt_enable();
+
+ if (ret == SGX_UNMASKED_EVENT)
+ continue;
+ else
+ break;
+ }
+
+ if (ret != SGX_UNMASKED_EVENT)
+ break;
+
+ msleep_interruptible(SGX_EINIT_SLEEP_TIME);
+
+ if (signal_pending(current)) {
+ ret = -ERESTARTSYS;
+ goto err_out;
+ }
+ }
+
+ if (ret & ENCLS_FAULT_FLAG) {
+ if (encls_failed(ret))
+ ENCLS_WARN(ret, "EINIT");
+
+ sgx_encl_destroy(encl);
+ ret = -EFAULT;
+ } else if (ret) {
+ pr_debug("EINIT returned %d\n", ret);
+ ret = -EPERM;
+ } else {
+ atomic_or(SGX_ENCL_INITIALIZED, &encl->flags);
+ }
+
+err_out:
+ mutex_unlock(&encl->lock);
+ return ret;
+}
+
+/**
+ * sgx_ioc_enclave_init - handler for %SGX_IOC_ENCLAVE_INIT
+ *
+ * @encl: an enclave pointer
+ * @arg: userspace pointer to a struct sgx_enclave_init instance
+ *
+ * Flush any outstanding enqueued EADD operations and perform EINIT. The
+ * Launch Enclave Public Key Hash MSRs are rewritten as necessary to match
+ * the enclave's MRSIGNER, which is caculated from the provided sigstruct.
+ *
+ * Return:
+ * 0 on success,
+ * SGX error code on EINIT failure,
+ * -errno otherwise
+ */
+static long sgx_ioc_enclave_init(struct sgx_encl *encl, void __user *arg)
+{
+ struct sgx_sigstruct *sigstruct;
+ struct sgx_enclave_init einit;
+ struct page *initp_page;
+ void *token;
+ int ret;
+
+ if ((atomic_read(&encl->flags) & SGX_ENCL_INITIALIZED) ||
+ !(atomic_read(&encl->flags) & SGX_ENCL_CREATED))
+ return -EINVAL;
+
+ if (copy_from_user(&einit, arg, sizeof(einit)))
+ return -EFAULT;
+
+ initp_page = alloc_page(GFP_KERNEL);
+ if (!initp_page)
+ return -ENOMEM;
+
+ sigstruct = kmap(initp_page);
+ token = (void *)((unsigned long)sigstruct + PAGE_SIZE / 2);
+ memset(token, 0, SGX_LAUNCH_TOKEN_SIZE);
+
+ if (copy_from_user(sigstruct, (void __user *)einit.sigstruct,
+ sizeof(*sigstruct))) {
+ ret = -EFAULT;
+ goto out;
+ }
+
+ /*
+ * A legacy field used with Intel signed enclaves. These used to mean
+ * regular and architectural enclaves. The CPU only accepts these values
+ * but they do not have any other meaning.
+ *
+ * Thus, reject any other values.
+ */
+ if (sigstruct->header.vendor != 0x0000 &&
+ sigstruct->header.vendor != 0x8086) {
+ ret = -EINVAL;
+ goto out;
+ }
+
+ ret = sgx_encl_init(encl, sigstruct, token);
+
+out:
+ kunmap(initp_page);
+ __free_page(initp_page);
+ return ret;
+}
+
+
long sgx_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
{
struct sgx_encl *encl = filep->private_data;
@@ -511,6 +701,9 @@ long sgx_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
case SGX_IOC_ENCLAVE_ADD_PAGES:
ret = sgx_ioc_enclave_add_pages(encl, (void __user *)arg);
break;
+ case SGX_IOC_ENCLAVE_INIT:
+ ret = sgx_ioc_enclave_init(encl, (void __user *)arg);
+ break;
default:
ret = -ENOIOCTLCMD;
break;
--
2.25.1
Document the Intel SGX kernel architecture. The fine-grained micro
architecture details can be looked up from Intel SDM Volume 3D.
Cc: [email protected]
Acked-by: Randy Dunlap <[email protected]>
Co-developed-by: Sean Christopherson <[email protected]>
Signed-off-by: Sean Christopherson <[email protected]>
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
Documentation/x86/index.rst | 1 +
Documentation/x86/sgx.rst | 284 ++++++++++++++++++++++++++++++++++++
2 files changed, 285 insertions(+)
create mode 100644 Documentation/x86/sgx.rst
diff --git a/Documentation/x86/index.rst b/Documentation/x86/index.rst
index 740ee7f87898..b9db893c8aee 100644
--- a/Documentation/x86/index.rst
+++ b/Documentation/x86/index.rst
@@ -32,3 +32,4 @@ x86-specific Documentation
i386/index
x86_64/index
sva
+ sgx
diff --git a/Documentation/x86/sgx.rst b/Documentation/x86/sgx.rst
new file mode 100644
index 000000000000..7b742c331247
--- /dev/null
+++ b/Documentation/x86/sgx.rst
@@ -0,0 +1,284 @@
+.. SPDX-License-Identifier: GPL-2.0
+
+===============================
+Software Guard eXtensions (SGX)
+===============================
+
+Architecture
+============
+
+*Software Guard eXtensions (SGX)* is a set of instructions that enable ring-3
+applications to set aside private regions of code and data. These regions are
+called enclaves. An enclave can be entered at a fixed set of entry points. Only
+a CPU running inside the enclave can access its code and data.
+
+The support can be determined by
+
+ ``grep sgx /proc/cpuinfo``
+
+Enclave Page Cache
+==================
+
+SGX utilizes an *Enclave Page Cache (EPC)* to store pages that are associated
+with an enclave. It is contained in a BIOS-reserved region of physical memory.
+Unlike pages used for regular memory, pages can only be accessed outside the
+enclave for different purposes with the instructions **ENCLS**, **ENCLV** and
+**ENCLU**.
+
+Direct memory accesses at an enclave can be only done by a CPU executing inside
+the enclave. An enclave can be entered with **ENCLU[EENTER]** to a fixed set of
+entry points. However, a CPU executing inside the enclave can do outside memory
+accesses.
+
+Page Types
+----------
+
+**SGX Enclave Control Structure (SECS)**
+ Enclave's address range, attributes and other global data are defined
+ by this structure.
+
+**Regular (REG)**
+ Regular EPC pages contain the code and data of an enclave.
+
+**Thread Control Structure (TCS)**
+ Thread Control Structure pages define the entry points to an enclave and
+ track the execution state of an enclave thread.
+
+**Version Array (VA)**
+ Version Array pages contain 512 slots, each of which can contain a version
+ number for a page evicted from the EPC.
+
+Enclave Page Cache Map
+----------------------
+
+The processor tracks EPC pages via the *Enclave Page Cache Map (EPCM)*. EPCM
+contains an entry for each EPC page, which describes the owning enclave, access
+rights and page type among the other things.
+
+The permissions from EPCM are consulted if and only if walking the kernel page
+tables succeeds. The total permissions are thus a conjunction between page table
+and EPCM permissions.
+
+For all intents and purposes, the SGX architecture allows the processor to
+invalidate all EPCM entries at will, i.e. requires that software be prepared to
+handle an EPCM fault at any time. The contents of EPC are encrypted with an
+ephemeral key, which is lost on power transitions.
+
+EPC management
+==============
+
+EPC pages do not have ``struct page`` instances. They are IO memory from kernel
+perspective. The consequence is that they are always mapped as shared memory.
+Kernel defines ``/dev/sgx/enclave`` that can be mapped as ``MAP_SHARED`` to
+define the address range for an enclave.
+
+EPC Over-subscription
+=====================
+
+When the amount of free EPC pages goes below a low watermark the swapping thread
+starts reclaiming pages. The pages that do not have the **A** bit set are
+selected as victim pages.
+
+Launch Control
+==============
+
+SGX provides a launch control mechanism. After all enclave pages have been
+copied, kernel executes **ENCLS[EINIT]**, which initializes the enclave. Only
+after this the CPU can execute inside the enclave.
+
+This leaf function takes an RSA-3072 signature of the enclave measurement and an
+optional cryptographic token. Linux does not take advantage of launch tokens.
+The leaf instruction checks that the measurement is correct and signature is
+signed with the key hashed to the four +**IA32_SGXLEPUBKEYHASH{0, 1, 2, 3}**
+MSRs representing the SHA256 of a public key.
+
+Those MSRs can be configured by the BIOS to be either readable or writable.
+Linux supports only writable configuration in order to give full control to the
+kernel on launch control policy. Readable configuration requires the use of
+previously mentioned launch tokens.
+
+The launch is performed by setting the MSRs to the hash of the enclave signer's
+public key. The alternative would be to have *a launch enclave* that would be
+signed with the key set into MSRs, which would then generate launch tokens for
+other enclaves. This would only make sense with read-only MSRs, and thus the
+option has been discarded.
+
+Attestation
+===========
+
+Local Attestation
+-----------------
+
+In local attestation, an enclave creates a **REPORT** data structure with
+**ENCLS[EREPORT]**, which describes the origin of an enclave. In particular, it
+contains a AES-CMAC of the enclave contents signed with a report key unique to
+each processor. All enclaves have access to this key.
+
+This mechanism can also be used in addition as a communication channel as the
+**REPORT** data structure includes a 64-byte field for variable information.
+
+Remote Attestation
+------------------
+
+Provisioning Certification Enclave (PCE), the root of trust for other enclaves,
+generates a signing key from a fused key called Provisioning Certification Key.
+PCE can then use this key to certify an attestation key of a Quoting Enclave
+(QE), e.g. we get the chain of trust down to the hardware if the Intel signed
+PCE is used.
+
+To use the needed keys, ATTRIBUTE.PROVISIONKEY is required but should be only
+allowed for those who actually need it so that only the trusted parties can
+certify QE's.
+
+A device file called /dev/sgx/provision exists to provide file descriptors that
+act as privilege tokens for building provisioning enclaves. These can be
+associated with enclaves with the ioctl SGX_IOC_ENCLAVE_SET_ATTRIBUTE.
+
+Encryption engines
+==================
+
+In order to conceal the enclave data while it is out of the CPU package,
+memory controller has to be extended with an encryption engine. MC can then
+route incoming requests coming from CPU cores running in enclave mode to the
+encryption engine.
+
+In CPUs prior to Icelake, Memory Encryption Engine (MEE) is used to
+encrypt pages leaving the CPU caches. MEE uses a n-ary Merkle tree with root in
+SRAM to maintain integrity of the encrypted data. This provides integrity and
+anti-replay protection but does not scale to large memory sizes because the time
+required to update the Merkle tree grows logarithmically in relation to the
+memory size.
+
+CPUs starting from Icelake use Total Memory Encryption (TME) in the place of
+MEE. SGX using TME does not have an integrity Merkle tree, which means losing HW
+protections from integrity and replay-attacks, but includes additional changes
+to prevent cipher text from being return and SW memory aliases from being
+created. DMA remains blocked by the PRMRR to the EPC memory even systems that
+use TME (SDM section 41.10).
+
+Backing storage
+===============
+
+Backing storage is shared and not accounted. It is implemented as a private
+shmem file. Providing a backing storage in some form from user space is not
+possible - accounting would go to invalid state as reclaimed pages would get
+accounted to the processes of which behalf the kernel happened to be acting on.
+
+Enclave Life Cycle
+==================
+
+Enclaves must be built before they can be executed (entered). The first step in
+building an enclave is opening the `/dev/sgx/enclave` device. Then, the enclave
+is built with ioctl's documented in `arch/x86/include/uapi/asm/sgx.h`.
+
+Since enclave memory is protected from direct access, special privileged
+instructions (name them here) are used to copy data into enclave pages and
+establish enclave page permissions within ioctl(SGX_whatever) calls.
+
+`mmap()` permissions are capped by the enclave permissions. A direct
+consequence of this is that all the pages for an address range must be added
+before `mmap()` can be applied. Effectively an enclave page with minimum
+permissions in the address range sets the permission cap for the mapping
+operation.
+
+SGX vDSO
+========
+
+The basic concept and implementation is very similar to the kernel's exception
+fixup mechanism. The key differences are that the kernel handler is hardcoded
+and the fixup entry addresses are relative to the overall table as opposed to
+individual entries.
+
+Hardcoding the kernel handler avoids the need to figure out how to get userspace
+code to point at a kernel function. Given that the expected usage is to
+propagate information to userspace, dumping all fault information into registers
+is likely the desired behavior for the vast majority of yet-to-be-created
+functions. Use registers DI, SI and DX to communicate fault information, which
+follows Linux's ABI for register consumption and hopefully avoids conflict with
+hardware features that might leverage the fixup capabilities, e.g. register
+usage for SGX instructions was at least partially designed with calling
+conventions in mind.
+
+Making fixup addresses relative to the overall table allows the table to be
+stripped from the final vDSO image (it's a kernel construct) without
+complicating the offset logic, e.g. entry-relative addressing would also need to
+account for the table's location relative to the image.
+
+Regarding stripping the table, modify vdso2c to extract the table from the raw,
+a.k.a. unstripped, data and dump it as a standalone byte array in the resulting
+.c file. The original base of the table, its length and a pointer to the byte
+array are captured in struct vdso_image. Alternatively, the table could be
+dumped directly into the struct, but because the number of entries can vary per
+image, that would require either hardcoding a max sized table into the struct
+definition or defining the table as a flexible length array. The flexible
+length array approach has zero benefits, e.g. the base/size are still needed,
+and prevents reusing the extraction code, while hardcoding the max size adds
+ongoing maintenance just to avoid exporting the explicit size.
+
+The immediate use case is for Intel Software Guard Extensions (SGX). SGX
+introduces a new CPL3-only "enclave" mode that runs as a sort of black box
+shared object that is hosted by an untrusted "normal" CPl3 process.
+
+Entering an enclave can only be done through SGX-specific instructions, EENTER
+and ERESUME, and is a non-trivial process. Because of the complexity of
+transitioning to/from an enclave, the vast majority of enclaves are expected to
+utilize a library to handle the actual transitions. This is roughly analogous
+to how e.g. libc implementations are used by most applications.
+
+Another crucial characteristic of SGX enclaves is that they can generate
+exceptions as part of their normal (at least as "normal" as SGX can be)
+operation that need to be handled *in* the enclave and/or are unique to SGX.
+
+And because they are essentially fancy shared objects, a process can host any
+number of enclaves, each of which can execute multiple threads simultaneously.
+
+Putting everything together, userspace enclaves will utilize a library that must
+be prepared to handle any and (almost) all exceptions any time at least one
+thread may be executing in an enclave. Leveraging signals to handle the enclave
+exceptions is unpleasant, to put it mildly, e.g. the SGX library must
+constantly (un)register its signal handler based on whether or not at least one
+thread is executing in an enclave, and filter and forward exceptions that aren't
+related to its enclaves. This becomes particularly nasty when using multiple
+levels of libraries that register signal handlers, e.g. running an enclave via
+cgo inside of the Go runtime.
+
+Enabling exception fixup in vDSO allows the kernel to provide a vDSO function
+that wraps the low-level transitions to/from the enclave, i.e. the EENTER and
+ERESUME instructions. The vDSO function can intercept exceptions that would
+otherwise generate a signal and return the fault information directly to its
+caller, thus avoiding the need to juggle signal handlers.
+
+Note that unlike the kernel's _ASM_EXTABLE_HANDLE implementation, the 'C'
+version of _ASM_VDSO_EXTABLE_HANDLE doesn't use a pre-compiled assembly macro.
+Duplicating four lines of code is simpler than adding the necessary
+infrastructure to generate pre-compiled assembly and the intended benefit of
+massaging GCC's inlining algorithm is unlikely to realized in the vDSO any time
+soon, if ever.
+
+Usage Models
+============
+
+Shared Library
+--------------
+
+Sensitive data and the code that acts on it is partitioned from the application
+into a separate library. The library is then linked as a DSO which can be loaded
+into an enclave. The application can then make individual function calls into
+the enclave through special SGX instructions. A run-time within the enclave is
+configured to marshal function parameters into and out of the enclave and to
+call the correct library function.
+
+Application Container
+---------------------
+
+An application may be loaded into a container enclave which is specially
+configured with a library OS and run-time which permits the application to run.
+The enclave run-time and library OS work together to execute the application
+when a thread enters the enclave.
+
+References
+==========
+
+"Supporting Third Party Attestation for Intel® SGX with Intel® Data Center
+Attestation Primitives"
+ https://software.intel.com/sites/default/files/managed/f1/b8/intel-sgx-support-for-third-party-attestation.pdf
--
2.25.1
From: Sean Christopherson <[email protected]>
An SGX runtime must be aware of the exceptions, which happen inside an
enclave. Introduce a vDSO call that wraps EENTER/ERESUME cycle and returns
the CPU exception back to the caller exactly when it happens.
Kernel fixups the exception information to RDI, RSI and RDX. The SGX call
vDSO handler fills this information to the user provided buffer or
alternatively trigger user provided callback at the time of the exception.
The calling convention supports providing the parameters in standard RDI
RSI, RDX, RCX, R8 and R9 registers, i.e. it is possible to declare the vDSO
as a C prototype, but other than that there is no specific support for
SystemV ABI. Storing XSAVE etc. is all responsibility of the enclave and
the associated run-time.
Suggested-by: Andy Lutomirski <[email protected]>
Acked-by: Jethro Beekman <[email protected]>
Tested-by: Jethro Beekman <[email protected]>
Signed-off-by: Sean Christopherson <[email protected]>
Co-developed-by: Cedric Xing <[email protected]>
Signed-off-by: Cedric Xing <[email protected]>
Co-developed-by: Jarkko Sakkinen <[email protected]>
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
arch/x86/entry/vdso/Makefile | 2 +
arch/x86/entry/vdso/vdso.lds.S | 1 +
arch/x86/entry/vdso/vsgx.S | 157 ++++++++++++++++++++++++++++++++
arch/x86/include/asm/enclu.h | 9 ++
arch/x86/include/uapi/asm/sgx.h | 98 ++++++++++++++++++++
5 files changed, 267 insertions(+)
create mode 100644 arch/x86/entry/vdso/vsgx.S
create mode 100644 arch/x86/include/asm/enclu.h
diff --git a/arch/x86/entry/vdso/Makefile b/arch/x86/entry/vdso/Makefile
index 3f183d0b8826..27e7635e31d3 100644
--- a/arch/x86/entry/vdso/Makefile
+++ b/arch/x86/entry/vdso/Makefile
@@ -29,6 +29,7 @@ VDSO32-$(CONFIG_IA32_EMULATION) := y
vobjs-y := vdso-note.o vclock_gettime.o vgetcpu.o
vobjs32-y := vdso32/note.o vdso32/system_call.o vdso32/sigreturn.o
vobjs32-y += vdso32/vclock_gettime.o
+vobjs-$(VDSO64-y) += vsgx.o
# files to link into kernel
obj-y += vma.o extable.o
@@ -100,6 +101,7 @@ $(vobjs): KBUILD_CFLAGS := $(filter-out $(GCC_PLUGINS_CFLAGS) $(RETPOLINE_CFLAGS
CFLAGS_REMOVE_vclock_gettime.o = -pg
CFLAGS_REMOVE_vdso32/vclock_gettime.o = -pg
CFLAGS_REMOVE_vgetcpu.o = -pg
+CFLAGS_REMOVE_vsgx.o = -pg
#
# X32 processes use x32 vDSO to access 64bit kernel data.
diff --git a/arch/x86/entry/vdso/vdso.lds.S b/arch/x86/entry/vdso/vdso.lds.S
index 36b644e16272..4bf48462fca7 100644
--- a/arch/x86/entry/vdso/vdso.lds.S
+++ b/arch/x86/entry/vdso/vdso.lds.S
@@ -27,6 +27,7 @@ VERSION {
__vdso_time;
clock_getres;
__vdso_clock_getres;
+ __vdso_sgx_enter_enclave;
local: *;
};
}
diff --git a/arch/x86/entry/vdso/vsgx.S b/arch/x86/entry/vdso/vsgx.S
new file mode 100644
index 000000000000..5c047e588f16
--- /dev/null
+++ b/arch/x86/entry/vdso/vsgx.S
@@ -0,0 +1,157 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+#include <linux/linkage.h>
+#include <asm/export.h>
+#include <asm/errno.h>
+#include <asm/enclu.h>
+
+#include "extable.h"
+
+/* Relative to %rbp. */
+#define SGX_ENCLAVE_OFFSET_OF_RUN 16
+
+/* The offsets relative to struct sgx_enclave_run. */
+#define SGX_ENCLAVE_RUN_TCS 0
+#define SGX_ENCLAVE_RUN_USER_HANDLER 8
+#define SGX_ENCLAVE_RUN_USER_DATA 16 /* unused */
+#define SGX_ENCLAVE_RUN_LEAF 24
+#define SGX_ENCLAVE_RUN_EXCEPTION_VECTOR 28
+#define SGX_ENCLAVE_RUN_EXCEPTION_ERROR_CODE 30
+#define SGX_ENCLAVE_RUN_EXCEPTION_ADDR 32
+#define SGX_ENCLAVE_RUN_RESERVED_START 40
+#define SGX_ENCLAVE_RUN_RESERVED_END 64
+
+.code64
+.section .text, "ax"
+
+SYM_FUNC_START(__vdso_sgx_enter_enclave)
+ /* Prolog */
+ .cfi_startproc
+ push %rbp
+ .cfi_adjust_cfa_offset 8
+ .cfi_rel_offset %rbp, 0
+ mov %rsp, %rbp
+ .cfi_def_cfa_register %rbp
+ push %rbx
+ .cfi_rel_offset %rbx, -8
+
+ mov %ecx, %eax
+.Lenter_enclave:
+ /* EENTER <= leaf <= ERESUME */
+ cmp $EENTER, %eax
+ jb .Linvalid_input
+ cmp $ERESUME, %eax
+ ja .Linvalid_input
+
+ mov SGX_ENCLAVE_OFFSET_OF_RUN(%rbp), %rcx
+
+ /* Validate that the reserved area contains only zeros. */
+ push %rax
+ push %rbx
+ mov $SGX_ENCLAVE_RUN_RESERVED_START, %rbx
+1:
+ mov (%rcx, %rbx), %rax
+ cmpq $0, %rax
+ jne .Linvalid_input
+
+ add $8, %rbx
+ cmpq $SGX_ENCLAVE_RUN_RESERVED_END, %rbx
+ jne 1b
+ pop %rbx
+ pop %rax
+
+ /* Load TCS and AEP */
+ mov SGX_ENCLAVE_RUN_TCS(%rcx), %rbx
+ lea .Lasync_exit_pointer(%rip), %rcx
+
+ /* Single ENCLU serving as both EENTER and AEP (ERESUME) */
+.Lasync_exit_pointer:
+.Lenclu_eenter_eresume:
+ enclu
+
+ /* EEXIT jumps here unless the enclave is doing something fancy. */
+ mov SGX_ENCLAVE_OFFSET_OF_RUN(%rbp), %rbx
+
+ /* Set exit_reason. */
+ movl $EEXIT, SGX_ENCLAVE_RUN_LEAF(%rbx)
+
+ /* Invoke userspace's exit handler if one was provided. */
+.Lhandle_exit:
+ cmpq $0, SGX_ENCLAVE_RUN_USER_HANDLER(%rbx)
+ jne .Linvoke_userspace_handler
+
+ /* Success, in the sense that ENCLU was attempted. */
+ xor %eax, %eax
+
+.Lout:
+ pop %rbx
+ leave
+ .cfi_def_cfa %rsp, 8
+ ret
+
+ /* The out-of-line code runs with the pre-leave stack frame. */
+ .cfi_def_cfa %rbp, 16
+
+.Linvalid_input:
+ mov $(-EINVAL), %eax
+ jmp .Lout
+
+.Lhandle_exception:
+ mov SGX_ENCLAVE_OFFSET_OF_RUN(%rbp), %rbx
+
+ /* Set the exception info. */
+ mov %eax, (SGX_ENCLAVE_RUN_LEAF)(%rbx)
+ mov %di, (SGX_ENCLAVE_RUN_EXCEPTION_VECTOR)(%rbx)
+ mov %si, (SGX_ENCLAVE_RUN_EXCEPTION_ERROR_CODE)(%rbx)
+ mov %rdx, (SGX_ENCLAVE_RUN_EXCEPTION_ADDR)(%rbx)
+ jmp .Lhandle_exit
+
+.Linvoke_userspace_handler:
+ /* Pass the untrusted RSP (at exit) to the callback via %rcx. */
+ mov %rsp, %rcx
+
+ /* Save struct sgx_enclave_exception %rbx is about to be clobbered. */
+ mov %rbx, %rax
+
+ /* Save the untrusted RSP offset in %rbx (non-volatile register). */
+ mov %rsp, %rbx
+ and $0xf, %rbx
+
+ /*
+ * Align stack per x86_64 ABI. Note, %rsp needs to be 16-byte aligned
+ * _after_ pushing the parameters on the stack, hence the bonus push.
+ */
+ and $-0x10, %rsp
+ push %rax
+
+ /* Push struct sgx_enclave_exception as a param to the callback. */
+ push %rax
+
+ /* Clear RFLAGS.DF per x86_64 ABI */
+ cld
+
+ /*
+ * Load the callback pointer to %rax and lfence for LVI (load value
+ * injection) protection before making the call.
+ */
+ mov SGX_ENCLAVE_RUN_USER_HANDLER(%rax), %rax
+ lfence
+ call *%rax
+
+ /* Undo the post-exit %rsp adjustment. */
+ lea 0x10(%rsp, %rbx), %rsp
+
+ /*
+ * If the return from callback is zero or negative, return immediately,
+ * else re-execute ENCLU with the postive return value interpreted as
+ * the requested ENCLU leaf.
+ */
+ cmp $0, %eax
+ jle .Lout
+ jmp .Lenter_enclave
+
+ .cfi_endproc
+
+_ASM_VDSO_EXTABLE_HANDLE(.Lenclu_eenter_eresume, .Lhandle_exception)
+
+SYM_FUNC_END(__vdso_sgx_enter_enclave)
diff --git a/arch/x86/include/asm/enclu.h b/arch/x86/include/asm/enclu.h
new file mode 100644
index 000000000000..b1314e41a744
--- /dev/null
+++ b/arch/x86/include/asm/enclu.h
@@ -0,0 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _ASM_X86_ENCLU_H
+#define _ASM_X86_ENCLU_H
+
+#define EENTER 0x02
+#define ERESUME 0x03
+#define EEXIT 0x04
+
+#endif /* _ASM_X86_ENCLU_H */
diff --git a/arch/x86/include/uapi/asm/sgx.h b/arch/x86/include/uapi/asm/sgx.h
index b6ba036a9b82..3dd2df44d569 100644
--- a/arch/x86/include/uapi/asm/sgx.h
+++ b/arch/x86/include/uapi/asm/sgx.h
@@ -74,4 +74,102 @@ struct sgx_enclave_provision {
__u64 attribute_fd;
};
+struct sgx_enclave_run;
+
+/**
+ * typedef sgx_enclave_user_handler_t - Exit handler function accepted by
+ * __vdso_sgx_enter_enclave()
+ * @run: Pointer to the caller provided struct sgx_enclave_run
+ *
+ * The register parameters contain the snapshot of their values at enclave
+ * exit
+ *
+ * Return:
+ * 0 or negative to exit vDSO
+ * positive to re-enter enclave (must be EENTER or ERESUME leaf)
+ */
+typedef int (*sgx_enclave_user_handler_t)(long rdi, long rsi, long rdx,
+ long rsp, long r8, long r9,
+ struct sgx_enclave_run *run);
+
+/**
+ * struct sgx_enclave_run - the execution context of __vdso_sgx_enter_enclave()
+ * @tcs: TCS used to enter the enclave
+ * @user_handler: User provided callback run on exception
+ * @user_data: Data passed to the user handler
+ * @leaf: The ENCLU leaf we were at (EENTER/ERESUME/EEXIT)
+ * @exception_vector: The interrupt vector of the exception
+ * @exception_error_code: The exception error code pulled out of the stack
+ * @exception_addr: The address that triggered the exception
+ * @reserved Reserved for possible future use
+ */
+struct sgx_enclave_run {
+ __u64 tcs;
+ __u64 user_handler;
+ __u64 user_data;
+ __u32 leaf;
+ __u16 exception_vector;
+ __u16 exception_error_code;
+ __u64 exception_addr;
+ __u8 reserved[24];
+};
+
+/**
+ * typedef vdso_sgx_enter_enclave_t - Prototype for __vdso_sgx_enter_enclave(),
+ * a vDSO function to enter an SGX enclave.
+ * @rdi: Pass-through value for RDI
+ * @rsi: Pass-through value for RSI
+ * @rdx: Pass-through value for RDX
+ * @leaf: ENCLU leaf, must be EENTER or ERESUME
+ * @r8: Pass-through value for R8
+ * @r9: Pass-through value for R9
+ * @run: struct sgx_enclave_run, must be non-NULL
+ *
+ * NOTE: __vdso_sgx_enter_enclave() does not ensure full compliance with the
+ * x86-64 ABI, e.g. doesn't handle XSAVE state. Except for non-volatile
+ * general purpose registers, EFLAGS.DF, and RSP alignment, preserving/setting
+ * state in accordance with the x86-64 ABI is the responsibility of the enclave
+ * and its runtime, i.e. __vdso_sgx_enter_enclave() cannot be called from C
+ * code without careful consideration by both the enclave and its runtime.
+ *
+ * All general purpose registers except RAX, RBX and RCX are passed as-is to
+ * the enclave. RAX, RBX and RCX are consumed by EENTER and ERESUME and are
+ * loaded with @leaf, asynchronous exit pointer, and @run.tcs respectively.
+ *
+ * RBP and the stack are used to anchor __vdso_sgx_enter_enclave() to the
+ * pre-enclave state, e.g. to retrieve @run.exception and @run.user_handler
+ * after an enclave exit. All other registers are available for use by the
+ * enclave and its runtime, e.g. an enclave can push additional data onto the
+ * stack (and modify RSP) to pass information to the optional user handler (see
+ * below).
+ *
+ * Most exceptions reported on ENCLU, including those that occur within the
+ * enclave, are fixed up and reported synchronously instead of being delivered
+ * via a standard signal. Debug Exceptions (#DB) and Breakpoints (#BP) are
+ * never fixed up and are always delivered via standard signals. On synchrously
+ * reported exceptions, -EFAULT is returned and details about the exception are
+ * recorded in @run.exception, the optional sgx_enclave_exception struct.
+ *
+ * If a user handler is provided, the handler will be invoked on synchronous
+ * exits from the enclave and for all synchronously reported exceptions. In
+ * latter case, @run.exception is filled prior to invoking the handler.
+ *
+ * The user handler's return value is interpreted as follows:
+ * >0: continue, restart __vdso_sgx_enter_enclave() with @ret as @leaf
+ * 0: success, return @ret to the caller
+ * <0: error, return @ret to the caller
+ *
+ * The user handler may transfer control, e.g. via longjmp() or C++ exception,
+ * without returning to __vdso_sgx_enter_enclave().
+ *
+ * Return:
+ * 0 on success (ENCLU reached),
+ * -EINVAL if ENCLU leaf is not allowed,
+ * -errno for all other negative values returned by the userspace user handler
+ */
+typedef int (*vdso_sgx_enter_enclave_t)(unsigned long rdi, unsigned long rsi,
+ unsigned long rdx, unsigned int leaf,
+ unsigned long r8, unsigned long r9,
+ struct sgx_enclave_run *run);
+
#endif /* _UAPI_ASM_X86_SGX_H */
--
2.25.1
Add an ioctl that performs ENCLS[ECREATE], which creates SGX Enclave
Control Structure for the enclave. SECS contains attributes about the
enclave that are used by the hardware and cannot be directly accessed by
software, as SECS resides in the EPC.
One essential field in SECS is a field that stores the SHA256 of the
measured enclave pages. This field, MRENCLAVE, is initialized by the
ECREATE instruction and updated by every EADD and EEXTEND operation.
Finally, EINIT locks down the value.
Acked-by: Jethro Beekman <[email protected]>
Tested-by: Jethro Beekman <[email protected]>
Tested-by: Haitao Huang <[email protected]>
Tested-by: Chunyang Hui <[email protected]>
Tested-by: Jordan Hand <[email protected]>
Tested-by: Nathaniel McCallum <[email protected]>
Tested-by: Seth Moore <[email protected]>
Tested-by: Darren Kenny <[email protected]>
Reviewed-by: Darren Kenny <[email protected]>
Co-developed-by: Sean Christopherson <[email protected]>
Signed-off-by: Sean Christopherson <[email protected]>
Co-developed-by: Suresh Siddha <[email protected]>
Signed-off-by: Suresh Siddha <[email protected]>
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
.../userspace-api/ioctl/ioctl-number.rst | 1 +
arch/x86/include/uapi/asm/sgx.h | 25 ++
arch/x86/kernel/cpu/sgx/Makefile | 1 +
arch/x86/kernel/cpu/sgx/driver.c | 12 +
arch/x86/kernel/cpu/sgx/driver.h | 1 +
arch/x86/kernel/cpu/sgx/ioctl.c | 223 ++++++++++++++++++
6 files changed, 263 insertions(+)
create mode 100644 arch/x86/include/uapi/asm/sgx.h
create mode 100644 arch/x86/kernel/cpu/sgx/ioctl.c
diff --git a/Documentation/userspace-api/ioctl/ioctl-number.rst b/Documentation/userspace-api/ioctl/ioctl-number.rst
index 2a198838fca9..a89e1c46a25a 100644
--- a/Documentation/userspace-api/ioctl/ioctl-number.rst
+++ b/Documentation/userspace-api/ioctl/ioctl-number.rst
@@ -323,6 +323,7 @@ Code Seq# Include File Comments
<mailto:[email protected]>
0xA3 90-9F linux/dtlk.h
0xA4 00-1F uapi/linux/tee.h Generic TEE subsystem
+0xA4 00-1F uapi/asm/sgx.h <mailto:[email protected]>
0xAA 00-3F linux/uapi/linux/userfaultfd.h
0xAB 00-1F linux/nbd.h
0xAC 00-1F linux/raw.h
diff --git a/arch/x86/include/uapi/asm/sgx.h b/arch/x86/include/uapi/asm/sgx.h
new file mode 100644
index 000000000000..c75b375f3770
--- /dev/null
+++ b/arch/x86/include/uapi/asm/sgx.h
@@ -0,0 +1,25 @@
+/* SPDX-License-Identifier: ((GPL-2.0+ WITH Linux-syscall-note) OR BSD-3-Clause) */
+/*
+ * Copyright(c) 2016-19 Intel Corporation.
+ */
+#ifndef _UAPI_ASM_X86_SGX_H
+#define _UAPI_ASM_X86_SGX_H
+
+#include <linux/types.h>
+#include <linux/ioctl.h>
+
+#define SGX_MAGIC 0xA4
+
+#define SGX_IOC_ENCLAVE_CREATE \
+ _IOW(SGX_MAGIC, 0x00, struct sgx_enclave_create)
+
+/**
+ * struct sgx_enclave_create - parameter structure for the
+ * %SGX_IOC_ENCLAVE_CREATE ioctl
+ * @src: address for the SECS page data
+ */
+struct sgx_enclave_create {
+ __u64 src;
+};
+
+#endif /* _UAPI_ASM_X86_SGX_H */
diff --git a/arch/x86/kernel/cpu/sgx/Makefile b/arch/x86/kernel/cpu/sgx/Makefile
index 3fc451120735..91d3dc784a29 100644
--- a/arch/x86/kernel/cpu/sgx/Makefile
+++ b/arch/x86/kernel/cpu/sgx/Makefile
@@ -1,4 +1,5 @@
obj-y += \
driver.o \
encl.o \
+ ioctl.o \
main.o
diff --git a/arch/x86/kernel/cpu/sgx/driver.c b/arch/x86/kernel/cpu/sgx/driver.c
index f54da5f19c2b..7bdb49dfcca6 100644
--- a/arch/x86/kernel/cpu/sgx/driver.c
+++ b/arch/x86/kernel/cpu/sgx/driver.c
@@ -114,10 +114,22 @@ static unsigned long sgx_get_unmapped_area(struct file *file,
return current->mm->get_unmapped_area(file, addr, len, pgoff, flags);
}
+#ifdef CONFIG_COMPAT
+static long sgx_compat_ioctl(struct file *filep, unsigned int cmd,
+ unsigned long arg)
+{
+ return sgx_ioctl(filep, cmd, arg);
+}
+#endif
+
static const struct file_operations sgx_encl_fops = {
.owner = THIS_MODULE,
.open = sgx_open,
.release = sgx_release,
+ .unlocked_ioctl = sgx_ioctl,
+#ifdef CONFIG_COMPAT
+ .compat_ioctl = sgx_compat_ioctl,
+#endif
.mmap = sgx_mmap,
.get_unmapped_area = sgx_get_unmapped_area,
};
diff --git a/arch/x86/kernel/cpu/sgx/driver.h b/arch/x86/kernel/cpu/sgx/driver.h
index f7ce40dedc91..e4063923115b 100644
--- a/arch/x86/kernel/cpu/sgx/driver.h
+++ b/arch/x86/kernel/cpu/sgx/driver.h
@@ -9,6 +9,7 @@
#include <linux/rwsem.h>
#include <linux/sched.h>
#include <linux/workqueue.h>
+#include <uapi/asm/sgx.h>
#include "sgx.h"
#define SGX_EINIT_SPIN_COUNT 20
diff --git a/arch/x86/kernel/cpu/sgx/ioctl.c b/arch/x86/kernel/cpu/sgx/ioctl.c
new file mode 100644
index 000000000000..9bb4694e57c1
--- /dev/null
+++ b/arch/x86/kernel/cpu/sgx/ioctl.c
@@ -0,0 +1,223 @@
+// SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause)
+// Copyright(c) 2016-19 Intel Corporation.
+
+#include <asm/mman.h>
+#include <linux/mman.h>
+#include <linux/delay.h>
+#include <linux/file.h>
+#include <linux/hashtable.h>
+#include <linux/highmem.h>
+#include <linux/ratelimit.h>
+#include <linux/sched/signal.h>
+#include <linux/shmem_fs.h>
+#include <linux/slab.h>
+#include <linux/suspend.h>
+#include "driver.h"
+#include "encl.h"
+#include "encls.h"
+
+static u32 sgx_calc_ssa_frame_size(u32 miscselect, u64 xfrm)
+{
+ u32 size_max = PAGE_SIZE;
+ u32 size;
+ int i;
+
+ for (i = 2; i < 64; i++) {
+ if (!((1 << i) & xfrm))
+ continue;
+
+ size = SGX_SSA_GPRS_SIZE + sgx_xsave_size_tbl[i];
+
+ if (miscselect & SGX_MISC_EXINFO)
+ size += SGX_SSA_MISC_EXINFO_SIZE;
+
+ if (size > size_max)
+ size_max = size;
+ }
+
+ return PFN_UP(size_max);
+}
+
+static int sgx_validate_secs(const struct sgx_secs *secs)
+{
+ u64 max_size = (secs->attributes & SGX_ATTR_MODE64BIT) ?
+ sgx_encl_size_max_64 : sgx_encl_size_max_32;
+
+ if (secs->size < (2 * PAGE_SIZE) || !is_power_of_2(secs->size))
+ return -EINVAL;
+
+ if (secs->base & (secs->size - 1))
+ return -EINVAL;
+
+ if (secs->miscselect & sgx_misc_reserved_mask ||
+ secs->attributes & sgx_attributes_reserved_mask ||
+ secs->xfrm & sgx_xfrm_reserved_mask)
+ return -EINVAL;
+
+ if (secs->size > max_size)
+ return -EINVAL;
+
+ if (!(secs->xfrm & XFEATURE_MASK_FP) ||
+ !(secs->xfrm & XFEATURE_MASK_SSE) ||
+ (((secs->xfrm >> XFEATURE_BNDREGS) & 1) != ((secs->xfrm >> XFEATURE_BNDCSR) & 1)))
+ return -EINVAL;
+
+ if (!secs->ssa_frame_size)
+ return -EINVAL;
+
+ if (sgx_calc_ssa_frame_size(secs->miscselect, secs->xfrm) > secs->ssa_frame_size)
+ return -EINVAL;
+
+ if (memchr_inv(secs->reserved1, 0, sizeof(secs->reserved1)) ||
+ memchr_inv(secs->reserved2, 0, sizeof(secs->reserved2)) ||
+ memchr_inv(secs->reserved3, 0, sizeof(secs->reserved3)) ||
+ memchr_inv(secs->reserved4, 0, sizeof(secs->reserved4)))
+ return -EINVAL;
+
+ return 0;
+}
+
+static int sgx_encl_create(struct sgx_encl *encl, struct sgx_secs *secs)
+{
+ struct sgx_epc_page *secs_epc;
+ struct sgx_pageinfo pginfo;
+ struct sgx_secinfo secinfo;
+ unsigned long encl_size;
+ struct file *backing;
+ long ret;
+
+ if (sgx_validate_secs(secs)) {
+ pr_debug("invalid SECS\n");
+ return -EINVAL;
+ }
+
+ /* The extra page goes to SECS. */
+ encl_size = secs->size + PAGE_SIZE;
+
+ backing = shmem_file_setup("SGX backing", encl_size + (encl_size >> 5),
+ VM_NORESERVE);
+ if (IS_ERR(backing))
+ return PTR_ERR(backing);
+
+ encl->backing = backing;
+
+ secs_epc = __sgx_alloc_epc_page();
+ if (IS_ERR(secs_epc)) {
+ ret = PTR_ERR(secs_epc);
+ goto err_out_backing;
+ }
+
+ encl->secs.epc_page = secs_epc;
+
+ pginfo.addr = 0;
+ pginfo.contents = (unsigned long)secs;
+ pginfo.metadata = (unsigned long)&secinfo;
+ pginfo.secs = 0;
+ memset(&secinfo, 0, sizeof(secinfo));
+
+ ret = __ecreate((void *)&pginfo, sgx_get_epc_addr(secs_epc));
+ if (ret) {
+ pr_debug("ECREATE returned %ld\n", ret);
+ goto err_out;
+ }
+
+ if (secs->attributes & SGX_ATTR_DEBUG)
+ atomic_or(SGX_ENCL_DEBUG, &encl->flags);
+
+ encl->secs.encl = encl;
+ encl->base = secs->base;
+ encl->size = secs->size;
+ encl->ssaframesize = secs->ssa_frame_size;
+
+ /*
+ * Set SGX_ENCL_CREATED only after the enclave is fully prepped. This
+ * allows setting and checking enclave creation without having to take
+ * encl->lock.
+ */
+ atomic_or(SGX_ENCL_CREATED, &encl->flags);
+
+ return 0;
+
+err_out:
+ sgx_free_epc_page(encl->secs.epc_page);
+ encl->secs.epc_page = NULL;
+
+err_out_backing:
+ fput(encl->backing);
+ encl->backing = NULL;
+
+ return ret;
+}
+
+/**
+ * sgx_ioc_enclave_create - handler for %SGX_IOC_ENCLAVE_CREATE
+ * @encl: an enclave pointer
+ * @arg: userspace pointer to a struct sgx_enclave_create instance
+ *
+ * Allocate kernel data structures for a new enclave and execute ECREATE after
+ * checking that the provided data for SECS meets the expectations of ECREATE
+ * for an uninitialized enclave and size of the address space does not surpass the
+ * platform expectations. This validation is done by sgx_validate_secs().
+ *
+ * Return:
+ * 0 on success,
+ * -errno otherwise
+ */
+static long sgx_ioc_enclave_create(struct sgx_encl *encl, void __user *arg)
+{
+ struct sgx_enclave_create ecreate;
+ struct page *secs_page;
+ struct sgx_secs *secs;
+ int ret;
+
+ if (atomic_read(&encl->flags) & SGX_ENCL_CREATED)
+ return -EINVAL;
+
+ if (copy_from_user(&ecreate, arg, sizeof(ecreate)))
+ return -EFAULT;
+
+ secs_page = alloc_page(GFP_KERNEL);
+ if (!secs_page)
+ return -ENOMEM;
+
+ secs = kmap(secs_page);
+ if (copy_from_user(secs, (void __user *)ecreate.src, sizeof(*secs))) {
+ ret = -EFAULT;
+ goto out;
+ }
+
+ ret = sgx_encl_create(encl, secs);
+
+out:
+ kunmap(secs_page);
+ __free_page(secs_page);
+ return ret;
+}
+
+long sgx_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
+{
+ struct sgx_encl *encl = filep->private_data;
+ int ret, encl_flags;
+
+ encl_flags = atomic_fetch_or(SGX_ENCL_IOCTL, &encl->flags);
+ if (encl_flags & SGX_ENCL_IOCTL)
+ return -EBUSY;
+
+ if (encl_flags & SGX_ENCL_DEAD) {
+ ret = -EFAULT;
+ goto out;
+ }
+
+ switch (cmd) {
+ case SGX_IOC_ENCLAVE_CREATE:
+ ret = sgx_ioc_enclave_create(encl, (void __user *)arg);
+ break;
+ default:
+ ret = -ENOIOCTLCMD;
+ break;
+ }
+
+out:
+ atomic_andnot(SGX_ENCL_IOCTL, &encl->flags);
+ return ret;
+}
--
2.25.1
Intel Sofware Guard eXtensions (SGX) allows creation of executable blobs
called enclaves, which cannot be accessed by default when not executing
inside the enclave. Enclaves can be entered by only using predefined memory
addresses, which are defined when the enclave is loaded.
However, enclaves can defined as debug enclaves at the load time. In debug
enclaves data can be read and/or written a memory word at a time by by
using ENCLS[EDBGRD] and ENCLS[EDBGWR] leaf instructions.
Add sgx_vma_access() function that implements 'access' virtual function
of struct vm_operations_struct. Use aforementioned leaf instructions to
provide read and write primitives for the enclave memory.
Cc: [email protected]
Cc: Andrew Morton <[email protected]>
Cc: Matthew Wilcox <[email protected]>
Acked-by: Jethro Beekman <[email protected]>
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
arch/x86/kernel/cpu/sgx/encl.c | 89 ++++++++++++++++++++++++++++++++++
1 file changed, 89 insertions(+)
diff --git a/arch/x86/kernel/cpu/sgx/encl.c b/arch/x86/kernel/cpu/sgx/encl.c
index 54326efa6c2f..ae45f8f0951e 100644
--- a/arch/x86/kernel/cpu/sgx/encl.c
+++ b/arch/x86/kernel/cpu/sgx/encl.c
@@ -337,10 +337,99 @@ static int sgx_vma_mprotect(struct vm_area_struct *vma,
return mprotect_fixup(vma, pprev, start, end, newflags);
}
+static int sgx_encl_debug_read(struct sgx_encl *encl, struct sgx_encl_page *page,
+ unsigned long addr, void *data)
+{
+ unsigned long offset = addr & ~PAGE_MASK;
+ int ret;
+
+
+ ret = __edbgrd(sgx_get_epc_addr(page->epc_page) + offset, data);
+ if (ret)
+ return -EIO;
+
+ return 0;
+}
+
+static int sgx_encl_debug_write(struct sgx_encl *encl, struct sgx_encl_page *page,
+ unsigned long addr, void *data)
+{
+ unsigned long offset = addr & ~PAGE_MASK;
+ int ret;
+
+ ret = __edbgwr(sgx_get_epc_addr(page->epc_page) + offset, data);
+ if (ret)
+ return -EIO;
+
+ return 0;
+}
+
+static int sgx_vma_access(struct vm_area_struct *vma, unsigned long addr,
+ void *buf, int len, int write)
+{
+ struct sgx_encl *encl = vma->vm_private_data;
+ struct sgx_encl_page *entry = NULL;
+ char data[sizeof(unsigned long)];
+ unsigned long align;
+ unsigned int flags;
+ int offset;
+ int cnt;
+ int ret = 0;
+ int i;
+
+ /*
+ * If process was forked, VMA is still there but vm_private_data is set
+ * to NULL.
+ */
+ if (!encl)
+ return -EFAULT;
+
+ flags = atomic_read(&encl->flags);
+
+ if (!(flags & SGX_ENCL_DEBUG) || !(flags & SGX_ENCL_INITIALIZED) ||
+ (flags & SGX_ENCL_DEAD))
+ return -EFAULT;
+
+ for (i = 0; i < len; i += cnt) {
+ entry = sgx_encl_reserve_page(encl, (addr + i) & PAGE_MASK);
+ if (IS_ERR(entry)) {
+ ret = PTR_ERR(entry);
+ break;
+ }
+
+ align = ALIGN_DOWN(addr + i, sizeof(unsigned long));
+ offset = (addr + i) & (sizeof(unsigned long) - 1);
+ cnt = sizeof(unsigned long) - offset;
+ cnt = min(cnt, len - i);
+
+ ret = sgx_encl_debug_read(encl, entry, align, data);
+ if (ret)
+ goto out;
+
+ if (write) {
+ memcpy(data + offset, buf + i, cnt);
+ ret = sgx_encl_debug_write(encl, entry, align, data);
+ if (ret)
+ goto out;
+ } else {
+ memcpy(buf + i, data + offset, cnt);
+ }
+
+out:
+ mutex_unlock(&encl->lock);
+
+ if (ret)
+ break;
+ }
+
+ return ret < 0 ? ret : i;
+}
+
const struct vm_operations_struct sgx_vm_ops = {
.open = sgx_vma_open,
.fault = sgx_vma_fault,
.mprotect = sgx_vma_mprotect,
+ .access = sgx_vma_access,
};
/**
--
2.25.1
From: Sean Christopherson <[email protected]>
vDSO functions can now leverage an exception fixup mechanism similar to
kernel exception fixup. For vDSO exception fixup, the initial user is
Intel's Software Guard Extensions (SGX), which will wrap the low-level
transitions to/from the enclave, i.e. EENTER and ERESUME instructions,
in a vDSO function and leverage fixup to intercept exceptions that would
otherwise generate a signal. This allows the vDSO wrapper to return the
fault information directly to its caller, obviating the need for SGX
applications and libraries to juggle signal handlers.
Attempt to fixup vDSO exceptions immediately prior to populating and
sending signal information. Except for the delivery mechanism, an
exception in a vDSO function should be treated like any other exception
in userspace, e.g. any fault that is successfully handled by the kernel
should not be directly visible to userspace.
Although it's debatable whether or not all exceptions are of interest to
enclaves, defer to the vDSO fixup to decide whether to do fixup or
generate a signal. Future users of vDSO fixup, if there ever are any,
will undoubtedly have different requirements than SGX enclaves, e.g. the
fixup vs. signal logic can be made function specific if/when necessary.
Suggested-by: Andy Lutomirski <[email protected]>
Acked-by: Jethro Beekman <[email protected]>
Signed-off-by: Sean Christopherson <[email protected]>
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
arch/x86/kernel/traps.c | 10 ++++++++++
arch/x86/mm/fault.c | 7 +++++++
2 files changed, 17 insertions(+)
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index e2c6fd4dde8e..13dbc59c6bc5 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -60,6 +60,7 @@
#include <asm/umip.h>
#include <asm/insn.h>
#include <asm/insn-eval.h>
+#include <asm/vdso.h>
#ifdef CONFIG_X86_64
#include <asm/x86_init.h>
@@ -117,6 +118,9 @@ do_trap_no_signal(struct task_struct *tsk, int trapnr, const char *str,
tsk->thread.error_code = error_code;
tsk->thread.trap_nr = trapnr;
die(str, regs, error_code);
+ } else {
+ if (fixup_vdso_exception(regs, trapnr, error_code, 0))
+ return 0;
}
/*
@@ -550,6 +554,9 @@ DEFINE_IDTENTRY_ERRORCODE(exc_general_protection)
tsk->thread.error_code = error_code;
tsk->thread.trap_nr = X86_TRAP_GP;
+ if (fixup_vdso_exception(regs, X86_TRAP_GP, error_code, 0))
+ return;
+
show_signal(tsk, SIGSEGV, "", desc, regs, error_code);
force_sig(SIGSEGV);
goto exit;
@@ -1031,6 +1038,9 @@ static void math_error(struct pt_regs *regs, int trapnr)
if (!si_code)
goto exit;
+ if (fixup_vdso_exception(regs, trapnr, 0, 0))
+ return;
+
force_sig_fault(SIGFPE, si_code,
(void __user *)uprobe_get_trap_addr(regs));
exit:
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 24ab833ede41..bda67aba6553 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -30,6 +30,7 @@
#include <asm/cpu_entry_area.h> /* exception stack */
#include <asm/pgtable_areas.h> /* VMALLOC_START, ... */
#include <asm/kvm_para.h> /* kvm_handle_async_pf */
+#include <asm/vdso.h> /* fixup_vdso_exception() */
#define CREATE_TRACE_POINTS
#include <asm/trace/exceptions.h>
@@ -822,6 +823,9 @@ __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,
sanitize_error_code(address, &error_code);
+ if (fixup_vdso_exception(regs, X86_TRAP_PF, error_code, address))
+ return;
+
if (likely(show_unhandled_signals))
show_signal_msg(regs, error_code, address, tsk);
@@ -941,6 +945,9 @@ do_sigbus(struct pt_regs *regs, unsigned long error_code, unsigned long address,
sanitize_error_code(address, &error_code);
+ if (fixup_vdso_exception(regs, X86_TRAP_PF, error_code, address))
+ return;
+
set_signal_archinfo(address, error_code);
#ifdef CONFIG_MEMORY_FAILURE
--
2.25.1
From: Sean Christopherson <[email protected]>
The basic concept and implementation is very similar to the kernel's
exception fixup mechanism. The key differences are that the kernel
handler is hardcoded and the fixup entry addresses are relative to
the overall table as opposed to individual entries.
Hardcoding the kernel handler avoids the need to figure out how to
get userspace code to point at a kernel function. Given that the
expected usage is to propagate information to userspace, dumping all
fault information into registers is likely the desired behavior for
the vast majority of yet-to-be-created functions. Use registers
DI, SI and DX to communicate fault information, which follows Linux's
ABI for register consumption and hopefully avoids conflict with
hardware features that might leverage the fixup capabilities, e.g.
register usage for SGX instructions was at least partially designed
with calling conventions in mind.
Making fixup addresses relative to the overall table allows the table
to be stripped from the final vDSO image (it's a kernel construct)
without complicating the offset logic, e.g. entry-relative addressing
would also need to account for the table's location relative to the
image.
Regarding stripping the table, modify vdso2c to extract the table from
the raw, a.k.a. unstripped, data and dump it as a standalone byte array
in the resulting .c file. The original base of the table, its length
and a pointer to the byte array are captured in struct vdso_image.
Alternatively, the table could be dumped directly into the struct,
but because the number of entries can vary per image, that would
require either hardcoding a max sized table into the struct definition
or defining the table as a flexible length array. The flexible length
array approach has zero benefits, e.g. the base/size are still needed,
and prevents reusing the extraction code, while hardcoding the max size
adds ongoing maintenance just to avoid exporting the explicit size.
The immediate use case is for Intel Software Guard Extensions (SGX).
SGX introduces a new CPL3-only "enclave" mode that runs as a sort of
black box shared object that is hosted by an untrusted "normal" CPl3
process.
Entering an enclave can only be done through SGX-specific instructions,
EENTER and ERESUME, and is a non-trivial process. Because of the
complexity of transitioning to/from an enclave, the vast majority of
enclaves are expected to utilize a library to handle the actual
transitions. This is roughly analogous to how e.g. libc implementations
are used by most applications.
Another crucial characteristic of SGX enclaves is that they can generate
exceptions as part of their normal (at least as "normal" as SGX can be)
operation that need to be handled *in* the enclave and/or are unique
to SGX.
And because they are essentially fancy shared objects, a process can
host any number of enclaves, each of which can execute multiple threads
simultaneously.
Putting everything together, userspace enclaves will utilize a library
that must be prepared to handle any and (almost) all exceptions any time
at least one thread may be executing in an enclave. Leveraging signals
to handle the enclave exceptions is unpleasant, to put it mildly, e.g.
the SGX library must constantly (un)register its signal handler based
on whether or not at least one thread is executing in an enclave, and
filter and forward exceptions that aren't related to its enclaves. This
becomes particularly nasty when using multiple levels of libraries that
register signal handlers, e.g. running an enclave via cgo inside of the
Go runtime.
Enabling exception fixup in vDSO allows the kernel to provide a vDSO
function that wraps the low-level transitions to/from the enclave, i.e.
the EENTER and ERESUME instructions. The vDSO function can intercept
exceptions that would otherwise generate a signal and return the fault
information directly to its caller, thus avoiding the need to juggle
signal handlers.
Note that unlike the kernel's _ASM_EXTABLE_HANDLE implementation, the
'C' version of _ASM_VDSO_EXTABLE_HANDLE doesn't use a pre-compiled
assembly macro. Duplicating four lines of code is simpler than adding
the necessary infrastructure to generate pre-compiled assembly and the
intended benefit of massaging GCC's inlining algorithm is unlikely to
realized in the vDSO any time soon, if ever.
Suggested-by: Andy Lutomirski <[email protected]>
Acked-by: Jethro Beekman <[email protected]>
Signed-off-by: Sean Christopherson <[email protected]>
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
arch/x86/entry/vdso/Makefile | 6 ++--
arch/x86/entry/vdso/extable.c | 46 ++++++++++++++++++++++++
arch/x86/entry/vdso/extable.h | 28 +++++++++++++++
arch/x86/entry/vdso/vdso-layout.lds.S | 9 ++++-
arch/x86/entry/vdso/vdso2c.h | 50 ++++++++++++++++++++++++++-
arch/x86/include/asm/vdso.h | 5 +++
6 files changed, 139 insertions(+), 5 deletions(-)
create mode 100644 arch/x86/entry/vdso/extable.c
create mode 100644 arch/x86/entry/vdso/extable.h
diff --git a/arch/x86/entry/vdso/Makefile b/arch/x86/entry/vdso/Makefile
index 215376d975a2..3f183d0b8826 100644
--- a/arch/x86/entry/vdso/Makefile
+++ b/arch/x86/entry/vdso/Makefile
@@ -31,7 +31,7 @@ vobjs32-y := vdso32/note.o vdso32/system_call.o vdso32/sigreturn.o
vobjs32-y += vdso32/vclock_gettime.o
# files to link into kernel
-obj-y += vma.o
+obj-y += vma.o extable.o
KASAN_SANITIZE_vma.o := y
UBSAN_SANITIZE_vma.o := y
KCSAN_SANITIZE_vma.o := y
@@ -130,8 +130,8 @@ $(obj)/%-x32.o: $(obj)/%.o FORCE
targets += vdsox32.lds $(vobjx32s-y)
-$(obj)/%.so: OBJCOPYFLAGS := -S
-$(obj)/%.so: $(obj)/%.so.dbg FORCE
+$(obj)/%.so: OBJCOPYFLAGS := -S --remove-section __ex_table
+$(obj)/%.so: $(obj)/%.so.dbg
$(call if_changed,objcopy)
$(obj)/vdsox32.so.dbg: $(obj)/vdsox32.lds $(vobjx32s) FORCE
diff --git a/arch/x86/entry/vdso/extable.c b/arch/x86/entry/vdso/extable.c
new file mode 100644
index 000000000000..afcf5b65beef
--- /dev/null
+++ b/arch/x86/entry/vdso/extable.c
@@ -0,0 +1,46 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <linux/err.h>
+#include <linux/mm.h>
+#include <asm/current.h>
+#include <asm/traps.h>
+#include <asm/vdso.h>
+
+struct vdso_exception_table_entry {
+ int insn, fixup;
+};
+
+bool fixup_vdso_exception(struct pt_regs *regs, int trapnr,
+ unsigned long error_code, unsigned long fault_addr)
+{
+ const struct vdso_image *image = current->mm->context.vdso_image;
+ const struct vdso_exception_table_entry *extable;
+ unsigned int nr_entries, i;
+ unsigned long base;
+
+ /*
+ * Do not attempt to fixup #DB or #BP. It's impossible to identify
+ * whether or not a #DB/#BP originated from within an SGX enclave and
+ * SGX enclaves are currently the only use case for vDSO fixup.
+ */
+ if (trapnr == X86_TRAP_DB || trapnr == X86_TRAP_BP)
+ return false;
+
+ if (!current->mm->context.vdso)
+ return false;
+
+ base = (unsigned long)current->mm->context.vdso + image->extable_base;
+ nr_entries = image->extable_len / (sizeof(*extable));
+ extable = image->extable;
+
+ for (i = 0; i < nr_entries; i++) {
+ if (regs->ip == base + extable[i].insn) {
+ regs->ip = base + extable[i].fixup;
+ regs->di = trapnr;
+ regs->si = error_code;
+ regs->dx = fault_addr;
+ return true;
+ }
+ }
+
+ return false;
+}
diff --git a/arch/x86/entry/vdso/extable.h b/arch/x86/entry/vdso/extable.h
new file mode 100644
index 000000000000..b56f6b012941
--- /dev/null
+++ b/arch/x86/entry/vdso/extable.h
@@ -0,0 +1,28 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef __VDSO_EXTABLE_H
+#define __VDSO_EXTABLE_H
+
+/*
+ * Inject exception fixup for vDSO code. Unlike normal exception fixup,
+ * vDSO uses a dedicated handler the addresses are relative to the overall
+ * exception table, not each individual entry.
+ */
+#ifdef __ASSEMBLY__
+#define _ASM_VDSO_EXTABLE_HANDLE(from, to) \
+ ASM_VDSO_EXTABLE_HANDLE from to
+
+.macro ASM_VDSO_EXTABLE_HANDLE from:req to:req
+ .pushsection __ex_table, "a"
+ .long (\from) - __ex_table
+ .long (\to) - __ex_table
+ .popsection
+.endm
+#else
+#define _ASM_VDSO_EXTABLE_HANDLE(from, to) \
+ ".pushsection __ex_table, \"a\"\n" \
+ ".long (" #from ") - __ex_table\n" \
+ ".long (" #to ") - __ex_table\n" \
+ ".popsection\n"
+#endif
+
+#endif /* __VDSO_EXTABLE_H */
diff --git a/arch/x86/entry/vdso/vdso-layout.lds.S b/arch/x86/entry/vdso/vdso-layout.lds.S
index 4d152933547d..dc8da7695859 100644
--- a/arch/x86/entry/vdso/vdso-layout.lds.S
+++ b/arch/x86/entry/vdso/vdso-layout.lds.S
@@ -75,11 +75,18 @@ SECTIONS
* stuff that isn't used at runtime in between.
*/
- .text : { *(.text*) } :text =0x90909090,
+ .text : {
+ *(.text*)
+ *(.fixup)
+ } :text =0x90909090,
+
+
.altinstructions : { *(.altinstructions) } :text
.altinstr_replacement : { *(.altinstr_replacement) } :text
+ __ex_table : { *(__ex_table) } :text
+
/DISCARD/ : {
*(.discard)
*(.discard.*)
diff --git a/arch/x86/entry/vdso/vdso2c.h b/arch/x86/entry/vdso/vdso2c.h
index 6f46e11ce539..1c7cfac7e64a 100644
--- a/arch/x86/entry/vdso/vdso2c.h
+++ b/arch/x86/entry/vdso/vdso2c.h
@@ -5,6 +5,41 @@
* are built for 32-bit userspace.
*/
+static void BITSFUNC(copy)(FILE *outfile, const unsigned char *data, size_t len)
+{
+ size_t i;
+
+ for (i = 0; i < len; i++) {
+ if (i % 10 == 0)
+ fprintf(outfile, "\n\t");
+ fprintf(outfile, "0x%02X, ", (int)(data)[i]);
+ }
+}
+
+
+/*
+ * Extract a section from the input data into a standalone blob. Used to
+ * capture kernel-only data that needs to persist indefinitely, e.g. the
+ * exception fixup tables, but only in the kernel, i.e. the section can
+ * be stripped from the final vDSO image.
+ */
+static void BITSFUNC(extract)(const unsigned char *data, size_t data_len,
+ FILE *outfile, ELF(Shdr) *sec, const char *name)
+{
+ unsigned long offset;
+ size_t len;
+
+ offset = (unsigned long)GET_LE(&sec->sh_offset);
+ len = (size_t)GET_LE(&sec->sh_size);
+
+ if (offset + len > data_len)
+ fail("section to extract overruns input data");
+
+ fprintf(outfile, "static const unsigned char %s[%lu] = {", name, len);
+ BITSFUNC(copy)(outfile, data + offset, len);
+ fprintf(outfile, "\n};\n\n");
+}
+
static void BITSFUNC(go)(void *raw_addr, size_t raw_len,
void *stripped_addr, size_t stripped_len,
FILE *outfile, const char *image_name)
@@ -15,7 +50,7 @@ static void BITSFUNC(go)(void *raw_addr, size_t raw_len,
ELF(Ehdr) *hdr = (ELF(Ehdr) *)raw_addr;
unsigned long i, syms_nr;
ELF(Shdr) *symtab_hdr = NULL, *strtab_hdr, *secstrings_hdr,
- *alt_sec = NULL;
+ *alt_sec = NULL, *extable_sec = NULL;
ELF(Dyn) *dyn = 0, *dyn_end = 0;
const char *secstrings;
INT_BITS syms[NSYMS] = {};
@@ -77,6 +112,8 @@ static void BITSFUNC(go)(void *raw_addr, size_t raw_len,
if (!strcmp(secstrings + GET_LE(&sh->sh_name),
".altinstructions"))
alt_sec = sh;
+ if (!strcmp(secstrings + GET_LE(&sh->sh_name), "__ex_table"))
+ extable_sec = sh;
}
if (!symtab_hdr)
@@ -155,6 +192,9 @@ static void BITSFUNC(go)(void *raw_addr, size_t raw_len,
(int)((unsigned char *)stripped_addr)[i]);
}
fprintf(outfile, "\n};\n\n");
+ if (extable_sec)
+ BITSFUNC(extract)(raw_addr, raw_len, outfile,
+ extable_sec, "extable");
fprintf(outfile, "const struct vdso_image %s = {\n", image_name);
fprintf(outfile, "\t.data = raw_data,\n");
@@ -165,6 +205,14 @@ static void BITSFUNC(go)(void *raw_addr, size_t raw_len,
fprintf(outfile, "\t.alt_len = %lu,\n",
(unsigned long)GET_LE(&alt_sec->sh_size));
}
+ if (extable_sec) {
+ fprintf(outfile, "\t.extable_base = %lu,\n",
+ (unsigned long)GET_LE(&extable_sec->sh_offset));
+ fprintf(outfile, "\t.extable_len = %lu,\n",
+ (unsigned long)GET_LE(&extable_sec->sh_size));
+ fprintf(outfile, "\t.extable = extable,\n");
+ }
+
for (i = 0; i < NSYMS; i++) {
if (required_syms[i].export && syms[i])
fprintf(outfile, "\t.sym_%s = %" PRIi64 ",\n",
diff --git a/arch/x86/include/asm/vdso.h b/arch/x86/include/asm/vdso.h
index bbcdc7b8f963..b5d23470f56b 100644
--- a/arch/x86/include/asm/vdso.h
+++ b/arch/x86/include/asm/vdso.h
@@ -15,6 +15,8 @@ struct vdso_image {
unsigned long size; /* Always a multiple of PAGE_SIZE */
unsigned long alt, alt_len;
+ unsigned long extable_base, extable_len;
+ const void *extable;
long sym_vvar_start; /* Negative offset to the vvar area */
@@ -45,6 +47,9 @@ extern void __init init_vdso_image(const struct vdso_image *image);
extern int map_vdso_once(const struct vdso_image *image, unsigned long addr);
+extern bool fixup_vdso_exception(struct pt_regs *regs, int trapnr,
+ unsigned long error_code,
+ unsigned long fault_addr);
#endif /* __ASSEMBLER__ */
#endif /* _ASM_X86_VDSO_H */
--
2.25.1
Add __sgx_alloc_epc_page(), which iterates through EPC sections and borrows
a page structure that is not used by anyone else. When a page is no longer
needed it must be released with sgx_free_epc_page(). This function
implicitly calls ENCLS[EREMOVE], which will return the page to the
uninitialized state (i.e. not required from caller part).
Acked-by: Jethro Beekman <[email protected]>
Reviewed-by: Darren Kenny <[email protected]>
Co-developed-by: Sean Christopherson <[email protected]>
Signed-off-by: Sean Christopherson <[email protected]>
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
arch/x86/kernel/cpu/sgx/main.c | 62 ++++++++++++++++++++++++++++++++++
arch/x86/kernel/cpu/sgx/sgx.h | 3 ++
2 files changed, 65 insertions(+)
diff --git a/arch/x86/kernel/cpu/sgx/main.c b/arch/x86/kernel/cpu/sgx/main.c
index c5831e3db14a..97c6895fb6c9 100644
--- a/arch/x86/kernel/cpu/sgx/main.c
+++ b/arch/x86/kernel/cpu/sgx/main.c
@@ -83,6 +83,68 @@ static bool __init sgx_page_reclaimer_init(void)
return true;
}
+static struct sgx_epc_page *__sgx_alloc_epc_page_from_section(struct sgx_epc_section *section)
+{
+ struct sgx_epc_page *page;
+
+ if (list_empty(§ion->page_list))
+ return NULL;
+
+ page = list_first_entry(§ion->page_list, struct sgx_epc_page, list);
+ list_del_init(&page->list);
+
+ return page;
+}
+
+/**
+ * __sgx_alloc_epc_page() - Allocate an EPC page
+ *
+ * Iterate through EPC sections and borrow a free EPC page to the caller. When a
+ * page is no longer needed it must be released with sgx_free_epc_page().
+ *
+ * Return:
+ * an EPC page,
+ * -errno on error
+ */
+struct sgx_epc_page *__sgx_alloc_epc_page(void)
+{
+ struct sgx_epc_section *section;
+ struct sgx_epc_page *page;
+ int i;
+
+ for (i = 0; i < sgx_nr_epc_sections; i++) {
+ section = &sgx_epc_sections[i];
+ spin_lock(§ion->lock);
+ page = __sgx_alloc_epc_page_from_section(section);
+ spin_unlock(§ion->lock);
+
+ if (page)
+ return page;
+ }
+
+ return ERR_PTR(-ENOMEM);
+}
+
+/**
+ * sgx_free_epc_page() - Free an EPC page
+ * @page: an EPC page
+ *
+ * Call EREMOVE for an EPC page and insert it back to the list of free pages.
+ */
+void sgx_free_epc_page(struct sgx_epc_page *page)
+{
+ struct sgx_epc_section *section = sgx_get_epc_section(page);
+ int ret;
+
+ ret = __eremove(sgx_get_epc_addr(page));
+ if (WARN_ONCE(ret, "EREMOVE returned %d (0x%x)", ret, ret))
+ return;
+
+ spin_lock(§ion->lock);
+ list_add_tail(&page->list, §ion->page_list);
+ spin_unlock(§ion->lock);
+}
+
static void __init sgx_free_epc_section(struct sgx_epc_section *section)
{
struct sgx_epc_page *page;
diff --git a/arch/x86/kernel/cpu/sgx/sgx.h b/arch/x86/kernel/cpu/sgx/sgx.h
index dff4f5f16d09..fce756c3434b 100644
--- a/arch/x86/kernel/cpu/sgx/sgx.h
+++ b/arch/x86/kernel/cpu/sgx/sgx.h
@@ -49,4 +49,7 @@ static inline void *sgx_get_epc_addr(struct sgx_epc_page *page)
return section->va + (page->desc & PAGE_MASK) - section->pa;
}
+struct sgx_epc_page *__sgx_alloc_epc_page(void);
+void sgx_free_epc_page(struct sgx_epc_page *page);
+
#endif /* _X86_SGX_H */
--
2.25.1
Provisioning Certification Enclave (PCE), the root of trust for other
enclaves, generates a signing key from a fused key called Provisioning
Certification Key. PCE can then use this key to certify an attestation key
of a Quoting Enclave (QE), e.g. we get the chain of trust down to the
hardware if the Intel signed PCE is used.
To use the needed keys, ATTRIBUTE.PROVISIONKEY is required but should be
only allowed for those who actually need it so that only the trusted
parties can certify QE's.
Obviously the attestation service should know the public key of the used
PCE and that way detect illegit attestation, but whitelisting the legit
users still adds an additional layer of defence.
Add new device file called /dev/sgx/provision. The sole purpose of this
file is to provide file descriptors that act as privilege tokens to allow
to build enclaves with ATTRIBUTE.PROVISIONKEY set. A new ioctl called
SGX_IOC_ENCLAVE_PROVISION is used to assign this token to an enclave.
Cc: [email protected]
Acked-by: Jethro Beekman <[email protected]>
Reviewed-by: Darren Kenny <[email protected]>
Suggested-by: Andy Lutomirski <[email protected]>
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
arch/x86/include/uapi/asm/sgx.h | 11 ++++++++
arch/x86/kernel/cpu/sgx/driver.c | 18 +++++++++++++
arch/x86/kernel/cpu/sgx/driver.h | 2 ++
arch/x86/kernel/cpu/sgx/ioctl.c | 46 ++++++++++++++++++++++++++++++++
4 files changed, 77 insertions(+)
diff --git a/arch/x86/include/uapi/asm/sgx.h b/arch/x86/include/uapi/asm/sgx.h
index e401fa72eaab..b6ba036a9b82 100644
--- a/arch/x86/include/uapi/asm/sgx.h
+++ b/arch/x86/include/uapi/asm/sgx.h
@@ -25,6 +25,8 @@ enum sgx_page_flags {
_IOWR(SGX_MAGIC, 0x01, struct sgx_enclave_add_pages)
#define SGX_IOC_ENCLAVE_INIT \
_IOW(SGX_MAGIC, 0x02, struct sgx_enclave_init)
+#define SGX_IOC_ENCLAVE_PROVISION \
+ _IOW(SGX_MAGIC, 0x03, struct sgx_enclave_provision)
/**
* struct sgx_enclave_create - parameter structure for the
@@ -63,4 +65,13 @@ struct sgx_enclave_init {
__u64 sigstruct;
};
+/**
+ * struct sgx_enclave_provision - parameter structure for the
+ * %SGX_IOC_ENCLAVE_PROVISION ioctl
+ * @attribute_fd: file handle of the attribute file in the securityfs
+ */
+struct sgx_enclave_provision {
+ __u64 attribute_fd;
+};
+
#endif /* _UAPI_ASM_X86_SGX_H */
diff --git a/arch/x86/kernel/cpu/sgx/driver.c b/arch/x86/kernel/cpu/sgx/driver.c
index 7bdb49dfcca6..d01b28f7ce4a 100644
--- a/arch/x86/kernel/cpu/sgx/driver.c
+++ b/arch/x86/kernel/cpu/sgx/driver.c
@@ -134,6 +134,10 @@ static const struct file_operations sgx_encl_fops = {
.get_unmapped_area = sgx_get_unmapped_area,
};
+const struct file_operations sgx_provision_fops = {
+ .owner = THIS_MODULE,
+};
+
static struct miscdevice sgx_dev_enclave = {
.minor = MISC_DYNAMIC_MINOR,
.name = "enclave",
@@ -141,6 +145,13 @@ static struct miscdevice sgx_dev_enclave = {
.fops = &sgx_encl_fops,
};
+static struct miscdevice sgx_dev_provision = {
+ .minor = MISC_DYNAMIC_MINOR,
+ .name = "provision",
+ .nodename = "sgx/provision",
+ .fops = &sgx_provision_fops,
+};
+
int __init sgx_drv_init(void)
{
unsigned int eax, ebx, ecx, edx;
@@ -181,5 +192,12 @@ int __init sgx_drv_init(void)
return ret;
}
+ ret = misc_register(&sgx_dev_provision);
+ if (ret) {
+ pr_err("Creating /dev/sgx/provision failed with %d.\n", ret);
+ misc_deregister(&sgx_dev_enclave);
+ return ret;
+ }
+
return 0;
}
diff --git a/arch/x86/kernel/cpu/sgx/driver.h b/arch/x86/kernel/cpu/sgx/driver.h
index e4063923115b..72747d01c046 100644
--- a/arch/x86/kernel/cpu/sgx/driver.h
+++ b/arch/x86/kernel/cpu/sgx/driver.h
@@ -23,6 +23,8 @@ extern u64 sgx_attributes_reserved_mask;
extern u64 sgx_xfrm_reserved_mask;
extern u32 sgx_xsave_size_tbl[64];
+extern const struct file_operations sgx_provision_fops;
+
long sgx_ioctl(struct file *filep, unsigned int cmd, unsigned long arg);
int sgx_drv_init(void);
diff --git a/arch/x86/kernel/cpu/sgx/ioctl.c b/arch/x86/kernel/cpu/sgx/ioctl.c
index cf5a43d6daa2..3c04798e83e5 100644
--- a/arch/x86/kernel/cpu/sgx/ioctl.c
+++ b/arch/x86/kernel/cpu/sgx/ioctl.c
@@ -679,6 +679,49 @@ static long sgx_ioc_enclave_init(struct sgx_encl *encl, void __user *arg)
return ret;
}
+/**
+ * sgx_ioc_enclave_provision - handler for %SGX_IOC_ENCLAVE_PROVISION
+ * @enclave: an enclave pointer
+ * @arg: userspace pointer to a struct sgx_enclave_provision instance
+ *
+ * Mark the enclave as being allowed to access a restricted attribute bit.
+ * The requested attribute is specified via the attribute_fd field in the
+ * provided struct sgx_enclave_provision. The attribute_fd must be a
+ * handle to an SGX attribute file, e.g. "/dev/sgx/provision".
