Intel(R) SGX is a set of CPU instructions that can be used by applications
to set aside private regions of code and data. The code outside the enclave
is disallowed to access the memory inside the enclave by the CPU access
control.
There is a new hardware unit in the processor called Memory Encryption
Engine (MEE) starting from the Skylake microacrhitecture. BIOS can define
one or many MEE regions that can hold enclave data by configuring them with
PRMRR registers.
The MEE automatically encrypts the data leaving the processor package to
the MEE regions. The data is encrypted using a random key whose life-time
is exactly one power cycle.
The current implementation requires that the firmware sets
IA32_SGXLEPUBKEYHASH* MSRs as writable so that ultimately the kernel can
decide what enclaves it wants run. The implementation does not create
any bottlenecks to support read-only MSRs later on.
You can tell if your CPU supports SGX by looking into /proc/cpuinfo:
cat /proc/cpuinfo | grep sgx
v28:
* Documented to Documentation/x86/sgx.rst how the kernel manages the
enclave ownership.
* Removed non-LC flow from sgx_einit().
* Removed struct sgx_einittoken since only the size of the corresponding
microarchitectural structure is used in the series ATM.
v27:
* Disallow RIE processes to use enclaves as there could a permission
conflict between VMA and enclave permissions.
* In the documentation, replace "grep /proc/cpuinfo" with
"grep sgx /proc/cpuinfo".
v26:
* Fixed the commit author in "x86/sgx: Linux Enclave Driver", which was
changed in v25 by mistake.
* Addressed a bunch of grammar mistakes in sgx.rst (thanks Randy once
again for such a detailed feedback).
* Added back the MAINTAINERS update commit, which was mistakenly removed
in v25.
* EREMOVE's for SECS cannot be done while sanitizing an EPC section. The
CPU does not allow to remove a SECS page before all of its children have
been removed, and a child page can be in some other section than the one
currently being processed. Thus, removed special SECS processing from
sgx_sanitize_page() and instead put sections through it twice. In the
2nd round the lists should only contain SECS pages.
v25:
* Fix a double-free issue when SGX_IOC_ENCLAVE_ADD_PAGES
fails on executing ENCLS[EADD]. The rollback path executed
radix_tree_delete() on the same address twice when this happened.
* Return -EINTR instead of -ERESTARTSYS in SGX_IOC_ENCLAVE_ADD_PAGES when
a signal is pending.
* As requested by Borislav, move the CPUID 0x12 features to their own word
in cpufeatures.
* Sean fixed a bug from sgx_reclaimer_write() where sgx_encl_put_backing()
was called with an uninitialized pointer when sgx_encl_get_backing()
fails.
* Migrated /dev/sgx/* to misc. This is future-proof as struct miscdevice
has 'groups' for setting up sysfs attributes for the device.
* Use device_initcall instead of subsys_initcall so that misc_class is
initialized before SGX is initialized.
* Return -EACCES in SGX_IOC_ENCLAVE_INIT when caller tries to select
enclave attributes that we the kernel does not allow it to set instead
of -EINVAL.
* Unless SGX public key MSRs are writable always deny the feature from
Linux. Previously this was only denied from driver. How VMs should be
supported is not really part of initial patch set, which makes this
an obvious choice.
* Cleaned up and refined documentation to be more approachable.
v24:
* Reclaim unmeasured and TCS pages (regression in v23).
* Replace usages of GFP_HIGHUSER with GFP_KERNEL.
* Return -EIO on when EADD or EEXTEND fails in %SGX_IOC_ENCLAVE_ADD_PAGES
and use the same rollback (destroy enclave). This can happen when host
suspends itself unknowingly to a VM running enclaves. From -EIO the user
space can deduce what happened.
* Have a separate @count in struct sgx_enclave_add_pages to output number
of bytes processed instead of overwriting the input parameters for
clarity and more importantly that the API provides means for partial
processing (@count could be less than @length in success case).
v23:
* Replace SGX_ENCLAVE_ADD_PAGE with SGX_ENCLAVE_ADD_PAGES. Replace @mrmask
with %SGX_PAGE_MEASURE flag.
* Return -EIO instead of -ECANCELED when ptrace() fails to read a TCS page.
* In the reclaimer, pin page before ENCLS[EBLOCK] because pinning can fail
(because of OOM) even in legit behaviour and after EBLOCK the reclaiming
flow can be only reverted by killing the whole enclave.
* Fixed SGX_ATTR_RESERVED_MASK. Bit 7 was marked as reserved while in fact
it should have been bit 6 (Table 37-3 in the SDM).
* Return -EPERM from SGX_IOC_ENCLAVE_INIT when ENCLS[EINIT] returns an SGX
error code.
v22:
* Refined bunch commit messages and added associated SDM references as
many of them were too exhausting and some outdated.
* Alignment checks have been removed from mmap() because it does not define the
ELRANGE. VMAs only act as windows to the enclave. The semantics compare
somewhat how mmap() works with regular files.
* We now require user space addresses given to SGX_IOC_ENCLAVE_ADD_PAGE to be
page aligned so that we can pass the page directly to EADD and do not have
to do an extra copy. This was made effectively possible by removing the
worker thread for adding pages.
* The selftest build files have been refined throughout of various glitches
and work properly in a cross compilation environment such as BuildRoot.
In addition, libcalls fail the build with an assertion in the linker
script, if they end up to the enclave binary.
* CONFIG_INTEL_SGX_DRIVER has been removed because you cannot use SGX core
for anything without having the driver. This could change when KVM support
is added.
* We require zero permissions in SECINFO for TCS pages because the CPU
overwrites SECINFO flags with zero permissions and measures the page
only after that. Allowing to pass TCS with non-zero permissions would
cause mismatching measurement between the one provided in SIGSTRUCT and
the one computed by the CPU.
* Obviously lots of small fixes and clean ups (does make sense to
document them all).
v21:
* Check on mmap() that the VMA does cover an area that does not have
enclave pages. Only mapping with PROT_NONE can do that to reserve
initial address space for an enclave.
* Check om mmap() and mprotect() that the VMA permissions do not
surpass the enclave permissions.
* Remove two refcounts from vma_close(): mm_list and encl->refcount.
Enclave refcount is only need for swapper/enclave sync and we can
remove mm_list refcount by destroying mm_struct when the process
is closed. By not having vm_close() the Linux MM can merge VMAs.
* Do not naturally align MAP_FIXED address.
* Numerous small fixes and clean ups.
* Use SRCU for synchronizing the list of mm_struct's.
* Move to stack based call convention in the vDSO.
v20:
* Fine-tune Kconfig messages and spacing and remove MMU_NOTIFIER
dependency as MMU notifiers are no longer used in the driver.
* Use mm_users instead of mm_count as refcount for mm_struct as mm_count
only protects from deleting mm_struct, not removing its contents.
* Sanitize EPC when the reclaimer thread starts by doing EREMOVE for all
of them. They could be in initialized state when the kernel starts
because it might be spawned by kexec().
* Documentation overhaul.
* Use a device /dev/sgx/provision for delivering the provision token
instead of securityfs.
* Create a reference to the enclave when already when opening
/dev/sgx/enclave. The file is then associated with this enclave only.
mmap() can be done at free at any point and always get a reference to
the enclave. To summarize the file now represents the enclave.
v19:
* Took 3-4 months but in some sense this was more like a rewrite of most
of the corners of the source code. If I've forgotten to deal with some
feedback, please don't shout me. Make a remark and I will fix it for
the next version. Hopefully there won't be this big turnovers anymore.
* Validate SECS attributes properly against CPUID given attributes and
against allowed attributes. SECS attributes are the ones that are
enforced whereas SIGSTRUCT attributes tell what is required to run
the enclave.
* Add KSS (Key Sharing Support) to the enclave attributes.
* Deny MAP_PRIVATE as an enclave is always a shared memory entity.
* Revert back to shmem backing storage so that it can be easily shared
by multiple processes.
* Split the recognization of an ENCLS leaf failure by using three
functions to detect it: encsl_faulted(), encls_returned_code() and
sgx_failed(). encls_failed() is only caused by a spurious expections that
should never happen. Thus, it is not defined as an inline function in
order to easily insert a kprobe to it.
* Move low-level enclave management routines, page fault handler and page
reclaiming routines from driver to the core. These cannot be separated
from each other as they are heavily interdependent. The rationale is that
the core does not call any code from the driver.
* Allow the driver to be compiled as a module now that it no code is using
its routines and it only uses exported symbols. Now the driver is
essentially just a thin ioctl layer.
* Reworked the driver to maintain a list of mm_struct's. The VMA callbacks
add new entries to this list as the process is forked. Each entry has
its own refcount because they have a different life-cycle as the enclave
does. In effect @tgid and @mm have been removed from struct sgx_encl
and we allow forking by removing VM_DONTCOPY from vm flags.
* Generate a cpu mask in the reclaimer from the cpu mask's of all
mm_struct's. This will kick out the hardware threads out of the enclave
from multiple processes. It is not a local variable because it would
eat too much of the stack space but instead a field in struct
sgx_encl.
* Allow forking i.e. remove VM_DONTCOPY. I did not change the API
because the old API scaled to the workload that Andy described. The
codebase is now mostly API independent i.e. changing the API is a
small task. For me the proper trigger to chanage it is a as concrete
as possible workload that cannot be fulfilled. I hope you understand
my thinking here. I don't want to change anything w/o proper basis
but I'm ready to change anything if there is a proper basis. I do
not have any kind of attachment to any particular type of API.
* Add Sean's vDSO ENCLS(EENTER) patches and update selftest to use the
new vDSO.
v18:
* Update the ioctl-number.txt.
* Move the driver under arch/x86.
* Add SGX features (SGX, SGX1, SGX2) to the disabled-features.h.
* Rename the selftest as test_sgx (previously sgx-selftest).
* In order to enable process accounting, swap EPC pages and PCMD's to a VMA
instead of shmem.
* Allow only to initialize and run enclaves with a subset of
{DEBUG, MODE64BIT} set.
* Add SGX_IOC_ENCLAVE_SET_ATTRIBUTE to allow an enclave to have privileged
attributes e.g. PROVISIONKEY.
v17:
* Add a simple selftest.
* Fix a null pointer dereference to section->pages when its
allocation fails.
* Add Sean's description of the exception handling to the documentation.
v16:
* Fixed SOB's in the commits that were a bit corrupted in v15.
* Implemented exceptio handling properly to detect_sgx().
* Use GENMASK() to define SGX_CPUID_SUB_LEAF_TYPE_MASK.
* Updated the documentation to use rst definition lists.
* Added the missing Documentation/x86/index.rst, which has a link to
intel_sgx.rst. Now the SGX and uapi documentation is properly generated
with 'make htmldocs'.
* While enumerating EPC sections, if an undefined section is found, fail
the driver initialization instead of continuing the initialization.
* Issue a warning if there are more than %SGX_MAX_EPC_SECTIONS.
* Remove copyright notice from arch/x86/include/asm/sgx.h.
* Migrated from ioremap_cache() to memremap().
v15:
* Split into more digestable size patches.
* Lots of small fixes and clean ups.
* Signal a "plain" SIGSEGV on an EPCM violation.
v14:
* Change the comment about X86_FEATURE_SGX_LC from “SGX launch
configuration” to “SGX launch control”.
* Move the SGX-related CPU feature flags as part of the Linux defined
virtual leaf 8.
* Add SGX_ prefix to the constants defining the ENCLS leaf functions.
* Use GENMASK*() and BIT*() in sgx_arch.h instead of raw hex numbers.
* Refine the long description for CONFIG_INTEL_SGX_CORE.
* Do not use pr_*_ratelimited() in the driver. The use of the rate limited
versions is legacy cruft from the prototyping phase.
* Detect sleep with SGX_INVALID_EINIT_TOKEN instead of counting power
cycles.
* Manually prefix with “sgx:” in the core SGX code instead of redefining
pr_fmt.
* Report if IA32_SGXLEPUBKEYHASHx MSRs are not writable in the driver
instead of core because it is a driver requirement.
* Change prompt to bool in the entry for CONFIG_INTEL_SGX_CORE because the
default is ‘n’.
* Rename struct sgx_epc_bank as struct sgx_epc_section in order to match
the SDM.
* Allocate struct sgx_epc_page instances one at a time.
* Use “__iomem void *” pointers for the mapped EPC memory consistently.
* Retry once on SGX_INVALID_TOKEN in sgx_einit() instead of counting power
cycles.
* Call enclave swapping operations directly from the driver instead of
calling them .indirectly through struct sgx_epc_page_ops because indirect
calls are not required yet as the patch set does not contain the KVM
support.
* Added special signal SEGV_SGXERR to notify about SGX EPCM violation
errors.
v13:
* Always use SGX_CPUID constant instead of a hardcoded value.
* Simplified and documented the macros and functions for ENCLS leaves.
* Enable sgx_free_page() to free active enclave pages on demand
in order to allow sgx_invalidate() to delete enclave pages.
It no longer performs EREMOVE if a page is in the process of
being reclaimed.
* Use PM notifier per enclave so that we don't have to traverse
the global list of active EPC pages to find enclaves.
* Removed unused SGX_LE_ROLLBACK constant from uapi/asm/sgx.h
* Always use ioremap() to map EPC banks as we only support 64-bit kernel.
* Invalidate IA32_SGXLEPUBKEYHASH cache used by sgx_einit() when going
to sleep.
v12:
* Split to more narrow scoped commits in order to ease the review process and
use co-developed-by tag for co-authors of commits instead of listing them in
the source files.
* Removed cruft EXPORT_SYMBOL() declarations and converted to static variables.
* Removed in-kernel LE i.e. this version of the SGX software stack only
supports unlocked IA32_SGXLEPUBKEYHASHx MSRs.
* Refined documentation on launching enclaves, swapping and enclave
construction.
* Refined sgx_arch.h to include alignment information for every struct that
requires it and removed structs that are not needed without an LE.
* Got rid of SGX_CPUID.
* SGX detection now prints log messages about firmware configuration issues.
v11:
* Polished ENCLS wrappers with refined exception handling.
* ksgxswapd was not stopped (regression in v5) in
sgx_page_cache_teardown(), which causes a leaked kthread after driver
deinitialization.
* Shutdown sgx_le_proxy when going to suspend because its EPC pages will be
invalidated when resuming, which will cause it not function properly
anymore.
* Set EINITTOKEN.VALID to zero for a token that is passed when
SGXLEPUBKEYHASH matches MRSIGNER as alloc_page() does not give a zero
page.
* Fixed the check in sgx_edbgrd() for a TCS page. Allowed to read offsets
around the flags field, which causes a #GP. Only flags read is readable.
* On read access memcpy() call inside sgx_vma_access() had src and dest
parameters in wrong order.
* The build issue with CONFIG_KASAN is now fixed. Added undefined symbols
to LE even if “KASAN_SANITIZE := false” was set in the makefile.
* Fixed a regression in the #PF handler. If a page has
SGX_ENCL_PAGE_RESERVED flag the #PF handler should unconditionally fail.
It did not, which caused weird races when trying to change other parts of
swapping code.
* EPC management has been refactored to a flat LRU cache and moved to
arch/x86. The swapper thread reads a cluster of EPC pages and swaps all
of them. It can now swap from multiple enclaves in the same round.
* For the sake of consistency with SGX_IOC_ENCLAVE_ADD_PAGE, return -EINVAL
when an enclave is already initialized or dead instead of zero.
v10:
* Cleaned up anon inode based IPC between the ring-0 and ring-3 parts
of the driver.
* Unset the reserved flag from an enclave page if EDBGRD/WR fails
(regression in v6).
* Close the anon inode when LE is stopped (regression in v9).
* Update the documentation with a more detailed description of SGX.
v9:
* Replaced kernel-LE IPC based on pipes with an anonymous inode.
The driver does not require anymore new exports.
v8:
* Check that public key MSRs match the LE public key hash in the
driver initialization when the MSRs are read-only.
* Fix the race in VA slot allocation by checking the fullness
immediately after succeesful allocation.
* Fix the race in hash mrsigner calculation between the launch
enclave and user enclaves by having a separate lock for hash
calculation.
v7:
* Fixed offset calculation in sgx_edbgr/wr(). Address was masked with PAGE_MASK
when it should have been masked with ~PAGE_MASK.
* Fixed a memory leak in sgx_ioc_enclave_create().
* Simplified swapping code by using a pointer array for a cluster
instead of a linked list.
* Squeezed struct sgx_encl_page to 32 bytes.
* Fixed deferencing of an RSA key on OpenSSL 1.1.0.
* Modified TC's CMAC to use kernel AES-NI. Restructured the code
a bit in order to better align with kernel conventions.
v6:
* Fixed semaphore underrun when accessing /dev/sgx from the launch enclave.
* In sgx_encl_create() s/IS_ERR(secs)/IS_ERR(encl)/.
* Removed virtualization chapter from the documentation.
* Changed the default filename for the signing key as signing_key.pem.
* Reworked EPC management in a way that instead of a linked list of
struct sgx_epc_page instances there is an array of integers that
encodes address and bank of an EPC page (the same data as 'pa' field
earlier). The locking has been moved to the EPC bank level instead
of a global lock.
* Relaxed locking requirements for EPC management. EPC pages can be
released back to the EPC bank concurrently.
* Cleaned up ptrace() code.
* Refined commit messages for new architectural constants.
* Sorted includes in every source file.
* Sorted local variable declarations according to the line length in
every function.
* Style fixes based on Darren's comments to sgx_le.c.
v5:
* Described IPC between the Launch Enclave and kernel in the commit messages.
* Fixed all relevant checkpatch.pl issues that I have forgot fix in earlier
versions except those that exist in the imported TinyCrypt code.
* Fixed spelling mistakes in the documentation.
* Forgot to check the return value of sgx_drv_subsys_init().
* Encapsulated properly page cache init and teardown.
* Collect epc pages to a temp list in sgx_add_epc_bank
* Removed SGX_ENCLAVE_INIT_ARCH constant.
v4:
* Tied life-cycle of the sgx_le_proxy process to /dev/sgx.
* Removed __exit annotation from sgx_drv_subsys_exit().
* Fixed a leak of a backing page in sgx_process_add_page_req() in the
case when vm_insert_pfn() fails.
* Removed unused symbol exports for sgx_page_cache.c.
* Updated sgx_alloc_page() to require encl parameter and documented the
behavior (Sean Christopherson).
* Refactored a more lean API for sgx_encl_find() and documented the behavior.
* Moved #PF handler to sgx_fault.c.
* Replaced subsys_system_register() with plain bus_register().
* Retry EINIT 2nd time only if MSRs are not locked.
v3:
* Check that FEATURE_CONTROL_LOCKED and FEATURE_CONTROL_SGX_ENABLE are set.
* Return -ERESTARTSYS in __sgx_encl_add_page() when sgx_alloc_page() fails.
* Use unused bits in epc_page->pa to store the bank number.
* Removed #ifdef for WQ_NONREENTRANT.
* If mmu_notifier_register() fails with -EINTR, return -ERESTARTSYS.
* Added --remove-section=.got.plt to objcopy flags in order to prevent a
dummy .got.plt, which will cause an inconsistent size for the LE.
* Documented sgx_encl_* functions.
* Added remark about AES implementation used inside the LE.
* Removed redundant sgx_sys_exit() from le/main.c.
* Fixed struct sgx_secinfo alignment from 128 to 64 bytes.
* Validate miscselect in sgx_encl_create().
* Fixed SSA frame size calculation to take the misc region into account.
* Implemented consistent exception handling to __encls() and __encls_ret().
* Implemented a proper device model in order to allow sysfs attributes
and in-kernel API.
* Cleaned up various "find enclave" implementations to the unified
sgx_encl_find().
* Validate that vm_pgoff is zero.
* Discard backing pages with shmem_truncate_range() after EADD.
* Added missing EEXTEND operations to LE signing and launch.
* Fixed SSA size for GPRS region from 168 to 184 bytes.
* Fixed the checks for TCS flags. Now DBGOPTIN is allowed.
* Check that TCS addresses are in ELRANGE and not just page aligned.
* Require kernel to be compiled with X64_64 and CPU_SUP_INTEL.
* Fixed an incorrect value for SGX_ATTR_DEBUG from 0x01 to 0x02.
v2:
* get_rand_uint32() changed the value of the pointer instead of value
where it is pointing at.
* Launch enclave incorrectly used sigstruct attributes-field instead of
enclave attributes-field.
* Removed unused struct sgx_add_page_req from sgx_ioctl.c
* Removed unused sgx_has_sgx2.
* Updated arch/x86/include/asm/sgx.h so that it provides stub
implementations when sgx in not enabled.
* Removed cruft rdmsr-calls from sgx_set_pubkeyhash_msrs().
* return -ENOMEM in sgx_alloc_page() when VA pages consume too much space
* removed unused global sgx_nr_pids
* moved sgx_encl_release to sgx_encl.c
* return -ERESTARTSYS instead of -EINTR in sgx_encl_init()
Jarkko Sakkinen (12):
x86/sgx: Update MAINTAINERS
x86/sgx: Add SGX microarchitectural data structures
x86/sgx: Add wrappers for ENCLS leaf functions
x86/sgx: Add functions to allocate and free EPC pages
x86/sgx: Linux Enclave Driver
docs: x86/sgx: Document SGX micro architecture and kernel internals
selftests/x86: Recurse into subdirectories
selftests/x86: Add a selftest for SGX
x86/sgx: Add provisioning
x86/sgx: Add a page reclaimer
x86/sgx: ptrace() support for the SGX driver
selftests/x86: Add vDSO selftest for SGX
Sean Christopherson (10):
x86/cpufeatures: x86/msr: Add Intel SGX hardware bits
x86/cpufeatures: x86/msr: Intel SGX Launch Control hardware bits
x86/mm: x86/sgx: Signal SIGSEGV with PF_SGX
x86/cpu/intel: Detect SGX supprt
x86/sgx: Enumerate and track EPC sections
mm: Introduce vm_ops->may_mprotect()
x86/vdso: Add support for exception fixup in vDSO functions
x86/fault: Add helper function to sanitize error code
x86/traps: Attempt to fixup exceptions in vDSO before signaling
x86/vdso: Implement a vDSO for Intel SGX enclave call
.../userspace-api/ioctl/ioctl-number.rst | 1 +
Documentation/x86/index.rst | 1 +
Documentation/x86/sgx.rst | 192 +++++
MAINTAINERS | 11 +
arch/x86/Kconfig | 14 +
arch/x86/entry/vdso/Makefile | 8 +-
arch/x86/entry/vdso/extable.c | 46 +
arch/x86/entry/vdso/extable.h | 29 +
arch/x86/entry/vdso/vdso-layout.lds.S | 9 +-
arch/x86/entry/vdso/vdso.lds.S | 1 +
arch/x86/entry/vdso/vdso2c.h | 58 +-
arch/x86/entry/vdso/vsgx_enter_enclave.S | 187 ++++
arch/x86/include/asm/cpufeature.h | 5 +-
arch/x86/include/asm/cpufeatures.h | 8 +-
arch/x86/include/asm/disabled-features.h | 18 +-
arch/x86/include/asm/msr-index.h | 8 +
arch/x86/include/asm/required-features.h | 2 +-
arch/x86/include/asm/traps.h | 1 +
arch/x86/include/asm/vdso.h | 5 +
arch/x86/include/uapi/asm/sgx.h | 114 +++
arch/x86/kernel/cpu/Makefile | 1 +
arch/x86/kernel/cpu/common.c | 4 +
arch/x86/kernel/cpu/feat_ctl.c | 29 +-
arch/x86/kernel/cpu/sgx/Makefile | 6 +
arch/x86/kernel/cpu/sgx/arch.h | 343 ++++++++
arch/x86/kernel/cpu/sgx/driver.c | 209 +++++
arch/x86/kernel/cpu/sgx/driver.h | 32 +
arch/x86/kernel/cpu/sgx/encl.c | 757 ++++++++++++++++
arch/x86/kernel/cpu/sgx/encl.h | 127 +++
arch/x86/kernel/cpu/sgx/encls.h | 238 ++++++
arch/x86/kernel/cpu/sgx/ioctl.c | 805 ++++++++++++++++++
arch/x86/kernel/cpu/sgx/main.c | 280 ++++++
arch/x86/kernel/cpu/sgx/reclaim.c | 458 ++++++++++
arch/x86/kernel/cpu/sgx/sgx.h | 108 +++
arch/x86/kernel/traps.c | 14 +
arch/x86/mm/fault.c | 45 +-
include/linux/mm.h | 2 +
mm/mprotect.c | 14 +-
tools/arch/x86/include/asm/cpufeatures.h | 7 +-
tools/testing/selftests/x86/Makefile | 44 +
tools/testing/selftests/x86/sgx/.gitignore | 3 +
tools/testing/selftests/x86/sgx/Makefile | 48 ++
tools/testing/selftests/x86/sgx/defines.h | 17 +
tools/testing/selftests/x86/sgx/encl.c | 20 +
tools/testing/selftests/x86/sgx/encl.lds | 34 +
.../selftests/x86/sgx/encl_bootstrap.S | 94 ++
tools/testing/selftests/x86/sgx/main.c | 379 +++++++++
tools/testing/selftests/x86/sgx/sgx_call.S | 66 ++
tools/testing/selftests/x86/sgx/sgx_call.h | 14 +
tools/testing/selftests/x86/sgx/sgxsign.c | 493 +++++++++++
.../testing/selftests/x86/sgx/signing_key.pem | 39 +
51 files changed, 5417 insertions(+), 31 deletions(-)
create mode 100644 Documentation/x86/sgx.rst
create mode 100644 arch/x86/entry/vdso/extable.c
create mode 100644 arch/x86/entry/vdso/extable.h
create mode 100644 arch/x86/entry/vdso/vsgx_enter_enclave.S
create mode 100644 arch/x86/include/uapi/asm/sgx.h
create mode 100644 arch/x86/kernel/cpu/sgx/Makefile
create mode 100644 arch/x86/kernel/cpu/sgx/arch.h
create mode 100644 arch/x86/kernel/cpu/sgx/driver.c
create mode 100644 arch/x86/kernel/cpu/sgx/driver.h
create mode 100644 arch/x86/kernel/cpu/sgx/encl.c
create mode 100644 arch/x86/kernel/cpu/sgx/encl.h
create mode 100644 arch/x86/kernel/cpu/sgx/encls.h
create mode 100644 arch/x86/kernel/cpu/sgx/ioctl.c
create mode 100644 arch/x86/kernel/cpu/sgx/main.c
create mode 100644 arch/x86/kernel/cpu/sgx/reclaim.c
create mode 100644 arch/x86/kernel/cpu/sgx/sgx.h
create mode 100644 tools/testing/selftests/x86/sgx/.gitignore
create mode 100644 tools/testing/selftests/x86/sgx/Makefile
create mode 100644 tools/testing/selftests/x86/sgx/defines.h
create mode 100644 tools/testing/selftests/x86/sgx/encl.c
create mode 100644 tools/testing/selftests/x86/sgx/encl.lds
create mode 100644 tools/testing/selftests/x86/sgx/encl_bootstrap.S
create mode 100644 tools/testing/selftests/x86/sgx/main.c
create mode 100644 tools/testing/selftests/x86/sgx/sgx_call.S
create mode 100644 tools/testing/selftests/x86/sgx/sgx_call.h
create mode 100644 tools/testing/selftests/x86/sgx/sgxsign.c
create mode 100644 tools/testing/selftests/x86/sgx/signing_key.pem
--
2.25.0
From: Sean Christopherson <[email protected]>
Add X86_FEATURE_SGX from CPUID.(EAX=7, ECX=1), which informs whether the
CPU has SGX.
Add X86_FEATURE_SGX1 and X86_FEATURE_SGX2 from CPUID.(EAX=12H, ECX=0),
which describe the level of SGX support available [1].
Remap CPUID.(EAX=12H, ECX=0) bits to the Linux fake CPUID 8 in order to
conserve some space. Keep the bit positions intact because KVM requires
this. Reserve bits 0-7 for SGX in order to maintain this invariant also
when new SGX specific feature bits get added.
Add IA32_FEATURE_CONTROL_SGX_ENABLE. BIOS can use this bit to opt-in SGX
before locking the feature control MSR [2].