+ *
+ * Failure to explicitly request access to a restricted attribute will cause
+ * sgx_ioc_enclave_init() to fail. Currently, the only restricted attribute
+ * is access to the PROVISION_KEY.
+ *
+ * Note, access to the EINITTOKEN_KEY is disallowed entirely.
+ *
+ * Return: 0 on success, -errno otherwise
+ */
+static long sgx_ioc_enclave_provision(struct sgx_encl *encl, void __user *arg)
+{
+ struct sgx_enclave_provision params;
+ struct file *attribute_file;
+ int ret;
+
+ if (copy_from_user(¶ms, arg, sizeof(params)))
+ return -EFAULT;
+
+ attribute_file = fget(params.attribute_fd);
+ if (!attribute_file)
+ return -EINVAL;
+
+ if (attribute_file->f_op != &sgx_provision_fops) {
+ ret = -EINVAL;
+ goto out;
+ }
+
+ encl->attributes_mask |= SGX_ATTR_PROVISIONKEY;
+ ret = 0;
+
+out:
+ fput(attribute_file);
+ return ret;
+}
long sgx_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
{
@@ -704,6 +747,9 @@ long sgx_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
case SGX_IOC_ENCLAVE_INIT:
ret = sgx_ioc_enclave_init(encl, (void __user *)arg);
break;
+ case SGX_IOC_ENCLAVE_PROVISION:
+ ret = sgx_ioc_enclave_provision(encl, (void __user *)arg);
+ break;
default:
ret = -ENOIOCTLCMD;
break;
--
2.25.1
Add a selftest for SGX. It is a trivial test where a simple enclave
copies one 64-bit word of memory between two memory locations.
Cc: Shuah Khan <[email protected]>
Cc: [email protected]
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
tools/testing/selftests/Makefile | 1 +
tools/testing/selftests/sgx/.gitignore | 2 +
tools/testing/selftests/sgx/Makefile | 53 +++
tools/testing/selftests/sgx/call.S | 44 ++
tools/testing/selftests/sgx/defines.h | 21 +
tools/testing/selftests/sgx/load.c | 277 ++++++++++++
tools/testing/selftests/sgx/main.c | 243 +++++++++++
tools/testing/selftests/sgx/main.h | 38 ++
tools/testing/selftests/sgx/sigstruct.c | 395 ++++++++++++++++++
tools/testing/selftests/sgx/test_encl.c | 20 +
tools/testing/selftests/sgx/test_encl.lds | 40 ++
.../selftests/sgx/test_encl_bootstrap.S | 89 ++++
12 files changed, 1223 insertions(+)
create mode 100644 tools/testing/selftests/sgx/.gitignore
create mode 100644 tools/testing/selftests/sgx/Makefile
create mode 100644 tools/testing/selftests/sgx/call.S
create mode 100644 tools/testing/selftests/sgx/defines.h
create mode 100644 tools/testing/selftests/sgx/load.c
create mode 100644 tools/testing/selftests/sgx/main.c
create mode 100644 tools/testing/selftests/sgx/main.h
create mode 100644 tools/testing/selftests/sgx/sigstruct.c
create mode 100644 tools/testing/selftests/sgx/test_encl.c
create mode 100644 tools/testing/selftests/sgx/test_encl.lds
create mode 100644 tools/testing/selftests/sgx/test_encl_bootstrap.S
diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
index 9018f45d631d..fee80cda6304 100644
--- a/tools/testing/selftests/Makefile
+++ b/tools/testing/selftests/Makefile
@@ -68,6 +68,7 @@ TARGETS += user
TARGETS += vm
TARGETS += x86
TARGETS += zram
+TARGETS += sgx
#Please keep the TARGETS list alphabetically sorted
# Run "make quicktest=1 run_tests" or
# "make quicktest=1 kselftest" from top level Makefile
diff --git a/tools/testing/selftests/sgx/.gitignore b/tools/testing/selftests/sgx/.gitignore
new file mode 100644
index 000000000000..fbaf0bda9a92
--- /dev/null
+++ b/tools/testing/selftests/sgx/.gitignore
@@ -0,0 +1,2 @@
+test_sgx
+test_encl.elf
diff --git a/tools/testing/selftests/sgx/Makefile b/tools/testing/selftests/sgx/Makefile
new file mode 100644
index 000000000000..95e5c4df8014
--- /dev/null
+++ b/tools/testing/selftests/sgx/Makefile
@@ -0,0 +1,53 @@
+top_srcdir = ../../../..
+
+include ../lib.mk
+
+.PHONY: all clean
+
+CAN_BUILD_X86_64 := $(shell ../x86/check_cc.sh $(CC) \
+ ../x86/trivial_64bit_program.c)
+
+ifndef OBJCOPY
+OBJCOPY := $(CROSS_COMPILE)objcopy
+endif
+
+INCLUDES := -I$(top_srcdir)/tools/include
+HOST_CFLAGS := -Wall -Werror -g $(INCLUDES) -fPIC -z noexecstack
+ENCL_CFLAGS := -Wall -Werror -static -nostdlib -nostartfiles -fPIC \
+ -fno-stack-protector -mrdrnd $(INCLUDES)
+
+TEST_CUSTOM_PROGS := $(OUTPUT)/test_sgx $(OUTPUT)/test_encl.elf
+
+ifeq ($(CAN_BUILD_X86_64), 1)
+all: $(TEST_CUSTOM_PROGS)
+endif
+
+$(OUTPUT)/test_sgx: $(OUTPUT)/main.o \
+ $(OUTPUT)/load.o \
+ $(OUTPUT)/sigstruct.o \
+ $(OUTPUT)/call.o
+ $(CC) $(HOST_CFLAGS) -o $@ $^ -lcrypto
+
+$(OUTPUT)/main.o: main.c
+ $(CC) $(HOST_CFLAGS) -c $< -o $@
+
+$(OUTPUT)/load.o: load.c
+ $(CC) $(HOST_CFLAGS) -c $< -o $@
+
+$(OUTPUT)/sigstruct.o: sigstruct.c
+ $(CC) $(HOST_CFLAGS) -c $< -o $@
+
+$(OUTPUT)/call.o: call.S
+ $(CC) $(HOST_CFLAGS) -c $< -o $@
+
+$(OUTPUT)/test_encl.elf: test_encl.lds test_encl.c test_encl_bootstrap.S
+ $(CC) $(ENCL_CFLAGS) -T $^ -o $@
+
+EXTRA_CLEAN := \
+ $(OUTPUT)/test_encl.elf \
+ $(OUTPUT)/load.o \
+ $(OUTPUT)/call.o \
+ $(OUTPUT)/main.o \
+ $(OUTPUT)/sigstruct.o \
+ $(OUTPUT)/test_sgx \
+ $(OUTPUT)/test_sgx.o \
diff --git a/tools/testing/selftests/sgx/call.S b/tools/testing/selftests/sgx/call.S
new file mode 100644
index 000000000000..f640532cda93
--- /dev/null
+++ b/tools/testing/selftests/sgx/call.S
@@ -0,0 +1,44 @@
+/* SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause) */
+/**
+* Copyright(c) 2016-18 Intel Corporation.
+*/
+
+ .text
+
+ .global sgx_call_vdso
+sgx_call_vdso:
+ .cfi_startproc
+ push %r15
+ .cfi_adjust_cfa_offset 8
+ .cfi_rel_offset %r15, 0
+ push %r14
+ .cfi_adjust_cfa_offset 8
+ .cfi_rel_offset %r14, 0
+ push %r13
+ .cfi_adjust_cfa_offset 8
+ .cfi_rel_offset %r13, 0
+ push %r12
+ .cfi_adjust_cfa_offset 8
+ .cfi_rel_offset %r12, 0
+ push %rbx
+ .cfi_adjust_cfa_offset 8
+ .cfi_rel_offset %rbx, 0
+ push $0
+ .cfi_adjust_cfa_offset 8
+ push 0x38(%rsp)
+ .cfi_adjust_cfa_offset 8
+ call *eenter(%rip)
+ add $0x10, %rsp
+ .cfi_adjust_cfa_offset -0x10
+ pop %rbx
+ .cfi_adjust_cfa_offset -8
+ pop %r12
+ .cfi_adjust_cfa_offset -8
+ pop %r13
+ .cfi_adjust_cfa_offset -8
+ pop %r14
+ .cfi_adjust_cfa_offset -8
+ pop %r15
+ .cfi_adjust_cfa_offset -8
+ ret
+ .cfi_endproc
diff --git a/tools/testing/selftests/sgx/defines.h b/tools/testing/selftests/sgx/defines.h
new file mode 100644
index 000000000000..be8969922804
--- /dev/null
+++ b/tools/testing/selftests/sgx/defines.h
@@ -0,0 +1,21 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright(c) 2016-19 Intel Corporation.
+ */
+
+#ifndef DEFINES_H
+#define DEFINES_H
+
+#include <stdint.h>
+
+#define PAGE_SIZE 4096
+#define PAGE_MASK (~(PAGE_SIZE - 1))
+
+#define __aligned(x) __attribute__((__aligned__(x)))
+#define __packed __attribute__((packed))
+
+#include "../../../../arch/x86/kernel/cpu/sgx/arch.h"
+#include "../../../../arch/x86/include/asm/enclu.h"
+#include "../../../../arch/x86/include/uapi/asm/sgx.h"
+
+#endif /* DEFINES_H */
diff --git a/tools/testing/selftests/sgx/load.c b/tools/testing/selftests/sgx/load.c
new file mode 100644
index 000000000000..8ce0c4ac9a49
--- /dev/null
+++ b/tools/testing/selftests/sgx/load.c
@@ -0,0 +1,277 @@
+// SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause)
+// Copyright(c) 2016-18 Intel Corporation.
+
+#include <assert.h>
+#include <elf.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/ioctl.h>
+#include <sys/mman.h>
+#include <sys/stat.h>
+#include <sys/time.h>
+#include <sys/types.h>
+#include "defines.h"
+#include "main.h"
+
+void encl_delete(struct encl *encl)
+{
+ if (encl->encl_base)
+ munmap((void *)encl->encl_base, encl->encl_size);
+
+ if (encl->bin)
+ munmap(encl->bin, encl->bin_size);
+
+ if (encl->fd)
+ close(encl->fd);
+
+ if (encl->segment_tbl)
+ free(encl->segment_tbl);
+
+ memset(encl, 0, sizeof(*encl));
+}
+
+static bool encl_map_bin(const char *path, struct encl *encl)
+{
+ struct stat sb;
+ void *bin;
+ int ret;
+ int fd;
+
+ fd = open(path, O_RDONLY);
+ if (fd == -1) {
+ perror("open()");
+ return false;
+ }
+
+ ret = stat(path, &sb);
+ if (ret) {
+ perror("stat()");
+ goto err;
+ }
+
+ bin = mmap(NULL, sb.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
+ if (bin == MAP_FAILED) {
+ perror("mmap()");
+ goto err;
+ }
+
+ encl->bin = bin;
+ encl->bin_size = sb.st_size;
+
+ close(fd);
+ return true;
+
+err:
+ close(fd);
+ return false;
+}
+
+static bool encl_ioc_create(struct encl *encl)
+{
+ struct sgx_secs *secs = &encl->secs;
+ struct sgx_enclave_create ioc;
+ int rc;
+
+ assert(encl->encl_base != 0);
+
+ memset(secs, 0, sizeof(*secs));
+ secs->ssa_frame_size = 1;
+ secs->attributes = SGX_ATTR_MODE64BIT;
+ secs->xfrm = 3;
+ secs->base = encl->encl_base;
+ secs->size = encl->encl_size;
+
+ ioc.src = (unsigned long)secs;
+ rc = ioctl(encl->fd, SGX_IOC_ENCLAVE_CREATE, &ioc);
+ if (rc) {
+ fprintf(stderr, "SGX_IOC_ENCLAVE_CREATE failed: errno=%d\n",
+ errno);
+ munmap((void *)secs->base, encl->encl_size);
+ return false;
+ }
+
+ return true;
+}
+
+static bool encl_ioc_add_pages(struct encl *encl, struct encl_segment *seg)
+{
+ struct sgx_enclave_add_pages ioc;
+ struct sgx_secinfo secinfo;
+ int rc;
+
+ memset(&secinfo, 0, sizeof(secinfo));
+ secinfo.flags = seg->flags;
+
+ ioc.src = (uint64_t)encl->src + seg->offset;
+ ioc.offset = seg->offset;
+ ioc.length = seg->size;
+ ioc.secinfo = (unsigned long)&secinfo;
+ ioc.flags = SGX_PAGE_MEASURE;
+
+ rc = ioctl(encl->fd, SGX_IOC_ENCLAVE_ADD_PAGES, &ioc);
+ if (rc < 0) {
+ fprintf(stderr, "SGX_IOC_ENCLAVE_ADD_PAGES failed: errno=%d.\n",
+ errno);
+ return false;
+ }
+
+ return true;
+}
+
+bool encl_load(const char *path, struct encl *encl)
+{
+ Elf64_Phdr *phdr_tbl;
+ off_t src_offset;
+ Elf64_Ehdr *ehdr;
+ int i, j;
+ int ret;
+
+ memset(encl, 0, sizeof(*encl));
+
+ ret = open("/dev/sgx/enclave", O_RDWR);
+ if (ret < 0) {
+ fprintf(stderr, "Unable to open /dev/sgx\n");
+ goto err;
+ }
+
+ encl->fd = ret;
+
+ if (!encl_map_bin(path, encl))
+ goto err;
+
+ ehdr = encl->bin;
+ phdr_tbl = encl->bin + ehdr->e_phoff;
+
+ for (i = 0; i < ehdr->e_phnum; i++) {
+ Elf64_Phdr *phdr = &phdr_tbl[i];
+
+ if (phdr->p_type == PT_LOAD)
+ encl->nr_segments++;
+ }
+
+ encl->segment_tbl = calloc(encl->nr_segments,
+ sizeof(struct encl_segment));
+ if (!encl->segment_tbl)
+ goto err;
+
+ for (i = 0, j = 0; i < ehdr->e_phnum; i++) {
+ Elf64_Phdr *phdr = &phdr_tbl[i];
+ unsigned int flags = phdr->p_flags;
+ struct encl_segment *seg;
+
+ if (phdr->p_type != PT_LOAD)
+ continue;
+
+ seg = &encl->segment_tbl[j];
+
+ if (!!(flags & ~(PF_R | PF_W | PF_X))) {
+ fprintf(stderr,
+ "%d has invalid segment flags 0x%02x.\n", i,
+ phdr->p_flags);
+ goto err;
+ }
+
+ if (j == 0 && flags != (PF_R | PF_W)) {
+ fprintf(stderr,
+ "TCS has invalid segment flags 0x%02x.\n",
+ phdr->p_flags);
+ goto err;
+ }
+
+ if (j == 0) {
+ src_offset = (phdr->p_offset & PAGE_MASK) - src_offset;
+
+ seg->prot = PROT_READ | PROT_WRITE;
+ seg->flags = SGX_PAGE_TYPE_TCS << 8;
+ } else {
+ seg->prot = (phdr->p_flags & PF_R) ? PROT_READ : 0;
+ seg->prot |= (phdr->p_flags & PF_W) ? PROT_WRITE : 0;
+ seg->prot |= (phdr->p_flags & PF_X) ? PROT_EXEC : 0;
+ seg->flags = (SGX_PAGE_TYPE_REG << 8) | seg->prot;
+ }
+
+ seg->offset = (phdr->p_offset & PAGE_MASK) - src_offset;
+ seg->size = (phdr->p_filesz + PAGE_SIZE - 1) & PAGE_MASK;
+
+ printf("0x%016lx 0x%016lx 0x%02x\n", seg->offset, seg->size,
+ seg->prot);
+
+ j++;
+ }
+
+ assert(j == encl->nr_segments);
+
+ encl->src = encl->bin + src_offset;
+ encl->src_size = encl->segment_tbl[j - 1].offset +
+ encl->segment_tbl[j - 1].size;
+
+ for (encl->encl_size = 4096; encl->encl_size < encl->src_size; )
+ encl->encl_size <<= 1;
+
+ return true;
+
+err:
+ encl_delete(encl);
+ return false;
+}
+
+static bool encl_map_area(struct encl *encl)
+{
+ size_t encl_size = encl->encl_size;
+ void *area;
+
+ area = mmap(NULL, encl_size * 2, PROT_NONE,
+ MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+ if (area == MAP_FAILED) {
+ perror("mmap");
+ return false;
+ }
+
+ encl->encl_base = ((uint64_t)area + encl_size - 1) & ~(encl_size - 1);
+
+ munmap(area, encl->encl_base - (uint64_t)area);
+ munmap((void *)(encl->encl_base + encl_size),
+ (uint64_t)area + encl_size - encl->encl_base);
+
+ return true;
+}
+
+bool encl_build(struct encl *encl)
+{
+ struct sgx_enclave_init ioc;
+ int ret;
+ int i;
+
+ if (!encl_map_area(encl))
+ return false;
+
+ if (!encl_ioc_create(encl))
+ return false;
+
+ /*
+ * Pages must be added before mapping VMAs because their permissions
+ * cap the VMA permissions.
+ */
+ for (i = 0; i < encl->nr_segments; i++) {
+ struct encl_segment *seg = &encl->segment_tbl[i];
+
+ if (!encl_ioc_add_pages(encl, seg))
+ return false;
+ }
+
+ ioc.sigstruct = (uint64_t)&encl->sigstruct;
+ ret = ioctl(encl->fd, SGX_IOC_ENCLAVE_INIT, &ioc);
+ if (ret) {
+ fprintf(stderr, "SGX_IOC_ENCLAVE_INIT failed: errno=%d\n",
+ errno);
+ return false;
+ }
+
+ return true;
+}
diff --git a/tools/testing/selftests/sgx/main.c b/tools/testing/selftests/sgx/main.c
new file mode 100644
index 000000000000..26e00f176535
--- /dev/null
+++ b/tools/testing/selftests/sgx/main.c
@@ -0,0 +1,243 @@
+// SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause)
+// Copyright(c) 2016-18 Intel Corporation.
+
+#include <elf.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/ioctl.h>
+#include <sys/mman.h>
+#include <sys/stat.h>
+#include <sys/time.h>
+#include <sys/types.h>
+#include "defines.h"
+#include "main.h"
+
+static const uint64_t MAGIC = 0x1122334455667788ULL;
+vdso_sgx_enter_enclave_t eenter;
+
+struct vdso_symtab {
+ Elf64_Sym *elf_symtab;
+ const char *elf_symstrtab;
+ Elf64_Word *elf_hashtab;
+};
+
+static void *vdso_get_base_addr(char *envp[])
+{
+ Elf64_auxv_t *auxv;
+ int i;
+
+ for (i = 0; envp[i]; i++)
+ ;
+
+ auxv = (Elf64_auxv_t *)&envp[i + 1];
+
+ for (i = 0; auxv[i].a_type != AT_NULL; i++) {
+ if (auxv[i].a_type == AT_SYSINFO_EHDR)
+ return (void *)auxv[i].a_un.a_val;
+ }
+
+ return NULL;
+}
+
+static Elf64_Dyn *vdso_get_dyntab(void *addr)
+{
+ Elf64_Ehdr *ehdr = addr;
+ Elf64_Phdr *phdrtab = addr + ehdr->e_phoff;
+ int i;
+
+ for (i = 0; i < ehdr->e_phnum; i++)
+ if (phdrtab[i].p_type == PT_DYNAMIC)
+ return addr + phdrtab[i].p_offset;
+
+ return NULL;
+}
+
+static void *vdso_get_dyn(void *addr, Elf64_Dyn *dyntab, Elf64_Sxword tag)
+{
+ int i;
+
+ for (i = 0; dyntab[i].d_tag != DT_NULL; i++)
+ if (dyntab[i].d_tag == tag)
+ return addr + dyntab[i].d_un.d_ptr;
+
+ return NULL;
+}
+
+static bool vdso_get_symtab(void *addr, struct vdso_symtab *symtab)
+{
+ Elf64_Dyn *dyntab = vdso_get_dyntab(addr);
+
+ symtab->elf_symtab = vdso_get_dyn(addr, dyntab, DT_SYMTAB);
+ if (!symtab->elf_symtab)
+ return false;
+
+ symtab->elf_symstrtab = vdso_get_dyn(addr, dyntab, DT_STRTAB);
+ if (!symtab->elf_symstrtab)
+ return false;
+
+ symtab->elf_hashtab = vdso_get_dyn(addr, dyntab, DT_HASH);
+ if (!symtab->elf_hashtab)
+ return false;
+
+ return true;
+}
+
+static unsigned long elf_sym_hash(const char *name)
+{
+ unsigned long h = 0, high;
+
+ while (*name) {
+ h = (h << 4) + *name++;
+ high = h & 0xf0000000;
+
+ if (high)
+ h ^= high >> 24;
+
+ h &= ~high;
+ }
+
+ return h;
+}
+
+static Elf64_Sym *vdso_symtab_get(struct vdso_symtab *symtab, const char *name)
+{
+ Elf64_Word bucketnum = symtab->elf_hashtab[0];
+ Elf64_Word *buckettab = &symtab->elf_hashtab[2];
+ Elf64_Word *chaintab = &symtab->elf_hashtab[2 + bucketnum];
+ Elf64_Sym *sym;
+ Elf64_Word i;
+
+ for (i = buckettab[elf_sym_hash(name) % bucketnum]; i != STN_UNDEF;
+ i = chaintab[i]) {
+ sym = &symtab->elf_symtab[i];
+ if (!strcmp(name, &symtab->elf_symstrtab[sym->st_name]))
+ return sym;
+ }
+
+ return NULL;
+}
+
+bool report_results(struct sgx_enclave_run *run, int ret, uint64_t result,
+ const char *test)
+{
+ bool valid = true;
+
+ if (ret) {
+ printf("FAIL: %s() returned: %d\n", test, ret);
+ valid = false;
+ }
+
+ if (run->leaf != EEXIT) {
+ printf("FAIL: %s() leaf, expected: %u, got: %u\n", test, EEXIT,
+ run->leaf);
+ valid = false;
+ }
+
+ if (result != MAGIC) {
+ printf("FAIL: %s(), expected: 0x%lx, got: 0x%lx\n", test, MAGIC,
+ result);
+ valid = false;
+ }
+
+ if (run->user_data) {
+ printf("FAIL: %s() user data, expected: 0x0, got: 0x%llx\n",
+ test, run->user_data);
+ valid = false;
+ }
+
+ return valid;
+}
+
+static int user_handler(long rdi, long rsi, long rdx, long ursp, long r8, long r9,
+ struct sgx_enclave_run *run)
+{
+ run->user_data = 0;
+ return 0;
+}
+
+int main(int argc, char *argv[], char *envp[])
+{
+ struct sgx_enclave_run run;
+ struct vdso_symtab symtab;
+ Elf64_Sym *eenter_sym;
+ uint64_t result = 0;
+ struct encl encl;
+ unsigned int i;
+ void *addr;
+ int ret;
+
+ memset(&run, 0, sizeof(run));
+
+ if (!encl_load("test_encl.elf", &encl))
+ goto err;
+
+ if (!encl_measure(&encl))
+ goto err;
+
+ if (!encl_build(&encl))
+ goto err;
+
+ /*
+ * An enclave consumer only must do this.
+ */
+ for (i = 0; i < encl.nr_segments; i++) {
+ struct encl_segment *seg = &encl.segment_tbl[i];
+
+ addr = mmap((void *)encl.encl_base + seg->offset, seg->size,
+ seg->prot, MAP_SHARED | MAP_FIXED, encl.fd, 0);
+ if (addr == MAP_FAILED) {
+ fprintf(stderr, "mmap() failed, errno=%d.\n", errno);
+ exit(1);
+ }
+ }
+
+ memset(&run, 0, sizeof(run));
+ run.tcs = encl.encl_base;
+
+ addr = vdso_get_base_addr(envp);
+ if (!addr)
+ goto err;
+
+ if (!vdso_get_symtab(addr, &symtab))
+ goto err;
+
+ eenter_sym = vdso_symtab_get(&symtab, "__vdso_sgx_enter_enclave");
+ if (!eenter_sym)
+ goto err;
+
+ eenter = addr + eenter_sym->st_value;
+
+ ret = sgx_call_vdso((void *)&MAGIC, &result, 0, EENTER, NULL, NULL, &run);
+ if (!report_results(&run, ret, result, "sgx_call_vdso"))
+ goto err;
+
+
+ /* Invoke the vDSO directly. */
+ result = 0;
+ ret = eenter((unsigned long)&MAGIC, (unsigned long)&result, 0, EENTER,
+ 0, 0, &run);
+ if (!report_results(&run, ret, result, "eenter"))
+ goto err;
+
+ /* And with an exit handler. */
+ run.user_handler = (__u64)user_handler;
+ run.user_data = 0xdeadbeef;
+ ret = eenter((unsigned long)&MAGIC, (unsigned long)&result, 0, EENTER,
+ 0, 0, &run);
+ if (!report_results(&run, ret, result, "user_handler"))
+ goto err;
+
+ printf("SUCCESS\n");
+ encl_delete(&encl);
+ exit(0);
+
+err:
+ encl_delete(&encl);
+ exit(1);
+}
diff --git a/tools/testing/selftests/sgx/main.h b/tools/testing/selftests/sgx/main.h
new file mode 100644
index 000000000000..2b4777942500
--- /dev/null
+++ b/tools/testing/selftests/sgx/main.h
@@ -0,0 +1,38 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright(c) 2016-19 Intel Corporation.
+ */
+
+#ifndef MAIN_H
+#define MAIN_H
+
+struct encl_segment {
+ off_t offset;
+ size_t size;
+ unsigned int prot;
+ unsigned int flags;
+};
+
+struct encl {
+ int fd;
+ void *bin;
+ off_t bin_size;
+ void *src;
+ size_t src_size;
+ size_t encl_size;
+ off_t encl_base;
+ unsigned int nr_segments;
+ struct encl_segment *segment_tbl;
+ struct sgx_secs secs;
+ struct sgx_sigstruct sigstruct;
+};
+
+void encl_delete(struct encl *ctx);
+bool encl_load(const char *path, struct encl *encl);
+bool encl_measure(struct encl *encl);
+bool encl_build(struct encl *encl);
+
+int sgx_call_vdso(void *rdi, void *rsi, long rdx, u32 leaf, void *r8, void *r9,
+ struct sgx_enclave_run *run);
+
+#endif /* MAIN_H */
diff --git a/tools/testing/selftests/sgx/sigstruct.c b/tools/testing/selftests/sgx/sigstruct.c
new file mode 100644
index 000000000000..ceddad478672
--- /dev/null
+++ b/tools/testing/selftests/sgx/sigstruct.c
@@ -0,0 +1,395 @@
+// SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause)
+// Copyright(c) 2016-18 Intel Corporation.
+
+#define _GNU_SOURCE
+#include <assert.h>
+#include <getopt.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <unistd.h>
+#include <openssl/err.h>
+#include <openssl/pem.h>
+#include "defines.h"
+#include "main.h"
+
+struct q1q2_ctx {
+ BN_CTX *bn_ctx;
+ BIGNUM *m;
+ BIGNUM *s;
+ BIGNUM *q1;
+ BIGNUM *qr;
+ BIGNUM *q2;
+};
+
+static void free_q1q2_ctx(struct q1q2_ctx *ctx)
+{
+ BN_CTX_free(ctx->bn_ctx);
+ BN_free(ctx->m);
+ BN_free(ctx->s);
+ BN_free(ctx->q1);
+ BN_free(ctx->qr);
+ BN_free(ctx->q2);
+}
+
+static bool alloc_q1q2_ctx(const uint8_t *s, const uint8_t *m,
+ struct q1q2_ctx *ctx)
+{
+ ctx->bn_ctx = BN_CTX_new();
+ ctx->s = BN_bin2bn(s, SGX_MODULUS_SIZE, NULL);
+ ctx->m = BN_bin2bn(m, SGX_MODULUS_SIZE, NULL);
+ ctx->q1 = BN_new();
+ ctx->qr = BN_new();
+ ctx->q2 = BN_new();
+
+ if (!ctx->bn_ctx || !ctx->s || !ctx->m || !ctx->q1 || !ctx->qr ||
+ !ctx->q2) {
+ free_q1q2_ctx(ctx);
+ return false;
+ }
+
+ return true;
+}
+
+static bool calc_q1q2(const uint8_t *s, const uint8_t *m, uint8_t *q1,
+ uint8_t *q2)
+{
+ struct q1q2_ctx ctx;
+
+ if (!alloc_q1q2_ctx(s, m, &ctx)) {
+ fprintf(stderr, "Not enough memory for Q1Q2 calculation\n");
+ return false;
+ }
+
+ if (!BN_mul(ctx.q1, ctx.s, ctx.s, ctx.bn_ctx))
+ goto out;
+
+ if (!BN_div(ctx.q1, ctx.qr, ctx.q1, ctx.m, ctx.bn_ctx))
+ goto out;
+
+ if (BN_num_bytes(ctx.q1) > SGX_MODULUS_SIZE) {
+ fprintf(stderr, "Too large Q1 %d bytes\n",
+ BN_num_bytes(ctx.q1));
+ goto out;
+ }
+
+ if (!BN_mul(ctx.q2, ctx.s, ctx.qr, ctx.bn_ctx))
+ goto out;
+
+ if (!BN_div(ctx.q2, NULL, ctx.q2, ctx.m, ctx.bn_ctx))
+ goto out;
+
+ if (BN_num_bytes(ctx.q2) > SGX_MODULUS_SIZE) {
+ fprintf(stderr, "Too large Q2 %d bytes\n",
+ BN_num_bytes(ctx.q2));
+ goto out;
+ }
+
+ BN_bn2bin(ctx.q1, q1);
+ BN_bn2bin(ctx.q2, q2);
+
+ free_q1q2_ctx(&ctx);
+ return true;
+out:
+ free_q1q2_ctx(&ctx);
+ return false;
+}
+
+struct sgx_sigstruct_payload {
+ struct sgx_sigstruct_header header;
+ struct sgx_sigstruct_body body;
+};
+
+static bool check_crypto_errors(void)
+{
+ int err;
+ bool had_errors = false;
+ const char *filename;
+ int line;
+ char str[256];
+
+ for ( ; ; ) {
+ if (ERR_peek_error() == 0)
+ break;
+
+ had_errors = true;
+ err = ERR_get_error_line(&filename, &line);
+ ERR_error_string_n(err, str, sizeof(str));
+ fprintf(stderr, "crypto: %s: %s:%d\n", str, filename, line);
+ }
+
+ return had_errors;
+}
+
+static inline const BIGNUM *get_modulus(RSA *key)
+{
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ return key->n;
+#else
+ const BIGNUM *n;
+
+ RSA_get0_key(key, &n, NULL, NULL);
+ return n;
+#endif
+}
+
+static RSA *gen_sign_key(void)
+{
+ BIGNUM *e;
+ RSA *key;
+ int ret;
+
+ e = BN_new();
+ key = RSA_new();
+
+ if (!e || !key)
+ goto err;
+
+ ret = BN_set_word(e, RSA_3);
+ if (ret != 1)
+ goto err;
+
+ ret = RSA_generate_key_ex(key, 3072, e, NULL);
+ if (ret != 1)
+ goto err;
+
+ BN_free(e);
+
+ return key;
+
+err:
+ RSA_free(key);
+ BN_free(e);
+
+ return NULL;
+}
+
+static void reverse_bytes(void *data, int length)
+{
+ int i = 0;
+ int j = length - 1;
+ uint8_t temp;
+ uint8_t *ptr = data;
+
+ while (i < j) {
+ temp = ptr[i];
+ ptr[i] = ptr[j];
+ ptr[j] = temp;
+ i++;
+ j--;
+ }
+}
+
+enum mrtags {
+ MRECREATE = 0x0045544145524345,
+ MREADD = 0x0000000044444145,
+ MREEXTEND = 0x00444E4554584545,
+};
+
+static bool mrenclave_update(EVP_MD_CTX *ctx, const void *data)
+{
+ if (!EVP_DigestUpdate(ctx, data, 64)) {
+ fprintf(stderr, "digest update failed\n");
+ return false;
+ }
+
+ return true;
+}
+
+static bool mrenclave_commit(EVP_MD_CTX *ctx, uint8_t *mrenclave)
+{
+ unsigned int size;
+
+ if (!EVP_DigestFinal_ex(ctx, (unsigned char *)mrenclave, &size)) {
+ fprintf(stderr, "digest commit failed\n");
+ return false;
+ }
+
+ if (size != 32) {
+ fprintf(stderr, "invalid digest size = %u\n", size);
+ return false;
+ }
+
+ return true;
+}
+
+struct mrecreate {
+ uint64_t tag;
+ uint32_t ssaframesize;
+ uint64_t size;
+ uint8_t reserved[44];
+} __attribute__((__packed__));
+
+
+static bool mrenclave_ecreate(EVP_MD_CTX *ctx, uint64_t blob_size)
+{
+ struct mrecreate mrecreate;
+ uint64_t encl_size;
+
+ for (encl_size = 0x1000; encl_size < blob_size; )
+ encl_size <<= 1;
+
+ memset(&mrecreate, 0, sizeof(mrecreate));
+ mrecreate.tag = MRECREATE;
+ mrecreate.ssaframesize = 1;
+ mrecreate.size = encl_size;
+
+ if (!EVP_DigestInit_ex(ctx, EVP_sha256(), NULL))
+ return false;
+
+ return mrenclave_update(ctx, &mrecreate);
+}
+
+struct mreadd {
+ uint64_t tag;
+ uint64_t offset;
+ uint64_t flags; /* SECINFO flags */
+ uint8_t reserved[40];
+} __attribute__((__packed__));
+
+static bool mrenclave_eadd(EVP_MD_CTX *ctx, uint64_t offset, uint64_t flags)
+{
+ struct mreadd mreadd;
+
+ memset(&mreadd, 0, sizeof(mreadd));
+ mreadd.tag = MREADD;
+ mreadd.offset = offset;
+ mreadd.flags = flags;
+
+ return mrenclave_update(ctx, &mreadd);
+}
+
+struct mreextend {
+ uint64_t tag;
+ uint64_t offset;
+ uint8_t reserved[48];
+} __attribute__((__packed__));
+
+static bool mrenclave_eextend(EVP_MD_CTX *ctx, uint64_t offset,
+ const uint8_t *data)
+{
+ struct mreextend mreextend;
+ int i;
+
+ for (i = 0; i < 0x1000; i += 0x100) {
+ memset(&mreextend, 0, sizeof(mreextend));
+ mreextend.tag = MREEXTEND;
+ mreextend.offset = offset + i;
+
+ if (!mrenclave_update(ctx, &mreextend))
+ return false;
+
+ if (!mrenclave_update(ctx, &data[i + 0x00]))
+ return false;
+
+ if (!mrenclave_update(ctx, &data[i + 0x40]))
+ return false;
+
+ if (!mrenclave_update(ctx, &data[i + 0x80]))
+ return false;
+
+ if (!mrenclave_update(ctx, &data[i + 0xC0]))
+ return false;
+ }
+
+ return true;
+}
+
+static bool mrenclave_segment(EVP_MD_CTX *ctx, struct encl *encl,
+ struct encl_segment *seg)
+{
+ uint64_t end = seg->offset + seg->size;
+ uint64_t offset;
+
+ for (offset = seg->offset; offset < end; offset += PAGE_SIZE) {
+ if (!mrenclave_eadd(ctx, offset, seg->flags))
+ return false;
+
+ if (!mrenclave_eextend(ctx, offset, encl->src + offset))
+ return false;
+ }
+
+ return true;
+}
+
+bool encl_measure(struct encl *encl)
+{
+ uint64_t header1[2] = {0x000000E100000006, 0x0000000000010000};
+ uint64_t header2[2] = {0x0000006000000101, 0x0000000100000060};
+ struct sgx_sigstruct *sigstruct = &encl->sigstruct;
+ struct sgx_sigstruct_payload payload;
+ uint8_t digest[SHA256_DIGEST_LENGTH];
+ unsigned int siglen;
+ RSA *key = NULL;
+ EVP_MD_CTX *ctx;
+ int i;
+
+ memset(sigstruct, 0, sizeof(*sigstruct));
+
+ sigstruct->header.header1[0] = header1[0];
+ sigstruct->header.header1[1] = header1[1];
+ sigstruct->header.header2[0] = header2[0];
+ sigstruct->header.header2[1] = header2[1];
+ sigstruct->exponent = 3;
+ sigstruct->body.attributes = SGX_ATTR_MODE64BIT;
+ sigstruct->body.xfrm = 3;
+
+ /* sanity check */
+ if (check_crypto_errors())
+ goto err;
+
+ key = gen_sign_key();
+ if (!key)
+ goto err;
+
+ BN_bn2bin(get_modulus(key), sigstruct->modulus);
+
+ ctx = EVP_MD_CTX_create();
+ if (!ctx)
+ goto err;
+
+ if (!mrenclave_ecreate(ctx, encl->src_size))
+ goto err;
+
+ for (i = 0; i < encl->nr_segments; i++) {
+ struct encl_segment *seg = &encl->segment_tbl[i];
+
+ if (!mrenclave_segment(ctx, encl, seg))
+ goto err;
+ }
+
+ if (!mrenclave_commit(ctx, sigstruct->body.mrenclave))
+ goto err;
+
+ memcpy(&payload.header, &sigstruct->header, sizeof(sigstruct->header));
+ memcpy(&payload.body, &sigstruct->body, sizeof(sigstruct->body));
+
+ SHA256((unsigned char *)&payload, sizeof(payload), digest);
+
+ if (!RSA_sign(NID_sha256, digest, SHA256_DIGEST_LENGTH,
+ sigstruct->signature, &siglen, key))
+ goto err;
+
+ if (!calc_q1q2(sigstruct->signature, sigstruct->modulus, sigstruct->q1,
+ sigstruct->q2))
+ goto err;
+
+ /* BE -> LE */
+ reverse_bytes(sigstruct->signature, SGX_MODULUS_SIZE);
+ reverse_bytes(sigstruct->modulus, SGX_MODULUS_SIZE);
+ reverse_bytes(sigstruct->q1, SGX_MODULUS_SIZE);
+ reverse_bytes(sigstruct->q2, SGX_MODULUS_SIZE);
+
+ EVP_MD_CTX_destroy(ctx);
+ RSA_free(key);
+ return true;
+
+err:
+ EVP_MD_CTX_destroy(ctx);
+ RSA_free(key);
+ return false;
+}
diff --git a/tools/testing/selftests/sgx/test_encl.c b/tools/testing/selftests/sgx/test_encl.c
new file mode 100644
index 000000000000..ede915399742
--- /dev/null
+++ b/tools/testing/selftests/sgx/test_encl.c
@@ -0,0 +1,20 @@
+// SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause)
+// Copyright(c) 2016-18 Intel Corporation.
+
+#include <stddef.h>
+#include "defines.h"
+
+static void *memcpy(void *dest, const void *src, size_t n)
+{
+ size_t i;
+
+ for (i = 0; i < n; i++)
+ ((char *)dest)[i] = ((char *)src)[i];
+
+ return dest;
+}
+
+void encl_body(void *rdi, void *rsi)
+{
+ memcpy(rsi, rdi, 8);
+}
diff --git a/tools/testing/selftests/sgx/test_encl.lds b/tools/testing/selftests/sgx/test_encl.lds
new file mode 100644
index 000000000000..0fbbda7e665e
--- /dev/null
+++ b/tools/testing/selftests/sgx/test_encl.lds
@@ -0,0 +1,40 @@
+OUTPUT_FORMAT(elf64-x86-64)
+
+PHDRS
+{
+ tcs PT_LOAD;
+ text PT_LOAD;
+ data PT_LOAD;
+}
+
+SECTIONS
+{
+ . = 0;
+ .tcs : {
+ *(.tcs*)
+ } : tcs
+
+ . = ALIGN(4096);
+ .text : {
+ *(.text*)
+ *(.rodata*)
+ } : text
+
+ . = ALIGN(4096);
+ .data : {
+ *(.data*)
+ } : data
+
+ /DISCARD/ : {
+ *(.comment*)
+ *(.note*)
+ *(.debug*)
+ *(.eh_frame*)
+ }
+}
+
+ASSERT(!DEFINED(.altinstructions), "ALTERNATIVES are not supported in enclaves")
+ASSERT(!DEFINED(.altinstr_replacement), "ALTERNATIVES are not supported in enclaves")
+ASSERT(!DEFINED(.discard.retpoline_safe), "RETPOLINE ALTERNATIVES are not supported in enclaves")
+ASSERT(!DEFINED(.discard.nospec), "RETPOLINE ALTERNATIVES are not supported in enclaves")
+ASSERT(!DEFINED(.got.plt), "Libcalls are not supported in enclaves")
diff --git a/tools/testing/selftests/sgx/test_encl_bootstrap.S b/tools/testing/selftests/sgx/test_encl_bootstrap.S
new file mode 100644
index 000000000000..6836ea86126e
--- /dev/null
+++ b/tools/testing/selftests/sgx/test_encl_bootstrap.S
@@ -0,0 +1,89 @@
+/* SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause) */
+/*
+ * Copyright(c) 2016-18 Intel Corporation.
+ */
+
+ .macro ENCLU
+ .byte 0x0f, 0x01, 0xd7
+ .endm
+
+ .section ".tcs", "aw"
+ .balign 4096
+
+ .fill 1, 8, 0 # STATE (set by CPU)
+ .fill 1, 8, 0 # FLAGS
+ .quad encl_ssa # OSSA
+ .fill 1, 4, 0 # CSSA (set by CPU)
+ .fill 1, 4, 1 # NSSA
+ .quad encl_entry # OENTRY
+ .fill 1, 8, 0 # AEP (set by EENTER and ERESUME)
+ .fill 1, 8, 0 # OFSBASE
+ .fill 1, 8, 0 # OGSBASE
+ .fill 1, 4, 0xFFFFFFFF # FSLIMIT
+ .fill 1, 4, 0xFFFFFFFF # GSLIMIT
+ .fill 4024, 1, 0 # Reserved
+
+ # Identical to the previous TCS.
+ .fill 1, 8, 0 # STATE (set by CPU)
+ .fill 1, 8, 0 # FLAGS
+ .quad encl_ssa # OSSA
+ .fill 1, 4, 0 # CSSA (set by CPU)
+ .fill 1, 4, 1 # NSSA
+ .quad encl_entry # OENTRY
+ .fill 1, 8, 0 # AEP (set by EENTER and ERESUME)
+ .fill 1, 8, 0 # OFSBASE
+ .fill 1, 8, 0 # OGSBASE
+ .fill 1, 4, 0xFFFFFFFF # FSLIMIT
+ .fill 1, 4, 0xFFFFFFFF # GSLIMIT
+ .fill 4024, 1, 0 # Reserved
+
+ .text
+
+encl_entry:
+ # RBX contains the base address for TCS, which is also the first address
+ # inside the enclave. By adding the value of le_stack_end to it, we get
+ # the absolute address for the stack.
+ lea (encl_stack)(%rbx), %rax
+ xchg %rsp, %rax
+ push %rax
+
+ push %rcx # push the address after EENTER
+ push %rbx # push the enclave base address
+
+ call encl_body
+
+ pop %rbx # pop the enclave base address
+
+ /* Clear volatile GPRs, except RAX (EEXIT leaf). */
+ xor %rcx, %rcx
+ xor %rdx, %rdx
+ xor %rdi, %rdi
+ xor %rsi, %rsi
+ xor %r8, %r8
+ xor %r9, %r9
+ xor %r10, %r10
+ xor %r11, %r11
+
+ # Reset status flags.
+ add %rdx, %rdx # OF = SF = AF = CF = 0; ZF = PF = 1
+
+ # Prepare EEXIT target by popping the address of the instruction after
+ # EENTER to RBX.
+ pop %rbx
+
+ # Restore the caller stack.
+ pop %rax
+ mov %rax, %rsp
+
+ # EEXIT
+ mov $4, %rax
+ enclu
+
+ .section ".data", "aw"
+
+encl_ssa:
+ .space 4096
+
+ .balign 4096
+ .space 8192
+encl_stack:
--
2.25.1
Add the maintainer information for the SGX subsystem.
Cc: Thomas Gleixner <[email protected]>
Cc: Borislav Petkov <[email protected]>
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
MAINTAINERS | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/MAINTAINERS b/MAINTAINERS
index b81aad6f7f97..ca1995b1ef45 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -9070,6 +9070,17 @@ F: Documentation/x86/intel_txt.rst
F: arch/x86/kernel/tboot.c
F: include/linux/tboot.h
+INTEL SGX
+M: Jarkko Sakkinen <[email protected]>
+M: Sean Christopherson <[email protected]>
+L: [email protected]
+S: Maintained
+Q: https://patchwork.kernel.org/project/intel-sgx/list/
+T: git git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-sgx.git
+F: arch/x86/include/uapi/asm/sgx.h
+F: arch/x86/kernel/cpu/sgx/*
+K: \bSGX_
+
INTERCONNECT API
M: Georgi Djakov <[email protected]>
L: [email protected]
--
2.25.1
From: Sean Christopherson <[email protected]>
Add helper function to sanitize error code to prepare for vDSO exception
fixup, which will expose the error code to userspace and runs before
set_signal_archinfo(), i.e. suppresses the signal when fixup is successful.
Acked-by: Jethro Beekman <[email protected]>
Signed-off-by: Sean Christopherson <[email protected]>
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
arch/x86/mm/fault.c | 24 +++++++++++++++++-------
1 file changed, 17 insertions(+), 7 deletions(-)
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 90ee91c244c6..24ab833ede41 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -602,6 +602,18 @@ pgtable_bad(struct pt_regs *regs, unsigned long error_code,
oops_end(flags, regs, sig);
}
+static void sanitize_error_code(unsigned long address,
+ unsigned long *error_code)
+{
+ /*
+ * To avoid leaking information about the kernel page
+ * table layout, pretend that user-mode accesses to
+ * kernel addresses are always protection faults.
+ */
+ if (address >= TASK_SIZE_MAX)
+ *error_code |= X86_PF_PROT;
+}
+
static void set_signal_archinfo(unsigned long address,
unsigned long error_code)
{
@@ -658,6 +670,8 @@ no_context(struct pt_regs *regs, unsigned long error_code,
* faulting through the emulate_vsyscall() logic.
*/
if (current->thread.sig_on_uaccess_err && signal) {
+ sanitize_error_code(address, &error_code);
+
set_signal_archinfo(address, error_code);
/* XXX: hwpoison faults will set the wrong code. */
@@ -806,13 +820,7 @@ __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,
if (is_errata100(regs, address))
return;
- /*
- * To avoid leaking information about the kernel page table
- * layout, pretend that user-mode accesses to kernel addresses
- * are always protection faults.
- */
- if (address >= TASK_SIZE_MAX)
- error_code |= X86_PF_PROT;
+ sanitize_error_code(address, &error_code);
if (likely(show_unhandled_signals))
show_signal_msg(regs, error_code, address, tsk);
@@ -931,6 +939,8 @@ do_sigbus(struct pt_regs *regs, unsigned long error_code, unsigned long address,
if (is_prefetch(regs, error_code, address))
return;
+ sanitize_error_code(address, &error_code);
+
set_signal_archinfo(address, error_code);
#ifdef CONFIG_MEMORY_FAILURE
--
2.25.1
There is a limited amount of EPC available. Therefore, some of it must be
copied to the regular memory, and only subset kept in the SGX reserved
memory. While kernel cannot directly access enclave memory, SGX provides a
set of ENCLS leaf functions to perform reclaiming.
Implement a page reclaimer by using these leaf functions. It picks the
victim pages in LRU fashion from all the enclaves running in the system.
The thread ksgxswapd reclaims pages on the event when the number of free
EPC pages goes below SGX_NR_LOW_PAGES up until it reaches
SGX_NR_HIGH_PAGES.
sgx_alloc_epc_page() can optionally directly reclaim pages with @reclaim
set true. A caller must also supply owner for each page so that the
reclaimer can access the associated enclaves. This is needed for locking,
as most of the ENCLS leafs cannot be executed concurrently for an enclave.
The owner is also needed for accessing SECS, which is required to be
resident when its child pages are being reclaimed.
Cc: [email protected]
Acked-by: Jethro Beekman <[email protected]>
Tested-by: Jethro Beekman <[email protected]>
Tested-by: Jordan Hand <[email protected]>
Tested-by: Nathaniel McCallum <[email protected]>
Tested-by: Chunyang Hui <[email protected]>
Tested-by: Seth Moore <[email protected]>
Co-developed-by: Sean Christopherson <[email protected]>
Signed-off-by: Sean Christopherson <[email protected]>
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
arch/x86/kernel/cpu/sgx/driver.c | 1 +
arch/x86/kernel/cpu/sgx/encl.c | 344 +++++++++++++++++++++-
arch/x86/kernel/cpu/sgx/encl.h | 41 +++
arch/x86/kernel/cpu/sgx/ioctl.c | 78 ++++-
arch/x86/kernel/cpu/sgx/main.c | 481 +++++++++++++++++++++++++++++++
arch/x86/kernel/cpu/sgx/sgx.h | 9 +
6 files changed, 947 insertions(+), 7 deletions(-)
diff --git a/arch/x86/kernel/cpu/sgx/driver.c b/arch/x86/kernel/cpu/sgx/driver.c
index d01b28f7ce4a..0446781cc7a2 100644
--- a/arch/x86/kernel/cpu/sgx/driver.c
+++ b/arch/x86/kernel/cpu/sgx/driver.c
@@ -29,6 +29,7 @@ static int sgx_open(struct inode *inode, struct file *file)
atomic_set(&encl->flags, 0);
kref_init(&encl->refcount);
xa_init(&encl->page_array);
+ INIT_LIST_HEAD(&encl->va_pages);
mutex_init(&encl->lock);
INIT_LIST_HEAD(&encl->mm_list);
spin_lock_init(&encl->mm_lock);
diff --git a/arch/x86/kernel/cpu/sgx/encl.c b/arch/x86/kernel/cpu/sgx/encl.c
index c2c4a77af36b..54326efa6c2f 100644
--- a/arch/x86/kernel/cpu/sgx/encl.c
+++ b/arch/x86/kernel/cpu/sgx/encl.c
@@ -12,9 +12,88 @@
#include "encls.h"
#include "sgx.h"
+/*
+ * ELDU: Load an EPC page as unblocked. For more info, see "OS Management of EPC
+ * Pages" in the SDM.
+ */
+static int __sgx_encl_eldu(struct sgx_encl_page *encl_page,
+ struct sgx_epc_page *epc_page,
+ struct sgx_epc_page *secs_page)
+{
+ unsigned long va_offset = SGX_ENCL_PAGE_VA_OFFSET(encl_page);
+ struct sgx_encl *encl = encl_page->encl;
+ struct sgx_pageinfo pginfo;
+ struct sgx_backing b;
+ pgoff_t page_index;
+ int ret;
+
+ if (secs_page)
+ page_index = SGX_ENCL_PAGE_INDEX(encl_page);
+ else
+ page_index = PFN_DOWN(encl->size);
+
+ ret = sgx_encl_get_backing(encl, page_index, &b);
+ if (ret)
+ return ret;
+
+ pginfo.addr = SGX_ENCL_PAGE_ADDR(encl_page);
+ pginfo.contents = (unsigned long)kmap_atomic(b.contents);
+ pginfo.metadata = (unsigned long)kmap_atomic(b.pcmd) +
+ b.pcmd_offset;
+
+ if (secs_page)
+ pginfo.secs = (u64)sgx_get_epc_addr(secs_page);
+ else
+ pginfo.secs = 0;
+
+ ret = __eldu(&pginfo, sgx_get_epc_addr(epc_page),
+ sgx_get_epc_addr(encl_page->va_page->epc_page) +
+ va_offset);
+ if (ret) {
+ if (encls_failed(ret))
+ ENCLS_WARN(ret, "ELDU");
+
+ ret = -EFAULT;
+ }
+
+ kunmap_atomic((void *)(unsigned long)(pginfo.metadata - b.pcmd_offset));
+ kunmap_atomic((void *)(unsigned long)pginfo.contents);
+
+ sgx_encl_put_backing(&b, false);
+
+ return ret;
+}
+
+static struct sgx_epc_page *sgx_encl_eldu(struct sgx_encl_page *encl_page,
+ struct sgx_epc_page *secs_page)
+{
+ unsigned long va_offset = SGX_ENCL_PAGE_VA_OFFSET(encl_page);
+ struct sgx_encl *encl = encl_page->encl;
+ struct sgx_epc_page *epc_page;
+ int ret;
+
+ epc_page = sgx_alloc_epc_page(encl_page, false);
+ if (IS_ERR(epc_page))
+ return epc_page;
+
+ ret = __sgx_encl_eldu(encl_page, epc_page, secs_page);
+ if (ret) {
+ sgx_free_epc_page(epc_page);
+ return ERR_PTR(ret);
+ }
+
+ sgx_free_va_slot(encl_page->va_page, va_offset);
+ list_move(&encl_page->va_page->list, &encl->va_pages);
+ encl_page->desc &= ~SGX_ENCL_PAGE_VA_OFFSET_MASK;
+ encl_page->epc_page = epc_page;
+
+ return epc_page;
+}
+
static struct sgx_encl_page *sgx_encl_load_page(struct sgx_encl *encl,
unsigned long addr)
{
+ struct sgx_epc_page *epc_page;
struct sgx_encl_page *entry;
unsigned int flags;
@@ -33,10 +112,27 @@ static struct sgx_encl_page *sgx_encl_load_page(struct sgx_encl *encl,
return ERR_PTR(-EFAULT);
/* Page is already resident in the EPC. */
- if (entry->epc_page)
+ if (entry->epc_page) {
+ if (entry->desc & SGX_ENCL_PAGE_BEING_RECLAIMED)
+ return ERR_PTR(-EBUSY);
+
return entry;
+ }
+
+ if (!(encl->secs.epc_page)) {
+ epc_page = sgx_encl_eldu(&encl->secs, NULL);
+ if (IS_ERR(epc_page))
+ return ERR_CAST(epc_page);
+ }
- return ERR_PTR(-EFAULT);
+ epc_page = sgx_encl_eldu(entry, encl->secs.epc_page);
+ if (IS_ERR(epc_page))
+ return ERR_CAST(epc_page);
+
+ encl->secs_child_cnt++;
+ sgx_mark_page_reclaimable(entry->epc_page);
+
+ return entry;
}
static void sgx_mmu_notifier_release(struct mmu_notifier *mn,
@@ -132,6 +228,9 @@ int sgx_encl_mm_add(struct sgx_encl *encl, struct mm_struct *mm)
spin_lock(&encl->mm_lock);
list_add_rcu(&encl_mm->list, &encl->mm_list);
+ /* Pairs with smp_rmb() in sgx_reclaimer_block(). */
+ smp_wmb();
+ encl->mm_list_version++;
spin_unlock(&encl->mm_lock);
return 0;
@@ -179,6 +278,8 @@ static unsigned int sgx_vma_fault(struct vm_fault *vmf)
goto out;
}
+ sgx_encl_test_and_clear_young(vma->vm_mm, entry);
+
out:
mutex_unlock(&encl->lock);
return ret;
@@ -280,6 +381,7 @@ int sgx_encl_find(struct mm_struct *mm, unsigned long addr,
*/
void sgx_encl_destroy(struct sgx_encl *encl)
{
+ struct sgx_va_page *va_page;
struct sgx_encl_page *entry;
unsigned long index;
@@ -287,6 +389,13 @@ void sgx_encl_destroy(struct sgx_encl *encl)
xa_for_each(&encl->page_array, index, entry) {
if (entry->epc_page) {
+ /*
+ * The page and its radix tree entry cannot be freed
+ * if the page is being held by the reclaimer.
+ */
+ if (sgx_unmark_page_reclaimable(entry->epc_page))
+ continue;
+
sgx_free_epc_page(entry->epc_page);
encl->secs_child_cnt--;
entry->epc_page = NULL;
@@ -301,6 +410,19 @@ void sgx_encl_destroy(struct sgx_encl *encl)
sgx_free_epc_page(encl->secs.epc_page);
encl->secs.epc_page = NULL;
}
+
+ /*
+ * The reclaimer is responsible for checking SGX_ENCL_DEAD before doing
+ * EWB, thus it's safe to free VA pages even if the reclaimer holds a
+ * reference to the enclave.
+ */
+ while (!list_empty(&encl->va_pages)) {
+ va_page = list_first_entry(&encl->va_pages, struct sgx_va_page,
+ list);
+ list_del(&va_page->list);
+ sgx_free_epc_page(va_page->epc_page);
+ kfree(va_page);
+ }
}
/**
@@ -329,3 +451,221 @@ void sgx_encl_release(struct kref *ref)
kfree(encl);
}
+
+static struct page *sgx_encl_get_backing_page(struct sgx_encl *encl,
+ pgoff_t index)
+{
+ struct inode *inode = encl->backing->f_path.dentry->d_inode;
+ struct address_space *mapping = inode->i_mapping;
+ gfp_t gfpmask = mapping_gfp_mask(mapping);
+
+ return shmem_read_mapping_page_gfp(mapping, index, gfpmask);
+}
+
+/**
+ * sgx_encl_get_backing() - Pin the backing storage
+ * @encl: an enclave pointer
+ * @page_index: enclave page index
+ * @backing: data for accessing backing storage for the page
+ *
+ * Pin the backing storage pages for storing the encrypted contents and Paging
+ * Crypto MetaData (PCMD) of an enclave page.
+ *
+ * Return:
+ * 0 on success,
+ * -errno otherwise.
+ */
+int sgx_encl_get_backing(struct sgx_encl *encl, unsigned long page_index,
+ struct sgx_backing *backing)
+{
+ pgoff_t pcmd_index = PFN_DOWN(encl->size) + 1 + (page_index >> 5);
+ struct page *contents;
+ struct page *pcmd;
+
+ contents = sgx_encl_get_backing_page(encl, page_index);
+ if (IS_ERR(contents))
+ return PTR_ERR(contents);
+
+ pcmd = sgx_encl_get_backing_page(encl, pcmd_index);
+ if (IS_ERR(pcmd)) {
+ put_page(contents);
+ return PTR_ERR(pcmd);
+ }
+
+ backing->page_index = page_index;
+ backing->contents = contents;
+ backing->pcmd = pcmd;
+ backing->pcmd_offset =
+ (page_index & (PAGE_SIZE / sizeof(struct sgx_pcmd) - 1)) *
+ sizeof(struct sgx_pcmd);
+
+ return 0;
+}
+
+/**
+ * sgx_encl_put_backing() - Unpin the backing storage
+ * @backing: data for accessing backing storage for the page
+ * @do_write: mark pages dirty
+ */
+void sgx_encl_put_backing(struct sgx_backing *backing, bool do_write)
+{
+ if (do_write) {
+ set_page_dirty(backing->pcmd);
+ set_page_dirty(backing->contents);
+ }
+
+ put_page(backing->pcmd);
+ put_page(backing->contents);
+}
+
+static int sgx_encl_test_and_clear_young_cb(pte_t *ptep, unsigned long addr,
+ void *data)
+{
+ pte_t pte;
+ int ret;
+
+ ret = pte_young(*ptep);
+ if (ret) {
+ pte = pte_mkold(*ptep);
+ set_pte_at((struct mm_struct *)data, addr, ptep, pte);
+ }
+
+ return ret;
+}
+
+/**
+ * sgx_encl_test_and_clear_young() - Test and reset the accessed bit
+ * @mm: mm_struct that is checked
+ * @page: enclave page to be tested for recent access
+ *
+ * Checks the Access (A) bit from the PTE corresponding to the enclave page and
+ * clears it.
+ *
+ * Return: 1 if the page has been recently accessed and 0 if not.
+ */
+int sgx_encl_test_and_clear_young(struct mm_struct *mm,
+ struct sgx_encl_page *page)
+{
+ unsigned long addr = SGX_ENCL_PAGE_ADDR(page);
+ struct sgx_encl *encl = page->encl;
+ struct vm_area_struct *vma;
+ int ret;
+
+ ret = sgx_encl_find(mm, addr, &vma);
+ if (ret)
+ return 0;
+
+ if (encl != vma->vm_private_data)
+ return 0;
+
+ ret = apply_to_page_range(vma->vm_mm, addr, PAGE_SIZE,
+ sgx_encl_test_and_clear_young_cb, vma->vm_mm);
+ if (ret < 0)
+ return 0;
+
+ return ret;
+}
+
+/**
+ * sgx_encl_reserve_page() - Reserve an enclave page
+ * @encl: an enclave pointer
+ * @addr: a page address
+ *
+ * Load an enclave page and lock the enclave so that the page can be used by
+ * EDBG* and EMOD*.
+ *
+ * Return:
+ * an enclave page on success
+ * -EFAULT if the load fails
+ */
+struct sgx_encl_page *sgx_encl_reserve_page(struct sgx_encl *encl,
+ unsigned long addr)
+{
+ struct sgx_encl_page *entry;
+
+ for ( ; ; ) {
+ mutex_lock(&encl->lock);
+
+ entry = sgx_encl_load_page(encl, addr);
+ if (PTR_ERR(entry) != -EBUSY)
+ break;
+
+ mutex_unlock(&encl->lock);
+ }
+
+ if (IS_ERR(entry))
+ mutex_unlock(&encl->lock);
+
+ return entry;
+}
+
+/**
+ * sgx_alloc_va_page() - Allocate a Version Array (VA) page
+ *
+ * Allocate a free EPC page and convert it to a Version Array (VA) page.
+ *
+ * Return:
+ * a VA page,
+ * -errno otherwise
+ */
+struct sgx_epc_page *sgx_alloc_va_page(void)
+{
+ struct sgx_epc_page *epc_page;
+ int ret;
+
+ epc_page = sgx_alloc_epc_page(NULL, true);
+ if (IS_ERR(epc_page))
+ return ERR_CAST(epc_page);
+
+ ret = __epa(sgx_get_epc_addr(epc_page));
+ if (ret) {
+ WARN_ONCE(1, "EPA returned %d (0x%x)", ret, ret);
+ sgx_free_epc_page(epc_page);
+ return ERR_PTR(-EFAULT);
+ }
+
+ return epc_page;
+}
+
+/**
+ * sgx_alloc_va_slot - allocate a VA slot
+ * @va_page: a &struct sgx_va_page instance
+ *
+ * Allocates a slot from a &struct sgx_va_page instance.
+ *
+ * Return: offset of the slot inside the VA page
+ */
+unsigned int sgx_alloc_va_slot(struct sgx_va_page *va_page)
+{
+ int slot = find_first_zero_bit(va_page->slots, SGX_VA_SLOT_COUNT);
+
+ if (slot < SGX_VA_SLOT_COUNT)
+ set_bit(slot, va_page->slots);
+
+ return slot << 3;
+}
+
+/**
+ * sgx_free_va_slot - free a VA slot
+ * @va_page: a &struct sgx_va_page instance
+ * @offset: offset of the slot inside the VA page
+ *
+ * Frees a slot from a &struct sgx_va_page instance.
+ */
+void sgx_free_va_slot(struct sgx_va_page *va_page, unsigned int offset)
+{
+ clear_bit(offset >> 3, va_page->slots);
+}
+
+/**
+ * sgx_va_page_full - is the VA page full?
+ * @va_page: a &struct sgx_va_page instance
+ *
+ * Return: true if all slots have been taken
+ */
+bool sgx_va_page_full(struct sgx_va_page *va_page)
+{
+ int slot = find_first_zero_bit(va_page->slots, SGX_VA_SLOT_COUNT);
+
+ return slot == SGX_VA_SLOT_COUNT;
+}
diff --git a/arch/x86/kernel/cpu/sgx/encl.h b/arch/x86/kernel/cpu/sgx/encl.h
index 0448d22d3010..e8eb9e9a834e 100644
--- a/arch/x86/kernel/cpu/sgx/encl.h
+++ b/arch/x86/kernel/cpu/sgx/encl.h
@@ -19,6 +19,10 @@
/**
* enum sgx_encl_page_desc - defines bits for an enclave page's descriptor
+ * %SGX_ENCL_PAGE_BEING_RECLAIMED: The page is in the process of being
+ * reclaimed.
+ * %SGX_ENCL_PAGE_VA_OFFSET_MASK: Holds the offset in the Version Array
+ * (VA) page for a swapped page.
* %SGX_ENCL_PAGE_ADDR_MASK: Holds the virtual address of the page.
*
* The page address for SECS is zero and is used by the subsystem to recognize
@@ -26,16 +30,23 @@
*/
enum sgx_encl_page_desc {
/* Bits 11:3 are available when the page is not swapped. */
+ SGX_ENCL_PAGE_BEING_RECLAIMED = BIT(3),
+ SGX_ENCL_PAGE_VA_OFFSET_MASK = GENMASK_ULL(11, 3),
SGX_ENCL_PAGE_ADDR_MASK = PAGE_MASK,
};
#define SGX_ENCL_PAGE_ADDR(page) \
((page)->desc & SGX_ENCL_PAGE_ADDR_MASK)
+#define SGX_ENCL_PAGE_VA_OFFSET(page) \
+ ((page)->desc & SGX_ENCL_PAGE_VA_OFFSET_MASK)
+#define SGX_ENCL_PAGE_INDEX(page) \
+ PFN_DOWN((page)->desc - (page)->encl->base)
struct sgx_encl_page {
unsigned long desc;
unsigned long vm_max_prot_bits;
struct sgx_epc_page *epc_page;
+ struct sgx_va_page *va_page;
struct sgx_encl *encl;
};
@@ -61,6 +72,7 @@ struct sgx_encl {
struct mutex lock;
struct list_head mm_list;
spinlock_t mm_lock;
+ unsigned long mm_list_version;
struct file *backing;
struct kref refcount;
struct srcu_struct srcu;
@@ -68,12 +80,21 @@ struct sgx_encl {
unsigned long size;
unsigned long ssaframesize;
struct xarray page_array;
+ struct list_head va_pages;
struct sgx_encl_page secs;
cpumask_t cpumask;
unsigned long attributes;
unsigned long attributes_mask;
};
+#define SGX_VA_SLOT_COUNT 512
+
+struct sgx_va_page {
+ struct sgx_epc_page *epc_page;
+ DECLARE_BITMAP(slots, SGX_VA_SLOT_COUNT);
+ struct list_head list;
+};
+
extern const struct vm_operations_struct sgx_vm_ops;
int sgx_encl_find(struct mm_struct *mm, unsigned long addr,
@@ -84,4 +105,24 @@ int sgx_encl_mm_add(struct sgx_encl *encl, struct mm_struct *mm);
int sgx_encl_may_map(struct sgx_encl *encl, unsigned long start,
unsigned long end, unsigned long vm_flags);
+struct sgx_backing {
+ pgoff_t page_index;
+ struct page *contents;
+ struct page *pcmd;
+ unsigned long pcmd_offset;
+};
+
+int sgx_encl_get_backing(struct sgx_encl *encl, unsigned long page_index,
+ struct sgx_backing *backing);
+void sgx_encl_put_backing(struct sgx_backing *backing, bool do_write);
+int sgx_encl_test_and_clear_young(struct mm_struct *mm,
+ struct sgx_encl_page *page);
+struct sgx_encl_page *sgx_encl_reserve_page(struct sgx_encl *encl,
+ unsigned long addr);
+
+struct sgx_epc_page *sgx_alloc_va_page(void);
+unsigned int sgx_alloc_va_slot(struct sgx_va_page *va_page);
+void sgx_free_va_slot(struct sgx_va_page *va_page, unsigned int offset);
+bool sgx_va_page_full(struct sgx_va_page *va_page);
+
#endif /* _X86_ENCL_H */
diff --git a/arch/x86/kernel/cpu/sgx/ioctl.c b/arch/x86/kernel/cpu/sgx/ioctl.c
index 3c04798e83e5..613f6c03598e 100644
--- a/arch/x86/kernel/cpu/sgx/ioctl.c
+++ b/arch/x86/kernel/cpu/sgx/ioctl.c
@@ -16,6 +16,43 @@
#include "encl.h"
#include "encls.h"
+static struct sgx_va_page *sgx_encl_grow(struct sgx_encl *encl)
+{
+ struct sgx_va_page *va_page = NULL;
+ void *err;
+
+ BUILD_BUG_ON(SGX_VA_SLOT_COUNT !=
+ (SGX_ENCL_PAGE_VA_OFFSET_MASK >> 3) + 1);
+
+ if (!(encl->page_cnt % SGX_VA_SLOT_COUNT)) {
+ va_page = kzalloc(sizeof(*va_page), GFP_KERNEL);
+ if (!va_page)
+ return ERR_PTR(-ENOMEM);
+
+ va_page->epc_page = sgx_alloc_va_page();
+ if (IS_ERR(va_page->epc_page)) {
+ err = ERR_CAST(va_page->epc_page);
+ kfree(va_page);
+ return err;
+ }
+
+ WARN_ON_ONCE(encl->page_cnt % SGX_VA_SLOT_COUNT);
+ }
+ encl->page_cnt++;
+ return va_page;
+}
+
+static void sgx_encl_shrink(struct sgx_encl *encl, struct sgx_va_page *va_page)
+{
+ encl->page_cnt--;
+
+ if (va_page) {
+ sgx_free_epc_page(va_page->epc_page);
+ list_del(&va_page->list);
+ kfree(va_page);
+ }
+}
+
static u32 sgx_calc_ssa_frame_size(u32 miscselect, u64 xfrm)
{
u32 size_max = PAGE_SIZE;
@@ -80,15 +117,24 @@ static int sgx_validate_secs(const struct sgx_secs *secs)
static int sgx_encl_create(struct sgx_encl *encl, struct sgx_secs *secs)
{
struct sgx_epc_page *secs_epc;
+ struct sgx_va_page *va_page;
struct sgx_pageinfo pginfo;
struct sgx_secinfo secinfo;
unsigned long encl_size;
struct file *backing;
long ret;
+ va_page = sgx_encl_grow(encl);
+ if (IS_ERR(va_page))
+ return PTR_ERR(va_page);
+ else if (va_page)
+ list_add(&va_page->list, &encl->va_pages);
+ /* else the tail page of the VA page list had free slots. */
+
if (sgx_validate_secs(secs)) {
pr_debug("invalid SECS\n");
- return -EINVAL;
+ ret = -EINVAL;
+ goto err_out_shrink;
}
/* The extra page goes to SECS. */
@@ -96,12 +142,14 @@ static int sgx_encl_create(struct sgx_encl *encl, struct sgx_secs *secs)
backing = shmem_file_setup("SGX backing", encl_size + (encl_size >> 5),
VM_NORESERVE);
- if (IS_ERR(backing))
- return PTR_ERR(backing);
+ if (IS_ERR(backing)) {
+ ret = PTR_ERR(backing);
+ goto err_out_shrink;
+ }
encl->backing = backing;
- secs_epc = __sgx_alloc_epc_page();
+ secs_epc = sgx_alloc_epc_page(&encl->secs, true);
if (IS_ERR(secs_epc)) {
ret = PTR_ERR(secs_epc);
goto err_out_backing;
@@ -149,6 +197,9 @@ static int sgx_encl_create(struct sgx_encl *encl, struct sgx_secs *secs)
fput(encl->backing);
encl->backing = NULL;
+err_out_shrink:
+ sgx_encl_shrink(encl, va_page);
+
return ret;
}
@@ -321,21 +372,35 @@ static int sgx_encl_add_page(struct sgx_encl *encl, unsigned long src,
{
struct sgx_encl_page *encl_page;
struct sgx_epc_page *epc_page;
+ struct sgx_va_page *va_page;
int ret;
encl_page = sgx_encl_page_alloc(encl, offset, secinfo->flags);
if (IS_ERR(encl_page))
return PTR_ERR(encl_page);
- epc_page = __sgx_alloc_epc_page();
+ epc_page = sgx_alloc_epc_page(encl_page, true);
if (IS_ERR(epc_page)) {
kfree(encl_page);
return PTR_ERR(epc_page);
}
+ va_page = sgx_encl_grow(encl);
+ if (IS_ERR(va_page)) {
+ ret = PTR_ERR(va_page);
+ goto err_out_free;
+ }
+
mmap_read_lock(current->mm);
mutex_lock(&encl->lock);
+ /*
+ * Adding to encl->va_pages must be done under encl->lock. Ditto for
+ * deleting (via sgx_encl_shrink()) in the error path.
+ */
+ if (va_page)
+ list_add(&va_page->list, &encl->va_pages);
+
/*
* Insert prior to EADD in case of OOM. EADD modifies MRENCLAVE, i.e.
* can't be gracefully unwound, while failure on EADD/EXTEND is limited
@@ -366,6 +431,7 @@ static int sgx_encl_add_page(struct sgx_encl *encl, unsigned long src,
goto err_out;
}
+ sgx_mark_page_reclaimable(encl_page->epc_page);
mutex_unlock(&encl->lock);
mmap_read_unlock(current->mm);
return ret;
@@ -374,9 +440,11 @@ static int sgx_encl_add_page(struct sgx_encl *encl, unsigned long src,
xa_erase(&encl->page_array, PFN_DOWN(encl_page->desc));
err_out_unlock:
+ sgx_encl_shrink(encl, va_page);
mutex_unlock(&encl->lock);
mmap_read_unlock(current->mm);
+err_out_free:
sgx_free_epc_page(epc_page);
kfree(encl_page);
diff --git a/arch/x86/kernel/cpu/sgx/main.c b/arch/x86/kernel/cpu/sgx/main.c
index 4137254fb29e..3f9130501370 100644
--- a/arch/x86/kernel/cpu/sgx/main.c
+++ b/arch/x86/kernel/cpu/sgx/main.c
@@ -16,6 +16,395 @@
struct sgx_epc_section sgx_epc_sections[SGX_MAX_EPC_SECTIONS];
static int sgx_nr_epc_sections;
static struct task_struct *ksgxswapd_tsk;
+static DECLARE_WAIT_QUEUE_HEAD(ksgxswapd_waitq);
+static LIST_HEAD(sgx_active_page_list);
+static DEFINE_SPINLOCK(sgx_active_page_list_lock);
+
+/**
+ * sgx_mark_page_reclaimable() - Mark a page as reclaimable
+ * @page: EPC page
+ *
+ * Mark a page as reclaimable and add it to the active page list. Pages
+ * are automatically removed from the active list when freed.
+ */
+void sgx_mark_page_reclaimable(struct sgx_epc_page *page)
+{
+ spin_lock(&sgx_active_page_list_lock);
+ page->desc |= SGX_EPC_PAGE_RECLAIMABLE;
+ list_add_tail(&page->list, &sgx_active_page_list);
+ spin_unlock(&sgx_active_page_list_lock);
+}
+
+/**
+ * sgx_unmark_page_reclaimable() - Remove a page from the reclaim list
+ * @page: EPC page
+ *
+ * Clear the reclaimable flag and remove the page from the active page list.
+ *
+ * Return:
+ * 0 on success,
+ * -EBUSY if the page is in the process of being reclaimed
+ */
+int sgx_unmark_page_reclaimable(struct sgx_epc_page *page)
+{
+ /*
+ * Remove the page from the active list if necessary. If the page
+ * is actively being reclaimed, i.e. RECLAIMABLE is set but the
+ * page isn't on the active list, return -EBUSY as we can't free
+ * the page at this time since it is "owned" by the reclaimer.
+ */
+ spin_lock(&sgx_active_page_list_lock);
+ if (page->desc & SGX_EPC_PAGE_RECLAIMABLE) {
+ if (list_empty(&page->list)) {
+ spin_unlock(&sgx_active_page_list_lock);
+ return -EBUSY;
+ }
+ list_del(&page->list);
+ page->desc &= ~SGX_EPC_PAGE_RECLAIMABLE;
+ }
+ spin_unlock(&sgx_active_page_list_lock);
+
+ return 0;
+}
+
+static bool sgx_reclaimer_age(struct sgx_epc_page *epc_page)
+{
+ struct sgx_encl_page *page = epc_page->owner;
+ struct sgx_encl *encl = page->encl;
+ struct sgx_encl_mm *encl_mm;
+ bool ret = true;
+ int idx;
+
+ idx = srcu_read_lock(&encl->srcu);
+
+ list_for_each_entry_rcu(encl_mm, &encl->mm_list, list) {
+ if (!mmget_not_zero(encl_mm->mm))
+ continue;
+
+ mmap_read_lock(encl_mm->mm);
+ ret = !sgx_encl_test_and_clear_young(encl_mm->mm, page);
+ mmap_read_unlock(encl_mm->mm);
+
+ mmput_async(encl_mm->mm);
+
+ if (!ret || (atomic_read(&encl->flags) & SGX_ENCL_DEAD))
+ break;
+ }
+
+ srcu_read_unlock(&encl->srcu, idx);
+
+ if (!ret && !(atomic_read(&encl->flags) & SGX_ENCL_DEAD))
+ return false;
+
+ return true;
+}
+
+static void sgx_reclaimer_block(struct sgx_epc_page *epc_page)
+{
+ struct sgx_encl_page *page = epc_page->owner;
+ unsigned long addr = SGX_ENCL_PAGE_ADDR(page);
+ struct sgx_encl *encl = page->encl;
+ unsigned long mm_list_version;
+ struct sgx_encl_mm *encl_mm;
+ struct vm_area_struct *vma;
+ int idx, ret;
+
+ do {
+ mm_list_version = encl->mm_list_version;
+
+ /* Pairs with smp_rmb() in sgx_encl_mm_add(). */
+ smp_rmb();
+
+ idx = srcu_read_lock(&encl->srcu);
+
+ list_for_each_entry_rcu(encl_mm, &encl->mm_list, list) {
+ if (!mmget_not_zero(encl_mm->mm))
+ continue;
+
+ mmap_read_lock(encl_mm->mm);
+
+ ret = sgx_encl_find(encl_mm->mm, addr, &vma);
+ if (!ret && encl == vma->vm_private_data)
+ zap_vma_ptes(vma, addr, PAGE_SIZE);
+
+ mmap_read_unlock(encl_mm->mm);
+
+ mmput_async(encl_mm->mm);
+ }
+
+ srcu_read_unlock(&encl->srcu, idx);
+ } while (unlikely(encl->mm_list_version != mm_list_version));
+
+ mutex_lock(&encl->lock);
+
+ if (!(atomic_read(&encl->flags) & SGX_ENCL_DEAD)) {
+ ret = __eblock(sgx_get_epc_addr(epc_page));
+ if (encls_failed(ret))
+ ENCLS_WARN(ret, "EBLOCK");
+ }
+
+ mutex_unlock(&encl->lock);
+}
+
+static int __sgx_encl_ewb(struct sgx_epc_page *epc_page, void *va_slot,
+ struct sgx_backing *backing)
+{
+ struct sgx_pageinfo pginfo;
+ int ret;
+
+ pginfo.addr = 0;
+ pginfo.secs = 0;
+
+ pginfo.contents = (unsigned long)kmap_atomic(backing->contents);
+ pginfo.metadata = (unsigned long)kmap_atomic(backing->pcmd) +
+ backing->pcmd_offset;
+
+ ret = __ewb(&pginfo, sgx_get_epc_addr(epc_page), va_slot);
+
+ kunmap_atomic((void *)(unsigned long)(pginfo.metadata -
+ backing->pcmd_offset));
+ kunmap_atomic((void *)(unsigned long)pginfo.contents);
+
+ return ret;
+}
+
+static void sgx_ipi_cb(void *info)
+{
+}
+
+static const cpumask_t *sgx_encl_ewb_cpumask(struct sgx_encl *encl)
+{
+ cpumask_t *cpumask = &encl->cpumask;
+ struct sgx_encl_mm *encl_mm;
+ int idx;
+
+ /*
+ * Can race with sgx_encl_mm_add(), but ETRACK has already been
+ * executed, which means that the CPUs running in the new mm will enter
+ * into the enclave with a fresh epoch.
+ */
+ cpumask_clear(cpumask);
+
+ idx = srcu_read_lock(&encl->srcu);
+
+ list_for_each_entry_rcu(encl_mm, &encl->mm_list, list) {
+ if (!mmget_not_zero(encl_mm->mm))
+ continue;
+
+ cpumask_or(cpumask, cpumask, mm_cpumask(encl_mm->mm));
+
+ mmput_async(encl_mm->mm);
+ }
+
+ srcu_read_unlock(&encl->srcu, idx);
+
+ return cpumask;
+}
+
+/*
+ * Swap page to the regular memory transformed to the blocked state by using
+ * EBLOCK, which means that it can no loger be referenced (no new TLB entries).
+ *
+ * The first trial just tries to write the page assuming that some other thread
+ * has reset the count for threads inside the enlave by using ETRACK, and
+ * previous thread count has been zeroed out. The second trial calls ETRACK
+ * before EWB. If that fails we kick all the HW threads out, and then do EWB,
+ * which should be guaranteed the succeed.
+ */
+static void sgx_encl_ewb(struct sgx_epc_page *epc_page,
+ struct sgx_backing *backing)
+{
+ struct sgx_encl_page *encl_page = epc_page->owner;
+ struct sgx_encl *encl = encl_page->encl;
+ struct sgx_va_page *va_page;
+ unsigned int va_offset;
+ void *va_slot;
+ int ret;
+
+ encl_page->desc &= ~SGX_ENCL_PAGE_BEING_RECLAIMED;
+
+ va_page = list_first_entry(&encl->va_pages, struct sgx_va_page,
+ list);
+ va_offset = sgx_alloc_va_slot(va_page);
+ va_slot = sgx_get_epc_addr(va_page->epc_page) + va_offset;
+ if (sgx_va_page_full(va_page))
+ list_move_tail(&va_page->list, &encl->va_pages);
+
+ ret = __sgx_encl_ewb(epc_page, va_slot, backing);
+ if (ret == SGX_NOT_TRACKED) {
+ ret = __etrack(sgx_get_epc_addr(encl->secs.epc_page));
+ if (ret) {
+ if (encls_failed(ret))
+ ENCLS_WARN(ret, "ETRACK");
+ }
+
+ ret = __sgx_encl_ewb(epc_page, va_slot, backing);
+ if (ret == SGX_NOT_TRACKED) {
+ /*
+ * Slow path, send IPIs to kick cpus out of the
+ * enclave. Note, it's imperative that the cpu
+ * mask is generated *after* ETRACK, else we'll
+ * miss cpus that entered the enclave between
+ * generating the mask and incrementing epoch.
+ */
+ on_each_cpu_mask(sgx_encl_ewb_cpumask(encl),
+ sgx_ipi_cb, NULL, 1);
+ ret = __sgx_encl_ewb(epc_page, va_slot, backing);
+ }
+ }
+
+ if (ret) {
+ if (encls_failed(ret))
+ ENCLS_WARN(ret, "EWB");
+
+ sgx_free_va_slot(va_page, va_offset);
+ } else {
+ encl_page->desc |= va_offset;
+ encl_page->va_page = va_page;
+ }
+}
+
+static void sgx_reclaimer_write(struct sgx_epc_page *epc_page,
+ struct sgx_backing *backing)
+{
+ struct sgx_encl_page *encl_page = epc_page->owner;
+ struct sgx_encl *encl = encl_page->encl;
+ struct sgx_backing secs_backing;
+ int ret;
+
+ mutex_lock(&encl->lock);
+
+ if (atomic_read(&encl->flags) & SGX_ENCL_DEAD) {
+ ret = __eremove(sgx_get_epc_addr(epc_page));
+ ENCLS_WARN(ret, "EREMOVE");
+ } else {
+ sgx_encl_ewb(epc_page, backing);
+ }
+
+ encl_page->epc_page = NULL;
+ encl->secs_child_cnt--;
+
+ if (!encl->secs_child_cnt) {
+ if (atomic_read(&encl->flags) & SGX_ENCL_DEAD) {
+ sgx_free_epc_page(encl->secs.epc_page);
+ encl->secs.epc_page = NULL;
+ } else if (atomic_read(&encl->flags) & SGX_ENCL_INITIALIZED) {
+ ret = sgx_encl_get_backing(encl, PFN_DOWN(encl->size),
+ &secs_backing);
+ if (ret)
+ goto out;
+
+ sgx_encl_ewb(encl->secs.epc_page, &secs_backing);
+
+ sgx_free_epc_page(encl->secs.epc_page);
+ encl->secs.epc_page = NULL;
+
+ sgx_encl_put_backing(&secs_backing, true);
+ }
+ }
+
+out:
+ mutex_unlock(&encl->lock);
+}
+
+/*
+ * Take a fixed number of pages from the head of the active page pool and
+ * reclaim them to the enclave's private shmem files. Skip the pages, which have
+ * been accessed since the last scan. Move those pages to the tail of active
+ * page pool so that the pages get scanned in LRU like fashion.
+ *
+ * Batch process a chunk of pages (at the moment 16) in order to degrade amount
+ * of IPI's and ETRACK's potentially required. sgx_encl_ewb() does degrade a bit
+ * among the HW threads with three stage EWB pipeline (EWB, ETRACK + EWB and IPI
+ * + EWB) but not sufficiently. Reclaiming one page at a time would also be
+ * problematic as it would increase the lock contention too much, which would
+ * halt forward progress.
+ */
+static void sgx_reclaim_pages(void)
+{
+ struct sgx_epc_page *chunk[SGX_NR_TO_SCAN];
+ struct sgx_backing backing[SGX_NR_TO_SCAN];
+ struct sgx_epc_section *section;
+ struct sgx_encl_page *encl_page;
+ struct sgx_epc_page *epc_page;
+ int cnt = 0;
+ int ret;
+ int i;
+
+ spin_lock(&sgx_active_page_list_lock);
+ for (i = 0; i < SGX_NR_TO_SCAN; i++) {
+ if (list_empty(&sgx_active_page_list))
+ break;
+
+ epc_page = list_first_entry(&sgx_active_page_list,
+ struct sgx_epc_page, list);
+ list_del_init(&epc_page->list);
+ encl_page = epc_page->owner;
+
+ if (kref_get_unless_zero(&encl_page->encl->refcount) != 0)
+ chunk[cnt++] = epc_page;
+ else
+ /* The owner is freeing the page. No need to add the
+ * page back to the list of reclaimable pages.
+ */
+ epc_page->desc &= ~SGX_EPC_PAGE_RECLAIMABLE;
+ }
+ spin_unlock(&sgx_active_page_list_lock);
+
+ for (i = 0; i < cnt; i++) {
+ epc_page = chunk[i];
+ encl_page = epc_page->owner;
+
+ if (!sgx_reclaimer_age(epc_page))
+ goto skip;
+
+ ret = sgx_encl_get_backing(encl_page->encl,
+ SGX_ENCL_PAGE_INDEX(encl_page),
+ &backing[i]);
+ if (ret)
+ goto skip;
+
+ mutex_lock(&encl_page->encl->lock);
+ encl_page->desc |= SGX_ENCL_PAGE_BEING_RECLAIMED;
+ mutex_unlock(&encl_page->encl->lock);
+ continue;
+
+skip:
+ spin_lock(&sgx_active_page_list_lock);
+ list_add_tail(&epc_page->list, &sgx_active_page_list);
+ spin_unlock(&sgx_active_page_list_lock);
+
+ kref_put(&encl_page->encl->refcount, sgx_encl_release);
+
+ chunk[i] = NULL;
+ }
+
+ for (i = 0; i < cnt; i++) {
+ epc_page = chunk[i];
+ if (epc_page)
+ sgx_reclaimer_block(epc_page);
+ }
+
+ for (i = 0; i < cnt; i++) {
+ epc_page = chunk[i];
+ if (!epc_page)
+ continue;
+
+ encl_page = epc_page->owner;
+ sgx_reclaimer_write(epc_page, &backing[i]);
+ sgx_encl_put_backing(&backing[i], true);
+
+ kref_put(&encl_page->encl->refcount, sgx_encl_release);
+ epc_page->desc &= ~SGX_EPC_PAGE_RECLAIMABLE;
+
+ section = sgx_get_epc_section(epc_page);
+ spin_lock(§ion->lock);
+ list_add_tail(&epc_page->list, §ion->page_list);
+ section->free_cnt++;
+ spin_unlock(§ion->lock);
+ }
+}
+
static void sgx_sanitize_section(struct sgx_epc_section *section)
{
@@ -44,6 +433,23 @@ static void sgx_sanitize_section(struct sgx_epc_section *section)
}
}
+static unsigned long sgx_nr_free_pages(void)
+{
+ unsigned long cnt = 0;
+ int i;
+
+ for (i = 0; i < sgx_nr_epc_sections; i++)
+ cnt += sgx_epc_sections[i].free_cnt;
+
+ return cnt;
+}
+
+static bool sgx_should_reclaim(unsigned long watermark)
+{
+ return sgx_nr_free_pages() < watermark &&
+ !list_empty(&sgx_active_page_list);
+}
+
static int ksgxswapd(void *p)
{
int i;
@@ -69,6 +475,20 @@ static int ksgxswapd(void *p)
WARN(1, "EPC section %d has unsanitized pages.\n", i);
}
+ while (!kthread_should_stop()) {
+ if (try_to_freeze())
+ continue;
+
+ wait_event_freezable(ksgxswapd_waitq,
+ kthread_should_stop() ||
+ sgx_should_reclaim(SGX_NR_HIGH_PAGES));
+
+ if (sgx_should_reclaim(SGX_NR_HIGH_PAGES))
+ sgx_reclaim_pages();
+
+ cond_resched();
+ }
+
return 0;
}
@@ -94,6 +514,7 @@ static struct sgx_epc_page *__sgx_alloc_epc_page_from_section(struct sgx_epc_sec
page = list_first_entry(§ion->page_list, struct sgx_epc_page, list);
list_del_init(&page->list);
+ section->free_cnt--;
return page;
}
@@ -127,6 +548,57 @@ struct sgx_epc_page *__sgx_alloc_epc_page(void)
return ERR_PTR(-ENOMEM);
}
+/**
+ * sgx_alloc_epc_page() - Allocate an EPC page
+ * @owner: the owner of the EPC page
+ * @reclaim: reclaim pages if necessary
+ *
+ * Iterate through EPC sections and borrow a free EPC page to the caller. When a
+ * page is no longer needed it must be released with sgx_free_epc_page(). If
+ * @reclaim is set to true, directly reclaim pages when we are out of pages. No
+ * mm's can be locked when @reclaim is set to true.
+ *
+ * Finally, wake up ksgxswapd when the number of pages goes below the watermark
+ * before returning back to the caller.
+ *
+ * Return:
+ * an EPC page,
+ * -errno on error
+ */
+struct sgx_epc_page *sgx_alloc_epc_page(void *owner, bool reclaim)
+{
+ struct sgx_epc_page *entry;
+
+ for ( ; ; ) {
+ entry = __sgx_alloc_epc_page();
+ if (!IS_ERR(entry)) {
+ entry->owner = owner;
+ break;
+ }
+
+ if (list_empty(&sgx_active_page_list))
+ return ERR_PTR(-ENOMEM);
+
+ if (!reclaim) {
+ entry = ERR_PTR(-EBUSY);
+ break;
+ }
+
+ if (signal_pending(current)) {
+ entry = ERR_PTR(-ERESTARTSYS);
+ break;
+ }
+
+ sgx_reclaim_pages();
+ schedule();
+ }
+
+ if (sgx_should_reclaim(SGX_NR_LOW_PAGES))
+ wake_up(&ksgxswapd_waitq);
+
+ return entry;
+}
+
/**
* sgx_free_epc_page() - Free an EPC page
* @page: an EPC page
@@ -138,12 +610,20 @@ void sgx_free_epc_page(struct sgx_epc_page *page)
struct sgx_epc_section *section = sgx_get_epc_section(page);
int ret;
+ /*
+ * Don't take sgx_active_page_list_lock when asserting the page isn't
+ * reclaimable, missing a WARN in the very rare case is preferable to
+ * unnecessarily taking a global lock in the common case.
+ */
+ WARN_ON_ONCE(page->desc & SGX_EPC_PAGE_RECLAIMABLE);
+
ret = __eremove(sgx_get_epc_addr(page));
if (WARN_ONCE(ret, "EREMOVE returned %d (0x%x)", ret, ret))
return;
spin_lock(§ion->lock);
list_add_tail(&page->list, §ion->page_list);
+ section->free_cnt++;
spin_unlock(§ion->lock);
}
@@ -194,6 +674,7 @@ static bool __init sgx_setup_epc_section(u64 addr, u64 size,
list_add_tail(&page->list, §ion->unsanitized_page_list);
}
+ section->free_cnt = nr_pages;
return true;
err_out:
diff --git a/arch/x86/kernel/cpu/sgx/sgx.h b/arch/x86/kernel/cpu/sgx/sgx.h
index 8d126070db1e..ec4f7b338dbe 100644
--- a/arch/x86/kernel/cpu/sgx/sgx.h
+++ b/arch/x86/kernel/cpu/sgx/sgx.h
@@ -15,6 +15,7 @@
struct sgx_epc_page {
unsigned long desc;
+ struct sgx_encl_page *owner;
struct list_head list;
};
@@ -27,6 +28,7 @@ struct sgx_epc_page {
struct sgx_epc_section {
unsigned long pa;
void *va;
+ unsigned long free_cnt;
struct list_head page_list;
struct list_head unsanitized_page_list;
spinlock_t lock;
@@ -35,6 +37,10 @@ struct sgx_epc_section {
#define SGX_EPC_SECTION_MASK GENMASK(7, 0)
#define SGX_MAX_EPC_SECTIONS (SGX_EPC_SECTION_MASK + 1)
#define SGX_MAX_ADD_PAGES_LENGTH 0x100000
+#define SGX_EPC_PAGE_RECLAIMABLE BIT(8)
+#define SGX_NR_TO_SCAN 16
+#define SGX_NR_LOW_PAGES 32
+#define SGX_NR_HIGH_PAGES 64
extern struct sgx_epc_section sgx_epc_sections[SGX_MAX_EPC_SECTIONS];
@@ -50,7 +56,10 @@ static inline void *sgx_get_epc_addr(struct sgx_epc_page *page)
return section->va + (page->desc & PAGE_MASK) - section->pa;
}
+void sgx_mark_page_reclaimable(struct sgx_epc_page *page);
+int sgx_unmark_page_reclaimable(struct sgx_epc_page *page);
struct sgx_epc_page *__sgx_alloc_epc_page(void);
+struct sgx_epc_page *sgx_alloc_epc_page(void *owner, bool reclaim);
void sgx_free_epc_page(struct sgx_epc_page *page);
#endif /* _X86_SGX_H */
--
2.25.1
When I turn on CONFIG_PROVE_LOCKING, kernel reports following suspicious
RCU usages. Not sure if it is an issue. Just reporting here:
[ +34.337095] =============================
[ +0.000001] WARNING: suspicious RCU usage
[ +0.000002] 5.9.0-rc6-lock-sgx39 #1 Not tainted
[ +0.000001] -----------------------------
[ +0.000001] ./include/linux/xarray.h:1165 suspicious
rcu_dereference_check() usage!
[ +0.000001]
other info that might help us debug this:
[ +0.000001]
rcu_scheduler_active = 2, debug_locks = 1
[ +0.000001] 1 lock held by enclaveos-runne/4238:
[ +0.000001] #0: ffff9cc6657e45e8 (&mm->mmap_lock#2){++++}-{3:3}, at:
vm_mmap_pgoff+0xa1/0x120
[ +0.000005]
stack backtrace:
[ +0.000002] CPU: 1 PID: 4238 Comm: enclaveos-runne Not tainted
5.9.0-rc6-lock-sgx39 #1
[ +0.000001] Hardware name: Microsoft Corporation Virtual Machine/Virtual
Machine, BIOS Hyper-V UEFI Release v4.1 04/02/2020
[ +0.000002] Call Trace:
[ +0.000003] dump_stack+0x7d/0x9f
[ +0.000003] lockdep_rcu_suspicious+0xce/0xf0
[ +0.000004] xas_start+0x14c/0x1c0
[ +0.000003] xas_load+0xf/0x50
[ +0.000002] xas_find+0x25c/0x2c0
[ +0.000004] sgx_encl_may_map+0x87/0x1c0
[ +0.000006] sgx_mmap+0x29/0x70
[ +0.000003] mmap_region+0x3ee/0x710
[ +0.000006] do_mmap+0x3f1/0x5e0
[ +0.000004] vm_mmap_pgoff+0xcd/0x120
[ +0.000007] ksys_mmap_pgoff+0x1de/0x240
[ +0.000005] __x64_sys_mmap+0x33/0x40
[ +0.000002] do_syscall_64+0x37/0x80
[ +0.000003] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ +0.000002] RIP: 0033:0x7fe34efe06ba
[ +0.000002] Code: 89 f5 41 54 49 89 fc 55 53 74 35 49 63 e8 48 63 da 4d
89 f9 49 89 e8 4d 63 d6 48 89 da 4c 89 ee 4c 89 e7 b8 09 00 00 00 0f 05
<48> 3d 00 f0 ff ff 77 56 5b 5d 41 5c 41 5d 41 5e 41 5f c3 0f 1f 00
[ +0.000001] RSP: 002b:00007ffee83eac08 EFLAGS: 00000206 ORIG_RAX:
0000000000000009
[ +0.000001] RAX: ffffffffffffffda RBX: 0000000000000001 RCX:
00007fe34efe06ba
[ +0.000001] RDX: 0000000000000001 RSI: 0000000000001000 RDI:
0000000007fff000
[ +0.000001] RBP: 0000000000000004 R08: 0000000000000004 R09:
0000000000000000
[ +0.000001] R10: 0000000000000011 R11: 0000000000000206 R12:
0000000007fff000
[ +0.000001] R13: 0000000000001000 R14: 0000000000000011 R15:
0000000000000000
[ +0.000010] =============================
[ +0.000001] WARNING: suspicious RCU usage
[ +0.000001] 5.9.0-rc6-lock-sgx39 #1 Not tainted
[ +0.000001] -----------------------------
[ +0.000001] ./include/linux/xarray.h:1181 suspicious
rcu_dereference_check() usage!
[ +0.000001]
other info that might help us debug this:
[ +0.000001]
rcu_scheduler_active = 2, debug_locks = 1
[ +0.000001] 1 lock held by enclaveos-runne/4238:
[ +0.000001] #0: ffff9cc6657e45e8 (&mm->mmap_lock#2){++++}-{3:3}, at:
vm_mmap_pgoff+0xa1/0x120
[ +0.000003]
stack backtrace:
[ +0.000001] CPU: 1 PID: 4238 Comm: enclaveos-runne Not tainted
5.9.0-rc6-lock-sgx39 #1
[ +0.000001] Hardware name: Microsoft Corporation Virtual Machine/Virtual
Machine, BIOS Hyper-V UEFI Release v4.1 04/02/2020
[ +0.000001] Call Trace:
[ +0.000001] dump_stack+0x7d/0x9f
[ +0.000003] lockdep_rcu_suspicious+0xce/0xf0
[ +0.000003] xas_descend+0x116/0x120
[ +0.000004] xas_load+0x42/0x50
[ +0.000002] xas_find+0x25c/0x2c0
[ +0.000004] sgx_encl_may_map+0x87/0x1c0
[ +0.000006] sgx_mmap+0x29/0x70
[ +0.000002] mmap_region+0x3ee/0x710
[ +0.000006] do_mmap+0x3f1/0x5e0
[ +0.000004] vm_mmap_pgoff+0xcd/0x120
[ +0.000007] ksys_mmap_pgoff+0x1de/0x240
[ +0.000005] __x64_sys_mmap+0x33/0x40
[ +0.000002] do_syscall_64+0x37/0x80
[ +0.000002] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ +0.000001] RIP: 0033:0x7fe34efe06ba
[ +0.000001] Code: 89 f5 41 54 49 89 fc 55 53 74 35 49 63 e8 48 63 da 4d
89 f9 49 89 e8 4d 63 d6 48 89 da 4c 89 ee 4c 89 e7 b8 09 00 00 00 0f 05
<48> 3d 00 f0 ff ff 77 56 5b 5d 41 5c 41 5d 41 5e 41 5f c3 0f 1f 00
[ +0.000001] RSP: 002b:00007ffee83eac08 EFLAGS: 00000206 ORIG_RAX:
0000000000000009
[ +0.000001] RAX: ffffffffffffffda RBX: 0000000000000001 RCX:
00007fe34efe06ba
[ +0.000001] RDX: 0000000000000001 RSI: 0000000000001000 RDI:
0000000007fff000
[ +0.000001] RBP: 0000000000000004 R08: 0000000000000004 R09:
0000000000000000
[ +0.000001] R10: 0000000000000011 R11: 0000000000000206 R12:
0000000007fff000
[ +0.000001] R13: 0000000000001000 R14: 0000000000000011 R15:
0000000000000000
[ +0.001117] =============================
[ +0.000001] WARNING: suspicious RCU usage
[ +0.000001] 5.9.0-rc6-lock-sgx39 #1 Not tainted
[ +0.000001] -----------------------------
[ +0.000001] ./include/linux/xarray.h:1181 suspicious
rcu_dereference_check() usage!
[ +0.000001]
other info that might help us debug this:
[ +0.000001]
rcu_scheduler_active = 2, debug_locks = 1
[ +0.000001] 1 lock held by enclaveos-runne/4238:
[ +0.000001] #0: ffff9cc6657e45e8 (&mm->mmap_lock#2){++++}-{3:3}, at:
vm_mmap_pgoff+0xa1/0x120
[ +0.000003]
stack backtrace:
[ +0.000002] CPU: 1 PID: 4238 Comm: enclaveos-runne Not tainted
5.9.0-rc6-lock-sgx39 #1
[ +0.000001] Hardware name: Microsoft Corporation Virtual Machine/Virtual
Machine, BIOS Hyper-V UEFI Release v4.1 04/02/2020
[ +0.000001] Call Trace:
[ +0.000002] dump_stack+0x7d/0x9f
[ +0.000003] lockdep_rcu_suspicious+0xce/0xf0
[ +0.000003] sgx_encl_may_map+0x1b0/0x1c0
[ +0.000006] sgx_mmap+0x29/0x70
[ +0.000002] mmap_region+0x3ee/0x710
[ +0.000006] do_mmap+0x3f1/0x5e0
[ +0.000005] vm_mmap_pgoff+0xcd/0x120
[ +0.000006] ksys_mmap_pgoff+0x1de/0x240
[ +0.000005] __x64_sys_mmap+0x33/0x40
[ +0.000002] do_syscall_64+0x37/0x80
[ +0.000002] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ +0.000002] RIP: 0033:0x7fe34efe06ba
[ +0.000001] Code: 89 f5 41 54 49 89 fc 55 53 74 35 49 63 e8 48 63 da 4d
89 f9 49 89 e8 4d 63 d6 48 89 da 4c 89 ee 4c 89 e7 b8 09 00 00 00 0f 05
<48> 3d 00 f0 ff ff 77 56 5b 5d 41 5c 41 5d 41 5e 41 5f c3 0f 1f 00
[ +0.000001] RSP: 002b:00007ffee83eac08 EFLAGS: 00000206 ORIG_RAX:
0000000000000009
[ +0.000001] RAX: ffffffffffffffda RBX: 0000000000000003 RCX:
00007fe34efe06ba
[ +0.000001] RDX: 0000000000000003 RSI: 0000000000010000 RDI:
0000000007fee000
[ +0.000001] RBP: 0000000000000004 R08: 0000000000000004 R09:
0000000000000000
[ +0.000001] R10: 0000000000000011 R11: 0000000000000206 R12:
0000000007fee000
[ +0.000001] R13: 0000000000010000 R14: 0000000000000011 R15:
0000000000000000
[ +0.003197] =============================
[ +0.000001] WARNING: suspicious RCU usage
[ +0.000001] 5.9.0-rc6-lock-sgx39 #1 Not tainted
[ +0.000001] -----------------------------
[ +0.000001] ./include/linux/xarray.h:1198 suspicious
rcu_dereference_check() usage!
[ +0.000001]
other info that might help us debug this:
[ +0.000001]
rcu_scheduler_active = 2, debug_locks = 1
[ +0.000001] 1 lock held by enclaveos-runne/4238:
[ +0.000001] #0: ffff9cc6657e45e8 (&mm->mmap_lock#2){++++}-{3:3}, at:
vm_mmap_pgoff+0xa1/0x120
[ +0.000003]
stack backtrace:
[ +0.000002] CPU: 1 PID: 4238 Comm: enclaveos-runne Not tainted
5.9.0-rc6-lock-sgx39 #1
[ +0.000001] Hardware name: Microsoft Corporation Virtual Machine/Virtual
Machine, BIOS Hyper-V UEFI Release v4.1 04/02/2020
[ +0.000001] Call Trace:
[ +0.000002] dump_stack+0x7d/0x9f
[ +0.000003] lockdep_rcu_suspicious+0xce/0xf0
[ +0.000004] xas_find+0x255/0x2c0
[ +0.000003] sgx_encl_may_map+0xad/0x1c0
[ +0.000006] sgx_mmap+0x29/0x70
[ +0.000003] mmap_region+0x3ee/0x710
[ +0.000005] do_mmap+0x3f1/0x5e0
[ +0.000005] vm_mmap_pgoff+0xcd/0x120
[ +0.000007] ksys_mmap_pgoff+0x1de/0x240
[ +0.000004] __x64_sys_mmap+0x33/0x40
[ +0.000002] do_syscall_64+0x37/0x80
[ +0.000002] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ +0.000002] RIP: 0033:0x7fe34efe06ba
[ +0.000001] Code: 89 f5 41 54 49 89 fc 55 53 74 35 49 63 e8 48 63 da 4d
89 f9 49 89 e8 4d 63 d6 48 89 da 4c 89 ee 4c 89 e7 b8 09 00 00 00 0f 05
<48> 3d 00 f0 ff ff 77 56 5b 5d 41 5c 41 5d 41 5e 41 5f c3 0f 1f 00
[ +0.000001] RSP: 002b:00007ffee83eac08 EFLAGS: 00000206 ORIG_RAX:
0000000000000009
[ +0.000002] RAX: ffffffffffffffda RBX: 0000000000000003 RCX:
00007fe34efe06ba
[ +0.000001] RDX: 0000000000000003 RSI: 0000000000010000 RDI:
0000000007fba000
[ +0.000001] RBP: 0000000000000004 R08: 0000000000000004 R09:
0000000000000000
[ +0.000001] R10: 0000000000000011 R11: 0000000000000206 R12:
0000000007fba000
[ +0.000001] R13: 0000000000010000 R14: 0000000000000011 R15:
0000000000000000
On Fri, 02 Oct 2020 23:50:51 -0500, Jarkko Sakkinen
<[email protected]> wrote:
> There is a limited amount of EPC available. Therefore, some of it must be
> copied to the regular memory, and only subset kept in the SGX reserved
> memory. While kernel cannot directly access enclave memory, SGX provides
> a
> set of ENCLS leaf functions to perform reclaiming.
>
> Implement a page reclaimer by using these leaf functions. It picks the
> victim pages in LRU fashion from all the enclaves running in the system.
> The thread ksgxswapd reclaims pages on the event when the number of free
> EPC pages goes below SGX_NR_LOW_PAGES up until it reaches
> SGX_NR_HIGH_PAGES.
>
> sgx_alloc_epc_page() can optionally directly reclaim pages with @reclaim
> set true. A caller must also supply owner for each page so that the
> reclaimer can access the associated enclaves. This is needed for locking,
> as most of the ENCLS leafs cannot be executed concurrently for an
> enclave.
> The owner is also needed for accessing SECS, which is required to be
> resident when its child pages are being reclaimed.
>
> Cc: [email protected]
> Acked-by: Jethro Beekman <[email protected]>
> Tested-by: Jethro Beekman <[email protected]>
> Tested-by: Jordan Hand <[email protected]>
> Tested-by: Nathaniel McCallum <[email protected]>
> Tested-by: Chunyang Hui <[email protected]>
> Tested-by: Seth Moore <[email protected]>
> Co-developed-by: Sean Christopherson <[email protected]>
> Signed-off-by: Sean Christopherson <[email protected]>
> Signed-off-by: Jarkko Sakkinen <[email protected]>
> ---
> arch/x86/kernel/cpu/sgx/driver.c | 1 +
> arch/x86/kernel/cpu/sgx/encl.c | 344 +++++++++++++++++++++-
> arch/x86/kernel/cpu/sgx/encl.h | 41 +++
> arch/x86/kernel/cpu/sgx/ioctl.c | 78 ++++-
> arch/x86/kernel/cpu/sgx/main.c | 481 +++++++++++++++++++++++++++++++
> arch/x86/kernel/cpu/sgx/sgx.h | 9 +
> 6 files changed, 947 insertions(+), 7 deletions(-)
>
> diff --git a/arch/x86/kernel/cpu/sgx/driver.c
> b/arch/x86/kernel/cpu/sgx/driver.c
> index d01b28f7ce4a..0446781cc7a2 100644
> --- a/arch/x86/kernel/cpu/sgx/driver.c
> +++ b/arch/x86/kernel/cpu/sgx/driver.c
> @@ -29,6 +29,7 @@ static int sgx_open(struct inode *inode, struct file
> *file)
> atomic_set(&encl->flags, 0);
> kref_init(&encl->refcount);
> xa_init(&encl->page_array);
> + INIT_LIST_HEAD(&encl->va_pages);
> mutex_init(&encl->lock);
> INIT_LIST_HEAD(&encl->mm_list);
> spin_lock_init(&encl->mm_lock);
> diff --git a/arch/x86/kernel/cpu/sgx/encl.c
> b/arch/x86/kernel/cpu/sgx/encl.c
> index c2c4a77af36b..54326efa6c2f 100644
> --- a/arch/x86/kernel/cpu/sgx/encl.c
> +++ b/arch/x86/kernel/cpu/sgx/encl.c
> @@ -12,9 +12,88 @@
> #include "encls.h"
> #include "sgx.h"
> +/*
> + * ELDU: Load an EPC page as unblocked. For more info, see "OS
> Management of EPC
> + * Pages" in the SDM.
> + */
> +static int __sgx_encl_eldu(struct sgx_encl_page *encl_page,
> + struct sgx_epc_page *epc_page,
> + struct sgx_epc_page *secs_page)
> +{
> + unsigned long va_offset = SGX_ENCL_PAGE_VA_OFFSET(encl_page);
> + struct sgx_encl *encl = encl_page->encl;
> + struct sgx_pageinfo pginfo;
> + struct sgx_backing b;
> + pgoff_t page_index;
> + int ret;
> +
> + if (secs_page)
> + page_index = SGX_ENCL_PAGE_INDEX(encl_page);
> + else
> + page_index = PFN_DOWN(encl->size);
> +
> + ret = sgx_encl_get_backing(encl, page_index, &b);
> + if (ret)
> + return ret;
> +
> + pginfo.addr = SGX_ENCL_PAGE_ADDR(encl_page);
> + pginfo.contents = (unsigned long)kmap_atomic(b.contents);
> + pginfo.metadata = (unsigned long)kmap_atomic(b.pcmd) +
> + b.pcmd_offset;
> +
> + if (secs_page)
> + pginfo.secs = (u64)sgx_get_epc_addr(secs_page);
> + else
> + pginfo.secs = 0;
> +
> + ret = __eldu(&pginfo, sgx_get_epc_addr(epc_page),
> + sgx_get_epc_addr(encl_page->va_page->epc_page) +
> + va_offset);
> + if (ret) {
> + if (encls_failed(ret))
> + ENCLS_WARN(ret, "ELDU");
> +
> + ret = -EFAULT;
> + }
> +
> + kunmap_atomic((void *)(unsigned long)(pginfo.metadata -
> b.pcmd_offset));
> + kunmap_atomic((void *)(unsigned long)pginfo.contents);
> +
> + sgx_encl_put_backing(&b, false);
> +
> + return ret;
> +}
> +
> +static struct sgx_epc_page *sgx_encl_eldu(struct sgx_encl_page
> *encl_page,
> + struct sgx_epc_page *secs_page)
> +{
> + unsigned long va_offset = SGX_ENCL_PAGE_VA_OFFSET(encl_page);
> + struct sgx_encl *encl = encl_page->encl;
> + struct sgx_epc_page *epc_page;
> + int ret;
> +
> + epc_page = sgx_alloc_epc_page(encl_page, false);
> + if (IS_ERR(epc_page))
> + return epc_page;
> +
> + ret = __sgx_encl_eldu(encl_page, epc_page, secs_page);
> + if (ret) {
> + sgx_free_epc_page(epc_page);
> + return ERR_PTR(ret);
> + }
> +
> + sgx_free_va_slot(encl_page->va_page, va_offset);
> + list_move(&encl_page->va_page->list, &encl->va_pages);
> + encl_page->desc &= ~SGX_ENCL_PAGE_VA_OFFSET_MASK;
> + encl_page->epc_page = epc_page;
> +
> + return epc_page;
> +}
> +
> static struct sgx_encl_page *sgx_encl_load_page(struct sgx_encl *encl,
> unsigned long addr)
> {
> + struct sgx_epc_page *epc_page;
> struct sgx_encl_page *entry;
> unsigned int flags;
> @@ -33,10 +112,27 @@ static struct sgx_encl_page
> *sgx_encl_load_page(struct sgx_encl *encl,
> return ERR_PTR(-EFAULT);
> /* Page is already resident in the EPC. */
> - if (entry->epc_page)
> + if (entry->epc_page) {
> + if (entry->desc & SGX_ENCL_PAGE_BEING_RECLAIMED)
> + return ERR_PTR(-EBUSY);
> +
> return entry;
> + }
> +
> + if (!(encl->secs.epc_page)) {
> + epc_page = sgx_encl_eldu(&encl->secs, NULL);
> + if (IS_ERR(epc_page))
> + return ERR_CAST(epc_page);
> + }
> - return ERR_PTR(-EFAULT);
> + epc_page = sgx_encl_eldu(entry, encl->secs.epc_page);
> + if (IS_ERR(epc_page))
> + return ERR_CAST(epc_page);
> +
> + encl->secs_child_cnt++;
> + sgx_mark_page_reclaimable(entry->epc_page);
> +
> + return entry;
> }
> static void sgx_mmu_notifier_release(struct mmu_notifier *mn,
> @@ -132,6 +228,9 @@ int sgx_encl_mm_add(struct sgx_encl *encl, struct
> mm_struct *mm)
> spin_lock(&encl->mm_lock);
> list_add_rcu(&encl_mm->list, &encl->mm_list);
> + /* Pairs with smp_rmb() in sgx_reclaimer_block(). */
> + smp_wmb();
> + encl->mm_list_version++;
> spin_unlock(&encl->mm_lock);
> return 0;
> @@ -179,6 +278,8 @@ static unsigned int sgx_vma_fault(struct vm_fault
> *vmf)
> goto out;
> }
> + sgx_encl_test_and_clear_young(vma->vm_mm, entry);
> +
> out:
> mutex_unlock(&encl->lock);
> return ret;
> @@ -280,6 +381,7 @@ int sgx_encl_find(struct mm_struct *mm, unsigned
> long addr,
> */
> void sgx_encl_destroy(struct sgx_encl *encl)
> {
> + struct sgx_va_page *va_page;
> struct sgx_encl_page *entry;
> unsigned long index;
> @@ -287,6 +389,13 @@ void sgx_encl_destroy(struct sgx_encl *encl)
> xa_for_each(&encl->page_array, index, entry) {
> if (entry->epc_page) {
> + /*
> + * The page and its radix tree entry cannot be freed
> + * if the page is being held by the reclaimer.
> + */
> + if (sgx_unmark_page_reclaimable(entry->epc_page))
> + continue;
> +
> sgx_free_epc_page(entry->epc_page);
> encl->secs_child_cnt--;
> entry->epc_page = NULL;
> @@ -301,6 +410,19 @@ void sgx_encl_destroy(struct sgx_encl *encl)
> sgx_free_epc_page(encl->secs.epc_page);
> encl->secs.epc_page = NULL;
> }
> +
> + /*
> + * The reclaimer is responsible for checking SGX_ENCL_DEAD before doing
> + * EWB, thus it's safe to free VA pages even if the reclaimer holds a
> + * reference to the enclave.
> + */
> + while (!list_empty(&encl->va_pages)) {
> + va_page = list_first_entry(&encl->va_pages, struct sgx_va_page,
> + list);
> + list_del(&va_page->list);
> + sgx_free_epc_page(va_page->epc_page);
> + kfree(va_page);
> + }
> }
> /**
> @@ -329,3 +451,221 @@ void sgx_encl_release(struct kref *ref)
> kfree(encl);
> }
> +
> +static struct page *sgx_encl_get_backing_page(struct sgx_encl *encl,
> + pgoff_t index)
> +{
> + struct inode *inode = encl->backing->f_path.dentry->d_inode;
> + struct address_space *mapping = inode->i_mapping;
> + gfp_t gfpmask = mapping_gfp_mask(mapping);
> +
> + return shmem_read_mapping_page_gfp(mapping, index, gfpmask);
> +}
> +
> +/**
> + * sgx_encl_get_backing() - Pin the backing storage
> + * @encl: an enclave pointer
> + * @page_index: enclave page index
> + * @backing: data for accessing backing storage for the page
> + *
> + * Pin the backing storage pages for storing the encrypted contents and
> Paging
> + * Crypto MetaData (PCMD) of an enclave page.
> + *
> + * Return:
> + * 0 on success,
> + * -errno otherwise.
> + */
> +int sgx_encl_get_backing(struct sgx_encl *encl, unsigned long
> page_index,
> + struct sgx_backing *backing)
> +{
> + pgoff_t pcmd_index = PFN_DOWN(encl->size) + 1 + (page_index >> 5);
> + struct page *contents;
> + struct page *pcmd;
> +
> + contents = sgx_encl_get_backing_page(encl, page_index);
> + if (IS_ERR(contents))
> + return PTR_ERR(contents);
> +
> + pcmd = sgx_encl_get_backing_page(encl, pcmd_index);
> + if (IS_ERR(pcmd)) {
> + put_page(contents);
> + return PTR_ERR(pcmd);
> + }
> +
> + backing->page_index = page_index;
> + backing->contents = contents;
> + backing->pcmd = pcmd;
> + backing->pcmd_offset =
> + (page_index & (PAGE_SIZE / sizeof(struct sgx_pcmd) - 1)) *
> + sizeof(struct sgx_pcmd);
> +
> + return 0;
> +}
> +
> +/**
> + * sgx_encl_put_backing() - Unpin the backing storage
> + * @backing: data for accessing backing storage for the page
> + * @do_write: mark pages dirty
> + */
> +void sgx_encl_put_backing(struct sgx_backing *backing, bool do_write)
> +{
> + if (do_write) {
> + set_page_dirty(backing->pcmd);
> + set_page_dirty(backing->contents);
> + }
> +
> + put_page(backing->pcmd);
> + put_page(backing->contents);
> +}
> +
> +static int sgx_encl_test_and_clear_young_cb(pte_t *ptep, unsigned long
> addr,
> + void *data)
> +{
> + pte_t pte;
> + int ret;
> +
> + ret = pte_young(*ptep);
> + if (ret) {
> + pte = pte_mkold(*ptep);
> + set_pte_at((struct mm_struct *)data, addr, ptep, pte);
> + }
> +
> + return ret;
> +}
> +
> +/**
> + * sgx_encl_test_and_clear_young() - Test and reset the accessed bit
> + * @mm: mm_struct that is checked
> + * @page: enclave page to be tested for recent access
> + *
> + * Checks the Access (A) bit from the PTE corresponding to the enclave
> page and
> + * clears it.
> + *
> + * Return: 1 if the page has been recently accessed and 0 if not.
> + */
> +int sgx_encl_test_and_clear_young(struct mm_struct *mm,
> + struct sgx_encl_page *page)
> +{
> + unsigned long addr = SGX_ENCL_PAGE_ADDR(page);
> + struct sgx_encl *encl = page->encl;
> + struct vm_area_struct *vma;
> + int ret;
> +
> + ret = sgx_encl_find(mm, addr, &vma);
> + if (ret)
> + return 0;
> +
> + if (encl != vma->vm_private_data)
> + return 0;
> +
> + ret = apply_to_page_range(vma->vm_mm, addr, PAGE_SIZE,
> + sgx_encl_test_and_clear_young_cb, vma->vm_mm);
> + if (ret < 0)
> + return 0;
> +
> + return ret;
> +}
> +
> +/**
> + * sgx_encl_reserve_page() - Reserve an enclave page
> + * @encl: an enclave pointer
> + * @addr: a page address
> + *
> + * Load an enclave page and lock the enclave so that the page can be
> used by
> + * EDBG* and EMOD*.
> + *
> + * Return:
> + * an enclave page on success
> + * -EFAULT if the load fails
> + */
> +struct sgx_encl_page *sgx_encl_reserve_page(struct sgx_encl *encl,
> + unsigned long addr)
> +{
> + struct sgx_encl_page *entry;
> +
> + for ( ; ; ) {
> + mutex_lock(&encl->lock);
> +
> + entry = sgx_encl_load_page(encl, addr);
> + if (PTR_ERR(entry) != -EBUSY)
> + break;
> +
> + mutex_unlock(&encl->lock);
> + }
> +
> + if (IS_ERR(entry))
> + mutex_unlock(&encl->lock);
> +
> + return entry;
> +}
> +
> +/**
> + * sgx_alloc_va_page() - Allocate a Version Array (VA) page
> + *
> + * Allocate a free EPC page and convert it to a Version Array (VA) page.
> + *
> + * Return:
> + * a VA page,
> + * -errno otherwise
> + */
> +struct sgx_epc_page *sgx_alloc_va_page(void)
> +{
> + struct sgx_epc_page *epc_page;
> + int ret;
> +
> + epc_page = sgx_alloc_epc_page(NULL, true);
> + if (IS_ERR(epc_page))
> + return ERR_CAST(epc_page);
> +
> + ret = __epa(sgx_get_epc_addr(epc_page));
> + if (ret) {
> + WARN_ONCE(1, "EPA returned %d (0x%x)", ret, ret);
> + sgx_free_epc_page(epc_page);
> + return ERR_PTR(-EFAULT);
> + }
> +
> + return epc_page;
> +}
> +
> +/**
> + * sgx_alloc_va_slot - allocate a VA slot
> + * @va_page: a &struct sgx_va_page instance
> + *
> + * Allocates a slot from a &struct sgx_va_page instance.
> + *
> + * Return: offset of the slot inside the VA page
> + */
> +unsigned int sgx_alloc_va_slot(struct sgx_va_page *va_page)
> +{
> + int slot = find_first_zero_bit(va_page->slots, SGX_VA_SLOT_COUNT);
> +
> + if (slot < SGX_VA_SLOT_COUNT)
> + set_bit(slot, va_page->slots);
> +
> + return slot << 3;
> +}
> +
> +/**
> + * sgx_free_va_slot - free a VA slot
> + * @va_page: a &struct sgx_va_page instance
> + * @offset: offset of the slot inside the VA page
> + *
> + * Frees a slot from a &struct sgx_va_page instance.
> + */
> +void sgx_free_va_slot(struct sgx_va_page *va_page, unsigned int offset)
> +{
> + clear_bit(offset >> 3, va_page->slots);
> +}
> +
> +/**
> + * sgx_va_page_full - is the VA page full?
> + * @va_page: a &struct sgx_va_page instance
> + *
> + * Return: true if all slots have been taken
> + */
> +bool sgx_va_page_full(struct sgx_va_page *va_page)
> +{
> + int slot = find_first_zero_bit(va_page->slots, SGX_VA_SLOT_COUNT);
> +
> + return slot == SGX_VA_SLOT_COUNT;
> +}
> diff --git a/arch/x86/kernel/cpu/sgx/encl.h
> b/arch/x86/kernel/cpu/sgx/encl.h
> index 0448d22d3010..e8eb9e9a834e 100644
> --- a/arch/x86/kernel/cpu/sgx/encl.h
> +++ b/arch/x86/kernel/cpu/sgx/encl.h
> @@ -19,6 +19,10 @@
> /**
> * enum sgx_encl_page_desc - defines bits for an enclave page's
> descriptor
> + * %SGX_ENCL_PAGE_BEING_RECLAIMED: The page is in the process of being
> + * reclaimed.
> + * %SGX_ENCL_PAGE_VA_OFFSET_MASK: Holds the offset in the Version Array
> + * (VA) page for a swapped page.
> * %SGX_ENCL_PAGE_ADDR_MASK: Holds the virtual address of the page.
> *
> * The page address for SECS is zero and is used by the subsystem to
> recognize
> @@ -26,16 +30,23 @@
> */
> enum sgx_encl_page_desc {
> /* Bits 11:3 are available when the page is not swapped. */
> + SGX_ENCL_PAGE_BEING_RECLAIMED = BIT(3),
> + SGX_ENCL_PAGE_VA_OFFSET_MASK = GENMASK_ULL(11, 3),
> SGX_ENCL_PAGE_ADDR_MASK = PAGE_MASK,
> };
> #define SGX_ENCL_PAGE_ADDR(page) \
> ((page)->desc & SGX_ENCL_PAGE_ADDR_MASK)
> +#define SGX_ENCL_PAGE_VA_OFFSET(page) \
> + ((page)->desc & SGX_ENCL_PAGE_VA_OFFSET_MASK)
> +#define SGX_ENCL_PAGE_INDEX(page) \
> + PFN_DOWN((page)->desc - (page)->encl->base)
> struct sgx_encl_page {
> unsigned long desc;
> unsigned long vm_max_prot_bits;
> struct sgx_epc_page *epc_page;
> + struct sgx_va_page *va_page;
> struct sgx_encl *encl;
> };
> @@ -61,6 +72,7 @@ struct sgx_encl {
> struct mutex lock;
> struct list_head mm_list;
> spinlock_t mm_lock;
> + unsigned long mm_list_version;
> struct file *backing;
> struct kref refcount;
> struct srcu_struct srcu;
> @@ -68,12 +80,21 @@ struct sgx_encl {
> unsigned long size;
> unsigned long ssaframesize;
> struct xarray page_array;
> + struct list_head va_pages;
> struct sgx_encl_page secs;
> cpumask_t cpumask;
> unsigned long attributes;
> unsigned long attributes_mask;
> };
> +#define SGX_VA_SLOT_COUNT 512
> +
> +struct sgx_va_page {
> + struct sgx_epc_page *epc_page;
> + DECLARE_BITMAP(slots, SGX_VA_SLOT_COUNT);
> + struct list_head list;
> +};
> +
> extern const struct vm_operations_struct sgx_vm_ops;
> int sgx_encl_find(struct mm_struct *mm, unsigned long addr,
> @@ -84,4 +105,24 @@ int sgx_encl_mm_add(struct sgx_encl *encl, struct
> mm_struct *mm);
> int sgx_encl_may_map(struct sgx_encl *encl, unsigned long start,
> unsigned long end, unsigned long vm_flags);
> +struct sgx_backing {
> + pgoff_t page_index;
> + struct page *contents;
> + struct page *pcmd;
> + unsigned long pcmd_offset;
> +};
> +
> +int sgx_encl_get_backing(struct sgx_encl *encl, unsigned long
> page_index,
> + struct sgx_backing *backing);
> +void sgx_encl_put_backing(struct sgx_backing *backing, bool do_write);
> +int sgx_encl_test_and_clear_young(struct mm_struct *mm,
> + struct sgx_encl_page *page);
> +struct sgx_encl_page *sgx_encl_reserve_page(struct sgx_encl *encl,
> + unsigned long addr);
> +
> +struct sgx_epc_page *sgx_alloc_va_page(void);
> +unsigned int sgx_alloc_va_slot(struct sgx_va_page *va_page);
> +void sgx_free_va_slot(struct sgx_va_page *va_page, unsigned int offset);
> +bool sgx_va_page_full(struct sgx_va_page *va_page);
> +
> #endif /* _X86_ENCL_H */
> diff --git a/arch/x86/kernel/cpu/sgx/ioctl.c
> b/arch/x86/kernel/cpu/sgx/ioctl.c
> index 3c04798e83e5..613f6c03598e 100644
> --- a/arch/x86/kernel/cpu/sgx/ioctl.c
> +++ b/arch/x86/kernel/cpu/sgx/ioctl.c
> @@ -16,6 +16,43 @@
> #include "encl.h"
> #include "encls.h"
> +static struct sgx_va_page *sgx_encl_grow(struct sgx_encl *encl)
> +{
> + struct sgx_va_page *va_page = NULL;
> + void *err;
> +
> + BUILD_BUG_ON(SGX_VA_SLOT_COUNT !=
> + (SGX_ENCL_PAGE_VA_OFFSET_MASK >> 3) + 1);
> +
> + if (!(encl->page_cnt % SGX_VA_SLOT_COUNT)) {
> + va_page = kzalloc(sizeof(*va_page), GFP_KERNEL);
> + if (!va_page)
> + return ERR_PTR(-ENOMEM);
> +
> + va_page->epc_page = sgx_alloc_va_page();
> + if (IS_ERR(va_page->epc_page)) {
> + err = ERR_CAST(va_page->epc_page);
> + kfree(va_page);
> + return err;
> + }
> +
> + WARN_ON_ONCE(encl->page_cnt % SGX_VA_SLOT_COUNT);
> + }
> + encl->page_cnt++;
> + return va_page;
> +}
> +
> +static void sgx_encl_shrink(struct sgx_encl *encl, struct sgx_va_page
> *va_page)
> +{
> + encl->page_cnt--;
> +
> + if (va_page) {
> + sgx_free_epc_page(va_page->epc_page);
> + list_del(&va_page->list);
> + kfree(va_page);
> + }
> +}
> +
> static u32 sgx_calc_ssa_frame_size(u32 miscselect, u64 xfrm)
> {
> u32 size_max = PAGE_SIZE;
> @@ -80,15 +117,24 @@ static int sgx_validate_secs(const struct sgx_secs
> *secs)
> static int sgx_encl_create(struct sgx_encl *encl, struct sgx_secs *secs)
> {
> struct sgx_epc_page *secs_epc;
> + struct sgx_va_page *va_page;
> struct sgx_pageinfo pginfo;
> struct sgx_secinfo secinfo;
> unsigned long encl_size;
> struct file *backing;
> long ret;
> + va_page = sgx_encl_grow(encl);
> + if (IS_ERR(va_page))
> + return PTR_ERR(va_page);
> + else if (va_page)
> + list_add(&va_page->list, &encl->va_pages);
> + /* else the tail page of the VA page list had free slots. */
> +
> if (sgx_validate_secs(secs)) {
> pr_debug("invalid SECS\n");
> - return -EINVAL;
> + ret = -EINVAL;
> + goto err_out_shrink;
> }
> /* The extra page goes to SECS. */
> @@ -96,12 +142,14 @@ static int sgx_encl_create(struct sgx_encl *encl,
> struct sgx_secs *secs)
> backing = shmem_file_setup("SGX backing", encl_size + (encl_size >> 5),
> VM_NORESERVE);
> - if (IS_ERR(backing))
> - return PTR_ERR(backing);
> + if (IS_ERR(backing)) {
> + ret = PTR_ERR(backing);
> + goto err_out_shrink;
> + }
> encl->backing = backing;
> - secs_epc = __sgx_alloc_epc_page();
> + secs_epc = sgx_alloc_epc_page(&encl->secs, true);
> if (IS_ERR(secs_epc)) {
> ret = PTR_ERR(secs_epc);
> goto err_out_backing;
> @@ -149,6 +197,9 @@ static int sgx_encl_create(struct sgx_encl *encl,
> struct sgx_secs *secs)
> fput(encl->backing);
> encl->backing = NULL;
> +err_out_shrink:
> + sgx_encl_shrink(encl, va_page);
> +
> return ret;
> }
> @@ -321,21 +372,35 @@ static int sgx_encl_add_page(struct sgx_encl
> *encl, unsigned long src,
> {
> struct sgx_encl_page *encl_page;
> struct sgx_epc_page *epc_page;
> + struct sgx_va_page *va_page;
> int ret;
> encl_page = sgx_encl_page_alloc(encl, offset, secinfo->flags);
> if (IS_ERR(encl_page))
> return PTR_ERR(encl_page);
> - epc_page = __sgx_alloc_epc_page();
> + epc_page = sgx_alloc_epc_page(encl_page, true);
> if (IS_ERR(epc_page)) {
> kfree(encl_page);
> return PTR_ERR(epc_page);
> }
> + va_page = sgx_encl_grow(encl);
> + if (IS_ERR(va_page)) {
> + ret = PTR_ERR(va_page);
> + goto err_out_free;
> + }
> +
> mmap_read_lock(current->mm);
> mutex_lock(&encl->lock);
> + /*
> + * Adding to encl->va_pages must be done under encl->lock. Ditto for
> + * deleting (via sgx_encl_shrink()) in the error path.
> + */
> + if (va_page)
> + list_add(&va_page->list, &encl->va_pages);
> +
> /*
> * Insert prior to EADD in case of OOM. EADD modifies MRENCLAVE, i.e.
> * can't be gracefully unwound, while failure on EADD/EXTEND is limited
> @@ -366,6 +431,7 @@ static int sgx_encl_add_page(struct sgx_encl *encl,
> unsigned long src,
> goto err_out;
> }
> + sgx_mark_page_reclaimable(encl_page->epc_page);
> mutex_unlock(&encl->lock);
> mmap_read_unlock(current->mm);
> return ret;
> @@ -374,9 +440,11 @@ static int sgx_encl_add_page(struct sgx_encl *encl,
> unsigned long src,
> xa_erase(&encl->page_array, PFN_DOWN(encl_page->desc));
> err_out_unlock:
> + sgx_encl_shrink(encl, va_page);
> mutex_unlock(&encl->lock);
> mmap_read_unlock(current->mm);
> +err_out_free:
> sgx_free_epc_page(epc_page);
> kfree(encl_page);
> diff --git a/arch/x86/kernel/cpu/sgx/main.c
> b/arch/x86/kernel/cpu/sgx/main.c
> index 4137254fb29e..3f9130501370 100644
> --- a/arch/x86/kernel/cpu/sgx/main.c
> +++ b/arch/x86/kernel/cpu/sgx/main.c
> @@ -16,6 +16,395 @@
> struct sgx_epc_section sgx_epc_sections[SGX_MAX_EPC_SECTIONS];
> static int sgx_nr_epc_sections;
> static struct task_struct *ksgxswapd_tsk;
> +static DECLARE_WAIT_QUEUE_HEAD(ksgxswapd_waitq);
> +static LIST_HEAD(sgx_active_page_list);
> +static DEFINE_SPINLOCK(sgx_active_page_list_lock);
> +
> +/**
> + * sgx_mark_page_reclaimable() - Mark a page as reclaimable
> + * @page: EPC page
> + *
> + * Mark a page as reclaimable and add it to the active page list. Pages
> + * are automatically removed from the active list when freed.
> + */
> +void sgx_mark_page_reclaimable(struct sgx_epc_page *page)
> +{
> + spin_lock(&sgx_active_page_list_lock);
> + page->desc |= SGX_EPC_PAGE_RECLAIMABLE;
> + list_add_tail(&page->list, &sgx_active_page_list);
> + spin_unlock(&sgx_active_page_list_lock);
> +}
> +
> +/**
> + * sgx_unmark_page_reclaimable() - Remove a page from the reclaim list
> + * @page: EPC page
> + *
> + * Clear the reclaimable flag and remove the page from the active page
> list.
> + *
> + * Return:
> + * 0 on success,
> + * -EBUSY if the page is in the process of being reclaimed
> + */
> +int sgx_unmark_page_reclaimable(struct sgx_epc_page *page)
> +{
> + /*
> + * Remove the page from the active list if necessary. If the page
> + * is actively being reclaimed, i.e. RECLAIMABLE is set but the
> + * page isn't on the active list, return -EBUSY as we can't free
> + * the page at this time since it is "owned" by the reclaimer.
> + */
> + spin_lock(&sgx_active_page_list_lock);
> + if (page->desc & SGX_EPC_PAGE_RECLAIMABLE) {
> + if (list_empty(&page->list)) {
> + spin_unlock(&sgx_active_page_list_lock);
> + return -EBUSY;
> + }
> + list_del(&page->list);
> + page->desc &= ~SGX_EPC_PAGE_RECLAIMABLE;
> + }
> + spin_unlock(&sgx_active_page_list_lock);
> +
> + return 0;
> +}
> +
> +static bool sgx_reclaimer_age(struct sgx_epc_page *epc_page)
> +{
> + struct sgx_encl_page *page = epc_page->owner;
> + struct sgx_encl *encl = page->encl;
> + struct sgx_encl_mm *encl_mm;
> + bool ret = true;
> + int idx;
> +
> + idx = srcu_read_lock(&encl->srcu);
> +
> + list_for_each_entry_rcu(encl_mm, &encl->mm_list, list) {
> + if (!mmget_not_zero(encl_mm->mm))
> + continue;
> +
> + mmap_read_lock(encl_mm->mm);
> + ret = !sgx_encl_test_and_clear_young(encl_mm->mm, page);
> + mmap_read_unlock(encl_mm->mm);
> +
> + mmput_async(encl_mm->mm);
> +
> + if (!ret || (atomic_read(&encl->flags) & SGX_ENCL_DEAD))
> + break;
> + }
> +
> + srcu_read_unlock(&encl->srcu, idx);
> +
> + if (!ret && !(atomic_read(&encl->flags) & SGX_ENCL_DEAD))
> + return false;
> +
> + return true;
> +}
> +
> +static void sgx_reclaimer_block(struct sgx_epc_page *epc_page)
> +{
> + struct sgx_encl_page *page = epc_page->owner;
> + unsigned long addr = SGX_ENCL_PAGE_ADDR(page);
> + struct sgx_encl *encl = page->encl;
> + unsigned long mm_list_version;
> + struct sgx_encl_mm *encl_mm;
> + struct vm_area_struct *vma;
> + int idx, ret;
> +
> + do {
> + mm_list_version = encl->mm_list_version;
> +
> + /* Pairs with smp_rmb() in sgx_encl_mm_add(). */
> + smp_rmb();
> +
> + idx = srcu_read_lock(&encl->srcu);
> +
> + list_for_each_entry_rcu(encl_mm, &encl->mm_list, list) {
> + if (!mmget_not_zero(encl_mm->mm))
> + continue;
> +
> + mmap_read_lock(encl_mm->mm);
> +
> + ret = sgx_encl_find(encl_mm->mm, addr, &vma);
> + if (!ret && encl == vma->vm_private_data)
> + zap_vma_ptes(vma, addr, PAGE_SIZE);
> +
> + mmap_read_unlock(encl_mm->mm);
> +
> + mmput_async(encl_mm->mm);
> + }
> +
> + srcu_read_unlock(&encl->srcu, idx);
> + } while (unlikely(encl->mm_list_version != mm_list_version));
> +
> + mutex_lock(&encl->lock);
> +
> + if (!(atomic_read(&encl->flags) & SGX_ENCL_DEAD)) {
> + ret = __eblock(sgx_get_epc_addr(epc_page));
> + if (encls_failed(ret))
> + ENCLS_WARN(ret, "EBLOCK");
> + }
> +
> + mutex_unlock(&encl->lock);
> +}
> +
> +static int __sgx_encl_ewb(struct sgx_epc_page *epc_page, void *va_slot,
> + struct sgx_backing *backing)
> +{
> + struct sgx_pageinfo pginfo;
> + int ret;
> +
> + pginfo.addr = 0;
> + pginfo.secs = 0;
> +
> + pginfo.contents = (unsigned long)kmap_atomic(backing->contents);
> + pginfo.metadata = (unsigned long)kmap_atomic(backing->pcmd) +
> + backing->pcmd_offset;
> +
> + ret = __ewb(&pginfo, sgx_get_epc_addr(epc_page), va_slot);
> +
> + kunmap_atomic((void *)(unsigned long)(pginfo.metadata -
> + backing->pcmd_offset));
> + kunmap_atomic((void *)(unsigned long)pginfo.contents);
> +
> + return ret;
> +}
> +
> +static void sgx_ipi_cb(void *info)
> +{
> +}
> +
> +static const cpumask_t *sgx_encl_ewb_cpumask(struct sgx_encl *encl)
> +{
> + cpumask_t *cpumask = &encl->cpumask;
> + struct sgx_encl_mm *encl_mm;
> + int idx;
> +
> + /*
> + * Can race with sgx_encl_mm_add(), but ETRACK has already been
> + * executed, which means that the CPUs running in the new mm will enter
> + * into the enclave with a fresh epoch.
> + */
> + cpumask_clear(cpumask);
> +
> + idx = srcu_read_lock(&encl->srcu);
> +
> + list_for_each_entry_rcu(encl_mm, &encl->mm_list, list) {
> + if (!mmget_not_zero(encl_mm->mm))
> + continue;
> +
> + cpumask_or(cpumask, cpumask, mm_cpumask(encl_mm->mm));
> +
> + mmput_async(encl_mm->mm);
> + }
> +
> + srcu_read_unlock(&encl->srcu, idx);
> +
> + return cpumask;
> +}
> +
> +/*
> + * Swap page to the regular memory transformed to the blocked state by
> using
> + * EBLOCK, which means that it can no loger be referenced (no new TLB
> entries).
> + *
> + * The first trial just tries to write the page assuming that some
> other thread
> + * has reset the count for threads inside the enlave by using ETRACK,
> and
> + * previous thread count has been zeroed out. The second trial calls
> ETRACK
> + * before EWB. If that fails we kick all the HW threads out, and then
> do EWB,
> + * which should be guaranteed the succeed.
> + */
> +static void sgx_encl_ewb(struct sgx_epc_page *epc_page,
> + struct sgx_backing *backing)
> +{
> + struct sgx_encl_page *encl_page = epc_page->owner;
> + struct sgx_encl *encl = encl_page->encl;
> + struct sgx_va_page *va_page;
> + unsigned int va_offset;
> + void *va_slot;
> + int ret;
> +
> + encl_page->desc &= ~SGX_ENCL_PAGE_BEING_RECLAIMED;
> +
> + va_page = list_first_entry(&encl->va_pages, struct sgx_va_page,
> + list);
> + va_offset = sgx_alloc_va_slot(va_page);
> + va_slot = sgx_get_epc_addr(va_page->epc_page) + va_offset;
> + if (sgx_va_page_full(va_page))
> + list_move_tail(&va_page->list, &encl->va_pages);
> +
> + ret = __sgx_encl_ewb(epc_page, va_slot, backing);
> + if (ret == SGX_NOT_TRACKED) {
> + ret = __etrack(sgx_get_epc_addr(encl->secs.epc_page));
> + if (ret) {
> + if (encls_failed(ret))
> + ENCLS_WARN(ret, "ETRACK");
> + }
> +
> + ret = __sgx_encl_ewb(epc_page, va_slot, backing);
> + if (ret == SGX_NOT_TRACKED) {
> + /*
> + * Slow path, send IPIs to kick cpus out of the
> + * enclave. Note, it's imperative that the cpu
> + * mask is generated *after* ETRACK, else we'll
> + * miss cpus that entered the enclave between
> + * generating the mask and incrementing epoch.
> + */
> + on_each_cpu_mask(sgx_encl_ewb_cpumask(encl),
> + sgx_ipi_cb, NULL, 1);
> + ret = __sgx_encl_ewb(epc_page, va_slot, backing);
> + }
> + }
> +
> + if (ret) {
> + if (encls_failed(ret))
> + ENCLS_WARN(ret, "EWB");
> +
> + sgx_free_va_slot(va_page, va_offset);
> + } else {
> + encl_page->desc |= va_offset;
> + encl_page->va_page = va_page;
> + }
> +}
> +
> +static void sgx_reclaimer_write(struct sgx_epc_page *epc_page,
> + struct sgx_backing *backing)
> +{
> + struct sgx_encl_page *encl_page = epc_page->owner;
> + struct sgx_encl *encl = encl_page->encl;
> + struct sgx_backing secs_backing;
> + int ret;
> +
> + mutex_lock(&encl->lock);
> +
> + if (atomic_read(&encl->flags) & SGX_ENCL_DEAD) {
> + ret = __eremove(sgx_get_epc_addr(epc_page));
> + ENCLS_WARN(ret, "EREMOVE");
> + } else {
> + sgx_encl_ewb(epc_page, backing);
> + }
> +
> + encl_page->epc_page = NULL;
> + encl->secs_child_cnt--;
> +
> + if (!encl->secs_child_cnt) {
> + if (atomic_read(&encl->flags) & SGX_ENCL_DEAD) {
> + sgx_free_epc_page(encl->secs.epc_page);
> + encl->secs.epc_page = NULL;
> + } else if (atomic_read(&encl->flags) & SGX_ENCL_INITIALIZED) {
> + ret = sgx_encl_get_backing(encl, PFN_DOWN(encl->size),
> + &secs_backing);
> + if (ret)
> + goto out;
> +
> + sgx_encl_ewb(encl->secs.epc_page, &secs_backing);
> +
> + sgx_free_epc_page(encl->secs.epc_page);
> + encl->secs.epc_page = NULL;
> +
> + sgx_encl_put_backing(&secs_backing, true);
> + }
> + }
> +
> +out:
> + mutex_unlock(&encl->lock);
> +}
> +
> +/*
> + * Take a fixed number of pages from the head of the active page pool
> and
> + * reclaim them to the enclave's private shmem files. Skip the pages,
> which have
> + * been accessed since the last scan. Move those pages to the tail of
> active
> + * page pool so that the pages get scanned in LRU like fashion.
> + *
> + * Batch process a chunk of pages (at the moment 16) in order to
> degrade amount
> + * of IPI's and ETRACK's potentially required. sgx_encl_ewb() does
> degrade a bit
> + * among the HW threads with three stage EWB pipeline (EWB, ETRACK +
> EWB and IPI
> + * + EWB) but not sufficiently. Reclaiming one page at a time would
> also be
> + * problematic as it would increase the lock contention too much, which
> would
> + * halt forward progress.
> + */
> +static void sgx_reclaim_pages(void)
> +{
> + struct sgx_epc_page *chunk[SGX_NR_TO_SCAN];
> + struct sgx_backing backing[SGX_NR_TO_SCAN];
> + struct sgx_epc_section *section;
> + struct sgx_encl_page *encl_page;
> + struct sgx_epc_page *epc_page;
> + int cnt = 0;
> + int ret;
> + int i;
> +
> + spin_lock(&sgx_active_page_list_lock);
> + for (i = 0; i < SGX_NR_TO_SCAN; i++) {
> + if (list_empty(&sgx_active_page_list))
> + break;
> +
> + epc_page = list_first_entry(&sgx_active_page_list,
> + struct sgx_epc_page, list);
> + list_del_init(&epc_page->list);
> + encl_page = epc_page->owner;
> +
> + if (kref_get_unless_zero(&encl_page->encl->refcount) != 0)
> + chunk[cnt++] = epc_page;
> + else
> + /* The owner is freeing the page. No need to add the
> + * page back to the list of reclaimable pages.
> + */
> + epc_page->desc &= ~SGX_EPC_PAGE_RECLAIMABLE;
> + }
> + spin_unlock(&sgx_active_page_list_lock);
> +
> + for (i = 0; i < cnt; i++) {
> + epc_page = chunk[i];
> + encl_page = epc_page->owner;
> +
> + if (!sgx_reclaimer_age(epc_page))
> + goto skip;
> +
> + ret = sgx_encl_get_backing(encl_page->encl,
> + SGX_ENCL_PAGE_INDEX(encl_page),
> + &backing[i]);
> + if (ret)
> + goto skip;
> +
> + mutex_lock(&encl_page->encl->lock);
> + encl_page->desc |= SGX_ENCL_PAGE_BEING_RECLAIMED;
> + mutex_unlock(&encl_page->encl->lock);
> + continue;
> +
> +skip:
> + spin_lock(&sgx_active_page_list_lock);
> + list_add_tail(&epc_page->list, &sgx_active_page_list);
> + spin_unlock(&sgx_active_page_list_lock);
> +
> + kref_put(&encl_page->encl->refcount, sgx_encl_release);
> +
> + chunk[i] = NULL;
> + }
> +
> + for (i = 0; i < cnt; i++) {
> + epc_page = chunk[i];
> + if (epc_page)
> + sgx_reclaimer_block(epc_page);
> + }
> +
> + for (i = 0; i < cnt; i++) {
> + epc_page = chunk[i];
> + if (!epc_page)
> + continue;
> +
> + encl_page = epc_page->owner;
> + sgx_reclaimer_write(epc_page, &backing[i]);
> + sgx_encl_put_backing(&backing[i], true);
> +
> + kref_put(&encl_page->encl->refcount, sgx_encl_release);
> + epc_page->desc &= ~SGX_EPC_PAGE_RECLAIMABLE;
> +
> + section = sgx_get_epc_section(epc_page);
> + spin_lock(§ion->lock);
> + list_add_tail(&epc_page->list, §ion->page_list);
> + section->free_cnt++;
> + spin_unlock(§ion->lock);
> + }
> +}
> +
> static void sgx_sanitize_section(struct sgx_epc_section *section)
> {
> @@ -44,6 +433,23 @@ static void sgx_sanitize_section(struct
> sgx_epc_section *section)
> }
> }
> +static unsigned long sgx_nr_free_pages(void)
> +{
> + unsigned long cnt = 0;
> + int i;
> +
> + for (i = 0; i < sgx_nr_epc_sections; i++)
> + cnt += sgx_epc_sections[i].free_cnt;
> +
> + return cnt;
> +}
> +
> +static bool sgx_should_reclaim(unsigned long watermark)
> +{
> + return sgx_nr_free_pages() < watermark &&
> + !list_empty(&sgx_active_page_list);
> +}
> +
> static int ksgxswapd(void *p)
> {
> int i;
> @@ -69,6 +475,20 @@ static int ksgxswapd(void *p)
> WARN(1, "EPC section %d has unsanitized pages.\n", i);
> }
> + while (!kthread_should_stop()) {
> + if (try_to_freeze())
> + continue;
> +
> + wait_event_freezable(ksgxswapd_waitq,
> + kthread_should_stop() ||
> + sgx_should_reclaim(SGX_NR_HIGH_PAGES));
> +
> + if (sgx_should_reclaim(SGX_NR_HIGH_PAGES))
> + sgx_reclaim_pages();
> +
> + cond_resched();
> + }
> +
> return 0;
> }
> @@ -94,6 +514,7 @@ static struct sgx_epc_page
> *__sgx_alloc_epc_page_from_section(struct sgx_epc_sec
> page = list_first_entry(§ion->page_list, struct sgx_epc_page, list);
> list_del_init(&page->list);
> + section->free_cnt--;
> return page;
> }
> @@ -127,6 +548,57 @@ struct sgx_epc_page *__sgx_alloc_epc_page(void)
> return ERR_PTR(-ENOMEM);
> }
> +/**
> + * sgx_alloc_epc_page() - Allocate an EPC page
> + * @owner: the owner of the EPC page
> + * @reclaim: reclaim pages if necessary
> + *
> + * Iterate through EPC sections and borrow a free EPC page to the
> caller. When a
> + * page is no longer needed it must be released with
> sgx_free_epc_page(). If
> + * @reclaim is set to true, directly reclaim pages when we are out of
> pages. No
> + * mm's can be locked when @reclaim is set to true.
> + *
> + * Finally, wake up ksgxswapd when the number of pages goes below the
> watermark
> + * before returning back to the caller.
> + *
> + * Return:
> + * an EPC page,
> + * -errno on error
> + */
> +struct sgx_epc_page *sgx_alloc_epc_page(void *owner, bool reclaim)
> +{
> + struct sgx_epc_page *entry;
> +
> + for ( ; ; ) {
> + entry = __sgx_alloc_epc_page();
> + if (!IS_ERR(entry)) {
> + entry->owner = owner;
> + break;
> + }
> +
> + if (list_empty(&sgx_active_page_list))
> + return ERR_PTR(-ENOMEM);
> +
> + if (!reclaim) {
> + entry = ERR_PTR(-EBUSY);
> + break;
> + }
> +
> + if (signal_pending(current)) {
> + entry = ERR_PTR(-ERESTARTSYS);
> + break;
> + }
> +
> + sgx_reclaim_pages();
> + schedule();
> + }
> +
> + if (sgx_should_reclaim(SGX_NR_LOW_PAGES))
> + wake_up(&ksgxswapd_waitq);
> +
> + return entry;
> +}
> +
> /**
> * sgx_free_epc_page() - Free an EPC page
> * @page: an EPC page
> @@ -138,12 +610,20 @@ void sgx_free_epc_page(struct sgx_epc_page *page)
> struct sgx_epc_section *section = sgx_get_epc_section(page);
> int ret;
> + /*
> + * Don't take sgx_active_page_list_lock when asserting the page isn't
> + * reclaimable, missing a WARN in the very rare case is preferable to
> + * unnecessarily taking a global lock in the common case.
> + */
> + WARN_ON_ONCE(page->desc & SGX_EPC_PAGE_RECLAIMABLE);
> +
> ret = __eremove(sgx_get_epc_addr(page));
> if (WARN_ONCE(ret, "EREMOVE returned %d (0x%x)", ret, ret))
> return;
> spin_lock(§ion->lock);
> list_add_tail(&page->list, §ion->page_list);
> + section->free_cnt++;
> spin_unlock(§ion->lock);
> }
> @@ -194,6 +674,7 @@ static bool __init sgx_setup_epc_section(u64 addr,
> u64 size,
> list_add_tail(&page->list, §ion->unsanitized_page_list);
> }
> + section->free_cnt = nr_pages;
> return true;
> err_out:
> diff --git a/arch/x86/kernel/cpu/sgx/sgx.h
> b/arch/x86/kernel/cpu/sgx/sgx.h
> index 8d126070db1e..ec4f7b338dbe 100644
> --- a/arch/x86/kernel/cpu/sgx/sgx.h
> +++ b/arch/x86/kernel/cpu/sgx/sgx.h
> @@ -15,6 +15,7 @@
> struct sgx_epc_page {
> unsigned long desc;
> + struct sgx_encl_page *owner;
> struct list_head list;
> };
> @@ -27,6 +28,7 @@ struct sgx_epc_page {
> struct sgx_epc_section {
> unsigned long pa;
> void *va;
> + unsigned long free_cnt;
> struct list_head page_list;
> struct list_head unsanitized_page_list;
> spinlock_t lock;
> @@ -35,6 +37,10 @@ struct sgx_epc_section {
> #define SGX_EPC_SECTION_MASK GENMASK(7, 0)
> #define SGX_MAX_EPC_SECTIONS (SGX_EPC_SECTION_MASK + 1)
> #define SGX_MAX_ADD_PAGES_LENGTH 0x100000
> +#define SGX_EPC_PAGE_RECLAIMABLE BIT(8)
> +#define SGX_NR_TO_SCAN 16
> +#define SGX_NR_LOW_PAGES 32
> +#define SGX_NR_HIGH_PAGES 64
> extern struct sgx_epc_section sgx_epc_sections[SGX_MAX_EPC_SECTIONS];
> @@ -50,7 +56,10 @@ static inline void *sgx_get_epc_addr(struct
> sgx_epc_page *page)
> return section->va + (page->desc & PAGE_MASK) - section->pa;
> }
> +void sgx_mark_page_reclaimable(struct sgx_epc_page *page);
> +int sgx_unmark_page_reclaimable(struct sgx_epc_page *page);
> struct sgx_epc_page *__sgx_alloc_epc_page(void);
> +struct sgx_epc_page *sgx_alloc_epc_page(void *owner, bool reclaim);
> void sgx_free_epc_page(struct sgx_epc_page *page);
> #endif /* _X86_SGX_H */
--
Using Opera's mail client: http://www.opera.com/mail/
On Sat, Oct 03, 2020 at 12:22:47AM -0500, Haitao Huang wrote:
> When I turn on CONFIG_PROVE_LOCKING, kernel reports following suspicious RCU
> usages. Not sure if it is an issue. Just reporting here:
I'm glad to hear that my tip helped you to get us the data.