[1] Intel SDM: 36.7.2 Intel® SGX Resource Enumeration Leaves
[2] Intel SDM: 36.7.1 Intel® SGX Opt-In Configuration
Signed-off-by: Sean Christopherson <[email protected]>
Co-developed-by: Jarkko Sakkinen <[email protected]>
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
arch/x86/include/asm/cpufeature.h | 5 +++--
arch/x86/include/asm/cpufeatures.h | 7 ++++++-
arch/x86/include/asm/disabled-features.h | 18 +++++++++++++++---
arch/x86/include/asm/msr-index.h | 1 +
arch/x86/include/asm/required-features.h | 2 +-
arch/x86/kernel/cpu/common.c | 4 ++++
tools/arch/x86/include/asm/cpufeatures.h | 7 ++++++-
7 files changed, 36 insertions(+), 8 deletions(-)
diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
index 59bf91c57aa8..efbdba5170a3 100644
--- a/arch/x86/include/asm/cpufeature.h
+++ b/arch/x86/include/asm/cpufeature.h
@@ -30,6 +30,7 @@ enum cpuid_leafs
CPUID_7_ECX,
CPUID_8000_0007_EBX,
CPUID_7_EDX,
+ CPUID_12_EAX,
};
#ifdef CONFIG_X86_FEATURE_NAMES
@@ -89,7 +90,7 @@ extern const char * const x86_bug_flags[NBUGINTS*32];
CHECK_BIT_IN_MASK_WORD(REQUIRED_MASK, 17, feature_bit) || \
CHECK_BIT_IN_MASK_WORD(REQUIRED_MASK, 18, feature_bit) || \
REQUIRED_MASK_CHECK || \
- BUILD_BUG_ON_ZERO(NCAPINTS != 19))
+ BUILD_BUG_ON_ZERO(NCAPINTS != 20))
#define DISABLED_MASK_BIT_SET(feature_bit) \
( CHECK_BIT_IN_MASK_WORD(DISABLED_MASK, 0, feature_bit) || \
@@ -112,7 +113,7 @@ extern const char * const x86_bug_flags[NBUGINTS*32];
CHECK_BIT_IN_MASK_WORD(DISABLED_MASK, 17, feature_bit) || \
CHECK_BIT_IN_MASK_WORD(DISABLED_MASK, 18, feature_bit) || \
DISABLED_MASK_CHECK || \
- BUILD_BUG_ON_ZERO(NCAPINTS != 19))
+ BUILD_BUG_ON_ZERO(NCAPINTS != 20))
#define cpu_has(c, bit) \
(__builtin_constant_p(bit) && REQUIRED_MASK_BIT_SET(bit) ? 1 : \
diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
index f3327cb56edf..42ae9fb06987 100644
--- a/arch/x86/include/asm/cpufeatures.h
+++ b/arch/x86/include/asm/cpufeatures.h
@@ -13,7 +13,7 @@
/*
* Defines x86 CPU feature bits
*/
-#define NCAPINTS 19 /* N 32-bit words worth of info */
+#define NCAPINTS 20 /* N 32-bit words worth of info */
#define NBUGINTS 1 /* N 32-bit bug flags */
/*
@@ -238,6 +238,7 @@
/* Intel-defined CPU features, CPUID level 0x00000007:0 (EBX), word 9 */
#define X86_FEATURE_FSGSBASE ( 9*32+ 0) /* RDFSBASE, WRFSBASE, RDGSBASE, WRGSBASE instructions*/
#define X86_FEATURE_TSC_ADJUST ( 9*32+ 1) /* TSC adjustment MSR 0x3B */
+#define X86_FEATURE_SGX ( 9*32+ 2) /* Software Guard Extensions */
#define X86_FEATURE_BMI1 ( 9*32+ 3) /* 1st group bit manipulation extensions */
#define X86_FEATURE_HLE ( 9*32+ 4) /* Hardware Lock Elision */
#define X86_FEATURE_AVX2 ( 9*32+ 5) /* AVX2 instructions */
@@ -369,6 +370,10 @@
#define X86_FEATURE_ARCH_CAPABILITIES (18*32+29) /* IA32_ARCH_CAPABILITIES MSR (Intel) */
#define X86_FEATURE_SPEC_CTRL_SSBD (18*32+31) /* "" Speculative Store Bypass Disable */
+/* Intel-defined SGX features, CPUID level 0x00000012:0 (EAX), word 19 */
+#define X86_FEATURE_SGX1 (19*32+ 0) /* SGX1 leaf functions */
+#define X86_FEATURE_SGX2 (19*32+ 1) /* SGX2 leaf functions */
+
/*
* BUG word(s)
*/
diff --git a/arch/x86/include/asm/disabled-features.h b/arch/x86/include/asm/disabled-features.h
index 4ea8584682f9..dbe534d5153f 100644
--- a/arch/x86/include/asm/disabled-features.h
+++ b/arch/x86/include/asm/disabled-features.h
@@ -28,13 +28,18 @@
# define DISABLE_CYRIX_ARR (1<<(X86_FEATURE_CYRIX_ARR & 31))
# define DISABLE_CENTAUR_MCR (1<<(X86_FEATURE_CENTAUR_MCR & 31))
# define DISABLE_PCID 0
+# define DISABLE_SGX1 0
+# define DISABLE_SGX2 0
#else
# define DISABLE_VME 0
# define DISABLE_K6_MTRR 0
# define DISABLE_CYRIX_ARR 0
# define DISABLE_CENTAUR_MCR 0
# define DISABLE_PCID (1<<(X86_FEATURE_PCID & 31))
-#endif /* CONFIG_X86_64 */
+# define DISABLE_SGX1 (1<<(X86_FEATURE_SGX1 & 31))
+# define DISABLE_SGX2 (1<<(X86_FEATURE_SGX2 & 31))
+ #endif /* CONFIG_X86_64 */
+
#ifdef CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS
# define DISABLE_PKU 0
@@ -56,6 +61,12 @@
# define DISABLE_PTI (1 << (X86_FEATURE_PTI & 31))
#endif
+#ifdef CONFIG_INTEL_SGX
+# define DISABLE_SGX 0
+#else
+# define DISABLE_SGX (1 << (X86_FEATURE_SGX & 31))
+#endif
+
/*
* Make sure to add features to the correct mask
*/
@@ -68,7 +79,7 @@
#define DISABLED_MASK6 0
#define DISABLED_MASK7 (DISABLE_PTI)
#define DISABLED_MASK8 0
-#define DISABLED_MASK9 (DISABLE_SMAP)
+#define DISABLED_MASK9 (DISABLE_SMAP|DISABLE_SGX)
#define DISABLED_MASK10 0
#define DISABLED_MASK11 0
#define DISABLED_MASK12 0
@@ -78,6 +89,7 @@
#define DISABLED_MASK16 (DISABLE_PKU|DISABLE_OSPKE|DISABLE_LA57|DISABLE_UMIP)
#define DISABLED_MASK17 0
#define DISABLED_MASK18 0
-#define DISABLED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 19)
+#define DISABLED_MASK19 (DISABLE_SGX1|DISABLE_SGX2)
+#define DISABLED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 20)
#endif /* _ASM_X86_DISABLED_FEATURES_H */
diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
index d5e517d1c3dd..e190293c8923 100644
--- a/arch/x86/include/asm/msr-index.h
+++ b/arch/x86/include/asm/msr-index.h
@@ -566,6 +566,7 @@
#define FEAT_CTL_LOCKED BIT(0)
#define FEAT_CTL_VMX_ENABLED_INSIDE_SMX BIT(1)
#define FEAT_CTL_VMX_ENABLED_OUTSIDE_SMX BIT(2)
+#define FEAT_CTL_SGX_ENABLED BIT(18)
#define FEAT_CTL_LMCE_ENABLED BIT(20)
#define MSR_IA32_TSC_ADJUST 0x0000003b
diff --git a/arch/x86/include/asm/required-features.h b/arch/x86/include/asm/required-features.h
index 6847d85400a8..039e58be2fe6 100644
--- a/arch/x86/include/asm/required-features.h
+++ b/arch/x86/include/asm/required-features.h
@@ -101,6 +101,6 @@
#define REQUIRED_MASK16 0
#define REQUIRED_MASK17 0
#define REQUIRED_MASK18 0
-#define REQUIRED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 19)
+#define REQUIRED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 20)
#endif /* _ASM_X86_REQUIRED_FEATURES_H */
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 52c9bfbbdb2a..db0c676b2eb0 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -915,6 +915,10 @@ void get_cpu_cap(struct cpuinfo_x86 *c)
c->x86_capability[CPUID_D_1_EAX] = eax;
}
+ /* Additional Intel-defined SGX flags: level 0x00000012 */
+ if (c->cpuid_level >= 0x00000012)
+ c->x86_capability[CPUID_12_EAX] = cpuid_eax(0x00000012);
+
/* AMD-defined flags: level 0x80000001 */
eax = cpuid_eax(0x80000000);
c->extended_cpuid_level = eax;
diff --git a/tools/arch/x86/include/asm/cpufeatures.h b/tools/arch/x86/include/asm/cpufeatures.h
index f3327cb56edf..42ae9fb06987 100644
--- a/tools/arch/x86/include/asm/cpufeatures.h
+++ b/tools/arch/x86/include/asm/cpufeatures.h
@@ -13,7 +13,7 @@
/*
* Defines x86 CPU feature bits
*/
-#define NCAPINTS 19 /* N 32-bit words worth of info */
+#define NCAPINTS 20 /* N 32-bit words worth of info */
#define NBUGINTS 1 /* N 32-bit bug flags */
/*
@@ -238,6 +238,7 @@
/* Intel-defined CPU features, CPUID level 0x00000007:0 (EBX), word 9 */
#define X86_FEATURE_FSGSBASE ( 9*32+ 0) /* RDFSBASE, WRFSBASE, RDGSBASE, WRGSBASE instructions*/
#define X86_FEATURE_TSC_ADJUST ( 9*32+ 1) /* TSC adjustment MSR 0x3B */
+#define X86_FEATURE_SGX ( 9*32+ 2) /* Software Guard Extensions */
#define X86_FEATURE_BMI1 ( 9*32+ 3) /* 1st group bit manipulation extensions */
#define X86_FEATURE_HLE ( 9*32+ 4) /* Hardware Lock Elision */
#define X86_FEATURE_AVX2 ( 9*32+ 5) /* AVX2 instructions */
@@ -369,6 +370,10 @@
#define X86_FEATURE_ARCH_CAPABILITIES (18*32+29) /* IA32_ARCH_CAPABILITIES MSR (Intel) */
#define X86_FEATURE_SPEC_CTRL_SSBD (18*32+31) /* "" Speculative Store Bypass Disable */
+/* Intel-defined SGX features, CPUID level 0x00000012:0 (EAX), word 19 */
+#define X86_FEATURE_SGX1 (19*32+ 0) /* SGX1 leaf functions */
+#define X86_FEATURE_SGX2 (19*32+ 1) /* SGX2 leaf functions */
+
/*
* BUG word(s)
*/
--
2.25.0
From: Sean Christopherson <[email protected]>
Add X86_FEATURE_SGX_LC, which informs whether or not the CPU supports SGX
Launch Control.
Add MSR_IA32_SGXLEPUBKEYHASH{0, 1, 2, 3}, which when combined contain a
SHA256 hash of a 3072-bit RSA public key. SGX backed software packages, so
called enclaves, are always signed. All enclaves signed with the public key
are unconditionally allowed to initialize. [1]
Add FEATURE_CONTROL_SGX_LE_WR bit of the feature control MSR, which informs
whether the formentioned MSRs are writable or not. If the bit is off, the
public key MSRs are read-only for the OS.
If the MSRs are read-only, the platform must provide a launch enclave (LE).
LE can create cryptographic tokens for other enclaves that they can pass
together with their signature to the ENCLS(EINIT) opcode, which is used
to initialize enclaves.
Linux is unlikely to support the locked configuration because it takes away
the control of the launch decisions from the kernel.
[1] Intel SDM: 38.1.4 Intel SGX Launch Control Configuration
Signed-off-by: Sean Christopherson <[email protected]>
Co-developed-by: Jarkko Sakkinen <[email protected]>
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
arch/x86/include/asm/cpufeatures.h | 1 +
arch/x86/include/asm/msr-index.h | 7 +++++++
2 files changed, 8 insertions(+)
diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
index 42ae9fb06987..bc5ad93cbeb6 100644
--- a/arch/x86/include/asm/cpufeatures.h
+++ b/arch/x86/include/asm/cpufeatures.h
@@ -350,6 +350,7 @@
#define X86_FEATURE_CLDEMOTE (16*32+25) /* CLDEMOTE instruction */
#define X86_FEATURE_MOVDIRI (16*32+27) /* MOVDIRI instruction */
#define X86_FEATURE_MOVDIR64B (16*32+28) /* MOVDIR64B instruction */
+#define X86_FEATURE_SGX_LC (16*32+30) /* Software Guard Extensions Launch Control */
/* AMD-defined CPU features, CPUID level 0x80000007 (EBX), word 17 */
#define X86_FEATURE_OVERFLOW_RECOV (17*32+ 0) /* MCA overflow recovery support */
diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
index e190293c8923..bae17ea2c8fe 100644
--- a/arch/x86/include/asm/msr-index.h
+++ b/arch/x86/include/asm/msr-index.h
@@ -566,6 +566,7 @@
#define FEAT_CTL_LOCKED BIT(0)
#define FEAT_CTL_VMX_ENABLED_INSIDE_SMX BIT(1)
#define FEAT_CTL_VMX_ENABLED_OUTSIDE_SMX BIT(2)
+#define FEAT_CTL_SGX_LC_ENABLED BIT(17)
#define FEAT_CTL_SGX_ENABLED BIT(18)
#define FEAT_CTL_LMCE_ENABLED BIT(20)
@@ -586,6 +587,12 @@
#define MSR_IA32_UCODE_WRITE 0x00000079
#define MSR_IA32_UCODE_REV 0x0000008b
+/* Intel SGX Launch Enclave Public Key Hash MSRs */
+#define MSR_IA32_SGXLEPUBKEYHASH0 0x0000008C
+#define MSR_IA32_SGXLEPUBKEYHASH1 0x0000008D
+#define MSR_IA32_SGXLEPUBKEYHASH2 0x0000008E
+#define MSR_IA32_SGXLEPUBKEYHASH3 0x0000008F
+
#define MSR_IA32_SMM_MONITOR_CTL 0x0000009b
#define MSR_IA32_SMBASE 0x0000009e
--
2.25.0
Add the maintainer information for the SGX subsystem.
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
MAINTAINERS | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/MAINTAINERS b/MAINTAINERS
index fcd79fc38928..6dca914d6926 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -8722,6 +8722,17 @@ F: Documentation/x86/intel_txt.rst
F: include/linux/tboot.h
F: arch/x86/kernel/tboot.c
+INTEL SGX
+M: Jarkko Sakkinen <[email protected]>
+M: Sean Christopherson <[email protected]>
+L: [email protected]
+S: Maintained
+Q: https://patchwork.kernel.org/project/intel-sgx/list/
+T: git https://github.com/jsakkine-intel/linux-sgx.git
+F: arch/x86/include/uapi/asm/sgx.h
+F: arch/x86/kernel/cpu/sgx/*
+K: \bSGX_
+
INTERCONNECT API
M: Georgi Djakov <[email protected]>
L: [email protected]
--
2.25.0
Define the SGX microarchitectural data structures used by various SGX
opcodes. This is not an exhaustive representation of all SGX data
structures but only those needed by the kernel.
The data structures are described in:
Intel SDM: 37.6 INTEL® SGX DATA STRUCTURES OVERVIEW
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
arch/x86/kernel/cpu/sgx/arch.h | 343 +++++++++++++++++++++++++++++++++
1 file changed, 343 insertions(+)
create mode 100644 arch/x86/kernel/cpu/sgx/arch.h
diff --git a/arch/x86/kernel/cpu/sgx/arch.h b/arch/x86/kernel/cpu/sgx/arch.h
new file mode 100644
index 000000000000..ddae55e9d4d8
--- /dev/null
+++ b/arch/x86/kernel/cpu/sgx/arch.h
@@ -0,0 +1,343 @@
+/* SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause) */
+/**
+ * Copyright(c) 2016-18 Intel Corporation.
+ *
+ * Contains data structures defined by the SGX architecture. Data structures
+ * defined by the Linux software stack should not be placed here.
+ */
+#ifndef _ASM_X86_SGX_ARCH_H
+#define _ASM_X86_SGX_ARCH_H
+
+#include <linux/bits.h>
+#include <linux/types.h>
+
+#define SGX_CPUID 0x12
+#define SGX_CPUID_FIRST_VARIABLE_SUB_LEAF 2
+
+/**
+ * enum sgx_return_code - The return code type for ENCLS, ENCLU and ENCLV
+ * %SGX_NOT_TRACKED: Previous ETRACK's shootdown sequence has not
+ * been completed yet.
+ * %SGX_INVALID_EINITTOKEN: EINITTOKEN is invalid and enclave signer's
+ * public key does not match IA32_SGXLEPUBKEYHASH.
+ * %SGX_UNMASKED_EVENT: An unmasked event, e.g. INTR, was received
+ */
+enum sgx_return_code {
+ SGX_NOT_TRACKED = 11,
+ SGX_INVALID_EINITTOKEN = 16,
+ SGX_UNMASKED_EVENT = 128,
+};
+
+/**
+ * enum sgx_sub_leaf_types - SGX CPUID variable sub-leaf types
+ * %SGX_CPUID_SUB_LEAF_INVALID: Indicates this sub-leaf is invalid.
+ * %SGX_CPUID_SUB_LEAF_EPC_SECTION: Sub-leaf enumerates an EPC section.
+ */
+enum sgx_sub_leaf_types {
+ SGX_CPUID_SUB_LEAF_INVALID = 0x0,
+ SGX_CPUID_SUB_LEAF_EPC_SECTION = 0x1,
+};
+
+#define SGX_CPUID_SUB_LEAF_TYPE_MASK GENMASK(3, 0)
+
+#define SGX_MODULUS_SIZE 384
+
+/**
+ * enum sgx_miscselect - additional information to an SSA frame
+ * %SGX_MISC_EXINFO: Report #PF or #GP to the SSA frame.
+ *
+ * Save State Area (SSA) is a stack inside the enclave used to store processor
+ * state when an exception or interrupt occurs. This enum defines additional
+ * information stored to an SSA frame.
+ */
+enum sgx_miscselect {
+ SGX_MISC_EXINFO = BIT(0),
+};
+
+#define SGX_MISC_RESERVED_MASK GENMASK_ULL(63, 1)
+
+#define SGX_SSA_GPRS_SIZE 184
+#define SGX_SSA_MISC_EXINFO_SIZE 16
+
+/**
+ * enum sgx_attributes - the attributes field in &struct sgx_secs
+ * %SGX_ATTR_INIT: Enclave can be entered (is initialized).
+ * %SGX_ATTR_DEBUG: Allow ENCLS(EDBGRD) and ENCLS(EDBGWR).
+ * %SGX_ATTR_MODE64BIT: Tell that this a 64-bit enclave.
+ * %SGX_ATTR_PROVISIONKEY: Allow to use provisioning keys for remote
+ * attestation.
+ * %SGX_ATTR_KSS: Allow to use key separation and sharing (KSS).
+ * %SGX_ATTR_EINITTOKENKEY: Allow to use token signing key that is used to
+ * sign cryptographic tokens that can be passed to
+ * EINIT as an authorization to run an enclave.
+ */
+enum sgx_attribute {
+ SGX_ATTR_INIT = BIT(0),
+ SGX_ATTR_DEBUG = BIT(1),
+ SGX_ATTR_MODE64BIT = BIT(2),
+ SGX_ATTR_PROVISIONKEY = BIT(4),
+ SGX_ATTR_EINITTOKENKEY = BIT(5),
+ SGX_ATTR_KSS = BIT(7),
+};
+
+#define SGX_ATTR_RESERVED_MASK (BIT_ULL(3) | BIT_ULL(6) | GENMASK_ULL(63, 8))
+#define SGX_ATTR_ALLOWED_MASK (SGX_ATTR_DEBUG | SGX_ATTR_MODE64BIT | \
+ SGX_ATTR_KSS)
+
+/**
+ * struct sgx_secs - SGX Enclave Control Structure (SECS)
+ * @size: size of the address space
+ * @base: base address of the address space
+ * @ssa_frame_size: size of an SSA frame
+ * @miscselect: additional information stored to an SSA frame
+ * @attributes: attributes for enclave
+ * @xfrm: XSave-Feature Request Mask (subset of XCR0)
+ * @mrenclave: SHA256-hash of the enclave contents
+ * @mrsigner: SHA256-hash of the public key used to sign the SIGSTRUCT
+ * @config_id: a user-defined value that is used in key derivation
+ * @isv_prod_id: a user-defined value that is used in key derivation
+ * @isv_svn: a user-defined value that is used in key derivation
+ * @config_svn: a user-defined value that is used in key derivation
+ *
+ * SGX Enclave Control Structure (SECS) is a special enclave page that is not
+ * visible in the address space. In fact, this structure defines the address
+ * range and other global attributes for the enclave and it is the first EPC
+ * page created for any enclave. It is moved from a temporary buffer to an EPC
+ * by the means of ENCLS(ECREATE) leaf.
+ */
+struct sgx_secs {
+ u64 size;
+ u64 base;
+ u32 ssa_frame_size;
+ u32 miscselect;
+ u8 reserved1[24];
+ u64 attributes;
+ u64 xfrm;
+ u32 mrenclave[8];
+ u8 reserved2[32];
+ u32 mrsigner[8];
+ u8 reserved3[32];
+ u32 config_id[16];
+ u16 isv_prod_id;
+ u16 isv_svn;
+ u16 config_svn;
+ u8 reserved4[3834];
+} __packed;
+
+/**
+ * enum sgx_tcs_flags - execution flags for TCS
+ * %SGX_TCS_DBGOPTIN: If enabled allows single-stepping and breakpoints
+ * inside an enclave. It is cleared by EADD but can
+ * be set later with EDBGWR.
+ */
+enum sgx_tcs_flags {
+ SGX_TCS_DBGOPTIN = 0x01,
+};
+
+#define SGX_TCS_RESERVED_MASK GENMASK_ULL(63, 1)
+#define SGX_TCS_RESERVED_SIZE 4024
+
+/**
+ * struct sgx_tcs - Thread Control Structure (TCS)
+ * @state: used to mark an entered TCS
+ * @flags: execution flags (cleared by EADD)
+ * @ssa_offset: SSA stack offset relative to the enclave base
+ * @ssa_index: the current SSA frame index (cleard by EADD)
+ * @nr_ssa_frames: the number of frame in the SSA stack
+ * @entry_offset: entry point offset relative to the enclave base
+ * @exit_addr: address outside the enclave to exit on an exception or
+ * interrupt
+ * @fs_offset: offset relative to the enclave base to become FS
+ * segment inside the enclave
+ * @gs_offset: offset relative to the enclave base to become GS
+ * segment inside the enclave
+ * @fs_limit: size to become a new FS-limit (only 32-bit enclaves)
+ * @gs_limit: size to become a new GS-limit (only 32-bit enclaves)
+ *
+ * Thread Control Structure (TCS) is an enclave page visible in its address
+ * space that defines an entry point inside the enclave. A thread enters inside
+ * an enclave by supplying address of TCS to ENCLU(EENTER). A TCS can be entered
+ * by only one thread at a time.
+ */
+struct sgx_tcs {
+ u64 state;
+ u64 flags;
+ u64 ssa_offset;
+ u32 ssa_index;
+ u32 nr_ssa_frames;
+ u64 entry_offset;
+ u64 exit_addr;
+ u64 fs_offset;
+ u64 gs_offset;
+ u32 fs_limit;
+ u32 gs_limit;
+ u8 reserved[SGX_TCS_RESERVED_SIZE];
+} __packed;
+
+/**
+ * struct sgx_pageinfo - an enclave page descriptor
+ * @addr: address of the enclave page
+ * @contents: pointer to the page contents
+ * @metadata: pointer either to a SECINFO or PCMD instance
+ * @secs: address of the SECS page
+ */
+struct sgx_pageinfo {
+ u64 addr;
+ u64 contents;
+ u64 metadata;
+ u64 secs;
+} __packed __aligned(32);
+
+
+/**
+ * enum sgx_page_type - bits in the SECINFO flags defining the page type
+ * %SGX_PAGE_TYPE_SECS: a SECS page
+ * %SGX_PAGE_TYPE_TCS: a TCS page
+ * %SGX_PAGE_TYPE_REG: a regular page
+ * %SGX_PAGE_TYPE_VA: a VA page
+ * %SGX_PAGE_TYPE_TRIM: a page in trimmed state
+ */
+enum sgx_page_type {
+ SGX_PAGE_TYPE_SECS,
+ SGX_PAGE_TYPE_TCS,
+ SGX_PAGE_TYPE_REG,
+ SGX_PAGE_TYPE_VA,
+ SGX_PAGE_TYPE_TRIM,
+};
+
+#define SGX_NR_PAGE_TYPES 5
+#define SGX_PAGE_TYPE_MASK GENMASK(7, 0)
+
+/**
+ * enum sgx_secinfo_flags - the flags field in &struct sgx_secinfo
+ * %SGX_SECINFO_R: allow read
+ * %SGX_SECINFO_W: allow write
+ * %SGX_SECINFO_X: allow execution
+ * %SGX_SECINFO_SECS: a SECS page
+ * %SGX_SECINFO_TCS: a TCS page
+ * %SGX_SECINFO_REG: a regular page
+ * %SGX_SECINFO_VA: a VA page
+ * %SGX_SECINFO_TRIM: a page in trimmed state
+ */
+enum sgx_secinfo_flags {
+ SGX_SECINFO_R = BIT(0),
+ SGX_SECINFO_W = BIT(1),
+ SGX_SECINFO_X = BIT(2),
+ SGX_SECINFO_SECS = (SGX_PAGE_TYPE_SECS << 8),
+ SGX_SECINFO_TCS = (SGX_PAGE_TYPE_TCS << 8),
+ SGX_SECINFO_REG = (SGX_PAGE_TYPE_REG << 8),
+ SGX_SECINFO_VA = (SGX_PAGE_TYPE_VA << 8),
+ SGX_SECINFO_TRIM = (SGX_PAGE_TYPE_TRIM << 8),
+};
+
+#define SGX_SECINFO_PERMISSION_MASK GENMASK_ULL(2, 0)
+#define SGX_SECINFO_PAGE_TYPE_MASK (SGX_PAGE_TYPE_MASK << 8)
+#define SGX_SECINFO_RESERVED_MASK ~(SGX_SECINFO_PERMISSION_MASK | \
+ SGX_SECINFO_PAGE_TYPE_MASK)
+
+/**
+ * struct sgx_secinfo - describes attributes of an EPC page
+ * @flags: permissions and type
+ *
+ * Used together with ENCLS leaves that add or modify an EPC page to an
+ * enclave to define page permissions and type.
+ */
+struct sgx_secinfo {
+ u64 flags;
+ u8 reserved[56];
+} __packed __aligned(64);
+
+#define SGX_PCMD_RESERVED_SIZE 40
+
+/**
+ * struct sgx_pcmd - Paging Crypto Metadata (PCMD)
+ * @enclave_id: enclave identifier
+ * @mac: MAC over PCMD, page contents and isvsvn
+ *
+ * PCMD is stored for every swapped page to the regular memory. When ELDU loads
+ * the page back it recalculates the MAC by using a isvsvn number stored in a
+ * VA page. Together these two structures bring integrity and rollback
+ * protection.
+ */
+struct sgx_pcmd {
+ struct sgx_secinfo secinfo;
+ u64 enclave_id;
+ u8 reserved[SGX_PCMD_RESERVED_SIZE];
+ u8 mac[16];
+} __packed __aligned(128);
+
+#define SGX_SIGSTRUCT_RESERVED1_SIZE 84
+#define SGX_SIGSTRUCT_RESERVED2_SIZE 20
+#define SGX_SIGSTRUCT_RESERVED3_SIZE 32
+#define SGX_SIGSTRUCT_RESERVED4_SIZE 12
+
+/**
+ * struct sgx_sigstruct_header - defines author of the enclave
+ * @header1: constant byte string
+ * @vendor: must be either 0x0000 or 0x8086
+ * @date: YYYYMMDD in BCD
+ * @header2: costant byte string
+ * @swdefined: software defined value
+ */
+struct sgx_sigstruct_header {
+ u64 header1[2];
+ u32 vendor;
+ u32 date;
+ u64 header2[2];
+ u32 swdefined;
+ u8 reserved1[84];
+} __packed;
+
+/**
+ * struct sgx_sigstruct_body - defines contents of the enclave
+ * @miscselect: additional information stored to an SSA frame
+ * @misc_mask: required miscselect in SECS
+ * @attributes: attributes for enclave
+ * @xfrm: XSave-Feature Request Mask (subset of XCR0)
+ * @attributes_mask: required attributes in SECS
+ * @xfrm_mask: required XFRM in SECS
+ * @mrenclave: SHA256-hash of the enclave contents
+ * @isvprodid: a user-defined value that is used in key derivation
+ * @isvsvn: a user-defined value that is used in key derivation
+ */
+struct sgx_sigstruct_body {
+ u32 miscselect;
+ u32 misc_mask;
+ u8 reserved2[20];
+ u64 attributes;
+ u64 xfrm;
+ u64 attributes_mask;
+ u64 xfrm_mask;
+ u8 mrenclave[32];
+ u8 reserved3[32];
+ u16 isvprodid;
+ u16 isvsvn;
+} __packed;
+
+/**
+ * struct sgx_sigstruct - an enclave signature
+ * @header: defines author of the enclave
+ * @modulus: the modulus of the public key
+ * @exponent: the exponent of the public key
+ * @signature: the signature calculated over the fields except modulus,
+ * @body: defines contents of the enclave
+ * @q1: a value used in RSA signature verification
+ * @q2: a value used in RSA signature verification
+ *
+ * Header and body are the parts that are actual signed. The remaining fields
+ * define the signature of the enclave.
+ */
+struct sgx_sigstruct {
+ struct sgx_sigstruct_header header;
+ u8 modulus[SGX_MODULUS_SIZE];
+ u32 exponent;
+ u8 signature[SGX_MODULUS_SIZE];
+ struct sgx_sigstruct_body body;
+ u8 reserved4[12];
+ u8 q1[SGX_MODULUS_SIZE];
+ u8 q2[SGX_MODULUS_SIZE];
+} __packed;
+
+#define SGX_LAUNCH_TOKEN_SIZE 304
+
+#endif /* _ASM_X86_SGX_ARCH_H */
--
2.25.0
From: Sean Christopherson <[email protected]>
Include SGX bit to the PF error codes and throw SIGSEGV with PF_SGX when
a #PF with SGX set happens.
CPU throws a #PF with the SGX bit in the event of Enclave Page Cache Map
(EPCM) conflict. The EPCM is a CPU-internal table, which describes the
properties for a enclave page. Enclaves are measured and signed software
entities, which SGX hosts. [1]
Although the primary purpose of the EPCM conflict checks is to prevent
malicious accesses to an enclave, an illegit access can happen also for
legit reasons.
All SGX reserved memory, including EPCM is encrypted with a transient
key that does not survive from the power transition. Throwing a SIGSEGV
allows user space software react when this happens (e.g. rec-create the
enclave, which was invalidated).
[1] Intel SDM: 36.5.1 Enclave Page Cache Map (EPCM)
Signed-off-by: Sean Christopherson <[email protected]>
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
arch/x86/include/asm/traps.h | 1 +
arch/x86/mm/fault.c | 13 +++++++++++++
2 files changed, 14 insertions(+)
diff --git a/arch/x86/include/asm/traps.h b/arch/x86/include/asm/traps.h
index ffa0dc8a535e..bb8d5ae74dbc 100644
--- a/arch/x86/include/asm/traps.h
+++ b/arch/x86/include/asm/traps.h
@@ -174,5 +174,6 @@ enum x86_pf_error_code {
X86_PF_RSVD = 1 << 3,
X86_PF_INSTR = 1 << 4,
X86_PF_PK = 1 << 5,
+ X86_PF_SGX = 1 << 15,
};
#endif /* _ASM_X86_TRAPS_H */
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index fa4ea09593ab..dee9504cde79 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -1179,6 +1179,19 @@ access_error(unsigned long error_code, struct vm_area_struct *vma)
if (error_code & X86_PF_PK)
return 1;
+ /*
+ * Access is blocked by the Enclave Page Cache Map (EPCM), i.e. the
+ * access is allowed by the PTE but not the EPCM. This usually happens
+ * when the EPCM is yanked out from under us, e.g. by hardware after a
+ * suspend/resume cycle. In any case, software, i.e. the kernel, can't
+ * fix the source of the fault as the EPCM can't be directly modified by
+ * software. Handle the fault as an access error in order to signal
+ * userspace so that userspace can rebuild their enclave(s), even though
+ * userspace may not have actually violated access permissions.
+ */
+ if (unlikely(error_code & X86_PF_SGX))
+ return 1;
+
/*
* Make sure to check the VMA so that we do not perform
* faults just to hit a X86_PF_PK as soon as we fill in a
--
2.25.0
From: Sean Christopherson <[email protected]>
Configure SGX as part of feature control MSR initialization and update
the associated X86_FEATURE flags accordingly. Because the kernel will
require the LE hash MSRs to be writable when running native enclaves,
disable X86_FEATURE_SGX (and all derivatives) if SGX Launch Control is
not (or cannot) be fully enabled via feature control MSR.
The check is done for every CPU, not just BSP, in order to verify that
MSR_IA32_FEATURE_CONTROL is correctly configured on all CPUs. The other
parts of the kernel, like the enclave driver, expect the same
configuration from all CPUs.
Note, unlike VMX, clear the X86_FEATURE_SGX* flags for all CPUs if any
CPU lacks SGX support as the kernel expects SGX to be available on all
CPUs. X86_FEATURE_VMX is intentionally cleared only for the current CPU
so that KVM can provide additional information if KVM fails to load,
e.g. print which CPU doesn't support VMX. KVM/VMX requires additional
per-CPU enabling, e.g. to set CR4.VMXE and do VMXON, and so already has
the necessary infrastructure to do per-CPU checks. SGX on the other
hand doesn't require additional enabling, so clearing the feature flags
on all CPUs means the SGX subsystem doesn't need to manually do support
checks on a per-CPU basis.
Signed-off-by: Sean Christopherson <[email protected]>
Co-developed-by: Jarkko Sakkinen <[email protected]>
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
arch/x86/kernel/cpu/feat_ctl.c | 29 ++++++++++++++++++++++++++++-
1 file changed, 28 insertions(+), 1 deletion(-)
diff --git a/arch/x86/kernel/cpu/feat_ctl.c b/arch/x86/kernel/cpu/feat_ctl.c
index 0268185bef94..b16b71a6da74 100644
--- a/arch/x86/kernel/cpu/feat_ctl.c
+++ b/arch/x86/kernel/cpu/feat_ctl.c
@@ -92,6 +92,14 @@ static void init_vmx_capabilities(struct cpuinfo_x86 *c)
}
#endif /* CONFIG_X86_VMX_FEATURE_NAMES */
+static void clear_sgx_caps(void)
+{
+ setup_clear_cpu_cap(X86_FEATURE_SGX);
+ setup_clear_cpu_cap(X86_FEATURE_SGX_LC);
+ setup_clear_cpu_cap(X86_FEATURE_SGX1);
+ setup_clear_cpu_cap(X86_FEATURE_SGX2);
+}
+
void init_ia32_feat_ctl(struct cpuinfo_x86 *c)
{
bool tboot = tboot_enabled();
@@ -99,6 +107,7 @@ void init_ia32_feat_ctl(struct cpuinfo_x86 *c)
if (rdmsrl_safe(MSR_IA32_FEAT_CTL, &msr)) {
clear_cpu_cap(c, X86_FEATURE_VMX);
+ clear_sgx_caps();
return;
}
@@ -123,13 +132,21 @@ void init_ia32_feat_ctl(struct cpuinfo_x86 *c)
msr |= FEAT_CTL_VMX_ENABLED_INSIDE_SMX;
}
+ /*
+ * Enable SGX if and only if the kernel supports SGX and Launch Control
+ * is supported, i.e. disable SGX if the LE hash MSRs can't be written.
+ */
+ if (cpu_has(c, X86_FEATURE_SGX) && cpu_has(c, X86_FEATURE_SGX_LC) &&
+ IS_ENABLED(CONFIG_INTEL_SGX))
+ msr |= FEAT_CTL_SGX_ENABLED | FEAT_CTL_SGX_LC_ENABLED;
+
wrmsrl(MSR_IA32_FEAT_CTL, msr);
update_caps:
set_cpu_cap(c, X86_FEATURE_MSR_IA32_FEAT_CTL);
if (!cpu_has(c, X86_FEATURE_VMX))
- return;
+ goto update_sgx;
if ( (tboot && !(msr & FEAT_CTL_VMX_ENABLED_INSIDE_SMX)) ||
(!tboot && !(msr & FEAT_CTL_VMX_ENABLED_OUTSIDE_SMX))) {
@@ -142,4 +159,14 @@ void init_ia32_feat_ctl(struct cpuinfo_x86 *c)
init_vmx_capabilities(c);
#endif
}
+
+update_sgx:
+ if (!cpu_has(c, X86_FEATURE_SGX) || !cpu_has(c, X86_FEATURE_SGX_LC)) {
+ clear_sgx_caps();
+ } else if (!(msr & FEAT_CTL_SGX_ENABLED) ||
+ !(msr & FEAT_CTL_SGX_LC_ENABLED)) {
+ if (IS_ENABLED(CONFIG_INTEL_SGX))
+ pr_err_once("SGX disabled by BIOS\n");
+ clear_sgx_caps();
+ }
}
--
2.25.0
From: Sean Christopherson <[email protected]>
Enumerate Enclave Page Cache (EPC) sections via CPUID and add the data
structures necessary to track EPC pages so that they can be allocated,
freed and managed. As a system may have multiple EPC sections, invoke CPUID
on SGX sub-leafs until an invalid leaf is encountered.
For simplicity, support a maximum of eight EPC sections. Existing client
hardware supports only a single section, while upcoming server hardware
will support at most eight sections. Bounding the number of sections also
allows the section ID to be embedded along with a page's offset in a single
unsigned long, enabling easy retrieval of both the VA and PA for a given
page.
Signed-off-by: Sean Christopherson <[email protected]>
Co-developed-by: Serge Ayoun <[email protected]>
Signed-off-by: Serge Ayoun <[email protected]>
Co-developed-by: Jarkko Sakkinen <[email protected]>
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
arch/x86/Kconfig | 14 +++
arch/x86/kernel/cpu/Makefile | 1 +
arch/x86/kernel/cpu/sgx/Makefile | 3 +
arch/x86/kernel/cpu/sgx/main.c | 151 ++++++++++++++++++++++++++++++
arch/x86/kernel/cpu/sgx/reclaim.c | 82 ++++++++++++++++
arch/x86/kernel/cpu/sgx/sgx.h | 70 ++++++++++++++
6 files changed, 321 insertions(+)
create mode 100644 arch/x86/kernel/cpu/sgx/Makefile
create mode 100644 arch/x86/kernel/cpu/sgx/main.c
create mode 100644 arch/x86/kernel/cpu/sgx/reclaim.c
create mode 100644 arch/x86/kernel/cpu/sgx/sgx.h
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index beea77046f9b..8bbb4313fae3 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -1950,6 +1950,20 @@ config X86_INTEL_TSX_MODE_AUTO
side channel attacks- equals the tsx=auto command line parameter.
endchoice
+config INTEL_SGX
+ bool "Intel SGX"
+ depends on X86_64 && CPU_SUP_INTEL
+ select SRCU
+ select MMU_NOTIFIER
+ help
+ Intel(R) SGX is a set of CPU instructions that can be used by
+ applications to set aside private regions of code and data, referred
+ to as enclaves. An enclave's private memory can only be accessed by
+ code running within the enclave. Accesses from outside the enclave,
+ including other enclaves, are disallowed by hardware.
+
+ If unsure, say N.
+
config EFI
bool "EFI runtime service support"
depends on ACPI
diff --git a/arch/x86/kernel/cpu/Makefile b/arch/x86/kernel/cpu/Makefile
index 7dc4ad68eb41..45534fb81007 100644
--- a/arch/x86/kernel/cpu/Makefile
+++ b/arch/x86/kernel/cpu/Makefile
@@ -46,6 +46,7 @@ obj-$(CONFIG_X86_MCE) += mce/
obj-$(CONFIG_MTRR) += mtrr/
obj-$(CONFIG_MICROCODE) += microcode/
obj-$(CONFIG_X86_CPU_RESCTRL) += resctrl/
+obj-$(CONFIG_INTEL_SGX) += sgx/
obj-$(CONFIG_X86_LOCAL_APIC) += perfctr-watchdog.o
diff --git a/arch/x86/kernel/cpu/sgx/Makefile b/arch/x86/kernel/cpu/sgx/Makefile
new file mode 100644
index 000000000000..2dec75916a5e
--- /dev/null
+++ b/arch/x86/kernel/cpu/sgx/Makefile
@@ -0,0 +1,3 @@
+obj-y += \
+ main.o \
+ reclaim.o
diff --git a/arch/x86/kernel/cpu/sgx/main.c b/arch/x86/kernel/cpu/sgx/main.c
new file mode 100644
index 000000000000..38424c1e8341
--- /dev/null
+++ b/arch/x86/kernel/cpu/sgx/main.c
@@ -0,0 +1,151 @@
+// SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause)
+// Copyright(c) 2016-17 Intel Corporation.
+
+#include <linux/freezer.h>
+#include <linux/highmem.h>
+#include <linux/kthread.h>
+#include <linux/pagemap.h>
+#include <linux/ratelimit.h>
+#include <linux/sched/signal.h>
+#include <linux/slab.h>
+#include "encls.h"
+
+struct sgx_epc_section sgx_epc_sections[SGX_MAX_EPC_SECTIONS];
+int sgx_nr_epc_sections;
+
+static void __init sgx_free_epc_section(struct sgx_epc_section *section)
+{
+ struct sgx_epc_page *page;
+
+ while (!list_empty(§ion->page_list)) {
+ page = list_first_entry(§ion->page_list,
+ struct sgx_epc_page, list);
+ list_del(&page->list);
+ kfree(page);
+ }
+
+ while (!list_empty(§ion->unsanitized_page_list)) {
+ page = list_first_entry(§ion->unsanitized_page_list,
+ struct sgx_epc_page, list);
+ list_del(&page->list);
+ kfree(page);
+ }
+
+ memunmap(section->va);
+}
+
+static bool __init sgx_alloc_epc_section(u64 addr, u64 size,
+ unsigned long index,
+ struct sgx_epc_section *section)
+{
+ unsigned long nr_pages = size >> PAGE_SHIFT;
+ struct sgx_epc_page *page;
+ unsigned long i;
+
+ section->va = memremap(addr, size, MEMREMAP_WB);
+ if (!section->va)
+ return false;
+
+ section->pa = addr;
+ spin_lock_init(§ion->lock);
+ INIT_LIST_HEAD(§ion->page_list);
+ INIT_LIST_HEAD(§ion->unsanitized_page_list);
+
+ for (i = 0; i < nr_pages; i++) {
+ page = kzalloc(sizeof(*page), GFP_KERNEL);
+ if (!page)
+ goto err_out;
+
+ page->desc = (addr + (i << PAGE_SHIFT)) | index;
+ list_add_tail(&page->list, §ion->unsanitized_page_list);
+ }
+
+ return true;
+
+err_out:
+ sgx_free_epc_section(section);
+ return false;
+}
+
+static void __init sgx_page_cache_teardown(void)
+{
+ int i;
+
+ for (i = 0; i < sgx_nr_epc_sections; i++)
+ sgx_free_epc_section(&sgx_epc_sections[i]);
+}
+
+/**
+ * A section metric is concatenated in a way that @low bits 12-31 define the
+ * bits 12-31 of the metric and @high bits 0-19 define the bits 32-51 of the
+ * metric.
+ */
+static inline u64 __init sgx_calc_section_metric(u64 low, u64 high)
+{
+ return (low & GENMASK_ULL(31, 12)) +
+ ((high & GENMASK_ULL(19, 0)) << 32);
+}
+
+static bool __init sgx_page_cache_init(void)
+{
+ u32 eax, ebx, ecx, edx, type;
+ u64 pa, size;
+ int i;
+
+ for (i = 0; i <= ARRAY_SIZE(sgx_epc_sections); i++) {
+ cpuid_count(SGX_CPUID, i + SGX_CPUID_FIRST_VARIABLE_SUB_LEAF,
+ &eax, &ebx, &ecx, &edx);
+
+ type = eax & SGX_CPUID_SUB_LEAF_TYPE_MASK;
+ if (type == SGX_CPUID_SUB_LEAF_INVALID)
+ break;
+
+ if (type != SGX_CPUID_SUB_LEAF_EPC_SECTION) {
+ pr_err_once("Unknown EPC section type: %u\n", type);
+ break;
+ }
+
+ if (i == ARRAY_SIZE(sgx_epc_sections)) {
+ pr_warn("No free slot for an EPC section\n");
+ break;
+ }
+
+ pa = sgx_calc_section_metric(eax, ebx);
+ size = sgx_calc_section_metric(ecx, edx);
+
+ pr_info("EPC section 0x%llx-0x%llx\n", pa, pa + size - 1);
+
+ if (!sgx_alloc_epc_section(pa, size, i, &sgx_epc_sections[i])) {
+ pr_err("No free memory for an EPC section\n");
+ break;
+ }
+
+ sgx_nr_epc_sections++;
+ }
+
+ if (!sgx_nr_epc_sections) {
+ pr_err("There are zero EPC sections.\n");
+ return false;
+ }
+
+ return true;
+}
+
+static void __init sgx_init(void)
+{
+ if (!boot_cpu_has(X86_FEATURE_SGX))
+ return;
+
+ if (!sgx_page_cache_init())
+ return;
+
+ if (!sgx_page_reclaimer_init())
+ goto err_page_cache;
+
+ return;
+
+err_page_cache:
+ sgx_page_cache_teardown();
+}
+
+arch_initcall(sgx_init);
diff --git a/arch/x86/kernel/cpu/sgx/reclaim.c b/arch/x86/kernel/cpu/sgx/reclaim.c
new file mode 100644
index 000000000000..215371588a25
--- /dev/null
+++ b/arch/x86/kernel/cpu/sgx/reclaim.c
@@ -0,0 +1,82 @@
+// SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause)
+// Copyright(c) 2016-19 Intel Corporation.
+
+#include <linux/freezer.h>
+#include <linux/highmem.h>
+#include <linux/kthread.h>
+#include <linux/pagemap.h>
+#include <linux/ratelimit.h>
+#include <linux/slab.h>
+#include <linux/sched/mm.h>
+#include <linux/sched/signal.h>
+#include "encls.h"
+
+struct task_struct *ksgxswapd_tsk;
+
+static void sgx_sanitize_section(struct sgx_epc_section *section)
+{
+ struct sgx_epc_page *page;
+ LIST_HEAD(secs_list);
+ int ret;
+
+ while (!list_empty(§ion->unsanitized_page_list)) {
+ if (kthread_should_stop())
+ return;
+
+ spin_lock(§ion->lock);
+
+ page = list_first_entry(§ion->unsanitized_page_list,
+ struct sgx_epc_page, list);
+
+ ret = __eremove(sgx_epc_addr(page));
+ if (!ret)
+ list_move(&page->list, §ion->page_list);
+ else
+ list_move_tail(&page->list, &secs_list);
+
+ spin_unlock(§ion->lock);
+
+ cond_resched();
+ }
+}
+
+static int ksgxswapd(void *p)
+{
+ int i;
+
+ set_freezable();
+
+ /*
+ * Reset all pages to uninitialized state. Pages could be in initialized
+ * on kmemexec.
+ */
+ for (i = 0; i < sgx_nr_epc_sections; i++)
+ sgx_sanitize_section(&sgx_epc_sections[i]);
+
+ /*
+ * 2nd round for the SECS pages as they cannot be removed when they
+ * still hold child pages.
+ */
+ for (i = 0; i < sgx_nr_epc_sections; i++) {
+ sgx_sanitize_section(&sgx_epc_sections[i]);
+
+ /* Should never happen. */
+ if (!list_empty(&sgx_epc_sections[i].unsanitized_page_list))
+ WARN(1, "EPC section %d has unsanitized pages.\n", i);
+ }
+
+ return 0;
+}
+
+bool __init sgx_page_reclaimer_init(void)
+{
+ struct task_struct *tsk;
+
+ tsk = kthread_run(ksgxswapd, NULL, "ksgxswapd");
+ if (IS_ERR(tsk))
+ return false;
+
+ ksgxswapd_tsk = tsk;
+
+ return true;
+}
diff --git a/arch/x86/kernel/cpu/sgx/sgx.h b/arch/x86/kernel/cpu/sgx/sgx.h
new file mode 100644
index 000000000000..aad30980be32
--- /dev/null
+++ b/arch/x86/kernel/cpu/sgx/sgx.h
@@ -0,0 +1,70 @@
+/* SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause) */
+#ifndef _X86_SGX_H
+#define _X86_SGX_H
+
+#include <linux/bitops.h>
+#include <linux/err.h>
+#include <linux/io.h>
+#include <linux/rwsem.h>
+#include <linux/types.h>
+#include <asm/asm.h>
+#include "arch.h"
+
+#undef pr_fmt
+#define pr_fmt(fmt) "sgx: " fmt
+
+struct sgx_epc_page {
+ unsigned long desc;
+ struct list_head list;
+};
+
+/**
+ * struct sgx_epc_section
+ *
+ * The firmware can define multiple chunks of EPC to the different areas of the
+ * physical memory e.g. for memory areas of the each node. This structure is
+ * used to store EPC pages for one EPC section and virtual memory area where
+ * the pages have been mapped.
+ */
+struct sgx_epc_section {
+ unsigned long pa;
+ void *va;
+ struct list_head page_list;
+ struct list_head unsanitized_page_list;
+ spinlock_t lock;
+};
+
+/**
+ * enum sgx_epc_page_desc - bits and masks for an EPC page's descriptor
+ * %SGX_EPC_SECTION_MASK: SGX allows to have multiple EPC sections in the
+ * physical memory. The existing and near-future
+ * hardware defines at most eight sections, hence
+ * three bits to hold a section.
+ */
+enum sgx_epc_page_desc {
+ SGX_EPC_SECTION_MASK = GENMASK_ULL(3, 0),
+ /* bits 12-63 are reserved for the physical page address of the page */
+};
+
+#define SGX_MAX_EPC_SECTIONS (SGX_EPC_SECTION_MASK + 1)
+
+extern struct sgx_epc_section sgx_epc_sections[SGX_MAX_EPC_SECTIONS];
+
+static inline struct sgx_epc_section *sgx_epc_section(struct sgx_epc_page *page)
+{
+ return &sgx_epc_sections[page->desc & SGX_EPC_SECTION_MASK];
+}
+
+static inline void *sgx_epc_addr(struct sgx_epc_page *page)
+{
+ struct sgx_epc_section *section = sgx_epc_section(page);
+
+ return section->va + (page->desc & PAGE_MASK) - section->pa;
+}
+
+extern int sgx_nr_epc_sections;
+extern struct task_struct *ksgxswapd_tsk;
+
+bool __init sgx_page_reclaimer_init(void);
+
+#endif /* _X86_SGX_H */
--
2.25.0
From: Sean Christopherson <[email protected]>
Add vm_ops()->may_mprotect() to check additional constrains set by a
subsystem for a mprotect() call.
Signed-off-by: Sean Christopherson <[email protected]>
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
include/linux/mm.h | 2 ++
mm/mprotect.c | 14 +++++++++++---
2 files changed, 13 insertions(+), 3 deletions(-)
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 52269e56c514..ad08eb666e1c 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -464,6 +464,8 @@ struct vm_operations_struct {
void (*close)(struct vm_area_struct * area);
int (*split)(struct vm_area_struct * area, unsigned long addr);
int (*mremap)(struct vm_area_struct * area);
+ int (*may_mprotect)(struct vm_area_struct *vma, unsigned long start,
+ unsigned long end, unsigned long prot);
vm_fault_t (*fault)(struct vm_fault *vmf);
vm_fault_t (*huge_fault)(struct vm_fault *vmf,
enum page_entry_size pe_size);
diff --git a/mm/mprotect.c b/mm/mprotect.c
index 7a8e84f86831..c0cb40e23b43 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -543,13 +543,21 @@ static int do_mprotect_pkey(unsigned long start, size_t len,
goto out;
}
+ tmp = vma->vm_end;
+ if (tmp > end)
+ tmp = end;
+
+ if (vma->vm_ops && vma->vm_ops->may_mprotect) {
+ error = vma->vm_ops->may_mprotect(vma, nstart, tmp,
+ prot);
+ if (error)
+ goto out;
+ }
+
error = security_file_mprotect(vma, reqprot, prot);
if (error)
goto out;
- tmp = vma->vm_end;
- if (tmp > end)
- tmp = end;
error = mprotect_fixup(vma, &prev, nstart, tmp, newflags);
if (error)
goto out;
--
2.25.0
ENCLS is a ring 0 instruction, which contains a set of leaf functions for
managing an enclave. Enclaves are measured and signed software entities,
which are protected by asserting the outside memory accesses and memory
encryption.
Add a two-layer macro system along with an encoding scheme to allow
wrappers to return trap numbers along ENCLS-specific error codes. The
bottom layer of the macro system splits between the leafs that return an
error code and those that do not. The second layer generates the correct
input/output annotations based on the number of operands for each leaf
function.
ENCLS leaf functions are documented in
Intel SDM: 36.6 ENCLAVE INSTRUCTIONS AND INTEL®
Co-developed-by: Sean Christopherson <[email protected]>
Signed-off-by: Sean Christopherson <[email protected]>
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
arch/x86/kernel/cpu/sgx/encls.h | 239 ++++++++++++++++++++++++++++++++
1 file changed, 239 insertions(+)
create mode 100644 arch/x86/kernel/cpu/sgx/encls.h
diff --git a/arch/x86/kernel/cpu/sgx/encls.h b/arch/x86/kernel/cpu/sgx/encls.h
new file mode 100644
index 000000000000..f91da6a1bddc
--- /dev/null
+++ b/arch/x86/kernel/cpu/sgx/encls.h
@@ -0,0 +1,239 @@
+/* SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause) */
+#ifndef _X86_ENCLS_H
+#define _X86_ENCLS_H
+
+#include <linux/bitops.h>
+#include <linux/err.h>
+#include <linux/io.h>
+#include <linux/rwsem.h>
+#include <linux/types.h>
+#include <asm/asm.h>
+#include <asm/traps.h>
+#include "sgx.h"
+
+enum sgx_encls_leaf {
+ ECREATE = 0x00,
+ EADD = 0x01,
+ EINIT = 0x02,
+ EREMOVE = 0x03,
+ EDGBRD = 0x04,
+ EDGBWR = 0x05,
+ EEXTEND = 0x06,
+ ELDU = 0x08,
+ EBLOCK = 0x09,
+ EPA = 0x0A,
+ EWB = 0x0B,
+ ETRACK = 0x0C,
+};
+
+/**
+ * ENCLS_FAULT_FLAG - flag signifying an ENCLS return code is a trapnr
+ *
+ * ENCLS has its own (positive value) error codes and also generates
+ * ENCLS specific #GP and #PF faults. And the ENCLS values get munged
+ * with system error codes as everything percolates back up the stack.
+ * Unfortunately (for us), we need to precisely identify each unique
+ * error code, e.g. the action taken if EWB fails varies based on the
+ * type of fault and on the exact SGX error code, i.e. we can't simply
+ * convert all faults to -EFAULT.
+ *
+ * To make all three error types coexist, we set bit 30 to identify an
+ * ENCLS fault. Bit 31 (technically bits N:31) is used to differentiate
+ * between positive (faults and SGX error codes) and negative (system
+ * error codes) values.
+ */
+#define ENCLS_FAULT_FLAG 0x40000000
+
+/* Retrieve the encoded trapnr from the specified return code. */
+#define ENCLS_TRAPNR(r) ((r) & ~ENCLS_FAULT_FLAG)
+
+/* Issue a WARN() about an ENCLS leaf. */
+#define ENCLS_WARN(r, name) { \
+ do { \
+ int _r = (r); \
+ WARN(_r, "%s returned %d (0x%x)\n", (name), _r, _r); \
+ } while (0); \
+}
+
+/**
+ * encls_failed() - Check if an ENCLS leaf function failed
+ * @ret: the return value of an ENCLS leaf function call
+ *
+ * Check if an ENCLS leaf function failed. This happens when the leaf function
+ * causes a fault that is not caused by an EPCM conflict or when the leaf
+ * function returns a non-zero value.