This does not look like an issue in the page reclaimer, which was not
obvious for me before. That's a good thing. I was really worried about
that because it has been very stable for a long period now. The last
bug fix for the reclaimer was done in June in v31 version of the patch
set and after that it has been unchanged (except possibly some renames
requested by Boris).
I wildly guess I have a bad usage pattern for xarray. I migrated to it
in v36, and it is entirely possible that I've misused it. It was the
first time that I ever used it. Before xarray we had radix_tree but
based Matthew Wilcox feedback I did a migration to xarray.
What I'd ask you to do next is to, if by any means possible, to try to
run the same test with v35 so we can verify this. That one still has
the radix tree.
Thank you.
/Jarkko
>
> [ +34.337095] =============================
> [ +0.000001] WARNING: suspicious RCU usage
> [ +0.000002] 5.9.0-rc6-lock-sgx39 #1 Not tainted
> [ +0.000001] -----------------------------
> [ +0.000001] ./include/linux/xarray.h:1165 suspicious
> rcu_dereference_check() usage!
> [ +0.000001]
> other info that might help us debug this:
>
> [ +0.000001]
> rcu_scheduler_active = 2, debug_locks = 1
> [ +0.000001] 1 lock held by enclaveos-runne/4238:
> [ +0.000001] #0: ffff9cc6657e45e8 (&mm->mmap_lock#2){++++}-{3:3}, at:
> vm_mmap_pgoff+0xa1/0x120
> [ +0.000005]
> stack backtrace:
> [ +0.000002] CPU: 1 PID: 4238 Comm: enclaveos-runne Not tainted
> 5.9.0-rc6-lock-sgx39 #1
> [ +0.000001] Hardware name: Microsoft Corporation Virtual Machine/Virtual
> Machine, BIOS Hyper-V UEFI Release v4.1 04/02/2020
> [ +0.000002] Call Trace:
> [ +0.000003] dump_stack+0x7d/0x9f
> [ +0.000003] lockdep_rcu_suspicious+0xce/0xf0
> [ +0.000004] xas_start+0x14c/0x1c0
> [ +0.000003] xas_load+0xf/0x50
> [ +0.000002] xas_find+0x25c/0x2c0
> [ +0.000004] sgx_encl_may_map+0x87/0x1c0
> [ +0.000006] sgx_mmap+0x29/0x70
> [ +0.000003] mmap_region+0x3ee/0x710
> [ +0.000006] do_mmap+0x3f1/0x5e0
> [ +0.000004] vm_mmap_pgoff+0xcd/0x120
> [ +0.000007] ksys_mmap_pgoff+0x1de/0x240
> [ +0.000005] __x64_sys_mmap+0x33/0x40
> [ +0.000002] do_syscall_64+0x37/0x80
> [ +0.000003] entry_SYSCALL_64_after_hwframe+0x44/0xa9
> [ +0.000002] RIP: 0033:0x7fe34efe06ba
> [ +0.000002] Code: 89 f5 41 54 49 89 fc 55 53 74 35 49 63 e8 48 63 da 4d 89
> f9 49 89 e8 4d 63 d6 48 89 da 4c 89 ee 4c 89 e7 b8 09 00 00 00 0f 05 <48> 3d
> 00 f0 ff ff 77 56 5b 5d 41 5c 41 5d 41 5e 41 5f c3 0f 1f 00
> [ +0.000001] RSP: 002b:00007ffee83eac08 EFLAGS: 00000206 ORIG_RAX:
> 0000000000000009
> [ +0.000001] RAX: ffffffffffffffda RBX: 0000000000000001 RCX:
> 00007fe34efe06ba
> [ +0.000001] RDX: 0000000000000001 RSI: 0000000000001000 RDI:
> 0000000007fff000
> [ +0.000001] RBP: 0000000000000004 R08: 0000000000000004 R09:
> 0000000000000000
> [ +0.000001] R10: 0000000000000011 R11: 0000000000000206 R12:
> 0000000007fff000
> [ +0.000001] R13: 0000000000001000 R14: 0000000000000011 R15:
> 0000000000000000
>
> [ +0.000010] =============================
> [ +0.000001] WARNING: suspicious RCU usage
> [ +0.000001] 5.9.0-rc6-lock-sgx39 #1 Not tainted
> [ +0.000001] -----------------------------
> [ +0.000001] ./include/linux/xarray.h:1181 suspicious
> rcu_dereference_check() usage!
> [ +0.000001]
> other info that might help us debug this:
>
> [ +0.000001]
> rcu_scheduler_active = 2, debug_locks = 1
> [ +0.000001] 1 lock held by enclaveos-runne/4238:
> [ +0.000001] #0: ffff9cc6657e45e8 (&mm->mmap_lock#2){++++}-{3:3}, at:
> vm_mmap_pgoff+0xa1/0x120
> [ +0.000003]
> stack backtrace:
> [ +0.000001] CPU: 1 PID: 4238 Comm: enclaveos-runne Not tainted
> 5.9.0-rc6-lock-sgx39 #1
> [ +0.000001] Hardware name: Microsoft Corporation Virtual Machine/Virtual
> Machine, BIOS Hyper-V UEFI Release v4.1 04/02/2020
> [ +0.000001] Call Trace:
> [ +0.000001] dump_stack+0x7d/0x9f
> [ +0.000003] lockdep_rcu_suspicious+0xce/0xf0
> [ +0.000003] xas_descend+0x116/0x120
> [ +0.000004] xas_load+0x42/0x50
> [ +0.000002] xas_find+0x25c/0x2c0
> [ +0.000004] sgx_encl_may_map+0x87/0x1c0
> [ +0.000006] sgx_mmap+0x29/0x70
> [ +0.000002] mmap_region+0x3ee/0x710
> [ +0.000006] do_mmap+0x3f1/0x5e0
> [ +0.000004] vm_mmap_pgoff+0xcd/0x120
> [ +0.000007] ksys_mmap_pgoff+0x1de/0x240
> [ +0.000005] __x64_sys_mmap+0x33/0x40
> [ +0.000002] do_syscall_64+0x37/0x80
> [ +0.000002] entry_SYSCALL_64_after_hwframe+0x44/0xa9
> [ +0.000001] RIP: 0033:0x7fe34efe06ba
> [ +0.000001] Code: 89 f5 41 54 49 89 fc 55 53 74 35 49 63 e8 48 63 da 4d 89
> f9 49 89 e8 4d 63 d6 48 89 da 4c 89 ee 4c 89 e7 b8 09 00 00 00 0f 05 <48> 3d
> 00 f0 ff ff 77 56 5b 5d 41 5c 41 5d 41 5e 41 5f c3 0f 1f 00
> [ +0.000001] RSP: 002b:00007ffee83eac08 EFLAGS: 00000206 ORIG_RAX:
> 0000000000000009
> [ +0.000001] RAX: ffffffffffffffda RBX: 0000000000000001 RCX:
> 00007fe34efe06ba
> [ +0.000001] RDX: 0000000000000001 RSI: 0000000000001000 RDI:
> 0000000007fff000
> [ +0.000001] RBP: 0000000000000004 R08: 0000000000000004 R09:
> 0000000000000000
> [ +0.000001] R10: 0000000000000011 R11: 0000000000000206 R12:
> 0000000007fff000
> [ +0.000001] R13: 0000000000001000 R14: 0000000000000011 R15:
> 0000000000000000
>
> [ +0.001117] =============================
> [ +0.000001] WARNING: suspicious RCU usage
> [ +0.000001] 5.9.0-rc6-lock-sgx39 #1 Not tainted
> [ +0.000001] -----------------------------
> [ +0.000001] ./include/linux/xarray.h:1181 suspicious
> rcu_dereference_check() usage!
> [ +0.000001]
> other info that might help us debug this:
>
> [ +0.000001]
> rcu_scheduler_active = 2, debug_locks = 1
> [ +0.000001] 1 lock held by enclaveos-runne/4238:
> [ +0.000001] #0: ffff9cc6657e45e8 (&mm->mmap_lock#2){++++}-{3:3}, at:
> vm_mmap_pgoff+0xa1/0x120
> [ +0.000003]
> stack backtrace:
> [ +0.000002] CPU: 1 PID: 4238 Comm: enclaveos-runne Not tainted
> 5.9.0-rc6-lock-sgx39 #1
> [ +0.000001] Hardware name: Microsoft Corporation Virtual Machine/Virtual
> Machine, BIOS Hyper-V UEFI Release v4.1 04/02/2020
> [ +0.000001] Call Trace:
> [ +0.000002] dump_stack+0x7d/0x9f
> [ +0.000003] lockdep_rcu_suspicious+0xce/0xf0
> [ +0.000003] sgx_encl_may_map+0x1b0/0x1c0
> [ +0.000006] sgx_mmap+0x29/0x70
> [ +0.000002] mmap_region+0x3ee/0x710
> [ +0.000006] do_mmap+0x3f1/0x5e0
> [ +0.000005] vm_mmap_pgoff+0xcd/0x120
> [ +0.000006] ksys_mmap_pgoff+0x1de/0x240
> [ +0.000005] __x64_sys_mmap+0x33/0x40
> [ +0.000002] do_syscall_64+0x37/0x80
> [ +0.000002] entry_SYSCALL_64_after_hwframe+0x44/0xa9
> [ +0.000002] RIP: 0033:0x7fe34efe06ba
> [ +0.000001] Code: 89 f5 41 54 49 89 fc 55 53 74 35 49 63 e8 48 63 da 4d 89
> f9 49 89 e8 4d 63 d6 48 89 da 4c 89 ee 4c 89 e7 b8 09 00 00 00 0f 05 <48> 3d
> 00 f0 ff ff 77 56 5b 5d 41 5c 41 5d 41 5e 41 5f c3 0f 1f 00
> [ +0.000001] RSP: 002b:00007ffee83eac08 EFLAGS: 00000206 ORIG_RAX:
> 0000000000000009
> [ +0.000001] RAX: ffffffffffffffda RBX: 0000000000000003 RCX:
> 00007fe34efe06ba
> [ +0.000001] RDX: 0000000000000003 RSI: 0000000000010000 RDI:
> 0000000007fee000
> [ +0.000001] RBP: 0000000000000004 R08: 0000000000000004 R09:
> 0000000000000000
> [ +0.000001] R10: 0000000000000011 R11: 0000000000000206 R12:
> 0000000007fee000
> [ +0.000001] R13: 0000000000010000 R14: 0000000000000011 R15:
> 0000000000000000
>
> [ +0.003197] =============================
> [ +0.000001] WARNING: suspicious RCU usage
> [ +0.000001] 5.9.0-rc6-lock-sgx39 #1 Not tainted
> [ +0.000001] -----------------------------
> [ +0.000001] ./include/linux/xarray.h:1198 suspicious
> rcu_dereference_check() usage!
> [ +0.000001]
> other info that might help us debug this:
>
> [ +0.000001]
> rcu_scheduler_active = 2, debug_locks = 1
> [ +0.000001] 1 lock held by enclaveos-runne/4238:
> [ +0.000001] #0: ffff9cc6657e45e8 (&mm->mmap_lock#2){++++}-{3:3}, at:
> vm_mmap_pgoff+0xa1/0x120
> [ +0.000003]
> stack backtrace:
> [ +0.000002] CPU: 1 PID: 4238 Comm: enclaveos-runne Not tainted
> 5.9.0-rc6-lock-sgx39 #1
> [ +0.000001] Hardware name: Microsoft Corporation Virtual Machine/Virtual
> Machine, BIOS Hyper-V UEFI Release v4.1 04/02/2020
> [ +0.000001] Call Trace:
> [ +0.000002] dump_stack+0x7d/0x9f
> [ +0.000003] lockdep_rcu_suspicious+0xce/0xf0
> [ +0.000004] xas_find+0x255/0x2c0
> [ +0.000003] sgx_encl_may_map+0xad/0x1c0
> [ +0.000006] sgx_mmap+0x29/0x70
> [ +0.000003] mmap_region+0x3ee/0x710
> [ +0.000005] do_mmap+0x3f1/0x5e0
> [ +0.000005] vm_mmap_pgoff+0xcd/0x120
> [ +0.000007] ksys_mmap_pgoff+0x1de/0x240
> [ +0.000004] __x64_sys_mmap+0x33/0x40
> [ +0.000002] do_syscall_64+0x37/0x80
> [ +0.000002] entry_SYSCALL_64_after_hwframe+0x44/0xa9
> [ +0.000002] RIP: 0033:0x7fe34efe06ba
> [ +0.000001] Code: 89 f5 41 54 49 89 fc 55 53 74 35 49 63 e8 48 63 da 4d 89
> f9 49 89 e8 4d 63 d6 48 89 da 4c 89 ee 4c 89 e7 b8 09 00 00 00 0f 05 <48> 3d
> 00 f0 ff ff 77 56 5b 5d 41 5c 41 5d 41 5e 41 5f c3 0f 1f 00
> [ +0.000001] RSP: 002b:00007ffee83eac08 EFLAGS: 00000206 ORIG_RAX:
> 0000000000000009
> [ +0.000002] RAX: ffffffffffffffda RBX: 0000000000000003 RCX:
> 00007fe34efe06ba
> [ +0.000001] RDX: 0000000000000003 RSI: 0000000000010000 RDI:
> 0000000007fba000
> [ +0.000001] RBP: 0000000000000004 R08: 0000000000000004 R09:
> 0000000000000000
> [ +0.000001] R10: 0000000000000011 R11: 0000000000000206 R12:
> 0000000007fba000
> [ +0.000001] R13: 0000000000010000 R14: 0000000000000011 R15:
> 0000000000000000
>
>
> On Fri, 02 Oct 2020 23:50:51 -0500, Jarkko Sakkinen
> <[email protected]> wrote:
>
> > There is a limited amount of EPC available. Therefore, some of it must be
> > copied to the regular memory, and only subset kept in the SGX reserved
> > memory. While kernel cannot directly access enclave memory, SGX provides
> > a
> > set of ENCLS leaf functions to perform reclaiming.
> >
> > Implement a page reclaimer by using these leaf functions. It picks the
> > victim pages in LRU fashion from all the enclaves running in the system.
> > The thread ksgxswapd reclaims pages on the event when the number of free
> > EPC pages goes below SGX_NR_LOW_PAGES up until it reaches
> > SGX_NR_HIGH_PAGES.
> >
> > sgx_alloc_epc_page() can optionally directly reclaim pages with @reclaim
> > set true. A caller must also supply owner for each page so that the
> > reclaimer can access the associated enclaves. This is needed for locking,
> > as most of the ENCLS leafs cannot be executed concurrently for an
> > enclave.
> > The owner is also needed for accessing SECS, which is required to be
> > resident when its child pages are being reclaimed.
> >
> > Cc: [email protected]
> > Acked-by: Jethro Beekman <[email protected]>
> > Tested-by: Jethro Beekman <[email protected]>
> > Tested-by: Jordan Hand <[email protected]>
> > Tested-by: Nathaniel McCallum <[email protected]>
> > Tested-by: Chunyang Hui <[email protected]>
> > Tested-by: Seth Moore <[email protected]>
> > Co-developed-by: Sean Christopherson <[email protected]>
> > Signed-off-by: Sean Christopherson <[email protected]>
> > Signed-off-by: Jarkko Sakkinen <[email protected]>
> > ---
> > arch/x86/kernel/cpu/sgx/driver.c | 1 +
> > arch/x86/kernel/cpu/sgx/encl.c | 344 +++++++++++++++++++++-
> > arch/x86/kernel/cpu/sgx/encl.h | 41 +++
> > arch/x86/kernel/cpu/sgx/ioctl.c | 78 ++++-
> > arch/x86/kernel/cpu/sgx/main.c | 481 +++++++++++++++++++++++++++++++
> > arch/x86/kernel/cpu/sgx/sgx.h | 9 +
> > 6 files changed, 947 insertions(+), 7 deletions(-)
> >
> > diff --git a/arch/x86/kernel/cpu/sgx/driver.c
> > b/arch/x86/kernel/cpu/sgx/driver.c
> > index d01b28f7ce4a..0446781cc7a2 100644
> > --- a/arch/x86/kernel/cpu/sgx/driver.c
> > +++ b/arch/x86/kernel/cpu/sgx/driver.c
> > @@ -29,6 +29,7 @@ static int sgx_open(struct inode *inode, struct file
> > *file)
> > atomic_set(&encl->flags, 0);
> > kref_init(&encl->refcount);
> > xa_init(&encl->page_array);
> > + INIT_LIST_HEAD(&encl->va_pages);
> > mutex_init(&encl->lock);
> > INIT_LIST_HEAD(&encl->mm_list);
> > spin_lock_init(&encl->mm_lock);
> > diff --git a/arch/x86/kernel/cpu/sgx/encl.c
> > b/arch/x86/kernel/cpu/sgx/encl.c
> > index c2c4a77af36b..54326efa6c2f 100644
> > --- a/arch/x86/kernel/cpu/sgx/encl.c
> > +++ b/arch/x86/kernel/cpu/sgx/encl.c
> > @@ -12,9 +12,88 @@
> > #include "encls.h"
> > #include "sgx.h"
> > +/*
> > + * ELDU: Load an EPC page as unblocked. For more info, see "OS
> > Management of EPC
> > + * Pages" in the SDM.
> > + */
> > +static int __sgx_encl_eldu(struct sgx_encl_page *encl_page,
> > + struct sgx_epc_page *epc_page,
> > + struct sgx_epc_page *secs_page)
> > +{
> > + unsigned long va_offset = SGX_ENCL_PAGE_VA_OFFSET(encl_page);
> > + struct sgx_encl *encl = encl_page->encl;
> > + struct sgx_pageinfo pginfo;
> > + struct sgx_backing b;
> > + pgoff_t page_index;
> > + int ret;
> > +
> > + if (secs_page)
> > + page_index = SGX_ENCL_PAGE_INDEX(encl_page);
> > + else
> > + page_index = PFN_DOWN(encl->size);
> > +
> > + ret = sgx_encl_get_backing(encl, page_index, &b);
> > + if (ret)
> > + return ret;
> > +
> > + pginfo.addr = SGX_ENCL_PAGE_ADDR(encl_page);
> > + pginfo.contents = (unsigned long)kmap_atomic(b.contents);
> > + pginfo.metadata = (unsigned long)kmap_atomic(b.pcmd) +
> > + b.pcmd_offset;
> > +
> > + if (secs_page)
> > + pginfo.secs = (u64)sgx_get_epc_addr(secs_page);
> > + else
> > + pginfo.secs = 0;
> > +
> > + ret = __eldu(&pginfo, sgx_get_epc_addr(epc_page),
> > + sgx_get_epc_addr(encl_page->va_page->epc_page) +
> > + va_offset);
> > + if (ret) {
> > + if (encls_failed(ret))
> > + ENCLS_WARN(ret, "ELDU");
> > +
> > + ret = -EFAULT;
> > + }
> > +
> > + kunmap_atomic((void *)(unsigned long)(pginfo.metadata -
> > b.pcmd_offset));
> > + kunmap_atomic((void *)(unsigned long)pginfo.contents);
> > +
> > + sgx_encl_put_backing(&b, false);
> > +
> > + return ret;
> > +}
> > +
> > +static struct sgx_epc_page *sgx_encl_eldu(struct sgx_encl_page
> > *encl_page,
> > + struct sgx_epc_page *secs_page)
> > +{
> > + unsigned long va_offset = SGX_ENCL_PAGE_VA_OFFSET(encl_page);
> > + struct sgx_encl *encl = encl_page->encl;
> > + struct sgx_epc_page *epc_page;
> > + int ret;
> > +
> > + epc_page = sgx_alloc_epc_page(encl_page, false);
> > + if (IS_ERR(epc_page))
> > + return epc_page;
> > +
> > + ret = __sgx_encl_eldu(encl_page, epc_page, secs_page);
> > + if (ret) {
> > + sgx_free_epc_page(epc_page);
> > + return ERR_PTR(ret);
> > + }
> > +
> > + sgx_free_va_slot(encl_page->va_page, va_offset);
> > + list_move(&encl_page->va_page->list, &encl->va_pages);
> > + encl_page->desc &= ~SGX_ENCL_PAGE_VA_OFFSET_MASK;
> > + encl_page->epc_page = epc_page;
> > +
> > + return epc_page;
> > +}
> > +
> > static struct sgx_encl_page *sgx_encl_load_page(struct sgx_encl *encl,
> > unsigned long addr)
> > {
> > + struct sgx_epc_page *epc_page;
> > struct sgx_encl_page *entry;
> > unsigned int flags;
> > @@ -33,10 +112,27 @@ static struct sgx_encl_page
> > *sgx_encl_load_page(struct sgx_encl *encl,
> > return ERR_PTR(-EFAULT);
> > /* Page is already resident in the EPC. */
> > - if (entry->epc_page)
> > + if (entry->epc_page) {
> > + if (entry->desc & SGX_ENCL_PAGE_BEING_RECLAIMED)
> > + return ERR_PTR(-EBUSY);
> > +
> > return entry;
> > + }
> > +
> > + if (!(encl->secs.epc_page)) {
> > + epc_page = sgx_encl_eldu(&encl->secs, NULL);
> > + if (IS_ERR(epc_page))
> > + return ERR_CAST(epc_page);
> > + }
> > - return ERR_PTR(-EFAULT);
> > + epc_page = sgx_encl_eldu(entry, encl->secs.epc_page);
> > + if (IS_ERR(epc_page))
> > + return ERR_CAST(epc_page);
> > +
> > + encl->secs_child_cnt++;
> > + sgx_mark_page_reclaimable(entry->epc_page);
> > +
> > + return entry;
> > }
> > static void sgx_mmu_notifier_release(struct mmu_notifier *mn,
> > @@ -132,6 +228,9 @@ int sgx_encl_mm_add(struct sgx_encl *encl, struct
> > mm_struct *mm)
> > spin_lock(&encl->mm_lock);
> > list_add_rcu(&encl_mm->list, &encl->mm_list);
> > + /* Pairs with smp_rmb() in sgx_reclaimer_block(). */
> > + smp_wmb();
> > + encl->mm_list_version++;
> > spin_unlock(&encl->mm_lock);
> > return 0;
> > @@ -179,6 +278,8 @@ static unsigned int sgx_vma_fault(struct vm_fault
> > *vmf)
> > goto out;
> > }
> > + sgx_encl_test_and_clear_young(vma->vm_mm, entry);
> > +
> > out:
> > mutex_unlock(&encl->lock);
> > return ret;
> > @@ -280,6 +381,7 @@ int sgx_encl_find(struct mm_struct *mm, unsigned
> > long addr,
> > */
> > void sgx_encl_destroy(struct sgx_encl *encl)
> > {
> > + struct sgx_va_page *va_page;
> > struct sgx_encl_page *entry;
> > unsigned long index;
> > @@ -287,6 +389,13 @@ void sgx_encl_destroy(struct sgx_encl *encl)
> > xa_for_each(&encl->page_array, index, entry) {
> > if (entry->epc_page) {
> > + /*
> > + * The page and its radix tree entry cannot be freed
> > + * if the page is being held by the reclaimer.
> > + */
> > + if (sgx_unmark_page_reclaimable(entry->epc_page))
> > + continue;
> > +
> > sgx_free_epc_page(entry->epc_page);
> > encl->secs_child_cnt--;
> > entry->epc_page = NULL;
> > @@ -301,6 +410,19 @@ void sgx_encl_destroy(struct sgx_encl *encl)
> > sgx_free_epc_page(encl->secs.epc_page);
> > encl->secs.epc_page = NULL;
> > }
> > +
> > + /*
> > + * The reclaimer is responsible for checking SGX_ENCL_DEAD before doing
> > + * EWB, thus it's safe to free VA pages even if the reclaimer holds a
> > + * reference to the enclave.
> > + */
> > + while (!list_empty(&encl->va_pages)) {
> > + va_page = list_first_entry(&encl->va_pages, struct sgx_va_page,
> > + list);
> > + list_del(&va_page->list);
> > + sgx_free_epc_page(va_page->epc_page);
> > + kfree(va_page);
> > + }
> > }
> > /**
> > @@ -329,3 +451,221 @@ void sgx_encl_release(struct kref *ref)
> > kfree(encl);
> > }
> > +
> > +static struct page *sgx_encl_get_backing_page(struct sgx_encl *encl,
> > + pgoff_t index)
> > +{
> > + struct inode *inode = encl->backing->f_path.dentry->d_inode;
> > + struct address_space *mapping = inode->i_mapping;
> > + gfp_t gfpmask = mapping_gfp_mask(mapping);
> > +
> > + return shmem_read_mapping_page_gfp(mapping, index, gfpmask);
> > +}
> > +
> > +/**
> > + * sgx_encl_get_backing() - Pin the backing storage
> > + * @encl: an enclave pointer
> > + * @page_index: enclave page index
> > + * @backing: data for accessing backing storage for the page
> > + *
> > + * Pin the backing storage pages for storing the encrypted contents and
> > Paging
> > + * Crypto MetaData (PCMD) of an enclave page.
> > + *
> > + * Return:
> > + * 0 on success,
> > + * -errno otherwise.
> > + */
> > +int sgx_encl_get_backing(struct sgx_encl *encl, unsigned long
> > page_index,
> > + struct sgx_backing *backing)
> > +{
> > + pgoff_t pcmd_index = PFN_DOWN(encl->size) + 1 + (page_index >> 5);
> > + struct page *contents;
> > + struct page *pcmd;
> > +
> > + contents = sgx_encl_get_backing_page(encl, page_index);
> > + if (IS_ERR(contents))
> > + return PTR_ERR(contents);
> > +
> > + pcmd = sgx_encl_get_backing_page(encl, pcmd_index);
> > + if (IS_ERR(pcmd)) {
> > + put_page(contents);
> > + return PTR_ERR(pcmd);
> > + }
> > +
> > + backing->page_index = page_index;
> > + backing->contents = contents;
> > + backing->pcmd = pcmd;
> > + backing->pcmd_offset =
> > + (page_index & (PAGE_SIZE / sizeof(struct sgx_pcmd) - 1)) *
> > + sizeof(struct sgx_pcmd);
> > +
> > + return 0;
> > +}
> > +
> > +/**
> > + * sgx_encl_put_backing() - Unpin the backing storage
> > + * @backing: data for accessing backing storage for the page
> > + * @do_write: mark pages dirty
> > + */
> > +void sgx_encl_put_backing(struct sgx_backing *backing, bool do_write)
> > +{
> > + if (do_write) {
> > + set_page_dirty(backing->pcmd);
> > + set_page_dirty(backing->contents);
> > + }
> > +
> > + put_page(backing->pcmd);
> > + put_page(backing->contents);
> > +}
> > +
> > +static int sgx_encl_test_and_clear_young_cb(pte_t *ptep, unsigned long
> > addr,
> > + void *data)
> > +{
> > + pte_t pte;
> > + int ret;
> > +
> > + ret = pte_young(*ptep);
> > + if (ret) {
> > + pte = pte_mkold(*ptep);
> > + set_pte_at((struct mm_struct *)data, addr, ptep, pte);
> > + }
> > +
> > + return ret;
> > +}
> > +
> > +/**
> > + * sgx_encl_test_and_clear_young() - Test and reset the accessed bit
> > + * @mm: mm_struct that is checked
> > + * @page: enclave page to be tested for recent access
> > + *
> > + * Checks the Access (A) bit from the PTE corresponding to the enclave
> > page and
> > + * clears it.
> > + *
> > + * Return: 1 if the page has been recently accessed and 0 if not.
> > + */
> > +int sgx_encl_test_and_clear_young(struct mm_struct *mm,
> > + struct sgx_encl_page *page)
> > +{
> > + unsigned long addr = SGX_ENCL_PAGE_ADDR(page);
> > + struct sgx_encl *encl = page->encl;
> > + struct vm_area_struct *vma;
> > + int ret;
> > +
> > + ret = sgx_encl_find(mm, addr, &vma);
> > + if (ret)
> > + return 0;
> > +
> > + if (encl != vma->vm_private_data)
> > + return 0;
> > +
> > + ret = apply_to_page_range(vma->vm_mm, addr, PAGE_SIZE,
> > + sgx_encl_test_and_clear_young_cb, vma->vm_mm);
> > + if (ret < 0)
> > + return 0;
> > +
> > + return ret;
> > +}
> > +
> > +/**
> > + * sgx_encl_reserve_page() - Reserve an enclave page
> > + * @encl: an enclave pointer
> > + * @addr: a page address
> > + *
> > + * Load an enclave page and lock the enclave so that the page can be
> > used by
> > + * EDBG* and EMOD*.
> > + *
> > + * Return:
> > + * an enclave page on success
> > + * -EFAULT if the load fails
> > + */
> > +struct sgx_encl_page *sgx_encl_reserve_page(struct sgx_encl *encl,
> > + unsigned long addr)
> > +{
> > + struct sgx_encl_page *entry;
> > +
> > + for ( ; ; ) {
> > + mutex_lock(&encl->lock);
> > +
> > + entry = sgx_encl_load_page(encl, addr);
> > + if (PTR_ERR(entry) != -EBUSY)
> > + break;
> > +
> > + mutex_unlock(&encl->lock);
> > + }
> > +
> > + if (IS_ERR(entry))
> > + mutex_unlock(&encl->lock);
> > +
> > + return entry;
> > +}
> > +
> > +/**
> > + * sgx_alloc_va_page() - Allocate a Version Array (VA) page
> > + *
> > + * Allocate a free EPC page and convert it to a Version Array (VA) page.
> > + *
> > + * Return:
> > + * a VA page,
> > + * -errno otherwise
> > + */
> > +struct sgx_epc_page *sgx_alloc_va_page(void)
> > +{
> > + struct sgx_epc_page *epc_page;
> > + int ret;
> > +
> > + epc_page = sgx_alloc_epc_page(NULL, true);
> > + if (IS_ERR(epc_page))
> > + return ERR_CAST(epc_page);
> > +
> > + ret = __epa(sgx_get_epc_addr(epc_page));
> > + if (ret) {
> > + WARN_ONCE(1, "EPA returned %d (0x%x)", ret, ret);
> > + sgx_free_epc_page(epc_page);
> > + return ERR_PTR(-EFAULT);
> > + }
> > +
> > + return epc_page;
> > +}
> > +
> > +/**
> > + * sgx_alloc_va_slot - allocate a VA slot
> > + * @va_page: a &struct sgx_va_page instance
> > + *
> > + * Allocates a slot from a &struct sgx_va_page instance.
> > + *
> > + * Return: offset of the slot inside the VA page
> > + */
> > +unsigned int sgx_alloc_va_slot(struct sgx_va_page *va_page)
> > +{
> > + int slot = find_first_zero_bit(va_page->slots, SGX_VA_SLOT_COUNT);
> > +
> > + if (slot < SGX_VA_SLOT_COUNT)
> > + set_bit(slot, va_page->slots);
> > +
> > + return slot << 3;
> > +}
> > +
> > +/**
> > + * sgx_free_va_slot - free a VA slot
> > + * @va_page: a &struct sgx_va_page instance
> > + * @offset: offset of the slot inside the VA page
> > + *
> > + * Frees a slot from a &struct sgx_va_page instance.
> > + */
> > +void sgx_free_va_slot(struct sgx_va_page *va_page, unsigned int offset)
> > +{
> > + clear_bit(offset >> 3, va_page->slots);
> > +}
> > +
> > +/**
> > + * sgx_va_page_full - is the VA page full?
> > + * @va_page: a &struct sgx_va_page instance
> > + *
> > + * Return: true if all slots have been taken
> > + */
> > +bool sgx_va_page_full(struct sgx_va_page *va_page)
> > +{
> > + int slot = find_first_zero_bit(va_page->slots, SGX_VA_SLOT_COUNT);
> > +
> > + return slot == SGX_VA_SLOT_COUNT;
> > +}
> > diff --git a/arch/x86/kernel/cpu/sgx/encl.h
> > b/arch/x86/kernel/cpu/sgx/encl.h
> > index 0448d22d3010..e8eb9e9a834e 100644
> > --- a/arch/x86/kernel/cpu/sgx/encl.h
> > +++ b/arch/x86/kernel/cpu/sgx/encl.h
> > @@ -19,6 +19,10 @@
> > /**
> > * enum sgx_encl_page_desc - defines bits for an enclave page's
> > descriptor
> > + * %SGX_ENCL_PAGE_BEING_RECLAIMED: The page is in the process of being
> > + * reclaimed.
> > + * %SGX_ENCL_PAGE_VA_OFFSET_MASK: Holds the offset in the Version Array
> > + * (VA) page for a swapped page.
> > * %SGX_ENCL_PAGE_ADDR_MASK: Holds the virtual address of the page.
> > *
> > * The page address for SECS is zero and is used by the subsystem to
> > recognize
> > @@ -26,16 +30,23 @@
> > */
> > enum sgx_encl_page_desc {
> > /* Bits 11:3 are available when the page is not swapped. */
> > + SGX_ENCL_PAGE_BEING_RECLAIMED = BIT(3),
> > + SGX_ENCL_PAGE_VA_OFFSET_MASK = GENMASK_ULL(11, 3),
> > SGX_ENCL_PAGE_ADDR_MASK = PAGE_MASK,
> > };
> > #define SGX_ENCL_PAGE_ADDR(page) \
> > ((page)->desc & SGX_ENCL_PAGE_ADDR_MASK)
> > +#define SGX_ENCL_PAGE_VA_OFFSET(page) \
> > + ((page)->desc & SGX_ENCL_PAGE_VA_OFFSET_MASK)
> > +#define SGX_ENCL_PAGE_INDEX(page) \
> > + PFN_DOWN((page)->desc - (page)->encl->base)
> > struct sgx_encl_page {
> > unsigned long desc;
> > unsigned long vm_max_prot_bits;
> > struct sgx_epc_page *epc_page;
> > + struct sgx_va_page *va_page;
> > struct sgx_encl *encl;
> > };
> > @@ -61,6 +72,7 @@ struct sgx_encl {
> > struct mutex lock;
> > struct list_head mm_list;
> > spinlock_t mm_lock;
> > + unsigned long mm_list_version;
> > struct file *backing;
> > struct kref refcount;
> > struct srcu_struct srcu;
> > @@ -68,12 +80,21 @@ struct sgx_encl {
> > unsigned long size;
> > unsigned long ssaframesize;
> > struct xarray page_array;
> > + struct list_head va_pages;
> > struct sgx_encl_page secs;
> > cpumask_t cpumask;
> > unsigned long attributes;
> > unsigned long attributes_mask;
> > };
> > +#define SGX_VA_SLOT_COUNT 512
> > +
> > +struct sgx_va_page {
> > + struct sgx_epc_page *epc_page;
> > + DECLARE_BITMAP(slots, SGX_VA_SLOT_COUNT);
> > + struct list_head list;
> > +};
> > +
> > extern const struct vm_operations_struct sgx_vm_ops;
> > int sgx_encl_find(struct mm_struct *mm, unsigned long addr,
> > @@ -84,4 +105,24 @@ int sgx_encl_mm_add(struct sgx_encl *encl, struct
> > mm_struct *mm);
> > int sgx_encl_may_map(struct sgx_encl *encl, unsigned long start,
> > unsigned long end, unsigned long vm_flags);
> > +struct sgx_backing {
> > + pgoff_t page_index;
> > + struct page *contents;
> > + struct page *pcmd;
> > + unsigned long pcmd_offset;
> > +};
> > +
> > +int sgx_encl_get_backing(struct sgx_encl *encl, unsigned long
> > page_index,
> > + struct sgx_backing *backing);
> > +void sgx_encl_put_backing(struct sgx_backing *backing, bool do_write);
> > +int sgx_encl_test_and_clear_young(struct mm_struct *mm,
> > + struct sgx_encl_page *page);
> > +struct sgx_encl_page *sgx_encl_reserve_page(struct sgx_encl *encl,
> > + unsigned long addr);
> > +
> > +struct sgx_epc_page *sgx_alloc_va_page(void);
> > +unsigned int sgx_alloc_va_slot(struct sgx_va_page *va_page);
> > +void sgx_free_va_slot(struct sgx_va_page *va_page, unsigned int offset);
> > +bool sgx_va_page_full(struct sgx_va_page *va_page);
> > +
> > #endif /* _X86_ENCL_H */
> > diff --git a/arch/x86/kernel/cpu/sgx/ioctl.c
> > b/arch/x86/kernel/cpu/sgx/ioctl.c
> > index 3c04798e83e5..613f6c03598e 100644
> > --- a/arch/x86/kernel/cpu/sgx/ioctl.c
> > +++ b/arch/x86/kernel/cpu/sgx/ioctl.c
> > @@ -16,6 +16,43 @@
> > #include "encl.h"
> > #include "encls.h"
> > +static struct sgx_va_page *sgx_encl_grow(struct sgx_encl *encl)
> > +{
> > + struct sgx_va_page *va_page = NULL;
> > + void *err;
> > +
> > + BUILD_BUG_ON(SGX_VA_SLOT_COUNT !=
> > + (SGX_ENCL_PAGE_VA_OFFSET_MASK >> 3) + 1);
> > +
> > + if (!(encl->page_cnt % SGX_VA_SLOT_COUNT)) {
> > + va_page = kzalloc(sizeof(*va_page), GFP_KERNEL);
> > + if (!va_page)
> > + return ERR_PTR(-ENOMEM);
> > +
> > + va_page->epc_page = sgx_alloc_va_page();
> > + if (IS_ERR(va_page->epc_page)) {
> > + err = ERR_CAST(va_page->epc_page);
> > + kfree(va_page);
> > + return err;
> > + }
> > +
> > + WARN_ON_ONCE(encl->page_cnt % SGX_VA_SLOT_COUNT);
> > + }
> > + encl->page_cnt++;
> > + return va_page;
> > +}
> > +
> > +static void sgx_encl_shrink(struct sgx_encl *encl, struct sgx_va_page
> > *va_page)
> > +{
> > + encl->page_cnt--;
> > +
> > + if (va_page) {
> > + sgx_free_epc_page(va_page->epc_page);
> > + list_del(&va_page->list);
> > + kfree(va_page);
> > + }
> > +}
> > +
> > static u32 sgx_calc_ssa_frame_size(u32 miscselect, u64 xfrm)
> > {
> > u32 size_max = PAGE_SIZE;
> > @@ -80,15 +117,24 @@ static int sgx_validate_secs(const struct sgx_secs
> > *secs)
> > static int sgx_encl_create(struct sgx_encl *encl, struct sgx_secs *secs)
> > {
> > struct sgx_epc_page *secs_epc;
> > + struct sgx_va_page *va_page;
> > struct sgx_pageinfo pginfo;
> > struct sgx_secinfo secinfo;
> > unsigned long encl_size;
> > struct file *backing;
> > long ret;
> > + va_page = sgx_encl_grow(encl);
> > + if (IS_ERR(va_page))
> > + return PTR_ERR(va_page);
> > + else if (va_page)
> > + list_add(&va_page->list, &encl->va_pages);
> > + /* else the tail page of the VA page list had free slots. */
> > +
> > if (sgx_validate_secs(secs)) {
> > pr_debug("invalid SECS\n");
> > - return -EINVAL;
> > + ret = -EINVAL;
> > + goto err_out_shrink;
> > }
> > /* The extra page goes to SECS. */
> > @@ -96,12 +142,14 @@ static int sgx_encl_create(struct sgx_encl *encl,
> > struct sgx_secs *secs)
> > backing = shmem_file_setup("SGX backing", encl_size + (encl_size >> 5),
> > VM_NORESERVE);
> > - if (IS_ERR(backing))
> > - return PTR_ERR(backing);
> > + if (IS_ERR(backing)) {
> > + ret = PTR_ERR(backing);
> > + goto err_out_shrink;
> > + }
> > encl->backing = backing;
> > - secs_epc = __sgx_alloc_epc_page();
> > + secs_epc = sgx_alloc_epc_page(&encl->secs, true);
> > if (IS_ERR(secs_epc)) {
> > ret = PTR_ERR(secs_epc);
> > goto err_out_backing;
> > @@ -149,6 +197,9 @@ static int sgx_encl_create(struct sgx_encl *encl,
> > struct sgx_secs *secs)
> > fput(encl->backing);
> > encl->backing = NULL;
> > +err_out_shrink:
> > + sgx_encl_shrink(encl, va_page);
> > +
> > return ret;
> > }
> > @@ -321,21 +372,35 @@ static int sgx_encl_add_page(struct sgx_encl
> > *encl, unsigned long src,
> > {
> > struct sgx_encl_page *encl_page;
> > struct sgx_epc_page *epc_page;
> > + struct sgx_va_page *va_page;
> > int ret;
> > encl_page = sgx_encl_page_alloc(encl, offset, secinfo->flags);
> > if (IS_ERR(encl_page))
> > return PTR_ERR(encl_page);
> > - epc_page = __sgx_alloc_epc_page();
> > + epc_page = sgx_alloc_epc_page(encl_page, true);
> > if (IS_ERR(epc_page)) {
> > kfree(encl_page);
> > return PTR_ERR(epc_page);
> > }
> > + va_page = sgx_encl_grow(encl);
> > + if (IS_ERR(va_page)) {
> > + ret = PTR_ERR(va_page);
> > + goto err_out_free;
> > + }
> > +
> > mmap_read_lock(current->mm);
> > mutex_lock(&encl->lock);
> > + /*
> > + * Adding to encl->va_pages must be done under encl->lock. Ditto for
> > + * deleting (via sgx_encl_shrink()) in the error path.
> > + */
> > + if (va_page)
> > + list_add(&va_page->list, &encl->va_pages);
> > +
> > /*
> > * Insert prior to EADD in case of OOM. EADD modifies MRENCLAVE, i.e.
> > * can't be gracefully unwound, while failure on EADD/EXTEND is limited
> > @@ -366,6 +431,7 @@ static int sgx_encl_add_page(struct sgx_encl *encl,
> > unsigned long src,
> > goto err_out;
> > }
> > + sgx_mark_page_reclaimable(encl_page->epc_page);
> > mutex_unlock(&encl->lock);
> > mmap_read_unlock(current->mm);
> > return ret;
> > @@ -374,9 +440,11 @@ static int sgx_encl_add_page(struct sgx_encl *encl,
> > unsigned long src,
> > xa_erase(&encl->page_array, PFN_DOWN(encl_page->desc));
> > err_out_unlock:
> > + sgx_encl_shrink(encl, va_page);
> > mutex_unlock(&encl->lock);
> > mmap_read_unlock(current->mm);
> > +err_out_free:
> > sgx_free_epc_page(epc_page);
> > kfree(encl_page);
> > diff --git a/arch/x86/kernel/cpu/sgx/main.c
> > b/arch/x86/kernel/cpu/sgx/main.c
> > index 4137254fb29e..3f9130501370 100644
> > --- a/arch/x86/kernel/cpu/sgx/main.c
> > +++ b/arch/x86/kernel/cpu/sgx/main.c
> > @@ -16,6 +16,395 @@
> > struct sgx_epc_section sgx_epc_sections[SGX_MAX_EPC_SECTIONS];
> > static int sgx_nr_epc_sections;
> > static struct task_struct *ksgxswapd_tsk;
> > +static DECLARE_WAIT_QUEUE_HEAD(ksgxswapd_waitq);
> > +static LIST_HEAD(sgx_active_page_list);
> > +static DEFINE_SPINLOCK(sgx_active_page_list_lock);
> > +
> > +/**
> > + * sgx_mark_page_reclaimable() - Mark a page as reclaimable
> > + * @page: EPC page
> > + *
> > + * Mark a page as reclaimable and add it to the active page list. Pages
> > + * are automatically removed from the active list when freed.
> > + */
> > +void sgx_mark_page_reclaimable(struct sgx_epc_page *page)
> > +{
> > + spin_lock(&sgx_active_page_list_lock);
> > + page->desc |= SGX_EPC_PAGE_RECLAIMABLE;
> > + list_add_tail(&page->list, &sgx_active_page_list);
> > + spin_unlock(&sgx_active_page_list_lock);
> > +}
> > +
> > +/**
> > + * sgx_unmark_page_reclaimable() - Remove a page from the reclaim list
> > + * @page: EPC page
> > + *
> > + * Clear the reclaimable flag and remove the page from the active page
> > list.
> > + *
> > + * Return:
> > + * 0 on success,
> > + * -EBUSY if the page is in the process of being reclaimed
> > + */
> > +int sgx_unmark_page_reclaimable(struct sgx_epc_page *page)
> > +{
> > + /*
> > + * Remove the page from the active list if necessary. If the page
> > + * is actively being reclaimed, i.e. RECLAIMABLE is set but the
> > + * page isn't on the active list, return -EBUSY as we can't free
> > + * the page at this time since it is "owned" by the reclaimer.
> > + */
> > + spin_lock(&sgx_active_page_list_lock);
> > + if (page->desc & SGX_EPC_PAGE_RECLAIMABLE) {
> > + if (list_empty(&page->list)) {
> > + spin_unlock(&sgx_active_page_list_lock);
> > + return -EBUSY;
> > + }
> > + list_del(&page->list);
> > + page->desc &= ~SGX_EPC_PAGE_RECLAIMABLE;
> > + }
> > + spin_unlock(&sgx_active_page_list_lock);
> > +
> > + return 0;
> > +}
> > +
> > +static bool sgx_reclaimer_age(struct sgx_epc_page *epc_page)
> > +{
> > + struct sgx_encl_page *page = epc_page->owner;
> > + struct sgx_encl *encl = page->encl;
> > + struct sgx_encl_mm *encl_mm;
> > + bool ret = true;
> > + int idx;
> > +
> > + idx = srcu_read_lock(&encl->srcu);
> > +
> > + list_for_each_entry_rcu(encl_mm, &encl->mm_list, list) {
> > + if (!mmget_not_zero(encl_mm->mm))
> > + continue;
> > +
> > + mmap_read_lock(encl_mm->mm);
> > + ret = !sgx_encl_test_and_clear_young(encl_mm->mm, page);
> > + mmap_read_unlock(encl_mm->mm);
> > +
> > + mmput_async(encl_mm->mm);
> > +
> > + if (!ret || (atomic_read(&encl->flags) & SGX_ENCL_DEAD))
> > + break;
> > + }
> > +
> > + srcu_read_unlock(&encl->srcu, idx);
> > +
> > + if (!ret && !(atomic_read(&encl->flags) & SGX_ENCL_DEAD))
> > + return false;
> > +
> > + return true;
> > +}
> > +
> > +static void sgx_reclaimer_block(struct sgx_epc_page *epc_page)
> > +{
> > + struct sgx_encl_page *page = epc_page->owner;
> > + unsigned long addr = SGX_ENCL_PAGE_ADDR(page);
> > + struct sgx_encl *encl = page->encl;
> > + unsigned long mm_list_version;
> > + struct sgx_encl_mm *encl_mm;
> > + struct vm_area_struct *vma;
> > + int idx, ret;
> > +
> > + do {
> > + mm_list_version = encl->mm_list_version;
> > +
> > + /* Pairs with smp_rmb() in sgx_encl_mm_add(). */
> > + smp_rmb();
> > +
> > + idx = srcu_read_lock(&encl->srcu);
> > +
> > + list_for_each_entry_rcu(encl_mm, &encl->mm_list, list) {
> > + if (!mmget_not_zero(encl_mm->mm))
> > + continue;
> > +
> > + mmap_read_lock(encl_mm->mm);
> > +
> > + ret = sgx_encl_find(encl_mm->mm, addr, &vma);
> > + if (!ret && encl == vma->vm_private_data)
> > + zap_vma_ptes(vma, addr, PAGE_SIZE);
> > +
> > + mmap_read_unlock(encl_mm->mm);
> > +
> > + mmput_async(encl_mm->mm);
> > + }
> > +
> > + srcu_read_unlock(&encl->srcu, idx);
> > + } while (unlikely(encl->mm_list_version != mm_list_version));
> > +
> > + mutex_lock(&encl->lock);
> > +
> > + if (!(atomic_read(&encl->flags) & SGX_ENCL_DEAD)) {
> > + ret = __eblock(sgx_get_epc_addr(epc_page));
> > + if (encls_failed(ret))
> > + ENCLS_WARN(ret, "EBLOCK");
> > + }
> > +
> > + mutex_unlock(&encl->lock);
> > +}
> > +
> > +static int __sgx_encl_ewb(struct sgx_epc_page *epc_page, void *va_slot,
> > + struct sgx_backing *backing)
> > +{
> > + struct sgx_pageinfo pginfo;
> > + int ret;
> > +
> > + pginfo.addr = 0;
> > + pginfo.secs = 0;
> > +
> > + pginfo.contents = (unsigned long)kmap_atomic(backing->contents);
> > + pginfo.metadata = (unsigned long)kmap_atomic(backing->pcmd) +
> > + backing->pcmd_offset;
> > +
> > + ret = __ewb(&pginfo, sgx_get_epc_addr(epc_page), va_slot);
> > +
> > + kunmap_atomic((void *)(unsigned long)(pginfo.metadata -
> > + backing->pcmd_offset));
> > + kunmap_atomic((void *)(unsigned long)pginfo.contents);
> > +
> > + return ret;
> > +}
> > +
> > +static void sgx_ipi_cb(void *info)
> > +{
> > +}
> > +
> > +static const cpumask_t *sgx_encl_ewb_cpumask(struct sgx_encl *encl)
> > +{
> > + cpumask_t *cpumask = &encl->cpumask;
> > + struct sgx_encl_mm *encl_mm;
> > + int idx;
> > +
> > + /*
> > + * Can race with sgx_encl_mm_add(), but ETRACK has already been
> > + * executed, which means that the CPUs running in the new mm will enter
> > + * into the enclave with a fresh epoch.
> > + */
> > + cpumask_clear(cpumask);
> > +
> > + idx = srcu_read_lock(&encl->srcu);
> > +
> > + list_for_each_entry_rcu(encl_mm, &encl->mm_list, list) {
> > + if (!mmget_not_zero(encl_mm->mm))
> > + continue;
> > +
> > + cpumask_or(cpumask, cpumask, mm_cpumask(encl_mm->mm));
> > +
> > + mmput_async(encl_mm->mm);
> > + }
> > +
> > + srcu_read_unlock(&encl->srcu, idx);
> > +
> > + return cpumask;
> > +}
> > +
> > +/*
> > + * Swap page to the regular memory transformed to the blocked state by
> > using
> > + * EBLOCK, which means that it can no loger be referenced (no new TLB
> > entries).
> > + *
> > + * The first trial just tries to write the page assuming that some
> > other thread
> > + * has reset the count for threads inside the enlave by using ETRACK,
> > and
> > + * previous thread count has been zeroed out. The second trial calls
> > ETRACK
> > + * before EWB. If that fails we kick all the HW threads out, and then
> > do EWB,
> > + * which should be guaranteed the succeed.
> > + */
> > +static void sgx_encl_ewb(struct sgx_epc_page *epc_page,
> > + struct sgx_backing *backing)
> > +{
> > + struct sgx_encl_page *encl_page = epc_page->owner;
> > + struct sgx_encl *encl = encl_page->encl;
> > + struct sgx_va_page *va_page;
> > + unsigned int va_offset;
> > + void *va_slot;
> > + int ret;
> > +
> > + encl_page->desc &= ~SGX_ENCL_PAGE_BEING_RECLAIMED;
> > +
> > + va_page = list_first_entry(&encl->va_pages, struct sgx_va_page,
> > + list);
> > + va_offset = sgx_alloc_va_slot(va_page);
> > + va_slot = sgx_get_epc_addr(va_page->epc_page) + va_offset;
> > + if (sgx_va_page_full(va_page))
> > + list_move_tail(&va_page->list, &encl->va_pages);
> > +
> > + ret = __sgx_encl_ewb(epc_page, va_slot, backing);
> > + if (ret == SGX_NOT_TRACKED) {
> > + ret = __etrack(sgx_get_epc_addr(encl->secs.epc_page));
> > + if (ret) {
> > + if (encls_failed(ret))
> > + ENCLS_WARN(ret, "ETRACK");
> > + }
> > +
> > + ret = __sgx_encl_ewb(epc_page, va_slot, backing);
> > + if (ret == SGX_NOT_TRACKED) {
> > + /*
> > + * Slow path, send IPIs to kick cpus out of the
> > + * enclave. Note, it's imperative that the cpu
> > + * mask is generated *after* ETRACK, else we'll
> > + * miss cpus that entered the enclave between
> > + * generating the mask and incrementing epoch.
> > + */
> > + on_each_cpu_mask(sgx_encl_ewb_cpumask(encl),
> > + sgx_ipi_cb, NULL, 1);
> > + ret = __sgx_encl_ewb(epc_page, va_slot, backing);
> > + }
> > + }
> > +
> > + if (ret) {
> > + if (encls_failed(ret))
> > + ENCLS_WARN(ret, "EWB");
> > +
> > + sgx_free_va_slot(va_page, va_offset);
> > + } else {
> > + encl_page->desc |= va_offset;
> > + encl_page->va_page = va_page;
> > + }
> > +}
> > +
> > +static void sgx_reclaimer_write(struct sgx_epc_page *epc_page,
> > + struct sgx_backing *backing)
> > +{
> > + struct sgx_encl_page *encl_page = epc_page->owner;
> > + struct sgx_encl *encl = encl_page->encl;
> > + struct sgx_backing secs_backing;
> > + int ret;
> > +
> > + mutex_lock(&encl->lock);
> > +
> > + if (atomic_read(&encl->flags) & SGX_ENCL_DEAD) {
> > + ret = __eremove(sgx_get_epc_addr(epc_page));
> > + ENCLS_WARN(ret, "EREMOVE");
> > + } else {
> > + sgx_encl_ewb(epc_page, backing);
> > + }
> > +
> > + encl_page->epc_page = NULL;
> > + encl->secs_child_cnt--;
> > +
> > + if (!encl->secs_child_cnt) {
> > + if (atomic_read(&encl->flags) & SGX_ENCL_DEAD) {
> > + sgx_free_epc_page(encl->secs.epc_page);
> > + encl->secs.epc_page = NULL;
> > + } else if (atomic_read(&encl->flags) & SGX_ENCL_INITIALIZED) {
> > + ret = sgx_encl_get_backing(encl, PFN_DOWN(encl->size),
> > + &secs_backing);
> > + if (ret)
> > + goto out;
> > +
> > + sgx_encl_ewb(encl->secs.epc_page, &secs_backing);
> > +
> > + sgx_free_epc_page(encl->secs.epc_page);
> > + encl->secs.epc_page = NULL;
> > +
> > + sgx_encl_put_backing(&secs_backing, true);
> > + }
> > + }
> > +
> > +out:
> > + mutex_unlock(&encl->lock);
> > +}
> > +
> > +/*
> > + * Take a fixed number of pages from the head of the active page pool
> > and
> > + * reclaim them to the enclave's private shmem files. Skip the pages,
> > which have
> > + * been accessed since the last scan. Move those pages to the tail of
> > active
> > + * page pool so that the pages get scanned in LRU like fashion.
> > + *
> > + * Batch process a chunk of pages (at the moment 16) in order to
> > degrade amount
> > + * of IPI's and ETRACK's potentially required. sgx_encl_ewb() does
> > degrade a bit
> > + * among the HW threads with three stage EWB pipeline (EWB, ETRACK +
> > EWB and IPI
> > + * + EWB) but not sufficiently. Reclaiming one page at a time would
> > also be
> > + * problematic as it would increase the lock contention too much, which
> > would
> > + * halt forward progress.
> > + */
> > +static void sgx_reclaim_pages(void)
> > +{
> > + struct sgx_epc_page *chunk[SGX_NR_TO_SCAN];
> > + struct sgx_backing backing[SGX_NR_TO_SCAN];
> > + struct sgx_epc_section *section;
> > + struct sgx_encl_page *encl_page;
> > + struct sgx_epc_page *epc_page;
> > + int cnt = 0;
> > + int ret;
> > + int i;
> > +
> > + spin_lock(&sgx_active_page_list_lock);
> > + for (i = 0; i < SGX_NR_TO_SCAN; i++) {
> > + if (list_empty(&sgx_active_page_list))
> > + break;
> > +
> > + epc_page = list_first_entry(&sgx_active_page_list,
> > + struct sgx_epc_page, list);
> > + list_del_init(&epc_page->list);
> > + encl_page = epc_page->owner;
> > +
> > + if (kref_get_unless_zero(&encl_page->encl->refcount) != 0)
> > + chunk[cnt++] = epc_page;
> > + else
> > + /* The owner is freeing the page. No need to add the
> > + * page back to the list of reclaimable pages.
> > + */
> > + epc_page->desc &= ~SGX_EPC_PAGE_RECLAIMABLE;
> > + }
> > + spin_unlock(&sgx_active_page_list_lock);
> > +
> > + for (i = 0; i < cnt; i++) {
> > + epc_page = chunk[i];
> > + encl_page = epc_page->owner;
> > +
> > + if (!sgx_reclaimer_age(epc_page))
> > + goto skip;
> > +
> > + ret = sgx_encl_get_backing(encl_page->encl,
> > + SGX_ENCL_PAGE_INDEX(encl_page),
> > + &backing[i]);
> > + if (ret)
> > + goto skip;
> > +
> > + mutex_lock(&encl_page->encl->lock);
> > + encl_page->desc |= SGX_ENCL_PAGE_BEING_RECLAIMED;
> > + mutex_unlock(&encl_page->encl->lock);
> > + continue;
> > +
> > +skip:
> > + spin_lock(&sgx_active_page_list_lock);
> > + list_add_tail(&epc_page->list, &sgx_active_page_list);
> > + spin_unlock(&sgx_active_page_list_lock);
> > +
> > + kref_put(&encl_page->encl->refcount, sgx_encl_release);
> > +
> > + chunk[i] = NULL;
> > + }
> > +
> > + for (i = 0; i < cnt; i++) {
> > + epc_page = chunk[i];
> > + if (epc_page)
> > + sgx_reclaimer_block(epc_page);
> > + }
> > +
> > + for (i = 0; i < cnt; i++) {
> > + epc_page = chunk[i];
> > + if (!epc_page)
> > + continue;
> > +
> > + encl_page = epc_page->owner;
> > + sgx_reclaimer_write(epc_page, &backing[i]);
> > + sgx_encl_put_backing(&backing[i], true);
> > +
> > + kref_put(&encl_page->encl->refcount, sgx_encl_release);
> > + epc_page->desc &= ~SGX_EPC_PAGE_RECLAIMABLE;
> > +
> > + section = sgx_get_epc_section(epc_page);
> > + spin_lock(§ion->lock);
> > + list_add_tail(&epc_page->list, §ion->page_list);
> > + section->free_cnt++;
> > + spin_unlock(§ion->lock);
> > + }
> > +}
> > +
> > static void sgx_sanitize_section(struct sgx_epc_section *section)
> > {
> > @@ -44,6 +433,23 @@ static void sgx_sanitize_section(struct
> > sgx_epc_section *section)
> > }
> > }
> > +static unsigned long sgx_nr_free_pages(void)
> > +{
> > + unsigned long cnt = 0;
> > + int i;
> > +
> > + for (i = 0; i < sgx_nr_epc_sections; i++)
> > + cnt += sgx_epc_sections[i].free_cnt;
> > +
> > + return cnt;
> > +}
> > +
> > +static bool sgx_should_reclaim(unsigned long watermark)
> > +{
> > + return sgx_nr_free_pages() < watermark &&
> > + !list_empty(&sgx_active_page_list);
> > +}
> > +
> > static int ksgxswapd(void *p)
> > {
> > int i;
> > @@ -69,6 +475,20 @@ static int ksgxswapd(void *p)
> > WARN(1, "EPC section %d has unsanitized pages.\n", i);
> > }
> > + while (!kthread_should_stop()) {
> > + if (try_to_freeze())
> > + continue;
> > +
> > + wait_event_freezable(ksgxswapd_waitq,
> > + kthread_should_stop() ||
> > + sgx_should_reclaim(SGX_NR_HIGH_PAGES));
> > +
> > + if (sgx_should_reclaim(SGX_NR_HIGH_PAGES))
> > + sgx_reclaim_pages();
> > +
> > + cond_resched();
> > + }
> > +
> > return 0;
> > }
> > @@ -94,6 +514,7 @@ static struct sgx_epc_page
> > *__sgx_alloc_epc_page_from_section(struct sgx_epc_sec
> > page = list_first_entry(§ion->page_list, struct sgx_epc_page, list);
> > list_del_init(&page->list);
> > + section->free_cnt--;
> > return page;
> > }
> > @@ -127,6 +548,57 @@ struct sgx_epc_page *__sgx_alloc_epc_page(void)
> > return ERR_PTR(-ENOMEM);
> > }
> > +/**
> > + * sgx_alloc_epc_page() - Allocate an EPC page
> > + * @owner: the owner of the EPC page
> > + * @reclaim: reclaim pages if necessary
> > + *
> > + * Iterate through EPC sections and borrow a free EPC page to the
> > caller. When a
> > + * page is no longer needed it must be released with
> > sgx_free_epc_page(). If
> > + * @reclaim is set to true, directly reclaim pages when we are out of
> > pages. No
> > + * mm's can be locked when @reclaim is set to true.
> > + *
> > + * Finally, wake up ksgxswapd when the number of pages goes below the
> > watermark
> > + * before returning back to the caller.
> > + *
> > + * Return:
> > + * an EPC page,
> > + * -errno on error
> > + */
> > +struct sgx_epc_page *sgx_alloc_epc_page(void *owner, bool reclaim)
> > +{
> > + struct sgx_epc_page *entry;
> > +
> > + for ( ; ; ) {
> > + entry = __sgx_alloc_epc_page();
> > + if (!IS_ERR(entry)) {
> > + entry->owner = owner;
> > + break;
> > + }
> > +
> > + if (list_empty(&sgx_active_page_list))
> > + return ERR_PTR(-ENOMEM);
> > +
> > + if (!reclaim) {
> > + entry = ERR_PTR(-EBUSY);
> > + break;
> > + }
> > +
> > + if (signal_pending(current)) {
> > + entry = ERR_PTR(-ERESTARTSYS);
> > + break;
> > + }
> > +
> > + sgx_reclaim_pages();
> > + schedule();
> > + }
> > +
> > + if (sgx_should_reclaim(SGX_NR_LOW_PAGES))
> > + wake_up(&ksgxswapd_waitq);
> > +
> > + return entry;
> > +}
> > +
> > /**
> > * sgx_free_epc_page() - Free an EPC page
> > * @page: an EPC page
> > @@ -138,12 +610,20 @@ void sgx_free_epc_page(struct sgx_epc_page *page)
> > struct sgx_epc_section *section = sgx_get_epc_section(page);
> > int ret;
> > + /*
> > + * Don't take sgx_active_page_list_lock when asserting the page isn't
> > + * reclaimable, missing a WARN in the very rare case is preferable to
> > + * unnecessarily taking a global lock in the common case.
> > + */
> > + WARN_ON_ONCE(page->desc & SGX_EPC_PAGE_RECLAIMABLE);
> > +
> > ret = __eremove(sgx_get_epc_addr(page));
> > if (WARN_ONCE(ret, "EREMOVE returned %d (0x%x)", ret, ret))
> > return;
> > spin_lock(§ion->lock);
> > list_add_tail(&page->list, §ion->page_list);
> > + section->free_cnt++;
> > spin_unlock(§ion->lock);
> > }
> > @@ -194,6 +674,7 @@ static bool __init sgx_setup_epc_section(u64 addr,
> > u64 size,
> > list_add_tail(&page->list, §ion->unsanitized_page_list);
> > }
> > + section->free_cnt = nr_pages;
> > return true;
> > err_out:
> > diff --git a/arch/x86/kernel/cpu/sgx/sgx.h
> > b/arch/x86/kernel/cpu/sgx/sgx.h
> > index 8d126070db1e..ec4f7b338dbe 100644
> > --- a/arch/x86/kernel/cpu/sgx/sgx.h
> > +++ b/arch/x86/kernel/cpu/sgx/sgx.h
> > @@ -15,6 +15,7 @@
> > struct sgx_epc_page {
> > unsigned long desc;
> > + struct sgx_encl_page *owner;
> > struct list_head list;
> > };
> > @@ -27,6 +28,7 @@ struct sgx_epc_page {
> > struct sgx_epc_section {
> > unsigned long pa;
> > void *va;
> > + unsigned long free_cnt;
> > struct list_head page_list;
> > struct list_head unsanitized_page_list;
> > spinlock_t lock;
> > @@ -35,6 +37,10 @@ struct sgx_epc_section {
> > #define SGX_EPC_SECTION_MASK GENMASK(7, 0)
> > #define SGX_MAX_EPC_SECTIONS (SGX_EPC_SECTION_MASK + 1)
> > #define SGX_MAX_ADD_PAGES_LENGTH 0x100000
> > +#define SGX_EPC_PAGE_RECLAIMABLE BIT(8)
> > +#define SGX_NR_TO_SCAN 16
> > +#define SGX_NR_LOW_PAGES 32
> > +#define SGX_NR_HIGH_PAGES 64
> > extern struct sgx_epc_section sgx_epc_sections[SGX_MAX_EPC_SECTIONS];
> > @@ -50,7 +56,10 @@ static inline void *sgx_get_epc_addr(struct
> > sgx_epc_page *page)
> > return section->va + (page->desc & PAGE_MASK) - section->pa;
> > }
> > +void sgx_mark_page_reclaimable(struct sgx_epc_page *page);
> > +int sgx_unmark_page_reclaimable(struct sgx_epc_page *page);
> > struct sgx_epc_page *__sgx_alloc_epc_page(void);
> > +struct sgx_epc_page *sgx_alloc_epc_page(void *owner, bool reclaim);
> > void sgx_free_epc_page(struct sgx_epc_page *page);
> > #endif /* _X86_SGX_H */
>
>
> --
> Using Opera's mail client: http://www.opera.com/mail/
On Sat, Oct 03, 2020 at 07:50:35AM +0300, Jarkko Sakkinen wrote:
> Intel(R) SGX is a set of CPU instructions that can be used by applications
> to set aside private regions of code and data. The code outside the enclave
> is disallowed to access the memory inside the enclave by the CPU access
> control.
>
> There is a new hardware unit in the processor called Memory Encryption
> Engine (MEE) starting from the Skylake microacrhitecture. BIOS can define
> one or many MEE regions that can hold enclave data by configuring them with
> PRMRR registers.
>
> The MEE automatically encrypts the data leaving the processor package to
> the MEE regions. The data is encrypted using a random key whose life-time
> is exactly one power cycle.
>
> The current implementation requires that the firmware sets
> IA32_SGXLEPUBKEYHASH* MSRs as writable so that ultimately the kernel can
> decide what enclaves it wants run. The implementation does not create
> any bottlenecks to support read-only MSRs later on.
>
> You can tell if your CPU supports SGX by looking into /proc/cpuinfo:
>
> cat /proc/cpuinfo | grep sgx
I might be late to the game, but why are you trying to dual-license the
new files you are adding in this patch? How will that help anyone?
I have had many talks with Intel about this in the past, and last I
heard was that when dual-licensing made sense, they would be explicit as
to why it was happening. Or is my memory failing me?
thanks,
greg k-h
On Sat, Oct 03, 2020 at 07:50:46AM +0300, Jarkko Sakkinen wrote:
> Intel Software Guard eXtensions (SGX) is a set of CPU instructions that can
> be used by applications to set aside private regions of code and data. The
> code outside the SGX hosted software entity is prevented from accessing the
> memory inside the enclave by the CPU. We call these entities enclaves.
>
> Add a driver that provides an ioctl API to construct and run enclaves.
> Enclaves are constructed from pages residing in reserved physical memory
> areas. The contents of these pages can only be accessed when they are
> mapped as part of an enclave, by a hardware thread running inside the
> enclave.
>
> The starting state of an enclave consists of a fixed measured set of
> pages that are copied to the EPC during the construction process by
> using the opcode ENCLS leaf functions and Software Enclave Control
> Structure (SECS) that defines the enclave properties.
>
> Enclaves are constructed by using ENCLS leaf functions ECREATE, EADD and
> EINIT. ECREATE initializes SECS, EADD copies pages from system memory to
> the EPC and EINIT checks a given signed measurement and moves the enclave
> into a state ready for execution.
>
> An initialized enclave can only be accessed through special Thread Control
> Structure (TCS) pages by using ENCLU (ring-3 only) leaf EENTER. This leaf
> function converts a thread into enclave mode and continues the execution in
> the offset defined by the TCS provided to EENTER. An enclave is exited
> through syscall, exception, interrupts or by explicitly calling another
> ENCLU leaf EEXIT.
>
> The mmap() permissions are capped by the contained enclave page
> permissions. The mapped areas must also be populated, i.e. each page
> address must contain a page. This logic is implemented in
> sgx_encl_may_map().
>
> Cc: [email protected]
> Cc: [email protected]
> Cc: Andrew Morton <[email protected]>
> Cc: Matthew Wilcox <[email protected]>
> Acked-by: Jethro Beekman <[email protected]>
> Tested-by: Jethro Beekman <[email protected]>
> Tested-by: Haitao Huang <[email protected]>
> Tested-by: Chunyang Hui <[email protected]>
> Tested-by: Jordan Hand <[email protected]>
> Tested-by: Nathaniel McCallum <[email protected]>
> Tested-by: Seth Moore <[email protected]>
> Tested-by: Darren Kenny <[email protected]>
> Reviewed-by: Darren Kenny <[email protected]>
> Co-developed-by: Sean Christopherson <[email protected]>
> Signed-off-by: Sean Christopherson <[email protected]>
> Co-developed-by: Suresh Siddha <[email protected]>
> Signed-off-by: Suresh Siddha <[email protected]>
> Signed-off-by: Jarkko Sakkinen <[email protected]>
> ---
> arch/x86/kernel/cpu/sgx/Makefile | 2 +
> arch/x86/kernel/cpu/sgx/driver.c | 173 ++++++++++++++++
> arch/x86/kernel/cpu/sgx/driver.h | 29 +++
> arch/x86/kernel/cpu/sgx/encl.c | 331 +++++++++++++++++++++++++++++++
> arch/x86/kernel/cpu/sgx/encl.h | 85 ++++++++
> arch/x86/kernel/cpu/sgx/main.c | 11 +
> 6 files changed, 631 insertions(+)
> create mode 100644 arch/x86/kernel/cpu/sgx/driver.c
> create mode 100644 arch/x86/kernel/cpu/sgx/driver.h
> create mode 100644 arch/x86/kernel/cpu/sgx/encl.c
> create mode 100644 arch/x86/kernel/cpu/sgx/encl.h
>
> diff --git a/arch/x86/kernel/cpu/sgx/Makefile b/arch/x86/kernel/cpu/sgx/Makefile
> index 79510ce01b3b..3fc451120735 100644
> --- a/arch/x86/kernel/cpu/sgx/Makefile
> +++ b/arch/x86/kernel/cpu/sgx/Makefile
> @@ -1,2 +1,4 @@
> obj-y += \
> + driver.o \
> + encl.o \
> main.o
> diff --git a/arch/x86/kernel/cpu/sgx/driver.c b/arch/x86/kernel/cpu/sgx/driver.c
> new file mode 100644
> index 000000000000..f54da5f19c2b
> --- /dev/null
> +++ b/arch/x86/kernel/cpu/sgx/driver.c
> @@ -0,0 +1,173 @@
> +// SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause)
You use gpl-only header files in this file, so how in the world can it
be bsd-3 licensed?
Please get your legal department to agree with this, after you explain
to them how you are mixing gpl2-only code in with this file.
> +// Copyright(c) 2016-18 Intel Corporation.
Dates are hard to get right :(
> +
> +#include <linux/acpi.h>
> +#include <linux/miscdevice.h>
> +#include <linux/mman.h>
> +#include <linux/security.h>
> +#include <linux/suspend.h>
> +#include <asm/traps.h>
> +#include "driver.h"
> +#include "encl.h"
> +
> +u64 sgx_encl_size_max_32;
> +u64 sgx_encl_size_max_64;
> +u32 sgx_misc_reserved_mask;
> +u64 sgx_attributes_reserved_mask;
> +u64 sgx_xfrm_reserved_mask = ~0x3;
> +u32 sgx_xsave_size_tbl[64];
> +
> +static int sgx_open(struct inode *inode, struct file *file)
> +{
> + struct sgx_encl *encl;
> + int ret;
> +
> + encl = kzalloc(sizeof(*encl), GFP_KERNEL);
> + if (!encl)
> + return -ENOMEM;
> +
> + atomic_set(&encl->flags, 0);
> + kref_init(&encl->refcount);
> + xa_init(&encl->page_array);
> + mutex_init(&encl->lock);
> + INIT_LIST_HEAD(&encl->mm_list);
> + spin_lock_init(&encl->mm_lock);
> +
> + ret = init_srcu_struct(&encl->srcu);
> + if (ret) {
> + kfree(encl);
> + return ret;
> + }
> +
> + file->private_data = encl;
> +
> + return 0;
> +}
> +
> +static int sgx_release(struct inode *inode, struct file *file)
> +{
> + struct sgx_encl *encl = file->private_data;
> + struct sgx_encl_mm *encl_mm;
> +
> + for ( ; ; ) {
> + spin_lock(&encl->mm_lock);
> +
> + if (list_empty(&encl->mm_list)) {
> + encl_mm = NULL;
> + } else {
> + encl_mm = list_first_entry(&encl->mm_list,
> + struct sgx_encl_mm, list);
> + list_del_rcu(&encl_mm->list);
> + }
> +
> + spin_unlock(&encl->mm_lock);
> +
> + /* The list is empty, ready to go. */
> + if (!encl_mm)
> + break;
> +
> + synchronize_srcu(&encl->srcu);
> + mmu_notifier_unregister(&encl_mm->mmu_notifier, encl_mm->mm);
> + kfree(encl_mm);
> + }
> +
> + mutex_lock(&encl->lock);
> + atomic_or(SGX_ENCL_DEAD, &encl->flags);
So you set a flag that this is dead, and then instantly delete it? Why
does that matter? I see you check for this flag elsewhere, but as you
are just about to delete this structure, how can this be an issue?
> + mutex_unlock(&encl->lock);
> +
> + kref_put(&encl->refcount, sgx_encl_release);
Don't you need to hold the lock across the put? If not, what is
serializing this?
But an even larger comment, why is this reference count needed at all?
You never grab it except at init time, and you free it at close time.
Why not rely on the reference counting that the vfs ensures you?
> + return 0;
> +}
> +
> +static int sgx_mmap(struct file *file, struct vm_area_struct *vma)
> +{
> + struct sgx_encl *encl = file->private_data;
> + int ret;
> +
> + ret = sgx_encl_may_map(encl, vma->vm_start, vma->vm_end, vma->vm_flags);
> + if (ret)
> + return ret;
> +
> + ret = sgx_encl_mm_add(encl, vma->vm_mm);
> + if (ret)
> + return ret;
> +
> + vma->vm_ops = &sgx_vm_ops;
> + vma->vm_flags |= VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP | VM_IO;
> + vma->vm_private_data = encl;
> +
> + return 0;
> +}
> +
> +static unsigned long sgx_get_unmapped_area(struct file *file,
> + unsigned long addr,
> + unsigned long len,
> + unsigned long pgoff,
> + unsigned long flags)
> +{
> + if ((flags & MAP_TYPE) == MAP_PRIVATE)
> + return -EINVAL;
> +
> + if (flags & MAP_FIXED)
> + return addr;
> +
> + return current->mm->get_unmapped_area(file, addr, len, pgoff, flags);
> +}
> +
> +static const struct file_operations sgx_encl_fops = {
> + .owner = THIS_MODULE,
> + .open = sgx_open,
> + .release = sgx_release,
> + .mmap = sgx_mmap,
> + .get_unmapped_area = sgx_get_unmapped_area,
> +};
> +
> +static struct miscdevice sgx_dev_enclave = {
> + .minor = MISC_DYNAMIC_MINOR,
> + .name = "enclave",
> + .nodename = "sgx/enclave",
A subdir for a single device node? Ok, odd, but why not just
"sgx_enclave"? How "special" is this device node?
thanks,
greg k-h
On Sat, Oct 03, 2020 at 04:32:46PM +0200, Greg KH wrote:
> I might be late to the game, but why are you trying to dual-license the
> new files you are adding in this patch? How will that help anyone?
>
> I have had many talks with Intel about this in the past, and last I
> heard was that when dual-licensing made sense, they would be explicit as
> to why it was happening. Or is my memory failing me?
My true and honest answer is that I cannot recall. Not sure even if it
was like when the driver was still out-of-tree implementation. This
would back to 2016 :-)
But we don't need to dig the exact answr because
➜ linux-tpmdd (next) ✔ git --no-pager grep -e BSD --and \( -e SPDX \) -- "arch/*.[Sc]"
arch/arm64/lib/tishift.S:/* SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause)
Oh darn, I guess this implies that my hands are tied :-) I'll gladly
implement the change.
> thanks,
>
> greg k-h
Thank you.
/Jarkko
On Sat, 03 Oct 2020 08:32:45 -0500, Jarkko Sakkinen
<[email protected]> wrote:
> On Sat, Oct 03, 2020 at 12:22:47AM -0500, Haitao Huang wrote:
>> When I turn on CONFIG_PROVE_LOCKING, kernel reports following
>> suspicious RCU
>> usages. Not sure if it is an issue. Just reporting here:
>
> I'm glad to hear that my tip helped you to get us the data.
>
> This does not look like an issue in the page reclaimer, which was not
> obvious for me before. That's a good thing. I was really worried about
> that because it has been very stable for a long period now. The last
> bug fix for the reclaimer was done in June in v31 version of the patch
> set and after that it has been unchanged (except possibly some renames
> requested by Boris).
>
> I wildly guess I have a bad usage pattern for xarray. I migrated to it
> in v36, and it is entirely possible that I've misused it. It was the
> first time that I ever used it. Before xarray we had radix_tree but
> based Matthew Wilcox feedback I did a migration to xarray.
>
> What I'd ask you to do next is to, if by any means possible, to try to
> run the same test with v35 so we can verify this. That one still has
> the radix tree.
>
v35 does not cause any such warning messages from kernel
> Thank you.
>
> /Jarkko
>
>>
>> [ +34.337095] =============================
>> [ +0.000001] WARNING: suspicious RCU usage
>> [ +0.000002] 5.9.0-rc6-lock-sgx39 #1 Not tainted
>> [ +0.000001] -----------------------------
>> [ +0.000001] ./include/linux/xarray.h:1165 suspicious
>> rcu_dereference_check() usage!
>> [ +0.000001]
>> other info that might help us debug this:
>>
>> [ +0.000001]
>> rcu_scheduler_active = 2, debug_locks = 1
>> [ +0.000001] 1 lock held by enclaveos-runne/4238:
>> [ +0.000001] #0: ffff9cc6657e45e8 (&mm->mmap_lock#2){++++}-{3:3}, at:
>> vm_mmap_pgoff+0xa1/0x120
>> [ +0.000005]
>> stack backtrace:
>> [ +0.000002] CPU: 1 PID: 4238 Comm: enclaveos-runne Not tainted
>> 5.9.0-rc6-lock-sgx39 #1
>> [ +0.000001] Hardware name: Microsoft Corporation Virtual
>> Machine/Virtual
>> Machine, BIOS Hyper-V UEFI Release v4.1 04/02/2020
>> [ +0.000002] Call Trace:
>> [ +0.000003] dump_stack+0x7d/0x9f
>> [ +0.000003] lockdep_rcu_suspicious+0xce/0xf0
>> [ +0.000004] xas_start+0x14c/0x1c0
>> [ +0.000003] xas_load+0xf/0x50
>> [ +0.000002] xas_find+0x25c/0x2c0
>> [ +0.000004] sgx_encl_may_map+0x87/0x1c0
>> [ +0.000006] sgx_mmap+0x29/0x70
>> [ +0.000003] mmap_region+0x3ee/0x710
>> [ +0.000006] do_mmap+0x3f1/0x5e0
>> [ +0.000004] vm_mmap_pgoff+0xcd/0x120
>> [ +0.000007] ksys_mmap_pgoff+0x1de/0x240
>> [ +0.000005] __x64_sys_mmap+0x33/0x40
>> [ +0.000002] do_syscall_64+0x37/0x80
>> [ +0.000003] entry_SYSCALL_64_after_hwframe+0x44/0xa9
>> [ +0.000002] RIP: 0033:0x7fe34efe06ba
>> [ +0.000002] Code: 89 f5 41 54 49 89 fc 55 53 74 35 49 63 e8 48 63 da
>> 4d 89
>> f9 49 89 e8 4d 63 d6 48 89 da 4c 89 ee 4c 89 e7 b8 09 00 00 00 0f 05
>> <48> 3d
>> 00 f0 ff ff 77 56 5b 5d 41 5c 41 5d 41 5e 41 5f c3 0f 1f 00
>> [ +0.000001] RSP: 002b:00007ffee83eac08 EFLAGS: 00000206 ORIG_RAX:
>> 0000000000000009
>> [ +0.000001] RAX: ffffffffffffffda RBX: 0000000000000001 RCX:
>> 00007fe34efe06ba
>> [ +0.000001] RDX: 0000000000000001 RSI: 0000000000001000 RDI:
>> 0000000007fff000
>> [ +0.000001] RBP: 0000000000000004 R08: 0000000000000004 R09:
>> 0000000000000000
>> [ +0.000001] R10: 0000000000000011 R11: 0000000000000206 R12:
>> 0000000007fff000
>> [ +0.000001] R13: 0000000000001000 R14: 0000000000000011 R15:
>> 0000000000000000
>>
>> [ +0.000010] =============================
>> [ +0.000001] WARNING: suspicious RCU usage
>> [ +0.000001] 5.9.0-rc6-lock-sgx39 #1 Not tainted
>> [ +0.000001] -----------------------------
>> [ +0.000001] ./include/linux/xarray.h:1181 suspicious
>> rcu_dereference_check() usage!
>> [ +0.000001]
>> other info that might help us debug this:
>>
>> [ +0.000001]
>> rcu_scheduler_active = 2, debug_locks = 1
>> [ +0.000001] 1 lock held by enclaveos-runne/4238:
>> [ +0.000001] #0: ffff9cc6657e45e8 (&mm->mmap_lock#2){++++}-{3:3}, at:
>> vm_mmap_pgoff+0xa1/0x120
>> [ +0.000003]
>> stack backtrace:
>> [ +0.000001] CPU: 1 PID: 4238 Comm: enclaveos-runne Not tainted
>> 5.9.0-rc6-lock-sgx39 #1
>> [ +0.000001] Hardware name: Microsoft Corporation Virtual
>> Machine/Virtual
>> Machine, BIOS Hyper-V UEFI Release v4.1 04/02/2020
>> [ +0.000001] Call Trace:
>> [ +0.000001] dump_stack+0x7d/0x9f
>> [ +0.000003] lockdep_rcu_suspicious+0xce/0xf0
>> [ +0.000003] xas_descend+0x116/0x120
>> [ +0.000004] xas_load+0x42/0x50
>> [ +0.000002] xas_find+0x25c/0x2c0
>> [ +0.000004] sgx_encl_may_map+0x87/0x1c0
>> [ +0.000006] sgx_mmap+0x29/0x70
>> [ +0.000002] mmap_region+0x3ee/0x710
>> [ +0.000006] do_mmap+0x3f1/0x5e0
>> [ +0.000004] vm_mmap_pgoff+0xcd/0x120
>> [ +0.000007] ksys_mmap_pgoff+0x1de/0x240
>> [ +0.000005] __x64_sys_mmap+0x33/0x40
>> [ +0.000002] do_syscall_64+0x37/0x80
>> [ +0.000002] entry_SYSCALL_64_after_hwframe+0x44/0xa9
>> [ +0.000001] RIP: 0033:0x7fe34efe06ba
>> [ +0.000001] Code: 89 f5 41 54 49 89 fc 55 53 74 35 49 63 e8 48 63 da
>> 4d 89
>> f9 49 89 e8 4d 63 d6 48 89 da 4c 89 ee 4c 89 e7 b8 09 00 00 00 0f 05
>> <48> 3d
>> 00 f0 ff ff 77 56 5b 5d 41 5c 41 5d 41 5e 41 5f c3 0f 1f 00
>> [ +0.000001] RSP: 002b:00007ffee83eac08 EFLAGS: 00000206 ORIG_RAX:
>> 0000000000000009
>> [ +0.000001] RAX: ffffffffffffffda RBX: 0000000000000001 RCX:
>> 00007fe34efe06ba
>> [ +0.000001] RDX: 0000000000000001 RSI: 0000000000001000 RDI:
>> 0000000007fff000
>> [ +0.000001] RBP: 0000000000000004 R08: 0000000000000004 R09:
>> 0000000000000000
>> [ +0.000001] R10: 0000000000000011 R11: 0000000000000206 R12:
>> 0000000007fff000
>> [ +0.000001] R13: 0000000000001000 R14: 0000000000000011 R15:
>> 0000000000000000
>>
>> [ +0.001117] =============================
>> [ +0.000001] WARNING: suspicious RCU usage
>> [ +0.000001] 5.9.0-rc6-lock-sgx39 #1 Not tainted
>> [ +0.000001] -----------------------------
>> [ +0.000001] ./include/linux/xarray.h:1181 suspicious
>> rcu_dereference_check() usage!
>> [ +0.000001]
>> other info that might help us debug this:
>>
>> [ +0.000001]
>> rcu_scheduler_active = 2, debug_locks = 1
>> [ +0.000001] 1 lock held by enclaveos-runne/4238:
>> [ +0.000001] #0: ffff9cc6657e45e8 (&mm->mmap_lock#2){++++}-{3:3}, at:
>> vm_mmap_pgoff+0xa1/0x120
>> [ +0.000003]
>> stack backtrace:
>> [ +0.000002] CPU: 1 PID: 4238 Comm: enclaveos-runne Not tainted
>> 5.9.0-rc6-lock-sgx39 #1
>> [ +0.000001] Hardware name: Microsoft Corporation Virtual
>> Machine/Virtual
>> Machine, BIOS Hyper-V UEFI Release v4.1 04/02/2020
>> [ +0.000001] Call Trace:
>> [ +0.000002] dump_stack+0x7d/0x9f
>> [ +0.000003] lockdep_rcu_suspicious+0xce/0xf0
>> [ +0.000003] sgx_encl_may_map+0x1b0/0x1c0
>> [ +0.000006] sgx_mmap+0x29/0x70
>> [ +0.000002] mmap_region+0x3ee/0x710
>> [ +0.000006] do_mmap+0x3f1/0x5e0
>> [ +0.000005] vm_mmap_pgoff+0xcd/0x120
>> [ +0.000006] ksys_mmap_pgoff+0x1de/0x240
>> [ +0.000005] __x64_sys_mmap+0x33/0x40
>> [ +0.000002] do_syscall_64+0x37/0x80
>> [ +0.000002] entry_SYSCALL_64_after_hwframe+0x44/0xa9
>> [ +0.000002] RIP: 0033:0x7fe34efe06ba
>> [ +0.000001] Code: 89 f5 41 54 49 89 fc 55 53 74 35 49 63 e8 48 63 da
>> 4d 89
>> f9 49 89 e8 4d 63 d6 48 89 da 4c 89 ee 4c 89 e7 b8 09 00 00 00 0f 05
>> <48> 3d
>> 00 f0 ff ff 77 56 5b 5d 41 5c 41 5d 41 5e 41 5f c3 0f 1f 00
>> [ +0.000001] RSP: 002b:00007ffee83eac08 EFLAGS: 00000206 ORIG_RAX:
>> 0000000000000009
>> [ +0.000001] RAX: ffffffffffffffda RBX: 0000000000000003 RCX:
>> 00007fe34efe06ba
>> [ +0.000001] RDX: 0000000000000003 RSI: 0000000000010000 RDI:
>> 0000000007fee000
>> [ +0.000001] RBP: 0000000000000004 R08: 0000000000000004 R09:
>> 0000000000000000
>> [ +0.000001] R10: 0000000000000011 R11: 0000000000000206 R12:
>> 0000000007fee000
>> [ +0.000001] R13: 0000000000010000 R14: 0000000000000011 R15:
>> 0000000000000000
>>
>> [ +0.003197] =============================
>> [ +0.000001] WARNING: suspicious RCU usage
>> [ +0.000001] 5.9.0-rc6-lock-sgx39 #1 Not tainted
>> [ +0.000001] -----------------------------
>> [ +0.000001] ./include/linux/xarray.h:1198 suspicious
>> rcu_dereference_check() usage!
>> [ +0.000001]
>> other info that might help us debug this:
>>
>> [ +0.000001]
>> rcu_scheduler_active = 2, debug_locks = 1
>> [ +0.000001] 1 lock held by enclaveos-runne/4238:
>> [ +0.000001] #0: ffff9cc6657e45e8 (&mm->mmap_lock#2){++++}-{3:3}, at:
>> vm_mmap_pgoff+0xa1/0x120
>> [ +0.000003]
>> stack backtrace:
>> [ +0.000002] CPU: 1 PID: 4238 Comm: enclaveos-runne Not tainted
>> 5.9.0-rc6-lock-sgx39 #1
>> [ +0.000001] Hardware name: Microsoft Corporation Virtual
>> Machine/Virtual
>> Machine, BIOS Hyper-V UEFI Release v4.1 04/02/2020
>> [ +0.000001] Call Trace:
>> [ +0.000002] dump_stack+0x7d/0x9f
>> [ +0.000003] lockdep_rcu_suspicious+0xce/0xf0
>> [ +0.000004] xas_find+0x255/0x2c0
>> [ +0.000003] sgx_encl_may_map+0xad/0x1c0
>> [ +0.000006] sgx_mmap+0x29/0x70
>> [ +0.000003] mmap_region+0x3ee/0x710
>> [ +0.000005] do_mmap+0x3f1/0x5e0
>> [ +0.000005] vm_mmap_pgoff+0xcd/0x120
>> [ +0.000007] ksys_mmap_pgoff+0x1de/0x240
>> [ +0.000004] __x64_sys_mmap+0x33/0x40
>> [ +0.000002] do_syscall_64+0x37/0x80
>> [ +0.000002] entry_SYSCALL_64_after_hwframe+0x44/0xa9
>> [ +0.000002] RIP: 0033:0x7fe34efe06ba
>> [ +0.000001] Code: 89 f5 41 54 49 89 fc 55 53 74 35 49 63 e8 48 63 da
>> 4d 89
>> f9 49 89 e8 4d 63 d6 48 89 da 4c 89 ee 4c 89 e7 b8 09 00 00 00 0f 05
>> <48> 3d
>> 00 f0 ff ff 77 56 5b 5d 41 5c 41 5d 41 5e 41 5f c3 0f 1f 00
>> [ +0.000001] RSP: 002b:00007ffee83eac08 EFLAGS: 00000206 ORIG_RAX:
>> 0000000000000009
>> [ +0.000002] RAX: ffffffffffffffda RBX: 0000000000000003 RCX:
>> 00007fe34efe06ba
>> [ +0.000001] RDX: 0000000000000003 RSI: 0000000000010000 RDI:
>> 0000000007fba000
>> [ +0.000001] RBP: 0000000000000004 R08: 0000000000000004 R09:
>> 0000000000000000
>> [ +0.000001] R10: 0000000000000011 R11: 0000000000000206 R12:
>> 0000000007fba000
>> [ +0.000001] R13: 0000000000010000 R14: 0000000000000011 R15:
>> 0000000000000000
>>
>>
>> On Fri, 02 Oct 2020 23:50:51 -0500, Jarkko Sakkinen
>> <[email protected]> wrote:
>>
>> > There is a limited amount of EPC available. Therefore, some of it
>> must be
>> > copied to the regular memory, and only subset kept in the SGX reserved
>> > memory. While kernel cannot directly access enclave memory, SGX
>> provides
>> > a
>> > set of ENCLS leaf functions to perform reclaiming.
>> >
>> > Implement a page reclaimer by using these leaf functions. It picks the
>> > victim pages in LRU fashion from all the enclaves running in the
>> system.
>> > The thread ksgxswapd reclaims pages on the event when the number of
>> free
>> > EPC pages goes below SGX_NR_LOW_PAGES up until it reaches
>> > SGX_NR_HIGH_PAGES.
>> >
>> > sgx_alloc_epc_page() can optionally directly reclaim pages with
>> @reclaim
>> > set true. A caller must also supply owner for each page so that the
>> > reclaimer can access the associated enclaves. This is needed for
>> locking,
>> > as most of the ENCLS leafs cannot be executed concurrently for an
>> > enclave.
>> > The owner is also needed for accessing SECS, which is required to be
>> > resident when its child pages are being reclaimed.
>> >
>> > Cc: [email protected]
>> > Acked-by: Jethro Beekman <[email protected]>
>> > Tested-by: Jethro Beekman <[email protected]>
>> > Tested-by: Jordan Hand <[email protected]>
>> > Tested-by: Nathaniel McCallum <[email protected]>
>> > Tested-by: Chunyang Hui <[email protected]>
>> > Tested-by: Seth Moore <[email protected]>
>> > Co-developed-by: Sean Christopherson <[email protected]>
>> > Signed-off-by: Sean Christopherson <[email protected]>
>> > Signed-off-by: Jarkko Sakkinen <[email protected]>
>> > ---
>> > arch/x86/kernel/cpu/sgx/driver.c | 1 +
>> > arch/x86/kernel/cpu/sgx/encl.c | 344 +++++++++++++++++++++-
>> > arch/x86/kernel/cpu/sgx/encl.h | 41 +++
>> > arch/x86/kernel/cpu/sgx/ioctl.c | 78 ++++-
>> > arch/x86/kernel/cpu/sgx/main.c | 481
>> +++++++++++++++++++++++++++++++
>> > arch/x86/kernel/cpu/sgx/sgx.h | 9 +
>> > 6 files changed, 947 insertions(+), 7 deletions(-)
>> >
>> > diff --git a/arch/x86/kernel/cpu/sgx/driver.c
>> > b/arch/x86/kernel/cpu/sgx/driver.c
>> > index d01b28f7ce4a..0446781cc7a2 100644
>> > --- a/arch/x86/kernel/cpu/sgx/driver.c
>> > +++ b/arch/x86/kernel/cpu/sgx/driver.c
>> > @@ -29,6 +29,7 @@ static int sgx_open(struct inode *inode, struct file
>> > *file)
>> > atomic_set(&encl->flags, 0);
>> > kref_init(&encl->refcount);
>> > xa_init(&encl->page_array);
>> > + INIT_LIST_HEAD(&encl->va_pages);
>> > mutex_init(&encl->lock);
>> > INIT_LIST_HEAD(&encl->mm_list);
>> > spin_lock_init(&encl->mm_lock);
>> > diff --git a/arch/x86/kernel/cpu/sgx/encl.c
>> > b/arch/x86/kernel/cpu/sgx/encl.c
>> > index c2c4a77af36b..54326efa6c2f 100644
>> > --- a/arch/x86/kernel/cpu/sgx/encl.c
>> > +++ b/arch/x86/kernel/cpu/sgx/encl.c
>> > @@ -12,9 +12,88 @@
>> > #include "encls.h"
>> > #include "sgx.h"
>> > +/*
>> > + * ELDU: Load an EPC page as unblocked. For more info, see "OS
>> > Management of EPC
>> > + * Pages" in the SDM.
>> > + */
>> > +static int __sgx_encl_eldu(struct sgx_encl_page *encl_page,
>> > + struct sgx_epc_page *epc_page,
>> > + struct sgx_epc_page *secs_page)
>> > +{
>> > + unsigned long va_offset = SGX_ENCL_PAGE_VA_OFFSET(encl_page);
>> > + struct sgx_encl *encl = encl_page->encl;
>> > + struct sgx_pageinfo pginfo;
>> > + struct sgx_backing b;
>> > + pgoff_t page_index;
>> > + int ret;
>> > +
>> > + if (secs_page)
>> > + page_index = SGX_ENCL_PAGE_INDEX(encl_page);
>> > + else
>> > + page_index = PFN_DOWN(encl->size);
>> > +
>> > + ret = sgx_encl_get_backing(encl, page_index, &b);
>> > + if (ret)
>> > + return ret;
>> > +
>> > + pginfo.addr = SGX_ENCL_PAGE_ADDR(encl_page);
>> > + pginfo.contents = (unsigned long)kmap_atomic(b.contents);
>> > + pginfo.metadata = (unsigned long)kmap_atomic(b.pcmd) +
>> > + b.pcmd_offset;
>> > +
>> > + if (secs_page)
>> > + pginfo.secs = (u64)sgx_get_epc_addr(secs_page);
>> > + else
>> > + pginfo.secs = 0;
>> > +
>> > + ret = __eldu(&pginfo, sgx_get_epc_addr(epc_page),
>> > + sgx_get_epc_addr(encl_page->va_page->epc_page) +
>> > + va_offset);
>> > + if (ret) {
>> > + if (encls_failed(ret))
>> > + ENCLS_WARN(ret, "ELDU");
>> > +
>> > + ret = -EFAULT;
>> > + }
>> > +
>> > + kunmap_atomic((void *)(unsigned long)(pginfo.metadata -
>> > b.pcmd_offset));
>> > + kunmap_atomic((void *)(unsigned long)pginfo.contents);
>> > +
>> > + sgx_encl_put_backing(&b, false);
>> > +
>> > + return ret;
>> > +}
>> > +
>> > +static struct sgx_epc_page *sgx_encl_eldu(struct sgx_encl_page
>> > *encl_page,
>> > + struct sgx_epc_page *secs_page)
>> > +{
>> > + unsigned long va_offset = SGX_ENCL_PAGE_VA_OFFSET(encl_page);
>> > + struct sgx_encl *encl = encl_page->encl;
>> > + struct sgx_epc_page *epc_page;
>> > + int ret;
>> > +
>> > + epc_page = sgx_alloc_epc_page(encl_page, false);
>> > + if (IS_ERR(epc_page))
>> > + return epc_page;
>> > +
>> > + ret = __sgx_encl_eldu(encl_page, epc_page, secs_page);
>> > + if (ret) {
>> > + sgx_free_epc_page(epc_page);
>> > + return ERR_PTR(ret);
>> > + }
>> > +
>> > + sgx_free_va_slot(encl_page->va_page, va_offset);
>> > + list_move(&encl_page->va_page->list, &encl->va_pages);
>> > + encl_page->desc &= ~SGX_ENCL_PAGE_VA_OFFSET_MASK;
>> > + encl_page->epc_page = epc_page;
>> > +
>> > + return epc_page;
>> > +}
>> > +
>> > static struct sgx_encl_page *sgx_encl_load_page(struct sgx_encl
>> *encl,
>> > unsigned long addr)
>> > {
>> > + struct sgx_epc_page *epc_page;
>> > struct sgx_encl_page *entry;
>> > unsigned int flags;
>> > @@ -33,10 +112,27 @@ static struct sgx_encl_page
>> > *sgx_encl_load_page(struct sgx_encl *encl,
>> > return ERR_PTR(-EFAULT);
>> > /* Page is already resident in the EPC. */
>> > - if (entry->epc_page)
>> > + if (entry->epc_page) {
>> > + if (entry->desc & SGX_ENCL_PAGE_BEING_RECLAIMED)
>> > + return ERR_PTR(-EBUSY);
>> > +
>> > return entry;
>> > + }
>> > +
>> > + if (!(encl->secs.epc_page)) {
>> > + epc_page = sgx_encl_eldu(&encl->secs, NULL);
>> > + if (IS_ERR(epc_page))
>> > + return ERR_CAST(epc_page);
>> > + }
>> > - return ERR_PTR(-EFAULT);
>> > + epc_page = sgx_encl_eldu(entry, encl->secs.epc_page);
>> > + if (IS_ERR(epc_page))
>> > + return ERR_CAST(epc_page);
>> > +
>> > + encl->secs_child_cnt++;
>> > + sgx_mark_page_reclaimable(entry->epc_page);
>> > +
>> > + return entry;
>> > }
>> > static void sgx_mmu_notifier_release(struct mmu_notifier *mn,
>> > @@ -132,6 +228,9 @@ int sgx_encl_mm_add(struct sgx_encl *encl, struct
>> > mm_struct *mm)
>> > spin_lock(&encl->mm_lock);
>> > list_add_rcu(&encl_mm->list, &encl->mm_list);
>> > + /* Pairs with smp_rmb() in sgx_reclaimer_block(). */
>> > + smp_wmb();
>> > + encl->mm_list_version++;
>> > spin_unlock(&encl->mm_lock);
>> > return 0;
>> > @@ -179,6 +278,8 @@ static unsigned int sgx_vma_fault(struct vm_fault
>> > *vmf)
>> > goto out;
>> > }
>> > + sgx_encl_test_and_clear_young(vma->vm_mm, entry);
>> > +
>> > out:
>> > mutex_unlock(&encl->lock);
>> > return ret;
>> > @@ -280,6 +381,7 @@ int sgx_encl_find(struct mm_struct *mm, unsigned
>> > long addr,
>> > */
>> > void sgx_encl_destroy(struct sgx_encl *encl)
>> > {
>> > + struct sgx_va_page *va_page;
>> > struct sgx_encl_page *entry;
>> > unsigned long index;
>> > @@ -287,6 +389,13 @@ void sgx_encl_destroy(struct sgx_encl *encl)
>> > xa_for_each(&encl->page_array, index, entry) {
>> > if (entry->epc_page) {
>> > + /*
>> > + * The page and its radix tree entry cannot be freed
>> > + * if the page is being held by the reclaimer.
>> > + */
>> > + if (sgx_unmark_page_reclaimable(entry->epc_page))
>> > + continue;
>> > +
>> > sgx_free_epc_page(entry->epc_page);
>> > encl->secs_child_cnt--;
>> > entry->epc_page = NULL;
>> > @@ -301,6 +410,19 @@ void sgx_encl_destroy(struct sgx_encl *encl)
>> > sgx_free_epc_page(encl->secs.epc_page);
>> > encl->secs.epc_page = NULL;
>> > }
>> > +
>> > + /*
>> > + * The reclaimer is responsible for checking SGX_ENCL_DEAD before
>> doing
>> > + * EWB, thus it's safe to free VA pages even if the reclaimer holds
>> a
>> > + * reference to the enclave.
>> > + */
>> > + while (!list_empty(&encl->va_pages)) {
>> > + va_page = list_first_entry(&encl->va_pages, struct sgx_va_page,
>> > + list);
>> > + list_del(&va_page->list);
>> > + sgx_free_epc_page(va_page->epc_page);
>> > + kfree(va_page);
>> > + }
>> > }
>> > /**
>> > @@ -329,3 +451,221 @@ void sgx_encl_release(struct kref *ref)
>> > kfree(encl);
>> > }
>> > +
>> > +static struct page *sgx_encl_get_backing_page(struct sgx_encl *encl,
>> > + pgoff_t index)
>> > +{
>> > + struct inode *inode = encl->backing->f_path.dentry->d_inode;
>> > + struct address_space *mapping = inode->i_mapping;
>> > + gfp_t gfpmask = mapping_gfp_mask(mapping);
>> > +
>> > + return shmem_read_mapping_page_gfp(mapping, index, gfpmask);
>> > +}
>> > +
>> > +/**
>> > + * sgx_encl_get_backing() - Pin the backing storage
>> > + * @encl: an enclave pointer
>> > + * @page_index: enclave page index
>> > + * @backing: data for accessing backing storage for the page
>> > + *
>> > + * Pin the backing storage pages for storing the encrypted contents
>> and
>> > Paging
>> > + * Crypto MetaData (PCMD) of an enclave page.
>> > + *
>> > + * Return:
>> > + * 0 on success,
>> > + * -errno otherwise.
>> > + */
>> > +int sgx_encl_get_backing(struct sgx_encl *encl, unsigned long
>> > page_index,
>> > + struct sgx_backing *backing)
>> > +{
>> > + pgoff_t pcmd_index = PFN_DOWN(encl->size) + 1 + (page_index >> 5);
>> > + struct page *contents;
>> > + struct page *pcmd;
>> > +
>> > + contents = sgx_encl_get_backing_page(encl, page_index);
>> > + if (IS_ERR(contents))
>> > + return PTR_ERR(contents);
>> > +
>> > + pcmd = sgx_encl_get_backing_page(encl, pcmd_index);
>> > + if (IS_ERR(pcmd)) {
>> > + put_page(contents);
>> > + return PTR_ERR(pcmd);
>> > + }
>> > +
>> > + backing->page_index = page_index;
>> > + backing->contents = contents;
>> > + backing->pcmd = pcmd;
>> > + backing->pcmd_offset =
>> > + (page_index & (PAGE_SIZE / sizeof(struct sgx_pcmd) - 1)) *
>> > + sizeof(struct sgx_pcmd);
>> > +
>> > + return 0;
>> > +}
>> > +
>> > +/**
>> > + * sgx_encl_put_backing() - Unpin the backing storage
>> > + * @backing: data for accessing backing storage for the page
>> > + * @do_write: mark pages dirty
>> > + */
>> > +void sgx_encl_put_backing(struct sgx_backing *backing, bool do_write)
>> > +{
>> > + if (do_write) {
>> > + set_page_dirty(backing->pcmd);
>> > + set_page_dirty(backing->contents);
>> > + }
>> > +
>> > + put_page(backing->pcmd);
>> > + put_page(backing->contents);
>> > +}
>> > +
>> > +static int sgx_encl_test_and_clear_young_cb(pte_t *ptep, unsigned
>> long
>> > addr,
>> > + void *data)
>> > +{
>> > + pte_t pte;
>> > + int ret;
>> > +
>> > + ret = pte_young(*ptep);
>> > + if (ret) {
>> > + pte = pte_mkold(*ptep);
>> > + set_pte_at((struct mm_struct *)data, addr, ptep, pte);
>> > + }
>> > +
>> > + return ret;
>> > +}
>> > +
>> > +/**
>> > + * sgx_encl_test_and_clear_young() - Test and reset the accessed bit
>> > + * @mm: mm_struct that is checked
>> > + * @page: enclave page to be tested for recent access
>> > + *
>> > + * Checks the Access (A) bit from the PTE corresponding to the
>> enclave
>> > page and
>> > + * clears it.
>> > + *
>> > + * Return: 1 if the page has been recently accessed and 0 if not.
>> > + */
>> > +int sgx_encl_test_and_clear_young(struct mm_struct *mm,
>> > + struct sgx_encl_page *page)
>> > +{
>> > + unsigned long addr = SGX_ENCL_PAGE_ADDR(page);
>> > + struct sgx_encl *encl = page->encl;
>> > + struct vm_area_struct *vma;
>> > + int ret;
>> > +
>> > + ret = sgx_encl_find(mm, addr, &vma);
>> > + if (ret)
>> > + return 0;
>> > +
>> > + if (encl != vma->vm_private_data)
>> > + return 0;
>> > +
>> > + ret = apply_to_page_range(vma->vm_mm, addr, PAGE_SIZE,
>> > + sgx_encl_test_and_clear_young_cb, vma->vm_mm);
>> > + if (ret < 0)
>> > + return 0;
>> > +
>> > + return ret;
>> > +}
>> > +
>> > +/**
>> > + * sgx_encl_reserve_page() - Reserve an enclave page
>> > + * @encl: an enclave pointer
>> > + * @addr: a page address
>> > + *
>> > + * Load an enclave page and lock the enclave so that the page can be
>> > used by
>> > + * EDBG* and EMOD*.
>> > + *
>> > + * Return:
>> > + * an enclave page on success
>> > + * -EFAULT if the load fails
>> > + */
>> > +struct sgx_encl_page *sgx_encl_reserve_page(struct sgx_encl *encl,
>> > + unsigned long addr)
>> > +{
>> > + struct sgx_encl_page *entry;
>> > +
>> > + for ( ; ; ) {
>> > + mutex_lock(&encl->lock);
>> > +
>> > + entry = sgx_encl_load_page(encl, addr);
>> > + if (PTR_ERR(entry) != -EBUSY)
>> > + break;
>> > +
>> > + mutex_unlock(&encl->lock);
>> > + }
>> > +
>> > + if (IS_ERR(entry))
>> > + mutex_unlock(&encl->lock);
>> > +
>> > + return entry;
>> > +}
>> > +
>> > +/**
>> > + * sgx_alloc_va_page() - Allocate a Version Array (VA) page
>> > + *
>> > + * Allocate a free EPC page and convert it to a Version Array (VA)
>> page.
>> > + *
>> > + * Return:
>> > + * a VA page,
>> > + * -errno otherwise
>> > + */
>> > +struct sgx_epc_page *sgx_alloc_va_page(void)
>> > +{
>> > + struct sgx_epc_page *epc_page;
>> > + int ret;
>> > +
>> > + epc_page = sgx_alloc_epc_page(NULL, true);
>> > + if (IS_ERR(epc_page))
>> > + return ERR_CAST(epc_page);
>> > +
>> > + ret = __epa(sgx_get_epc_addr(epc_page));
>> > + if (ret) {
>> > + WARN_ONCE(1, "EPA returned %d (0x%x)", ret, ret);
>> > + sgx_free_epc_page(epc_page);
>> > + return ERR_PTR(-EFAULT);
>> > + }
>> > +
>> > + return epc_page;
>> > +}
>> > +
>> > +/**
>> > + * sgx_alloc_va_slot - allocate a VA slot
>> > + * @va_page: a &struct sgx_va_page instance
>> > + *
>> > + * Allocates a slot from a &struct sgx_va_page instance.
>> > + *
>> > + * Return: offset of the slot inside the VA page
>> > + */
>> > +unsigned int sgx_alloc_va_slot(struct sgx_va_page *va_page)
>> > +{
>> > + int slot = find_first_zero_bit(va_page->slots, SGX_VA_SLOT_COUNT);
>> > +
>> > + if (slot < SGX_VA_SLOT_COUNT)
>> > + set_bit(slot, va_page->slots);
>> > +
>> > + return slot << 3;
>> > +}
>> > +
>> > +/**
>> > + * sgx_free_va_slot - free a VA slot
>> > + * @va_page: a &struct sgx_va_page instance
>> > + * @offset: offset of the slot inside the VA page
>> > + *
>> > + * Frees a slot from a &struct sgx_va_page instance.
>> > + */
>> > +void sgx_free_va_slot(struct sgx_va_page *va_page, unsigned int
>> offset)
>> > +{
>> > + clear_bit(offset >> 3, va_page->slots);
>> > +}
>> > +
>> > +/**
>> > + * sgx_va_page_full - is the VA page full?
>> > + * @va_page: a &struct sgx_va_page instance
>> > + *
>> > + * Return: true if all slots have been taken
>> > + */
>> > +bool sgx_va_page_full(struct sgx_va_page *va_page)
>> > +{
>> > + int slot = find_first_zero_bit(va_page->slots, SGX_VA_SLOT_COUNT);
>> > +
>> > + return slot == SGX_VA_SLOT_COUNT;
>> > +}
>> > diff --git a/arch/x86/kernel/cpu/sgx/encl.h
>> > b/arch/x86/kernel/cpu/sgx/encl.h
>> > index 0448d22d3010..e8eb9e9a834e 100644
>> > --- a/arch/x86/kernel/cpu/sgx/encl.h
>> > +++ b/arch/x86/kernel/cpu/sgx/encl.h
>> > @@ -19,6 +19,10 @@
>> > /**
>> > * enum sgx_encl_page_desc - defines bits for an enclave page's
>> > descriptor
>> > + * %SGX_ENCL_PAGE_BEING_RECLAIMED: The page is in the process of
>> being
>> > + * reclaimed.
>> > + * %SGX_ENCL_PAGE_VA_OFFSET_MASK: Holds the offset in the Version
>> Array
>> > + * (VA) page for a swapped page.
>> > * %SGX_ENCL_PAGE_ADDR_MASK: Holds the virtual address of the page.
>> > *
>> > * The page address for SECS is zero and is used by the subsystem to
>> > recognize
>> > @@ -26,16 +30,23 @@
>> > */
>> > enum sgx_encl_page_desc {
>> > /* Bits 11:3 are available when the page is not swapped. */
>> > + SGX_ENCL_PAGE_BEING_RECLAIMED = BIT(3),
>> > + SGX_ENCL_PAGE_VA_OFFSET_MASK = GENMASK_ULL(11, 3),
>> > SGX_ENCL_PAGE_ADDR_MASK = PAGE_MASK,
>> > };
>> > #define SGX_ENCL_PAGE_ADDR(page) \
>> > ((page)->desc & SGX_ENCL_PAGE_ADDR_MASK)
>> > +#define SGX_ENCL_PAGE_VA_OFFSET(page) \
>> > + ((page)->desc & SGX_ENCL_PAGE_VA_OFFSET_MASK)
>> > +#define SGX_ENCL_PAGE_INDEX(page) \
>> > + PFN_DOWN((page)->desc - (page)->encl->base)
>> > struct sgx_encl_page {
>> > unsigned long desc;
>> > unsigned long vm_max_prot_bits;
>> > struct sgx_epc_page *epc_page;
>> > + struct sgx_va_page *va_page;
>> > struct sgx_encl *encl;
>> > };
>> > @@ -61,6 +72,7 @@ struct sgx_encl {
>> > struct mutex lock;
>> > struct list_head mm_list;
>> > spinlock_t mm_lock;
>> > + unsigned long mm_list_version;
>> > struct file *backing;
>> > struct kref refcount;
>> > struct srcu_struct srcu;
>> > @@ -68,12 +80,21 @@ struct sgx_encl {
>> > unsigned long size;
>> > unsigned long ssaframesize;
>> > struct xarray page_array;
>> > + struct list_head va_pages;
>> > struct sgx_encl_page secs;
>> > cpumask_t cpumask;
>> > unsigned long attributes;
>> > unsigned long attributes_mask;
>> > };
>> > +#define SGX_VA_SLOT_COUNT 512
>> > +
>> > +struct sgx_va_page {
>> > + struct sgx_epc_page *epc_page;
>> > + DECLARE_BITMAP(slots, SGX_VA_SLOT_COUNT);
>> > + struct list_head list;
>> > +};
>> > +
>> > extern const struct vm_operations_struct sgx_vm_ops;
>> > int sgx_encl_find(struct mm_struct *mm, unsigned long addr,
>> > @@ -84,4 +105,24 @@ int sgx_encl_mm_add(struct sgx_encl *encl, struct
>> > mm_struct *mm);
>> > int sgx_encl_may_map(struct sgx_encl *encl, unsigned long start,
>> > unsigned long end, unsigned long vm_flags);
>> > +struct sgx_backing {
>> > + pgoff_t page_index;
>> > + struct page *contents;
>> > + struct page *pcmd;
>> > + unsigned long pcmd_offset;
>> > +};
>> > +
>> > +int sgx_encl_get_backing(struct sgx_encl *encl, unsigned long
>> > page_index,
>> > + struct sgx_backing *backing);
>> > +void sgx_encl_put_backing(struct sgx_backing *backing, bool
>> do_write);
>> > +int sgx_encl_test_and_clear_young(struct mm_struct *mm,
>> > + struct sgx_encl_page *page);
>> > +struct sgx_encl_page *sgx_encl_reserve_page(struct sgx_encl *encl,
>> > + unsigned long addr);
>> > +
>> > +struct sgx_epc_page *sgx_alloc_va_page(void);
>> > +unsigned int sgx_alloc_va_slot(struct sgx_va_page *va_page);
>> > +void sgx_free_va_slot(struct sgx_va_page *va_page, unsigned int
>> offset);
>> > +bool sgx_va_page_full(struct sgx_va_page *va_page);
>> > +
>> > #endif /* _X86_ENCL_H */
>> > diff --git a/arch/x86/kernel/cpu/sgx/ioctl.c
>> > b/arch/x86/kernel/cpu/sgx/ioctl.c
>> > index 3c04798e83e5..613f6c03598e 100644
>> > --- a/arch/x86/kernel/cpu/sgx/ioctl.c
>> > +++ b/arch/x86/kernel/cpu/sgx/ioctl.c
>> > @@ -16,6 +16,43 @@
>> > #include "encl.h"
>> > #include "encls.h"
>> > +static struct sgx_va_page *sgx_encl_grow(struct sgx_encl *encl)
>> > +{
>> > + struct sgx_va_page *va_page = NULL;
>> > + void *err;
>> > +
>> > + BUILD_BUG_ON(SGX_VA_SLOT_COUNT !=
>> > + (SGX_ENCL_PAGE_VA_OFFSET_MASK >> 3) + 1);
>> > +
>> > + if (!(encl->page_cnt % SGX_VA_SLOT_COUNT)) {
>> > + va_page = kzalloc(sizeof(*va_page), GFP_KERNEL);
>> > + if (!va_page)
>> > + return ERR_PTR(-ENOMEM);
>> > +
>> > + va_page->epc_page = sgx_alloc_va_page();
>> > + if (IS_ERR(va_page->epc_page)) {
>> > + err = ERR_CAST(va_page->epc_page);
>> > + kfree(va_page);
>> > + return err;
>> > + }
>> > +
>> > + WARN_ON_ONCE(encl->page_cnt % SGX_VA_SLOT_COUNT);
>> > + }
>> > + encl->page_cnt++;
>> > + return va_page;
>> > +}
>> > +
>> > +static void sgx_encl_shrink(struct sgx_encl *encl, struct sgx_va_page
>> > *va_page)
>> > +{
>> > + encl->page_cnt--;
>> > +
>> > + if (va_page) {
>> > + sgx_free_epc_page(va_page->epc_page);
>> > + list_del(&va_page->list);
>> > + kfree(va_page);
>> > + }
>> > +}
>> > +
>> > static u32 sgx_calc_ssa_frame_size(u32 miscselect, u64 xfrm)
>> > {
>> > u32 size_max = PAGE_SIZE;
>> > @@ -80,15 +117,24 @@ static int sgx_validate_secs(const struct
>> sgx_secs
>> > *secs)
>> > static int sgx_encl_create(struct sgx_encl *encl, struct sgx_secs
>> *secs)
>> > {
>> > struct sgx_epc_page *secs_epc;
>> > + struct sgx_va_page *va_page;
>> > struct sgx_pageinfo pginfo;
>> > struct sgx_secinfo secinfo;
>> > unsigned long encl_size;
>> > struct file *backing;
>> > long ret;
>> > + va_page = sgx_encl_grow(encl);
>> > + if (IS_ERR(va_page))
>> > + return PTR_ERR(va_page);
>> > + else if (va_page)
>> > + list_add(&va_page->list, &encl->va_pages);
>> > + /* else the tail page of the VA page list had free slots. */
>> > +
>> > if (sgx_validate_secs(secs)) {
>> > pr_debug("invalid SECS\n");
>> > - return -EINVAL;
>> > + ret = -EINVAL;
>> > + goto err_out_shrink;
>> > }
>> > /* The extra page goes to SECS. */
>> > @@ -96,12 +142,14 @@ static int sgx_encl_create(struct sgx_encl *encl,
>> > struct sgx_secs *secs)
>> > backing = shmem_file_setup("SGX backing", encl_size + (encl_size >>
>> 5),
>> > VM_NORESERVE);
>> > - if (IS_ERR(backing))
>> > - return PTR_ERR(backing);
>> > + if (IS_ERR(backing)) {
>> > + ret = PTR_ERR(backing);
>> > + goto err_out_shrink;
>> > + }
>> > encl->backing = backing;
>> > - secs_epc = __sgx_alloc_epc_page();
>> > + secs_epc = sgx_alloc_epc_page(&encl->secs, true);
>> > if (IS_ERR(secs_epc)) {
>> > ret = PTR_ERR(secs_epc);
>> > goto err_out_backing;
>> > @@ -149,6 +197,9 @@ static int sgx_encl_create(struct sgx_encl *encl,
>> > struct sgx_secs *secs)
>> > fput(encl->backing);
>> > encl->backing = NULL;
>> > +err_out_shrink:
>> > + sgx_encl_shrink(encl, va_page);
>> > +
>> > return ret;
>> > }
>> > @@ -321,21 +372,35 @@ static int sgx_encl_add_page(struct sgx_encl
>> > *encl, unsigned long src,
>> > {
>> > struct sgx_encl_page *encl_page;
>> > struct sgx_epc_page *epc_page;
>> > + struct sgx_va_page *va_page;
>> > int ret;
>> > encl_page = sgx_encl_page_alloc(encl, offset, secinfo->flags);
>> > if (IS_ERR(encl_page))
>> > return PTR_ERR(encl_page);
>> > - epc_page = __sgx_alloc_epc_page();
>> > + epc_page = sgx_alloc_epc_page(encl_page, true);
>> > if (IS_ERR(epc_page)) {
>> > kfree(encl_page);
>> > return PTR_ERR(epc_page);
>> > }
>> > + va_page = sgx_encl_grow(encl);
>> > + if (IS_ERR(va_page)) {
>> > + ret = PTR_ERR(va_page);
>> > + goto err_out_free;
>> > + }
>> > +
>> > mmap_read_lock(current->mm);
>> > mutex_lock(&encl->lock);
>> > + /*
>> > + * Adding to encl->va_pages must be done under encl->lock. Ditto
>> for
>> > + * deleting (via sgx_encl_shrink()) in the error path.
>> > + */
>> > + if (va_page)
>> > + list_add(&va_page->list, &encl->va_pages);
>> > +
>> > /*
>> > * Insert prior to EADD in case of OOM. EADD modifies MRENCLAVE,
>> i.e.
>> > * can't be gracefully unwound, while failure on EADD/EXTEND is
>> limited
>> > @@ -366,6 +431,7 @@ static int sgx_encl_add_page(struct sgx_encl
>> *encl,
>> > unsigned long src,
>> > goto err_out;
>> > }
>> > + sgx_mark_page_reclaimable(encl_page->epc_page);
>> > mutex_unlock(&encl->lock);
>> > mmap_read_unlock(current->mm);
>> > return ret;
>> > @@ -374,9 +440,11 @@ static int sgx_encl_add_page(struct sgx_encl
>> *encl,
>> > unsigned long src,
>> > xa_erase(&encl->page_array, PFN_DOWN(encl_page->desc));
>> > err_out_unlock:
>> > + sgx_encl_shrink(encl, va_page);
>> > mutex_unlock(&encl->lock);
>> > mmap_read_unlock(current->mm);
>> > +err_out_free:
>> > sgx_free_epc_page(epc_page);
>> > kfree(encl_page);
>> > diff --git a/arch/x86/kernel/cpu/sgx/main.c
>> > b/arch/x86/kernel/cpu/sgx/main.c
>> > index 4137254fb29e..3f9130501370 100644
>> > --- a/arch/x86/kernel/cpu/sgx/main.c
>> > +++ b/arch/x86/kernel/cpu/sgx/main.c
>> > @@ -16,6 +16,395 @@
>> > struct sgx_epc_section sgx_epc_sections[SGX_MAX_EPC_SECTIONS];
>> > static int sgx_nr_epc_sections;
>> > static struct task_struct *ksgxswapd_tsk;
>> > +static DECLARE_WAIT_QUEUE_HEAD(ksgxswapd_waitq);
>> > +static LIST_HEAD(sgx_active_page_list);
>> > +static DEFINE_SPINLOCK(sgx_active_page_list_lock);
>> > +
>> > +/**
>> > + * sgx_mark_page_reclaimable() - Mark a page as reclaimable
>> > + * @page: EPC page
>> > + *
>> > + * Mark a page as reclaimable and add it to the active page list.
>> Pages
>> > + * are automatically removed from the active list when freed.
>> > + */
>> > +void sgx_mark_page_reclaimable(struct sgx_epc_page *page)
>> > +{
>> > + spin_lock(&sgx_active_page_list_lock);
>> > + page->desc |= SGX_EPC_PAGE_RECLAIMABLE;
>> > + list_add_tail(&page->list, &sgx_active_page_list);
>> > + spin_unlock(&sgx_active_page_list_lock);
>> > +}
>> > +
>> > +/**
>> > + * sgx_unmark_page_reclaimable() - Remove a page from the reclaim
>> list
>> > + * @page: EPC page
>> > + *
>> > + * Clear the reclaimable flag and remove the page from the active
>> page
>> > list.
>> > + *
>> > + * Return:
>> > + * 0 on success,
>> > + * -EBUSY if the page is in the process of being reclaimed
>> > + */
>> > +int sgx_unmark_page_reclaimable(struct sgx_epc_page *page)
>> > +{
>> > + /*
>> > + * Remove the page from the active list if necessary. If the page
>> > + * is actively being reclaimed, i.e. RECLAIMABLE is set but the
>> > + * page isn't on the active list, return -EBUSY as we can't free
>> > + * the page at this time since it is "owned" by the reclaimer.
>> > + */
>> > + spin_lock(&sgx_active_page_list_lock);
>> > + if (page->desc & SGX_EPC_PAGE_RECLAIMABLE) {
>> > + if (list_empty(&page->list)) {
>> > + spin_unlock(&sgx_active_page_list_lock);
>> > + return -EBUSY;
>> > + }
>> > + list_del(&page->list);
>> > + page->desc &= ~SGX_EPC_PAGE_RECLAIMABLE;
>> > + }
>> > + spin_unlock(&sgx_active_page_list_lock);
>> > +
>> > + return 0;
>> > +}
>> > +
>> > +static bool sgx_reclaimer_age(struct sgx_epc_page *epc_page)
>> > +{
>> > + struct sgx_encl_page *page = epc_page->owner;
>> > + struct sgx_encl *encl = page->encl;
>> > + struct sgx_encl_mm *encl_mm;
>> > + bool ret = true;
>> > + int idx;
>> > +
>> > + idx = srcu_read_lock(&encl->srcu);
>> > +
>> > + list_for_each_entry_rcu(encl_mm, &encl->mm_list, list) {
>> > + if (!mmget_not_zero(encl_mm->mm))
>> > + continue;
>> > +
>> > + mmap_read_lock(encl_mm->mm);
>> > + ret = !sgx_encl_test_and_clear_young(encl_mm->mm, page);
>> > + mmap_read_unlock(encl_mm->mm);
>> > +
>> > + mmput_async(encl_mm->mm);
>> > +
>> > + if (!ret || (atomic_read(&encl->flags) & SGX_ENCL_DEAD))
>> > + break;
>> > + }
>> > +
>> > + srcu_read_unlock(&encl->srcu, idx);
>> > +
>> > + if (!ret && !(atomic_read(&encl->flags) & SGX_ENCL_DEAD))
>> > + return false;
>> > +
>> > + return true;
>> > +}
>> > +
>> > +static void sgx_reclaimer_block(struct sgx_epc_page *epc_page)
>> > +{
>> > + struct sgx_encl_page *page = epc_page->owner;
>> > + unsigned long addr = SGX_ENCL_PAGE_ADDR(page);
>> > + struct sgx_encl *encl = page->encl;
>> > + unsigned long mm_list_version;
>> > + struct sgx_encl_mm *encl_mm;
>> > + struct vm_area_struct *vma;
>> > + int idx, ret;
>> > +
>> > + do {
>> > + mm_list_version = encl->mm_list_version;
>> > +
>> > + /* Pairs with smp_rmb() in sgx_encl_mm_add(). */
>> > + smp_rmb();
>> > +
>> > + idx = srcu_read_lock(&encl->srcu);
>> > +
>> > + list_for_each_entry_rcu(encl_mm, &encl->mm_list, list) {
>> > + if (!mmget_not_zero(encl_mm->mm))
>> > + continue;
>> > +
>> > + mmap_read_lock(encl_mm->mm);
>> > +
>> > + ret = sgx_encl_find(encl_mm->mm, addr, &vma);
>> > + if (!ret && encl == vma->vm_private_data)
>> > + zap_vma_ptes(vma, addr, PAGE_SIZE);
>> > +
>> > + mmap_read_unlock(encl_mm->mm);
>> > +
>> > + mmput_async(encl_mm->mm);
>> > + }
>> > +
>> > + srcu_read_unlock(&encl->srcu, idx);
>> > + } while (unlikely(encl->mm_list_version != mm_list_version));
>> > +
>> > + mutex_lock(&encl->lock);
>> > +
>> > + if (!(atomic_read(&encl->flags) & SGX_ENCL_DEAD)) {
>> > + ret = __eblock(sgx_get_epc_addr(epc_page));
>> > + if (encls_failed(ret))
>> > + ENCLS_WARN(ret, "EBLOCK");
>> > + }
>> > +
>> > + mutex_unlock(&encl->lock);
>> > +}
>> > +
>> > +static int __sgx_encl_ewb(struct sgx_epc_page *epc_page, void
>> *va_slot,
>> > + struct sgx_backing *backing)
>> > +{
>> > + struct sgx_pageinfo pginfo;
>> > + int ret;
>> > +
>> > + pginfo.addr = 0;
>> > + pginfo.secs = 0;
>> > +
>> > + pginfo.contents = (unsigned long)kmap_atomic(backing->contents);
>> > + pginfo.metadata = (unsigned long)kmap_atomic(backing->pcmd) +
>> > + backing->pcmd_offset;
>> > +
>> > + ret = __ewb(&pginfo, sgx_get_epc_addr(epc_page), va_slot);
>> > +
>> > + kunmap_atomic((void *)(unsigned long)(pginfo.metadata -
>> > + backing->pcmd_offset));
>> > + kunmap_atomic((void *)(unsigned long)pginfo.contents);
>> > +
>> > + return ret;
>> > +}
>> > +
>> > +static void sgx_ipi_cb(void *info)
>> > +{
>> > +}
>> > +
>> > +static const cpumask_t *sgx_encl_ewb_cpumask(struct sgx_encl *encl)
>> > +{
>> > + cpumask_t *cpumask = &encl->cpumask;
>> > + struct sgx_encl_mm *encl_mm;
>> > + int idx;
>> > +
>> > + /*
>> > + * Can race with sgx_encl_mm_add(), but ETRACK has already been
>> > + * executed, which means that the CPUs running in the new mm will
>> enter
>> > + * into the enclave with a fresh epoch.
>> > + */
>> > + cpumask_clear(cpumask);
>> > +
>> > + idx = srcu_read_lock(&encl->srcu);
>> > +
>> > + list_for_each_entry_rcu(encl_mm, &encl->mm_list, list) {
>> > + if (!mmget_not_zero(encl_mm->mm))
>> > + continue;
>> > +
>> > + cpumask_or(cpumask, cpumask, mm_cpumask(encl_mm->mm));
>> > +
>> > + mmput_async(encl_mm->mm);
>> > + }
>> > +
>> > + srcu_read_unlock(&encl->srcu, idx);
>> > +
>> > + return cpumask;
>> > +}
>> > +
>> > +/*
>> > + * Swap page to the regular memory transformed to the blocked state
>> by
>> > using
>> > + * EBLOCK, which means that it can no loger be referenced (no new TLB
>> > entries).
>> > + *
>> > + * The first trial just tries to write the page assuming that some
>> > other thread
>> > + * has reset the count for threads inside the enlave by using ETRACK,
>> > and
>> > + * previous thread count has been zeroed out. The second trial calls
>> > ETRACK
>> > + * before EWB. If that fails we kick all the HW threads out, and then
>> > do EWB,
>> > + * which should be guaranteed the succeed.
>> > + */
>> > +static void sgx_encl_ewb(struct sgx_epc_page *epc_page,
>> > + struct sgx_backing *backing)
>> > +{
>> > + struct sgx_encl_page *encl_page = epc_page->owner;
>> > + struct sgx_encl *encl = encl_page->encl;
>> > + struct sgx_va_page *va_page;
>> > + unsigned int va_offset;
>> > + void *va_slot;
>> > + int ret;
>> > +
>> > + encl_page->desc &= ~SGX_ENCL_PAGE_BEING_RECLAIMED;
>> > +
>> > + va_page = list_first_entry(&encl->va_pages, struct sgx_va_page,
>> > + list);
>> > + va_offset = sgx_alloc_va_slot(va_page);
>> > + va_slot = sgx_get_epc_addr(va_page->epc_page) + va_offset;
>> > + if (sgx_va_page_full(va_page))
>> > + list_move_tail(&va_page->list, &encl->va_pages);
>> > +
>> > + ret = __sgx_encl_ewb(epc_page, va_slot, backing);
>> > + if (ret == SGX_NOT_TRACKED) {
>> > + ret = __etrack(sgx_get_epc_addr(encl->secs.epc_page));
>> > + if (ret) {
>> > + if (encls_failed(ret))
>> > + ENCLS_WARN(ret, "ETRACK");
>> > + }
>> > +
>> > + ret = __sgx_encl_ewb(epc_page, va_slot, backing);
>> > + if (ret == SGX_NOT_TRACKED) {
>> > + /*
>> > + * Slow path, send IPIs to kick cpus out of the
>> > + * enclave. Note, it's imperative that the cpu
>> > + * mask is generated *after* ETRACK, else we'll
>> > + * miss cpus that entered the enclave between
>> > + * generating the mask and incrementing epoch.
>> > + */
>> > + on_each_cpu_mask(sgx_encl_ewb_cpumask(encl),
>> > + sgx_ipi_cb, NULL, 1);
>> > + ret = __sgx_encl_ewb(epc_page, va_slot, backing);
>> > + }
>> > + }
>> > +
>> > + if (ret) {
>> > + if (encls_failed(ret))
>> > + ENCLS_WARN(ret, "EWB");
>> > +
>> > + sgx_free_va_slot(va_page, va_offset);
>> > + } else {
>> > + encl_page->desc |= va_offset;
>> > + encl_page->va_page = va_page;
>> > + }
>> > +}
>> > +
>> > +static void sgx_reclaimer_write(struct sgx_epc_page *epc_page,
>> > + struct sgx_backing *backing)
>> > +{
>> > + struct sgx_encl_page *encl_page = epc_page->owner;
>> > + struct sgx_encl *encl = encl_page->encl;
>> > + struct sgx_backing secs_backing;
>> > + int ret;
>> > +
>> > + mutex_lock(&encl->lock);
>> > +
>> > + if (atomic_read(&encl->flags) & SGX_ENCL_DEAD) {
>> > + ret = __eremove(sgx_get_epc_addr(epc_page));
>> > + ENCLS_WARN(ret, "EREMOVE");
>> > + } else {
>> > + sgx_encl_ewb(epc_page, backing);
>> > + }
>> > +
>> > + encl_page->epc_page = NULL;
>> > + encl->secs_child_cnt--;
>> > +
>> > + if (!encl->secs_child_cnt) {
>> > + if (atomic_read(&encl->flags) & SGX_ENCL_DEAD) {
>> > + sgx_free_epc_page(encl->secs.epc_page);
>> > + encl->secs.epc_page = NULL;
>> > + } else if (atomic_read(&encl->flags) & SGX_ENCL_INITIALIZED) {
>> > + ret = sgx_encl_get_backing(encl, PFN_DOWN(encl->size),
>> > + &secs_backing);
>> > + if (ret)
>> > + goto out;
>> > +
>> > + sgx_encl_ewb(encl->secs.epc_page, &secs_backing);
>> > +
>> > + sgx_free_epc_page(encl->secs.epc_page);
>> > + encl->secs.epc_page = NULL;
>> > +
>> > + sgx_encl_put_backing(&secs_backing, true);
>> > + }
>> > + }
>> > +
>> > +out:
>> > + mutex_unlock(&encl->lock);
>> > +}
>> > +
>> > +/*
>> > + * Take a fixed number of pages from the head of the active page pool
>> > and
>> > + * reclaim them to the enclave's private shmem files. Skip the pages,
>> > which have
>> > + * been accessed since the last scan. Move those pages to the tail of
>> > active
>> > + * page pool so that the pages get scanned in LRU like fashion.
>> > + *
>> > + * Batch process a chunk of pages (at the moment 16) in order to
>> > degrade amount
>> > + * of IPI's and ETRACK's potentially required. sgx_encl_ewb() does
>> > degrade a bit
>> > + * among the HW threads with three stage EWB pipeline (EWB, ETRACK +
>> > EWB and IPI
>> > + * + EWB) but not sufficiently. Reclaiming one page at a time would
>> > also be
>> > + * problematic as it would increase the lock contention too much,
>> which
>> > would
>> > + * halt forward progress.
>> > + */
>> > +static void sgx_reclaim_pages(void)
>> > +{
>> > + struct sgx_epc_page *chunk[SGX_NR_TO_SCAN];
>> > + struct sgx_backing backing[SGX_NR_TO_SCAN];
>> > + struct sgx_epc_section *section;
>> > + struct sgx_encl_page *encl_page;
>> > + struct sgx_epc_page *epc_page;
>> > + int cnt = 0;
>> > + int ret;
>> > + int i;
>> > +
>> > + spin_lock(&sgx_active_page_list_lock);
>> > + for (i = 0; i < SGX_NR_TO_SCAN; i++) {
>> > + if (list_empty(&sgx_active_page_list))
>> > + break;
>> > +
>> > + epc_page = list_first_entry(&sgx_active_page_list,
>> > + struct sgx_epc_page, list);
>> > + list_del_init(&epc_page->list);
>> > + encl_page = epc_page->owner;
>> > +
>> > + if (kref_get_unless_zero(&encl_page->encl->refcount) != 0)
>> > + chunk[cnt++] = epc_page;
>> > + else
>> > + /* The owner is freeing the page. No need to add the
>> > + * page back to the list of reclaimable pages.
>> > + */
>> > + epc_page->desc &= ~SGX_EPC_PAGE_RECLAIMABLE;
>> > + }
>> > + spin_unlock(&sgx_active_page_list_lock);
>> > +
>> > + for (i = 0; i < cnt; i++) {
>> > + epc_page = chunk[i];
>> > + encl_page = epc_page->owner;
>> > +
>> > + if (!sgx_reclaimer_age(epc_page))
>> > + goto skip;
>> > +
>> > + ret = sgx_encl_get_backing(encl_page->encl,
>> > + SGX_ENCL_PAGE_INDEX(encl_page),
>> > + &backing[i]);
>> > + if (ret)
>> > + goto skip;
>> > +
>> > + mutex_lock(&encl_page->encl->lock);
>> > + encl_page->desc |= SGX_ENCL_PAGE_BEING_RECLAIMED;
>> > + mutex_unlock(&encl_page->encl->lock);
>> > + continue;
>> > +
>> > +skip:
>> > + spin_lock(&sgx_active_page_list_lock);
>> > + list_add_tail(&epc_page->list, &sgx_active_page_list);
>> > + spin_unlock(&sgx_active_page_list_lock);
>> > +
>> > + kref_put(&encl_page->encl->refcount, sgx_encl_release);
>> > +
>> > + chunk[i] = NULL;
>> > + }
>> > +
>> > + for (i = 0; i < cnt; i++) {
>> > + epc_page = chunk[i];
>> > + if (epc_page)
>> > + sgx_reclaimer_block(epc_page);
>> > + }
>> > +
>> > + for (i = 0; i < cnt; i++) {
>> > + epc_page = chunk[i];
>> > + if (!epc_page)
>> > + continue;
>> > +
>> > + encl_page = epc_page->owner;
>> > + sgx_reclaimer_write(epc_page, &backing[i]);
>> > + sgx_encl_put_backing(&backing[i], true);
>> > +
>> > + kref_put(&encl_page->encl->refcount, sgx_encl_release);
>> > + epc_page->desc &= ~SGX_EPC_PAGE_RECLAIMABLE;
>> > +
>> > + section = sgx_get_epc_section(epc_page);
>> > + spin_lock(§ion->lock);
>> > + list_add_tail(&epc_page->list, §ion->page_list);
>> > + section->free_cnt++;
>> > + spin_unlock(§ion->lock);
>> > + }
>> > +}
>> > +
>> > static void sgx_sanitize_section(struct sgx_epc_section *section)
>> > {
>> > @@ -44,6 +433,23 @@ static void sgx_sanitize_section(struct
>> > sgx_epc_section *section)
>> > }
>> > }
>> > +static unsigned long sgx_nr_free_pages(void)
>> > +{
>> > + unsigned long cnt = 0;
>> > + int i;
>> > +
>> > + for (i = 0; i < sgx_nr_epc_sections; i++)
>> > + cnt += sgx_epc_sections[i].free_cnt;
>> > +
>> > + return cnt;
>> > +}
>> > +
>> > +static bool sgx_should_reclaim(unsigned long watermark)
>> > +{
>> > + return sgx_nr_free_pages() < watermark &&
>> > + !list_empty(&sgx_active_page_list);
>> > +}
>> > +
>> > static int ksgxswapd(void *p)
>> > {
>> > int i;
>> > @@ -69,6 +475,20 @@ static int ksgxswapd(void *p)
>> > WARN(1, "EPC section %d has unsanitized pages.\n", i);
>> > }
>> > + while (!kthread_should_stop()) {
>> > + if (try_to_freeze())
>> > + continue;
>> > +
>> > + wait_event_freezable(ksgxswapd_waitq,
>> > + kthread_should_stop() ||
>> > + sgx_should_reclaim(SGX_NR_HIGH_PAGES));
>> > +
>> > + if (sgx_should_reclaim(SGX_NR_HIGH_PAGES))
>> > + sgx_reclaim_pages();
>> > +
>> > + cond_resched();
>> > + }
>> > +
>> > return 0;
>> > }
>> > @@ -94,6 +514,7 @@ static struct sgx_epc_page
>> > *__sgx_alloc_epc_page_from_section(struct sgx_epc_sec
>> > page = list_first_entry(§ion->page_list, struct sgx_epc_page,
>> list);
>> > list_del_init(&page->list);
>> > + section->free_cnt--;
>> > return page;
>> > }
>> > @@ -127,6 +548,57 @@ struct sgx_epc_page *__sgx_alloc_epc_page(void)
>> > return ERR_PTR(-ENOMEM);
>> > }
>> > +/**
>> > + * sgx_alloc_epc_page() - Allocate an EPC page
>> > + * @owner: the owner of the EPC page
>> > + * @reclaim: reclaim pages if necessary
>> > + *
>> > + * Iterate through EPC sections and borrow a free EPC page to the
>> > caller. When a
>> > + * page is no longer needed it must be released with
>> > sgx_free_epc_page(). If
>> > + * @reclaim is set to true, directly reclaim pages when we are out of
>> > pages. No
>> > + * mm's can be locked when @reclaim is set to true.
>> > + *
>> > + * Finally, wake up ksgxswapd when the number of pages goes below the
>> > watermark
>> > + * before returning back to the caller.
>> > + *
>> > + * Return:
>> > + * an EPC page,
>> > + * -errno on error
>> > + */
>> > +struct sgx_epc_page *sgx_alloc_epc_page(void *owner, bool reclaim)
>> > +{
>> > + struct sgx_epc_page *entry;
>> > +
>> > + for ( ; ; ) {
>> > + entry = __sgx_alloc_epc_page();
>> > + if (!IS_ERR(entry)) {
>> > + entry->owner = owner;
>> > + break;
>> > + }
>> > +
>> > + if (list_empty(&sgx_active_page_list))
>> > + return ERR_PTR(-ENOMEM);
>> > +
>> > + if (!reclaim) {
>> > + entry = ERR_PTR(-EBUSY);
>> > + break;
>> > + }
>> > +
>> > + if (signal_pending(current)) {
>> > + entry = ERR_PTR(-ERESTARTSYS);
>> > + break;
>> > + }
>> > +
>> > + sgx_reclaim_pages();
>> > + schedule();
>> > + }
>> > +
>> > + if (sgx_should_reclaim(SGX_NR_LOW_PAGES))
>> > + wake_up(&ksgxswapd_waitq);
>> > +
>> > + return entry;
>> > +}
>> > +
>> > /**
>> > * sgx_free_epc_page() - Free an EPC page
>> > * @page: an EPC page
>> > @@ -138,12 +610,20 @@ void sgx_free_epc_page(struct sgx_epc_page
>> *page)
>> > struct sgx_epc_section *section = sgx_get_epc_section(page);
>> > int ret;
>> > + /*
>> > + * Don't take sgx_active_page_list_lock when asserting the page
>> isn't
>> > + * reclaimable, missing a WARN in the very rare case is preferable
>> to
>> > + * unnecessarily taking a global lock in the common case.
>> > + */
>> > + WARN_ON_ONCE(page->desc & SGX_EPC_PAGE_RECLAIMABLE);
>> > +
>> > ret = __eremove(sgx_get_epc_addr(page));
>> > if (WARN_ONCE(ret, "EREMOVE returned %d (0x%x)", ret, ret))
>> > return;
>> > spin_lock(§ion->lock);
>> > list_add_tail(&page->list, §ion->page_list);
>> > + section->free_cnt++;
>> > spin_unlock(§ion->lock);
>> > }
>> > @@ -194,6 +674,7 @@ static bool __init sgx_setup_epc_section(u64 addr,
>> > u64 size,
>> > list_add_tail(&page->list, §ion->unsanitized_page_list);
>> > }
>> > + section->free_cnt = nr_pages;
>> > return true;
>> > err_out:
>> > diff --git a/arch/x86/kernel/cpu/sgx/sgx.h
>> > b/arch/x86/kernel/cpu/sgx/sgx.h
>> > index 8d126070db1e..ec4f7b338dbe 100644
>> > --- a/arch/x86/kernel/cpu/sgx/sgx.h
>> > +++ b/arch/x86/kernel/cpu/sgx/sgx.h
>> > @@ -15,6 +15,7 @@
>> > struct sgx_epc_page {
>> > unsigned long desc;
>> > + struct sgx_encl_page *owner;
>> > struct list_head list;
>> > };
>> > @@ -27,6 +28,7 @@ struct sgx_epc_page {
>> > struct sgx_epc_section {
>> > unsigned long pa;
>> > void *va;
>> > + unsigned long free_cnt;
>> > struct list_head page_list;
>> > struct list_head unsanitized_page_list;
>> > spinlock_t lock;
>> > @@ -35,6 +37,10 @@ struct sgx_epc_section {
>> > #define SGX_EPC_SECTION_MASK GENMASK(7, 0)
>> > #define SGX_MAX_EPC_SECTIONS (SGX_EPC_SECTION_MASK + 1)
>> > #define SGX_MAX_ADD_PAGES_LENGTH 0x100000
>> > +#define SGX_EPC_PAGE_RECLAIMABLE BIT(8)
>> > +#define SGX_NR_TO_SCAN 16
>> > +#define SGX_NR_LOW_PAGES 32
>> > +#define SGX_NR_HIGH_PAGES 64
>> > extern struct sgx_epc_section sgx_epc_sections[SGX_MAX_EPC_SECTIONS];
>> > @@ -50,7 +56,10 @@ static inline void *sgx_get_epc_addr(struct
>> > sgx_epc_page *page)
>> > return section->va + (page->desc & PAGE_MASK) - section->pa;
>> > }
>> > +void sgx_mark_page_reclaimable(struct sgx_epc_page *page);
>> > +int sgx_unmark_page_reclaimable(struct sgx_epc_page *page);
>> > struct sgx_epc_page *__sgx_alloc_epc_page(void);
>> > +struct sgx_epc_page *sgx_alloc_epc_page(void *owner, bool reclaim);
>> > void sgx_free_epc_page(struct sgx_epc_page *page);
>> > #endif /* _X86_SGX_H */
>>
>>
>> --
On Sat, Oct 03, 2020 at 07:50:46AM +0300, Jarkko Sakkinen wrote:
> + XA_STATE(xas, &encl->page_array, idx_start);
> +
> + /*
> + * Disallow READ_IMPLIES_EXEC tasks as their VMA permissions might
> + * conflict with the enclave page permissions.
> + */
> + if (current->personality & READ_IMPLIES_EXEC)
> + return -EACCES;
> +
> + xas_for_each(&xas, page, idx_end)
> + if (!page || (~page->vm_max_prot_bits & vm_prot_bits))
> + return -EACCES;
You're iterating the array without holding any lock that the XArray knows
about. If you're OK with another thread adding/removing pages behind your
back, or there's a higher level lock (the mmap_sem?) protecting the XArray
from being modified while you walk it, then hold the rcu_read_lock()
while walking the array. Otherwise you can prevent modification by
calling xas_lock(&xas) and xas_unlock()..
> + return 0;
> +}
> +
> +static int sgx_vma_mprotect(struct vm_area_struct *vma,
> + struct vm_area_struct **pprev, unsigned long start,
> + unsigned long end, unsigned long newflags)
> +{
> + int ret;
> +
> + ret = sgx_encl_may_map(vma->vm_private_data, start, end, newflags);
> + if (ret)
> + return ret;
> +
> + return mprotect_fixup(vma, pprev, start, end, newflags);
> +}
> +
> +const struct vm_operations_struct sgx_vm_ops = {
> + .open = sgx_vma_open,
> + .fault = sgx_vma_fault,
> + .mprotect = sgx_vma_mprotect,
> +};
> +
> +/**
> + * sgx_encl_find - find an enclave
> + * @mm: mm struct of the current process
> + * @addr: address in the ELRANGE
> + * @vma: the resulting VMA
> + *
> + * Find an enclave identified by the given address. Give back a VMA that is
> + * part of the enclave and located in that address. The VMA is given back if it
> + * is a proper enclave VMA even if an &sgx_encl instance does not exist yet
> + * (enclave creation has not been performed).
> + *
> + * Return:
> + * 0 on success,
> + * -EINVAL if an enclave was not found,
> + * -ENOENT if the enclave has not been created yet
> + */
> +int sgx_encl_find(struct mm_struct *mm, unsigned long addr,
> + struct vm_area_struct **vma)
> +{
> + struct vm_area_struct *result;
> + struct sgx_encl *encl;
> +
> + result = find_vma(mm, addr);
> + if (!result || result->vm_ops != &sgx_vm_ops || addr < result->vm_start)
> + return -EINVAL;
> +
> + encl = result->vm_private_data;
> + *vma = result;
> +
> + return encl ? 0 : -ENOENT;
> +}
> +
> +/**
> + * sgx_encl_destroy() - destroy enclave resources
> + * @encl: an enclave pointer
> + */
> +void sgx_encl_destroy(struct sgx_encl *encl)
> +{
> + struct sgx_encl_page *entry;
> + unsigned long index;
> +
> + atomic_or(SGX_ENCL_DEAD, &encl->flags);
> +
> + xa_for_each(&encl->page_array, index, entry) {
> + if (entry->epc_page) {
> + sgx_free_epc_page(entry->epc_page);
> + encl->secs_child_cnt--;
> + entry->epc_page = NULL;
> + }
> +
> + kfree(entry);
> + }
> +
> + xa_destroy(&encl->page_array);
> +
> + if (!encl->secs_child_cnt && encl->secs.epc_page) {
> + sgx_free_epc_page(encl->secs.epc_page);
> + encl->secs.epc_page = NULL;
> + }
> +}
> +
> +/**
> + * sgx_encl_release - Destroy an enclave instance
> + * @kref: address of a kref inside &sgx_encl
> + *
> + * Used together with kref_put(). Frees all the resources associated with the
> + * enclave and the instance itself.
> + */
> +void sgx_encl_release(struct kref *ref)
> +{
> + struct sgx_encl *encl = container_of(ref, struct sgx_encl, refcount);
> +
> + sgx_encl_destroy(encl);
> +
> + if (encl->backing)
> + fput(encl->backing);
> +
> + cleanup_srcu_struct(&encl->srcu);
> +
> + WARN_ON_ONCE(!list_empty(&encl->mm_list));
> +
> + /* Detect EPC page leak's. */
> + WARN_ON_ONCE(encl->secs_child_cnt);
> + WARN_ON_ONCE(encl->secs.epc_page);
> +
> + kfree(encl);
> +}
> diff --git a/arch/x86/kernel/cpu/sgx/encl.h b/arch/x86/kernel/cpu/sgx/encl.h
> new file mode 100644
> index 000000000000..8ff445476657
> --- /dev/null
> +++ b/arch/x86/kernel/cpu/sgx/encl.h
> @@ -0,0 +1,85 @@
> +/* SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause) */
> +/**
> + * Copyright(c) 2016-19 Intel Corporation.
> + */
> +#ifndef _X86_ENCL_H
> +#define _X86_ENCL_H
> +
> +#include <linux/cpumask.h>
> +#include <linux/kref.h>
> +#include <linux/list.h>
> +#include <linux/mm_types.h>
> +#include <linux/mmu_notifier.h>
> +#include <linux/mutex.h>
> +#include <linux/notifier.h>
> +#include <linux/srcu.h>
> +#include <linux/workqueue.h>
> +#include <linux/xarray.h>
> +#include "sgx.h"
> +
> +/**
> + * enum sgx_encl_page_desc - defines bits for an enclave page's descriptor
> + * %SGX_ENCL_PAGE_ADDR_MASK: Holds the virtual address of the page.
> + *
> + * The page address for SECS is zero and is used by the subsystem to recognize
> + * the SECS page.