+ */
+static inline bool encls_failed(int ret)
+{
+ int epcm_trapnr;
+
+ if (boot_cpu_has(X86_FEATURE_SGX2))
+ epcm_trapnr = X86_TRAP_PF;
+ else
+ epcm_trapnr = X86_TRAP_GP;
+
+ if (ret & ENCLS_FAULT_FLAG)
+ return ENCLS_TRAPNR(ret) != epcm_trapnr;
+
+ return !!ret;
+}
+
+/**
+ * __encls_ret_N - encode an ENCLS leaf that returns an error code in EAX
+ * @rax: leaf number
+ * @inputs: asm inputs for the leaf
+ *
+ * Emit assembly for an ENCLS leaf that returns an error code, e.g. EREMOVE.
+ * And because SGX isn't complex enough as it is, leafs that return an error
+ * code also modify flags.
+ *
+ * Return:
+ * 0 on success,
+ * SGX error code on failure
+ */
+#define __encls_ret_N(rax, inputs...) \
+ ({ \
+ int ret; \
+ asm volatile( \
+ "1: .byte 0x0f, 0x01, 0xcf;\n\t" \
+ "2:\n" \
+ ".section .fixup,\"ax\"\n" \
+ "3: orl $"__stringify(ENCLS_FAULT_FLAG)",%%eax\n" \
+ " jmp 2b\n" \
+ ".previous\n" \
+ _ASM_EXTABLE_FAULT(1b, 3b) \
+ : "=a"(ret) \
+ : "a"(rax), inputs \
+ : "memory", "cc"); \
+ ret; \
+ })
+
+#define __encls_ret_1(rax, rcx) \
+ ({ \
+ __encls_ret_N(rax, "c"(rcx)); \
+ })
+
+#define __encls_ret_2(rax, rbx, rcx) \
+ ({ \
+ __encls_ret_N(rax, "b"(rbx), "c"(rcx)); \
+ })
+
+#define __encls_ret_3(rax, rbx, rcx, rdx) \
+ ({ \
+ __encls_ret_N(rax, "b"(rbx), "c"(rcx), "d"(rdx)); \
+ })
+
+/**
+ * __encls_N - encode an ENCLS leaf that doesn't return an error code
+ * @rax: leaf number
+ * @rbx_out: optional output variable
+ * @inputs: asm inputs for the leaf
+ *
+ * Emit assembly for an ENCLS leaf that does not return an error code,
+ * e.g. ECREATE. Leaves without error codes either succeed or fault.
+ * @rbx_out is an optional parameter for use by EDGBRD, which returns
+ * the the requested value in RBX.
+ *
+ * Return:
+ * 0 on success,
+ * trapnr with ENCLS_FAULT_FLAG set on fault
+ */
+#define __encls_N(rax, rbx_out, inputs...) \
+ ({ \
+ int ret; \
+ asm volatile( \
+ "1: .byte 0x0f, 0x01, 0xcf;\n\t" \
+ " xor %%eax,%%eax;\n" \
+ "2:\n" \
+ ".section .fixup,\"ax\"\n" \
+ "3: orl $"__stringify(ENCLS_FAULT_FLAG)",%%eax\n" \
+ " jmp 2b\n" \
+ ".previous\n" \
+ _ASM_EXTABLE_FAULT(1b, 3b) \
+ : "=a"(ret), "=b"(rbx_out) \
+ : "a"(rax), inputs \
+ : "memory"); \
+ ret; \
+ })
+
+#define __encls_2(rax, rbx, rcx) \
+ ({ \
+ unsigned long ign_rbx_out; \
+ __encls_N(rax, ign_rbx_out, "b"(rbx), "c"(rcx)); \
+ })
+
+#define __encls_1_1(rax, data, rcx) \
+ ({ \
+ unsigned long rbx_out; \
+ int ret = __encls_N(rax, rbx_out, "c"(rcx)); \
+ if (!ret) \
+ data = rbx_out; \
+ ret; \
+ })
+
+static inline int __ecreate(struct sgx_pageinfo *pginfo, void *secs)
+{
+ return __encls_2(ECREATE, pginfo, secs);
+}
+
+static inline int __eextend(void *secs, void *addr)
+{
+ return __encls_2(EEXTEND, secs, addr);
+}
+
+static inline int __eadd(struct sgx_pageinfo *pginfo, void *addr)
+{
+ return __encls_2(EADD, pginfo, addr);
+}
+
+static inline int __einit(void *sigstruct, struct sgx_einittoken *einittoken,
+ void *secs)
+{
+ return __encls_ret_3(EINIT, sigstruct, secs, einittoken);
+}
+
+static inline int __eremove(void *addr)
+{
+ return __encls_ret_1(EREMOVE, addr);
+}
+
+static inline int __edbgwr(void *addr, unsigned long *data)
+{
+ return __encls_2(EDGBWR, *data, addr);
+}
+
+static inline int __edbgrd(void *addr, unsigned long *data)
+{
+ return __encls_1_1(EDGBRD, *data, addr);
+}
+
+static inline int __etrack(void *addr)
+{
+ return __encls_ret_1(ETRACK, addr);
+}
+
+static inline int __eldu(struct sgx_pageinfo *pginfo, void *addr,
+ void *va)
+{
+ return __encls_ret_3(ELDU, pginfo, addr, va);
+}
+
+static inline int __eblock(void *addr)
+{
+ return __encls_ret_1(EBLOCK, addr);
+}
+
+static inline int __epa(void *addr)
+{
+ unsigned long rbx = SGX_PAGE_TYPE_VA;
+
+ return __encls_2(EPA, rbx, addr);
+}
+
+static inline int __ewb(struct sgx_pageinfo *pginfo, void *addr,
+ void *va)
+{
+ return __encls_ret_3(EWB, pginfo, addr, va);
+}
+
+#endif /* _X86_ENCLS_H */
--
2.25.0
Add a selftest for SGX. It is a trivial test where a simple enclave
copies one 64-bit word of memory between two memory locations given to
the enclave as arguments. Use ENCLS[EENTER] to invoke the enclave.
Cc: [email protected]
Cc: [email protected]
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
tools/testing/selftests/x86/sgx/.gitignore | 3 +
tools/testing/selftests/x86/sgx/Makefile | 48 ++
tools/testing/selftests/x86/sgx/defines.h | 17 +
tools/testing/selftests/x86/sgx/encl.c | 20 +
tools/testing/selftests/x86/sgx/encl.lds | 34 ++
.../selftests/x86/sgx/encl_bootstrap.S | 94 ++++
tools/testing/selftests/x86/sgx/main.c | 247 +++++++++
tools/testing/selftests/x86/sgx/sgx_call.S | 23 +
tools/testing/selftests/x86/sgx/sgx_call.h | 11 +
tools/testing/selftests/x86/sgx/sgxsign.c | 493 ++++++++++++++++++
.../testing/selftests/x86/sgx/signing_key.pem | 39 ++
11 files changed, 1029 insertions(+)
create mode 100644 tools/testing/selftests/x86/sgx/.gitignore
create mode 100644 tools/testing/selftests/x86/sgx/Makefile
create mode 100644 tools/testing/selftests/x86/sgx/defines.h
create mode 100644 tools/testing/selftests/x86/sgx/encl.c
create mode 100644 tools/testing/selftests/x86/sgx/encl.lds
create mode 100644 tools/testing/selftests/x86/sgx/encl_bootstrap.S
create mode 100644 tools/testing/selftests/x86/sgx/main.c
create mode 100644 tools/testing/selftests/x86/sgx/sgx_call.S
create mode 100644 tools/testing/selftests/x86/sgx/sgx_call.h
create mode 100644 tools/testing/selftests/x86/sgx/sgxsign.c
create mode 100644 tools/testing/selftests/x86/sgx/signing_key.pem
diff --git a/tools/testing/selftests/x86/sgx/.gitignore b/tools/testing/selftests/x86/sgx/.gitignore
new file mode 100644
index 000000000000..98eb2d439606
--- /dev/null
+++ b/tools/testing/selftests/x86/sgx/.gitignore
@@ -0,0 +1,3 @@
+encl.ss
+sgxsign
+test_sgx
diff --git a/tools/testing/selftests/x86/sgx/Makefile b/tools/testing/selftests/x86/sgx/Makefile
new file mode 100644
index 000000000000..f838700029e2
--- /dev/null
+++ b/tools/testing/selftests/x86/sgx/Makefile
@@ -0,0 +1,48 @@
+top_srcdir = ../../../../..
+
+include ../../lib.mk
+
+ifndef OBJCOPY
+OBJCOPY := $(CROSS_COMPILE)objcopy
+endif
+
+INCLUDES := -I$(top_srcdir)/tools/include
+HOST_CFLAGS := -Wall -Werror -g $(INCLUDES) -fPIC -z noexecstack
+ENCL_CFLAGS := -Wall -Werror -static -nostdlib -nostartfiles -fPIC \
+ -fno-stack-protector -mrdrnd $(INCLUDES)
+
+TEST_CUSTOM_PROGS := $(OUTPUT)/test_sgx $(OUTPUT)/encl.bin $(OUTPUT)/encl.ss
+
+all: $(TEST_CUSTOM_PROGS)
+
+$(OUTPUT)/test_sgx: $(OUTPUT)/main.o $(OUTPUT)/sgx_call.o
+ $(CC) $(HOST_CFLAGS) -o $@ $^
+
+$(OUTPUT)/main.o: main.c
+ $(CC) $(HOST_CFLAGS) -c $< -o $@
+
+$(OUTPUT)/sgx_call.o: sgx_call.S
+ $(CC) $(HOST_CFLAGS) -c $< -o $@
+
+$(OUTPUT)/encl.bin: $(OUTPUT)/encl.elf $(OUTPUT)/sgxsign
+ $(OBJCOPY) -O binary $< $@
+
+$(OUTPUT)/encl.elf: encl.lds encl.c encl_bootstrap.S
+ $(CC) $(ENCL_CFLAGS) -T $^ -o $@
+
+$(OUTPUT)/encl.ss: $(OUTPUT)/encl.bin
+ $(OUTPUT)/sgxsign signing_key.pem $(OUTPUT)/encl.bin $(OUTPUT)/encl.ss
+
+$(OUTPUT)/sgxsign: sgxsign.c
+ $(CC) $(INCLUDES) -o $@ $< -lcrypto
+
+EXTRA_CLEAN := \
+ $(OUTPUT)/encl.bin \
+ $(OUTPUT)/encl.elf \
+ $(OUTPUT)/encl.ss \
+ $(OUTPUT)/sgx_call.o \
+ $(OUTPUT)/sgxsign \
+ $(OUTPUT)/test_sgx \
+ $(OUTPUT)/test_sgx.o \
+
+.PHONY: clean
diff --git a/tools/testing/selftests/x86/sgx/defines.h b/tools/testing/selftests/x86/sgx/defines.h
new file mode 100644
index 000000000000..87264f85cb9f
--- /dev/null
+++ b/tools/testing/selftests/x86/sgx/defines.h
@@ -0,0 +1,17 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright(c) 2016-19 Intel Corporation.
+ */
+
+#ifndef DEFINES_H
+#define DEFINES_H
+
+#include <stdint.h>
+
+#define __aligned(x) __attribute__((__aligned__(x)))
+#define __packed __attribute__((packed))
+
+#include "../../../../../arch/x86/kernel/cpu/sgx/arch.h"
+#include "../../../../../arch/x86/include/uapi/asm/sgx.h"
+
+#endif /* DEFINES_H */
diff --git a/tools/testing/selftests/x86/sgx/encl.c b/tools/testing/selftests/x86/sgx/encl.c
new file mode 100644
index 000000000000..ede915399742
--- /dev/null
+++ b/tools/testing/selftests/x86/sgx/encl.c
@@ -0,0 +1,20 @@
+// SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause)
+// Copyright(c) 2016-18 Intel Corporation.
+
+#include <stddef.h>
+#include "defines.h"
+
+static void *memcpy(void *dest, const void *src, size_t n)
+{
+ size_t i;
+
+ for (i = 0; i < n; i++)
+ ((char *)dest)[i] = ((char *)src)[i];
+
+ return dest;
+}
+
+void encl_body(void *rdi, void *rsi)
+{
+ memcpy(rsi, rdi, 8);
+}
diff --git a/tools/testing/selftests/x86/sgx/encl.lds b/tools/testing/selftests/x86/sgx/encl.lds
new file mode 100644
index 000000000000..9a56d3064104
--- /dev/null
+++ b/tools/testing/selftests/x86/sgx/encl.lds
@@ -0,0 +1,34 @@
+OUTPUT_FORMAT(elf64-x86-64)
+
+SECTIONS
+{
+ . = 0;
+ .tcs : {
+ *(.tcs*)
+ }
+
+ . = ALIGN(4096);
+ .text : {
+ *(.text*)
+ *(.rodata*)
+ }
+
+ . = ALIGN(4096);
+ .data : {
+ *(.data*)
+ }
+
+ /DISCARD/ : {
+ *(.data*)
+ *(.comment*)
+ *(.note*)
+ *(.debug*)
+ *(.eh_frame*)
+ }
+}
+
+ASSERT(!DEFINED(.altinstructions), "ALTERNATIVES are not supported in enclaves")
+ASSERT(!DEFINED(.altinstr_replacement), "ALTERNATIVES are not supported in enclaves")
+ASSERT(!DEFINED(.discard.retpoline_safe), "RETPOLINE ALTERNATIVES are not supported in enclaves")
+ASSERT(!DEFINED(.discard.nospec), "RETPOLINE ALTERNATIVES are not supported in enclaves")
+ASSERT(!DEFINED(.got.plt), "Libcalls are not supported in enclaves")
diff --git a/tools/testing/selftests/x86/sgx/encl_bootstrap.S b/tools/testing/selftests/x86/sgx/encl_bootstrap.S
new file mode 100644
index 000000000000..d07f970ccdf9
--- /dev/null
+++ b/tools/testing/selftests/x86/sgx/encl_bootstrap.S
@@ -0,0 +1,94 @@
+/* SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause) */
+/*
+ * Copyright(c) 2016-18 Intel Corporation.
+ */
+
+ .macro ENCLU
+ .byte 0x0f, 0x01, 0xd7
+ .endm
+
+ .section ".tcs", "a"
+ .balign 4096
+
+ .fill 1, 8, 0 # STATE (set by CPU)
+ .fill 1, 8, 0 # FLAGS
+ .quad encl_ssa # OSSA
+ .fill 1, 4, 0 # CSSA (set by CPU)
+ .fill 1, 4, 1 # NSSA
+ .quad encl_entry # OENTRY
+ .fill 1, 8, 0 # AEP (set by EENTER and ERESUME)
+ .fill 1, 8, 0 # OFSBASE
+ .fill 1, 8, 0 # OGSBASE
+ .fill 1, 4, 0xFFFFFFFF # FSLIMIT
+ .fill 1, 4, 0xFFFFFFFF # GSLIMIT
+ .fill 4024, 1, 0 # Reserved
+
+ .text
+
+encl_entry:
+ # RBX contains the base address for TCS, which is also the first address
+ # inside the enclave. By adding the value of le_stack_end to it, we get
+ # the absolute address for the stack.
+ lea (encl_stack)(%rbx), %rax
+ xchg %rsp, %rax
+ push %rax
+
+ push %rcx # push the address after EENTER
+ push %rbx # push the enclave base address
+
+ call encl_body
+
+ pop %rbx # pop the enclave base address
+
+ # Restore XSAVE registers to a synthetic state.
+ mov $0xFFFFFFFF, %rax
+ mov $0xFFFFFFFF, %rdx
+ lea (xsave_area)(%rbx), %rdi
+ fxrstor (%rdi)
+
+ # Clear GPRs.
+ xor %rcx, %rcx
+ xor %rdx, %rdx
+ xor %rdi, %rdi
+ xor %rsi, %rsi
+ xor %r8, %r8
+ xor %r9, %r9
+ xor %r10, %r10
+ xor %r11, %r11
+ xor %r12, %r12
+ xor %r13, %r13
+ xor %r14, %r14
+ xor %r15, %r15
+
+ # Reset status flags.
+ add %rdx, %rdx # OF = SF = AF = CF = 0; ZF = PF = 1
+
+ # Prepare EEXIT target by popping the address of the instruction after
+ # EENTER to RBX.
+ pop %rbx
+
+ # Restore the caller stack.
+ pop %rax
+ mov %rax, %rsp
+
+ # EEXIT
+ mov $4, %rax
+ enclu
+
+ .section ".data", "aw"
+
+encl_ssa:
+ .space 4096
+
+xsave_area:
+ .fill 1, 4, 0x037F # FCW
+ .fill 5, 4, 0
+ .fill 1, 4, 0x1F80 # MXCSR
+ .fill 1, 4, 0xFFFF # MXCSR_MASK
+ .fill 123, 4, 0
+ .fill 1, 4, 0x80000000 # XCOMP_BV[63] = 1, compaction mode
+ .fill 12, 4, 0
+
+ .balign 4096
+ .space 8192
+encl_stack:
diff --git a/tools/testing/selftests/x86/sgx/main.c b/tools/testing/selftests/x86/sgx/main.c
new file mode 100644
index 000000000000..48ed5fdfb3cb
--- /dev/null
+++ b/tools/testing/selftests/x86/sgx/main.c
@@ -0,0 +1,247 @@
+// SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause)
+// Copyright(c) 2016-18 Intel Corporation.
+
+#include <elf.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/ioctl.h>
+#include <sys/mman.h>
+#include <sys/stat.h>
+#include <sys/time.h>
+#include <sys/types.h>
+#include "defines.h"
+#include "sgx_call.h"
+
+#define PAGE_SIZE 4096
+
+static const uint64_t MAGIC = 0x1122334455667788ULL;
+
+static bool encl_create(int dev_fd, unsigned long bin_size,
+ struct sgx_secs *secs)
+{
+ struct sgx_enclave_create ioc;
+ void *area;
+ int rc;
+
+ memset(secs, 0, sizeof(*secs));
+ secs->ssa_frame_size = 1;
+ secs->attributes = SGX_ATTR_MODE64BIT;
+ secs->xfrm = 3;
+
+ for (secs->size = 4096; secs->size < bin_size; )
+ secs->size <<= 1;
+
+ area = mmap(NULL, secs->size * 2, PROT_NONE, MAP_SHARED, dev_fd, 0);
+ if (area == MAP_FAILED) {
+ perror("mmap");
+ return false;
+ }
+
+ secs->base = ((uint64_t)area + secs->size - 1) & ~(secs->size - 1);
+
+ munmap(area, secs->base - (uint64_t)area);
+ munmap((void *)(secs->base + secs->size),
+ (uint64_t)area + secs->size - secs->base);
+
+ ioc.src = (unsigned long)secs;
+ rc = ioctl(dev_fd, SGX_IOC_ENCLAVE_CREATE, &ioc);
+ if (rc) {
+ fprintf(stderr, "ECREATE failed rc=%d, err=%d.\n", rc, errno);
+ munmap((void *)secs->base, secs->size);
+ return false;
+ }
+
+ return true;
+}
+
+static bool encl_add_pages(int dev_fd, unsigned long offset, void *data,
+ unsigned long length, uint64_t flags)
+{
+ struct sgx_enclave_add_pages ioc;
+ struct sgx_secinfo secinfo;
+ int rc;
+
+ memset(&secinfo, 0, sizeof(secinfo));
+ secinfo.flags = flags;
+
+ ioc.src = (uint64_t)data;
+ ioc.offset = offset;
+ ioc.length = length;
+ ioc.secinfo = (unsigned long)&secinfo;
+ ioc.flags = SGX_PAGE_MEASURE;
+
+ rc = ioctl(dev_fd, SGX_IOC_ENCLAVE_ADD_PAGES, &ioc);
+ if (rc) {
+ fprintf(stderr, "EADD failed rc=%d.\n", rc);
+ return false;
+ }
+
+ if (ioc.count != ioc.length) {
+ fprintf(stderr, "Partially processed, update the test.\n");
+ return false;
+ }
+
+ return true;
+}
+
+#define SGX_REG_PAGE_FLAGS \
+ (SGX_SECINFO_REG | SGX_SECINFO_R | SGX_SECINFO_W | SGX_SECINFO_X)
+
+static bool encl_build(struct sgx_secs *secs, void *bin,
+ unsigned long bin_size, struct sgx_sigstruct *sigstruct)
+{
+ struct sgx_enclave_init ioc;
+ void *addr;
+ int dev_fd;
+ int rc;
+
+ dev_fd = open("/dev/sgx/enclave", O_RDWR);
+ if (dev_fd < 0) {
+ fprintf(stderr, "Unable to open /dev/sgx\n");
+ return false;
+ }
+
+ if (!encl_create(dev_fd, bin_size, secs))
+ goto out_dev_fd;
+
+ if (!encl_add_pages(dev_fd, 0, bin, PAGE_SIZE, SGX_SECINFO_TCS))
+ goto out_dev_fd;
+
+ if (!encl_add_pages(dev_fd, PAGE_SIZE, bin + PAGE_SIZE,
+ bin_size - PAGE_SIZE, SGX_REG_PAGE_FLAGS))
+ goto out_dev_fd;
+
+ ioc.sigstruct = (uint64_t)sigstruct;
+ rc = ioctl(dev_fd, SGX_IOC_ENCLAVE_INIT, &ioc);
+ if (rc) {
+ printf("EINIT failed rc=%d\n", rc);
+ goto out_map;
+ }
+
+ addr = mmap((void *)secs->base, PAGE_SIZE, PROT_READ | PROT_WRITE,
+ MAP_SHARED | MAP_FIXED, dev_fd, 0);
+ if (addr == MAP_FAILED) {
+ fprintf(stderr, "mmap() failed on TCS, errno=%d.\n", errno);
+ return false;
+ }
+
+ addr = mmap((void *)(secs->base + PAGE_SIZE), bin_size - PAGE_SIZE,
+ PROT_READ | PROT_WRITE | PROT_EXEC,
+ MAP_SHARED | MAP_FIXED, dev_fd, 0);
+ if (addr == MAP_FAILED) {
+ fprintf(stderr, "mmap() failed, errno=%d.\n", errno);
+ return false;
+ }
+
+ close(dev_fd);
+ return true;
+out_map:
+ munmap((void *)secs->base, secs->size);
+out_dev_fd:
+ close(dev_fd);
+ return false;
+}
+
+bool get_file_size(const char *path, off_t *bin_size)
+{
+ struct stat sb;
+ int ret;
+
+ ret = stat(path, &sb);
+ if (ret) {
+ perror("stat");
+ return false;
+ }
+
+ if (!sb.st_size || sb.st_size & 0xfff) {
+ fprintf(stderr, "Invalid blob size %lu\n", sb.st_size);
+ return false;
+ }
+
+ *bin_size = sb.st_size;
+ return true;
+}
+
+bool encl_data_map(const char *path, void **bin, off_t *bin_size)
+{
+ int fd;
+
+ fd = open(path, O_RDONLY);
+ if (fd == -1) {
+ fprintf(stderr, "open() %s failed, errno=%d.\n", path, errno);
+ return false;
+ }
+
+ if (!get_file_size(path, bin_size))
+ goto err_out;
+
+ *bin = mmap(NULL, *bin_size, PROT_READ, MAP_PRIVATE, fd, 0);
+ if (*bin == MAP_FAILED) {
+ fprintf(stderr, "mmap() %s failed, errno=%d.\n", path, errno);
+ goto err_out;
+ }
+
+ close(fd);
+ return true;
+
+err_out:
+ close(fd);
+ return false;
+}
+
+bool load_sigstruct(const char *path, void *sigstruct)
+{
+ int fd;
+
+ fd = open(path, O_RDONLY);
+ if (fd == -1) {
+ fprintf(stderr, "open() %s failed, errno=%d.\n", path, errno);
+ return false;
+ }
+
+ if (read(fd, sigstruct, sizeof(struct sgx_sigstruct)) !=
+ sizeof(struct sgx_sigstruct)) {
+ fprintf(stderr, "read() %s failed, errno=%d.\n", path, errno);
+ close(fd);
+ return false;
+ }
+
+ close(fd);
+ return true;
+}
+
+int main(int argc, char *argv[], char *envp[])
+{
+ struct sgx_sigstruct sigstruct;
+ struct sgx_secs secs;
+ uint64_t result = 0;
+ off_t bin_size;
+ void *bin;
+
+ if (!encl_data_map("encl.bin", &bin, &bin_size))
+ exit(1);
+
+ if (!load_sigstruct("encl.ss", &sigstruct))
+ exit(1);
+
+ if (!encl_build(&secs, bin, bin_size, &sigstruct))
+ exit(1);
+
+ printf("Input: 0x%lx\n", MAGIC);
+
+ sgx_call_eenter((void *)&MAGIC, &result, (void *)secs.base);
+ if (result != MAGIC) {
+ fprintf(stderr, "0x%lx != 0x%lx\n", result, MAGIC);
+ exit(1);
+ }
+
+ printf("Output: 0x%lx\n", result);
+
+ exit(0);
+}
diff --git a/tools/testing/selftests/x86/sgx/sgx_call.S b/tools/testing/selftests/x86/sgx/sgx_call.S
new file mode 100644
index 000000000000..ca4c7893f9d9
--- /dev/null
+++ b/tools/testing/selftests/x86/sgx/sgx_call.S
@@ -0,0 +1,23 @@
+/* SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause) */
+/**
+* Copyright(c) 2016-18 Intel Corporation.
+*/
+
+ .text
+
+ .macro ENCLU
+ .byte 0x0f, 0x01, 0xd7
+ .endm
+
+ .text
+
+ .global sgx_call_eenter
+sgx_call_eenter:
+ push %rbx
+ mov $0x02, %rax
+ mov %rdx, %rbx
+ lea sgx_async_exit(%rip), %rcx
+sgx_async_exit:
+ ENCLU
+ pop %rbx
+ ret
diff --git a/tools/testing/selftests/x86/sgx/sgx_call.h b/tools/testing/selftests/x86/sgx/sgx_call.h
new file mode 100644
index 000000000000..bf72068ada23
--- /dev/null
+++ b/tools/testing/selftests/x86/sgx/sgx_call.h
@@ -0,0 +1,11 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright(c) 2016-19 Intel Corporation.
+ */
+
+#ifndef SGX_CALL_H
+#define SGX_CALL_H
+
+void sgx_call_eenter(void *rdi, void *rsi, void *entry);
+
+#endif /* SGX_CALL_H */
diff --git a/tools/testing/selftests/x86/sgx/sgxsign.c b/tools/testing/selftests/x86/sgx/sgxsign.c
new file mode 100644
index 000000000000..3d9007af40c9
--- /dev/null
+++ b/tools/testing/selftests/x86/sgx/sgxsign.c
@@ -0,0 +1,493 @@
+// SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause)
+// Copyright(c) 2016-18 Intel Corporation.