> + */
> +enum sgx_encl_page_desc {
> + /* Bits 11:3 are available when the page is not swapped. */
> + SGX_ENCL_PAGE_ADDR_MASK = PAGE_MASK,
> +};
> +
> +#define SGX_ENCL_PAGE_ADDR(page) \
> + ((page)->desc & SGX_ENCL_PAGE_ADDR_MASK)
> +
> +struct sgx_encl_page {
> + unsigned long desc;
> + unsigned long vm_max_prot_bits;
> + struct sgx_epc_page *epc_page;
> + struct sgx_encl *encl;
> +};
> +
> +enum sgx_encl_flags {
> + SGX_ENCL_CREATED = BIT(0),
> + SGX_ENCL_INITIALIZED = BIT(1),
> + SGX_ENCL_DEBUG = BIT(2),
> + SGX_ENCL_DEAD = BIT(3),
> + SGX_ENCL_IOCTL = BIT(4),
> +};
> +
> +struct sgx_encl_mm {
> + struct sgx_encl *encl;
> + struct mm_struct *mm;
> + struct list_head list;
> + struct mmu_notifier mmu_notifier;
> +};
> +
> +struct sgx_encl {
> + atomic_t flags;
> + unsigned int page_cnt;
> + unsigned int secs_child_cnt;
> + struct mutex lock;
> + struct list_head mm_list;
> + spinlock_t mm_lock;
> + struct file *backing;
> + struct kref refcount;
> + struct srcu_struct srcu;
> + unsigned long base;
> + unsigned long size;
> + unsigned long ssaframesize;
> + struct xarray page_array;
> + struct sgx_encl_page secs;
> + cpumask_t cpumask;
> +};
> +
> +extern const struct vm_operations_struct sgx_vm_ops;
> +
> +int sgx_encl_find(struct mm_struct *mm, unsigned long addr,
> + struct vm_area_struct **vma);
> +void sgx_encl_destroy(struct sgx_encl *encl);
> +void sgx_encl_release(struct kref *ref);
> +int sgx_encl_mm_add(struct sgx_encl *encl, struct mm_struct *mm);
> +int sgx_encl_may_map(struct sgx_encl *encl, unsigned long start,
> + unsigned long end, unsigned long vm_flags);
> +
> +#endif /* _X86_ENCL_H */
> diff --git a/arch/x86/kernel/cpu/sgx/main.c b/arch/x86/kernel/cpu/sgx/main.c
> index 97c6895fb6c9..4137254fb29e 100644
> --- a/arch/x86/kernel/cpu/sgx/main.c
> +++ b/arch/x86/kernel/cpu/sgx/main.c
> @@ -9,6 +9,8 @@
> #include <linux/sched/mm.h>
> #include <linux/sched/signal.h>
> #include <linux/slab.h>
> +#include "driver.h"
> +#include "encl.h"
> #include "encls.h"
>
> struct sgx_epc_section sgx_epc_sections[SGX_MAX_EPC_SECTIONS];
> @@ -260,6 +262,8 @@ static bool __init sgx_page_cache_init(void)
>
> static void __init sgx_init(void)
> {
> + int ret;
> +
> if (!boot_cpu_has(X86_FEATURE_SGX))
> return;
>
> @@ -269,8 +273,15 @@ static void __init sgx_init(void)
> if (!sgx_page_reclaimer_init())
> goto err_page_cache;
>
> + ret = sgx_drv_init();
> + if (ret)
> + goto err_kthread;
> +
> return;
>
> +err_kthread:
> + kthread_stop(ksgxswapd_tsk);
> +
> err_page_cache:
> sgx_page_cache_teardown();
> }
> --
> 2.25.1
>
On Sat, Oct 03, 2020 at 04:39:25PM +0200, Greg KH wrote:
> On Sat, Oct 03, 2020 at 07:50:46AM +0300, Jarkko Sakkinen wrote:
> > Intel Software Guard eXtensions (SGX) is a set of CPU instructions that can
> > be used by applications to set aside private regions of code and data. The
> > code outside the SGX hosted software entity is prevented from accessing the
> > memory inside the enclave by the CPU. We call these entities enclaves.
> >
> > Add a driver that provides an ioctl API to construct and run enclaves.
> > Enclaves are constructed from pages residing in reserved physical memory
> > areas. The contents of these pages can only be accessed when they are
> > mapped as part of an enclave, by a hardware thread running inside the
> > enclave.
> >
> > The starting state of an enclave consists of a fixed measured set of
> > pages that are copied to the EPC during the construction process by
> > using the opcode ENCLS leaf functions and Software Enclave Control
> > Structure (SECS) that defines the enclave properties.
> >
> > Enclaves are constructed by using ENCLS leaf functions ECREATE, EADD and
> > EINIT. ECREATE initializes SECS, EADD copies pages from system memory to
> > the EPC and EINIT checks a given signed measurement and moves the enclave
> > into a state ready for execution.
> >
> > An initialized enclave can only be accessed through special Thread Control
> > Structure (TCS) pages by using ENCLU (ring-3 only) leaf EENTER. This leaf
> > function converts a thread into enclave mode and continues the execution in
> > the offset defined by the TCS provided to EENTER. An enclave is exited
> > through syscall, exception, interrupts or by explicitly calling another
> > ENCLU leaf EEXIT.
> >
> > The mmap() permissions are capped by the contained enclave page
> > permissions. The mapped areas must also be populated, i.e. each page
> > address must contain a page. This logic is implemented in
> > sgx_encl_may_map().
> >
> > Cc: [email protected]
> > Cc: [email protected]
> > Cc: Andrew Morton <[email protected]>
> > Cc: Matthew Wilcox <[email protected]>
> > Acked-by: Jethro Beekman <[email protected]>
> > Tested-by: Jethro Beekman <[email protected]>
> > Tested-by: Haitao Huang <[email protected]>
> > Tested-by: Chunyang Hui <[email protected]>
> > Tested-by: Jordan Hand <[email protected]>
> > Tested-by: Nathaniel McCallum <[email protected]>
> > Tested-by: Seth Moore <[email protected]>
> > Tested-by: Darren Kenny <[email protected]>
> > Reviewed-by: Darren Kenny <[email protected]>
> > Co-developed-by: Sean Christopherson <[email protected]>
> > Signed-off-by: Sean Christopherson <[email protected]>
> > Co-developed-by: Suresh Siddha <[email protected]>
> > Signed-off-by: Suresh Siddha <[email protected]>
> > Signed-off-by: Jarkko Sakkinen <[email protected]>
> > ---
> > arch/x86/kernel/cpu/sgx/Makefile | 2 +
> > arch/x86/kernel/cpu/sgx/driver.c | 173 ++++++++++++++++
> > arch/x86/kernel/cpu/sgx/driver.h | 29 +++
> > arch/x86/kernel/cpu/sgx/encl.c | 331 +++++++++++++++++++++++++++++++
> > arch/x86/kernel/cpu/sgx/encl.h | 85 ++++++++
> > arch/x86/kernel/cpu/sgx/main.c | 11 +
> > 6 files changed, 631 insertions(+)
> > create mode 100644 arch/x86/kernel/cpu/sgx/driver.c
> > create mode 100644 arch/x86/kernel/cpu/sgx/driver.h
> > create mode 100644 arch/x86/kernel/cpu/sgx/encl.c
> > create mode 100644 arch/x86/kernel/cpu/sgx/encl.h
> >
> > diff --git a/arch/x86/kernel/cpu/sgx/Makefile b/arch/x86/kernel/cpu/sgx/Makefile
> > index 79510ce01b3b..3fc451120735 100644
> > --- a/arch/x86/kernel/cpu/sgx/Makefile
> > +++ b/arch/x86/kernel/cpu/sgx/Makefile
> > @@ -1,2 +1,4 @@
> > obj-y += \
> > + driver.o \
> > + encl.o \
> > main.o
> > diff --git a/arch/x86/kernel/cpu/sgx/driver.c b/arch/x86/kernel/cpu/sgx/driver.c
> > new file mode 100644
> > index 000000000000..f54da5f19c2b
> > --- /dev/null
> > +++ b/arch/x86/kernel/cpu/sgx/driver.c
> > @@ -0,0 +1,173 @@
> > +// SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause)
>
> You use gpl-only header files in this file, so how in the world can it
> be bsd-3 licensed?
>
> Please get your legal department to agree with this, after you explain
> to them how you are mixing gpl2-only code in with this file.
I'll do what I already stated that I will do. Should I do something
more?
> > +// Copyright(c) 2016-18 Intel Corporation.
>
> Dates are hard to get right :(
Will fix.
>
> > +
> > +#include <linux/acpi.h>
> > +#include <linux/miscdevice.h>
> > +#include <linux/mman.h>
> > +#include <linux/security.h>
> > +#include <linux/suspend.h>
> > +#include <asm/traps.h>
> > +#include "driver.h"
> > +#include "encl.h"
> > +
> > +u64 sgx_encl_size_max_32;
> > +u64 sgx_encl_size_max_64;
> > +u32 sgx_misc_reserved_mask;
> > +u64 sgx_attributes_reserved_mask;
> > +u64 sgx_xfrm_reserved_mask = ~0x3;
> > +u32 sgx_xsave_size_tbl[64];
> > +
> > +static int sgx_open(struct inode *inode, struct file *file)
> > +{
> > + struct sgx_encl *encl;
> > + int ret;
> > +
> > + encl = kzalloc(sizeof(*encl), GFP_KERNEL);
> > + if (!encl)
> > + return -ENOMEM;
> > +
> > + atomic_set(&encl->flags, 0);
> > + kref_init(&encl->refcount);
> > + xa_init(&encl->page_array);
> > + mutex_init(&encl->lock);
> > + INIT_LIST_HEAD(&encl->mm_list);
> > + spin_lock_init(&encl->mm_lock);
> > +
> > + ret = init_srcu_struct(&encl->srcu);
> > + if (ret) {
> > + kfree(encl);
> > + return ret;
> > + }
> > +
> > + file->private_data = encl;
> > +
> > + return 0;
> > +}
> > +
> > +static int sgx_release(struct inode *inode, struct file *file)
> > +{
> > + struct sgx_encl *encl = file->private_data;
> > + struct sgx_encl_mm *encl_mm;
> > +
> > + for ( ; ; ) {
> > + spin_lock(&encl->mm_lock);
> > +
> > + if (list_empty(&encl->mm_list)) {
> > + encl_mm = NULL;
> > + } else {
> > + encl_mm = list_first_entry(&encl->mm_list,
> > + struct sgx_encl_mm, list);
> > + list_del_rcu(&encl_mm->list);
> > + }
> > +
> > + spin_unlock(&encl->mm_lock);
> > +
> > + /* The list is empty, ready to go. */
> > + if (!encl_mm)
> > + break;
> > +
> > + synchronize_srcu(&encl->srcu);
> > + mmu_notifier_unregister(&encl_mm->mmu_notifier, encl_mm->mm);
> > + kfree(encl_mm);
> > + }
> > +
> > + mutex_lock(&encl->lock);
> > + atomic_or(SGX_ENCL_DEAD, &encl->flags);
>
> So you set a flag that this is dead, and then instantly delete it? Why
> does that matter? I see you check for this flag elsewhere, but as you
> are just about to delete this structure, how can this be an issue?
It matters because ksgxswapd (sgx_reclaimer_*) might be processing it.
It will use the flag to skip the operations that it would do to a victim
page, when the enclave is still alive.
>
> > + mutex_unlock(&encl->lock);
> > +
> > + kref_put(&encl->refcount, sgx_encl_release);
>
> Don't you need to hold the lock across the put? If not, what is
> serializing this?
>
> But an even larger comment, why is this reference count needed at all?
>
> You never grab it except at init time, and you free it at close time.
> Why not rely on the reference counting that the vfs ensures you?
Because ksgxswapd needs the alive enclave instance while it is in the
process of swapping a victim page. The reason for this is the
hierarchical nature of the enclave pages.
As an example, a write operation to main memory, EWB (SDM vol 3D 40-79)
needs to access SGX Enclave Control Structure (SECS) page, which is
contains global data for an enclave, like the unswapped child count.
> > + return 0;
> > +}
> > +
> > +static int sgx_mmap(struct file *file, struct vm_area_struct *vma)
> > +{
> > + struct sgx_encl *encl = file->private_data;
> > + int ret;
> > +
> > + ret = sgx_encl_may_map(encl, vma->vm_start, vma->vm_end, vma->vm_flags);
> > + if (ret)
> > + return ret;
> > +
> > + ret = sgx_encl_mm_add(encl, vma->vm_mm);
> > + if (ret)
> > + return ret;
> > +
> > + vma->vm_ops = &sgx_vm_ops;
> > + vma->vm_flags |= VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP | VM_IO;
> > + vma->vm_private_data = encl;
> > +
> > + return 0;
> > +}
> > +
> > +static unsigned long sgx_get_unmapped_area(struct file *file,
> > + unsigned long addr,
> > + unsigned long len,
> > + unsigned long pgoff,
> > + unsigned long flags)
> > +{
> > + if ((flags & MAP_TYPE) == MAP_PRIVATE)
> > + return -EINVAL;
> > +
> > + if (flags & MAP_FIXED)
> > + return addr;
> > +
> > + return current->mm->get_unmapped_area(file, addr, len, pgoff, flags);
> > +}
> > +
> > +static const struct file_operations sgx_encl_fops = {
> > + .owner = THIS_MODULE,
> > + .open = sgx_open,
> > + .release = sgx_release,
> > + .mmap = sgx_mmap,
> > + .get_unmapped_area = sgx_get_unmapped_area,
> > +};
> > +
> > +static struct miscdevice sgx_dev_enclave = {
> > + .minor = MISC_DYNAMIC_MINOR,
> > + .name = "enclave",
> > + .nodename = "sgx/enclave",
>
> A subdir for a single device node? Ok, odd, but why not just
> "sgx_enclave"? How "special" is this device node?
There is a patch that adds "sgx/provision".
Either works for me. Should I flatten them to "sgx_enclave" and
"sgx_provision", or keep them as they are?
> thanks,
>
> greg k-h
/Jarkko
On Sun, Oct 04, 2020 at 05:32:57PM +0300, Jarkko Sakkinen wrote:
> On Sat, Oct 03, 2020 at 04:39:25PM +0200, Greg KH wrote:
> > You use gpl-only header files in this file, so how in the world can it
> > be bsd-3 licensed?
> >
> > Please get your legal department to agree with this, after you explain
> > to them how you are mixing gpl2-only code in with this file.
>
> I'll do what I already stated that I will do. Should I do something
> more?
And forward this message to the aformentioned entity.
/Jarkko
On Sat, Oct 03, 2020 at 08:54:40PM +0100, Matthew Wilcox wrote:
> On Sat, Oct 03, 2020 at 07:50:46AM +0300, Jarkko Sakkinen wrote:
> > + XA_STATE(xas, &encl->page_array, idx_start);
> > +
> > + /*
> > + * Disallow READ_IMPLIES_EXEC tasks as their VMA permissions might
> > + * conflict with the enclave page permissions.
> > + */
> > + if (current->personality & READ_IMPLIES_EXEC)
> > + return -EACCES;
> > +
> > + xas_for_each(&xas, page, idx_end)
> > + if (!page || (~page->vm_max_prot_bits & vm_prot_bits))
> > + return -EACCES;
>
> You're iterating the array without holding any lock that the XArray knows
> about. If you're OK with another thread adding/removing pages behind your
> back, or there's a higher level lock (the mmap_sem?) protecting the XArray
> from being modified while you walk it, then hold the rcu_read_lock()
> while walking the array. Otherwise you can prevent modification by
> calling xas_lock(&xas) and xas_unlock()..
I backtracked this. The locks have been there from v21-v35. This is a
refactoring mistake in radix_tree to xarray migration happened in v36.
It's by no means intentional.
What is shoukd take is encl->lock.
The loop was pre-v36 like:
idx_start = PFN_DOWN(start);
idx_end = PFN_DOWN(end - 1);
for (idx = idx_start; idx <= idx_end; ++idx) {
mutex_lock(&encl->lock);
page = radix_tree_lookup(&encl->page_tree, idx);
mutex_unlock(&encl->lock);
if (!page || (~page->vm_max_prot_bits & vm_prot_bits))
return -EACCES;
}
Looking at xarray.h and filemap.c, I'm thinking something along the
lines of:
for (idx = idx_start; idx <= idx_end; ++idx) {
mutex_lock(&encl->lock);
page = xas_find(&xas, idx + 1);
mutex_unlock(&encl->lock);
if (!page || (~page->vm_max_prot_bits & vm_prot_bits))
return -EACCES;
}
Does this look about right?
/Jarkko
On Mon, Oct 05, 2020 at 12:51:00AM +0300, Jarkko Sakkinen wrote:
> On Sat, Oct 03, 2020 at 08:54:40PM +0100, Matthew Wilcox wrote:
> > On Sat, Oct 03, 2020 at 07:50:46AM +0300, Jarkko Sakkinen wrote:
> > > + XA_STATE(xas, &encl->page_array, idx_start);
> > > +
> > > + /*
> > > + * Disallow READ_IMPLIES_EXEC tasks as their VMA permissions might
> > > + * conflict with the enclave page permissions.
> > > + */
> > > + if (current->personality & READ_IMPLIES_EXEC)
> > > + return -EACCES;
> > > +
> > > + xas_for_each(&xas, page, idx_end)
> > > + if (!page || (~page->vm_max_prot_bits & vm_prot_bits))
> > > + return -EACCES;
> >
> > You're iterating the array without holding any lock that the XArray knows
> > about. If you're OK with another thread adding/removing pages behind your
> > back, or there's a higher level lock (the mmap_sem?) protecting the XArray
> > from being modified while you walk it, then hold the rcu_read_lock()
> > while walking the array. Otherwise you can prevent modification by
> > calling xas_lock(&xas) and xas_unlock()..
>
> I backtracked this. The locks have been there from v21-v35. This is a
> refactoring mistake in radix_tree to xarray migration happened in v36.
> It's by no means intentional.
>
> What is shoukd take is encl->lock.
>
> The loop was pre-v36 like:
>
> idx_start = PFN_DOWN(start);
> idx_end = PFN_DOWN(end - 1);
>
> for (idx = idx_start; idx <= idx_end; ++idx) {
> mutex_lock(&encl->lock);
> page = radix_tree_lookup(&encl->page_tree, idx);
> mutex_unlock(&encl->lock);
>
> if (!page || (~page->vm_max_prot_bits & vm_prot_bits))
> return -EACCES;
> }
>
> Looking at xarray.h and filemap.c, I'm thinking something along the
> lines of:
>
> for (idx = idx_start; idx <= idx_end; ++idx) {
> mutex_lock(&encl->lock);
> page = xas_find(&xas, idx + 1);
~~~~~~~
idx
> mutex_unlock(&encl->lock);
>
> if (!page || (~page->vm_max_prot_bits & vm_prot_bits))
> return -EACCES;
> }
>
> Does this look about right?
/Jarkko
On Mon, Oct 05, 2020 at 12:50:49AM +0300, Jarkko Sakkinen wrote:
> What is shoukd take is encl->lock.
>
> The loop was pre-v36 like:
>
> idx_start = PFN_DOWN(start);
> idx_end = PFN_DOWN(end - 1);
>
> for (idx = idx_start; idx <= idx_end; ++idx) {
> mutex_lock(&encl->lock);
> page = radix_tree_lookup(&encl->page_tree, idx);
> mutex_unlock(&encl->lock);
>
> if (!page || (~page->vm_max_prot_bits & vm_prot_bits))
> return -EACCES;
> }
>
> Looking at xarray.h and filemap.c, I'm thinking something along the
> lines of:
>
> for (idx = idx_start; idx <= idx_end; ++idx) {
> mutex_lock(&encl->lock);
> page = xas_find(&xas, idx + 1);
> mutex_unlock(&encl->lock);
>
> if (!page || (~page->vm_max_prot_bits & vm_prot_bits))
> return -EACCES;
> }
>
> Does this look about right?
Not really ...
int ret = 0;
mutex_lock(&encl->lock);
rcu_read_lock();
while (xas.index < idx_end) {
page = xas_next(&xas);
if (!page || (~page->vm_max_prot_bits & vm_prot_bits))
ret = -EACCESS;
break;
}
}
rcu_read_unlock();
mutex_unlock(&encl->lock);
return ret;
... or you could rework to use the xa_lock instead of encl->lock.
I don't know how feasible that is for you.
On Sat, Oct 03, 2020 at 01:23:49PM -0500, Haitao Huang wrote:
> On Sat, 03 Oct 2020 08:32:45 -0500, Jarkko Sakkinen
> <[email protected]> wrote:
>
> > On Sat, Oct 03, 2020 at 12:22:47AM -0500, Haitao Huang wrote:
> > > When I turn on CONFIG_PROVE_LOCKING, kernel reports following
> > > suspicious RCU
> > > usages. Not sure if it is an issue. Just reporting here:
> >
> > I'm glad to hear that my tip helped you to get us the data.
> >
> > This does not look like an issue in the page reclaimer, which was not
> > obvious for me before. That's a good thing. I was really worried about
> > that because it has been very stable for a long period now. The last
> > bug fix for the reclaimer was done in June in v31 version of the patch
> > set and after that it has been unchanged (except possibly some renames
> > requested by Boris).
> >
> > I wildly guess I have a bad usage pattern for xarray. I migrated to it
> > in v36, and it is entirely possible that I've misused it. It was the
> > first time that I ever used it. Before xarray we had radix_tree but
> > based Matthew Wilcox feedback I did a migration to xarray.
> >
> > What I'd ask you to do next is to, if by any means possible, to try to
> > run the same test with v35 so we can verify this. That one still has
> > the radix tree.
> >
>
>
> v35 does not cause any such warning messages from kernel
Thank you. Looks like Matthew already located the issue, a fix will
land soon.
/Jarkko
On Sun, Oct 04, 2020 at 11:27:50PM +0100, Matthew Wilcox wrote:
> On Mon, Oct 05, 2020 at 12:50:49AM +0300, Jarkko Sakkinen wrote:
> > What is shoukd take is encl->lock.
> >
> > The loop was pre-v36 like:
> >
> > idx_start = PFN_DOWN(start);
> > idx_end = PFN_DOWN(end - 1);
> >
> > for (idx = idx_start; idx <= idx_end; ++idx) {
> > mutex_lock(&encl->lock);
> > page = radix_tree_lookup(&encl->page_tree, idx);
> > mutex_unlock(&encl->lock);
> >
> > if (!page || (~page->vm_max_prot_bits & vm_prot_bits))
> > return -EACCES;
> > }
> >
> > Looking at xarray.h and filemap.c, I'm thinking something along the
> > lines of:
> >
> > for (idx = idx_start; idx <= idx_end; ++idx) {
> > mutex_lock(&encl->lock);
> > page = xas_find(&xas, idx + 1);
> > mutex_unlock(&encl->lock);
> >
> > if (!page || (~page->vm_max_prot_bits & vm_prot_bits))
> > return -EACCES;
> > }
> >
> > Does this look about right?
>
> Not really ...
>
> int ret = 0;
>
> mutex_lock(&encl->lock);
> rcu_read_lock();
Right, so xa_*() take RCU lock implicitly and xas_* do not.
> while (xas.index < idx_end) {
> page = xas_next(&xas);
It should iterate through every possible page index within the range,
even the ones that do not have an entry, i.e. this loop also checks
that there are no empty slots.
Does xas_next() go through every possible index, or skip the non-empty
ones?
> if (!page || (~page->vm_max_prot_bits & vm_prot_bits))
> ret = -EACCESS;
> break;
> }
> }
> rcu_read_unlock();
> mutex_unlock(&encl->lock);
In my Geminilake NUC the maximum size of the address space is 64GB for
an enclave, and it is not fixed but can grow in microarchitectures
beyond that.
That means that in (*artificial*) worst case the locks would be kept for
64*1024*1024*1024/4096 = 16777216 iterations.
I just realized that in sgx_encl_load_page ([1], the encl->lock is
acquired by the caller) I have used xa_load(), which more or less would
be compatible with the old radix_tree pattern, i.e.
for (idx = idx_start; idx <= idx_end; ++idx) {
mutex_lock(&encl->lock);
page = xas_load(&encl->page_array, idx);
mutex_unlock(&encl->lock);
if (!page || (~page->vm_max_prot_bits & vm_prot_bits))
return -EACCES;
}
To make things stable again, I'll go with this for the immediate future.
> return ret;
>
> ... or you could rework to use the xa_lock instead of encl->lock.
> I don't know how feasible that is for you.
encl->lock is used to protect enclave state but it is true that
page->vm_max_prort_bits is not modified through concurrent access, once
the page is added (e.g. by the reclaimer, which gets pages through
sgx_activate_page_list, not through xarray).
It's an interesting idea, but before even considering it I want to fix
the bug, even if the fix ought to be somehow unoptimal in terms of
performance.
Thanks for helping with this. xarray is still somewhat alien to me and
most of the code I see just use the iterator macros excep mm/*, but
I'm slowly adapting the concepts.
[1] https://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-sgx.git/tree/arch/x86/kernel/cpu/sgx/encl.c
[2] https://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-sgx.git/tree/arch/x86/kernel/cpu/sgx/main.c
/Jarkko
On Mon, Oct 05, 2020 at 02:41:53AM +0300, Jarkko Sakkinen wrote:
> On Sun, Oct 04, 2020 at 11:27:50PM +0100, Matthew Wilcox wrote:
> > int ret = 0;
> >
> > mutex_lock(&encl->lock);
> > rcu_read_lock();
>
> Right, so xa_*() take RCU lock implicitly and xas_* do not.
Not necessarily the RCU lock ... I did document all this in xarray.rst:
https://www.kernel.org/doc/html/latest/core-api/xarray.html
> > while (xas.index < idx_end) {
> > page = xas_next(&xas);
>
> It should iterate through every possible page index within the range,
> even the ones that do not have an entry, i.e. this loop also checks
> that there are no empty slots.
>
> Does xas_next() go through every possible index, or skip the non-empty
> ones?
xas_next(), as its documentation says, will move to the next array
index:
https://www.kernel.org/doc/html/latest/core-api/xarray.html#c.xas_next
> > if (!page || (~page->vm_max_prot_bits & vm_prot_bits))
> > ret = -EACCESS;
> > break;
> > }
> > }
> > rcu_read_unlock();
> > mutex_unlock(&encl->lock);
>
> In my Geminilake NUC the maximum size of the address space is 64GB for
> an enclave, and it is not fixed but can grow in microarchitectures
> beyond that.
>
> That means that in (*artificial*) worst case the locks would be kept for
> 64*1024*1024*1024/4096 = 16777216 iterations.
Oh, there's support for that on the XArray API too.
xas_lock_irq(&xas);
xas_for_each_marked(&xas, page, end, PAGECACHE_TAG_DIRTY) {
xas_set_mark(&xas, PAGECACHE_TAG_TOWRITE);
if (++tagged % XA_CHECK_SCHED)
continue;
xas_pause(&xas);
xas_unlock_irq(&xas);
cond_resched();
xas_lock_irq(&xas);
}
xas_unlock_irq(&xas);
On Mon, Oct 05, 2020 at 02:30:53AM +0100, Matthew Wilcox wrote:
> > In my Geminilake NUC the maximum size of the address space is 64GB for
> > an enclave, and it is not fixed but can grow in microarchitectures
> > beyond that.
> >
> > That means that in (*artificial*) worst case the locks would be kept for
> > 64*1024*1024*1024/4096 = 16777216 iterations.
>
> Oh, there's support for that on the XArray API too.
>
> xas_lock_irq(&xas);
> xas_for_each_marked(&xas, page, end, PAGECACHE_TAG_DIRTY) {
> xas_set_mark(&xas, PAGECACHE_TAG_TOWRITE);
> if (++tagged % XA_CHECK_SCHED)
> continue;
>
> xas_pause(&xas);
> xas_unlock_irq(&xas);
> cond_resched();
> xas_lock_irq(&xas);
> }
> xas_unlock_irq(&xas);
Assuming we can iterate the array without encl->lock, I think this
would translate to:
/*
* Not taking encl->lock because:
* 1. page attributes are not written.
* 2. the only page attribute read is set before it is put to the array
* and stays constant throughout the enclave life-cycle.
*/
xas_lock(&xas);
xas_for_each_marked(&xas, page, idx_end) {
if (++tagged % XA_CHECK_SCHED)
continue;
xas_pause(&xas);
xas_unlock(&xas);
/*
* Attributes are not protected by the xa_lock, so I'm assuming
* that this is the legit place for the check.
*/
if (!page || (~page->vm_max_prot_bits & vm_prot_bits))
return -EACCES;
cond_resched();
xas_lock(&xas);
}
xas_unlock(&xas);
Obviously, we cannot use this pattern by taking the encl->lock inside
the loop (ABBA and encl->lock is a mutex).
Let's enumerate:
A. sgx_encl_add_page(): uses xa_insert() and xa_erase().
B. sgx_encl_load_page(): uses xa_load().
C. sgx_encl_may_map(): is broken (for the moment).
A and B implicitly the lock and if a page exist at all we only access
a pure constant.
Also, since the open file keeps the instance alive, nobody is going
to pull carpet under our feet.
OK, I've just concluded tha we don't need to take encl->lock in this
case. Great.
/Jarkko
On Sat, Oct 03, 2020 at 04:39:25PM +0200, Greg KH wrote:
> > @@ -0,0 +1,173 @@
> > +// SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause)
>
> You use gpl-only header files in this file, so how in the world can it
> be bsd-3 licensed?
>
> Please get your legal department to agree with this, after you explain
> to them how you are mixing gpl2-only code in with this file.
>
> > +// Copyright(c) 2016-18 Intel Corporation.
>
> Dates are hard to get right :(
As is comment formatting apparently. Don't use // comments for anything
but the SPDX header, please.
On Sun, Oct 04, 2020 at 05:32:46PM +0300, Jarkko Sakkinen wrote:
> On Sat, Oct 03, 2020 at 04:39:25PM +0200, Greg KH wrote:
> > On Sat, Oct 03, 2020 at 07:50:46AM +0300, Jarkko Sakkinen wrote:
> > > Intel Software Guard eXtensions (SGX) is a set of CPU instructions that can
> > > be used by applications to set aside private regions of code and data. The
> > > code outside the SGX hosted software entity is prevented from accessing the
> > > memory inside the enclave by the CPU. We call these entities enclaves.
> > >
> > > Add a driver that provides an ioctl API to construct and run enclaves.
> > > Enclaves are constructed from pages residing in reserved physical memory
> > > areas. The contents of these pages can only be accessed when they are
> > > mapped as part of an enclave, by a hardware thread running inside the
> > > enclave.
> > >
> > > The starting state of an enclave consists of a fixed measured set of
> > > pages that are copied to the EPC during the construction process by
> > > using the opcode ENCLS leaf functions and Software Enclave Control
> > > Structure (SECS) that defines the enclave properties.
> > >
> > > Enclaves are constructed by using ENCLS leaf functions ECREATE, EADD and
> > > EINIT. ECREATE initializes SECS, EADD copies pages from system memory to
> > > the EPC and EINIT checks a given signed measurement and moves the enclave
> > > into a state ready for execution.
> > >
> > > An initialized enclave can only be accessed through special Thread Control
> > > Structure (TCS) pages by using ENCLU (ring-3 only) leaf EENTER. This leaf
> > > function converts a thread into enclave mode and continues the execution in
> > > the offset defined by the TCS provided to EENTER. An enclave is exited
> > > through syscall, exception, interrupts or by explicitly calling another
> > > ENCLU leaf EEXIT.
> > >
> > > The mmap() permissions are capped by the contained enclave page
> > > permissions. The mapped areas must also be populated, i.e. each page
> > > address must contain a page. This logic is implemented in
> > > sgx_encl_may_map().
> > >
> > > Cc: [email protected]
> > > Cc: [email protected]
> > > Cc: Andrew Morton <[email protected]>
> > > Cc: Matthew Wilcox <[email protected]>
> > > Acked-by: Jethro Beekman <[email protected]>
> > > Tested-by: Jethro Beekman <[email protected]>
> > > Tested-by: Haitao Huang <[email protected]>
> > > Tested-by: Chunyang Hui <[email protected]>
> > > Tested-by: Jordan Hand <[email protected]>
> > > Tested-by: Nathaniel McCallum <[email protected]>
> > > Tested-by: Seth Moore <[email protected]>
> > > Tested-by: Darren Kenny <[email protected]>
> > > Reviewed-by: Darren Kenny <[email protected]>
> > > Co-developed-by: Sean Christopherson <[email protected]>
> > > Signed-off-by: Sean Christopherson <[email protected]>
> > > Co-developed-by: Suresh Siddha <[email protected]>
> > > Signed-off-by: Suresh Siddha <[email protected]>
> > > Signed-off-by: Jarkko Sakkinen <[email protected]>
> > > ---
> > > arch/x86/kernel/cpu/sgx/Makefile | 2 +
> > > arch/x86/kernel/cpu/sgx/driver.c | 173 ++++++++++++++++
> > > arch/x86/kernel/cpu/sgx/driver.h | 29 +++
> > > arch/x86/kernel/cpu/sgx/encl.c | 331 +++++++++++++++++++++++++++++++
> > > arch/x86/kernel/cpu/sgx/encl.h | 85 ++++++++
> > > arch/x86/kernel/cpu/sgx/main.c | 11 +
> > > 6 files changed, 631 insertions(+)
> > > create mode 100644 arch/x86/kernel/cpu/sgx/driver.c
> > > create mode 100644 arch/x86/kernel/cpu/sgx/driver.h
> > > create mode 100644 arch/x86/kernel/cpu/sgx/encl.c
> > > create mode 100644 arch/x86/kernel/cpu/sgx/encl.h
> > >
> > > diff --git a/arch/x86/kernel/cpu/sgx/Makefile b/arch/x86/kernel/cpu/sgx/Makefile
> > > index 79510ce01b3b..3fc451120735 100644
> > > --- a/arch/x86/kernel/cpu/sgx/Makefile
> > > +++ b/arch/x86/kernel/cpu/sgx/Makefile
> > > @@ -1,2 +1,4 @@
> > > obj-y += \
> > > + driver.o \
> > > + encl.o \
> > > main.o
> > > diff --git a/arch/x86/kernel/cpu/sgx/driver.c b/arch/x86/kernel/cpu/sgx/driver.c
> > > new file mode 100644
> > > index 000000000000..f54da5f19c2b
> > > --- /dev/null
> > > +++ b/arch/x86/kernel/cpu/sgx/driver.c
> > > @@ -0,0 +1,173 @@
> > > +// SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause)
> >
> > You use gpl-only header files in this file, so how in the world can it
> > be bsd-3 licensed?
> >
> > Please get your legal department to agree with this, after you explain
> > to them how you are mixing gpl2-only code in with this file.
>
> I'll do what I already stated that I will do. Should I do something
> more?
This was written before your previous response.
> > > + mutex_lock(&encl->lock);
> > > + atomic_or(SGX_ENCL_DEAD, &encl->flags);
> >
> > So you set a flag that this is dead, and then instantly delete it? Why
> > does that matter? I see you check for this flag elsewhere, but as you
> > are just about to delete this structure, how can this be an issue?
>
> It matters because ksgxswapd (sgx_reclaimer_*) might be processing it.
I don't see that happening in this patch, did I miss it?
> It will use the flag to skip the operations that it would do to a victim
> page, when the enclave is still alive.
Again, why are you adding flags when the patch does not use them?
Please put new functionality in the specific patch that uses it.
And can you really rely on this? How did sgx_reclaimer_* (whatever that
is), get the reference on this object in the first place? Again, I
don't see that happening at all in here, and at a quick glance in the
other patches I don't see it there either. What am I missing?
> > > + mutex_unlock(&encl->lock);
> > > +
> > > + kref_put(&encl->refcount, sgx_encl_release);
> >
> > Don't you need to hold the lock across the put? If not, what is
> > serializing this?
> >
> > But an even larger comment, why is this reference count needed at all?
> >
> > You never grab it except at init time, and you free it at close time.
> > Why not rely on the reference counting that the vfs ensures you?
>
> Because ksgxswapd needs the alive enclave instance while it is in the
> process of swapping a victim page. The reason for this is the
> hierarchical nature of the enclave pages.
>
> As an example, a write operation to main memory, EWB (SDM vol 3D 40-79)
What is that referencing?
> needs to access SGX Enclave Control Structure (SECS) page, which is
> contains global data for an enclave, like the unswapped child count.
Ok, but how did it get access to this structure in the first place, like
I ask above?
> > > + return 0;
> > > +}
> > > +
> > > +static int sgx_mmap(struct file *file, struct vm_area_struct *vma)
> > > +{
> > > + struct sgx_encl *encl = file->private_data;
> > > + int ret;
> > > +
> > > + ret = sgx_encl_may_map(encl, vma->vm_start, vma->vm_end, vma->vm_flags);
> > > + if (ret)
> > > + return ret;
> > > +
> > > + ret = sgx_encl_mm_add(encl, vma->vm_mm);
> > > + if (ret)
> > > + return ret;
> > > +
> > > + vma->vm_ops = &sgx_vm_ops;
> > > + vma->vm_flags |= VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP | VM_IO;
> > > + vma->vm_private_data = encl;
> > > +
> > > + return 0;
> > > +}
> > > +
> > > +static unsigned long sgx_get_unmapped_area(struct file *file,
> > > + unsigned long addr,
> > > + unsigned long len,
> > > + unsigned long pgoff,
> > > + unsigned long flags)
> > > +{
> > > + if ((flags & MAP_TYPE) == MAP_PRIVATE)
> > > + return -EINVAL;
> > > +
> > > + if (flags & MAP_FIXED)
> > > + return addr;
> > > +
> > > + return current->mm->get_unmapped_area(file, addr, len, pgoff, flags);
> > > +}
> > > +
> > > +static const struct file_operations sgx_encl_fops = {
> > > + .owner = THIS_MODULE,
> > > + .open = sgx_open,
> > > + .release = sgx_release,
> > > + .mmap = sgx_mmap,
> > > + .get_unmapped_area = sgx_get_unmapped_area,
> > > +};
> > > +
> > > +static struct miscdevice sgx_dev_enclave = {
> > > + .minor = MISC_DYNAMIC_MINOR,
> > > + .name = "enclave",
> > > + .nodename = "sgx/enclave",
> >
> > A subdir for a single device node? Ok, odd, but why not just
> > "sgx_enclave"? How "special" is this device node?
>
> There is a patch that adds "sgx/provision".
What number in this series?
> Either works for me. Should I flatten them to "sgx_enclave" and
> "sgx_provision", or keep them as they are?
Having 2 char nodes in a subdir is better than one, I will give you
that. But none is even better, don't you think?
thanks,
greg k-h
On Mon, Oct 05, 2020 at 09:45:54AM +0100, Christoph Hellwig wrote:
> On Sat, Oct 03, 2020 at 04:39:25PM +0200, Greg KH wrote:
> > > @@ -0,0 +1,173 @@
> > > +// SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause)
> >
> > You use gpl-only header files in this file, so how in the world can it
> > be bsd-3 licensed?
> >
> > Please get your legal department to agree with this, after you explain
> > to them how you are mixing gpl2-only code in with this file.
> >
> > > +// Copyright(c) 2016-18 Intel Corporation.
> >
> > Dates are hard to get right :(
>
> As is comment formatting apparently. Don't use // comments for anything
> but the SPDX header, please.
I'll bring some context to this.
When I moved into using SPDX, I took the example from places where I saw
also the copyright using "//". That's the reason for the choice.
I.e.
$ git grep "// Copyright" | wc -l
2123
I don't care, which one to use, just wondering is it done in the wrong
way in all these sites?
/Jarkko
On Mon, Oct 05, 2020 at 02:42:50PM +0300, Jarkko Sakkinen wrote:
> On Mon, Oct 05, 2020 at 09:45:54AM +0100, Christoph Hellwig wrote:
> > On Sat, Oct 03, 2020 at 04:39:25PM +0200, Greg KH wrote:
> > > > @@ -0,0 +1,173 @@
> > > > +// SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause)
> > >
> > > You use gpl-only header files in this file, so how in the world can it
> > > be bsd-3 licensed?
> > >
> > > Please get your legal department to agree with this, after you explain
> > > to them how you are mixing gpl2-only code in with this file.
> > >
> > > > +// Copyright(c) 2016-18 Intel Corporation.
> > >
> > > Dates are hard to get right :(
> >
> > As is comment formatting apparently. Don't use // comments for anything
> > but the SPDX header, please.
>
> I'll bring some context to this.
>
> When I moved into using SPDX, I took the example from places where I saw
> also the copyright using "//". That's the reason for the choice.
>
> I.e.
>
> $ git grep "// Copyright" | wc -l
> 2123
>
> I don't care, which one to use, just wondering is it done in the wrong
> way in all these sites?
Probably, but I know at least one subsystem requires their headers to be
in this manner. There's no accounting for taste :)
thanks,
greg k-h
On Mon, Oct 05, 2020 at 11:42:46AM +0200, Greg KH wrote:
> > > You use gpl-only header files in this file, so how in the world can it
> > > be bsd-3 licensed?
> > >
> > > Please get your legal department to agree with this, after you explain
> > > to them how you are mixing gpl2-only code in with this file.
> >
> > I'll do what I already stated that I will do. Should I do something
> > more?
>
> This was written before your previous response.
OK, that is weird, I got this one some time later.
> > > > + mutex_lock(&encl->lock);
> > > > + atomic_or(SGX_ENCL_DEAD, &encl->flags);
> > >
> > > So you set a flag that this is dead, and then instantly delete it? Why
> > > does that matter? I see you check for this flag elsewhere, but as you
> > > are just about to delete this structure, how can this be an issue?
> >
> > It matters because ksgxswapd (sgx_reclaimer_*) might be processing it.
>
> I don't see that happening in this patch, did I miss it?
It's implemented in 16/24:
https://lore.kernel.org/linux-sgx/[email protected]/T/#u
> > It will use the flag to skip the operations that it would do to a victim
> > page, when the enclave is still alive.
>
> Again, why are you adding flags when the patch does not use them?
> Please put new functionality in the specific patch that uses it.
>
> And can you really rely on this? How did sgx_reclaimer_* (whatever that
> is), get the reference on this object in the first place? Again, I
> don't see that happening at all in here, and at a quick glance in the
> other patches I don't see it there either. What am I missing?
I went through the patch, and yes, they can be migrated to 16/24.
I agree with this, no excuses.
In 16/24 pages are added to sgx_active_page_list from which they are
swapped by the reclaimer to the main memory when Enclave Page Cache
(EPC), the memory where enclave pages reside, gets full.
When a reclaimer thread takes a victim page from that list, it will also
get a kref to the enclave so that struct sgx_encl instance does not
get wiped while it's doing its job.
> > Because ksgxswapd needs the alive enclave instance while it is in the
> > process of swapping a victim page. The reason for this is the
> > hierarchical nature of the enclave pages.
> >
> > As an example, a write operation to main memory, EWB (SDM vol 3D 40-79)
>
> What is that referencing?
https://software.intel.com/content/dam/develop/public/us/en/documents/332831-sdm-vol-3d.pdf
> > needs to access SGX Enclave Control Structure (SECS) page, which is
> > contains global data for an enclave, like the unswapped child count.
>
> Ok, but how did it get access to this structure in the first place, like
> I ask above?
I guess I answered that, and I also fully agree with your suggestions.
It used to be many iterations ago that enclaves were not file based but
just memory mappings (long story short: was not great way to make them
multiprocess, that's why file centered now), and then refcount played a
bigger role. Having those "extras" in this patch is by no means
intentional but more like cruft of many iterations of refactoring.
Sometimes when you work long with this kind of pile of code, which has
converged through many iterations, you really need someone else to point
some of the simple and obvious things out.
> > There is a patch that adds "sgx/provision".
>
> What number in this series?
It's 15/24.
>
> > Either works for me. Should I flatten them to "sgx_enclave" and
> > "sgx_provision", or keep them as they are?
>
> Having 2 char nodes in a subdir is better than one, I will give you
> that. But none is even better, don't you think?
I think that having just "sgx_enclave" and "sgx_provision" would be
better.
I've been thinking about this for a while but at the same time try not
to be too proactive without feedback. One reason would be that "enclave"
and "provision" without the subdir are not good identifiers.
I also recalled this discussion:
https://lkml.org/lkml/2019/12/23/158
and was wondering how that subdir would even play with /sys/class/misc,
if we decide to add attributes? Not enough knowledge to answer this.
Anyway, I'll put a note to my backlog on this, and also to move the
previously discussed cruft to the correct patch.
> thanks,
>
> greg k-h
Thank you.
/Jarkko
On Mon, Oct 05, 2020 at 01:50:30PM +0200, Greg KH wrote:
> On Mon, Oct 05, 2020 at 02:42:50PM +0300, Jarkko Sakkinen wrote:
> > On Mon, Oct 05, 2020 at 09:45:54AM +0100, Christoph Hellwig wrote:
> > > On Sat, Oct 03, 2020 at 04:39:25PM +0200, Greg KH wrote:
> > > > > @@ -0,0 +1,173 @@
> > > > > +// SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause)
> > > >
> > > > You use gpl-only header files in this file, so how in the world can it
> > > > be bsd-3 licensed?
> > > >
> > > > Please get your legal department to agree with this, after you explain
> > > > to them how you are mixing gpl2-only code in with this file.
> > > >
> > > > > +// Copyright(c) 2016-18 Intel Corporation.
> > > >
> > > > Dates are hard to get right :(
> > >
> > > As is comment formatting apparently. Don't use // comments for anything
> > > but the SPDX header, please.
> >
> > I'll bring some context to this.
> >
> > When I moved into using SPDX, I took the example from places where I saw
> > also the copyright using "//". That's the reason for the choice.
> >
> > I.e.
> >
> > $ git grep "// Copyright" | wc -l
> > 2123
> >
> > I don't care, which one to use, just wondering is it done in the wrong
> > way in all these sites?
>
> Probably, but I know at least one subsystem requires their headers to be
> in this manner. There's no accounting for taste :)
This discussion is a bit confusing [*], so I'll just ask from Git:
➜ linux-sgx (master) ✔ git --no-pager grep "\/\/ Copyright" arch/x86
arch/x86/kernel/cpu/sgx/driver.c:// Copyright(c) 2016-20 Intel Corporation.
arch/x86/kernel/cpu/sgx/encl.c:// Copyright(c) 2016-20 Intel Corporation.
arch/x86/kernel/cpu/sgx/ioctl.c:// Copyright(c) 2016-20 Intel Corporation.
arch/x86/kernel/cpu/sgx/main.c:// Copyright(c) 2016-20 Intel Corporation.
OK, now I think I know what to do :-)
> thanks,
>
> greg k-h
[*] One thing I've been wondering for a long time is that, why new code
should have the copyright platters in the first place? I get it for
pre-Git era but now there is a cryptographic log of authority.
Copyright platters, remarking the authors to the header and
MODULE_AUTHOR() macro are the three things that I just do not get in the
modern times.
/Jarkko
On Mon, Oct 05, 2020 at 05:23:45PM +0300, Jarkko Sakkinen wrote:
> [*] One thing I've been wondering for a long time is that, why new code
> should have the copyright platters in the first place? I get it for
> pre-Git era but now there is a cryptographic log of authority.
Go talk to your corporate lawyers about this, it is one of the most
common cargo-cult patterns around :)
good luck!
greg k-h
On 10/5/20 8:02 AM, Greg KH wrote:
> On Mon, Oct 05, 2020 at 05:23:45PM +0300, Jarkko Sakkinen wrote:
>> [*] One thing I've been wondering for a long time is that, why new code
>> should have the copyright platters in the first place? I get it for
>> pre-Git era but now there is a cryptographic log of authority.
> Go talk to your corporate lawyers about this, it is one of the most
> common cargo-cult patterns around :)
For this patch, though, it seems like we should just update the dates
instead of removing them.
If I look at the last 1000 "^+.*Copyright" lines added to the kernel,
997 of them have a year. So, weird or not, it's a pretty standard
convention. We'd need a slightly more broad conversation before we
decide to nix these dates.
Pure speculation: Copyright protection, at least in the US, is not
forever. I _think_ it's 75 years or something. That protection starts
when the work is created and is independent of when it gets merged into
Linux. So, if we did something weird like merge a driver written 10
years ago, it would only be protected for 65 more years after we merge
it. In other words, git history _might_ be irrelevant for copyright
protection.
On Mon, Oct 05, 2020 at 09:40:52AM -0700, Dave Hansen wrote:
> On 10/5/20 8:02 AM, Greg KH wrote:
> > On Mon, Oct 05, 2020 at 05:23:45PM +0300, Jarkko Sakkinen wrote:
> >> [*] One thing I've been wondering for a long time is that, why new code
> >> should have the copyright platters in the first place? I get it for
> >> pre-Git era but now there is a cryptographic log of authority.
> > Go talk to your corporate lawyers about this, it is one of the most
> > common cargo-cult patterns around :)
>
> For this patch, though, it seems like we should just update the dates
> instead of removing them.
Already done. I updated them yesterday as:
Copyright(c) 2016-20 Intel Corporation.
Changing from '//' to '/* ... */' is not yet.
> If I look at the last 1000 "^+.*Copyright" lines added to the kernel,
> 997 of them have a year. So, weird or not, it's a pretty standard
> convention. We'd need a slightly more broad conversation before we
> decide to nix these dates.
>
> Pure speculation: Copyright protection, at least in the US, is not
> forever. I _think_ it's 75 years or something. That protection starts
> when the work is created and is independent of when it gets merged into
> Linux. So, if we did something weird like merge a driver written 10
> years ago, it would only be protected for 65 more years after we merge
> it. In other words, git history _might_ be irrelevant for copyright
> protection.
/Jarkko
On Sat, Oct 03, 2020 at 07:50:56AM +0300, Jarkko Sakkinen wrote:
> From: Sean Christopherson <[email protected]>
> + /* Validate that the reserved area contains only zeros. */
> + push %rax
> + push %rbx
> + mov $SGX_ENCLAVE_RUN_RESERVED_START, %rbx
> +1:
> + mov (%rcx, %rbx), %rax
> + cmpq $0, %rax
> + jne .Linvalid_input
> +
> + add $8, %rbx
> + cmpq $SGX_ENCLAVE_RUN_RESERVED_END, %rbx
> + jne 1b
> + pop %rbx
> + pop %rax
This can more succinctly be (untested):
movq SGX_ENCLAVE_RUN_RESERVED_1(%rbp), %rbx
orq SGX_ENCLAVE_RUN_RESERVED_2(%rbp), %rbx
orq SGX_ENCLAVE_RUN_RESERVED_3(%rbp), %rbx
jnz .Linvalid_input
Note, %rbx is getting clobbered anyways, no need to save/restore it.
> diff --git a/arch/x86/include/uapi/asm/sgx.h b/arch/x86/include/uapi/asm/sgx.h
> index b6ba036a9b82..3dd2df44d569 100644
> --- a/arch/x86/include/uapi/asm/sgx.h
> +++ b/arch/x86/include/uapi/asm/sgx.h
> @@ -74,4 +74,102 @@ struct sgx_enclave_provision {
> __u64 attribute_fd;
> };
>
> +struct sgx_enclave_run;
> +
> +/**
> + * typedef sgx_enclave_user_handler_t - Exit handler function accepted by
> + * __vdso_sgx_enter_enclave()
> + * @run: Pointer to the caller provided struct sgx_enclave_run
> + *
> + * The register parameters contain the snapshot of their values at enclave
> + * exit
> + *
> + * Return:
> + * 0 or negative to exit vDSO
> + * positive to re-enter enclave (must be EENTER or ERESUME leaf)
> + */
> +typedef int (*sgx_enclave_user_handler_t)(long rdi, long rsi, long rdx,
> + long rsp, long r8, long r9,
> + struct sgx_enclave_run *run);
> +
> +/**
> + * struct sgx_enclave_run - the execution context of __vdso_sgx_enter_enclave()
> + * @tcs: TCS used to enter the enclave
> + * @user_handler: User provided callback run on exception
> + * @user_data: Data passed to the user handler
> + * @leaf: The ENCLU leaf we were at (EENTER/ERESUME/EEXIT)
> + * @exception_vector: The interrupt vector of the exception
> + * @exception_error_code: The exception error code pulled out of the stack
> + * @exception_addr: The address that triggered the exception
> + * @reserved Reserved for possible future use
> + */
> +struct sgx_enclave_run {
> + __u64 tcs;
> + __u64 user_handler;
> + __u64 user_data;
> + __u32 leaf;
I am still very strongly opposed to omitting exit_reason. It is not at all
difficult to imagine scenarios where 'leaf' alone is insufficient for the
caller or its handler to deduce why the CPU exited the enclave. E.g. see
Jethro's request for intercepting interrupts.
I don't buy the argument that the N bytes needed for the exit_reason are at
all expensive.
> + __u16 exception_vector;
> + __u16 exception_error_code;
> + __u64 exception_addr;
> + __u8 reserved[24];
I also think it's a waste of space to bother with multiple reserved fields.
24 bytes isn't so much that it guarantees we'll never run into problems in
the future. But I care far less about this than I do about exit_reason.
> +};
On 2020-10-06 04:57, Sean Christopherson wrote:
> On Sat, Oct 03, 2020 at 07:50:56AM +0300, Jarkko Sakkinen wrote:
>> From: Sean Christopherson <[email protected]>
>> + /* Validate that the reserved area contains only zeros. */
>> + push %rax
>> + push %rbx
>> + mov $SGX_ENCLAVE_RUN_RESERVED_START, %rbx
>> +1:
>> + mov (%rcx, %rbx), %rax
>> + cmpq $0, %rax
>> + jne .Linvalid_input
>> +
>> + add $8, %rbx
>> + cmpq $SGX_ENCLAVE_RUN_RESERVED_END, %rbx
>> + jne 1b
>> + pop %rbx
>> + pop %rax
>
> This can more succinctly be (untested):
>
> movq SGX_ENCLAVE_RUN_RESERVED_1(%rbp), %rbx
> orq SGX_ENCLAVE_RUN_RESERVED_2(%rbp), %rbx
> orq SGX_ENCLAVE_RUN_RESERVED_3(%rbp), %rbx
> jnz .Linvalid_input
>
> Note, %rbx is getting clobbered anyways, no need to save/restore it.
>
>> diff --git a/arch/x86/include/uapi/asm/sgx.h b/arch/x86/include/uapi/asm/sgx.h
>> index b6ba036a9b82..3dd2df44d569 100644
>> --- a/arch/x86/include/uapi/asm/sgx.h
>> +++ b/arch/x86/include/uapi/asm/sgx.h
>> @@ -74,4 +74,102 @@ struct sgx_enclave_provision {
>> __u64 attribute_fd;
>> };
>>
>> +struct sgx_enclave_run;
>> +
>> +/**
>> + * typedef sgx_enclave_user_handler_t - Exit handler function accepted by
>> + * __vdso_sgx_enter_enclave()
>> + * @run: Pointer to the caller provided struct sgx_enclave_run
>> + *
>> + * The register parameters contain the snapshot of their values at enclave
>> + * exit
>> + *
>> + * Return:
>> + * 0 or negative to exit vDSO
>> + * positive to re-enter enclave (must be EENTER or ERESUME leaf)
>> + */
>> +typedef int (*sgx_enclave_user_handler_t)(long rdi, long rsi, long rdx,
>> + long rsp, long r8, long r9,
>> + struct sgx_enclave_run *run);
>> +
>> +/**
>> + * struct sgx_enclave_run - the execution context of __vdso_sgx_enter_enclave()
>> + * @tcs: TCS used to enter the enclave
>> + * @user_handler: User provided callback run on exception
>> + * @user_data: Data passed to the user handler
>> + * @leaf: The ENCLU leaf we were at (EENTER/ERESUME/EEXIT)
>> + * @exception_vector: The interrupt vector of the exception
>> + * @exception_error_code: The exception error code pulled out of the stack
>> + * @exception_addr: The address that triggered the exception
>> + * @reserved Reserved for possible future use
>> + */
>> +struct sgx_enclave_run {
>> + __u64 tcs;
>> + __u64 user_handler;
>> + __u64 user_data;
>> + __u32 leaf;
>
> I am still very strongly opposed to omitting exit_reason. It is not at all
> difficult to imagine scenarios where 'leaf' alone is insufficient for the
> caller or its handler to deduce why the CPU exited the enclave. E.g. see
> Jethro's request for intercepting interrupts.
Not entirely sure what this has to do with my request, I just expect to see leaf=ERESUME in this case, I think? E.g. as you would see in EAX when calling ENCLU.
--
Jethro Beekman | Fortanix
On Tue, Oct 06, 2020 at 10:30:16AM +0200, Jethro Beekman wrote:
> On 2020-10-06 04:57, Sean Christopherson wrote:
> > On Sat, Oct 03, 2020 at 07:50:56AM +0300, Jarkko Sakkinen wrote:
> >> +struct sgx_enclave_run {
> >> + __u64 tcs;
> >> + __u64 user_handler;
> >> + __u64 user_data;
> >> + __u32 leaf;
> >
> > I am still very strongly opposed to omitting exit_reason. It is not at all
> > difficult to imagine scenarios where 'leaf' alone is insufficient for the
> > caller or its handler to deduce why the CPU exited the enclave. E.g. see
> > Jethro's request for intercepting interrupts.
>
> Not entirely sure what this has to do with my request, I just expect to see
> leaf=ERESUME in this case, I think? E.g. as you would see in EAX when calling
> ENCLU.
But how would you differentiate from the case that an exception occured in
the enclave? That will also transfer control with leaf=ERESUME. If there
was a prior exception and userspace didn't zero out the struct, there would
be "valid" data in the exception fields.
An exit_reason also would allow retrofitting the exception fields into a
union, i.e. the fields are valid if and only if exit_reason is exception.
On Mon, Oct 05, 2020 at 07:57:05PM -0700, Sean Christopherson wrote:
> On Sat, Oct 03, 2020 at 07:50:56AM +0300, Jarkko Sakkinen wrote:
> > From: Sean Christopherson <[email protected]>
> > + /* Validate that the reserved area contains only zeros. */
> > + push %rax
> > + push %rbx
> > + mov $SGX_ENCLAVE_RUN_RESERVED_START, %rbx
> > +1:
> > + mov (%rcx, %rbx), %rax
> > + cmpq $0, %rax
> > + jne .Linvalid_input
> > +
> > + add $8, %rbx
> > + cmpq $SGX_ENCLAVE_RUN_RESERVED_END, %rbx
> > + jne 1b
> > + pop %rbx
> > + pop %rax
>
> This can more succinctly be (untested):
>
> movq SGX_ENCLAVE_RUN_RESERVED_1(%rbp), %rbx
> orq SGX_ENCLAVE_RUN_RESERVED_2(%rbp), %rbx
> orq SGX_ENCLAVE_RUN_RESERVED_3(%rbp), %rbx
> jnz .Linvalid_input
>
> Note, %rbx is getting clobbered anyways, no need to save/restore it.
Right of course, because TCS comes through the run-struct. I've created
a backlog entry for this. Thank you.
> > diff --git a/arch/x86/include/uapi/asm/sgx.h b/arch/x86/include/uapi/asm/sgx.h
> > index b6ba036a9b82..3dd2df44d569 100644
> > --- a/arch/x86/include/uapi/asm/sgx.h
> > +++ b/arch/x86/include/uapi/asm/sgx.h
> > @@ -74,4 +74,102 @@ struct sgx_enclave_provision {
> > __u64 attribute_fd;
> > };
> >
> > +struct sgx_enclave_run;
> > +
> > +/**
> > + * typedef sgx_enclave_user_handler_t - Exit handler function accepted by
> > + * __vdso_sgx_enter_enclave()
> > + * @run: Pointer to the caller provided struct sgx_enclave_run
> > + *
> > + * The register parameters contain the snapshot of their values at enclave
> > + * exit
> > + *
> > + * Return:
> > + * 0 or negative to exit vDSO
> > + * positive to re-enter enclave (must be EENTER or ERESUME leaf)
> > + */
> > +typedef int (*sgx_enclave_user_handler_t)(long rdi, long rsi, long rdx,
> > + long rsp, long r8, long r9,
> > + struct sgx_enclave_run *run);
> > +
> > +/**
> > + * struct sgx_enclave_run - the execution context of __vdso_sgx_enter_enclave()
> > + * @tcs: TCS used to enter the enclave
> > + * @user_handler: User provided callback run on exception
> > + * @user_data: Data passed to the user handler
> > + * @leaf: The ENCLU leaf we were at (EENTER/ERESUME/EEXIT)
> > + * @exception_vector: The interrupt vector of the exception
> > + * @exception_error_code: The exception error code pulled out of the stack
> > + * @exception_addr: The address that triggered the exception
> > + * @reserved Reserved for possible future use
> > + */
> > +struct sgx_enclave_run {
> > + __u64 tcs;
> > + __u64 user_handler;
> > + __u64 user_data;
> > + __u32 leaf;
>
> I am still very strongly opposed to omitting exit_reason. It is not at all
> difficult to imagine scenarios where 'leaf' alone is insufficient for the
> caller or its handler to deduce why the CPU exited the enclave. E.g. see
> Jethro's request for intercepting interrupts.
>
> I don't buy the argument that the N bytes needed for the exit_reason are at
> all expensive.
It's not used for anything.
> > + __u16 exception_vector;
> > + __u16 exception_error_code;
> > + __u64 exception_addr;
> > + __u8 reserved[24];
>
> I also think it's a waste of space to bother with multiple reserved fields.
> 24 bytes isn't so much that it guarantees we'll never run into problems in
> the future. But I care far less about this than I do about exit_reason.
/Jarkko
On Tue, Oct 06, 2020 at 10:30:16AM +0200, Jethro Beekman wrote:
> On 2020-10-06 04:57, Sean Christopherson wrote:
> > On Sat, Oct 03, 2020 at 07:50:56AM +0300, Jarkko Sakkinen wrote:
> >> From: Sean Christopherson <[email protected]>
> >> + /* Validate that the reserved area contains only zeros. */
> >> + push %rax
> >> + push %rbx
> >> + mov $SGX_ENCLAVE_RUN_RESERVED_START, %rbx
> >> +1:
> >> + mov (%rcx, %rbx), %rax
> >> + cmpq $0, %rax
> >> + jne .Linvalid_input
> >> +
> >> + add $8, %rbx
> >> + cmpq $SGX_ENCLAVE_RUN_RESERVED_END, %rbx
> >> + jne 1b
> >> + pop %rbx
> >> + pop %rax
> >
> > This can more succinctly be (untested):
> >
> > movq SGX_ENCLAVE_RUN_RESERVED_1(%rbp), %rbx
> > orq SGX_ENCLAVE_RUN_RESERVED_2(%rbp), %rbx
> > orq SGX_ENCLAVE_RUN_RESERVED_3(%rbp), %rbx
> > jnz .Linvalid_input
> >
> > Note, %rbx is getting clobbered anyways, no need to save/restore it.
> >
> >> diff --git a/arch/x86/include/uapi/asm/sgx.h b/arch/x86/include/uapi/asm/sgx.h
> >> index b6ba036a9b82..3dd2df44d569 100644
> >> --- a/arch/x86/include/uapi/asm/sgx.h
> >> +++ b/arch/x86/include/uapi/asm/sgx.h
> >> @@ -74,4 +74,102 @@ struct sgx_enclave_provision {
> >> __u64 attribute_fd;
> >> };
> >>
> >> +struct sgx_enclave_run;
> >> +
> >> +/**
> >> + * typedef sgx_enclave_user_handler_t - Exit handler function accepted by
> >> + * __vdso_sgx_enter_enclave()
> >> + * @run: Pointer to the caller provided struct sgx_enclave_run
> >> + *
> >> + * The register parameters contain the snapshot of their values at enclave
> >> + * exit
> >> + *
> >> + * Return:
> >> + * 0 or negative to exit vDSO
> >> + * positive to re-enter enclave (must be EENTER or ERESUME leaf)
> >> + */
> >> +typedef int (*sgx_enclave_user_handler_t)(long rdi, long rsi, long rdx,
> >> + long rsp, long r8, long r9,
> >> + struct sgx_enclave_run *run);
> >> +
> >> +/**
> >> + * struct sgx_enclave_run - the execution context of __vdso_sgx_enter_enclave()
> >> + * @tcs: TCS used to enter the enclave
> >> + * @user_handler: User provided callback run on exception
> >> + * @user_data: Data passed to the user handler
> >> + * @leaf: The ENCLU leaf we were at (EENTER/ERESUME/EEXIT)
> >> + * @exception_vector: The interrupt vector of the exception
> >> + * @exception_error_code: The exception error code pulled out of the stack
> >> + * @exception_addr: The address that triggered the exception
> >> + * @reserved Reserved for possible future use
> >> + */
> >> +struct sgx_enclave_run {
> >> + __u64 tcs;
> >> + __u64 user_handler;
> >> + __u64 user_data;
> >> + __u32 leaf;
> >
> > I am still very strongly opposed to omitting exit_reason. It is not at all
> > difficult to imagine scenarios where 'leaf' alone is insufficient for the
> > caller or its handler to deduce why the CPU exited the enclave. E.g. see
> > Jethro's request for intercepting interrupts.
>
> Not entirely sure what this has to do with my request, I just expect
> to see leaf=ERESUME in this case, I think? E.g. as you would see in
> EAX when calling ENCLU.
The documentation needs to be fixed but the answer is yes.
I.e.
- Leaf will contain ERESUME on interrupt.
- Leaf will contain EEXIT on normal exit.
Maybe I should rename it as exit_leaf and rewrite the description to
improve clarity?
/Jarkko
On Tue, Oct 06, 2020 at 08:15:32AM -0700, Sean Christopherson wrote:
> On Tue, Oct 06, 2020 at 10:30:16AM +0200, Jethro Beekman wrote:
> > On 2020-10-06 04:57, Sean Christopherson wrote:
> > > On Sat, Oct 03, 2020 at 07:50:56AM +0300, Jarkko Sakkinen wrote:
> > >> +struct sgx_enclave_run {
> > >> + __u64 tcs;
> > >> + __u64 user_handler;
> > >> + __u64 user_data;
> > >> + __u32 leaf;
> > >
> > > I am still very strongly opposed to omitting exit_reason. It is not at all
> > > difficult to imagine scenarios where 'leaf' alone is insufficient for the
> > > caller or its handler to deduce why the CPU exited the enclave. E.g. see
> > > Jethro's request for intercepting interrupts.
> >
> > Not entirely sure what this has to do with my request, I just expect to see
> > leaf=ERESUME in this case, I think? E.g. as you would see in EAX when calling
> > ENCLU.
>
> But how would you differentiate from the case that an exception occured in
> the enclave? That will also transfer control with leaf=ERESUME. If there
> was a prior exception and userspace didn't zero out the struct, there would
> be "valid" data in the exception fields.
>
> An exit_reason also would allow retrofitting the exception fields into a
> union, i.e. the fields are valid if and only if exit_reason is exception.
Let's purge this a bit. Please remark where my logic goes wrong. I'm
just explaining how I've deduced the whole thing.
The information was encoded in v38 version of the vDSO was exactly this:
- On normal EEXIT, it got the value 0.
- Otherwise, it got the value 1.
The leaf, then embdded to struct sgx_exception but essentially the same
field got the value from EAX, and the value that EAX had was only
written on exception path.
Thus, I deduced that if you write $EEXIT to leaf on synchrous exit you
get the same information content, nothing gets overwritten. I.e. you
can make same conclusions as you would with those two struct fields.
/Jarkko
On Mon, Oct 05, 2020 at 07:57:05PM -0700, Sean Christopherson wrote:
> On Sat, Oct 03, 2020 at 07:50:56AM +0300, Jarkko Sakkinen wrote:
> > + __u16 exception_vector;
> > + __u16 exception_error_code;
> > + __u64 exception_addr;
> > + __u8 reserved[24];
>
> I also think it's a waste of space to bother with multiple reserved fields.
> 24 bytes isn't so much that it guarantees we'll never run into problems in
> the future. But I care far less about this than I do about exit_reason.
For me the real problem is that there has not been "no brainer" basis
for any size, so a one cache line worth of data is just something that
makes sense, because would neither make much sense to have less.
I'll throw an argument to have it a bit bigger amount of reserved space
for future use.
First, there is always some amount of unknown unknowns when it comes to
run-time structures, given the evolution of microarchitectures. So yes,
some more "state" might be needed in the future.
Secondly, this is a bigger problem for the vDSO than it is for ioctl's
because we can have only one. With ioctl's, in the absolute worst case,
we can have a second version of the same ioctl.
At least 256 bytes would be probably a good number, if we want to
increase it. The reserved space zero validation that I implemented to
this version probably does not add much to the overhead anyway.
I'm not sure why care about one struct field more than making sure that
the run-time structure can stand time.
/Jarkko
On Tue, Oct 06, 2020 at 08:28:19PM +0300, Jarkko Sakkinen wrote:
> On Tue, Oct 06, 2020 at 08:15:32AM -0700, Sean Christopherson wrote:
> > On Tue, Oct 06, 2020 at 10:30:16AM +0200, Jethro Beekman wrote:
> > > On 2020-10-06 04:57, Sean Christopherson wrote:
> > > > On Sat, Oct 03, 2020 at 07:50:56AM +0300, Jarkko Sakkinen wrote:
> > > >> +struct sgx_enclave_run {
> > > >> + __u64 tcs;
> > > >> + __u64 user_handler;
> > > >> + __u64 user_data;
> > > >> + __u32 leaf;
> > > >
> > > > I am still very strongly opposed to omitting exit_reason. It is not at all
> > > > difficult to imagine scenarios where 'leaf' alone is insufficient for the
> > > > caller or its handler to deduce why the CPU exited the enclave. E.g. see
> > > > Jethro's request for intercepting interrupts.
> > >
> > > Not entirely sure what this has to do with my request, I just expect to see
> > > leaf=ERESUME in this case, I think? E.g. as you would see in EAX when calling
> > > ENCLU.
> >
> > But how would you differentiate from the case that an exception occured in
> > the enclave? That will also transfer control with leaf=ERESUME. If there
> > was a prior exception and userspace didn't zero out the struct, there would
> > be "valid" data in the exception fields.
> >
> > An exit_reason also would allow retrofitting the exception fields into a
> > union, i.e. the fields are valid if and only if exit_reason is exception.
>
> Let's purge this a bit. Please remark where my logic goes wrong. I'm
> just explaining how I've deduced the whole thing.
>
> The information was encoded in v38 version of the vDSO was exactly this:
>
> - On normal EEXIT, it got the value 0.
> - Otherwise, it got the value 1.
>
> The leaf, then embdded to struct sgx_exception but essentially the same
> field got the value from EAX, and the value that EAX had was only
> written on exception path.
>
> Thus, I deduced that if you write $EEXIT to leaf on synchrous exit you
> get the same information content, nothing gets overwritten. I.e. you
> can make same conclusions as you would with those two struct fields.
And then a third flavor comes along, e.g. Jethro's request interrupt case,
and exit_reason can also return '2'. How do you handle that with only the
leaf?
On Tue, Oct 06, 2020 at 04:21:29PM -0700, Sean Christopherson wrote:
> On Tue, Oct 06, 2020 at 08:28:19PM +0300, Jarkko Sakkinen wrote:
> > On Tue, Oct 06, 2020 at 08:15:32AM -0700, Sean Christopherson wrote:
> > > On Tue, Oct 06, 2020 at 10:30:16AM +0200, Jethro Beekman wrote:
> > > > On 2020-10-06 04:57, Sean Christopherson wrote:
> > > > > On Sat, Oct 03, 2020 at 07:50:56AM +0300, Jarkko Sakkinen wrote:
> > > > >> +struct sgx_enclave_run {
> > > > >> + __u64 tcs;
> > > > >> + __u64 user_handler;
> > > > >> + __u64 user_data;
> > > > >> + __u32 leaf;
> > > > >
> > > > > I am still very strongly opposed to omitting exit_reason. It is not at all
> > > > > difficult to imagine scenarios where 'leaf' alone is insufficient for the
> > > > > caller or its handler to deduce why the CPU exited the enclave. E.g. see
> > > > > Jethro's request for intercepting interrupts.
> > > >
> > > > Not entirely sure what this has to do with my request, I just expect to see
> > > > leaf=ERESUME in this case, I think? E.g. as you would see in EAX when calling
> > > > ENCLU.
> > >
> > > But how would you differentiate from the case that an exception occured in
> > > the enclave? That will also transfer control with leaf=ERESUME. If there
> > > was a prior exception and userspace didn't zero out the struct, there would
> > > be "valid" data in the exception fields.
> > >
> > > An exit_reason also would allow retrofitting the exception fields into a
> > > union, i.e. the fields are valid if and only if exit_reason is exception.
> >
> > Let's purge this a bit. Please remark where my logic goes wrong. I'm
> > just explaining how I've deduced the whole thing.
> >
> > The information was encoded in v38 version of the vDSO was exactly this:
> >
> > - On normal EEXIT, it got the value 0.
> > - Otherwise, it got the value 1.
> >
> > The leaf, then embdded to struct sgx_exception but essentially the same
> > field got the value from EAX, and the value that EAX had was only
> > written on exception path.
> >
> > Thus, I deduced that if you write $EEXIT to leaf on synchrous exit you
> > get the same information content, nothing gets overwritten. I.e. you
> > can make same conclusions as you would with those two struct fields.
>
> And then a third flavor comes along, e.g. Jethro's request interrupt case,
> and exit_reason can also return '2'. How do you handle that with only the
> leaf?
I'm listening. How was that handled before? I saw only '0' and '1'. Can
you bring some context on that? I did read the emails that were swapped
when the run structure was added but I'm not sure what is the exact
differentiator. Maybe I'm missing something.
/Jarkko
On Wed, Oct 07, 2020 at 12:39:27AM +0300, Jarkko Sakkinen wrote:
> On Mon, Oct 05, 2020 at 07:57:05PM -0700, Sean Christopherson wrote:
> > On Sat, Oct 03, 2020 at 07:50:56AM +0300, Jarkko Sakkinen wrote:
> > > + __u16 exception_vector;
> > > + __u16 exception_error_code;
> > > + __u64 exception_addr;
> > > + __u8 reserved[24];
> >
> > I also think it's a waste of space to bother with multiple reserved fields.
> > 24 bytes isn't so much that it guarantees we'll never run into problems in
> > the future. But I care far less about this than I do about exit_reason.
>
> For me the real problem is that there has not been "no brainer" basis
> for any size, so a one cache line worth of data is just something that
> makes sense, because would neither make much sense to have less.
>
> I'll throw an argument to have it a bit bigger amount of reserved space
> for future use.
>
> First, there is always some amount of unknown unknowns when it comes to
> run-time structures, given the evolution of microarchitectures. So yes,
> some more "state" might be needed in the future.
>
> Secondly, this is a bigger problem for the vDSO than it is for ioctl's
> because we can have only one. With ioctl's, in the absolute worst case,
> we can have a second version of the same ioctl.
>
> At least 256 bytes would be probably a good number, if we want to
> increase it. The reserved space zero validation that I implemented to
> this version probably does not add much to the overhead anyway.
>
> I'm not sure why care about one struct field more than making sure that
> the run-time structure can stand time.
So what I could do is to grow the reserved area and based on my response
explain this in the changelog message but I need to make sure that I got
the reasoning right behind the size.
/Jarkko
On Wed, Oct 07, 2020 at 03:22:36AM +0300, Jarkko Sakkinen wrote:
> On Tue, Oct 06, 2020 at 04:21:29PM -0700, Sean Christopherson wrote:
> > On Tue, Oct 06, 2020 at 08:28:19PM +0300, Jarkko Sakkinen wrote:
> > > On Tue, Oct 06, 2020 at 08:15:32AM -0700, Sean Christopherson wrote:
> > > > On Tue, Oct 06, 2020 at 10:30:16AM +0200, Jethro Beekman wrote:
> > > > > On 2020-10-06 04:57, Sean Christopherson wrote:
> > > > > > On Sat, Oct 03, 2020 at 07:50:56AM +0300, Jarkko Sakkinen wrote:
> > > > > >> +struct sgx_enclave_run {
> > > > > >> + __u64 tcs;
> > > > > >> + __u64 user_handler;
> > > > > >> + __u64 user_data;
> > > > > >> + __u32 leaf;
> > > > > >
> > > > > > I am still very strongly opposed to omitting exit_reason. It is not at all
> > > > > > difficult to imagine scenarios where 'leaf' alone is insufficient for the
> > > > > > caller or its handler to deduce why the CPU exited the enclave. E.g. see
> > > > > > Jethro's request for intercepting interrupts.
> > > > >
> > > > > Not entirely sure what this has to do with my request, I just expect to see
> > > > > leaf=ERESUME in this case, I think? E.g. as you would see in EAX when calling
> > > > > ENCLU.
> > > >
> > > > But how would you differentiate from the case that an exception occured in
> > > > the enclave? That will also transfer control with leaf=ERESUME. If there
> > > > was a prior exception and userspace didn't zero out the struct, there would
> > > > be "valid" data in the exception fields.
> > > >
> > > > An exit_reason also would allow retrofitting the exception fields into a
> > > > union, i.e. the fields are valid if and only if exit_reason is exception.
> > >
> > > Let's purge this a bit. Please remark where my logic goes wrong. I'm
> > > just explaining how I've deduced the whole thing.
> > >
> > > The information was encoded in v38 version of the vDSO was exactly this:
> > >
> > > - On normal EEXIT, it got the value 0.
> > > - Otherwise, it got the value 1.
> > >
> > > The leaf, then embdded to struct sgx_exception but essentially the same
> > > field got the value from EAX, and the value that EAX had was only
> > > written on exception path.
> > >
> > > Thus, I deduced that if you write $EEXIT to leaf on synchrous exit you
> > > get the same information content, nothing gets overwritten. I.e. you
> > > can make same conclusions as you would with those two struct fields.
> >
> > And then a third flavor comes along, e.g. Jethro's request interrupt case,
> > and exit_reason can also return '2'. How do you handle that with only the
> > leaf?
>
> I'm listening. How was that handled before? I saw only '0' and '1'. Can
> you bring some context on that? I did read the emails that were swapped
> when the run structure was added but I'm not sure what is the exact
> differentiator. Maybe I'm missing something.
https://patchwork.kernel.org/patch/11719889/
On Tue, Oct 06, 2020 at 06:17:38PM -0700, Sean Christopherson wrote:
> On Wed, Oct 07, 2020 at 03:22:36AM +0300, Jarkko Sakkinen wrote:
> > On Tue, Oct 06, 2020 at 04:21:29PM -0700, Sean Christopherson wrote:
> > > On Tue, Oct 06, 2020 at 08:28:19PM +0300, Jarkko Sakkinen wrote:
> > > > On Tue, Oct 06, 2020 at 08:15:32AM -0700, Sean Christopherson wrote:
> > > > > On Tue, Oct 06, 2020 at 10:30:16AM +0200, Jethro Beekman wrote:
> > > > > > On 2020-10-06 04:57, Sean Christopherson wrote:
> > > > > > > On Sat, Oct 03, 2020 at 07:50:56AM +0300, Jarkko Sakkinen wrote:
> > > > > > >> +struct sgx_enclave_run {
> > > > > > >> + __u64 tcs;
> > > > > > >> + __u64 user_handler;
> > > > > > >> + __u64 user_data;
> > > > > > >> + __u32 leaf;
> > > > > > >
> > > > > > > I am still very strongly opposed to omitting exit_reason. It is not at all
> > > > > > > difficult to imagine scenarios where 'leaf' alone is insufficient for the
> > > > > > > caller or its handler to deduce why the CPU exited the enclave. E.g. see
> > > > > > > Jethro's request for intercepting interrupts.
> > > > > >
> > > > > > Not entirely sure what this has to do with my request, I just expect to see
> > > > > > leaf=ERESUME in this case, I think? E.g. as you would see in EAX when calling
> > > > > > ENCLU.
> > > > >
> > > > > But how would you differentiate from the case that an exception occured in
> > > > > the enclave? That will also transfer control with leaf=ERESUME. If there
> > > > > was a prior exception and userspace didn't zero out the struct, there would
> > > > > be "valid" data in the exception fields.
> > > > >
> > > > > An exit_reason also would allow retrofitting the exception fields into a
> > > > > union, i.e. the fields are valid if and only if exit_reason is exception.
> > > >
> > > > Let's purge this a bit. Please remark where my logic goes wrong. I'm
> > > > just explaining how I've deduced the whole thing.
> > > >
> > > > The information was encoded in v38 version of the vDSO was exactly this:
> > > >
> > > > - On normal EEXIT, it got the value 0.
> > > > - Otherwise, it got the value 1.
> > > >
> > > > The leaf, then embdded to struct sgx_exception but essentially the same
> > > > field got the value from EAX, and the value that EAX had was only
> > > > written on exception path.
> > > >
> > > > Thus, I deduced that if you write $EEXIT to leaf on synchrous exit you
> > > > get the same information content, nothing gets overwritten. I.e. you
> > > > can make same conclusions as you would with those two struct fields.
> > >
> > > And then a third flavor comes along, e.g. Jethro's request interrupt case,
> > > and exit_reason can also return '2'. How do you handle that with only the
> > > leaf?
> >
> > I'm listening. How was that handled before? I saw only '0' and '1'. Can
> > you bring some context on that? I did read the emails that were swapped
> > when the run structure was added but I'm not sure what is the exact
> > differentiator. Maybe I'm missing something.
>
> https://patchwork.kernel.org/patch/11719889/
Thank you.
There's aboslutely nothing that is blocking adding such support for such
AEP handling in the current implementation. SGX_SYNCHRONOUS_EXIT is just
another name for EEXIT. Even if that was in place, you'd need to
separate normal and interrupt. Tristate is useless here. As far as I'm
concerned, no bottlenecks have been created.
/Jarkko
On Wed, Oct 07, 2020 at 06:14:02AM +0300, Jarkko Sakkinen wrote:
> On Tue, Oct 06, 2020 at 06:17:38PM -0700, Sean Christopherson wrote:
> > On Wed, Oct 07, 2020 at 03:22:36AM +0300, Jarkko Sakkinen wrote:
> > > > And then a third flavor comes along, e.g. Jethro's request interrupt case,
> > > > and exit_reason can also return '2'. How do you handle that with only the
> > > > leaf?
> > >
> > > I'm listening. How was that handled before? I saw only '0' and '1'. Can
> > > you bring some context on that? I did read the emails that were swapped
> > > when the run structure was added but I'm not sure what is the exact
> > > differentiator. Maybe I'm missing something.
> >
> > https://patchwork.kernel.org/patch/11719889/
>
> Thank you.
>
> There's aboslutely nothing that is blocking adding such support for such
> AEP handling in the current implementation. SGX_SYNCHRONOUS_EXIT is just
> another name for EEXIT.
Sure. And SGX_EXCEPTION_EXIT is just another name for EENTER|ERESUME.
> Even if that was in place, you'd need to separate normal and interrupt.
> Tristate is useless here.
Huh? You mean like adding SGX_INTERRUPT_EXIT and SGX_EXCEPTION_EXIT?
> As far as I'm concerned, no bottlenecks have been created.
There's no bottleneck, just an inflexible and kludgy API for userspace.
if (run->leaf == EEXIT)
return handle_eexit();
if (run->leaf == EENTER || run->leaf == ERESUME)
return handle_exception(run->leaf);
return -EIO;
Let's say we come up with a clever opt-in scheme that allows exception fixup
to inform the vDSO that the enclave was invalid, even on SGX1. Now we're in
a scenario where we want to tell userspace that the enclave is lost, but
userspace assumes any exit EENTER or ERESUME is an exception.
if (run->leaf == EEXIT)
return handle_eexit();
if (run->leaf == EENTER || run->leaf == ERESUME)
return handle_invalid_enclave_or_maybe_exception();
return -EIO;
We could add a new exit reason, but we'd still need to ensure EENTER|ERESUME
means "exception" for old userspace. Or we could add exit_reason now and end
up with (IMO) a sane and extensible interface.
if (run->exit_reason == SGX_ENCLAVE_INVALID)
return handle_invalid_enclave();
if (run->exit_reason == SGX_SYNCHRONOUS_EXIT)
return handle_eexit();
if (run->exit_reason == SGX_EXCEPTION)
return handle_exception();
return -EIO;
And maybe we get really clever and figure out a way to (deterministically)
redirect SIGALRM to the vDSO. Then we'd want:
if (run->exit_reason == SGX_ENCLAVE_INVALID)
return handle_invalid_enclave();
if (run->exit_reason == SGX_SYNCHRONOUS_EXIT)
return handle_eexit();
if (run->exit_reason == SGX_ALARM)
return handle_reschedule();
if (run->exit_reason == SGX_EXCEPTION)
return handle_exception();
return -EIO;
Even more hypothetical would be if Andy gets one of his wishes, and EENTER2
comes along that doesn't allow the enclave to dictate the exit point,
"returns" an error code on enclave failure, and allows the kernel to
auto-restart the enclave on IRQs/NMIs. That (very hypothetical) scenario
fits nicely into the exit_reason handling.
I'm not arguing that any of the above is even remotely likely. I just don't
understand why we'd want an API that at best requires heuristics in userspace
to determine why the enclave stopped running, and at worst will saddle us with
an ugly mess in the future. All to save 4 bytes that no one cares about (they
literally cost nothing), and a single MOV in a flow that is hundreds, if not
thousands, of cycles.
On Tue, Oct 06, 2020 at 09:34:19PM -0700, Sean Christopherson wrote:
> On Wed, Oct 07, 2020 at 06:14:02AM +0300, Jarkko Sakkinen wrote:
> > On Tue, Oct 06, 2020 at 06:17:38PM -0700, Sean Christopherson wrote:
> > > On Wed, Oct 07, 2020 at 03:22:36AM +0300, Jarkko Sakkinen wrote:
> > > > > And then a third flavor comes along, e.g. Jethro's request interrupt case,
> > > > > and exit_reason can also return '2'. How do you handle that with only the
> > > > > leaf?
> > > >
> > > > I'm listening. How was that handled before? I saw only '0' and '1'. Can
> > > > you bring some context on that? I did read the emails that were swapped
> > > > when the run structure was added but I'm not sure what is the exact
> > > > differentiator. Maybe I'm missing something.
> > >
> > > https://patchwork.kernel.org/patch/11719889/
> >
> > Thank you.
> >
> > There's aboslutely nothing that is blocking adding such support for such
> > AEP handling in the current implementation. SGX_SYNCHRONOUS_EXIT is just
> > another name for EEXIT.
>
> Sure. And SGX_EXCEPTION_EXIT is just another name for EENTER|ERESUME.
Kind of yes.
> > Even if that was in place, you'd need to separate normal and interrupt.
> > Tristate is useless here.
>
> Huh? You mean like adding SGX_INTERRUPT_EXIT and SGX_EXCEPTION_EXIT?
OK, so I'll throw something.
1. "normal" is either exception from either EENTER or ERESUME,
or just EEXIT.
2. "interrupt" is something where you want to tailor AEP path.
> > As far as I'm concerned, no bottlenecks have been created.
>
> There's no bottleneck, just an inflexible and kludgy API for userspace.
>
> if (run->leaf == EEXIT)
> return handle_eexit();
>
> if (run->leaf == EENTER || run->leaf == ERESUME)
> return handle_exception(run->leaf);
>
> return -EIO;
I think that's quite intuitive to have just one state variable.
> Let's say we come up with a clever opt-in scheme that allows exception fixup
> to inform the vDSO that the enclave was invalid, even on SGX1. Now we're in
> a scenario where we want to tell userspace that the enclave is lost, but
> userspace assumes any exit EENTER or ERESUME is an exception.
>
> if (run->leaf == EEXIT)
> return handle_eexit();
>
> if (run->leaf == EENTER || run->leaf == ERESUME)
> return handle_invalid_enclave_or_maybe_exception();
>
> return -EIO;
What I'd do would be to add a 'flags' field.
It could have a bit for interrupt, let's call it for the sake of an
example as SGX_ENCLAVE_RUN_FLAG_INT.
Then you'd do this if you want to exit from the vDSO instead of doing
ERESUME:
run->flags |= SGX_ENCLAVE_RUN_FLAG_INT
The vDSO would check this bit on AEP and:
1. If it's cleared, it would ERESUME.
2. If it's set, it would clear it and exit from vDSO.
> We could add a new exit reason, but we'd still need to ensure EENTER|ERESUME
> means "exception" for old userspace. Or we could add exit_reason now and end
> up with (IMO) a sane and extensible interface.
>
> if (run->exit_reason == SGX_ENCLAVE_INVALID)
> return handle_invalid_enclave();
>
> if (run->exit_reason == SGX_SYNCHRONOUS_EXIT)
> return handle_eexit();
>
> if (run->exit_reason == SGX_EXCEPTION)
> return handle_exception();
>
> return -EIO;
>
> And maybe we get really clever and figure out a way to (deterministically)
> redirect SIGALRM to the vDSO. Then we'd want:
>
> if (run->exit_reason == SGX_ENCLAVE_INVALID)
> return handle_invalid_enclave();
>
> if (run->exit_reason == SGX_SYNCHRONOUS_EXIT)
> return handle_eexit();
>
> if (run->exit_reason == SGX_ALARM)
> return handle_reschedule();
>
> if (run->exit_reason == SGX_EXCEPTION)
> return handle_exception();
>
> return -EIO;
>
> Even more hypothetical would be if Andy gets one of his wishes, and EENTER2
> comes along that doesn't allow the enclave to dictate the exit point,
> "returns" an error code on enclave failure, and allows the kernel to
> auto-restart the enclave on IRQs/NMIs. That (very hypothetical) scenario
> fits nicely into the exit_reason handling.
>
> I'm not arguing that any of the above is even remotely likely. I just don't
> understand why we'd want an API that at best requires heuristics in userspace
> to determine why the enclave stopped running, and at worst will saddle us with
> an ugly mess in the future. All to save 4 bytes that no one cares about (they
> literally cost nothing), and a single MOV in a flow that is hundreds, if not
> thousands, of cycles.
I don't care as much as saving bytes as defining API, which has zero
ambiguous state variables.
And since the field 'leaf' is there, and was before too, no degrees of
freedom are lost. Removing one variable does not make more of a mess.
/Jarkko
On Wed, Oct 07, 2020 at 10:39:23AM +0300, Jarkko Sakkinen wrote:
> On Tue, Oct 06, 2020 at 09:34:19PM -0700, Sean Christopherson wrote:
> > Even more hypothetical would be if Andy gets one of his wishes, and EENTER2
> > comes along that doesn't allow the enclave to dictate the exit point,
> > "returns" an error code on enclave failure, and allows the kernel to
> > auto-restart the enclave on IRQs/NMIs. That (very hypothetical) scenario
> > fits nicely into the exit_reason handling.
> >
> > I'm not arguing that any of the above is even remotely likely. I just don't
> > understand why we'd want an API that at best requires heuristics in userspace
> > to determine why the enclave stopped running, and at worst will saddle us with
> > an ugly mess in the future. All to save 4 bytes that no one cares about (they
> > literally cost nothing), and a single MOV in a flow that is hundreds, if not
> > thousands, of cycles.
>
> I don't care as much as saving bytes as defining API, which has zero
> ambiguous state variables.
>
> And since the field 'leaf' is there, and was before too, no degrees of
> freedom are lost. Removing one variable does not make more of a mess.
I think the reserved space should be expanded though.
I'd go with that 256 bytes as it was before. It's still fast to validate
and the loop construct for that is already in place. I complement that
with addition to the changelog with the reasoning that I gave earlier.
That was lacking for that detail in earlier patch set versions.
/Jarkko
On Wed, Oct 07, 2020 at 10:39:23AM +0300, Jarkko Sakkinen wrote:
> On Tue, Oct 06, 2020 at 09:34:19PM -0700, Sean Christopherson wrote:
> > > Even if that was in place, you'd need to separate normal and interrupt.
> > > Tristate is useless here.
> >
> > Huh? You mean like adding SGX_INTERRUPT_EXIT and SGX_EXCEPTION_EXIT?
>
> OK, so I'll throw something.
>
> 1. "normal" is either exception from either EENTER or ERESUME,
> or just EEXIT.
> 2. "interrupt" is something where you want to tailor AEP path.
Manipulating the behavior of the vDSO, as in #2, would be done via an input
flag. It may be related to the exit reason, e.g. the flag may also opt-in to
a new exit reason, but that has no bearing on whether or not a dedicated exit
reason is valuable.
> > I'm not arguing that any of the above is even remotely likely. I just don't
> > understand why we'd want an API that at best requires heuristics in userspace
> > to determine why the enclave stopped running, and at worst will saddle us with
> > an ugly mess in the future. All to save 4 bytes that no one cares about (they
> > literally cost nothing), and a single MOV in a flow that is hundreds, if not
> > thousands, of cycles.
>
> I don't care as much as saving bytes as defining API, which has zero
> ambiguous state variables.
How is exit_reason ambiguous?
On Wed, Oct 07, 2020 at 08:08:32PM +0300, Jarkko Sakkinen wrote:
> On Wed, Oct 07, 2020 at 08:25:45AM -0700, Sean Christopherson wrote:
> > On Wed, Oct 07, 2020 at 10:39:23AM +0300, Jarkko Sakkinen wrote:
> > > On Tue, Oct 06, 2020 at 09:34:19PM -0700, Sean Christopherson wrote:
> > > > > Even if that was in place, you'd need to separate normal and interrupt.
> > > > > Tristate is useless here.
> > > >
> > > > Huh? You mean like adding SGX_INTERRUPT_EXIT and SGX_EXCEPTION_EXIT?
> > >
> > > OK, so I'll throw something.
> > >
> > > 1. "normal" is either exception from either EENTER or ERESUME,
> > > or just EEXIT.
> > > 2. "interrupt" is something where you want to tailor AEP path.
> >
> > Manipulating the behavior of the vDSO, as in #2, would be done via an input
> > flag. It may be related to the exit reason, e.g. the flag may also opt-in to
> > a new exit reason, but that has no bearing on whether or not a dedicated exit
> > reason is valuable.
>
> The fact is that AEP path is not actual right now.
>
> I'm not even interested to go further on discussing about feature that
> does not exist. Perhaps if/when it exist it turns out that we want a
> variable lets say 'exit_reason' to present something in that context.
>
> I'm neither against that or for it because it is all speculative.
>
> > > > I'm not arguing that any of the above is even remotely likely. I just don't
> > > > understand why we'd want an API that at best requires heuristics in userspace
> > > > to determine why the enclave stopped running, and at worst will saddle us with
> > > > an ugly mess in the future. All to save 4 bytes that no one cares about (they
> > > > literally cost nothing), and a single MOV in a flow that is hundreds, if not
> > > > thousands, of cycles.
> > >
> > > I don't care as much as saving bytes as defining API, which has zero
> > > ambiguous state variables.
> >
> > How is exit_reason ambiguous?
>
> I rather pick the word redundant:
>
> 1. 'leaf' exist anyway.
> 2. It can represent all the state we need right now.
> 3. It does not block anything.,
>
> I care deeply about wasting 4 bytes in a fixed size struct for
> absolutely nothing.
And I do care about what to pick for the struct size. My remarks on
that are lost somewhere in this thread. I absoutely do not have any
interest whether 'exit_reason' in some future situation is useful
or not.
/Jarkko
On Mon, Oct 05, 2020 at 01:39:21AM +0300, Jarkko Sakkinen wrote:
> On Sat, Oct 03, 2020 at 01:23:49PM -0500, Haitao Huang wrote:
> > On Sat, 03 Oct 2020 08:32:45 -0500, Jarkko Sakkinen
> > <[email protected]> wrote:
> >
> > > On Sat, Oct 03, 2020 at 12:22:47AM -0500, Haitao Huang wrote:
> > > > When I turn on CONFIG_PROVE_LOCKING, kernel reports following
> > > > suspicious RCU
> > > > usages. Not sure if it is an issue. Just reporting here:
> > >
> > > I'm glad to hear that my tip helped you to get us the data.
> > >
> > > This does not look like an issue in the page reclaimer, which was not
> > > obvious for me before. That's a good thing. I was really worried about
> > > that because it has been very stable for a long period now. The last
> > > bug fix for the reclaimer was done in June in v31 version of the patch
> > > set and after that it has been unchanged (except possibly some renames
> > > requested by Boris).
> > >
> > > I wildly guess I have a bad usage pattern for xarray. I migrated to it
> > > in v36, and it is entirely possible that I've misused it. It was the
> > > first time that I ever used it. Before xarray we had radix_tree but
> > > based Matthew Wilcox feedback I did a migration to xarray.
> > >
> > > What I'd ask you to do next is to, if by any means possible, to try to
> > > run the same test with v35 so we can verify this. That one still has
> > > the radix tree.
> > >
> >
> >
> > v35 does not cause any such warning messages from kernel
>
> Thank you. Looks like Matthew already located the issue, a fix will
> land soon.
Just acknowledging that this should be fixed in my master branch now.
/Jarkko
On Wed, Oct 07, 2020 at 08:25:45AM -0700, Sean Christopherson wrote:
> On Wed, Oct 07, 2020 at 10:39:23AM +0300, Jarkko Sakkinen wrote:
> > On Tue, Oct 06, 2020 at 09:34:19PM -0700, Sean Christopherson wrote:
> > > > Even if that was in place, you'd need to separate normal and interrupt.
> > > > Tristate is useless here.
> > >
> > > Huh? You mean like adding SGX_INTERRUPT_EXIT and SGX_EXCEPTION_EXIT?
> >
> > OK, so I'll throw something.
> >
> > 1. "normal" is either exception from either EENTER or ERESUME,
> > or just EEXIT.
> > 2. "interrupt" is something where you want to tailor AEP path.
>
> Manipulating the behavior of the vDSO, as in #2, would be done via an input
> flag. It may be related to the exit reason, e.g. the flag may also opt-in to
> a new exit reason, but that has no bearing on whether or not a dedicated exit
> reason is valuable.
The fact is that AEP path is not actual right now.
I'm not even interested to go further on discussing about feature that
does not exist. Perhaps if/when it exist it turns out that we want a
variable lets say 'exit_reason' to present something in that context.
I'm neither against that or for it because it is all speculative.
> > > I'm not arguing that any of the above is even remotely likely. I just don't
> > > understand why we'd want an API that at best requires heuristics in userspace
> > > to determine why the enclave stopped running, and at worst will saddle us with
> > > an ugly mess in the future. All to save 4 bytes that no one cares about (they
> > > literally cost nothing), and a single MOV in a flow that is hundreds, if not
> > > thousands, of cycles.
> >
> > I don't care as much as saving bytes as defining API, which has zero
> > ambiguous state variables.
>
> How is exit_reason ambiguous?
I rather pick the word redundant:
1. 'leaf' exist anyway.
2. It can represent all the state we need right now.
3. It does not block anything.,
I care deeply about wasting 4 bytes in a fixed size struct for
absolutely nothing.
/Jarkko
On Mon, 05 Oct 2020 07:42:21 -0500, Jarkko Sakkinen
<[email protected]> wrote:
> On Mon, Oct 05, 2020 at 11:42:46AM +0200, Greg KH wrote:
>> > > You use gpl-only header files in this file, so how in the world can
>> it
>> > > be bsd-3 licensed?
>> > >
>> > > Please get your legal department to agree with this, after you
>> explain
>> > > to them how you are mixing gpl2-only code in with this file.
>> >
>> > I'll do what I already stated that I will do. Should I do something
>> > more?
>>
>> This was written before your previous response.
>
> OK, that is weird, I got this one some time later.
>
>> > > > + mutex_lock(&encl->lock);
>> > > > + atomic_or(SGX_ENCL_DEAD, &encl->flags);
>> > >
>> > > So you set a flag that this is dead, and then instantly delete it?
>> Why
>> > > does that matter? I see you check for this flag elsewhere, but as
>> you
>> > > are just about to delete this structure, how can this be an issue?
>> >
>> > It matters because ksgxswapd (sgx_reclaimer_*) might be processing it.
>>
>> I don't see that happening in this patch, did I miss it?
>
> It's implemented in 16/24:
>
> https://lore.kernel.org/linux-sgx/[email protected]/T/#u
>
>> > It will use the flag to skip the operations that it would do to a
>> victim
>> > page, when the enclave is still alive.
>>
>> Again, why are you adding flags when the patch does not use them?
>> Please put new functionality in the specific patch that uses it.
>>
>> And can you really rely on this? How did sgx_reclaimer_* (whatever that
>> is), get the reference on this object in the first place? Again, I
>> don't see that happening at all in here, and at a quick glance in the
>> other patches I don't see it there either. What am I missing?
>
> I went through the patch, and yes, they can be migrated to 16/24.
> I agree with this, no excuses.
>
> In 16/24 pages are added to sgx_active_page_list from which they are
> swapped by the reclaimer to the main memory when Enclave Page Cache
> (EPC), the memory where enclave pages reside, gets full.
>
> When a reclaimer thread takes a victim page from that list, it will also
> get a kref to the enclave so that struct sgx_encl instance does not
> get wiped while it's doing its job.
>
>> > Because ksgxswapd needs the alive enclave instance while it is in the
>> > process of swapping a victim page. The reason for this is the
>> > hierarchical nature of the enclave pages.
>> >
>> > As an example, a write operation to main memory, EWB (SDM vol 3D
>> 40-79)
>>
>> What is that referencing?
>
> https://software.intel.com/content/dam/develop/public/us/en/documents/332831-sdm-vol-3d.pdf
>
>> > needs to access SGX Enclave Control Structure (SECS) page, which is
>> > contains global data for an enclave, like the unswapped child count.
>>
>> Ok, but how did it get access to this structure in the first place, like
>> I ask above?
>
> I guess I answered that, and I also fully agree with your suggestions.
>
> It used to be many iterations ago that enclaves were not file based but
> just memory mappings (long story short: was not great way to make them
> multiprocess, that's why file centered now), and then refcount played a
> bigger role. Having those "extras" in this patch is by no means
> intentional but more like cruft of many iterations of refactoring.
>
> Sometimes when you work long with this kind of pile of code, which has
> converged through many iterations, you really need someone else to point
> some of the simple and obvious things out.
>
>> > There is a patch that adds "sgx/provision".
>>
>> What number in this series?
>
> It's 15/24.
>
Don't know if this is critical. I'd prefer to keep them as is. Directory
seems natural to me and makes sense to add more under the same dir in case
there are more to come.
Thanks
Haitao
On Wed, Oct 07, 2020 at 01:09:01PM -0500, Haitao Huang wrote:
> > > > There is a patch that adds "sgx/provision".
> > >
> > > What number in this series?
> >
> > It's 15/24.
> >
>
> Don't know if this is critical. I'd prefer to keep them as is. Directory
> seems natural to me and makes sense to add more under the same dir in case
> there are more to come.
Why is this so special that you need a subdirectory for a single driver
with a mere 2 device nodes? Do any other misc drivers have a new
subdirectory in /dev/ for them?
thanks,
greg k-h
On Wed, Oct 07, 2020 at 09:26:55PM +0200, Greg KH wrote:
> On Wed, Oct 07, 2020 at 01:09:01PM -0500, Haitao Huang wrote:
> > > > > There is a patch that adds "sgx/provision".
> > > >
> > > > What number in this series?
> > >
> > > It's 15/24.
> > >
> >
> > Don't know if this is critical. I'd prefer to keep them as is. Directory
> > seems natural to me and makes sense to add more under the same dir in case
> > there are more to come.
>
> Why is this so special that you need a subdirectory for a single driver
> with a mere 2 device nodes? Do any other misc drivers have a new
> subdirectory in /dev/ for them?
Absolutely nothing as far as I'm concerned. Should have done that
already at the time when I switched to misc based on your feedback. I
was acting too reactive I guess. For sure I'll rename.
I also looked at encl->refcount with time. Instead of just "moving the
garbage up to the correct waste pit", I'll address that one by
refactoring it out and making the reclaimer thread to do the reaper's
job.
> thanks,
>
> greg k-h
/Jarkko
Hi!
> > new file mode 100644
> > index 000000000000..f54da5f19c2b
> > --- /dev/null
> > +++ b/arch/x86/kernel/cpu/sgx/driver.c
> > @@ -0,0 +1,173 @@
> > +// SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause)
>
> You use gpl-only header files in this file, so how in the world can it
> be bsd-3 licensed?
>
> Please get your legal department to agree with this, after you explain
> to them how you are mixing gpl2-only code in with this file.
This specifies license of driver.c, not of the headers included. Are
you saying that it is impossible to have a kernel driver with anything
else than GPL-2? That would be news to many, and that's not what
current consensus is.
Pavel
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
On Fri 2020-10-09 09:21:41, Greg KH wrote:
> On Fri, Oct 09, 2020 at 09:10:45AM +0200, Pavel Machek wrote:
> > Hi!
> >
> > > > new file mode 100644
> > > > index 000000000000..f54da5f19c2b
> > > > --- /dev/null
> > > > +++ b/arch/x86/kernel/cpu/sgx/driver.c
> > > > @@ -0,0 +1,173 @@
> > > > +// SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause)
> > >
> > > You use gpl-only header files in this file, so how in the world can it
> > > be bsd-3 licensed?
> > >
> > > Please get your legal department to agree with this, after you explain
> > > to them how you are mixing gpl2-only code in with this file.
> >
> > This specifies license of driver.c, not of the headers included. Are
> > you saying that it is impossible to have a kernel driver with anything
> > else than GPL-2? That would be news to many, and that's not what
> > current consensus is.
>
> If you want to write any non-GPL-2-only kernel code, you had better be
> consulting your lawyers and get very explicit instructions on how to do
> this in a way that does not violate any licenses.
>
> I am not a lawyer, and will not be giving you any such advice, as I
> think it's not something that people should be doing.
You are pushing view that is well outside accepted community
consensus, then try to hide it by claiming that you are not a lawyer.
Stop it.
Dual licensed drivers are common in the kernel, and are considered
okay by everyone but you. Author is free to select license for his
work.
Pavel
--
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
On Fri, Oct 09, 2020 at 09:10:45AM +0200, Pavel Machek wrote:
> Hi!
>
> > > new file mode 100644
> > > index 000000000000..f54da5f19c2b
> > > --- /dev/null
> > > +++ b/arch/x86/kernel/cpu/sgx/driver.c
> > > @@ -0,0 +1,173 @@
> > > +// SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause)
> >
> > You use gpl-only header files in this file, so how in the world can it
> > be bsd-3 licensed?
> >
> > Please get your legal department to agree with this, after you explain
> > to them how you are mixing gpl2-only code in with this file.
>
> This specifies license of driver.c, not of the headers included. Are
> you saying that it is impossible to have a kernel driver with anything
> else than GPL-2? That would be news to many, and that's not what
> current consensus is.
If you want to write any non-GPL-2-only kernel code, you had better be
consulting your lawyers and get very explicit instructions on how to do
this in a way that does not violate any licenses.
I am not a lawyer, and will not be giving you any such advice, as I
think it's not something that people should be doing.
greg k-h
On Sat, Oct 03, 2020 at 07:50:57AM +0300, Jarkko Sakkinen wrote:
> Add a selftest for SGX. It is a trivial test where a simple enclave
> copies one 64-bit word of memory between two memory locations.
>
> Cc: Shuah Khan <[email protected]>
> Cc: [email protected]
> Signed-off-by: Jarkko Sakkinen <[email protected]>
Greg, speaking of dual licensing, I'd make an expection with this
selftest to what we agreed in the last week.
It's the only compact C-only example that I'm aware of that shows how to
put together the basics of an SGX user space. Here a more permissive
licensing would make sense in my opinion just to give a seed for
alternatives.
Right now the user space implementations are either in C++ and Rust, and
they work great for big things like containers etc. I could envision
someone to have something more minimalistic to do something simple for
lets say a system daemon.
I've done a similar decision with tools/testing/selftests/tpm2/tpm2.py
in the past.
What do you think?
/Jarkko
On 10/8/20 11:44 PM, Jarkko Sakkinen wrote:
>> Why is this so special that you need a subdirectory for a single driver
>> with a mere 2 device nodes? Do any other misc drivers have a new
>> subdirectory in /dev/ for them?
> Absolutely nothing as far as I'm concerned. Should have done that
> already at the time when I switched to misc based on your feedback. I
> was acting too reactive I guess. For sure I'll rename.
Plus, if anyone *REALLY* cares, they can get their precious directory
back with a couple of lines of udev rules, I believe:
KERNEL=="sgx_provision", SYMLINK+="sgx/provision"
KERNEL=="sgx_enclave", SYMLINK+="sgx/enclave"
On 10/2/20 9:50 PM, Jarkko Sakkinen wrote:
...
> You can tell if your CPU supports SGX by looking into /proc/cpuinfo:
>
> cat /proc/cpuinfo | grep sgx
This is only true *after* applying this series, right?
> +static u32 sgx_calc_ssa_frame_size(u32 miscselect, u64 xfrm)
> +{
> + u32 size_max = PAGE_SIZE;
> + u32 size;
> + int i;
> +
> + for (i = 2; i < 64; i++) {
Should this be:
for (i = XFEATURE_YMM; i < XFEATURE_MAX; i++) {
Basically, does this need to be 64, or should it be limited to the
kernel-known XFEATURES? Or, should this be looping through all the bits
set in xfeatures_mask_user().
> + if (!((1 << i) & xfrm))
> + continue;
> +
> + size = SGX_SSA_GPRS_SIZE + sgx_xsave_size_tbl[i];
> +
> + if (miscselect & SGX_MISC_EXINFO)
> + size += SGX_SSA_MISC_EXINFO_SIZE;
> +
> + if (size > size_max)
> + size_max = size;
> + }
> +
> + return PFN_UP(size_max);
> +}
> +
> +static int sgx_validate_secs(const struct sgx_secs *secs)
> +{
What's the overall point of this function? Does it avoid a #GP from an
instruction later?
Does all of the 'secs' content come from userspace?
> + u64 max_size = (secs->attributes & SGX_ATTR_MODE64BIT) ?
> + sgx_encl_size_max_64 : sgx_encl_size_max_32;
> +
> + if (secs->size < (2 * PAGE_SIZE) || !is_power_of_2(secs->size))
> + return -EINVAL;
> +
> + if (secs->base & (secs->size - 1))
> + return -EINVAL;
> +
> + if (secs->miscselect & sgx_misc_reserved_mask ||
> + secs->attributes & sgx_attributes_reserved_mask ||
> + secs->xfrm & sgx_xfrm_reserved_mask)
> + return -EINVAL;
> +
> + if (secs->size > max_size)
> + return -EINVAL;
> +
> + if (!(secs->xfrm & XFEATURE_MASK_FP) ||
> + !(secs->xfrm & XFEATURE_MASK_SSE) ||
> + (((secs->xfrm >> XFEATURE_BNDREGS) & 1) != ((secs->xfrm >> XFEATURE_BNDCSR) & 1)))
> + return -EINVAL;
> +
> + if (!secs->ssa_frame_size)
> + return -EINVAL;
> +
> + if (sgx_calc_ssa_frame_size(secs->miscselect, secs->xfrm) > secs->ssa_frame_size)
> + return -EINVAL;
> +
> + if (memchr_inv(secs->reserved1, 0, sizeof(secs->reserved1)) ||
> + memchr_inv(secs->reserved2, 0, sizeof(secs->reserved2)) ||
> + memchr_inv(secs->reserved3, 0, sizeof(secs->reserved3)) ||
> + memchr_inv(secs->reserved4, 0, sizeof(secs->reserved4)))
> + return -EINVAL;
> +
> + return 0;
> +}
I think it would be nice to at least have one comment per condition to
explain what's going on there.
> +static int sgx_encl_create(struct sgx_encl *encl, struct sgx_secs *secs)
> +{
> + struct sgx_epc_page *secs_epc;
> + struct sgx_pageinfo pginfo;
> + struct sgx_secinfo secinfo;
> + unsigned long encl_size;
> + struct file *backing;
> + long ret;
> +
> + if (sgx_validate_secs(secs)) {
> + pr_debug("invalid SECS\n");
> + return -EINVAL;
> + }
> +
> + /* The extra page goes to SECS. */
> + encl_size = secs->size + PAGE_SIZE;
> +
> + backing = shmem_file_setup("SGX backing", encl_size + (encl_size >> 5),
> + VM_NORESERVE);
What's the >>5 adjustment for?
> + if (IS_ERR(backing))
> + return PTR_ERR(backing);
> +
> + encl->backing = backing;
> +
> + secs_epc = __sgx_alloc_epc_page();
> + if (IS_ERR(secs_epc)) {
> + ret = PTR_ERR(secs_epc);
> + goto err_out_backing;
> + }
> +
> + encl->secs.epc_page = secs_epc;
> +
> + pginfo.addr = 0;
> + pginfo.contents = (unsigned long)secs;
> + pginfo.metadata = (unsigned long)&secinfo;
> + pginfo.secs = 0;
> + memset(&secinfo, 0, sizeof(secinfo));
> +
> + ret = __ecreate((void *)&pginfo, sgx_get_epc_addr(secs_epc));
> + if (ret) {
> + pr_debug("ECREATE returned %ld\n", ret);
> + goto err_out;
> + }
> +
> + if (secs->attributes & SGX_ATTR_DEBUG)
> + atomic_or(SGX_ENCL_DEBUG, &encl->flags);
> +
> + encl->secs.encl = encl;
> + encl->base = secs->base;
> + encl->size = secs->size;
> + encl->ssaframesize = secs->ssa_frame_size;
> +
> + /*
> + * Set SGX_ENCL_CREATED only after the enclave is fully prepped. This
> + * allows setting and checking enclave creation without having to take
> + * encl->lock.
> + */
> + atomic_or(SGX_ENCL_CREATED, &encl->flags);
I'm wondering what the impact of setting this flag is. That's hard to
figure out because the flag isn't documented.
It's also unusual to have atomic_or() used like this. The normal
set_bit()/clear_bit() that you can use on an unsigned long are actually
implemented as atomics.
I'm curious both why this needs to be atomics, *and* why the atomic_or()
interface is being used.
> + return 0;
> +
> +err_out:
> + sgx_free_epc_page(encl->secs.epc_page);
> + encl->secs.epc_page = NULL;
> +
> +err_out_backing:
> + fput(encl->backing);
> + encl->backing = NULL;
> +
> + return ret;
> +}
> +
> +/**
> + * sgx_ioc_enclave_create - handler for %SGX_IOC_ENCLAVE_CREATE
> + * @encl: an enclave pointer
> + * @arg: userspace pointer to a struct sgx_enclave_create instance
> + *
> + * Allocate kernel data structures for a new enclave and execute ECREATE after
> + * checking that the provided data for SECS meets the expectations of ECREATE
> + * for an uninitialized enclave and size of the address space does not surpass the
> + * platform expectations. This validation is done by sgx_validate_secs().
> + *
> + * Return:
> + * 0 on success,
> + * -errno otherwise
> + */
> +static long sgx_ioc_enclave_create(struct sgx_encl *encl, void __user *arg)
> +{
> + struct sgx_enclave_create ecreate;
> + struct page *secs_page;
> + struct sgx_secs *secs;
> + int ret;
> +
> + if (atomic_read(&encl->flags) & SGX_ENCL_CREATED)
> + return -EINVAL;
> +
> + if (copy_from_user(&ecreate, arg, sizeof(ecreate)))
> + return -EFAULT;
> +
> + secs_page = alloc_page(GFP_KERNEL);
> + if (!secs_page)
> + return -ENOMEM;
> +
> + secs = kmap(secs_page);
GFP_KERNEL pages are in low memory and don't need to be kmap()'d.
This can just be:
secs = __get_free_page(GFP_KERNEL);
if (copy_from_user(secs, (void __user *)ecreate.src,...
and forget about the kmapping. You also need to change __free_pages()
to free_pages().
The other alternative would be to just kmalloc() it. kmalloc()
guarantees alignment in a stronger way than it used to.
> + if (copy_from_user(secs, (void __user *)ecreate.src, sizeof(*secs))) {
> + ret = -EFAULT;
> + goto out;
> + }
> +
> + ret = sgx_encl_create(encl, secs);
> +
> +out:
> + kunmap(secs_page);
> + __free_page(secs_page);
> + return ret;
> +}
> +
> +long sgx_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
> +{
> + struct sgx_encl *encl = filep->private_data;
> + int ret, encl_flags;
> +
> + encl_flags = atomic_fetch_or(SGX_ENCL_IOCTL, &encl->flags);
> + if (encl_flags & SGX_ENCL_IOCTL)
> + return -EBUSY;
Is the SGX_ENCL_IOCTL bit essentially just a lock to single-thread
ioctl()s? Should we name it as such?
> + if (encl_flags & SGX_ENCL_DEAD) {
> + ret = -EFAULT;
> + goto out;
> + }
> +
> + switch (cmd) {
> + case SGX_IOC_ENCLAVE_CREATE:
> + ret = sgx_ioc_enclave_create(encl, (void __user *)arg);
> + break;
> + default:
> + ret = -ENOIOCTLCMD;
> + break;
> + }
> +
> +out:
> + atomic_andnot(SGX_ENCL_IOCTL, &encl->flags);
> + return ret;
> +}
>
On 10/2/20 9:50 PM, Jarkko Sakkinen wrote:
> +INTEL SGX
> +M: Jarkko Sakkinen <[email protected]>
> +M: Sean Christopherson <[email protected]>
> +L: [email protected]
> +S: Maintained
Should be Supported, not Maintained.
> +/**
> + * struct sgx_enclave_add_pages - parameter structure for the
> + * %SGX_IOC_ENCLAVE_ADD_PAGE ioctl
> + * @src: start address for the page data
> + * @offset: starting page offset
Is this the offset *within* the page? Might be nice to say that.
> + * @length: length of the data (multiple of the page size)
> + * @secinfo: address for the SECINFO data
> + * @flags: page control flags
> + * @count: number of bytes added (multiple of the page size)
> + */
> +struct sgx_enclave_add_pages {
> + __u64 src;
> + __u64 offset;
> + __u64 length;
> + __u64 secinfo;
> + __u64 flags;
> + __u64 count;
> +};
> +
> #endif /* _UAPI_ASM_X86_SGX_H */
> diff --git a/arch/x86/kernel/cpu/sgx/ioctl.c b/arch/x86/kernel/cpu/sgx/ioctl.c
> index 9bb4694e57c1..e13e04737683 100644
> --- a/arch/x86/kernel/cpu/sgx/ioctl.c
> +++ b/arch/x86/kernel/cpu/sgx/ioctl.c
> @@ -194,6 +194,302 @@ static long sgx_ioc_enclave_create(struct sgx_encl *encl, void __user *arg)
> return ret;
> }
>
> +static struct sgx_encl_page *sgx_encl_page_alloc(struct sgx_encl *encl,
> + unsigned long offset,
> + u64 secinfo_flags)
> +{
> + struct sgx_encl_page *encl_page;
> + unsigned long prot;
> +
> + encl_page = kzalloc(sizeof(*encl_page), GFP_KERNEL);
> + if (!encl_page)
> + return ERR_PTR(-ENOMEM);
> +
> + encl_page->desc = encl->base + offset;
> + encl_page->encl = encl;
Somewhere, we need an explanation of why we have 'sgx_epc_page' and
'sgx_encl_page'. I think they're 1:1 at least after
sgx_encl_page_alloc(), so I'm wondering why we need two.
> + prot = _calc_vm_trans(secinfo_flags, SGX_SECINFO_R, PROT_READ) |
> + _calc_vm_trans(secinfo_flags, SGX_SECINFO_W, PROT_WRITE) |
> + _calc_vm_trans(secinfo_flags, SGX_SECINFO_X, PROT_EXEC);
> +
> + /*
> + * TCS pages must always RW set for CPU access while the SECINFO
> + * permissions are *always* zero - the CPU ignores the user provided
> + * values and silently overwrites them with zero permissions.
> + */
> + if ((secinfo_flags & SGX_SECINFO_PAGE_TYPE_MASK) == SGX_SECINFO_TCS)
> + prot |= PROT_READ | PROT_WRITE;
> +
> + /* Calculate maximum of the VM flags for the page. */
> + encl_page->vm_max_prot_bits = calc_vm_prot_bits(prot, 0);
> +
> + return encl_page;
> +}
> +
> +static int sgx_validate_secinfo(struct sgx_secinfo *secinfo)
> +{
> + u64 perm = secinfo->flags & SGX_SECINFO_PERMISSION_MASK;
> + u64 pt = secinfo->flags & SGX_SECINFO_PAGE_TYPE_MASK;
I'd align the ='s up there ^^
> +
> + if (pt != SGX_SECINFO_REG && pt != SGX_SECINFO_TCS)
> + return -EINVAL;
> +
> + if ((perm & SGX_SECINFO_W) && !(perm & SGX_SECINFO_R))
> + return -EINVAL;
> +
> + /*
> + * CPU will silently overwrite the permissions as zero, which means
> + * that we need to validate it ourselves.
> + */
> + if (pt == SGX_SECINFO_TCS && perm)
> + return -EINVAL;
> +
> + if (secinfo->flags & SGX_SECINFO_RESERVED_MASK)
> + return -EINVAL;
> +
> + if (memchr_inv(secinfo->reserved, 0, sizeof(secinfo->reserved)))
> + return -EINVAL;
> +
> + return 0;
> +}
> +
> +static int __sgx_encl_add_page(struct sgx_encl *encl,
> + struct sgx_encl_page *encl_page,
> + struct sgx_epc_page *epc_page,
> + struct sgx_secinfo *secinfo, unsigned long src)
> +{
> + struct sgx_pageinfo pginfo;
> + struct vm_area_struct *vma;
> + struct page *src_page;
> + int ret;
> +
> + /* Deny noexec. */
> + vma = find_vma(current->mm, src);
> + if (!vma)
> + return -EFAULT;
> +
> + if (!(vma->vm_flags & VM_MAYEXEC))
> + return -EACCES;
> +
> + ret = get_user_pages(src, 1, 0, &src_page, NULL);
> + if (ret < 1)
> + return -EFAULT;
> +
> + pginfo.secs = (unsigned long)sgx_get_epc_addr(encl->secs.epc_page);
> + pginfo.addr = SGX_ENCL_PAGE_ADDR(encl_page);
> + pginfo.metadata = (unsigned long)secinfo;
> + pginfo.contents = (unsigned long)kmap_atomic(src_page);
> +
> + ret = __eadd(&pginfo, sgx_get_epc_addr(epc_page));
Could you convince me that EADD is not going to fault and make the
kmap_atomic() mad?
> + kunmap_atomic((void *)pginfo.contents);
All the casting is kinda nasty, but I gues you do it to ensure you can
use __u64 in the hardware structs.
> + put_page(src_page);
> +
> + return ret ? -EIO : 0;
> +}
> +
> +/*
> + * If the caller requires measurement of the page as a proof for the content,
> + * use EEXTEND to add a measurement for 256 bytes of the page. Repeat this
> + * operation until the entire page is measured."
> + */
> +static int __sgx_encl_extend(struct sgx_encl *encl,
> + struct sgx_epc_page *epc_page)
> +{
> + int ret;
> + int i;
> +
> + for (i = 0; i < 16; i++) {
No magic numbers please.
#define SGX_EEXTEND_NR_BYTES 16 ??
> + ret = __eextend(sgx_get_epc_addr(encl->secs.epc_page),
> + sgx_get_epc_addr(epc_page) + (i * 0x100));
What's the 0x100 for?
> + if (ret) {
> + if (encls_failed(ret))
> + ENCLS_WARN(ret, "EEXTEND");
> + return -EIO;
How frequent should we expect these to be? Can users cause them? You
should *proably* call it ENCLS_WARN_ONCE() if it's implemented that way.
> + }
> + }
> +
> + return 0;
> +}
> +
> +static int sgx_encl_add_page(struct sgx_encl *encl, unsigned long src,
> + unsigned long offset, struct sgx_secinfo *secinfo,
> + unsigned long flags)
> +{
> + struct sgx_encl_page *encl_page;
> + struct sgx_epc_page *epc_page;
> + int ret;
> +
> + encl_page = sgx_encl_page_alloc(encl, offset, secinfo->flags);
> + if (IS_ERR(encl_page))
> + return PTR_ERR(encl_page);
> +
> + epc_page = __sgx_alloc_epc_page();
> + if (IS_ERR(epc_page)) {
> + kfree(encl_page);
> + return PTR_ERR(epc_page);
> + }
Looking at these, I'm forgetting why we need to both allocate an
encl_page and an epc_page. Commends might remind me. So would better
names.
> + mmap_read_lock(current->mm);
> + mutex_lock(&encl->lock);
> +
> + /*
> + * Insert prior to EADD in case of OOM.
I wouldn't say OOM. Maybe:
xa_insert() and EADD can both fail. But xa_insert() is easier
to unwind so do it first.
> EADD modifies MRENCLAVE, i.e.
What is MRENCLAVE?
> + * can't be gracefully unwound, while failure on EADD/EXTEND is limited
> + * to userspace errors (or kernel/hardware bugs).
> + */
> + ret = xa_insert(&encl->page_array, PFN_DOWN(encl_page->desc),
> + encl_page, GFP_KERNEL);
> + if (ret)
> + goto err_out_unlock;
> +
> + ret = __sgx_encl_add_page(encl, encl_page, epc_page, secinfo,
> + src);
> + if (ret)
> + goto err_out;
> +
> + /*
> + * Complete the "add" before doing the "extend" so that the "add"
> + * isn't in a half-baked state in the extremely unlikely scenario
> + * the enclave will be destroyed in response to EEXTEND failure.
> + */
> + encl_page->encl = encl;
> + encl_page->epc_page = epc_page;
> + encl->secs_child_cnt++;
> +
> + if (flags & SGX_PAGE_MEASURE) {
> + ret = __sgx_encl_extend(encl, epc_page);
> + if (ret)
> + goto err_out;
> + }
Why would we never *not* measure an added page?
> + mutex_unlock(&encl->lock);
> + mmap_read_unlock(current->mm);
> + return ret;
> +
> +err_out:
> + xa_erase(&encl->page_array, PFN_DOWN(encl_page->desc));
> +
> +err_out_unlock:
> + mutex_unlock(&encl->lock);
> + mmap_read_unlock(current->mm);
> +
> + sgx_free_epc_page(epc_page);
> + kfree(encl_page);
> +
> + return ret;
> +}
> +
> +/**
> + * sgx_ioc_enclave_add_pages() - The handler for %SGX_IOC_ENCLAVE_ADD_PAGES
> + * @encl: an enclave pointer
> + * @arg: a user pointer to a struct sgx_enclave_add_pages instance
> + *
> + * Add one or more pages to an uninitialized enclave, and optionally extend the
> + * measurement with the contents of the page. The SECINFO and measurement mask
> + * are applied to all pages.
> + *
> + * A SECINFO for a TCS is required to always contain zero permissions because
> + * CPU silently zeros them. Allowing anything else would cause a mismatch in
> + * the measurement.
> + *
> + * mmap()'s protection bits are capped by the page permissions. For each page
> + * address, the maximum protection bits are computed with the following
> + * heuristics:
> + *
> + * 1. A regular page: PROT_R, PROT_W and PROT_X match the SECINFO permissions.
> + * 2. A TCS page: PROT_R | PROT_W.
> + *
> + * mmap() is not allowed to surpass the minimum of the maximum protection bits
> + * within the given address range.
> + *
> + * The function deinitializes kernel data structures for enclave and returns
> + * -EIO in any of the following conditions:
> + *
> + * - Enclave Page Cache (EPC), the physical memory holding enclaves, has
> + * been invalidated. This will cause EADD and EEXTEND to fail.
> + * - If the source address is corrupted somehow when executing EADD.
> + *
> + * Return:
> + * length of the data processed on success,
> + * -EACCES if an executable source page is located in a noexec partition,
> + * -ENOMEM if the system is out of EPC pages,
> + * -EINTR if the call was interrupted before any data was processed,
> + * -EIO if the enclave was lost
> + * -errno otherwise
> + */
> +static long sgx_ioc_enclave_add_pages(struct sgx_encl *encl, void __user *arg)
> +{
> + struct sgx_enclave_add_pages addp;
> + struct sgx_secinfo secinfo;
> + unsigned long c;
> + int ret;
> +
> + if ((atomic_read(&encl->flags) & SGX_ENCL_INITIALIZED) ||
> + !(atomic_read(&encl->flags) & SGX_ENCL_CREATED))
> + return -EINVAL;
There should to be a nice state machine documented somewhere. Is ther?
> + if (copy_from_user(&addp, arg, sizeof(addp)))
> + return -EFAULT;
> +
> + if (!IS_ALIGNED(addp.offset, PAGE_SIZE) ||
> + !IS_ALIGNED(addp.src, PAGE_SIZE))
> + return -EINVAL;
> +
> + if (!(access_ok(addp.src, PAGE_SIZE)))
> + return -EFAULT;
This worries me. You're doing an access_ok() check on addp.src because
you evidently don't trust it. But, below, it looks to be accessed
directly with an offset, bound by addp.length, which I think can be
>PAGE_SIZE.
I'd feel a lot better if addp.src's value was being passed around as a
__user pointer.
> + if (addp.length & (PAGE_SIZE - 1))
> + return -EINVAL;
> +
> + if (addp.offset + addp.length - PAGE_SIZE >= encl->size)
> + return -EINVAL;
> +
> + if (copy_from_user(&secinfo, (void __user *)addp.secinfo,
> + sizeof(secinfo)))
> + return -EFAULT;
> +
> + if (sgx_validate_secinfo(&secinfo))
> + return -EINVAL;
> +
> + for (c = 0 ; c < addp.length; c += PAGE_SIZE) {
> + if (signal_pending(current)) {
> + if (!c)
> + ret = -ERESTARTSYS;
> +
> + break;
> + }
> +
> + if (c == SGX_MAX_ADD_PAGES_LENGTH)
> + break;
> +
> + if (need_resched())
> + cond_resched();
> +
> + ret = sgx_encl_add_page(encl, addp.src + c, addp.offset + c,
> + &secinfo, addp.flags);
Yeah... Don't we need to do another access_ok() check here, if we
needed one above since we are moving away from addrp.src?
> + if (ret)
> + break;
> + }
> +
> + addp.count = c;
> +
> + if (copy_to_user(arg, &addp, sizeof(addp)))
> + return -EFAULT;
> +
> + /*
> + * If the enlave was lost, deinitialize the internal data structures
> + * for the enclave.
> + */
> + if (ret == -EIO) {
> + mutex_lock(&encl->lock);
> + sgx_encl_destroy(encl);
> + mutex_unlock(&encl->lock);
> + }
> +
> + return ret;
> +}
> +
> long sgx_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
> {
> struct sgx_encl *encl = filep->private_data;
> @@ -212,6 +508,9 @@ long sgx_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
> case SGX_IOC_ENCLAVE_CREATE:
> ret = sgx_ioc_enclave_create(encl, (void __user *)arg);
> break;
> + case SGX_IOC_ENCLAVE_ADD_PAGES:
> + ret = sgx_ioc_enclave_add_pages(encl, (void __user *)arg);
> + break;
> default:
> ret = -ENOIOCTLCMD;
> break;
> diff --git a/arch/x86/kernel/cpu/sgx/sgx.h b/arch/x86/kernel/cpu/sgx/sgx.h
> index fce756c3434b..8d126070db1e 100644
> --- a/arch/x86/kernel/cpu/sgx/sgx.h
> +++ b/arch/x86/kernel/cpu/sgx/sgx.h
> @@ -34,6 +34,7 @@ struct sgx_epc_section {
>
> #define SGX_EPC_SECTION_MASK GENMASK(7, 0)
> #define SGX_MAX_EPC_SECTIONS (SGX_EPC_SECTION_MASK + 1)
> +#define SGX_MAX_ADD_PAGES_LENGTH 0x100000
>
> extern struct sgx_epc_section sgx_epc_sections[SGX_MAX_EPC_SECTIONS];
>
>
On Fri, Oct 2, 2020 at 9:51 PM Jarkko Sakkinen
<[email protected]> wrote:
>
> From: Sean Christopherson <[email protected]>
>
> An SGX runtime must be aware of the exceptions, which happen inside an
> enclave. Introduce a vDSO call that wraps EENTER/ERESUME cycle and returns
> the CPU exception back to the caller exactly when it happens.
>
> Kernel fixups the exception information to RDI, RSI and RDX. The SGX call
> vDSO handler fills this information to the user provided buffer or
> alternatively trigger user provided callback at the time of the exception.
>
> The calling convention supports providing the parameters in standard RDI
> RSI, RDX, RCX, R8 and R9 registers, i.e. it is possible to declare the vDSO
> as a C prototype, but other than that there is no specific support for
> SystemV ABI. Storing XSAVE etc. is all responsibility of the enclave and
> the associated run-time.
>
> Suggested-by: Andy Lutomirski <[email protected]>
> Acked-by: Jethro Beekman <[email protected]>
> Tested-by: Jethro Beekman <[email protected]>
> Signed-off-by: Sean Christopherson <[email protected]>
> Co-developed-by: Cedric Xing <[email protected]>
> Signed-off-by: Cedric Xing <[email protected]>
> Co-developed-by: Jarkko Sakkinen <[email protected]>
> Signed-off-by: Jarkko Sakkinen <[email protected]>
> +SYM_FUNC_START(__vdso_sgx_enter_enclave)
> + /* Prolog */
> + .cfi_startproc
> + push %rbp
> + .cfi_adjust_cfa_offset 8
> + .cfi_rel_offset %rbp, 0
> + mov %rsp, %rbp
> + .cfi_def_cfa_register %rbp
> + push %rbx
> + .cfi_rel_offset %rbx, -8
This *looks* right, but I'm not really an expert.
> +
> + mov %ecx, %eax
> +.Lenter_enclave:
> + /* EENTER <= leaf <= ERESUME */
> + cmp $EENTER, %eax
> + jb .Linvalid_input
> + cmp $ERESUME, %eax
> + ja .Linvalid_input
> +
> + mov SGX_ENCLAVE_OFFSET_OF_RUN(%rbp), %rcx
> +
> + /* Validate that the reserved area contains only zeros. */
> + push %rax
> + push %rbx
This could use a .cfi_register_something_or_other for rbx
> + mov $SGX_ENCLAVE_RUN_RESERVED_START, %rbx
> +1:
> + mov (%rcx, %rbx), %rax
> + cmpq $0, %rax
> + jne .Linvalid_input
> +
> + add $8, %rbx
> + cmpq $SGX_ENCLAVE_RUN_RESERVED_END, %rbx
> + jne 1b
> + pop %rbx
This should undo it.
> + pop %rax
> +
> + /* Load TCS and AEP */
> + mov SGX_ENCLAVE_RUN_TCS(%rcx), %rbx
> + lea .Lasync_exit_pointer(%rip), %rcx
> +
> + /* Single ENCLU serving as both EENTER and AEP (ERESUME) */
> +.Lasync_exit_pointer:
> +.Lenclu_eenter_eresume:
> + enclu
> +
> + /* EEXIT jumps here unless the enclave is doing something fancy. */
> + mov SGX_ENCLAVE_OFFSET_OF_RUN(%rbp), %rbx
> +
> + /* Set exit_reason. */
> + movl $EEXIT, SGX_ENCLAVE_RUN_LEAF(%rbx)
> +
> + /* Invoke userspace's exit handler if one was provided. */
> +.Lhandle_exit:
> + cmpq $0, SGX_ENCLAVE_RUN_USER_HANDLER(%rbx)
> + jne .Linvoke_userspace_handler
> +
> + /* Success, in the sense that ENCLU was attempted. */
> + xor %eax, %eax
> +
> +.Lout:
> + pop %rbx
and this should undo the .cfi_register.
> + leave
> + .cfi_def_cfa %rsp, 8
> + ret
> +
> + /* The out-of-line code runs with the pre-leave stack frame. */
> + .cfi_def_cfa %rbp, 16
> +
> +.Linvalid_input:
Here rbx and rax are pushed, and I guess pop rbx and leave fixes that
up, so okay.
> + mov $(-EINVAL), %eax
> + jmp .Lout
> +
> +.Lhandle_exception:
> + mov SGX_ENCLAVE_OFFSET_OF_RUN(%rbp), %rbx
> +
> + /* Set the exception info. */
> + mov %eax, (SGX_ENCLAVE_RUN_LEAF)(%rbx)
> + mov %di, (SGX_ENCLAVE_RUN_EXCEPTION_VECTOR)(%rbx)
> + mov %si, (SGX_ENCLAVE_RUN_EXCEPTION_ERROR_CODE)(%rbx)
> + mov %rdx, (SGX_ENCLAVE_RUN_EXCEPTION_ADDR)(%rbx)
> + jmp .Lhandle_exit
> +
> +.Linvoke_userspace_handler:
> + /* Pass the untrusted RSP (at exit) to the callback via %rcx. */
> + mov %rsp, %rcx
> +
> + /* Save struct sgx_enclave_exception %rbx is about to be clobbered. */
> + mov %rbx, %rax
> +
> + /* Save the untrusted RSP offset in %rbx (non-volatile register). */
> + mov %rsp, %rbx
> + and $0xf, %rbx
> +
> + /*
> + * Align stack per x86_64 ABI. Note, %rsp needs to be 16-byte aligned
> + * _after_ pushing the parameters on the stack, hence the bonus push.
> + */
> + and $-0x10, %rsp
> + push %rax
> +
> + /* Push struct sgx_enclave_exception as a param to the callback. */
> + push %rax
> +
> + /* Clear RFLAGS.DF per x86_64 ABI */
> + cld
> +
> + /*
> + * Load the callback pointer to %rax and lfence for LVI (load value
> + * injection) protection before making the call.
> + */
> + mov SGX_ENCLAVE_RUN_USER_HANDLER(%rax), %rax
> + lfence
> + call *%rax
> +
> + /* Undo the post-exit %rsp adjustment. */
> + lea 0x10(%rsp, %rbx), %rsp
> +
> + /*
> + * If the return from callback is zero or negative, return immediately,
> + * else re-execute ENCLU with the postive return value interpreted as
> + * the requested ENCLU leaf.
> + */
> + cmp $0, %eax
> + jle .Lout
> + jmp .Lenter_enclave
> +
> + .cfi_endproc
> +
> +_ASM_VDSO_EXTABLE_HANDLE(.Lenclu_eenter_eresume, .Lhandle_exception)
On Thu, Oct 15, 2020 at 12:06:52PM -0700, Dave Hansen wrote:
> On 10/2/20 9:50 PM, Jarkko Sakkinen wrote:
> ...
> > You can tell if your CPU supports SGX by looking into /proc/cpuinfo:
> >
> > cat /proc/cpuinfo | grep sgx
>
> This is only true *after* applying this series, right?
Yes, that's correct.
/Jarkko
On Fri, Oct 16, 2020 at 06:48:53PM -0700, Andy Lutomirski wrote:
> On Fri, Oct 2, 2020 at 9:51 PM Jarkko Sakkinen
> <[email protected]> wrote:
> >
> > From: Sean Christopherson <[email protected]>
> >
> > An SGX runtime must be aware of the exceptions, which happen inside an
> > enclave. Introduce a vDSO call that wraps EENTER/ERESUME cycle and returns
> > the CPU exception back to the caller exactly when it happens.
> >
> > Kernel fixups the exception information to RDI, RSI and RDX. The SGX call
> > vDSO handler fills this information to the user provided buffer or
> > alternatively trigger user provided callback at the time of the exception.
> >
> > The calling convention supports providing the parameters in standard RDI
> > RSI, RDX, RCX, R8 and R9 registers, i.e. it is possible to declare the vDSO
> > as a C prototype, but other than that there is no specific support for
> > SystemV ABI. Storing XSAVE etc. is all responsibility of the enclave and
> > the associated run-time.
> >
> > Suggested-by: Andy Lutomirski <[email protected]>
> > Acked-by: Jethro Beekman <[email protected]>
> > Tested-by: Jethro Beekman <[email protected]>
> > Signed-off-by: Sean Christopherson <[email protected]>
> > Co-developed-by: Cedric Xing <[email protected]>
> > Signed-off-by: Cedric Xing <[email protected]>
> > Co-developed-by: Jarkko Sakkinen <[email protected]>
> > Signed-off-by: Jarkko Sakkinen <[email protected]>
>
> > +SYM_FUNC_START(__vdso_sgx_enter_enclave)
> > + /* Prolog */
> > + .cfi_startproc
> > + push %rbp
> > + .cfi_adjust_cfa_offset 8
> > + .cfi_rel_offset %rbp, 0
> > + mov %rsp, %rbp
> > + .cfi_def_cfa_register %rbp
> > + push %rbx
> > + .cfi_rel_offset %rbx, -8
>
> This *looks* right, but I'm not really an expert.
I did not change this from earlier versions.
> > +
> > + mov %ecx, %eax
> > +.Lenter_enclave:
> > + /* EENTER <= leaf <= ERESUME */
> > + cmp $EENTER, %eax
> > + jb .Linvalid_input
> > + cmp $ERESUME, %eax
> > + ja .Linvalid_input
> > +
> > + mov SGX_ENCLAVE_OFFSET_OF_RUN(%rbp), %rcx
> > +
> > + /* Validate that the reserved area contains only zeros. */
> > + push %rax
> > + push %rbx
>
> This could use a .cfi_register_something_or_other for rbx
Sean pointed out that saving %rbx is not necessary here:
https://lore.kernel.org/linux-sgx/[email protected]/
> > + mov $SGX_ENCLAVE_RUN_RESERVED_START, %rbx
> > +1:
> > + mov (%rcx, %rbx), %rax
> > + cmpq $0, %rax
> > + jne .Linvalid_input
> > +
> > + add $8, %rbx
> > + cmpq $SGX_ENCLAVE_RUN_RESERVED_END, %rbx
> > + jne 1b
> > + pop %rbx
>
> This should undo it.
Given private feedback from Sean, I'm replacing this with:
mov $SGX_ENCLAVE_RUN_RESERVED_START, %rbx
1:
cmpq $0, (%rcx, %rbx)
jne .Linvalid_input
add $8, %rbx
cmpq $SGX_ENCLAVE_RUN_RESERVED_END, %rbx
jne 1b
There was bug in the error path, %rax was not popped. I did negative
testing (testing both branches) for this but it went clean.
I guess if I fix this, that will deal with all of your comments?
> > + pop %rax
> > +
> > + /* Load TCS and AEP */
> > + mov SGX_ENCLAVE_RUN_TCS(%rcx), %rbx
> > + lea .Lasync_exit_pointer(%rip), %rcx
> > +
> > + /* Single ENCLU serving as both EENTER and AEP (ERESUME) */
> > +.Lasync_exit_pointer:
> > +.Lenclu_eenter_eresume:
> > + enclu
> > +
> > + /* EEXIT jumps here unless the enclave is doing something fancy. */
> > + mov SGX_ENCLAVE_OFFSET_OF_RUN(%rbp), %rbx
> > +
> > + /* Set exit_reason. */
> > + movl $EEXIT, SGX_ENCLAVE_RUN_LEAF(%rbx)
> > +
> > + /* Invoke userspace's exit handler if one was provided. */
> > +.Lhandle_exit:
> > + cmpq $0, SGX_ENCLAVE_RUN_USER_HANDLER(%rbx)
> > + jne .Linvoke_userspace_handler
> > +
> > + /* Success, in the sense that ENCLU was attempted. */
> > + xor %eax, %eax
> > +
> > +.Lout:
> > + pop %rbx
>
> and this should undo the .cfi_register.
>
> > + leave
> > + .cfi_def_cfa %rsp, 8
> > + ret
> > +
> > + /* The out-of-line code runs with the pre-leave stack frame. */
> > + .cfi_def_cfa %rbp, 16
> > +
> > +.Linvalid_input:
>
> Here rbx and rax are pushed, and I guess pop rbx and leave fixes that
> up, so okay.
>
> > + mov $(-EINVAL), %eax
> > + jmp .Lout
> > +
> > +.Lhandle_exception:
> > + mov SGX_ENCLAVE_OFFSET_OF_RUN(%rbp), %rbx
> > +
> > + /* Set the exception info. */
> > + mov %eax, (SGX_ENCLAVE_RUN_LEAF)(%rbx)
> > + mov %di, (SGX_ENCLAVE_RUN_EXCEPTION_VECTOR)(%rbx)
> > + mov %si, (SGX_ENCLAVE_RUN_EXCEPTION_ERROR_CODE)(%rbx)
> > + mov %rdx, (SGX_ENCLAVE_RUN_EXCEPTION_ADDR)(%rbx)
> > + jmp .Lhandle_exit
> > +
> > +.Linvoke_userspace_handler:
> > + /* Pass the untrusted RSP (at exit) to the callback via %rcx. */
> > + mov %rsp, %rcx
> > +
> > + /* Save struct sgx_enclave_exception %rbx is about to be clobbered. */
> > + mov %rbx, %rax
> > +
> > + /* Save the untrusted RSP offset in %rbx (non-volatile register). */
> > + mov %rsp, %rbx
> > + and $0xf, %rbx
> > +
> > + /*
> > + * Align stack per x86_64 ABI. Note, %rsp needs to be 16-byte aligned
> > + * _after_ pushing the parameters on the stack, hence the bonus push.
> > + */
> > + and $-0x10, %rsp
> > + push %rax
> > +
> > + /* Push struct sgx_enclave_exception as a param to the callback. */
> > + push %rax
> > +
> > + /* Clear RFLAGS.DF per x86_64 ABI */
> > + cld
> > +
> > + /*
> > + * Load the callback pointer to %rax and lfence for LVI (load value
> > + * injection) protection before making the call.
> > + */
> > + mov SGX_ENCLAVE_RUN_USER_HANDLER(%rax), %rax
> > + lfence
> > + call *%rax
> > +
> > + /* Undo the post-exit %rsp adjustment. */
> > + lea 0x10(%rsp, %rbx), %rsp
> > +
> > + /*
> > + * If the return from callback is zero or negative, return immediately,
> > + * else re-execute ENCLU with the postive return value interpreted as
> > + * the requested ENCLU leaf.
> > + */
> > + cmp $0, %eax
> > + jle .Lout
> > + jmp .Lenter_enclave
> > +
> > + .cfi_endproc
> > +
> > +_ASM_VDSO_EXTABLE_HANDLE(.Lenclu_eenter_eresume, .Lhandle_exception)
/Jarkko
On Fri, Oct 16, 2020 at 02:25:50PM -0700, Dave Hansen wrote:
>
> > +/**
> > + * struct sgx_enclave_add_pages - parameter structure for the
> > + * %SGX_IOC_ENCLAVE_ADD_PAGE ioctl
> > + * @src: start address for the page data
> > + * @offset: starting page offset
>
> Is this the offset *within* the page? Might be nice to say that.
It's the offset in the enclave address range where page is to be added.
> > + * @length: length of the data (multiple of the page size)
> > + * @secinfo: address for the SECINFO data
> > + * @flags: page control flags
> > + * @count: number of bytes added (multiple of the page size)
> > + */
> > +struct sgx_enclave_add_pages {
> > + __u64 src;
> > + __u64 offset;
> > + __u64 length;
> > + __u64 secinfo;
> > + __u64 flags;
> > + __u64 count;
> > +};
> > +
> > #endif /* _UAPI_ASM_X86_SGX_H */
> > diff --git a/arch/x86/kernel/cpu/sgx/ioctl.c b/arch/x86/kernel/cpu/sgx/ioctl.c
> > index 9bb4694e57c1..e13e04737683 100644
> > --- a/arch/x86/kernel/cpu/sgx/ioctl.c
> > +++ b/arch/x86/kernel/cpu/sgx/ioctl.c
> > @@ -194,6 +194,302 @@ static long sgx_ioc_enclave_create(struct sgx_encl *encl, void __user *arg)
> > return ret;
> > }
> >
> > +static struct sgx_encl_page *sgx_encl_page_alloc(struct sgx_encl *encl,
> > + unsigned long offset,
> > + u64 secinfo_flags)
> > +{
> > + struct sgx_encl_page *encl_page;
> > + unsigned long prot;
> > +
> > + encl_page = kzalloc(sizeof(*encl_page), GFP_KERNEL);
> > + if (!encl_page)
> > + return ERR_PTR(-ENOMEM);
> > +
> > + encl_page->desc = encl->base + offset;
> > + encl_page->encl = encl;
>
> Somewhere, we need an explanation of why we have 'sgx_epc_page' and
> 'sgx_encl_page'. I think they're 1:1 at least after
> sgx_encl_page_alloc(), so I'm wondering why we need two.
You need sgx_encl_page to hold data that exists whether or not there is
an associated EPC page.
Essentially sgx_encl_page contains the data needed for a virtual page,
and sgx_epc_page what is needed to represent physical page.
None of the data contained in sgx_encl_page make sense for sgx_epc_page.
They don't contain intersecting or redundant data.
> > + prot = _calc_vm_trans(secinfo_flags, SGX_SECINFO_R, PROT_READ) |
> > + _calc_vm_trans(secinfo_flags, SGX_SECINFO_W, PROT_WRITE) |
> > + _calc_vm_trans(secinfo_flags, SGX_SECINFO_X, PROT_EXEC);
> > +
> > + /*
> > + * TCS pages must always RW set for CPU access while the SECINFO
> > + * permissions are *always* zero - the CPU ignores the user provided
> > + * values and silently overwrites them with zero permissions.
> > + */
> > + if ((secinfo_flags & SGX_SECINFO_PAGE_TYPE_MASK) == SGX_SECINFO_TCS)
> > + prot |= PROT_READ | PROT_WRITE;
> > +
> > + /* Calculate maximum of the VM flags for the page. */
> > + encl_page->vm_max_prot_bits = calc_vm_prot_bits(prot, 0);
> > +
> > + return encl_page;
> > +}
> > +
> > +static int sgx_validate_secinfo(struct sgx_secinfo *secinfo)
> > +{
> > + u64 perm = secinfo->flags & SGX_SECINFO_PERMISSION_MASK;
> > + u64 pt = secinfo->flags & SGX_SECINFO_PAGE_TYPE_MASK;
>
> I'd align the ='s up there ^^
Thanks, I updated this.
> > +
> > + if (pt != SGX_SECINFO_REG && pt != SGX_SECINFO_TCS)
> > + return -EINVAL;
> > +
> > + if ((perm & SGX_SECINFO_W) && !(perm & SGX_SECINFO_R))
> > + return -EINVAL;
> > +
> > + /*
> > + * CPU will silently overwrite the permissions as zero, which means
> > + * that we need to validate it ourselves.
> > + */
> > + if (pt == SGX_SECINFO_TCS && perm)
> > + return -EINVAL;
> > +
> > + if (secinfo->flags & SGX_SECINFO_RESERVED_MASK)
> > + return -EINVAL;
> > +
> > + if (memchr_inv(secinfo->reserved, 0, sizeof(secinfo->reserved)))
> > + return -EINVAL;
> > +
> > + return 0;
> > +}
> > +
> > +static int __sgx_encl_add_page(struct sgx_encl *encl,
> > + struct sgx_encl_page *encl_page,
> > + struct sgx_epc_page *epc_page,
> > + struct sgx_secinfo *secinfo, unsigned long src)
> > +{
> > + struct sgx_pageinfo pginfo;
> > + struct vm_area_struct *vma;
> > + struct page *src_page;
> > + int ret;
> > +
> > + /* Deny noexec. */
> > + vma = find_vma(current->mm, src);
> > + if (!vma)
> > + return -EFAULT;
> > +
> > + if (!(vma->vm_flags & VM_MAYEXEC))
> > + return -EACCES;
> > +
> > + ret = get_user_pages(src, 1, 0, &src_page, NULL);
> > + if (ret < 1)
> > + return -EFAULT;
> > +
> > + pginfo.secs = (unsigned long)sgx_get_epc_addr(encl->secs.epc_page);
> > + pginfo.addr = SGX_ENCL_PAGE_ADDR(encl_page);
> > + pginfo.metadata = (unsigned long)secinfo;
> > + pginfo.contents = (unsigned long)kmap_atomic(src_page);
> > +
> > + ret = __eadd(&pginfo, sgx_get_epc_addr(epc_page));
>
> Could you convince me that EADD is not going to fault and make the
> kmap_atomic() mad?
It can legitly fail in the case when power cycle happens.
That's why the inline assembly catches faults and return an error code.
Thhis code has been field tested a lot. I have fairly good trust on
it.
> > + kunmap_atomic((void *)pginfo.contents);
>
> All the casting is kinda nasty, but I gues you do it to ensure you can
> use __u64 in the hardware structs.
Yup.
>
> > + put_page(src_page);
> > +
> > + return ret ? -EIO : 0;
> > +}
> > +
> > +/*
> > + * If the caller requires measurement of the page as a proof for the content,
> > + * use EEXTEND to add a measurement for 256 bytes of the page. Repeat this
> > + * operation until the entire page is measured."
> > + */
> > +static int __sgx_encl_extend(struct sgx_encl *encl,
> > + struct sgx_epc_page *epc_page)
> > +{
> > + int ret;
> > + int i;
> > +
> > + for (i = 0; i < 16; i++) {
>
> No magic numbers please.
>
> #define SGX_EEXTEND_NR_BYTES 16 ??
>
> > + ret = __eextend(sgx_get_epc_addr(encl->secs.epc_page),
> > + sgx_get_epc_addr(epc_page) + (i * 0x100));
>
> What's the 0x100 for?
It's the block size for this operation. I will define constants.
> > + if (ret) {
> > + if (encls_failed(ret))
> > + ENCLS_WARN(ret, "EEXTEND");
> > + return -EIO;
>
> How frequent should we expect these to be? Can users cause them? You
> should *proably* call it ENCLS_WARN_ONCE() if it's implemented that way.
If power cycle happens.
> > + }
> > + }
> > +
> > + return 0;
> > +}
> > +
> > +static int sgx_encl_add_page(struct sgx_encl *encl, unsigned long src,
> > + unsigned long offset, struct sgx_secinfo *secinfo,
> > + unsigned long flags)
> > +{
> > + struct sgx_encl_page *encl_page;
> > + struct sgx_epc_page *epc_page;
> > + int ret;
> > +
> > + encl_page = sgx_encl_page_alloc(encl, offset, secinfo->flags);
> > + if (IS_ERR(encl_page))
> > + return PTR_ERR(encl_page);
> > +
> > + epc_page = __sgx_alloc_epc_page();
> > + if (IS_ERR(epc_page)) {
> > + kfree(encl_page);
> > + return PTR_ERR(epc_page);
> > + }
>
> Looking at these, I'm forgetting why we need to both allocate an
> encl_page and an epc_page. Commends might remind me. So would better
> names.
Should the struct names be renamed?
Like sgx_phys_epc_page and sgx_virt_epc_page?
>
> > + mmap_read_lock(current->mm);
> > + mutex_lock(&encl->lock);
> > +
> > + /*
> > + * Insert prior to EADD in case of OOM.
>
> I wouldn't say OOM. Maybe:
>
> xa_insert() and EADD can both fail. But xa_insert() is easier
> to unwind so do it first.
>
> > EADD modifies MRENCLAVE, i.e.
>
> What is MRENCLAVE?
The measurement stored in SECS. I'm wondering with xarray, is it
possible to preallocate entry without inserting anything?
Then we could get rid of this unwind and also would not need to
take encl->lock in sgx_encl_may_map().
> > + * can't be gracefully unwound, while failure on EADD/EXTEND is limited
> > + * to userspace errors (or kernel/hardware bugs).
> > + */
> > + ret = xa_insert(&encl->page_array, PFN_DOWN(encl_page->desc),
> > + encl_page, GFP_KERNEL);
> > + if (ret)
> > + goto err_out_unlock;
> > +
> > + ret = __sgx_encl_add_page(encl, encl_page, epc_page, secinfo,
> > + src);
> > + if (ret)
> > + goto err_out;
> > +
> > + /*
> > + * Complete the "add" before doing the "extend" so that the "add"
> > + * isn't in a half-baked state in the extremely unlikely scenario
> > + * the enclave will be destroyed in response to EEXTEND failure.
> > + */
> > + encl_page->encl = encl;
> > + encl_page->epc_page = epc_page;
> > + encl->secs_child_cnt++;
> > +
> > + if (flags & SGX_PAGE_MEASURE) {
> > + ret = __sgx_encl_extend(encl, epc_page);
> > + if (ret)
> > + goto err_out;
> > + }
>
> Why would we never *not* measure an added page?
You might add Thread Control Structure pages without measuring them or
data area. There are reasons for the user space not to have everything
measured.