+
+#define _GNU_SOURCE
+#include <getopt.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <unistd.h>
+#include <openssl/err.h>
+#include <openssl/pem.h>
+#include "defines.h"
+
+struct sgx_sigstruct_payload {
+ struct sgx_sigstruct_header header;
+ struct sgx_sigstruct_body body;
+};
+
+static bool check_crypto_errors(void)
+{
+ int err;
+ bool had_errors = false;
+ const char *filename;
+ int line;
+ char str[256];
+
+ for ( ; ; ) {
+ if (ERR_peek_error() == 0)
+ break;
+
+ had_errors = true;
+ err = ERR_get_error_line(&filename, &line);
+ ERR_error_string_n(err, str, sizeof(str));
+ fprintf(stderr, "crypto: %s: %s:%d\n", str, filename, line);
+ }
+
+ return had_errors;
+}
+
+static void exit_usage(const char *program)
+{
+ fprintf(stderr,
+ "Usage: %s/sign-le <key> <enclave> <sigstruct>\n", program);
+ exit(1);
+}
+
+static inline const BIGNUM *get_modulus(RSA *key)
+{
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ return key->n;
+#else
+ const BIGNUM *n;
+
+ RSA_get0_key(key, &n, NULL, NULL);
+ return n;
+#endif
+}
+
+static RSA *load_sign_key(const char *path)
+{
+ FILE *f;
+ RSA *key;
+
+ f = fopen(path, "rb");
+ if (!f) {
+ fprintf(stderr, "Unable to open %s\n", path);
+ return NULL;
+ }
+ key = RSA_new();
+ if (!PEM_read_RSAPrivateKey(f, &key, NULL, NULL))
+ return NULL;
+ fclose(f);
+
+ if (BN_num_bytes(get_modulus(key)) != SGX_MODULUS_SIZE) {
+ fprintf(stderr, "Invalid key size %d\n",
+ BN_num_bytes(get_modulus(key)));
+ RSA_free(key);
+ return NULL;
+ }
+
+ return key;
+}
+
+static void reverse_bytes(void *data, int length)
+{
+ int i = 0;
+ int j = length - 1;
+ uint8_t temp;
+ uint8_t *ptr = data;
+
+ while (i < j) {
+ temp = ptr[i];
+ ptr[i] = ptr[j];
+ ptr[j] = temp;
+ i++;
+ j--;
+ }
+}
+
+enum mrtags {
+ MRECREATE = 0x0045544145524345,
+ MREADD = 0x0000000044444145,
+ MREEXTEND = 0x00444E4554584545,
+};
+
+static bool mrenclave_update(EVP_MD_CTX *ctx, const void *data)
+{
+ if (!EVP_DigestUpdate(ctx, data, 64)) {
+ fprintf(stderr, "digest update failed\n");
+ return false;
+ }
+
+ return true;
+}
+
+static bool mrenclave_commit(EVP_MD_CTX *ctx, uint8_t *mrenclave)
+{
+ unsigned int size;
+
+ if (!EVP_DigestFinal_ex(ctx, (unsigned char *)mrenclave, &size)) {
+ fprintf(stderr, "digest commit failed\n");
+ return false;
+ }
+
+ if (size != 32) {
+ fprintf(stderr, "invalid digest size = %u\n", size);
+ return false;
+ }
+
+ return true;
+}
+
+struct mrecreate {
+ uint64_t tag;
+ uint32_t ssaframesize;
+ uint64_t size;
+ uint8_t reserved[44];
+} __attribute__((__packed__));
+
+
+static bool mrenclave_ecreate(EVP_MD_CTX *ctx, uint64_t blob_size)
+{
+ struct mrecreate mrecreate;
+ uint64_t encl_size;
+
+ for (encl_size = 0x1000; encl_size < blob_size; )
+ encl_size <<= 1;
+
+ memset(&mrecreate, 0, sizeof(mrecreate));
+ mrecreate.tag = MRECREATE;
+ mrecreate.ssaframesize = 1;
+ mrecreate.size = encl_size;
+
+ if (!EVP_DigestInit_ex(ctx, EVP_sha256(), NULL))
+ return false;
+
+ return mrenclave_update(ctx, &mrecreate);
+}
+
+struct mreadd {
+ uint64_t tag;
+ uint64_t offset;
+ uint64_t flags; /* SECINFO flags */
+ uint8_t reserved[40];
+} __attribute__((__packed__));
+
+static bool mrenclave_eadd(EVP_MD_CTX *ctx, uint64_t offset, uint64_t flags)
+{
+ struct mreadd mreadd;
+
+ memset(&mreadd, 0, sizeof(mreadd));
+ mreadd.tag = MREADD;
+ mreadd.offset = offset;
+ mreadd.flags = flags;
+
+ return mrenclave_update(ctx, &mreadd);
+}
+
+struct mreextend {
+ uint64_t tag;
+ uint64_t offset;
+ uint8_t reserved[48];
+} __attribute__((__packed__));
+
+static bool mrenclave_eextend(EVP_MD_CTX *ctx, uint64_t offset, uint8_t *data)
+{
+ struct mreextend mreextend;
+ int i;
+
+ for (i = 0; i < 0x1000; i += 0x100) {
+ memset(&mreextend, 0, sizeof(mreextend));
+ mreextend.tag = MREEXTEND;
+ mreextend.offset = offset + i;
+
+ if (!mrenclave_update(ctx, &mreextend))
+ return false;
+
+ if (!mrenclave_update(ctx, &data[i + 0x00]))
+ return false;
+
+ if (!mrenclave_update(ctx, &data[i + 0x40]))
+ return false;
+
+ if (!mrenclave_update(ctx, &data[i + 0x80]))
+ return false;
+
+ if (!mrenclave_update(ctx, &data[i + 0xC0]))
+ return false;
+ }
+
+ return true;
+}
+
+/**
+ * measure_encl - measure enclave
+ * @path: path to the enclave
+ * @mrenclave: measurement
+ *
+ * Calculates MRENCLAVE. Assumes that the very first page is a TCS page and
+ * following pages are regular pages. Does not measure the contents of the
+ * enclave as the signing tool is used at the moment only for the launch
+ * enclave, which is pass-through (everything gets a token).
+ */
+static bool measure_encl(const char *path, uint8_t *mrenclave)
+{
+ FILE *file;
+ struct stat sb;
+ EVP_MD_CTX *ctx;
+ uint64_t flags;
+ uint64_t offset;
+ uint8_t data[0x1000];
+ int rc;
+
+ ctx = EVP_MD_CTX_create();
+ if (!ctx)
+ return false;
+
+ file = fopen(path, "rb");
+ if (!file) {
+ perror("fopen");
+ EVP_MD_CTX_destroy(ctx);
+ return false;
+ }
+
+ rc = stat(path, &sb);
+ if (rc) {
+ perror("stat");
+ goto out;
+ }
+
+ if (!sb.st_size || sb.st_size & 0xfff) {
+ fprintf(stderr, "Invalid blob size %lu\n", sb.st_size);
+ goto out;
+ }
+
+ if (!mrenclave_ecreate(ctx, sb.st_size))
+ goto out;
+
+ for (offset = 0; offset < sb.st_size; offset += 0x1000) {
+ if (!offset)
+ flags = SGX_SECINFO_TCS;
+ else
+ flags = SGX_SECINFO_REG | SGX_SECINFO_R |
+ SGX_SECINFO_W | SGX_SECINFO_X;
+
+ if (!mrenclave_eadd(ctx, offset, flags))
+ goto out;
+
+ rc = fread(data, 1, 0x1000, file);
+ if (!rc)
+ break;
+ if (rc < 0x1000)
+ goto out;
+
+ if (!mrenclave_eextend(ctx, offset, data))
+ goto out;
+ }
+
+ if (!mrenclave_commit(ctx, mrenclave))
+ goto out;
+
+ fclose(file);
+ EVP_MD_CTX_destroy(ctx);
+ return true;
+out:
+ fclose(file);
+ EVP_MD_CTX_destroy(ctx);
+ return false;
+}
+
+/**
+ * sign_encl - sign enclave
+ * @sigstruct: pointer to SIGSTRUCT
+ * @key: 3072-bit RSA key
+ * @signature: byte array for the signature
+ *
+ * Calculates EMSA-PKCSv1.5 signature for the given SIGSTRUCT. The result is
+ * stored in big-endian format so that it can be further passed to OpenSSL
+ * libcrypto functions.
+ */
+static bool sign_encl(const struct sgx_sigstruct *sigstruct, RSA *key,
+ uint8_t *signature)
+{
+ struct sgx_sigstruct_payload payload;
+ unsigned int siglen;
+ uint8_t digest[SHA256_DIGEST_LENGTH];
+ bool ret;
+
+ memcpy(&payload.header, &sigstruct->header, sizeof(sigstruct->header));
+ memcpy(&payload.body, &sigstruct->body, sizeof(sigstruct->body));
+
+ SHA256((unsigned char *)&payload, sizeof(payload), digest);
+
+ ret = RSA_sign(NID_sha256, digest, SHA256_DIGEST_LENGTH, signature,
+ &siglen, key);
+
+ return ret;
+}
+
+struct q1q2_ctx {
+ BN_CTX *bn_ctx;
+ BIGNUM *m;
+ BIGNUM *s;
+ BIGNUM *q1;
+ BIGNUM *qr;
+ BIGNUM *q2;
+};
+
+static void free_q1q2_ctx(struct q1q2_ctx *ctx)
+{
+ BN_CTX_free(ctx->bn_ctx);
+ BN_free(ctx->m);
+ BN_free(ctx->s);
+ BN_free(ctx->q1);
+ BN_free(ctx->qr);
+ BN_free(ctx->q2);
+}
+
+static bool alloc_q1q2_ctx(const uint8_t *s, const uint8_t *m,
+ struct q1q2_ctx *ctx)
+{
+ ctx->bn_ctx = BN_CTX_new();
+ ctx->s = BN_bin2bn(s, SGX_MODULUS_SIZE, NULL);
+ ctx->m = BN_bin2bn(m, SGX_MODULUS_SIZE, NULL);
+ ctx->q1 = BN_new();
+ ctx->qr = BN_new();
+ ctx->q2 = BN_new();
+
+ if (!ctx->bn_ctx || !ctx->s || !ctx->m || !ctx->q1 || !ctx->qr ||
+ !ctx->q2) {
+ free_q1q2_ctx(ctx);
+ return false;
+ }
+
+ return true;
+}
+
+static bool calc_q1q2(const uint8_t *s, const uint8_t *m, uint8_t *q1,
+ uint8_t *q2)
+{
+ struct q1q2_ctx ctx;
+
+ if (!alloc_q1q2_ctx(s, m, &ctx)) {
+ fprintf(stderr, "Not enough memory for Q1Q2 calculation\n");
+ return false;
+ }
+
+ if (!BN_mul(ctx.q1, ctx.s, ctx.s, ctx.bn_ctx))
+ goto out;
+
+ if (!BN_div(ctx.q1, ctx.qr, ctx.q1, ctx.m, ctx.bn_ctx))
+ goto out;
+
+ if (BN_num_bytes(ctx.q1) > SGX_MODULUS_SIZE) {
+ fprintf(stderr, "Too large Q1 %d bytes\n",
+ BN_num_bytes(ctx.q1));
+ goto out;
+ }
+
+ if (!BN_mul(ctx.q2, ctx.s, ctx.qr, ctx.bn_ctx))
+ goto out;
+
+ if (!BN_div(ctx.q2, NULL, ctx.q2, ctx.m, ctx.bn_ctx))
+ goto out;
+
+ if (BN_num_bytes(ctx.q2) > SGX_MODULUS_SIZE) {
+ fprintf(stderr, "Too large Q2 %d bytes\n",
+ BN_num_bytes(ctx.q2));
+ goto out;
+ }
+
+ BN_bn2bin(ctx.q1, q1);
+ BN_bn2bin(ctx.q2, q2);
+
+ free_q1q2_ctx(&ctx);
+ return true;
+out:
+ free_q1q2_ctx(&ctx);
+ return false;
+}
+
+static bool save_sigstruct(const struct sgx_sigstruct *sigstruct,
+ const char *path)
+{
+ FILE *f = fopen(path, "wb");
+
+ if (!f) {
+ fprintf(stderr, "Unable to open %s\n", path);
+ return false;
+ }
+
+ fwrite(sigstruct, sizeof(*sigstruct), 1, f);
+ fclose(f);
+ return true;
+}
+
+int main(int argc, char **argv)
+{
+ uint64_t header1[2] = {0x000000E100000006, 0x0000000000010000};
+ uint64_t header2[2] = {0x0000006000000101, 0x0000000100000060};
+ struct sgx_sigstruct ss;
+ const char *program;
+ int opt;
+ RSA *sign_key;
+
+ memset(&ss, 0, sizeof(ss));
+ ss.header.header1[0] = header1[0];
+ ss.header.header1[1] = header1[1];
+ ss.header.header2[0] = header2[0];
+ ss.header.header2[1] = header2[1];
+ ss.exponent = 3;
+
+#ifndef CONFIG_EINITTOKENKEY
+ ss.body.attributes = SGX_ATTR_MODE64BIT;
+#else
+ ss.body.attributes = SGX_ATTR_MODE64BIT | SGX_ATTR_EINITTOKENKEY;
+#endif
+ ss.body.xfrm = 3,
+
+ program = argv[0];
+
+ do {
+ opt = getopt(argc, argv, "");
+ switch (opt) {
+ case -1:
+ break;
+ default:
+ exit_usage(program);
+ }
+ } while (opt != -1);
+
+ argc -= optind;
+ argv += optind;
+
+ if (argc < 3)
+ exit_usage(program);
+
+ /* sanity check only */
+ if (check_crypto_errors())
+ exit(1);
+
+ sign_key = load_sign_key(argv[0]);
+ if (!sign_key)
+ goto out;
+
+ BN_bn2bin(get_modulus(sign_key), ss.modulus);
+
+ if (!measure_encl(argv[1], ss.body.mrenclave))
+ goto out;
+
+ if (!sign_encl(&ss, sign_key, ss.signature))
+ goto out;
+
+ if (!calc_q1q2(ss.signature, ss.modulus, ss.q1, ss.q2))
+ goto out;
+
+ /* convert to little endian */
+ reverse_bytes(ss.signature, SGX_MODULUS_SIZE);
+ reverse_bytes(ss.modulus, SGX_MODULUS_SIZE);
+ reverse_bytes(ss.q1, SGX_MODULUS_SIZE);
+ reverse_bytes(ss.q2, SGX_MODULUS_SIZE);
+
+ if (!save_sigstruct(&ss, argv[2]))
+ goto out;
+ exit(0);
+out:
+ check_crypto_errors();
+ exit(1);
+}
diff --git a/tools/testing/selftests/x86/sgx/signing_key.pem b/tools/testing/selftests/x86/sgx/signing_key.pem
new file mode 100644
index 000000000000..d76f21f19187
--- /dev/null
+++ b/tools/testing/selftests/x86/sgx/signing_key.pem
@@ -0,0 +1,39 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIG4wIBAAKCAYEApalGbq7Q+usM91CPtksu3D+b0Prc8gAFL6grM3mg85A5Bx8V
+cfMXPgtrw8EYFwQxDAvzZWwl+9VfOX0ECrFRBkOHcOiG0SnADN8+FLj1UiNUQwbp
+S6OzhNWuRcSbGraSOyUlVlV0yMQSvewyzGklOaXBe30AJqzIBc8QfdSxKuP8rs0Z
+ga6k/Bl73osrYKByILJTUUeZqjLERsE6GebsdzbWgKn8qVqng4ZS4yMNg6LeRlH3
++9CIPgg4jwpSLHcp7dq2qTIB9a0tGe9ayp+5FbucpB6U7ePold0EeRN6RlJGDF9k
+L93v8P5ykz5G5gYZ2g0K1X2sHIWV4huxPgv5PXgdyQYbK+6olqj0d5rjYuwX57Ul
+k6SroPS1U6UbdCjG5txM+BNGU0VpD0ZhrIRw0leQdnNcCO9sTJuInZrgYacSVJ7u
+mtB+uCt+uzUesc+l+xPRYA+9e14lLkZp7AAmo9FvL816XDI09deehJ3i/LmHKCRN
+tuqC5TprRjFwUr6dAgEDAoIBgG5w2Z8fNfycs0+LCnmHdJLVEotR6KFVWMpwHMz7
+wKJgJgS/Y6FMuilc8oKAuroCy11dTO5IGVKOP3uorVx2NgQtBPXwWeDGgAiU1A3Q
+o4wXjYIEm4fCd63jyYPYZ2ckYXzDbjmOTdstYdPyzIhGGNEZK6eoqsRzMAPfYFPj
+IMdCqHSIu6vJw1K7p+myHOsVoWshjODaZnF3LYSA0WaZ8vokjwBxUxuRxQJZjJds
+s60XPtmL+qfgWtQFewoG4XL6GuD8FcXccynRRtzrLtFNPIl9BQfWfjBBhTC1/Te1
+0Z6XbZvpdUTD9OfLB7SbR2OUFNpKQgriO0iYVdbW3cr7uu38Zwp4W1TX73DPjoi6
+KNooP6SGWd4mRJW2+dUmSYS4QNG8eVVZswKcploEIXlAKRsOe4kzJJ1iETugIe85
+uX8nd1WYEp65xwoRUg8hqng0MeyveVbXqNKuJG6tzNDt9kgFYo+hmC/oouAW2Dtc
+T9jdRAwKJXqA2Eg6OkgXCEv+kwKBwQDYaQiFMlFhsmLlqI+EzCUh7c941/cL7m6U
+7j98+8ngl0HgCEcrc10iJVCKakQW3YbPzAx3XkKTaGjWazvvrFarXIGlOud64B8a
+iWyQ7VdlnmZnNEdk+C83tI91OQeaTKqRLDGzKh29Ry/jL8Pcbazt+kDgxa0H7qJp
+roADUanLQuNkYubpbhFBh3xpa2EExaVq6rF7nIVsD8W9TrbmPKA4LgH7z0iy544D
+kVCNYsTjYDdUWP+WiSor8kCnnpjnN9sCgcEAw/eNezUD1UDf6OYFC9+5JZJFn4Tg
+mZMyN93JKIb199ffwnjtHUSjcyiWeesXucpzwtGbTcwQnDisSW4oneYKLSEBlBaq
+scqiUugyGZZOthFSCbdXYXMViK2vHrKlkse7GxVlROKcEhM/pRBrmjaGO8eWR+D4
+FO2wCXzVs3KgV6j779frw0vC54oHOxc9+Lu1rSHp4i+600koyvL/zF6U/5tZXIvN
+YW2yoiQJnjCmVA1pwbwV6KAUTPDTMnBK+YjnAoHBAJBGBa4hi5Z27JkbCliIGMFJ
+NPs6pLKe9GNJf6in2+sPgUAFhMeiPhbDiwbxgrnpBIqICE+ULGJFmzmc0p/IOceT
+ARjR76dAFLxbnbXzj5kURETNhO36yiUjCk4mBRGIcbYddndxaSjaH+zKgpLzyJ6m
+1esuc1qfFvEfAAI2cTIsl5hB70ZJYNZaUvDyQK3ZGPHxy6e9rkgKg9OJz0QoatAe
+q/002yHvtAJg4F5B2JeVejg7VQ8GHB1MKxppu0TP5wKBwQCCpQj8zgKOKz/wmViy
+lSYZDC5qWJW7t3bP6TDFr06lOpUsUJ4TgxeiGw778g/RMaKB4RIz3WBoJcgw9BsT
+7rFza1ZiucchMcGMmswRDt8kC4wGejpA92Owc8oUdxkMhSdnY5jYlxK2t3/DYEe8
+JFl9L7mFQKVjSSAGUzkiTGrlG1Kf5UfXh9dFBq98uilQfSPIwUaWynyM23CHTKqI
+Pw3/vOY9sojrnncWwrEUIG7is5vWfWPwargzSzd29YdRBe8CgcEAuRVewK/YeNOX
+B7ZG6gKKsfsvrGtY7FPETzLZAHjoVXYNea4LVZ2kn4hBXXlvw/4HD+YqcTt4wmif
+5JQlDvjNobUiKJZpzy7hklVhF7wZFl4pCF7Yh43q9iQ7gKTaeUG7MiaK+G8Zz8aY
+HW9rsiihbdZkccMvnPfO9334XMxl3HtBRzLstjUlbLB7Sdh+7tZ3JQidCOFNs5pE
+XyWwnASPu4tKfDahH1UUTp1uJcq/6716CSWg080avYxFcn75qqsb
+-----END RSA PRIVATE KEY-----
--
2.25.0
In order to provide a mechanism for devilering provisoning rights:
1. Add a new device file /dev/sgx/provision that works as a token for
allowing an enclave to have the provisioning privileges.
2. Add a new ioctl called SGX_IOC_ENCLAVE_SET_ATTRIBUTE that accepts the
following data structure:
struct sgx_enclave_set_attribute {
__u64 addr;
__u64 attribute_fd;
};
A daemon could sit on top of /dev/sgx/provision and send a file
descriptor of this file to a process that needs to be able to provision
enclaves.
The way this API is used is straight-forward. Lets assume that dev_fd is
a handle to /dev/sgx/enclave and prov_fd is a handle to
/dev/sgx/provision. You would allow SGX_IOC_ENCLAVE_CREATE to
initialize an enclave with the PROVISIONKEY attribute by
params.addr = <enclave address>;
params.token_fd = prov_fd;
ioctl(dev_fd, SGX_IOC_ENCLAVE_SET_ATTRIBUTE, ¶ms);
Cc: [email protected]
Suggested-by: Andy Lutomirski <[email protected]>
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
arch/x86/include/uapi/asm/sgx.h | 11 ++++++++
arch/x86/kernel/cpu/sgx/driver.c | 14 ++++++++++
arch/x86/kernel/cpu/sgx/driver.h | 2 ++
arch/x86/kernel/cpu/sgx/ioctl.c | 47 ++++++++++++++++++++++++++++++++
4 files changed, 74 insertions(+)
diff --git a/arch/x86/include/uapi/asm/sgx.h b/arch/x86/include/uapi/asm/sgx.h
index 5edb08ab8fd0..57d0d30c79b3 100644
--- a/arch/x86/include/uapi/asm/sgx.h
+++ b/arch/x86/include/uapi/asm/sgx.h
@@ -25,6 +25,8 @@ enum sgx_page_flags {
_IOWR(SGX_MAGIC, 0x01, struct sgx_enclave_add_pages)
#define SGX_IOC_ENCLAVE_INIT \
_IOW(SGX_MAGIC, 0x02, struct sgx_enclave_init)
+#define SGX_IOC_ENCLAVE_SET_ATTRIBUTE \
+ _IOW(SGX_MAGIC, 0x03, struct sgx_enclave_set_attribute)
/**
* struct sgx_enclave_create - parameter structure for the
@@ -63,4 +65,13 @@ struct sgx_enclave_init {
__u64 sigstruct;
};
+/**
+ * struct sgx_enclave_set_attribute - parameter structure for the
+ * %SGX_IOC_ENCLAVE_SET_ATTRIBUTE ioctl
+ * @attribute_fd: file handle of the attribute file in the securityfs
+ */
+struct sgx_enclave_set_attribute {
+ __u64 attribute_fd;
+};
+
#endif /* _UAPI_ASM_X86_SGX_H */
diff --git a/arch/x86/kernel/cpu/sgx/driver.c b/arch/x86/kernel/cpu/sgx/driver.c
index b4aa7b9f8376..d90114cec1c3 100644
--- a/arch/x86/kernel/cpu/sgx/driver.c
+++ b/arch/x86/kernel/cpu/sgx/driver.c
@@ -150,6 +150,13 @@ static struct miscdevice sgx_dev_enclave = {
.fops = &sgx_encl_fops,
};
+static struct miscdevice sgx_dev_provision = {
+ .minor = MISC_DYNAMIC_MINOR,
+ .name = "provision",
+ .nodename = "sgx/provision",
+ .fops = &sgx_provision_fops,
+};
+
int __init sgx_drv_init(void)
{
unsigned int eax, ebx, ecx, edx;
@@ -190,5 +197,12 @@ int __init sgx_drv_init(void)
return ret;
}
+ ret = misc_register(&sgx_dev_provision);
+ if (ret) {
+ pr_err("Creating /dev/sgx/provision failed with %d.\n", ret);
+ misc_deregister(&sgx_dev_enclave);
+ return ret;
+ }
+
return 0;
}
diff --git a/arch/x86/kernel/cpu/sgx/driver.h b/arch/x86/kernel/cpu/sgx/driver.h
index e4063923115b..72747d01c046 100644
--- a/arch/x86/kernel/cpu/sgx/driver.h
+++ b/arch/x86/kernel/cpu/sgx/driver.h
@@ -23,6 +23,8 @@ extern u64 sgx_attributes_reserved_mask;
extern u64 sgx_xfrm_reserved_mask;
extern u32 sgx_xsave_size_tbl[64];
+extern const struct file_operations sgx_provision_fops;
+
long sgx_ioctl(struct file *filep, unsigned int cmd, unsigned long arg);
int sgx_drv_init(void);
diff --git a/arch/x86/kernel/cpu/sgx/ioctl.c b/arch/x86/kernel/cpu/sgx/ioctl.c
index 27de304efe39..251b7a989606 100644
--- a/arch/x86/kernel/cpu/sgx/ioctl.c
+++ b/arch/x86/kernel/cpu/sgx/ioctl.c
@@ -658,6 +658,50 @@ static long sgx_ioc_enclave_init(struct sgx_encl *encl, void __user *arg)
return ret;
}
+/**
+ * sgx_ioc_enclave_set_attribute - handler for %SGX_IOC_ENCLAVE_SET_ATTRIBUTE
+ * @filep: open file to /dev/sgx
+ * @arg: userspace pointer to a struct sgx_enclave_set_attribute instance
+ *
+ * Mark the enclave as being allowed to access a restricted attribute bit.
+ * The requested attribute is specified via the attribute_fd field in the
+ * provided struct sgx_enclave_set_attribute. The attribute_fd must be a
+ * handle to an SGX attribute file, e.g. “/dev/sgx/provision".
+ *
+ * Failure to explicitly request access to a restricted attribute will cause
+ * sgx_ioc_enclave_init() to fail. Currently, the only restricted attribute
+ * is access to the PROVISION_KEY.
+ *
+ * Note, access to the EINITTOKEN_KEY is disallowed entirely.
+ *
+ * Return: 0 on success, -errno otherwise
+ */
+static long sgx_ioc_enclave_set_attribute(struct sgx_encl *encl,
+ void __user *arg)
+{
+ struct sgx_enclave_set_attribute params;
+ struct file *attribute_file;
+ int ret;
+
+ if (copy_from_user(¶ms, arg, sizeof(params)))
+ return -EFAULT;
+
+ attribute_file = fget(params.attribute_fd);
+ if (!attribute_file)
+ return -EINVAL;
+
+ if (attribute_file->f_op != &sgx_provision_fops) {
+ ret = -EINVAL;
+ goto out;
+ }
+
+ encl->allowed_attributes |= SGX_ATTR_PROVISIONKEY;
+ ret = 0;
+
+out:
+ fput(attribute_file);
+ return ret;
+}
long sgx_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
{
@@ -681,6 +725,9 @@ long sgx_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
case SGX_IOC_ENCLAVE_INIT:
ret = sgx_ioc_enclave_init(encl, (void __user *)arg);
break;
+ case SGX_IOC_ENCLAVE_SET_ATTRIBUTE:
+ ret = sgx_ioc_enclave_set_attribute(encl, (void __user *)arg);
+ break;
default:
ret = -ENOIOCTLCMD;
break;
--
2.25.0
Add functions for allocating page from Enclave Page Cache (EPC). A page is
allocated by going through the EPC sections and returning the first free
page.
When a page is freed, it might have a valid state, which means that the
callee has assigned it to an enclave, which are protected memory ares used
to run code protected from outside access. The page is returned back to the
invalid state with ENCLS[EREMOVE] [1].
[1] Intel SDM: 40.3 INTEL® SGX SYSTEM LEAF FUNCTION REFERENCE
Co-developed-by: Sean Christopherson <[email protected]>
Signed-off-by: Sean Christopherson <[email protected]>
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
arch/x86/kernel/cpu/sgx/main.c | 60 ++++++++++++++++++++++++++++++++++
arch/x86/kernel/cpu/sgx/sgx.h | 3 ++
2 files changed, 63 insertions(+)
diff --git a/arch/x86/kernel/cpu/sgx/main.c b/arch/x86/kernel/cpu/sgx/main.c
index 38424c1e8341..60d82e7537c8 100644
--- a/arch/x86/kernel/cpu/sgx/main.c
+++ b/arch/x86/kernel/cpu/sgx/main.c
@@ -13,6 +13,66 @@
struct sgx_epc_section sgx_epc_sections[SGX_MAX_EPC_SECTIONS];
int sgx_nr_epc_sections;
+static struct sgx_epc_page *__sgx_try_alloc_page(struct sgx_epc_section *section)
+{
+ struct sgx_epc_page *page;
+
+ if (list_empty(§ion->page_list))
+ return NULL;
+
+ page = list_first_entry(§ion->page_list, struct sgx_epc_page, list);
+ list_del_init(&page->list);
+ return page;
+}
+
+/**
+ * sgx_try_alloc_page() - Allocate an EPC page
+ *
+ * Try to grab a page from the free EPC page list.
+ *
+ * Return:
+ * a pointer to a &struct sgx_epc_page instance,
+ * -errno on error
+ */
+struct sgx_epc_page *sgx_try_alloc_page(void)
+{
+ struct sgx_epc_section *section;
+ struct sgx_epc_page *page;
+ int i;
+
+ for (i = 0; i < sgx_nr_epc_sections; i++) {
+ section = &sgx_epc_sections[i];
+ spin_lock(§ion->lock);
+ page = __sgx_try_alloc_page(section);
+ spin_unlock(§ion->lock);
+
+ if (page)
+ return page;
+ }
+
+ return ERR_PTR(-ENOMEM);
+}
+
+/**
+ * sgx_free_page() - Free an EPC page
+ * @page: pointer a previously allocated EPC page
+ *
+ * EREMOVE an EPC page and insert it back to the list of free pages.