>
> > + mutex_unlock(&encl->lock);
> > + mmap_read_unlock(current->mm);
> > + return ret;
> > +
> > +err_out:
> > + xa_erase(&encl->page_array, PFN_DOWN(encl_page->desc));
> > +
> > +err_out_unlock:
> > + mutex_unlock(&encl->lock);
> > + mmap_read_unlock(current->mm);
> > +
> > + sgx_free_epc_page(epc_page);
> > + kfree(encl_page);
> > +
> > + return ret;
> > +}
> > +
> > +/**
> > + * sgx_ioc_enclave_add_pages() - The handler for %SGX_IOC_ENCLAVE_ADD_PAGES
> > + * @encl: an enclave pointer
> > + * @arg: a user pointer to a struct sgx_enclave_add_pages instance
> > + *
> > + * Add one or more pages to an uninitialized enclave, and optionally extend the
> > + * measurement with the contents of the page. The SECINFO and measurement mask
> > + * are applied to all pages.
> > + *
> > + * A SECINFO for a TCS is required to always contain zero permissions because
> > + * CPU silently zeros them. Allowing anything else would cause a mismatch in
> > + * the measurement.
> > + *
> > + * mmap()'s protection bits are capped by the page permissions. For each page
> > + * address, the maximum protection bits are computed with the following
> > + * heuristics:
> > + *
> > + * 1. A regular page: PROT_R, PROT_W and PROT_X match the SECINFO permissions.
> > + * 2. A TCS page: PROT_R | PROT_W.
> > + *
> > + * mmap() is not allowed to surpass the minimum of the maximum protection bits
> > + * within the given address range.
> > + *
> > + * The function deinitializes kernel data structures for enclave and returns
> > + * -EIO in any of the following conditions:
> > + *
> > + * - Enclave Page Cache (EPC), the physical memory holding enclaves, has
> > + * been invalidated. This will cause EADD and EEXTEND to fail.
> > + * - If the source address is corrupted somehow when executing EADD.
> > + *
> > + * Return:
> > + * length of the data processed on success,
> > + * -EACCES if an executable source page is located in a noexec partition,
> > + * -ENOMEM if the system is out of EPC pages,
> > + * -EINTR if the call was interrupted before any data was processed,
> > + * -EIO if the enclave was lost
> > + * -errno otherwise
> > + */
> > +static long sgx_ioc_enclave_add_pages(struct sgx_encl *encl, void __user *arg)
> > +{
> > + struct sgx_enclave_add_pages addp;
> > + struct sgx_secinfo secinfo;
> > + unsigned long c;
> > + int ret;
> > +
> > + if ((atomic_read(&encl->flags) & SGX_ENCL_INITIALIZED) ||
> > + !(atomic_read(&encl->flags) & SGX_ENCL_CREATED))
> > + return -EINVAL;
>
> There should to be a nice state machine documented somewhere. Is ther?
So should I document to encl.h where they are declared to start with?
>
> > + if (copy_from_user(&addp, arg, sizeof(addp)))
> > + return -EFAULT;
> > +
> > + if (!IS_ALIGNED(addp.offset, PAGE_SIZE) ||
> > + !IS_ALIGNED(addp.src, PAGE_SIZE))
> > + return -EINVAL;
> > +
> > + if (!(access_ok(addp.src, PAGE_SIZE)))
> > + return -EFAULT;
>
> This worries me. You're doing an access_ok() check on addp.src because
> you evidently don't trust it. But, below, it looks to be accessed
> directly with an offset, bound by addp.length, which I think can be
> >PAGE_SIZE.
>
> I'd feel a lot better if addp.src's value was being passed around as a
> __user pointer.
I'm not sure if that call is even needed. Each page is pinned with
get_user_pages(). AFAIK, it should be enough. This must be legacy cruft.
> > + if (addp.length & (PAGE_SIZE - 1))
> > + return -EINVAL;
> > +
> > + if (addp.offset + addp.length - PAGE_SIZE >= encl->size)
> > + return -EINVAL;
> > +
> > + if (copy_from_user(&secinfo, (void __user *)addp.secinfo,
> > + sizeof(secinfo)))
> > + return -EFAULT;
> > +
> > + if (sgx_validate_secinfo(&secinfo))
> > + return -EINVAL;
> > +
> > + for (c = 0 ; c < addp.length; c += PAGE_SIZE) {
> > + if (signal_pending(current)) {
> > + if (!c)
> > + ret = -ERESTARTSYS;
> > +
> > + break;
> > + }
> > +
> > + if (c == SGX_MAX_ADD_PAGES_LENGTH)
> > + break;
> > +
> > + if (need_resched())
> > + cond_resched();
> > +
> > + ret = sgx_encl_add_page(encl, addp.src + c, addp.offset + c,
> > + &secinfo, addp.flags);
>
> Yeah... Don't we need to do another access_ok() check here, if we
> needed one above since we are moving away from addrp.src?
I don't think so because the page is pinned with get_user_pages().
>
> > + if (ret)
> > + break;
> > + }
> > +
> > + addp.count = c;
> > +
> > + if (copy_to_user(arg, &addp, sizeof(addp)))
> > + return -EFAULT;
> > +
> > + /*
> > + * If the enlave was lost, deinitialize the internal data structures
> > + * for the enclave.
> > + */
> > + if (ret == -EIO) {
> > + mutex_lock(&encl->lock);
> > + sgx_encl_destroy(encl);
> > + mutex_unlock(&encl->lock);
> > + }
> > +
> > + return ret;
> > +}
> > +
> > long sgx_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
> > {
> > struct sgx_encl *encl = filep->private_data;
> > @@ -212,6 +508,9 @@ long sgx_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
> > case SGX_IOC_ENCLAVE_CREATE:
> > ret = sgx_ioc_enclave_create(encl, (void __user *)arg);
> > break;
> > + case SGX_IOC_ENCLAVE_ADD_PAGES:
> > + ret = sgx_ioc_enclave_add_pages(encl, (void __user *)arg);
> > + break;
> > default:
> > ret = -ENOIOCTLCMD;
> > break;
> > diff --git a/arch/x86/kernel/cpu/sgx/sgx.h b/arch/x86/kernel/cpu/sgx/sgx.h
> > index fce756c3434b..8d126070db1e 100644
> > --- a/arch/x86/kernel/cpu/sgx/sgx.h
> > +++ b/arch/x86/kernel/cpu/sgx/sgx.h
> > @@ -34,6 +34,7 @@ struct sgx_epc_section {
> >
> > #define SGX_EPC_SECTION_MASK GENMASK(7, 0)
> > #define SGX_MAX_EPC_SECTIONS (SGX_EPC_SECTION_MASK + 1)
> > +#define SGX_MAX_ADD_PAGES_LENGTH 0x100000
> >
> > extern struct sgx_epc_section sgx_epc_sections[SGX_MAX_EPC_SECTIONS];
> >
> >
>
/Jarkko
On Fri, Oct 16, 2020 at 10:07:47AM -0700, Dave Hansen wrote:
> > +static u32 sgx_calc_ssa_frame_size(u32 miscselect, u64 xfrm)
> > +{
> > + u32 size_max = PAGE_SIZE;
> > + u32 size;
> > + int i;
> > +
> > + for (i = 2; i < 64; i++) {
>
> Should this be:
>
> for (i = XFEATURE_YMM; i < XFEATURE_MAX; i++) {
>
> Basically, does this need to be 64, or should it be limited to the
> kernel-known XFEATURES? Or, should this be looping through all the bits
> set in xfeatures_mask_user().
I think so yes.
> > + if (!((1 << i) & xfrm))
> > + continue;
> > +
> > + size = SGX_SSA_GPRS_SIZE + sgx_xsave_size_tbl[i];
> > +
> > + if (miscselect & SGX_MISC_EXINFO)
> > + size += SGX_SSA_MISC_EXINFO_SIZE;
> > +
> > + if (size > size_max)
> > + size_max = size;
> > + }
> > +
> > + return PFN_UP(size_max);
> > +}
> > +
> > +static int sgx_validate_secs(const struct sgx_secs *secs)
> > +{
>
> What's the overall point of this function? Does it avoid a #GP from an
> instruction later?
>
> Does all of the 'secs' content come from userspace?
Yes it does avoid #GP, and all the data comes from the user space.
> > + u64 max_size = (secs->attributes & SGX_ATTR_MODE64BIT) ?
> > + sgx_encl_size_max_64 : sgx_encl_size_max_32;
> > +
> > + if (secs->size < (2 * PAGE_SIZE) || !is_power_of_2(secs->size))
> > + return -EINVAL;
> > +
> > + if (secs->base & (secs->size - 1))
> > + return -EINVAL;
> > +
> > + if (secs->miscselect & sgx_misc_reserved_mask ||
> > + secs->attributes & sgx_attributes_reserved_mask ||
> > + secs->xfrm & sgx_xfrm_reserved_mask)
> > + return -EINVAL;
> > +
> > + if (secs->size > max_size)
> > + return -EINVAL;
> > +
> > + if (!(secs->xfrm & XFEATURE_MASK_FP) ||
> > + !(secs->xfrm & XFEATURE_MASK_SSE) ||
> > + (((secs->xfrm >> XFEATURE_BNDREGS) & 1) != ((secs->xfrm >> XFEATURE_BNDCSR) & 1)))
> > + return -EINVAL;
> > +
> > + if (!secs->ssa_frame_size)
> > + return -EINVAL;
> > +
> > + if (sgx_calc_ssa_frame_size(secs->miscselect, secs->xfrm) > secs->ssa_frame_size)
> > + return -EINVAL;
> > +
> > + if (memchr_inv(secs->reserved1, 0, sizeof(secs->reserved1)) ||
> > + memchr_inv(secs->reserved2, 0, sizeof(secs->reserved2)) ||
> > + memchr_inv(secs->reserved3, 0, sizeof(secs->reserved3)) ||
> > + memchr_inv(secs->reserved4, 0, sizeof(secs->reserved4)))
> > + return -EINVAL;
> > +
> > + return 0;
> > +}
>
> I think it would be nice to at least have one comment per condition to
> explain what's going on there.
OK, I can do that.
>
> > +static int sgx_encl_create(struct sgx_encl *encl, struct sgx_secs *secs)
> > +{
> > + struct sgx_epc_page *secs_epc;
> > + struct sgx_pageinfo pginfo;
> > + struct sgx_secinfo secinfo;
> > + unsigned long encl_size;
> > + struct file *backing;
> > + long ret;
> > +
> > + if (sgx_validate_secs(secs)) {
> > + pr_debug("invalid SECS\n");
> > + return -EINVAL;
> > + }
> > +
> > + /* The extra page goes to SECS. */
> > + encl_size = secs->size + PAGE_SIZE;
> > +
> > + backing = shmem_file_setup("SGX backing", encl_size + (encl_size >> 5),
> > + VM_NORESERVE);
>
> What's the >>5 adjustment for?
The backing storage stores not only the swapped page but also
Paging Crypto MetaData (PCMD) structure. It essentially contains
a CPU encrypted MAC for a page.
The MAC is over page version and data. The version is stored in
a EPC page called Version Array (VA) page.
Both of these are needed by ENCLS[ELDU].
>
> > + if (IS_ERR(backing))
> > + return PTR_ERR(backing);
> > +
> > + encl->backing = backing;
> > +
> > + secs_epc = __sgx_alloc_epc_page();
> > + if (IS_ERR(secs_epc)) {
> > + ret = PTR_ERR(secs_epc);
> > + goto err_out_backing;
> > + }
> > +
> > + encl->secs.epc_page = secs_epc;
> > +
> > + pginfo.addr = 0;
> > + pginfo.contents = (unsigned long)secs;
> > + pginfo.metadata = (unsigned long)&secinfo;
> > + pginfo.secs = 0;
> > + memset(&secinfo, 0, sizeof(secinfo));
> > +
> > + ret = __ecreate((void *)&pginfo, sgx_get_epc_addr(secs_epc));
> > + if (ret) {
> > + pr_debug("ECREATE returned %ld\n", ret);
> > + goto err_out;
> > + }
> > +
> > + if (secs->attributes & SGX_ATTR_DEBUG)
> > + atomic_or(SGX_ENCL_DEBUG, &encl->flags);
> > +
> > + encl->secs.encl = encl;
> > + encl->base = secs->base;
> > + encl->size = secs->size;
> > + encl->ssaframesize = secs->ssa_frame_size;
> > +
> > + /*
> > + * Set SGX_ENCL_CREATED only after the enclave is fully prepped. This
> > + * allows setting and checking enclave creation without having to take
> > + * encl->lock.
> > + */
> > + atomic_or(SGX_ENCL_CREATED, &encl->flags);
>
> I'm wondering what the impact of setting this flag is. That's hard to
> figure out because the flag isn't documented.
>
> It's also unusual to have atomic_or() used like this. The normal
> set_bit()/clear_bit() that you can use on an unsigned long are actually
> implemented as atomics.
>
> I'm curious both why this needs to be atomics, *and* why the atomic_or()
> interface is being used.
Right, and this covers also test_and_change_bit() too (just checked).
So, I suppose we can.
> > + return 0;
> > +
> > +err_out:
> > + sgx_free_epc_page(encl->secs.epc_page);
> > + encl->secs.epc_page = NULL;
> > +
> > +err_out_backing:
> > + fput(encl->backing);
> > + encl->backing = NULL;
> > +
> > + return ret;
> > +}
> > +
> > +/**
> > + * sgx_ioc_enclave_create - handler for %SGX_IOC_ENCLAVE_CREATE
> > + * @encl: an enclave pointer
> > + * @arg: userspace pointer to a struct sgx_enclave_create instance
> > + *
> > + * Allocate kernel data structures for a new enclave and execute ECREATE after
> > + * checking that the provided data for SECS meets the expectations of ECREATE
> > + * for an uninitialized enclave and size of the address space does not surpass the
> > + * platform expectations. This validation is done by sgx_validate_secs().
> > + *
> > + * Return:
> > + * 0 on success,
> > + * -errno otherwise
> > + */
> > +static long sgx_ioc_enclave_create(struct sgx_encl *encl, void __user *arg)
> > +{
> > + struct sgx_enclave_create ecreate;
> > + struct page *secs_page;
> > + struct sgx_secs *secs;
> > + int ret;
> > +
> > + if (atomic_read(&encl->flags) & SGX_ENCL_CREATED)
> > + return -EINVAL;
> > +
> > + if (copy_from_user(&ecreate, arg, sizeof(ecreate)))
> > + return -EFAULT;
> > +
> > + secs_page = alloc_page(GFP_KERNEL);
> > + if (!secs_page)
> > + return -ENOMEM;
> > +
> > + secs = kmap(secs_page);
>
> GFP_KERNEL pages are in low memory and don't need to be kmap()'d.
>
> This can just be:
>
> secs = __get_free_page(GFP_KERNEL);
> if (copy_from_user(secs, (void __user *)ecreate.src,...
>
> and forget about the kmapping. You also need to change __free_pages()
> to free_pages().
>
> The other alternative would be to just kmalloc() it. kmalloc()
> guarantees alignment in a stronger way than it used to.
Right, I'll change this, makes sense.
>
> > + if (copy_from_user(secs, (void __user *)ecreate.src, sizeof(*secs))) {
> > + ret = -EFAULT;
> > + goto out;
> > + }
> > +
> > + ret = sgx_encl_create(encl, secs);
> > +
> > +out:
> > + kunmap(secs_page);
> > + __free_page(secs_page);
> > + return ret;
> > +}
> > +
> > +long sgx_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
> > +{
> > + struct sgx_encl *encl = filep->private_data;
> > + int ret, encl_flags;
> > +
> > + encl_flags = atomic_fetch_or(SGX_ENCL_IOCTL, &encl->flags);
> > + if (encl_flags & SGX_ENCL_IOCTL)
> > + return -EBUSY;
>
> Is the SGX_ENCL_IOCTL bit essentially just a lock to single-thread
> ioctl()s? Should we name it as such?
Yes. It makes the concurrency overally easier if we can assume that
only a single ioctl is in progress. There is no good reason to do
them in parallel.
E.g. when you add pages you want to do that serially because the
order changes the MRENCLAVE.
So should I rename it as SGX_ENCL_IOCTL_LOCKED?
> > + if (encl_flags & SGX_ENCL_DEAD) {
> > + ret = -EFAULT;
> > + goto out;
> > + }
> > +
> > + switch (cmd) {
> > + case SGX_IOC_ENCLAVE_CREATE:
> > + ret = sgx_ioc_enclave_create(encl, (void __user *)arg);
> > + break;
> > + default:
> > + ret = -ENOIOCTLCMD;
> > + break;
> > + }
> > +
> > +out:
> > + atomic_andnot(SGX_ENCL_IOCTL, &encl->flags);
> > + return ret;
> > +}
> >
>
/Jarkko
On Fri, Oct 16, 2020 at 02:04:05PM -0700, Dave Hansen wrote:
> On 10/2/20 9:50 PM, Jarkko Sakkinen wrote:
> > +INTEL SGX
> > +M: Jarkko Sakkinen <[email protected]>
> > +M: Sean Christopherson <[email protected]>
> > +L: [email protected]
> > +S: Maintained
>
> Should be Supported, not Maintained.
Thanks, fixed.
/Jarkko
On Sun, Oct 18, 2020 at 08:03:11AM +0300, Jarkko Sakkinen wrote:
> > > + mmap_read_lock(current->mm);
> > > + mutex_lock(&encl->lock);
> > > +
> > > + /*
> > > + * Insert prior to EADD in case of OOM.
> >
> > I wouldn't say OOM. Maybe:
> >
> > xa_insert() and EADD can both fail. But xa_insert() is easier
> > to unwind so do it first.
> >
> > > EADD modifies MRENCLAVE, i.e.
> >
> > What is MRENCLAVE?
>
> The measurement stored in SECS. I'm wondering with xarray, is it
> possible to preallocate entry without inserting anything?
>
> Then we could get rid of this unwind and also would not need to
> take encl->lock in sgx_encl_may_map().
I'm still a bit confused with the unfamiliar Xarray API but I think I
got it:
1. xa_insert() with a NULL entry reserves index and more importantly
does the memory allocation.
2. xa_cmpxchg() with the enclave page, if EADD and EEXTEND's succceed.
3. xa_release() otherwise.
This way sgx_encl_may_map() will never see a stale enclave page when it
does the permission check, even if encl->lock is not taken.
I mean right now I have to take both xas lock and enclave lock, which
is terrible but this will take care of it.
I will rewrite the comment to something more reasonable, once I've done
this code change.
The reason for doing insert first is that, if we get -ENOMEM after
successful EADD and EEXTEND's we have a legit microarchitectural state
but you cannot rollback a hash (MRENCLAVE), so game is anyway over
because your data structures are not in sync.
If -ENOMEM comes before, everything is still in sync and we don't have
invalidate the enclave.
/Jarkko
On Mon, Oct 19, 2020 at 07:30:32AM -0700, Dave Hansen wrote:
> On 10/2/20 9:50 PM, Jarkko Sakkinen wrote:
> > +/**
> > + * encls_failed() - Check if an ENCLS leaf function failed
> > + * @ret: the return value of an ENCLS leaf function call
> > + *
> > + * Check if an ENCLS leaf function failed. This happens when the leaf function
> > + * causes a fault that is not caused by an EPCM conflict or when the leaf
> > + * function returns a non-zero value.
> > + */
> > +static inline bool encls_failed(int ret)
> > +{
> > + int epcm_trapnr;
> > +
> > + if (boot_cpu_has(X86_FEATURE_SGX2))
> > + epcm_trapnr = X86_TRAP_PF;
> > + else
> > + epcm_trapnr = X86_TRAP_GP;
>
> So, the SDM makes it sound like the only thing that changes from
> SGX1->SGX2 is the ENCLS leafs supported. Since the kernel doesn't use
> any SGX2 leaf functions, this would imply there is some other
> architecture change which is visible. *But* I don't see any evidence of
> this in the SDM, at least from a quick scan.
>
> Why is this here?
SGX1 CPUs take an erratum on the #PF behavior, e.g. "KBW90 Violation of Intel
SGX Access-Control Requirements Produce #GP Instead of #PF".
https://www.intel.com/content/dam/www/public/us/en/documents/specification-updates/xeon-e3-1200v6-spec-update.pdf
> > + if (ret & ENCLS_FAULT_FLAG)
> > + return ENCLS_TRAPNR(ret) != epcm_trapnr;
> > +
> > + return !!ret;
> > +}
>
>
On 10/2/20 9:50 PM, Jarkko Sakkinen wrote:
> +/**
> + * encls_failed() - Check if an ENCLS leaf function failed
> + * @ret: the return value of an ENCLS leaf function call
> + *
> + * Check if an ENCLS leaf function failed. This happens when the leaf function
> + * causes a fault that is not caused by an EPCM conflict or when the leaf
> + * function returns a non-zero value.
> + */
> +static inline bool encls_failed(int ret)
> +{
> + int epcm_trapnr;
> +
> + if (boot_cpu_has(X86_FEATURE_SGX2))
> + epcm_trapnr = X86_TRAP_PF;
> + else
> + epcm_trapnr = X86_TRAP_GP;
So, the SDM makes it sound like the only thing that changes from
SGX1->SGX2 is the ENCLS leafs supported. Since the kernel doesn't use
any SGX2 leaf functions, this would imply there is some other
architecture change which is visible. *But* I don't see any evidence of
this in the SDM, at least from a quick scan.
Why is this here?
> + if (ret & ENCLS_FAULT_FLAG)
> + return ENCLS_TRAPNR(ret) != epcm_trapnr;
> +
> + return !!ret;
> +}
On 10/19/20 10:38 AM, Sean Christopherson wrote:
>>> +static inline bool encls_failed(int ret)
>>> +{
>>> + int epcm_trapnr;
>>> +
>>> + if (boot_cpu_has(X86_FEATURE_SGX2))
>>> + epcm_trapnr = X86_TRAP_PF;
>>> + else
>>> + epcm_trapnr = X86_TRAP_GP;
>> So, the SDM makes it sound like the only thing that changes from
>> SGX1->SGX2 is the ENCLS leafs supported. Since the kernel doesn't use
>> any SGX2 leaf functions, this would imply there is some other
>> architecture change which is visible. *But* I don't see any evidence of
>> this in the SDM, at least from a quick scan.
>>
>> Why is this here?
> SGX1 CPUs take an erratum on the #PF behavior, e.g. "KBW90 Violation of Intel
> SGX Access-Control Requirements Produce #GP Instead of #PF".
>
> https://www.intel.com/content/dam/www/public/us/en/documents/specification-updates/xeon-e3-1200v6-spec-update.pdf
OK, but that's only for "Intel ® Xeon ® E3-1200 v6 Processor Family",
specifically stepping B-0. That's far from a broad erratum. I *see* it
in other errata lists, but I still think this is too broad.
Also, what if a hypervisor masks the SGX2 cpuid bit on SGX2-capable
hardware? Won't the hardware still exhibit the erratum?
I don't think we can control model-specific errata behavior with an
architectural CPUID bit.
On Mon, Oct 19, 2020 at 10:48:35AM -0700, Dave Hansen wrote:
> On 10/19/20 10:38 AM, Sean Christopherson wrote:
> >>> +static inline bool encls_failed(int ret)
> >>> +{
> >>> + int epcm_trapnr;
> >>> +
> >>> + if (boot_cpu_has(X86_FEATURE_SGX2))
> >>> + epcm_trapnr = X86_TRAP_PF;
> >>> + else
> >>> + epcm_trapnr = X86_TRAP_GP;
> >> So, the SDM makes it sound like the only thing that changes from
> >> SGX1->SGX2 is the ENCLS leafs supported. Since the kernel doesn't use
> >> any SGX2 leaf functions, this would imply there is some other
> >> architecture change which is visible. *But* I don't see any evidence of
> >> this in the SDM, at least from a quick scan.
> >>
> >> Why is this here?
> > SGX1 CPUs take an erratum on the #PF behavior, e.g. "KBW90 Violation of Intel
> > SGX Access-Control Requirements Produce #GP Instead of #PF".
> >
> > https://www.intel.com/content/dam/www/public/us/en/documents/specification-updates/xeon-e3-1200v6-spec-update.pdf
>
> OK, but that's only for "Intel ? Xeon ? E3-1200 v6 Processor Family",
> specifically stepping B-0. That's far from a broad erratum. I *see* it
> in other errata lists, but I still think this is too broad.
>
> Also, what if a hypervisor masks the SGX2 cpuid bit on SGX2-capable
> hardware? Won't the hardware still exhibit the erratum?
>
> I don't think we can control model-specific errata behavior with an
> architectural CPUID bit.
Hmm, true. Checking for #PF _or_ #GP on SGX1 CPUs would be my first choice.
ENCLS #GPs for other reasons, most of which would indicate a kernel bug. It'd
be nice to limit the "#GP is expected, sort of" behavior to CPUs that might be
affected by an erratum.
On 10/19/20 10:53 AM, Sean Christopherson wrote:
>>> SGX1 CPUs take an erratum on the #PF behavior, e.g. "KBW90 Violation of Intel
>>> SGX Access-Control Requirements Produce #GP Instead of #PF".
>>>
>>> https://www.intel.com/content/dam/www/public/us/en/documents/specification-updates/xeon-e3-1200v6-spec-update.pdf
>> OK, but that's only for "Intel ® Xeon ® E3-1200 v6 Processor Family",
>> specifically stepping B-0. That's far from a broad erratum. I *see* it
>> in other errata lists, but I still think this is too broad.
>>
>> Also, what if a hypervisor masks the SGX2 cpuid bit on SGX2-capable
>> hardware? Won't the hardware still exhibit the erratum?
>>
>> I don't think we can control model-specific errata behavior with an
>> architectural CPUID bit.
> Hmm, true. Checking for #PF _or_ #GP on SGX1 CPUs would be my first choice.
> ENCLS #GPs for other reasons, most of which would indicate a kernel bug. It'd
> be nice to limit the "#GP is expected, sort of" behavior to CPUs that might be
> affected by an erratum.
Yes, agreed.
We need a model/family/stepping list of all the affected CPUs, and a
normal old match_cpu() or whatever. If a hypervisor lies about
model/family/stepping, then the fallout is on them, not the guest.
On Mon, Oct 19, 2020 at 01:21:09PM -0700, Dave Hansen wrote:
> On 10/17/20 9:26 PM, Jarkko Sakkinen wrote:
> >>> +long sgx_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
> >>> +{
> >>> + struct sgx_encl *encl = filep->private_data;
> >>> + int ret, encl_flags;
> >>> +
> >>> + encl_flags = atomic_fetch_or(SGX_ENCL_IOCTL, &encl->flags);
> >>> + if (encl_flags & SGX_ENCL_IOCTL)
> >>> + return -EBUSY;
> >>
> >> Is the SGX_ENCL_IOCTL bit essentially just a lock to single-thread
> >> ioctl()s? Should we name it as such?
> >
> > Yes. It makes the concurrency overally easier if we can assume that
> > only a single ioctl is in progress. There is no good reason to do
> > them in parallel.
> >
> > E.g. when you add pages you want to do that serially because the
> > order changes the MRENCLAVE.
>
> There are also hardware concurrency requirements, right? A bunch of the
> SGX functions seem not not even support being called in parallel.
Yes, and the driver, even when "holding" SGX_ENCL_IOCTL, takes encl->lock
when executing an ENCLS leaf. The separate IOCTL flag avoids complications
with reclaim, specifically it allows the ioctls to initiate reclaim without
hitting a deadlock.
Reclaim needs to take encl->lock, e.g. to do ENCLS[EBLOCK], and reclaim is by
default initiated during allocation if there are no pages available. I.e. if
an ioctl() simply held encl->lock, it would deadlock in the scenario where it
triggered reclaim on the current enclave.
In other words, the flag is necessary even if it weren't being used a lock
primitive, e.g. it'd still need to exist even if encl->lock were taken to set
and check the flag. The atomic shenanigans were added as an optimization to
allow reclaim in parallel with the bulk of the ioctl flows, and partly because
using atomic_fetch_or() avoided having to drop encl->lock in an error flow,
i.e. yielded less code.
> > So should I rename it as SGX_ENCL_IOCTL_LOCKED?
>
> I'd rather not see hand-rolled locking primitives frankly.
IOCTL_IN_PROGRESS would be my vote if we want a more descriptive name.
On Mon, Oct 19, 2020 at 01:48:32PM -0700, Dave Hansen wrote:
> On 10/17/20 10:03 PM, Jarkko Sakkinen wrote:
> >>> + if (ret) {
> >>> + if (encls_failed(ret))
> >>> + ENCLS_WARN(ret, "EEXTEND");
> >>> + return -EIO;
> >>
> >> How frequent should we expect these to be? Can users cause them? You
> >> should *proably* call it ENCLS_WARN_ONCE() if it's implemented that way.
Ya, it's implemented using WARN_ONCE. It doesn't append _ONCE mostly to avoid
unnecessary verbosity, e.g. there's no existing SGX code that uses vanilla
WARN, nor does it seem likely that there will ever be a case where using WARN
is justified.
> > If power cycle happens.
>
> So, we get one warning per power cycle? Practically, do you mean a
> suspend/resume cycle, or is this more like hibernation-to-disk-resume?
>
> In any case, if this is normal system operation (which closing my laptop
> lid qualifies as), it should produce zero warnings.
encls_failed() filters out EPCM faults (which, by the by, is why the kernel
cares about that #GP vs. #PF erratum). So what you describe is the implemented
behavior, i.e. WARNs are triggerable if and only if there is a hardware or
kernel bug.
FWIW, I prefer burying the encls_failed() logic in ENCLS_WARN. encls_failed()
is only used to gate ENCLS_WARN, and ENCLS_WARN is always wrapped with
encls_failed() excepted for EREMOVE. The only downside to applying the logic
to EREMOVE is that it could theoretically suppress kernel bugs on CPUs that are
subject to the #GP instead of #PF errata.
> >>> +static int sgx_encl_add_page(struct sgx_encl *encl, unsigned long src,
> >>> + unsigned long offset, struct sgx_secinfo *secinfo,
> >>> + unsigned long flags)
> >>> +{
> >>> + struct sgx_encl_page *encl_page;
> >>> + struct sgx_epc_page *epc_page;
> >>> + int ret;
> >>> +
> >>> + encl_page = sgx_encl_page_alloc(encl, offset, secinfo->flags);
> >>> + if (IS_ERR(encl_page))
> >>> + return PTR_ERR(encl_page);
> >>> +
> >>> + epc_page = __sgx_alloc_epc_page();
> >>> + if (IS_ERR(epc_page)) {
> >>> + kfree(encl_page);
> >>> + return PTR_ERR(epc_page);
> >>> + }
> >>
> >> Looking at these, I'm forgetting why we need to both allocate an
> >> encl_page and an epc_page. Commends might remind me. So would better
> >> names.
> >
> > Should the struct names be renamed?
> >
> > Like sgx_phys_epc_page and sgx_virt_epc_page?
>
> "epc" is additional acronym nonsense and redundant with "sgx" and "page"
> anyway.
>
> I'd probably call then 'sgx_phys_page' and 'sgx_virt_slot' or something.
I don't too much deeply about whether or not sgx_encl_page is renamed, but I
would very strongly prefer keeping sgx_epc_page. Nearly all of the SGX
literature refers to the physical pages residing in the EPC as "EPC pages".
IMO, the "sgx" is the somewhat superfluous part that is tacked on to add
namespacing in case of collisions with "epc".
> >>> + mmap_read_lock(current->mm);
> >>> + mutex_lock(&encl->lock);
> >>> +
> >>> + /*
> >>> + * Insert prior to EADD in case of OOM.
> >>> + if (copy_from_user(&addp, arg, sizeof(addp)))
> >>> + return -EFAULT;
> >>> +
> >>> + if (!IS_ALIGNED(addp.offset, PAGE_SIZE) ||
> >>> + !IS_ALIGNED(addp.src, PAGE_SIZE))
> >>> + return -EINVAL;
> >>> +
> >>> + if (!(access_ok(addp.src, PAGE_SIZE)))
> >>> + return -EFAULT;
> >>
> >> This worries me. You're doing an access_ok() check on addp.src because
> >> you evidently don't trust it. But, below, it looks to be accessed
> >> directly with an offset, bound by addp.length, which I think can be
> >>> PAGE_SIZE.
> >>
> >> I'd feel a lot better if addp.src's value was being passed around as a
> >> __user pointer.
> >
> > I'm not sure if that call is even needed. Each page is pinned with
> > get_user_pages(). AFAIK, it should be enough. This must be legacy cruft.
>
> get_user_pages() and access_ok() do *very* different things. Even if
> the pages are pinned, you might still be tricked into referencing off
> the end of the page, or up into the kernel address space.
>
> >>> + if (addp.length & (PAGE_SIZE - 1))
> >>> + return -EINVAL;
> >>> +
> >>> + if (addp.offset + addp.length - PAGE_SIZE >= encl->size)
> >>> + return -EINVAL;
> >>> +
> >>> + if (copy_from_user(&secinfo, (void __user *)addp.secinfo,
> >>> + sizeof(secinfo)))
> >>> + return -EFAULT;
> >>> +
> >>> + if (sgx_validate_secinfo(&secinfo))
> >>> + return -EINVAL;
> >>> +
> >>> + for (c = 0 ; c < addp.length; c += PAGE_SIZE) {
> >>> + if (signal_pending(current)) {
> >>> + if (!c)
> >>> + ret = -ERESTARTSYS;
> >>> +
> >>> + break;
> >>> + }
> >>> +
> >>> + if (c == SGX_MAX_ADD_PAGES_LENGTH)
> >>> + break;
> >>> +
> >>> + if (need_resched())
> >>> + cond_resched();
> >>> +
> >>> + ret = sgx_encl_add_page(encl, addp.src + c, addp.offset + c,
> >>> + &secinfo, addp.flags);
> >>
> >> Yeah... Don't we need to do another access_ok() check here, if we
> >> needed one above since we are moving away from addrp.src?
> >
> > I don't think so because the page is pinned with get_user_pages().
>
> No, get_user_pages() is orthogonal.
>
> Looking at this again, you _might_ be OK since you validated addp.length
> against encl->size. But, it's all very convoluted and doesn't look very
> organized or obviously right.
The easiest fix would be to have the existing access_ok() check the entire
range, no? Or am I missing something obvious?
On 10/19/20 2:15 PM, Sean Christopherson wrote:
>>>> Yeah... Don't we need to do another access_ok() check here, if we
>>>> needed one above since we are moving away from addrp.src?
>>> I don't think so because the page is pinned with get_user_pages().
>> No, get_user_pages() is orthogonal.
>>
>> Looking at this again, you _might_ be OK since you validated addp.length
>> against encl->size. But, it's all very convoluted and doesn't look very
>> organized or obviously right.
> The easiest fix would be to have the existing access_ok() check the entire
> range, no? Or am I missing something obvious?
In general, I want the actual userspace access to be as close as
possible and 1:1 with the access_ok() checks. That way, it's blatantly
obvious that the pointers have been checked.
*But* get_user_pages() has access_ok() checks inside of its
implementation, which makes sense. *But*, that begs the question of
what the top-level one was doing in the first place. Maybe it was just
superfluous.
Either way, it still doesn't explain what this is doing:
> + ret = get_user_pages(src, 1, 0, &src_page, NULL);
> + if (ret < 1)
> + return -EFAULT;
> +
> + pginfo.secs = (unsigned long)sgx_get_epc_addr(encl->secs.epc_page);
> + pginfo.addr = SGX_ENCL_PAGE_ADDR(encl_page);
> + pginfo.metadata = (unsigned long)secinfo;
> + pginfo.contents = (unsigned long)kmap_atomic(src_page);
> +
> + ret = __eadd(&pginfo, sgx_get_epc_addr(epc_page));
> +
> + kunmap_atomic((void *)pginfo.contents);
I think the point is to create a stable kernel alias address for
'src_page' so that any mucking with the userspace mapping doesn't screw
up the __eadd() and any failures aren't due to reclaim or MADV_DONTNEED.
If this isn't even touching the userspace mapping, it didn't need
access_ok() in the first place.
On 10/17/20 9:26 PM, Jarkko Sakkinen wrote:
...
>>> +static int sgx_validate_secs(const struct sgx_secs *secs)
>>> +{
>>
>> What's the overall point of this function? Does it avoid a #GP from an
>> instruction later?
>>
>> Does all of the 'secs' content come from userspace?
>
> Yes it does avoid #GP, and all the data comes from the user space.
Please comment the function to indicate this.
But, in general, why do we care to avoid a #GP? Is it just because we
don't have infrastructure in-kernel to suppress the resulting panic()?
>>> + u64 max_size = (secs->attributes & SGX_ATTR_MODE64BIT) ?
>>> + sgx_encl_size_max_64 : sgx_encl_size_max_32;
>>> +
>>> + if (secs->size < (2 * PAGE_SIZE) || !is_power_of_2(secs->size))
>>> + return -EINVAL;
>>> +
>>> + if (secs->base & (secs->size - 1))
>>> + return -EINVAL;
>>> +
>>> + if (secs->miscselect & sgx_misc_reserved_mask ||
>>> + secs->attributes & sgx_attributes_reserved_mask ||
>>> + secs->xfrm & sgx_xfrm_reserved_mask)
>>> + return -EINVAL;
>>> +
>>> + if (secs->size > max_size)
>>> + return -EINVAL;
>>> +
>>> + if (!(secs->xfrm & XFEATURE_MASK_FP) ||
>>> + !(secs->xfrm & XFEATURE_MASK_SSE) ||
>>> + (((secs->xfrm >> XFEATURE_BNDREGS) & 1) != ((secs->xfrm >> XFEATURE_BNDCSR) & 1)))
>>> + return -EINVAL;
>>> +
>>> + if (!secs->ssa_frame_size)
>>> + return -EINVAL;
>>> +
>>> + if (sgx_calc_ssa_frame_size(secs->miscselect, secs->xfrm) > secs->ssa_frame_size)
>>> + return -EINVAL;
>>> +
>>> + if (memchr_inv(secs->reserved1, 0, sizeof(secs->reserved1)) ||
>>> + memchr_inv(secs->reserved2, 0, sizeof(secs->reserved2)) ||
>>> + memchr_inv(secs->reserved3, 0, sizeof(secs->reserved3)) ||
>>> + memchr_inv(secs->reserved4, 0, sizeof(secs->reserved4)))
>>> + return -EINVAL;
>>> +
>>> + return 0;
>>> +}
>>
>> I think it would be nice to at least have one comment per condition to
>> explain what's going on there.
...
>>> +static int sgx_encl_create(struct sgx_encl *encl, struct sgx_secs *secs)
>>> +{
>>> + struct sgx_epc_page *secs_epc;
>>> + struct sgx_pageinfo pginfo;
>>> + struct sgx_secinfo secinfo;
>>> + unsigned long encl_size;
>>> + struct file *backing;
>>> + long ret;
>>> +
>>> + if (sgx_validate_secs(secs)) {
>>> + pr_debug("invalid SECS\n");
>>> + return -EINVAL;
>>> + }
>>> +
>>> + /* The extra page goes to SECS. */
>>> + encl_size = secs->size + PAGE_SIZE;
>>> +
>>> + backing = shmem_file_setup("SGX backing", encl_size + (encl_size >> 5),
>>> + VM_NORESERVE);
>>
>> What's the >>5 adjustment for?
>
> The backing storage stores not only the swapped page but also
> Paging Crypto MetaData (PCMD) structure. It essentially contains
> a CPU encrypted MAC for a page.
>
> The MAC is over page version and data. The version is stored in
> a EPC page called Version Array (VA) page.
>
> Both of these are needed by ENCLS[ELDU].
/*
* SGX backing storage needs to contain space for both the
* EPC data and some metadata called the Paging Crypto
* MetaData (PCMD). The PCMD needs 128b of storage for each
* page.
*/
Also, the MAC is a fixed size, right? Let's say that x86 got a larger
page size in the future. Would this number be 128b or PAGE_SIZE/32?
If it's a fixed size, I'd write:
size = encl_size;
size += (encl_size / PAGE_SIZE) * SGX_PCPD_PER_PAGE;
If it really is 1/32nd, I'd write
size += encl_size / SGX_PCPD_RATIO;
or something.
Either way, the >>5 is total magic and needs comments and fixing.
>>> +long sgx_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
>>> +{
>>> + struct sgx_encl *encl = filep->private_data;
>>> + int ret, encl_flags;
>>> +
>>> + encl_flags = atomic_fetch_or(SGX_ENCL_IOCTL, &encl->flags);
>>> + if (encl_flags & SGX_ENCL_IOCTL)
>>> + return -EBUSY;
>>
>> Is the SGX_ENCL_IOCTL bit essentially just a lock to single-thread
>> ioctl()s? Should we name it as such?
>
> Yes. It makes the concurrency overally easier if we can assume that
> only a single ioctl is in progress. There is no good reason to do
> them in parallel.
>
> E.g. when you add pages you want to do that serially because the
> order changes the MRENCLAVE.
There are also hardware concurrency requirements, right? A bunch of the
SGX functions seem not not even support being called in parallel.
> So should I rename it as SGX_ENCL_IOCTL_LOCKED?
I'd rather not see hand-rolled locking primitives frankly.
On 10/17/20 10:03 PM, Jarkko Sakkinen wrote:
> On Fri, Oct 16, 2020 at 02:25:50PM -0700, Dave Hansen wrote:
>>> +/**
>>> + * struct sgx_enclave_add_pages - parameter structure for the
>>> + * %SGX_IOC_ENCLAVE_ADD_PAGE ioctl
>>> + * @src: start address for the page data
>>> + * @offset: starting page offset
>>
>> Is this the offset *within* the page? Might be nice to say that.
>
> It's the offset in the enclave address range where page is to be added.
Yikes, comment improvement needed, badly.
>>> +static struct sgx_encl_page *sgx_encl_page_alloc(struct sgx_encl *encl,
>>> + unsigned long offset,
>>> + u64 secinfo_flags)
>>> +{
>>> + struct sgx_encl_page *encl_page;
>>> + unsigned long prot;
>>> +
>>> + encl_page = kzalloc(sizeof(*encl_page), GFP_KERNEL);
>>> + if (!encl_page)
>>> + return ERR_PTR(-ENOMEM);
>>> +
>>> + encl_page->desc = encl->base + offset;
>>> + encl_page->encl = encl;
>>
>> Somewhere, we need an explanation of why we have 'sgx_epc_page' and
>> 'sgx_encl_page'. I think they're 1:1 at least after
>> sgx_encl_page_alloc(), so I'm wondering why we need two.
>
> You need sgx_encl_page to hold data that exists whether or not there is
> an associated EPC page.
Except they're currently tightly bound:
> encl_page = sgx_encl_page_alloc(encl, offset, secinfo->flags);
> if (IS_ERR(encl_page))
> return PTR_ERR(encl_page);
>
> - epc_page = __sgx_alloc_epc_page();
> + epc_page = sgx_alloc_epc_page(encl_page, true);
> if (IS_ERR(epc_page)) {
> kfree(encl_page);
> return PTR_ERR(epc_page);
> }
So, is this because 'sgx_encl_page' continues to exist even if
'sgx_epc_page' is reclaimed?
> Essentially sgx_encl_page contains the data needed for a virtual page,
> and sgx_epc_page what is needed to represent physical page.
So, grumble grumble, that's horribly inefficient for sparse mappings.
There's a reason VMAs cover ranges instead of being allocated
per-virtual-page.
> None of the data contained in sgx_encl_page make sense for sgx_epc_page.
> They don't contain intersecting or redundant data.
Yeah, except they point to each other, so if one isn't necessary, we can
get rid of that pointer.
>>> +static int __sgx_encl_add_page(struct sgx_encl *encl,
>>> + struct sgx_encl_page *encl_page,
>>> + struct sgx_epc_page *epc_page,
>>> + struct sgx_secinfo *secinfo, unsigned long src)
>>> +{
>>> + struct sgx_pageinfo pginfo;
>>> + struct vm_area_struct *vma;
>>> + struct page *src_page;
>>> + int ret;
>>> +
>>> + /* Deny noexec. */
>>> + vma = find_vma(current->mm, src);
>>> + if (!vma)
>>> + return -EFAULT;
>>> +
>>> + if (!(vma->vm_flags & VM_MAYEXEC))
>>> + return -EACCES;
>>> +
>>> + ret = get_user_pages(src, 1, 0, &src_page, NULL);
>>> + if (ret < 1)
>>> + return -EFAULT;
>>> +
>>> + pginfo.secs = (unsigned long)sgx_get_epc_addr(encl->secs.epc_page);
>>> + pginfo.addr = SGX_ENCL_PAGE_ADDR(encl_page);
>>> + pginfo.metadata = (unsigned long)secinfo;
>>> + pginfo.contents = (unsigned long)kmap_atomic(src_page);
>>> +
>>> + ret = __eadd(&pginfo, sgx_get_epc_addr(epc_page));
>>
>> Could you convince me that EADD is not going to fault and make the
>> kmap_atomic() mad?
>
> It can legitly fail in the case when power cycle happens.
>
> That's why the inline assembly catches faults and return an error code.
> Thhis code has been field tested a lot. I have fairly good trust on
> it.
OK, so it can fault, but not *sleep*.
Can you comment it to that effect, please?
>>> + if (ret) {
>>> + if (encls_failed(ret))
>>> + ENCLS_WARN(ret, "EEXTEND");
>>> + return -EIO;
>>
>> How frequent should we expect these to be? Can users cause them? You
>> should *proably* call it ENCLS_WARN_ONCE() if it's implemented that way.
>
> If power cycle happens.
So, we get one warning per power cycle? Practically, do you mean a
suspend/resume cycle, or is this more like hibernation-to-disk-resume?
In any case, if this is normal system operation (which closing my laptop
lid qualifies as), it should produce zero warnings.
>>> +static int sgx_encl_add_page(struct sgx_encl *encl, unsigned long src,
>>> + unsigned long offset, struct sgx_secinfo *secinfo,
>>> + unsigned long flags)
>>> +{
>>> + struct sgx_encl_page *encl_page;
>>> + struct sgx_epc_page *epc_page;
>>> + int ret;
>>> +
>>> + encl_page = sgx_encl_page_alloc(encl, offset, secinfo->flags);
>>> + if (IS_ERR(encl_page))
>>> + return PTR_ERR(encl_page);
>>> +
>>> + epc_page = __sgx_alloc_epc_page();
>>> + if (IS_ERR(epc_page)) {
>>> + kfree(encl_page);
>>> + return PTR_ERR(epc_page);
>>> + }
>>
>> Looking at these, I'm forgetting why we need to both allocate an
>> encl_page and an epc_page. Commends might remind me. So would better
>> names.
>
> Should the struct names be renamed?
>
> Like sgx_phys_epc_page and sgx_virt_epc_page?
"epc" is additional acronym nonsense and redundant with "sgx" and "page"
anyway.
I'd probably call then 'sgx_phys_page' and 'sgx_virt_slot' or something.
>>> + mmap_read_lock(current->mm);
>>> + mutex_lock(&encl->lock);
>>> +
>>> + /*
>>> + * Insert prior to EADD in case of OOM.
>>
>> I wouldn't say OOM. Maybe:
>>
>> xa_insert() and EADD can both fail. But xa_insert() is easier
>> to unwind so do it first.
>>
>>> EADD modifies MRENCLAVE, i.e.
>>
>> What is MRENCLAVE?
>
> The measurement stored in SECS. I'm wondering with xarray, is it
> possible to preallocate entry without inserting anything?
Let's use plain english here. I don't care what the implementation
does, I just care about what it means to the kernel.
> Then we could get rid of this unwind and also would not need to
> take encl->lock in sgx_encl_may_map().
There was for radix trees, iirc.
>>> + * can't be gracefully unwound, while failure on EADD/EXTEND is limited
>>> + * to userspace errors (or kernel/hardware bugs).
>>> + */
>>> + ret = xa_insert(&encl->page_array, PFN_DOWN(encl_page->desc),
>>> + encl_page, GFP_KERNEL);
>>> + if (ret)
>>> + goto err_out_unlock;
>>> +
>>> + ret = __sgx_encl_add_page(encl, encl_page, epc_page, secinfo,
>>> + src);
>>> + if (ret)
>>> + goto err_out;
>>> +
>>> + /*
>>> + * Complete the "add" before doing the "extend" so that the "add"
>>> + * isn't in a half-baked state in the extremely unlikely scenario
>>> + * the enclave will be destroyed in response to EEXTEND failure.
>>> + */
>>> + encl_page->encl = encl;
>>> + encl_page->epc_page = epc_page;
>>> + encl->secs_child_cnt++;
>>> +
>>> + if (flags & SGX_PAGE_MEASURE) {
>>> + ret = __sgx_encl_extend(encl, epc_page);
>>> + if (ret)
>>> + goto err_out;
>>> + }
>>
>> Why would we never *not* measure an added page?
>
> You might add Thread Control Structure pages without measuring them or
> data area. There are reasons for the user space not to have everything
> measured.
This is also good comment fodder.
>>> +static long sgx_ioc_enclave_add_pages(struct sgx_encl *encl, void __user *arg)
>>> +{
>>> + struct sgx_enclave_add_pages addp;
>>> + struct sgx_secinfo secinfo;
>>> + unsigned long c;
>>> + int ret;
>>> +
>>> + if ((atomic_read(&encl->flags) & SGX_ENCL_INITIALIZED) ||
>>> + !(atomic_read(&encl->flags) & SGX_ENCL_CREATED))
>>> + return -EINVAL;
>>
>> There should to be a nice state machine documented somewhere. Is ther?
>
> So should I document to encl.h where they are declared to start with?
I think it's better placed in the Documentation/.
>>> + if (copy_from_user(&addp, arg, sizeof(addp)))
>>> + return -EFAULT;
>>> +
>>> + if (!IS_ALIGNED(addp.offset, PAGE_SIZE) ||
>>> + !IS_ALIGNED(addp.src, PAGE_SIZE))
>>> + return -EINVAL;
>>> +
>>> + if (!(access_ok(addp.src, PAGE_SIZE)))
>>> + return -EFAULT;
>>
>> This worries me. You're doing an access_ok() check on addp.src because
>> you evidently don't trust it. But, below, it looks to be accessed
>> directly with an offset, bound by addp.length, which I think can be
>>> PAGE_SIZE.
>>
>> I'd feel a lot better if addp.src's value was being passed around as a
>> __user pointer.
>
> I'm not sure if that call is even needed. Each page is pinned with
> get_user_pages(). AFAIK, it should be enough. This must be legacy cruft.
get_user_pages() and access_ok() do *very* different things. Even if
the pages are pinned, you might still be tricked into referencing off
the end of the page, or up into the kernel address space.
>>> + if (addp.length & (PAGE_SIZE - 1))
>>> + return -EINVAL;
>>> +
>>> + if (addp.offset + addp.length - PAGE_SIZE >= encl->size)
>>> + return -EINVAL;
>>> +
>>> + if (copy_from_user(&secinfo, (void __user *)addp.secinfo,
>>> + sizeof(secinfo)))
>>> + return -EFAULT;
>>> +
>>> + if (sgx_validate_secinfo(&secinfo))
>>> + return -EINVAL;
>>> +
>>> + for (c = 0 ; c < addp.length; c += PAGE_SIZE) {
>>> + if (signal_pending(current)) {
>>> + if (!c)
>>> + ret = -ERESTARTSYS;
>>> +
>>> + break;
>>> + }
>>> +
>>> + if (c == SGX_MAX_ADD_PAGES_LENGTH)
>>> + break;
>>> +
>>> + if (need_resched())
>>> + cond_resched();
>>> +
>>> + ret = sgx_encl_add_page(encl, addp.src + c, addp.offset + c,
>>> + &secinfo, addp.flags);
>>
>> Yeah... Don't we need to do another access_ok() check here, if we
>> needed one above since we are moving away from addrp.src?
>
> I don't think so because the page is pinned with get_user_pages().
No, get_user_pages() is orthogonal.
Looking at this again, you _might_ be OK since you validated addp.length
against encl->size. But, it's all very convoluted and doesn't look very
organized or obviously right.
So, this begs the question: What, exactly are the guarantees you are
expecting out of get_user_pages() here?
I also think it's an absolute requirement that if you're passing around
userspace pointers that you tag them as __user, not pass around as
unsigned longs.
> int __init sgx_drv_init(void)
> {
> unsigned int eax, ebx, ecx, edx;
> @@ -181,5 +192,12 @@ int __init sgx_drv_init(void)
> return ret;
> }
>
> + ret = misc_register(&sgx_dev_provision);
> + if (ret) {
> + pr_err("Creating /dev/sgx/provision failed with %d.\n", ret);
> + misc_deregister(&sgx_dev_enclave);
> + return ret;
> + }
> +
Isn't it a *bit* too specific to say that a device file failed to be
created? Do other misc devices use this kind of message?
On 10/2/20 9:50 PM, Jarkko Sakkinen wrote:
> + * Failure to explicitly request access to a restricted attribute will cause
> + * sgx_ioc_enclave_init() to fail. Currently, the only restricted attribute
> + * is access to the PROVISION_KEY.
Could we also justify why access is restricted, please? Maybe:
Access is restricted because PROVISION_KEY is burned uniquely
into each each processor, making it a perfect unique identifier
with privacy and fingerprinting implications.
Are there any other reasons for doing it this way?
On Mon, Oct 19, 2020 at 02:44:19PM -0700, Dave Hansen wrote:
> On 10/19/20 2:15 PM, Sean Christopherson wrote:
> >>>> Yeah... Don't we need to do another access_ok() check here, if we
> >>>> needed one above since we are moving away from addrp.src?
> >>> I don't think so because the page is pinned with get_user_pages().
> >> No, get_user_pages() is orthogonal.
> >>
> >> Looking at this again, you _might_ be OK since you validated addp.length
> >> against encl->size. But, it's all very convoluted and doesn't look very
> >> organized or obviously right.
> > The easiest fix would be to have the existing access_ok() check the entire
> > range, no? Or am I missing something obvious?
>
> In general, I want the actual userspace access to be as close as
> possible and 1:1 with the access_ok() checks. That way, it's blatantly
> obvious that the pointers have been checked.
>
> *But* get_user_pages() has access_ok() checks inside of its
> implementation, which makes sense. *But*, that begs the question of
> what the top-level one was doing in the first place. Maybe it was just
> superfluous.
>
> Either way, it still doesn't explain what this is doing:
I guess it is just history. Used to be one page ioctl.
> > + ret = get_user_pages(src, 1, 0, &src_page, NULL);
> > + if (ret < 1)
> > + return -EFAULT;
> > +
> > + pginfo.secs = (unsigned long)sgx_get_epc_addr(encl->secs.epc_page);
> > + pginfo.addr = SGX_ENCL_PAGE_ADDR(encl_page);
> > + pginfo.metadata = (unsigned long)secinfo;
> > + pginfo.contents = (unsigned long)kmap_atomic(src_page);
> > +
> > + ret = __eadd(&pginfo, sgx_get_epc_addr(epc_page));
> > +
> > + kunmap_atomic((void *)pginfo.contents);
>
> I think the point is to create a stable kernel alias address for
> 'src_page' so that any mucking with the userspace mapping doesn't screw
> up the __eadd() and any failures aren't due to reclaim or MADV_DONTNEED.
>
> If this isn't even touching the userspace mapping, it didn't need
> access_ok() in the first place.
The whole access_ok() check is just evolutionary cruft. I will remove
it.
/Jarkko
On Tue, Oct 20, 2020 at 08:48:54AM -0700, Dave Hansen wrote:
> > int __init sgx_drv_init(void)
> > {
> > unsigned int eax, ebx, ecx, edx;
> > @@ -181,5 +192,12 @@ int __init sgx_drv_init(void)
> > return ret;
> > }
> >
> > + ret = misc_register(&sgx_dev_provision);
> > + if (ret) {
> > + pr_err("Creating /dev/sgx/provision failed with %d.\n", ret);
> > + misc_deregister(&sgx_dev_enclave);
> > + return ret;
> > + }
> > +
>
> Isn't it a *bit* too specific to say that a device file failed to be
> created? Do other misc devices use this kind of message?
Before seeing this I had already removed it. It is incosistent at
least and quite useless error really. We have tracing tools for
this.
/Jarkko
On Tue, Oct 20, 2020 at 02:19:26PM -0700, Dave Hansen wrote:
> On 10/2/20 9:50 PM, Jarkko Sakkinen wrote:
> > + * Failure to explicitly request access to a restricted attribute will cause
> > + * sgx_ioc_enclave_init() to fail. Currently, the only restricted attribute
> > + * is access to the PROVISION_KEY.
>
> Could we also justify why access is restricted, please? Maybe:
>
> Access is restricted because PROVISION_KEY is burned uniquely
> into each each processor, making it a perfect unique identifier
> with privacy and fingerprinting implications.
>
> Are there any other reasons for doing it this way?
AFAIK, if I interperet the SDM correctl, PROVISION_KEY and
PROVISION_SEALING_KEY also have random salt added, i.e. they change
every boot cycle.
There is "RAND = yes" on those keys in Table 40-64 of Intel SDM volume
3D :-)
/Jarkko
On 2020-10-23 12:17, Jarkko Sakkinen wrote:
> On Tue, Oct 20, 2020 at 02:19:26PM -0700, Dave Hansen wrote:
>> On 10/2/20 9:50 PM, Jarkko Sakkinen wrote:
>>> + * Failure to explicitly request access to a restricted attribute will cause
>>> + * sgx_ioc_enclave_init() to fail. Currently, the only restricted attribute
>>> + * is access to the PROVISION_KEY.
>>
>> Could we also justify why access is restricted, please? Maybe:
>>
>> Access is restricted because PROVISION_KEY is burned uniquely
>> into each each processor, making it a perfect unique identifier
>> with privacy and fingerprinting implications.
>>
>> Are there any other reasons for doing it this way?
>
> AFAIK, if I interperet the SDM correctl, PROVISION_KEY and
> PROVISION_SEALING_KEY also have random salt added, i.e. they change
> every boot cycle.
>
> There is "RAND = yes" on those keys in Table 40-64 of Intel SDM volume
> 3D :-)
>
This is nonsense. The whole point of sealing keys is that they don't change every boot. If did they they'd have no value over enclave memory. RAND means that the KEYID field from the KEYREQUEST is included in the derivation (as noted in the source row of the table you looked at).
--
Jethro Beekman | Fortanix
On 10/23/20 3:17 AM, Jarkko Sakkinen wrote:
> On Tue, Oct 20, 2020 at 02:19:26PM -0700, Dave Hansen wrote:
>> On 10/2/20 9:50 PM, Jarkko Sakkinen wrote:
>>> + * Failure to explicitly request access to a restricted attribute will cause
>>> + * sgx_ioc_enclave_init() to fail. Currently, the only restricted attribute
>>> + * is access to the PROVISION_KEY.
>> Could we also justify why access is restricted, please? Maybe:
>>
>> Access is restricted because PROVISION_KEY is burned uniquely
>> into each each processor, making it a perfect unique identifier
>> with privacy and fingerprinting implications.
>>
>> Are there any other reasons for doing it this way?
> AFAIK, if I interperet the SDM correctl, PROVISION_KEY and
> PROVISION_SEALING_KEY also have random salt added, i.e. they change
> every boot cycle.
>
> There is "RAND = yes" on those keys in Table 40-64 of Intel SDM volume
> 3D :-)
Does that mean there are no privacy implications from access to the
provisioning keys? If that's true, why do we need a separate permission
framework for creating provisioning enclaves?
On Fri, Oct 23, 2020 at 07:19:05AM -0700, Dave Hansen wrote:
> On 10/23/20 3:17 AM, Jarkko Sakkinen wrote:
> > On Tue, Oct 20, 2020 at 02:19:26PM -0700, Dave Hansen wrote:
> >> On 10/2/20 9:50 PM, Jarkko Sakkinen wrote:
> >>> + * Failure to explicitly request access to a restricted attribute will cause
> >>> + * sgx_ioc_enclave_init() to fail. Currently, the only restricted attribute
> >>> + * is access to the PROVISION_KEY.
> >> Could we also justify why access is restricted, please? Maybe:
> >>
> >> Access is restricted because PROVISION_KEY is burned uniquely
> >> into each each processor, making it a perfect unique identifier
> >> with privacy and fingerprinting implications.
> >>
> >> Are there any other reasons for doing it this way?
> > AFAIK, if I interperet the SDM correctl, PROVISION_KEY and
> > PROVISION_SEALING_KEY also have random salt added, i.e. they change
> > every boot cycle.
> >
> > There is "RAND = yes" on those keys in Table 40-64 of Intel SDM volume
> > 3D :-)
>
> Does that mean there are no privacy implications from access to the
> provisioning keys? If that's true, why do we need a separate permission
> framework for creating provisioning enclaves?
As I've understood it, the key material for those keys is not even
required in the current SGX architecture, it was used in the legacy EPID
scheme, but the attribute itself is useful.
Let's assume that we have some sort of quoting enclave Q, which guards a
public key pair, which signs quotes of other enclaves. Let's assume we
have an attestation server A, which will enable some capabilities [*],
if it receives a quote signed with that public key pair.
1. E gets the report key with EGETKEY.
2. E constructs REPORTDATA (37.16) and TARGETINFO (37.17) structures.
The former describes the enclaves contents and attributes and latter
the target, i.e. Q in this artitificial example.
3. E calls EREPORT to generate a structure called REPORT MAC'd with the
*targets* report key. It knows, which key to usue from REPORTDATA.
4. The runtime will then pass this to Q.
5. Q will check if ATTRIBUTE.PROVISION_KEY is set. If it is, Q will
know that the enclave is allowed to get attested. Then it will
sign the report with the guarded public key pair and send it to
the attestation server.
The example is artificial, e.g. there could be something more complex,
but the idea is essentially this.
[*] With TPM and measured boot this could be to open network for a data
center node. Quote is just the term used for a signed measurement in
remote attestation schemes generally.
/Jarkko
On Sat, Oct 24, 2020 at 4:34 AM Jarkko Sakkinen <[email protected]> wrote:
>
> On Fri, Oct 23, 2020 at 07:19:05AM -0700, Dave Hansen wrote:
> > On 10/23/20 3:17 AM, Jarkko Sakkinen wrote:
> > > On Tue, Oct 20, 2020 at 02:19:26PM -0700, Dave Hansen wrote:
> > >> On 10/2/20 9:50 PM, Jarkko Sakkinen wrote:
> > >>> + * Failure to explicitly request access to a restricted attribute will cause
> > >>> + * sgx_ioc_enclave_init() to fail. Currently, the only restricted attribute
> > >>> + * is access to the PROVISION_KEY.
> > >> Could we also justify why access is restricted, please? Maybe:
> > >>
> > >> Access is restricted because PROVISION_KEY is burned uniquely
> > >> into each each processor, making it a perfect unique identifier
> > >> with privacy and fingerprinting implications.
> > >>
> > >> Are there any other reasons for doing it this way?
> > > AFAIK, if I interperet the SDM correctl, PROVISION_KEY and
> > > PROVISION_SEALING_KEY also have random salt added, i.e. they change
> > > every boot cycle.
> > >
> > > There is "RAND = yes" on those keys in Table 40-64 of Intel SDM volume
> > > 3D :-)
> >
> > Does that mean there are no privacy implications from access to the
> > provisioning keys? If that's true, why do we need a separate permission
> > framework for creating provisioning enclaves?
>
> As I've understood it, the key material for those keys is not even
> required in the current SGX architecture, it was used in the legacy EPID
> scheme, but the attribute itself is useful.
>
> Let's assume that we have some sort of quoting enclave Q, which guards a
> public key pair, which signs quotes of other enclaves. Let's assume we
> have an attestation server A, which will enable some capabilities [*],
> if it receives a quote signed with that public key pair.
>
> 1. E gets the report key with EGETKEY.
> 2. E constructs REPORTDATA (37.16) and TARGETINFO (37.17) structures.
> The former describes the enclaves contents and attributes and latter
> the target, i.e. Q in this artitificial example.
> 3. E calls EREPORT to generate a structure called REPORT MAC'd with the
> *targets* report key. It knows, which key to usue from REPORTDATA.
> 4. The runtime will then pass this to Q.
> 5. Q will check if ATTRIBUTE.PROVISION_KEY is set. If it is, Q will
> know that the enclave is allowed to get attested. Then it will
> sign the report with the guarded public key pair and send it to
> the attestation server.
I think you have this a little bit off. AIUI E won't have
ATTRIBUTE.PROVISION_KEY set -- Q will. Q uses the provisioning key to
convince an Intel server that it's running on a genuine Intel CPU, and
the Intel server will return a signed certificate that Q can chain off
of to generate attestations for E.
Dave, I would rephrase what you're saying a bit. The PROVISION_KEY
attribute allows enclaves to access keys that are unique to a
processor and unchangeable. Unlike other SGX keys, these keys are not
affected by OWNER_EPOCH changes and therefore cannot be reset.
--Andy
On Fri, Oct 23, 2020 at 04:23:55PM +0200, Jethro Beekman wrote:
> On 2020-10-23 12:17, Jarkko Sakkinen wrote:
> > On Tue, Oct 20, 2020 at 02:19:26PM -0700, Dave Hansen wrote:
> >> On 10/2/20 9:50 PM, Jarkko Sakkinen wrote:
> >>> + * Failure to explicitly request access to a restricted attribute will cause
> >>> + * sgx_ioc_enclave_init() to fail. Currently, the only restricted attribute
> >>> + * is access to the PROVISION_KEY.
> >>
> >> Could we also justify why access is restricted, please? Maybe:
> >>
> >> Access is restricted because PROVISION_KEY is burned uniquely
> >> into each each processor, making it a perfect unique identifier
> >> with privacy and fingerprinting implications.
> >>
> >> Are there any other reasons for doing it this way?
> >
> > AFAIK, if I interperet the SDM correctl, PROVISION_KEY and
> > PROVISION_SEALING_KEY also have random salt added, i.e. they change
> > every boot cycle.
> >
> > There is "RAND = yes" on those keys in Table 40-64 of Intel SDM volume
> > 3D :-)
> >
>
> This is nonsense. The whole point of sealing keys is that they don't
> change every boot. If did they they'd have no value over enclave
> memory. RAND means that the KEYID field from the KEYREQUEST is
> included in the derivation (as noted in the source row of the table
> you looked at).
I just looked that the column name is RAND, the row is called "Provision
key" and the cell has "Yes" in it.
> --
> Jethro Beekman | Fortanix
/Jarkko
On Sat, Oct 24, 2020 at 08:47:28AM -0700, Andy Lutomirski wrote:
> On Sat, Oct 24, 2020 at 4:34 AM Jarkko Sakkinen <[email protected]> wrote:
> >
> > On Fri, Oct 23, 2020 at 07:19:05AM -0700, Dave Hansen wrote:
> > > On 10/23/20 3:17 AM, Jarkko Sakkinen wrote:
> > > > On Tue, Oct 20, 2020 at 02:19:26PM -0700, Dave Hansen wrote:
> > > >> On 10/2/20 9:50 PM, Jarkko Sakkinen wrote:
> > > >>> + * Failure to explicitly request access to a restricted attribute will cause
> > > >>> + * sgx_ioc_enclave_init() to fail. Currently, the only restricted attribute
> > > >>> + * is access to the PROVISION_KEY.
> > > >> Could we also justify why access is restricted, please? Maybe:
> > > >>
> > > >> Access is restricted because PROVISION_KEY is burned uniquely
> > > >> into each each processor, making it a perfect unique identifier
> > > >> with privacy and fingerprinting implications.
> > > >>
> > > >> Are there any other reasons for doing it this way?
> > > > AFAIK, if I interperet the SDM correctl, PROVISION_KEY and
> > > > PROVISION_SEALING_KEY also have random salt added, i.e. they change
> > > > every boot cycle.
> > > >
> > > > There is "RAND = yes" on those keys in Table 40-64 of Intel SDM volume
> > > > 3D :-)
> > >
> > > Does that mean there are no privacy implications from access to the
> > > provisioning keys? If that's true, why do we need a separate permission
> > > framework for creating provisioning enclaves?
> >
> > As I've understood it, the key material for those keys is not even
> > required in the current SGX architecture, it was used in the legacy EPID
> > scheme, but the attribute itself is useful.
> >
> > Let's assume that we have some sort of quoting enclave Q, which guards a
> > public key pair, which signs quotes of other enclaves. Let's assume we
> > have an attestation server A, which will enable some capabilities [*],
> > if it receives a quote signed with that public key pair.
> >
> > 1. E gets the report key with EGETKEY.
> > 2. E constructs REPORTDATA (37.16) and TARGETINFO (37.17) structures.
> > The former describes the enclaves contents and attributes and latter
> > the target, i.e. Q in this artitificial example.
> > 3. E calls EREPORT to generate a structure called REPORT MAC'd with the
> > *targets* report key. It knows, which key to usue from REPORTDATA.
> > 4. The runtime will then pass this to Q.
> > 5. Q will check if ATTRIBUTE.PROVISION_KEY is set. If it is, Q will
> > know that the enclave is allowed to get attested. Then it will
> > sign the report with the guarded public key pair and send it to
> > the attestation server.
>
> I think you have this a little bit off. AIUI E won't have
> ATTRIBUTE.PROVISION_KEY set -- Q will. Q uses the provisioning key to
> convince an Intel server that it's running on a genuine Intel CPU, and
> the Intel server will return a signed certificate that Q can chain off
> of to generate attestations for E.
Right, I was confused by that RAND column, until Jethro corrected me.
Actually, quoting enclave (QE) authorizes itself with a provisioning
certification enclave (PCE), which holds certificates and revocation
lists for provisioning secrets unique to a CPU. And the sequence that I
described happens between PCE and QE. It accepts requests from enclaves
with ATTRIBUTES.PROVISION key bits set to 1 according to:
https://software.intel.com/content/dam/develop/external/us/en/documents/intel-sgx-support-for-third-party-attestation-801017.pdf
The source code for the reference is available here:
https://github.com/intel/SGXDataCenterAttestationPrimitives
And binaries are here:
https://01.org/intel-softwareguard-extensions/downloads/intel-sgx-dcap-1.6-release
They are provided for the inevitable reason that, it is the way bind to
the hardware, i.e. proof that you are running on a genuine CPU.
The network part is that PCE and QE can certify to an application, if an
enclave running in a different computer is an enclave.
> Dave, I would rephrase what you're saying a bit. The PROVISION_KEY
> attribute allows enclaves to access keys that are unique to a
> processor and unchangeable. Unlike other SGX keys, these keys are not
> affected by OWNER_EPOCH changes and therefore cannot be reset.
/Jarkko
On Sat, Oct 24, 2020 at 11:23:11PM +0300, Jarkko Sakkinen wrote:
Good morning, I hope the day is starting well for everyone.
> On Sat, Oct 24, 2020 at 08:47:28AM -0700, Andy Lutomirski wrote:
> > On Sat, Oct 24, 2020 at 4:34 AM Jarkko Sakkinen <[email protected]> wrote:
> > >
> > > On Fri, Oct 23, 2020 at 07:19:05AM -0700, Dave Hansen wrote:
> > > > On 10/23/20 3:17 AM, Jarkko Sakkinen wrote:
> > > > > On Tue, Oct 20, 2020 at 02:19:26PM -0700, Dave Hansen wrote:
> > > > >> On 10/2/20 9:50 PM, Jarkko Sakkinen wrote:
> > > > >>> + * Failure to explicitly request access to a restricted attribute will cause
> > > > >>> + * sgx_ioc_enclave_init() to fail. Currently, the only restricted attribute
> > > > >>> + * is access to the PROVISION_KEY.
> > > > >> Could we also justify why access is restricted, please? Maybe:
> > > > >>
> > > > >> Access is restricted because PROVISION_KEY is burned uniquely
> > > > >> into each each processor, making it a perfect unique identifier
> > > > >> with privacy and fingerprinting implications.
> > > > >>
> > > > >> Are there any other reasons for doing it this way?
> > > > > AFAIK, if I interperet the SDM correctl, PROVISION_KEY and
> > > > > PROVISION_SEALING_KEY also have random salt added, i.e. they change
> > > > > every boot cycle.
> > > > >
> > > > > There is "RAND = yes" on those keys in Table 40-64 of Intel SDM volume
> > > > > 3D :-)
> > > >
> > > > Does that mean there are no privacy implications from access to the
> > > > provisioning keys? If that's true, why do we need a separate permission
> > > > framework for creating provisioning enclaves?
> > >
> > > As I've understood it, the key material for those keys is not even
> > > required in the current SGX architecture, it was used in the legacy EPID
> > > scheme, but the attribute itself is useful.
> > >
> > > Let's assume that we have some sort of quoting enclave Q, which guards a
> > > public key pair, which signs quotes of other enclaves. Let's assume we
> > > have an attestation server A, which will enable some capabilities [*],
> > > if it receives a quote signed with that public key pair.
> > >
> > > 1. E gets the report key with EGETKEY.
> > > 2. E constructs REPORTDATA (37.16) and TARGETINFO (37.17) structures.
> > > The former describes the enclaves contents and attributes and latter
> > > the target, i.e. Q in this artitificial example.
> > > 3. E calls EREPORT to generate a structure called REPORT MAC'd with the
> > > *targets* report key. It knows, which key to usue from REPORTDATA.
> > > 4. The runtime will then pass this to Q.
> > > 5. Q will check if ATTRIBUTE.PROVISION_KEY is set. If it is, Q will
> > > know that the enclave is allowed to get attested. Then it will
> > > sign the report with the guarded public key pair and send it to
> > > the attestation server.
> >
> > I think you have this a little bit off. AIUI E won't have
> > ATTRIBUTE.PROVISION_KEY set -- Q will. Q uses the provisioning key to
> > convince an Intel server that it's running on a genuine Intel CPU, and
> > the Intel server will return a signed certificate that Q can chain off
> > of to generate attestations for E.
> Right, I was confused by that RAND column, until Jethro corrected me.
The RAND column is probably misnamed, it doesn't really imply random
in the common sense of the meaning. It implies that a 256 bit nonce
(keyid) can be supplied to the ENCLU[EGETKEY] instruction to perturb
the key derivation process.
The value is actually available in plaintext form as part of the
metadata for sealed data.
If it was really a random value, attestation wouldn't work.
> Actually, quoting enclave (QE) authorizes itself with a provisioning
> certification enclave (PCE), which holds certificates and revocation
> lists for provisioning secrets unique to a CPU. And the sequence that I
> described happens between PCE and QE. It accepts requests from enclaves
> with ATTRIBUTES.PROVISION key bits set to 1 according to:
>
> https://software.intel.com/content/dam/develop/external/us/en/documents/intel-sgx-support-for-third-party-attestation-801017.pdf
>
> The source code for the reference is available here:
>
> https://github.com/intel/SGXDataCenterAttestationPrimitives
>
> And binaries are here:
>
> https://01.org/intel-softwareguard-extensions/downloads/intel-sgx-dcap-1.6-release
>
> They are provided for the inevitable reason that, it is the way bind
> to the hardware, i.e. proof that you are running on a genuine CPU.
>
> The network part is that PCE and QE can certify to an application,
> if an enclave running in a different computer is an enclave.
All of this discussion has lacked a certain amount of precision, as a
result the original issue with respect to Dave's concern regarding the
privacy implications of an enclave posessing the PROVISION_KEY
attribute has been lost.
First of all, it is important to note that two types of attestation
are available, EPID and DCAP/ECDSA. They differ in their
implementation with respect to which enclaves need to have access to
derivation of the PROVISION_KEY. What does remain constant is the
role that the PROVISION_KEY plays in all this.
The Platform Certification Enclave (PCE) has two roles:
1.) Generate a Platform Provisioning IDentifier (PPID).
2.) Certification of the fact that an enclave, other then the PCE, is
running on the same platform at a particular Trusted Computing Base
(TCB) level.
Being able to generate a PPID is the most privacy sensitive operation
that an enclave can peform, hence the recommendation to restrict
access to the attribute bit that allows an enclave to create a
derivation of the root provisioning key.
The PPID is a 256 bit symmetric key that is generated with the keyid
and security version values all set to null values. As a result, any
enclave with a given MRSIGNER value will generate the same key value.
That value is used by Intel, and potentially others, to uniquely
identify the platform as long as it exists.
The PPID can be admixed with other information, such as the platform
security version of an enclave, to create a unique identifier for the
TCB state of enclave based software running on a particular platform.
This is role 2 of the PCE that I noted above.
In DCAP attestation, which is what Jarkko is referring to, both the
Quoting Enclave (QE) and PCE have access to PROVISION_KEY derivation.
In EPID attestation the PCE and the Provisioning Enclave (PVE) have
access to PROVISION_KEY derivation.
I guess it is up to community consensus as to whether or not this is a
privacy/security sensitive issue. It provides precise enough
identification that Intel uses it to determine whether or not a
platform should be allowed or denied the ability to participate in
EPID attestation.
I believe that this is being used to to force the cloud based
platforms to use DCAP rather then EPID based attestation. The
provision keys for these SKU's are not included in the Intel
Attestation Service (IAS) database so they cannot identify themselves
for provisioning of an EPID private key.
Since Intel has access to the root provisioning keys it can identify a
platform a-priori. Other entities can use this infrastructure for
uniquely identifying platforms but it has to be done via an enrollment
process for a given signing key.
> /Jarkko
Hopefully the above clarifications are helpful.
Have a good day.
Dr. Greg
As always,
Dr. Greg Wettstein, Ph.D, Worker Autonomously self-defensive
Enjellic Systems Development, LLC IOT platforms and edge devices.
4206 N. 19th Ave.
Fargo, ND 58102
PH: 701-281-1686 EMAIL: [email protected]
------------------------------------------------------------------------------
"I suppose that could could happen but he wouldn't know a Galois Field
if it kicked him in the nuts."
-- Anonymous mathematician
Resurrection.