+ */
+void sgx_free_page(struct sgx_epc_page *page)
+{
+ struct sgx_epc_section *section = sgx_epc_section(page);
+ int ret;
+
+ ret = __eremove(sgx_epc_addr(page));
+ if (WARN_ONCE(ret, "EREMOVE returned %d (0x%x)", ret, ret))
+ return;
+
+ spin_lock(§ion->lock);
+ list_add_tail(&page->list, §ion->page_list);
+ spin_unlock(§ion->lock);
+}
+
static void __init sgx_free_epc_section(struct sgx_epc_section *section)
{
struct sgx_epc_page *page;
diff --git a/arch/x86/kernel/cpu/sgx/sgx.h b/arch/x86/kernel/cpu/sgx/sgx.h
index aad30980be32..aa85f85412d8 100644
--- a/arch/x86/kernel/cpu/sgx/sgx.h
+++ b/arch/x86/kernel/cpu/sgx/sgx.h
@@ -67,4 +67,7 @@ extern struct task_struct *ksgxswapd_tsk;
bool __init sgx_page_reclaimer_init(void);
+struct sgx_epc_page *sgx_try_alloc_page(void);
+void sgx_free_page(struct sgx_epc_page *page);
+
#endif /* _X86_SGX_H */
--
2.25.0
Recurse into a list of subdirectories defined by SUBDIRS when running
x86 selftests. Override run_tests, install, emit_tests and clean
targets to implement this behaviour.
A possible alternative would be to add "x86/sgx" to TARGETS. However,
this would be problematic because detecting 64-bit build would have
to duplicated.
The implementation is derived from the makefiles of powerpc and sparc64
selftests.
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
tools/testing/selftests/x86/Makefile | 44 ++++++++++++++++++++++++++++
1 file changed, 44 insertions(+)
diff --git a/tools/testing/selftests/x86/Makefile b/tools/testing/selftests/x86/Makefile
index 5d49bfec1e9a..dee6dadeba61 100644
--- a/tools/testing/selftests/x86/Makefile
+++ b/tools/testing/selftests/x86/Makefile
@@ -10,6 +10,8 @@ CAN_BUILD_I386 := $(shell ./check_cc.sh $(CC) trivial_32bit_program.c -m32)
CAN_BUILD_X86_64 := $(shell ./check_cc.sh $(CC) trivial_64bit_program.c)
CAN_BUILD_WITH_NOPIE := $(shell ./check_cc.sh $(CC) trivial_program.c -no-pie)
+SUBDIRS := sgx
+
TARGETS_C_BOTHBITS := single_step_syscall sysret_ss_attrs syscall_nt test_mremap_vdso \
check_initial_reg_state sigreturn iopl ioperm \
protection_keys test_vdso test_vsyscall mov_ss_trap \
@@ -59,6 +61,48 @@ endif
ifeq ($(CAN_BUILD_X86_64),1)
all: all_64
+ @for DIR in $(SUBDIRS); do \
+ BUILD_TARGET=$(OUTPUT)/$$DIR; \
+ mkdir $$BUILD_TARGET -p; \
+ make OUTPUT=$$BUILD_TARGET -C $$DIR $@; \
+ done
+
+DEFAULT_RUN_TESTS := $(RUN_TESTS)
+override define RUN_TESTS
+ $(DEFAULT_RUN_TESTS)
+ @for TARGET in $(SUBDIRS); do \
+ BUILD_TARGET=$(OUTPUT)/$$TARGET; \
+ $(MAKE) OUTPUT=$$BUILD_TARGET -C $$TARGET run_tests; \
+ done;
+endef
+
+DEFAULT_INSTALL_RULE := $(INSTALL_RULE)
+override define INSTALL_RULE
+ $(DEFAULT_INSTALL_RULE)
+ @for TARGET in $(SUBDIRS); do \
+ BUILD_TARGET=$(OUTPUT)/$$TARGET; \
+ $(MAKE) OUTPUT=$$BUILD_TARGET -C $$TARGET install; \
+ done;
+endef
+
+DEFAULT_EMIT_TESTS := $(EMIT_TESTS)
+override define EMIT_TESTS
+ $(DEFAULT_EMIT_TESTS)
+ @for TARGET in $(SUBDIRS); do \
+ BUILD_TARGET=$(OUTPUT)/$$TARGET; \
+ $(MAKE) OUTPUT=$$BUILD_TARGET -s -C $$TARGET emit_tests; \
+ done;
+endef
+
+DEFAULT_CLEAN := $(CLEAN)
+override define CLEAN
+ $(DEFAULT_CLEAN)
+ @for TARGET in $(SUBDIRS); do \
+ BUILD_TARGET=$(OUTPUT)/$$TARGET; \
+ $(MAKE) OUTPUT=$$BUILD_TARGET -C $$TARGET clean; \
+ done;
+endef
+
TEST_PROGS += $(BINARIES_64)
EXTRA_CFLAGS += -DCAN_BUILD_64
$(foreach t,$(TARGETS_C_64BIT_ALL),$(eval $(call gen-target-rule-64,$(t))))
--
2.25.0
Intel Software Guard eXtensions (SGX) is a set of CPU instructions that
can be used by applications to set aside private regions of code and
data. The code outside the SGX hosted software entity is disallowed to
access the memory inside the enclave enforced by the CPU. We call these
entities as enclaves.
This commit implements a driver that provides an ioctl API to construct
and run enclaves. Enclaves are constructed from pages residing in
reserved physical memory areas. The contents of these pages can only be
accessed when they are mapped as part of an enclave, by a hardware
thread running inside the enclave.
The starting state of an enclave consists of a fixed measured set of
pages that are copied to the EPC during the construction process by
using ENCLS leaf functions and Software Enclave Control Structure (SECS)
that defines the enclave properties.
Enclave are constructed by using ENCLS leaf functions ECREATE, EADD and
EINIT. ECREATE initializes SECS, EADD copies pages from system memory to
the EPC and EINIT check a given signed measurement and moves the enclave
into a state ready for execution.
An initialized enclave can only be accessed through special Thread Control
Structure (TCS) pages by using ENCLU (ring-3 only) leaf EENTER. This leaf
function converts a thread into enclave mode and continues the execution in
the offset defined by the TCS provided to EENTER. An enclave is exited
through syscall, exception, interrupts or by explicitly calling another
ENCLU leaf EEXIT.
The permissions, which enclave page is added will set the limit for maximum
permissions that can be set for mmap() and mprotect(). This will
effectively allow to build different security schemes between producers and
consumers of enclaves. Later on we can increase granularity with LSM hooks
for page addition (i.e. for producers) and mapping of the enclave (i.e. for
consumers)
Cc: [email protected]
Co-developed-by: Sean Christopherson <[email protected]>
Signed-off-by: Sean Christopherson <[email protected]>
Co-developed-by: Suresh Siddha <[email protected]>
Signed-off-by: Suresh Siddha <[email protected]>
Tested-by: Haitao Huang <[email protected]>
Tested-by: Jethro Beekman <[email protected]>
Tested-by: Chunyang Hui <[email protected]>
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
.../userspace-api/ioctl/ioctl-number.rst | 1 +
arch/x86/include/uapi/asm/sgx.h | 66 ++
arch/x86/kernel/cpu/sgx/Makefile | 3 +
arch/x86/kernel/cpu/sgx/driver.c | 194 +++++
arch/x86/kernel/cpu/sgx/driver.h | 30 +
arch/x86/kernel/cpu/sgx/encl.c | 336 +++++++++
arch/x86/kernel/cpu/sgx/encl.h | 87 +++
arch/x86/kernel/cpu/sgx/encls.h | 5 +-
arch/x86/kernel/cpu/sgx/ioctl.c | 692 ++++++++++++++++++
arch/x86/kernel/cpu/sgx/main.c | 12 +-
arch/x86/kernel/cpu/sgx/reclaim.c | 1 +
11 files changed, 1423 insertions(+), 4 deletions(-)
create mode 100644 arch/x86/include/uapi/asm/sgx.h
create mode 100644 arch/x86/kernel/cpu/sgx/driver.c
create mode 100644 arch/x86/kernel/cpu/sgx/driver.h
create mode 100644 arch/x86/kernel/cpu/sgx/encl.c
create mode 100644 arch/x86/kernel/cpu/sgx/encl.h
create mode 100644 arch/x86/kernel/cpu/sgx/ioctl.c
diff --git a/Documentation/userspace-api/ioctl/ioctl-number.rst b/Documentation/userspace-api/ioctl/ioctl-number.rst
index 2e91370dc159..1c54dd2704db 100644
--- a/Documentation/userspace-api/ioctl/ioctl-number.rst
+++ b/Documentation/userspace-api/ioctl/ioctl-number.rst
@@ -321,6 +321,7 @@ Code Seq# Include File Comments
<mailto:[email protected]>
0xA3 90-9F linux/dtlk.h
0xA4 00-1F uapi/linux/tee.h Generic TEE subsystem
+0xA4 00-1F uapi/asm/sgx.h Intel SGX subsystem (a legit conflict as TEE and SGX do not co-exist)
0xAA 00-3F linux/uapi/linux/userfaultfd.h
0xAB 00-1F linux/nbd.h
0xAC 00-1F linux/raw.h
diff --git a/arch/x86/include/uapi/asm/sgx.h b/arch/x86/include/uapi/asm/sgx.h
new file mode 100644
index 000000000000..5edb08ab8fd0
--- /dev/null
+++ b/arch/x86/include/uapi/asm/sgx.h
@@ -0,0 +1,66 @@
+/* SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause) WITH Linux-syscall-note */
+/*
+ * Copyright(c) 2016-19 Intel Corporation.
+ */
+#ifndef _UAPI_ASM_X86_SGX_H
+#define _UAPI_ASM_X86_SGX_H
+
+#include <linux/types.h>
+#include <linux/ioctl.h>
+
+/**
+ * enum sgx_epage_flags - page control flags
+ * %SGX_PAGE_MEASURE: Measure the page contents with a sequence of
+ * ENCLS[EEXTEND] operations.
+ */
+enum sgx_page_flags {
+ SGX_PAGE_MEASURE = 0x01,
+};
+
+#define SGX_MAGIC 0xA4
+
+#define SGX_IOC_ENCLAVE_CREATE \
+ _IOW(SGX_MAGIC, 0x00, struct sgx_enclave_create)
+#define SGX_IOC_ENCLAVE_ADD_PAGES \
+ _IOWR(SGX_MAGIC, 0x01, struct sgx_enclave_add_pages)
+#define SGX_IOC_ENCLAVE_INIT \
+ _IOW(SGX_MAGIC, 0x02, struct sgx_enclave_init)
+
+/**
+ * struct sgx_enclave_create - parameter structure for the
+ * %SGX_IOC_ENCLAVE_CREATE ioctl
+ * @src: address for the SECS page data
+ */
+struct sgx_enclave_create {
+ __u64 src;
+};
+
+/**
+ * struct sgx_enclave_add_pages - parameter structure for the
+ * %SGX_IOC_ENCLAVE_ADD_PAGE ioctl
+ * @src: start address for the page data
+ * @offset: starting page offset
+ * @length: length of the data (multiple of the page size)
+ * @secinfo: address for the SECINFO data
+ * @flags: page control flags
+ * @count: number of bytes added (multiple of the page size)
+ */
+struct sgx_enclave_add_pages {
+ __u64 src;
+ __u64 offset;
+ __u64 length;
+ __u64 secinfo;
+ __u64 flags;
+ __u64 count;
+};
+
+/**
+ * struct sgx_enclave_init - parameter structure for the
+ * %SGX_IOC_ENCLAVE_INIT ioctl
+ * @sigstruct: address for the SIGSTRUCT data
+ */
+struct sgx_enclave_init {
+ __u64 sigstruct;
+};
+
+#endif /* _UAPI_ASM_X86_SGX_H */
diff --git a/arch/x86/kernel/cpu/sgx/Makefile b/arch/x86/kernel/cpu/sgx/Makefile
index 2dec75916a5e..f8d32da3a67a 100644
--- a/arch/x86/kernel/cpu/sgx/Makefile
+++ b/arch/x86/kernel/cpu/sgx/Makefile
@@ -1,3 +1,6 @@
obj-y += \
+ driver.o \
+ encl.o \
+ ioctl.o \
main.o \
reclaim.o
diff --git a/arch/x86/kernel/cpu/sgx/driver.c b/arch/x86/kernel/cpu/sgx/driver.c
new file mode 100644
index 000000000000..b4aa7b9f8376
--- /dev/null
+++ b/arch/x86/kernel/cpu/sgx/driver.c
@@ -0,0 +1,194 @@
+// SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause)
+// Copyright(c) 2016-18 Intel Corporation.
+
+#include <linux/acpi.h>
+#include <linux/miscdevice.h>
+#include <linux/mman.h>
+#include <linux/security.h>
+#include <linux/suspend.h>
+#include <asm/traps.h>
+#include "driver.h"
+#include "encl.h"
+
+MODULE_DESCRIPTION("Intel SGX Enclave Driver");
+MODULE_AUTHOR("Jarkko Sakkinen <[email protected]>");
+MODULE_LICENSE("Dual BSD/GPL");
+
+u64 sgx_encl_size_max_32;
+u64 sgx_encl_size_max_64;
+u32 sgx_misc_reserved_mask;
+u64 sgx_attributes_reserved_mask;
+u64 sgx_xfrm_reserved_mask = ~0x3;
+u32 sgx_xsave_size_tbl[64];
+
+static int sgx_open(struct inode *inode, struct file *file)
+{
+ struct sgx_encl *encl;
+ int ret;
+
+ encl = kzalloc(sizeof(*encl), GFP_KERNEL);
+ if (!encl)
+ return -ENOMEM;
+
+ atomic_set(&encl->flags, 0);
+ kref_init(&encl->refcount);
+ INIT_RADIX_TREE(&encl->page_tree, GFP_KERNEL);
+ mutex_init(&encl->lock);
+ INIT_LIST_HEAD(&encl->mm_list);
+ spin_lock_init(&encl->mm_lock);
+
+ ret = init_srcu_struct(&encl->srcu);
+ if (ret) {
+ kfree(encl);
+ return ret;
+ }
+
+ file->private_data = encl;
+
+ return 0;
+}
+
+static int sgx_release(struct inode *inode, struct file *file)
+{
+ struct sgx_encl *encl = file->private_data;
+ struct sgx_encl_mm *encl_mm;
+
+ for ( ; ; ) {
+ spin_lock(&encl->mm_lock);
+
+ if (list_empty(&encl->mm_list)) {
+ encl_mm = NULL;
+ } else {
+ encl_mm = list_first_entry(&encl->mm_list,
+ struct sgx_encl_mm, list);
+ list_del_rcu(&encl_mm->list);
+ }
+
+ spin_unlock(&encl->mm_lock);
+
+ /* The list is empty, ready to go. */
+ if (!encl_mm)
+ break;
+
+ synchronize_srcu(&encl->srcu);
+ mmu_notifier_unregister(&encl_mm->mmu_notifier, encl_mm->mm);
+ kfree(encl_mm);
+ };
+
+ mutex_lock(&encl->lock);
+ atomic_or(SGX_ENCL_DEAD, &encl->flags);
+ mutex_unlock(&encl->lock);
+
+ kref_put(&encl->refcount, sgx_encl_release);
+ return 0;
+}
+
+#ifdef CONFIG_COMPAT
+static long sgx_compat_ioctl(struct file *filep, unsigned int cmd,
+ unsigned long arg)
+{
+ return sgx_ioctl(filep, cmd, arg);
+}
+#endif
+
+static int sgx_mmap(struct file *file, struct vm_area_struct *vma)
+{
+ struct sgx_encl *encl = file->private_data;
+ int ret;
+
+ ret = sgx_encl_may_map(encl, vma->vm_start, vma->vm_end,
+ vma->vm_flags & (VM_READ | VM_WRITE | VM_EXEC));
+ if (ret)
+ return ret;
+
+ ret = sgx_encl_mm_add(encl, vma->vm_mm);
+ if (ret)
+ return ret;
+
+ vma->vm_ops = &sgx_vm_ops;
+ vma->vm_flags |= VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP | VM_IO;
+ vma->vm_private_data = encl;
+
+ return 0;
+}
+
+static unsigned long sgx_get_unmapped_area(struct file *file,
+ unsigned long addr,
+ unsigned long len,
+ unsigned long pgoff,
+ unsigned long flags)
+{
+ if (flags & MAP_PRIVATE)
+ return -EINVAL;
+
+ if (flags & MAP_FIXED)
+ return addr;
+
+ return current->mm->get_unmapped_area(file, addr, len, pgoff, flags);
+}
+
+static const struct file_operations sgx_encl_fops = {
+ .owner = THIS_MODULE,
+ .open = sgx_open,
+ .release = sgx_release,
+ .unlocked_ioctl = sgx_ioctl,
+#ifdef CONFIG_COMPAT
+ .compat_ioctl = sgx_compat_ioctl,
+#endif
+ .mmap = sgx_mmap,
+ .get_unmapped_area = sgx_get_unmapped_area,
+};
+
+const struct file_operations sgx_provision_fops = {
+ .owner = THIS_MODULE,
+};
+
+static struct miscdevice sgx_dev_enclave = {
+ .minor = MISC_DYNAMIC_MINOR,
+ .name = "enclave",
+ .nodename = "sgx/enclave",
+ .fops = &sgx_encl_fops,
+};
+
+int __init sgx_drv_init(void)
+{
+ unsigned int eax, ebx, ecx, edx;
+ u64 attr_mask, xfrm_mask;
+ int ret;
+ int i;
+
+ if (!boot_cpu_has(X86_FEATURE_SGX_LC)) {
+ pr_info("The public key MSRs are not writable.\n");
+ return -ENODEV;
+ }
+
+ cpuid_count(SGX_CPUID, 0, &eax, &ebx, &ecx, &edx);
+ sgx_misc_reserved_mask = ~ebx | SGX_MISC_RESERVED_MASK;
+ sgx_encl_size_max_64 = 1ULL << ((edx >> 8) & 0xFF);
+ sgx_encl_size_max_32 = 1ULL << (edx & 0xFF);
+
+ cpuid_count(SGX_CPUID, 1, &eax, &ebx, &ecx, &edx);
+
+ attr_mask = (((u64)ebx) << 32) + (u64)eax;
+ sgx_attributes_reserved_mask = ~attr_mask | SGX_ATTR_RESERVED_MASK;
+
+ if (boot_cpu_has(X86_FEATURE_OSXSAVE)) {
+ xfrm_mask = (((u64)edx) << 32) + (u64)ecx;
+
+ for (i = 2; i < 64; i++) {
+ cpuid_count(0x0D, i, &eax, &ebx, &ecx, &edx);
+ if ((1 << i) & xfrm_mask)
+ sgx_xsave_size_tbl[i] = eax + ebx;
+ }
+
+ sgx_xfrm_reserved_mask = ~xfrm_mask;
+ }
+
+ ret = misc_register(&sgx_dev_enclave);
+ if (ret) {
+ pr_err("Creating /dev/sgx/enclave failed with %d.\n", ret);
+ return ret;
+ }
+
+ return 0;
+}
diff --git a/arch/x86/kernel/cpu/sgx/driver.h b/arch/x86/kernel/cpu/sgx/driver.h
new file mode 100644
index 000000000000..e4063923115b
--- /dev/null
+++ b/arch/x86/kernel/cpu/sgx/driver.h
@@ -0,0 +1,30 @@
+/* SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause) */
+#ifndef __ARCH_SGX_DRIVER_H__
+#define __ARCH_SGX_DRIVER_H__
+
+#include <crypto/hash.h>
+#include <linux/kref.h>
+#include <linux/mmu_notifier.h>
+#include <linux/radix-tree.h>
+#include <linux/rwsem.h>
+#include <linux/sched.h>
+#include <linux/workqueue.h>
+#include <uapi/asm/sgx.h>
+#include "sgx.h"
+
+#define SGX_EINIT_SPIN_COUNT 20
+#define SGX_EINIT_SLEEP_COUNT 50
+#define SGX_EINIT_SLEEP_TIME 20
+
+extern u64 sgx_encl_size_max_32;
+extern u64 sgx_encl_size_max_64;
+extern u32 sgx_misc_reserved_mask;
+extern u64 sgx_attributes_reserved_mask;
+extern u64 sgx_xfrm_reserved_mask;
+extern u32 sgx_xsave_size_tbl[64];
+
+long sgx_ioctl(struct file *filep, unsigned int cmd, unsigned long arg);
+
+int sgx_drv_init(void);
+
+#endif /* __ARCH_X86_SGX_DRIVER_H__ */
diff --git a/arch/x86/kernel/cpu/sgx/encl.c b/arch/x86/kernel/cpu/sgx/encl.c
new file mode 100644
index 000000000000..f349697c7508
--- /dev/null
+++ b/arch/x86/kernel/cpu/sgx/encl.c
@@ -0,0 +1,336 @@
+// SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause)
+// Copyright(c) 2016-18 Intel Corporation.
+
+#include <linux/lockdep.h>
+#include <linux/mm.h>
+#include <linux/mman.h>
+#include <linux/shmem_fs.h>
+#include <linux/suspend.h>
+#include <linux/sched/mm.h>
+#include "arch.h"
+#include "encl.h"
+#include "sgx.h"
+
+static struct sgx_encl_page *sgx_encl_load_page(struct sgx_encl *encl,
+ unsigned long addr)
+{
+ struct sgx_encl_page *entry;
+ unsigned int flags;
+
+ /* If process was forked, VMA is still there but vm_private_data is set
+ * to NULL.
+ */
+ if (!encl)
+ return ERR_PTR(-EFAULT);
+
+ flags = atomic_read(&encl->flags);
+
+ if ((flags & SGX_ENCL_DEAD) || !(flags & SGX_ENCL_INITIALIZED))
+ return ERR_PTR(-EFAULT);
+
+ entry = radix_tree_lookup(&encl->page_tree, addr >> PAGE_SHIFT);
+ if (!entry)
+ return ERR_PTR(-EFAULT);
+
+ /* Page is already resident in the EPC. */
+ if (entry->epc_page)
+ return entry;
+
+ return ERR_PTR(-EFAULT);
+}
+
+static void sgx_mmu_notifier_release(struct mmu_notifier *mn,
+ struct mm_struct *mm)
+{
+ struct sgx_encl_mm *encl_mm =
+ container_of(mn, struct sgx_encl_mm, mmu_notifier);
+ struct sgx_encl_mm *tmp = NULL;
+
+ /*
+ * The enclave itself can remove encl_mm. Note, objects can't be moved
+ * off an RCU protected list, but deletion is ok.
+ */
+ spin_lock(&encl_mm->encl->mm_lock);
+ list_for_each_entry(tmp, &encl_mm->encl->mm_list, list) {
+ if (tmp == encl_mm) {
+ list_del_rcu(&encl_mm->list);
+ break;
+ }
+ }
+ spin_unlock(&encl_mm->encl->mm_lock);
+
+ if (tmp == encl_mm) {
+ synchronize_srcu(&encl_mm->encl->srcu);
+ mmu_notifier_put(mn);
+ }
+}
+
+static void sgx_mmu_notifier_free(struct mmu_notifier *mn)
+{
+ struct sgx_encl_mm *encl_mm =
+ container_of(mn, struct sgx_encl_mm, mmu_notifier);
+
+ kfree(encl_mm);
+}
+
+static const struct mmu_notifier_ops sgx_mmu_notifier_ops = {
+ .release = sgx_mmu_notifier_release,
+ .free_notifier = sgx_mmu_notifier_free,
+};
+
+static struct sgx_encl_mm *sgx_encl_find_mm(struct sgx_encl *encl,
+ struct mm_struct *mm)
+{
+ struct sgx_encl_mm *encl_mm = NULL;
+ struct sgx_encl_mm *tmp;
+ int idx;
+
+ idx = srcu_read_lock(&encl->srcu);
+
+ list_for_each_entry_rcu(tmp, &encl->mm_list, list) {
+ if (tmp->mm == mm) {
+ encl_mm = tmp;
+ break;
+ }
+ }
+
+ srcu_read_unlock(&encl->srcu, idx);
+
+ return encl_mm;
+}
+
+int sgx_encl_mm_add(struct sgx_encl *encl, struct mm_struct *mm)
+{
+ struct sgx_encl_mm *encl_mm;
+ int ret;
+
+ if (atomic_read(&encl->flags) & SGX_ENCL_DEAD)
+ return -EINVAL;
+
+ /*
+ * mm_structs are kept on mm_list until the mm or the enclave dies,
+ * i.e. once an mm is off the list, it's gone for good, therefore it's
+ * impossible to get a false positive on @mm due to a stale mm_list.
+ */
+ if (sgx_encl_find_mm(encl, mm))
+ return 0;
+
+ encl_mm = kzalloc(sizeof(*encl_mm), GFP_KERNEL);
+ if (!encl_mm)
+ return -ENOMEM;
+
+ encl_mm->encl = encl;
+ encl_mm->mm = mm;
+ encl_mm->mmu_notifier.ops = &sgx_mmu_notifier_ops;
+
+ ret = __mmu_notifier_register(&encl_mm->mmu_notifier, mm);
+ if (ret) {
+ kfree(encl_mm);
+ return ret;
+ }
+
+ spin_lock(&encl->mm_lock);
+ list_add_rcu(&encl_mm->list, &encl->mm_list);
+ spin_unlock(&encl->mm_lock);
+
+ synchronize_srcu(&encl->srcu);
+
+ return 0;
+}
+
+static void sgx_vma_open(struct vm_area_struct *vma)
+{
+ struct sgx_encl *encl = vma->vm_private_data;
+
+ if (!encl)
+ return;
+
+ if (sgx_encl_mm_add(encl, vma->vm_mm))
+ vma->vm_private_data = NULL;
+}
+
+static unsigned int sgx_vma_fault(struct vm_fault *vmf)
+{
+ unsigned long addr = (unsigned long)vmf->address;
+ struct vm_area_struct *vma = vmf->vma;
+ struct sgx_encl *encl = vma->vm_private_data;
+ struct sgx_encl_page *entry;
+ int ret = VM_FAULT_NOPAGE;
+ unsigned long pfn;
+
+ if (!encl)
+ return VM_FAULT_SIGBUS;
+
+ mutex_lock(&encl->lock);
+
+ entry = sgx_encl_load_page(encl, addr);
+ if (IS_ERR(entry)) {
+ if (unlikely(PTR_ERR(entry) != -EBUSY))
+ ret = VM_FAULT_SIGBUS;
+
+ goto out;
+ }
+
+ if (!follow_pfn(vma, addr, &pfn))
+ goto out;
+
+ ret = vmf_insert_pfn(vma, addr, PFN_DOWN(entry->epc_page->desc));
+ if (ret != VM_FAULT_NOPAGE) {
+ ret = VM_FAULT_SIGBUS;
+ goto out;
+ }
+
+out:
+ mutex_unlock(&encl->lock);
+ return ret;
+}
+
+/**
+ * sgx_encl_may_map() - Check if a requested VMA mapping is allowed
+ * @encl: an enclave
+ * @start: lower bound of the address range, inclusive
+ * @end: upper bound of the address range, exclusive
+ * @vm_prot_bits: requested protections of the address range
+ *
+ * Iterate through the enclave pages contained within [@start, @end) to verify
+ * the permissions requested by @vm_prot_bits do not exceed that of any enclave
+ * page to be mapped. Page addresses that do not have an associated enclave
+ * page are interpreted to zero permissions.
+ *
+ * Return:
+ * 0 on success,
+ * -EACCES if VMA permissions exceed enclave page permissions
+ */
+int sgx_encl_may_map(struct sgx_encl *encl, unsigned long start,
+ unsigned long end, unsigned long vm_prot_bits)
+{
+ unsigned long idx, idx_start, idx_end;
+ struct sgx_encl_page *page;
+
+ /*
+ * Disallow RIE tasks as their VMA permissions might conflict with the
+ * enclave page permissions.
+ */
+ if (!!(current->personality & READ_IMPLIES_EXEC))
+ return -EACCES;
+
+ /* PROT_NONE always succeeds. */
+ if (!vm_prot_bits)
+ return 0;
+
+ idx_start = PFN_DOWN(start);
+ idx_end = PFN_DOWN(end - 1);
+
+ for (idx = idx_start; idx <= idx_end; ++idx) {
+ mutex_lock(&encl->lock);
+ page = radix_tree_lookup(&encl->page_tree, idx);
+ mutex_unlock(&encl->lock);
+
+ if (!page || (~page->vm_max_prot_bits & vm_prot_bits))
+ return -EACCES;
+ }
+
+ return 0;
+}
+
+static int sgx_vma_mprotect(struct vm_area_struct *vma, unsigned long start,
+ unsigned long end, unsigned long prot)
+{
+ return sgx_encl_may_map(vma->vm_private_data, start, end,
+ calc_vm_prot_bits(prot, 0));
+}
+
+const struct vm_operations_struct sgx_vm_ops = {
+ .open = sgx_vma_open,
+ .fault = sgx_vma_fault,
+ .may_mprotect = sgx_vma_mprotect,
+};
+
+/**
+ * sgx_encl_find - find an enclave
+ * @mm: mm struct of the current process
+ * @addr: address in the ELRANGE
+ * @vma: the resulting VMA
+ *
+ * Find an enclave identified by the given address. Give back a VMA that is
+ * part of the enclave and located in that address. The VMA is given back if it
+ * is a proper enclave VMA even if an &sgx_encl instance does not exist yet
+ * (enclave creation has not been performed).
+ *
+ * Return:
+ * 0 on success,
+ * -EINVAL if an enclave was not found,
+ * -ENOENT if the enclave has not been created yet
+ */
+int sgx_encl_find(struct mm_struct *mm, unsigned long addr,
+ struct vm_area_struct **vma)
+{
+ struct vm_area_struct *result;
+ struct sgx_encl *encl;
+
+ result = find_vma(mm, addr);
+ if (!result || result->vm_ops != &sgx_vm_ops || addr < result->vm_start)
+ return -EINVAL;
+
+ encl = result->vm_private_data;
+ *vma = result;
+
+ return encl ? 0 : -ENOENT;
+}
+
+/**
+ * sgx_encl_destroy() - destroy enclave resources
+ * @encl: an &sgx_encl instance
+ */
+void sgx_encl_destroy(struct sgx_encl *encl)
+{
+ struct sgx_encl_page *entry;
+ struct radix_tree_iter iter;
+ void **slot;
+
+ atomic_or(SGX_ENCL_DEAD, &encl->flags);
+
+ radix_tree_for_each_slot(slot, &encl->page_tree, &iter, 0) {
+ entry = *slot;
+
+ if (entry->epc_page) {
+ sgx_free_page(entry->epc_page);
+ encl->secs_child_cnt--;
+ entry->epc_page = NULL;
+ }
+
+ radix_tree_delete(&entry->encl->page_tree,
+ PFN_DOWN(entry->desc));
+ kfree(entry);
+ }
+
+ if (!encl->secs_child_cnt && encl->secs.epc_page) {
+ sgx_free_page(encl->secs.epc_page);
+ encl->secs.epc_page = NULL;
+ }
+}
+
+/**
+ * sgx_encl_release - Destroy an enclave instance
+ * @kref: address of a kref inside &sgx_encl
+ *
+ * Used together with kref_put(). Frees all the resources associated with the
+ * enclave and the instance itself.
+ */
+void sgx_encl_release(struct kref *ref)
+{
+ struct sgx_encl *encl = container_of(ref, struct sgx_encl, refcount);
+
+ sgx_encl_destroy(encl);
+
+ if (encl->backing)
+ fput(encl->backing);
+
+ WARN_ON_ONCE(!list_empty(&encl->mm_list));
+
+ /* Detect EPC page leak's. */
+ WARN_ON_ONCE(encl->secs_child_cnt);
+ WARN_ON_ONCE(encl->secs.epc_page);
+
+ kfree(encl);
+}
diff --git a/arch/x86/kernel/cpu/sgx/encl.h b/arch/x86/kernel/cpu/sgx/encl.h
new file mode 100644
index 000000000000..1d1bc5d590ee
--- /dev/null
+++ b/arch/x86/kernel/cpu/sgx/encl.h
@@ -0,0 +1,87 @@
+/* SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause) */
+/**
+ * Copyright(c) 2016-19 Intel Corporation.
+ */
+#ifndef _X86_ENCL_H
+#define _X86_ENCL_H
+
+#include <linux/cpumask.h>
+#include <linux/kref.h>
+#include <linux/list.h>
+#include <linux/mm_types.h>
+#include <linux/mmu_notifier.h>
+#include <linux/mutex.h>
+#include <linux/notifier.h>
+#include <linux/radix-tree.h>
+#include <linux/srcu.h>
+#include <linux/workqueue.h>
+#include "sgx.h"
+
+/**
+ * enum sgx_encl_page_desc - defines bits for an enclave page's descriptor
+ * %SGX_ENCL_PAGE_ADDR_MASK: Holds the virtual address of the page.
+ *
+ * The page address for SECS is zero and is used by the subsystem to recognize
+ * the SECS page.
+ */
+enum sgx_encl_page_desc {
+ /* Bits 11:3 are available when the page is not swapped. */
+ SGX_ENCL_PAGE_ADDR_MASK = PAGE_MASK,
+};
+
+#define SGX_ENCL_PAGE_ADDR(page) \
+ ((page)->desc & SGX_ENCL_PAGE_ADDR_MASK)
+
+struct sgx_encl_page {
+ unsigned long desc;
+ unsigned long vm_max_prot_bits;
+ struct sgx_epc_page *epc_page;
+ struct sgx_encl *encl;
+};
+
+enum sgx_encl_flags {
+ SGX_ENCL_CREATED = BIT(0),
+ SGX_ENCL_INITIALIZED = BIT(1),
+ SGX_ENCL_DEBUG = BIT(2),
+ SGX_ENCL_DEAD = BIT(3),
+ SGX_ENCL_IOCTL = BIT(4),
+};
+
+struct sgx_encl_mm {
+ struct sgx_encl *encl;
+ struct mm_struct *mm;
+ struct list_head list;
+ struct mmu_notifier mmu_notifier;
+};
+
+struct sgx_encl {
+ atomic_t flags;
+ u64 secs_attributes;
+ u64 allowed_attributes;
+ unsigned int page_cnt;
+ unsigned int secs_child_cnt;
+ struct mutex lock;
+ struct list_head mm_list;
+ spinlock_t mm_lock;
+ struct file *backing;
+ struct kref refcount;
+ struct srcu_struct srcu;
+ unsigned long base;
+ unsigned long size;
+ unsigned long ssaframesize;
+ struct radix_tree_root page_tree;
+ struct sgx_encl_page secs;
+ cpumask_t cpumask;
+};
+
+extern const struct vm_operations_struct sgx_vm_ops;
+
+int sgx_encl_find(struct mm_struct *mm, unsigned long addr,
+ struct vm_area_struct **vma);
+void sgx_encl_destroy(struct sgx_encl *encl);
+void sgx_encl_release(struct kref *ref);
+int sgx_encl_mm_add(struct sgx_encl *encl, struct mm_struct *mm);
+int sgx_encl_may_map(struct sgx_encl *encl, unsigned long start,
+ unsigned long end, unsigned long vm_prot_bits);
+
+#endif /* _X86_ENCL_H */
diff --git a/arch/x86/kernel/cpu/sgx/encls.h b/arch/x86/kernel/cpu/sgx/encls.h
index f91da6a1bddc..072d42973c68 100644
--- a/arch/x86/kernel/cpu/sgx/encls.h
+++ b/arch/x86/kernel/cpu/sgx/encls.h
@@ -186,10 +186,9 @@ static inline int __eadd(struct sgx_pageinfo *pginfo, void *addr)
return __encls_2(EADD, pginfo, addr);
}
-static inline int __einit(void *sigstruct, struct sgx_einittoken *einittoken,
- void *secs)
+static inline int __einit(void *sigstruct, void *token, void *secs)
{
- return __encls_ret_3(EINIT, sigstruct, secs, einittoken);
+ return __encls_ret_3(EINIT, sigstruct, secs, token);
}
static inline int __eremove(void *addr)
diff --git a/arch/x86/kernel/cpu/sgx/ioctl.c b/arch/x86/kernel/cpu/sgx/ioctl.c
new file mode 100644
index 000000000000..27de304efe39
--- /dev/null
+++ b/arch/x86/kernel/cpu/sgx/ioctl.c
@@ -0,0 +1,692 @@
+// SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause)
+// Copyright(c) 2016-19 Intel Corporation.
+
+#include <asm/mman.h>
+#include <linux/mman.h>
+#include <linux/delay.h>
+#include <linux/file.h>
+#include <linux/hashtable.h>
+#include <linux/highmem.h>
+#include <linux/ratelimit.h>
+#include <linux/sched/signal.h>
+#include <linux/shmem_fs.h>
+#include <linux/slab.h>
+#include <linux/suspend.h>
+#include "driver.h"
+#include "encl.h"
+#include "encls.h"
+
+/* A per-cpu cache for the last known values of IA32_SGXLEPUBKEYHASHx MSRs. */
+static DEFINE_PER_CPU(u64 [4], sgx_lepubkeyhash_cache);
+
+static u32 sgx_calc_ssaframesize(u32 miscselect, u64 xfrm)
+{
+ u32 size_max = PAGE_SIZE;
+ u32 size;
+ int i;
+
+ for (i = 2; i < 64; i++) {
+ if (!((1 << i) & xfrm))
+ continue;
+
+ size = SGX_SSA_GPRS_SIZE + sgx_xsave_size_tbl[i];
+ if (miscselect & SGX_MISC_EXINFO)
+ size += SGX_SSA_MISC_EXINFO_SIZE;
+
+ if (size > size_max)
+ size_max = size;
+ }
+
+ return PFN_UP(size_max);
+}
+
+static int sgx_validate_secs(const struct sgx_secs *secs,
+ unsigned long ssaframesize)
+{
+ if (secs->size < (2 * PAGE_SIZE) || !is_power_of_2(secs->size))
+ return -EINVAL;
+
+ if (secs->base & (secs->size - 1))
+ return -EINVAL;
+
+ if (secs->miscselect & sgx_misc_reserved_mask ||
+ secs->attributes & sgx_attributes_reserved_mask ||
+ secs->xfrm & sgx_xfrm_reserved_mask)
+ return -EINVAL;
+
+ if (secs->attributes & SGX_ATTR_MODE64BIT) {
+ if (secs->size > sgx_encl_size_max_64)
+ return -EINVAL;
+ } else if (secs->size > sgx_encl_size_max_32)
+ return -EINVAL;
+
+ if (!(secs->xfrm & XFEATURE_MASK_FP) ||
+ !(secs->xfrm & XFEATURE_MASK_SSE) ||
+ (((secs->xfrm >> XFEATURE_BNDREGS) & 1) !=
+ ((secs->xfrm >> XFEATURE_BNDCSR) & 1)))
+ return -EINVAL;
+
+ if (!secs->ssa_frame_size || ssaframesize > secs->ssa_frame_size)
+ return -EINVAL;
+
+ if (memchr_inv(secs->reserved1, 0, sizeof(secs->reserved1)) ||
+ memchr_inv(secs->reserved2, 0, sizeof(secs->reserved2)) ||
+ memchr_inv(secs->reserved3, 0, sizeof(secs->reserved3)) ||
+ memchr_inv(secs->reserved4, 0, sizeof(secs->reserved4)))
+ return -EINVAL;
+
+ return 0;
+}
+
+static struct sgx_encl_page *sgx_encl_page_alloc(struct sgx_encl *encl,
+ unsigned long offset,
+ u64 secinfo_flags)
+{
+ struct sgx_encl_page *encl_page;
+ unsigned long prot;
+
+ encl_page = kzalloc(sizeof(*encl_page), GFP_KERNEL);
+ if (!encl_page)
+ return ERR_PTR(-ENOMEM);
+
+ encl_page->desc = encl->base + offset;
+ encl_page->encl = encl;
+
+ prot = _calc_vm_trans(secinfo_flags, SGX_SECINFO_R, PROT_READ) |
+ _calc_vm_trans(secinfo_flags, SGX_SECINFO_W, PROT_WRITE) |
+ _calc_vm_trans(secinfo_flags, SGX_SECINFO_X, PROT_EXEC);
+
+ /*
+ * TCS pages must always RW set for CPU access while the SECINFO
+ * permissions are *always* zero - the CPU ignores the user provided
+ * values and silently overwrites them with zero permissions.
+ */
+ if ((secinfo_flags & SGX_SECINFO_PAGE_TYPE_MASK) == SGX_SECINFO_TCS)
+ prot |= PROT_READ | PROT_WRITE;
+
+ /* Calculate maximum of the VM flags for the page. */
+ encl_page->vm_max_prot_bits = calc_vm_prot_bits(prot, 0);
+
+ return encl_page;
+}
+
+static int sgx_encl_create(struct sgx_encl *encl, struct sgx_secs *secs)
+{
+ unsigned long encl_size = secs->size + PAGE_SIZE;
+ struct sgx_epc_page *secs_epc;
+ unsigned long ssaframesize;
+ struct sgx_pageinfo pginfo;
+ struct sgx_secinfo secinfo;
+ struct file *backing;
+ long ret;
+
+ if (atomic_read(&encl->flags) & SGX_ENCL_CREATED)
+ return -EINVAL;
+
+ ssaframesize = sgx_calc_ssaframesize(secs->miscselect, secs->xfrm);
+ if (sgx_validate_secs(secs, ssaframesize)) {
+ pr_debug("invalid SECS\n");
+ return -EINVAL;
+ }
+
+ backing = shmem_file_setup("SGX backing", encl_size + (encl_size >> 5),
+ VM_NORESERVE);
+ if (IS_ERR(backing))
+ return PTR_ERR(backing);
+
+ encl->backing = backing;
+
+ secs_epc = sgx_try_alloc_page();
+ if (IS_ERR(secs_epc)) {
+ ret = PTR_ERR(secs_epc);
+ goto err_out_backing;
+ }
+
+ encl->secs.epc_page = secs_epc;
+
+ pginfo.addr = 0;
+ pginfo.contents = (unsigned long)secs;
+ pginfo.metadata = (unsigned long)&secinfo;
+ pginfo.secs = 0;
+ memset(&secinfo, 0, sizeof(secinfo));
+
+ ret = __ecreate((void *)&pginfo, sgx_epc_addr(secs_epc));
+ if (ret) {
+ pr_debug("ECREATE returned %ld\n", ret);
+ goto err_out;
+ }
+
+ if (secs->attributes & SGX_ATTR_DEBUG)
+ atomic_or(SGX_ENCL_DEBUG, &encl->flags);
+
+ encl->secs.encl = encl;
+ encl->secs_attributes = secs->attributes;
+ encl->allowed_attributes |= SGX_ATTR_ALLOWED_MASK;
+ encl->base = secs->base;
+ encl->size = secs->size;
+ encl->ssaframesize = secs->ssa_frame_size;
+
+ /*
+ * Set SGX_ENCL_CREATED only after the enclave is fully prepped. This
+ * allows setting and checking enclave creation without having to take
+ * encl->lock.
+ */
+ atomic_or(SGX_ENCL_CREATED, &encl->flags);
+
+ return 0;
+
+err_out:
+ sgx_free_page(encl->secs.epc_page);
+ encl->secs.epc_page = NULL;
+
+err_out_backing:
+ fput(encl->backing);
+ encl->backing = NULL;
+
+ return ret;
+}
+
+/**
+ * sgx_ioc_enclave_create - handler for %SGX_IOC_ENCLAVE_CREATE
+ * @filep: open file to /dev/sgx
+ * @arg: userspace pointer to a struct sgx_enclave_create instance
+ *
+ * Allocate kernel data structures for a new enclave and execute ECREATE after
+ * verifying the correctness of the provided SECS.
+ *
+ * Note, enforcement of restricted and disallowed attributes is deferred until
+ * sgx_ioc_enclave_init(), only the architectural correctness of the SECS is
+ * checked by sgx_ioc_enclave_create().
+ *
+ * Return:
+ * 0 on success,
+ * -errno otherwise
+ */
+static long sgx_ioc_enclave_create(struct sgx_encl *encl, void __user *arg)
+{
+ struct sgx_enclave_create ecreate;
+ struct page *secs_page;
+ struct sgx_secs *secs;
+ int ret;
+
+ if (copy_from_user(&ecreate, arg, sizeof(ecreate)))
+ return -EFAULT;
+
+ secs_page = alloc_page(GFP_KERNEL);
+ if (!secs_page)
+ return -ENOMEM;
+
+ secs = kmap(secs_page);
+ if (copy_from_user(secs, (void __user *)ecreate.src, sizeof(*secs))) {
+ ret = -EFAULT;
+ goto out;
+ }
+
+ ret = sgx_encl_create(encl, secs);
+
+out:
+ kunmap(secs_page);
+ __free_page(secs_page);
+ return ret;
+}
+
+static int sgx_validate_secinfo(struct sgx_secinfo *secinfo)
+{
+ u64 perm = secinfo->flags & SGX_SECINFO_PERMISSION_MASK;
+ u64 pt = secinfo->flags & SGX_SECINFO_PAGE_TYPE_MASK;
+
+ if (pt != SGX_SECINFO_REG && pt != SGX_SECINFO_TCS)
+ return -EINVAL;
+
+ if ((perm & SGX_SECINFO_W) && !(perm & SGX_SECINFO_R))
+ return -EINVAL;
+
+ /*
+ * CPU will silently overwrite the permissions as zero, which means
+ * that we need to validate it ourselves.
+ */
+ if (pt == SGX_SECINFO_TCS && perm)
+ return -EINVAL;
+
+ if (secinfo->flags & SGX_SECINFO_RESERVED_MASK)
+ return -EINVAL;
+
+ if (memchr_inv(secinfo->reserved, 0, sizeof(secinfo->reserved)))
+ return -EINVAL;
+
+ return 0;
+}
+
+static int __sgx_encl_add_page(struct sgx_encl *encl,
+ struct sgx_encl_page *encl_page,
+ struct sgx_epc_page *epc_page,
+ struct sgx_secinfo *secinfo, unsigned long src)
+{
+ struct sgx_pageinfo pginfo;
+ struct vm_area_struct *vma;
+ struct page *src_page;
+ int ret;
+
+ /* Query vma's VM_MAYEXEC as an indirect path_noexec() check. */
+ if (encl_page->vm_max_prot_bits & VM_EXEC) {
+ vma = find_vma(current->mm, src);
+ if (!vma)
+ return -EFAULT;
+
+ if (!(vma->vm_flags & VM_MAYEXEC))
+ return -EACCES;
+ }
+
+ ret = get_user_pages(src, 1, 0, &src_page, NULL);
+ if (ret < 1)
+ return ret;
+
+ pginfo.secs = (unsigned long)sgx_epc_addr(encl->secs.epc_page);
+ pginfo.addr = SGX_ENCL_PAGE_ADDR(encl_page);
+ pginfo.metadata = (unsigned long)secinfo;
+ pginfo.contents = (unsigned long)kmap_atomic(src_page);
+
+ ret = __eadd(&pginfo, sgx_epc_addr(epc_page));
+
+ kunmap_atomic((void *)pginfo.contents);
+ put_page(src_page);
+
+ return ret ? -EIO : 0;
+}
+
+static int __sgx_encl_extend(struct sgx_encl *encl,
+ struct sgx_epc_page *epc_page)
+{
+ int ret;
+ int i;
+
+ for (i = 0; i < 16; i++) {
+ ret = __eextend(sgx_epc_addr(encl->secs.epc_page),
+ sgx_epc_addr(epc_page) + (i * 0x100));
+ if (ret) {
+ if (encls_failed(ret))
+ ENCLS_WARN(ret, "EEXTEND");
+ return -EIO;
+ }
+ }
+
+ return 0;
+}
+
+static int sgx_encl_add_page(struct sgx_encl *encl, unsigned long src,
+ unsigned long offset, unsigned long length,
+ struct sgx_secinfo *secinfo, unsigned long flags)
+{
+ struct sgx_encl_page *encl_page;
+ struct sgx_epc_page *epc_page;
+ int ret;
+
+ encl_page = sgx_encl_page_alloc(encl, offset, secinfo->flags);
+ if (IS_ERR(encl_page))
+ return PTR_ERR(encl_page);
+
+ epc_page = sgx_try_alloc_page();
+ if (IS_ERR(epc_page)) {
+ kfree(encl_page);
+ return PTR_ERR(epc_page);
+ }
+
+ if (atomic_read(&encl->flags) &
+ (SGX_ENCL_INITIALIZED | SGX_ENCL_DEAD)) {
+ ret = -EFAULT;
+ goto err_out_free;
+ }
+
+ down_read(¤t->mm->mmap_sem);
+ mutex_lock(&encl->lock);
+
+ /*
+ * Insert prior to EADD in case of OOM. EADD modifies MRENCLAVE, i.e.
+ * can't be gracefully unwound, while failure on EADD/EXTEND is limited
+ * to userspace errors (or kernel/hardware bugs).
+ */
+ ret = radix_tree_insert(&encl->page_tree, PFN_DOWN(encl_page->desc),
+ encl_page);
+ if (ret)
+ goto err_out_unlock;
+
+ ret = __sgx_encl_add_page(encl, encl_page, epc_page, secinfo,
+ src);
+ if (ret)
+ goto err_out;
+
+ /*
+ * Complete the "add" before doing the "extend" so that the "add"
+ * isn't in a half-baked state in the extremely unlikely scenario the
+ * the enclave will be destroyed in response to EEXTEND failure.
+ */
+ encl_page->encl = encl;
+ encl_page->epc_page = epc_page;
+ encl->secs_child_cnt++;
+
+ if (flags & SGX_PAGE_MEASURE) {
+ ret = __sgx_encl_extend(encl, epc_page);
+ if (ret)
+ goto err_out;
+ }
+
+ mutex_unlock(&encl->lock);
+ up_read(¤t->mm->mmap_sem);
+ return ret;
+
+err_out:
+ radix_tree_delete(&encl_page->encl->page_tree,
+ PFN_DOWN(encl_page->desc));
+
+err_out_unlock:
+ mutex_unlock(&encl->lock);
+ up_read(¤t->mm->mmap_sem);
+
+err_out_free:
+ sgx_free_page(epc_page);
+ kfree(encl_page);
+
+ /*
+ * Destroy enclave on ENCLS failure as this means that EPC has been
+ * invalidated.
+ */
+ if (ret == -EIO)
+ sgx_encl_destroy(encl);
+
+ return ret;
+}
+
+/**
+ * sgx_ioc_enclave_add_pages() - The handler for %SGX_IOC_ENCLAVE_ADD_PAGES
+ * @encl: pointer to an enclave instance (via ioctl() file pointer)
+ * @arg: a user pointer to a struct sgx_enclave_add_pages instance
+ *
+ * Add one or more pages to an uninitialized enclave, and optionally extend the
+ * measurement with the contents of the page. The address range of pages must
+ * be contiguous. The SECINFO and measurement mask are applied to all pages.
+ *
+ * A SECINFO for a TCS is required to always contain zero permissions because
+ * CPU silently zeros them. Allowing anything else would cause a mismatch in
+ * the measurement.
+ *
+ * mmap()'s protection bits are capped by the page permissions. For each page
+ * address, the maximum protection bits are computed with the following
+ * heuristics:
+ *
+ * 1. A regular page: PROT_R, PROT_W and PROT_X match the SECINFO permissions.
+ * 2. A TCS page: PROT_R | PROT_W.
+ * 3. No page: PROT_NONE.
+ *
+ * mmap() is not allowed to surpass the minimum of the maximum protection bits
+ * within the given address range.
+ *
+ * As stated above, a non-existent page is interpreted as a page with no
+ * permissions. In effect, this allows mmap() with PROT_NONE to be used to seek
+ * an address range for the enclave that can be then populated into SECS.
+ *
+ * If ENCLS opcode fails, that effectively means that EPC has been invalidated.
+ * When this happens the enclave is destroyed and -EIO is returned to the
+ * caller.
+ *
+ * Return:
+ * 0 on success,
+ * -EACCES if an executable source page is located in a noexec partition,
+ * -EIO if either ENCLS[EADD] or ENCLS[EEXTEND] fails
+ * -errno otherwise
+ */
+static long sgx_ioc_enclave_add_pages(struct sgx_encl *encl, void __user *arg)
+{
+ struct sgx_enclave_add_pages addp;
+ struct sgx_secinfo secinfo;
+ unsigned long c;
+ int ret;
+
+ if (!(atomic_read(&encl->flags) & SGX_ENCL_CREATED))
+ return -EINVAL;
+
+ if (copy_from_user(&addp, arg, sizeof(addp)))
+ return -EFAULT;
+
+ if (!IS_ALIGNED(addp.offset, PAGE_SIZE) ||
+ !IS_ALIGNED(addp.src, PAGE_SIZE))
+ return -EINVAL;
+
+ if (!(access_ok(addp.src, PAGE_SIZE)))
+ return -EFAULT;
+
+ if (addp.length & (PAGE_SIZE - 1))
+ return -EINVAL;
+
+ if (addp.offset + addp.length - PAGE_SIZE >= encl->size)
+ return -EINVAL;
+
+ if (copy_from_user(&secinfo, (void __user *)addp.secinfo,
+ sizeof(secinfo)))
+ return -EFAULT;
+
+ if (sgx_validate_secinfo(&secinfo))
+ return -EINVAL;
+
+ for (c = 0 ; c < addp.length; c += PAGE_SIZE) {
+ if (signal_pending(current)) {
+ ret = -EINTR;
+ break;
+ }
+
+ if (need_resched())
+ cond_resched();
+
+ ret = sgx_encl_add_page(encl, addp.src + c, addp.offset + c,
+ addp.length - c, &secinfo, addp.flags);
+ if (ret)
+ break;
+ }
+
+ addp.count = c;
+
+ if (copy_to_user(arg, &addp, sizeof(addp)))
+ return -EFAULT;
+
+ return ret;
+}
+
+static int __sgx_get_key_hash(struct crypto_shash *tfm, const void *modulus,
+ void *hash)
+{
+ SHASH_DESC_ON_STACK(shash, tfm);
+
+ shash->tfm = tfm;
+
+ return crypto_shash_digest(shash, modulus, SGX_MODULUS_SIZE, hash);
+}
+
+static int sgx_get_key_hash(const void *modulus, void *hash)
+{
+ struct crypto_shash *tfm;
+ int ret;
+
+ tfm = crypto_alloc_shash("sha256", 0, CRYPTO_ALG_ASYNC);
+ if (IS_ERR(tfm))
+ return PTR_ERR(tfm);
+
+ ret = __sgx_get_key_hash(tfm, modulus, hash);
+
+ crypto_free_shash(tfm);
+ return ret;
+}
+
+static void sgx_update_lepubkeyhash_msrs(u64 *lepubkeyhash, bool enforce)
+{
+ u64 *cache;
+ int i;
+
+ cache = per_cpu(sgx_lepubkeyhash_cache, smp_processor_id());
+ for (i = 0; i < 4; i++) {
+ if (enforce || (lepubkeyhash[i] != cache[i])) {
+ wrmsrl(MSR_IA32_SGXLEPUBKEYHASH0 + i, lepubkeyhash[i]);
+ cache[i] = lepubkeyhash[i];
+ }
+ }
+}
+
+static int sgx_einit(struct sgx_sigstruct *sigstruct, void *token,
+ struct sgx_epc_page *secs, u64 *lepubkeyhash)
+{
+ int ret;
+
+ preempt_disable();
+ sgx_update_lepubkeyhash_msrs(lepubkeyhash, false);
+ ret = __einit(sigstruct, token, sgx_epc_addr(secs));
+ if (ret == SGX_INVALID_EINITTOKEN) {
+ sgx_update_lepubkeyhash_msrs(lepubkeyhash, true);
+ ret = __einit(sigstruct, token, sgx_epc_addr(secs));
+ }
+ preempt_enable();
+ return ret;
+}
+
+static int sgx_encl_init(struct sgx_encl *encl, struct sgx_sigstruct *sigstruct,
+ void *token)
+{
+ u64 mrsigner[4];
+ int ret;
+ int i;
+ int j;
+
+ /* Check that the required attributes have been authorized. */
+ if (encl->secs_attributes & ~encl->allowed_attributes)
+ return -EACCES;
+
+ ret = sgx_get_key_hash(sigstruct->modulus, mrsigner);
+ if (ret)
+ return ret;
+
+ mutex_lock(&encl->lock);
+
+ if (atomic_read(&encl->flags) & SGX_ENCL_INITIALIZED) {
+ ret = -EFAULT;
+ goto err_out;
+ }
+
+ for (i = 0; i < SGX_EINIT_SLEEP_COUNT; i++) {
+ for (j = 0; j < SGX_EINIT_SPIN_COUNT; j++) {
+ ret = sgx_einit(sigstruct, token, encl->secs.epc_page,
+ mrsigner);
+ if (ret == SGX_UNMASKED_EVENT)
+ continue;
+ else
+ break;
+ }
+
+ if (ret != SGX_UNMASKED_EVENT)
+ break;
+
+ msleep_interruptible(SGX_EINIT_SLEEP_TIME);
+
+ if (signal_pending(current)) {
+ ret = -ERESTARTSYS;
+ goto err_out;
+ }
+ }
+
+ if (ret & ENCLS_FAULT_FLAG) {
+ if (encls_failed(ret))
+ ENCLS_WARN(ret, "EINIT");
+
+ sgx_encl_destroy(encl);
+ ret = -EFAULT;
+ } else if (ret) {
+ pr_debug("EINIT returned %d\n", ret);
+ ret = -EPERM;
+ } else {
+ atomic_or(SGX_ENCL_INITIALIZED, &encl->flags);
+ }
+
+err_out:
+ mutex_unlock(&encl->lock);
+ return ret;
+}
+
+/**
+ * sgx_ioc_enclave_init - handler for %SGX_IOC_ENCLAVE_INIT
+ *
+ * @filep: open file to /dev/sgx
+ * @arg: userspace pointer to a struct sgx_enclave_init instance
+ *
+ * Flush any outstanding enqueued EADD operations and perform EINIT. The
+ * Launch Enclave Public Key Hash MSRs are rewritten as necessary to match
+ * the enclave's MRSIGNER, which is caculated from the provided sigstruct.
+ *
+ * Return:
+ * 0 on success,
+ * SGX error code on EINIT failure,
+ * -errno otherwise
+ */
+static long sgx_ioc_enclave_init(struct sgx_encl *encl, void __user *arg)
+{
+ struct sgx_sigstruct *sigstruct;
+ struct sgx_enclave_init einit;
+ struct page *initp_page;
+ void *token;
+ int ret;
+
+ if (!(atomic_read(&encl->flags) & SGX_ENCL_CREATED))
+ return -EINVAL;
+
+ if (copy_from_user(&einit, arg, sizeof(einit)))
+ return -EFAULT;
+
+ initp_page = alloc_page(GFP_KERNEL);
+ if (!initp_page)
+ return -ENOMEM;
+
+ sigstruct = kmap(initp_page);
+ token = (void *)((unsigned long)sigstruct + PAGE_SIZE / 2);
+ memset(token, 0, SGX_LAUNCH_TOKEN_SIZE);
+
+ if (copy_from_user(sigstruct, (void __user *)einit.sigstruct,
+ sizeof(*sigstruct))) {
+ ret = -EFAULT;
+ goto out;
+ }
+
+ ret = sgx_encl_init(encl, sigstruct, token);
+
+out:
+ kunmap(initp_page);
+ __free_page(initp_page);
+ return ret;
+}
+
+
+long sgx_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
+{
+ struct sgx_encl *encl = filep->private_data;
+ int ret, encl_flags;
+
+ encl_flags = atomic_fetch_or(SGX_ENCL_IOCTL, &encl->flags);
+ if (encl_flags & SGX_ENCL_IOCTL)
+ return -EBUSY;
+
+ if (encl_flags & SGX_ENCL_DEAD)
+ return -EFAULT;
+
+ switch (cmd) {
+ case SGX_IOC_ENCLAVE_CREATE:
+ ret = sgx_ioc_enclave_create(encl, (void __user *)arg);
+ break;
+ case SGX_IOC_ENCLAVE_ADD_PAGES:
+ ret = sgx_ioc_enclave_add_pages(encl, (void __user *)arg);
+ break;
+ case SGX_IOC_ENCLAVE_INIT:
+ ret = sgx_ioc_enclave_init(encl, (void __user *)arg);
+ break;
+ default:
+ ret = -ENOIOCTLCMD;
+ break;
+ }
+
+ atomic_andnot(SGX_ENCL_IOCTL, &encl->flags);
+
+ return ret;
+}
diff --git a/arch/x86/kernel/cpu/sgx/main.c b/arch/x86/kernel/cpu/sgx/main.c
index 60d82e7537c8..842f9abba1c0 100644
--- a/arch/x86/kernel/cpu/sgx/main.c
+++ b/arch/x86/kernel/cpu/sgx/main.c
@@ -8,6 +8,7 @@
#include <linux/ratelimit.h>
#include <linux/sched/signal.h>
#include <linux/slab.h>
+#include "driver.h"
#include "encls.h"
struct sgx_epc_section sgx_epc_sections[SGX_MAX_EPC_SECTIONS];
@@ -193,6 +194,8 @@ static bool __init sgx_page_cache_init(void)
static void __init sgx_init(void)
{
+ int ret;
+
if (!boot_cpu_has(X86_FEATURE_SGX))
return;
@@ -202,10 +205,17 @@ static void __init sgx_init(void)
if (!sgx_page_reclaimer_init())
goto err_page_cache;
+ ret = sgx_drv_init();
+ if (ret)
+ goto err_kthread;
+
return;
+err_kthread:
+ kthread_stop(ksgxswapd_tsk);
+
err_page_cache:
sgx_page_cache_teardown();
}
-arch_initcall(sgx_init);
+device_initcall(sgx_init);
diff --git a/arch/x86/kernel/cpu/sgx/reclaim.c b/arch/x86/kernel/cpu/sgx/reclaim.c
index 215371588a25..9e6d3e147aa2 100644
--- a/arch/x86/kernel/cpu/sgx/reclaim.c
+++ b/arch/x86/kernel/cpu/sgx/reclaim.c
@@ -10,6 +10,7 @@
#include <linux/sched/mm.h>
#include <linux/sched/signal.h>
#include "encls.h"
+#include "driver.h"
struct task_struct *ksgxswapd_tsk;
--
2.25.0
Add VMA callbacks for ptrace() that can be used with debug enclaves.
With debug enclaves data can be read and write the memory word at a time
by using ENCLS(EDBGRD) and ENCLS(EDBGWR) leaf instructions.
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
arch/x86/kernel/cpu/sgx/encl.c | 88 ++++++++++++++++++++++++++++++++++
1 file changed, 88 insertions(+)
diff --git a/arch/x86/kernel/cpu/sgx/encl.c b/arch/x86/kernel/cpu/sgx/encl.c
index dc597fdfd0dd..d6a19bdd1921 100644
--- a/arch/x86/kernel/cpu/sgx/encl.c
+++ b/arch/x86/kernel/cpu/sgx/encl.c
@@ -327,6 +327,7 @@ int sgx_encl_may_map(struct sgx_encl *encl, unsigned long start,
return 0;
}
+
static int sgx_vma_mprotect(struct vm_area_struct *vma, unsigned long start,
unsigned long end, unsigned long prot)
{
@@ -334,10 +335,97 @@ static int sgx_vma_mprotect(struct vm_area_struct *vma, unsigned long start,
calc_vm_prot_bits(prot, 0));
}
+static int sgx_edbgrd(struct sgx_encl *encl, struct sgx_encl_page *page,
+ unsigned long addr, void *data)
+{
+ unsigned long offset = addr & ~PAGE_MASK;
+ int ret;
+
+
+ ret = __edbgrd(sgx_epc_addr(page->epc_page) + offset, data);
+ if (ret)
+ return -EIO;
+
+ return 0;
+}
+
+static int sgx_edbgwr(struct sgx_encl *encl, struct sgx_encl_page *page,
+ unsigned long addr, void *data)
+{
+ unsigned long offset = addr & ~PAGE_MASK;
+ int ret;
+
+ ret = __edbgwr(sgx_epc_addr(page->epc_page) + offset, data);
+ if (ret)
+ return -EIO;
+
+ return 0;
+}
+
+static int sgx_vma_access(struct vm_area_struct *vma, unsigned long addr,
+ void *buf, int len, int write)
+{
+ struct sgx_encl *encl = vma->vm_private_data;
+ struct sgx_encl_page *entry = NULL;
+ char data[sizeof(unsigned long)];
+ unsigned long align;
+ unsigned int flags;
+ int offset;
+ int cnt;
+ int ret = 0;
+ int i;
+
+ /* If process was forked, VMA is still there but vm_private_data is set
+ * to NULL.
+ */
+ if (!encl)
+ return -EFAULT;
+
+ flags = atomic_read(&encl->flags);
+
+ if (!(flags & SGX_ENCL_DEBUG) || !(flags & SGX_ENCL_INITIALIZED) ||
+ (flags & SGX_ENCL_DEAD))
+ return -EFAULT;
+
+ for (i = 0; i < len; i += cnt) {
+ entry = sgx_encl_reserve_page(encl, (addr + i) & PAGE_MASK);
+ if (IS_ERR(entry)) {
+ ret = PTR_ERR(entry);
+ break;
+ }
+
+ align = ALIGN_DOWN(addr + i, sizeof(unsigned long));
+ offset = (addr + i) & (sizeof(unsigned long) - 1);
+ cnt = sizeof(unsigned long) - offset;
+ cnt = min(cnt, len - i);
+
+ ret = sgx_edbgrd(encl, entry, align, data);
+ if (ret)
+ goto out;
+
+ if (write) {
+ memcpy(data + offset, buf + i, cnt);
+ ret = sgx_edbgwr(encl, entry, align, data);
+ if (ret)
+ goto out;
+ } else
+ memcpy(buf + i, data + offset, cnt);
+
+out:
+ mutex_unlock(&encl->lock);
+
+ if (ret)
+ break;
+ }
+
+ return ret < 0 ? ret : i;
+}
+
const struct vm_operations_struct sgx_vm_ops = {
.open = sgx_vma_open,
.fault = sgx_vma_fault,
.may_mprotect = sgx_vma_mprotect,
+ .access = sgx_vma_access,
};
/**
--
2.25.0
Document Intel SGX micro architecture and kernel internals. The motivation
is to make the core ideas approachable by keeping a fairly high abstraction
level. Fine-grained micro architecture details can be looked up from Intel
SDM Volume 3D.
Cc: [email protected]
Co-developed-by: Sean Christopherson <[email protected]>
Signed-off-by: Sean Christopherson <[email protected]>
Acked-by: Randy Dunlap <[email protected]>
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
Documentation/x86/index.rst | 1 +
Documentation/x86/sgx.rst | 192 ++++++++++++++++++++++++++++++++++++
2 files changed, 193 insertions(+)
create mode 100644 Documentation/x86/sgx.rst
diff --git a/Documentation/x86/index.rst b/Documentation/x86/index.rst
index a8de2fbc1caa..971f30a7d166 100644
--- a/Documentation/x86/index.rst
+++ b/Documentation/x86/index.rst
@@ -31,3 +31,4 @@ x86-specific Documentation
usb-legacy-support
i386/index
x86_64/index
+ sgx
diff --git a/Documentation/x86/sgx.rst b/Documentation/x86/sgx.rst
new file mode 100644
index 000000000000..740b09323f18
--- /dev/null
+++ b/Documentation/x86/sgx.rst
@@ -0,0 +1,192 @@
+.. SPDX-License-Identifier: GPL-2.0
+
+============
+Architecture
+============
+
+*Software Guard eXtensions (SGX)* is a set of instructions that enable ring-3
+applications to set aside private regions of code and data. These regions are
+called enclaves. An enclave can be entered to a fixed set of entry points. Only
+a CPU running inside the enclave can access its code and data.
+
+The support can be determined by
+
+ ``grep sgx /proc/cpuinfo``
+
+Enclave Page Cache
+==================
+
+SGX utilizes an *Enclave Page Cache (EPC)* to store pages that are associated
+with an enclave. It is contained in a BIOS reserved region of physical memory.
+Unlike pages used for regular memory, pages can only be accessed outside the
+enclave for different purposes with the instructions **ENCLS**, **ENCLV** and
+**ENCLU**.
+
+Direct memory accesses to an enclave can be only done by a CPU executing inside
+the enclave. An enclave can be entered with **ENCLU[EENTER]** to a fixed set of
+entry points. However, a CPU executing inside the enclave can do outside memory
+accesses.
+
+Page Types
+----------
+
+**SGX Enclave Control Structure (SECS)**
+ Enclave's address range, attributes and other global data are defined
+ by this structure.
+
+**Regular (REG)**
+ Regular EPC pages contain the code and data of an enclave.
+
+**Thread Control Structure (TCS)**
+ Thread Control Structure pages define the entry points to an enclave and
+ track the execution state of an enclave thread.
+
+**Version Array (VA)**
+ Version Array pages contain 512 slots, each of which can contain a version
+ number for a page evicted from the EPC.
+
+Enclave Page Cache Map
+----------------------
+
+The processor tracks EPC pages via the *Enclave Page Cache Map (EPCM)*. EPCM
+contains an entry for each EPC page, which describes the owning enclave, access
+rights and page type among the other things.
+
+The permissions from EPCM is consulted if and only if walking the kernel page
+tables succeeds. The total permissions are thus a conjunction between page table
+and EPCM permissions.
+
+For all intents and purposes the SGX architecture allows the processor to
+invalidate all EPCM entries at will, i.e. requires that software be prepared to
+handle an EPCM fault at any time. The contents of EPC are encrypted with an
+ephemeral key, which is lost on power transitions.
+
+EPC management
+==============
+
+EPC pages do not have ``struct page`` instances. They are IO memory from kernel
+perspective. The consequence is that they are always mapped as shared memory.
+Kernel defines ``/dev/sgx/enclave`` that can be mapped as ``MAP_SHARED`` to
+define the address range for an enclave.
+
+EPC Over-subscription
+=====================
+
+When the amount of free EPC pages goes below a low watermark the swapping thread
+starts reclaiming pages. The pages that do not have the **A** bit set are
+selected as victim pages.
+
+Launch Control
+==============
+
+SGX provides a launch control mechanism. After all enclave pages have been
+copied, kernel executes **ENCLS[EINIT]**, which initializes the enclave. Only
+after this the CPU can execute inside the enclave.
+
+This leaf function takes an RSA-3072 signature of the enclave measurement and an
+optional cryptographic token. Linux does not take advantage of launch tokens.
+The instruction checks that the signature is signed with the key defined in
+**IA32_SGXLEPUBKEYHASH?** MSRs and the measurement is correct. If so, the
+enclave is allowed to be executed.
+
+MSRs can be configured by the BIOS to be either readable or writable. Linux
+supports only writable configuration in order to give full control to the kernel
+on launch control policy. Readable configuration requires the use of previously
+mentioned launch tokens.
+
+The current kernel implementation supports only writable MSRs. The launch is
+performed by setting the MSRs to the hash of the enclave signer's public key.
+The alternative would be to have *a launch enclave* that would be signed with
+the key set into MSRs, which would then generate launch tokens for other
+enclaves. This would only make sense with read-only MSRs, and thus the option
+has been discarded.
+
+Attestation
+===========
+
+Local Attestation
+-----------------
+
+In local attestation an enclave creates a **REPORT** data structure with
+**ENCLS[EREPORT]**, which describes the origin of an enclave. In particular, it
+contains a AES-CMAC of the enclave contents signed with a report key unique to
+each processor. All enclaves have access to this key.
+
+This mechanism can also be used in addition as a communication channel as the
+**REPORT** data structure includes a 64-byte field for variable information.
+
+Remote Attestation
+------------------
+
+For remote attestation (aka provisioning) there are multiple options available:
+
+* EPID based scheme, which requires the use of Intel managed attestation
+ service.
+* ECDSA based scheme, which allows a 3rd party to act as an attestation service.
+
+Intel provides an open source *quoting enclave (QE)* and *provisioning
+certification enclave (PCE)* for the ECDSA based scheme. PCE acts as the
+CA for the local QE's.
+
+Intel also provides a proprietary binary version of the PCE. This is a
+necessity when the software needs to prove to be running inside a legit enclave
+on real hardware.
+
+The use of remote attestation must be strictly controlled because it allows to
+get access to the provisioning keys to attest to a remote party that the
+software is running inside a legitimate enclave on real hardware. This could be
+potentially used by malware, and thus must be protected.
+
+Enclaves can attest their identity when **ATTRIBUTES.PROVISIONKEY** is set in
+SECS. This attribute authorizes **ENCLS[EGETKEY]** to access provisioning keys.
+
+References
+----------
+
+"Intel® Software Guard Extensions: EPID Provisioning and Attestation Services"
+ https://software.intel.com/sites/default/files/managed/57/0e/ww10-2016-sgx-provisioning-and-attestation-final.pdf
+
+"Supporting Third Party Attestation for Intel® SGX with Intel® Data Center
+Attestation Primitives"
+ https://software.intel.com/sites/default/files/managed/f1/b8/intel-sgx-support-for-third-party-attestation.pdf
+
+Usage Models
+============
+
+Shared Library
+--------------
+
+Sensitive data and the code that acts on it is partitioned from the application
+into a separate library. The library is then linked as a DSO which can be loaded
+into an enclave. The application can then make individual function calls into
+the enclave through special SGX instructions. A run-time within the enclave is
+configured to marshal function parameters into and out of the enclave and to
+call the correct library function.
+
+Application Container
+---------------------
+
+An application may be loaded into a container enclave which is specially
+configured with a library OS and run-time which permits the application to run.
+The enclave run-time and library OS work together to execute the application
+when a thread enters the enclave.
+
+================
+Kernel internals
+================
+
+An enclave is created by opening ``/dev/sgx/enclave`` and calling a set of ioctl
+calls, which reserve a fixed range of memory addresses for the enclave and
+initialize its memory contents.
+
+An enclave can be made visible with ``mmap()`` calls. Permissions are capped by
+enclave page permissions given during the building phase because CPU disallows a
+PTE have higher permissions than the enclave page that it contains.
+
+Enclaves can be forked or sent through UDS sockets, which allows an enclave
+consumer and a builder to be separate processes with a different set of
+privileges.
+
+The backing memory is implemented with a private shemm file, which is not
+accounted. This makes it advicable to not allow all processes in a system
+to build enclaves.
--
2.25.0
From: Sean Christopherson <[email protected]>
vDSO functions can now leverage an exception fixup mechanism similar to
kernel exception fixup. For vDSO exception fixup, the initial user is
Intel's Software Guard Extensions (SGX), which will wrap the low-level
transitions to/from the enclave, i.e. EENTER and ERESUME instructions,
in a vDSO function and leverage fixup to intercept exceptions that would
otherwise generate a signal. This allows the vDSO wrapper to return the
fault information directly to its caller, obviating the need for SGX
applications and libraries to juggle signal handlers.
Attempt to fixup vDSO exceptions immediately prior to populating and
sending signal information. Except for the delivery mechanism, an
exception in a vDSO function should be treated like any other exception
in userspace, e.g. any fault that is successfully handled by the kernel
should not be directly visible to userspace.
Although it's debatable whether or not all exceptions are of interest to
enclaves, defer to the vDSO fixup to decide whether to do fixup or
generate a signal. Future users of vDSO fixup, if there ever are any,
will undoubtedly have different requirements than SGX enclaves, e.g. the
fixup vs. signal logic can be made function specific if/when necessary.
Suggested-by: Andy Lutomirski <[email protected]>
Signed-off-by: Sean Christopherson <[email protected]>
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
arch/x86/kernel/traps.c | 14 ++++++++++++++
arch/x86/mm/fault.c | 8 ++++++++
2 files changed, 22 insertions(+)
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 6ef00eb6fbb9..a814b1aea94d 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -56,6 +56,7 @@
#include <asm/umip.h>
#include <asm/insn.h>
#include <asm/insn-eval.h>
+#include <asm/vdso.h>
#ifdef CONFIG_X86_64
#include <asm/x86_init.h>
@@ -205,6 +206,9 @@ do_trap_no_signal(struct task_struct *tsk, int trapnr, const char *str,
tsk->thread.error_code = error_code;
tsk->thread.trap_nr = trapnr;
die(str, regs, error_code);
+ } else {
+ if (fixup_vdso_exception(regs, trapnr, error_code, 0))
+ return 0;
}
/*
@@ -518,6 +522,9 @@ dotraplinkage void do_general_protection(struct pt_regs *regs, long error_code)
tsk->thread.error_code = error_code;
tsk->thread.trap_nr = X86_TRAP_GP;
+ if (fixup_vdso_exception(regs, X86_TRAP_GP, error_code, 0))
+ return;
+
show_signal(tsk, SIGSEGV, "", desc, regs, error_code);
force_sig(SIGSEGV);
@@ -762,6 +769,10 @@ dotraplinkage void do_debug(struct pt_regs *regs, long error_code)
SIGTRAP) == NOTIFY_STOP)
goto exit;
+ if (user_mode(regs) &&
+ fixup_vdso_exception(regs, X86_TRAP_DB, error_code, 0))
+ goto exit;
+
/*
* Let others (NMI) know that the debug stack is in use
* as we may switch to the interrupt stack.
@@ -842,6 +853,9 @@ static void math_error(struct pt_regs *regs, int error_code, int trapnr)
if (!si_code)
return;
+ if (fixup_vdso_exception(regs, trapnr, error_code, 0))
+ return;
+
force_sig_fault(SIGFPE, si_code,
(void __user *)uprobe_get_trap_addr(regs));
}
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 6b662d272af6..42965b47b52f 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -30,6 +30,7 @@
#include <asm/desc.h> /* store_idt(), ... */
#include <asm/cpu_entry_area.h> /* exception stack */
#include <asm/pgtable_areas.h> /* VMALLOC_START, ... */
+#include <asm/vdso.h> /* fixup_vdso_exception() */
#define CREATE_TRACE_POINTS
#include <asm/trace/exceptions.h>
@@ -902,6 +903,10 @@ __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,
sanitize_error_code(address, &error_code);
+ if (fixup_vdso_exception(regs, X86_TRAP_PF, error_code,
+ address))
+ return;
+
if (likely(show_unhandled_signals))
show_signal_msg(regs, error_code, address, tsk);
@@ -1019,6 +1024,9 @@ do_sigbus(struct pt_regs *regs, unsigned long error_code, unsigned long address,
sanitize_error_code(address, &error_code);
+ if (fixup_vdso_exception(regs, X86_TRAP_PF, error_code, address))
+ return;
+
set_signal_archinfo(address, error_code);
#ifdef CONFIG_MEMORY_FAILURE
--
2.25.0
From: Sean Christopherson <[email protected]>
An SGX runtime must be aware of the exceptions, which happen inside an
enclave. Introduce a vDSO call that wraps EENTER/ERESUME cycle and returns
the CPU exception back to the caller exactly when it happens.
Kernel fixups the exception information to RDI, RSI and RDX. The SGX call
vDSO handler fills this information to the user provided buffer or
alternatively trigger user provided callback at the time of the exception.
The calling convention is custom and does not follow System V x86-64 ABI.
Suggested-by: Andy Lutomirski <[email protected]>
Signed-off-by: Sean Christopherson <[email protected]>
Co-developed-by: Cedric Xing <[email protected]>
Signed-off-by: Cedric Xing <[email protected]>
Tested-by: Jethro Beekman <[email protected]>
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
arch/x86/entry/vdso/Makefile | 2 +
arch/x86/entry/vdso/vdso.lds.S | 1 +
arch/x86/entry/vdso/vsgx_enter_enclave.S | 187 +++++++++++++++++++++++
arch/x86/include/uapi/asm/sgx.h | 37 +++++
4 files changed, 227 insertions(+)
create mode 100644 arch/x86/entry/vdso/vsgx_enter_enclave.S
diff --git a/arch/x86/entry/vdso/Makefile b/arch/x86/entry/vdso/Makefile
index 657e01d34d02..fa50c76a17a8 100644
--- a/arch/x86/entry/vdso/Makefile
+++ b/arch/x86/entry/vdso/Makefile
@@ -24,6 +24,7 @@ VDSO32-$(CONFIG_IA32_EMULATION) := y
# files to link into the vdso
vobjs-y := vdso-note.o vclock_gettime.o vgetcpu.o
+vobjs-$(VDSO64-y) += vsgx_enter_enclave.o
# files to link into kernel
obj-y += vma.o extable.o
@@ -90,6 +91,7 @@ $(vobjs): KBUILD_CFLAGS := $(filter-out $(GCC_PLUGINS_CFLAGS) $(RETPOLINE_CFLAGS
CFLAGS_REMOVE_vclock_gettime.o = -pg
CFLAGS_REMOVE_vdso32/vclock_gettime.o = -pg
CFLAGS_REMOVE_vgetcpu.o = -pg
+CFLAGS_REMOVE_vsgx_enter_enclave.o = -pg
#
# X32 processes use x32 vDSO to access 64bit kernel data.
diff --git a/arch/x86/entry/vdso/vdso.lds.S b/arch/x86/entry/vdso/vdso.lds.S
index 36b644e16272..4bf48462fca7 100644
--- a/arch/x86/entry/vdso/vdso.lds.S
+++ b/arch/x86/entry/vdso/vdso.lds.S
@@ -27,6 +27,7 @@ VERSION {
__vdso_time;
clock_getres;
__vdso_clock_getres;
+ __vdso_sgx_enter_enclave;
local: *;
};
}
diff --git a/arch/x86/entry/vdso/vsgx_enter_enclave.S b/arch/x86/entry/vdso/vsgx_enter_enclave.S
new file mode 100644
index 000000000000..94a8e5f99961
--- /dev/null
+++ b/arch/x86/entry/vdso/vsgx_enter_enclave.S
@@ -0,0 +1,187 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+#include <linux/linkage.h>
+#include <asm/export.h>
+#include <asm/errno.h>
+
+#include "extable.h"
+
+#define EX_LEAF 0*8
+#define EX_TRAPNR 0*8+4
+#define EX_ERROR_CODE 0*8+6
+#define EX_ADDRESS 1*8
+
+.code64
+.section .text, "ax"
+
+/**
+ * __vdso_sgx_enter_enclave() - Enter an SGX enclave
+ * @leaf: ENCLU leaf, must be EENTER or ERESUME
+ * @tcs: TCS, must be non-NULL
+ * @e: Optional struct sgx_enclave_exception instance
+ * @handler: Optional enclave exit handler
+ *
+ * **Important!** __vdso_sgx_enter_enclave() is **NOT** compliant with the
+ * x86-64 ABI, i.e. cannot be called from standard C code.
+ *
+ * Input ABI:
+ * @leaf %eax
+ * @tcs 8(%rsp)
+ * @e 0x10(%rsp)
+ * @handler 0x18(%rsp)
+ *
+ * Output ABI:
+ * @ret %eax
+ *
+ * All general purpose registers except RAX, RBX and RCX are passed as-is to
+ * the enclave. RAX, RBX and RCX are consumed by EENTER and ERESUME and are
+ * loaded with @leaf, asynchronous exit pointer, and @tcs respectively.
+ *
+ * RBP and the stack are used to anchor __vdso_sgx_enter_enclave() to the
+ * pre-enclave state, e.g. to retrieve @e and @handler after an enclave exit.
+ * All other registers are available for use by the enclave and its runtime,
+ * e.g. an enclave can push additional data onto the stack (and modify RSP) to
+ * pass information to the optional exit handler (see below).
+ *
+ * Most exceptions reported on ENCLU, including those that occur within the
+ * enclave, are fixed up and reported synchronously instead of being delivered
+ * via a standard signal. Debug Exceptions (#DB) and Breakpoints (#BP) are
+ * never fixed up and are always delivered via standard signals. On synchrously
+ * reported exceptions, -EFAULT is returned and details about the exception are
+ * recorded in @e, the optional sgx_enclave_exception struct.
+
+ * If an exit handler is provided, the handler will be invoked on synchronous
+ * exits from the enclave and for all synchronously reported exceptions. In
+ * latter case, @e is filled prior to invoking the handler.
+ *
+ * The exit handler's return value is interpreted as follows:
+ * >0: continue, restart __vdso_sgx_enter_enclave() with @ret as @leaf
+ * 0: success, return @ret to the caller
+ * <0: error, return @ret to the caller
+ *
+ * The userspace exit handler is responsible for unwinding the stack, e.g. to
+ * pop @e, u_rsp and @tcs, prior to returning to __vdso_sgx_enter_enclave().
+ * The exit handler may also transfer control, e.g. via longjmp() or a C++
+ * exception, without returning to __vdso_sgx_enter_enclave().
+ *
+ * Return:
+ * 0 on success,
+ * -EINVAL if ENCLU leaf is not allowed,
+ * -EFAULT if an exception occurs on ENCLU or within the enclave
+ * -errno for all other negative values returned by the userspace exit handler
+ */
+#ifdef SGX_KERNEL_DOC
+/* C-style function prototype to coerce kernel-doc into parsing the comment. */
+int __vdso_sgx_enter_enclave(int leaf, void *tcs,
+ struct sgx_enclave_exception *e,
+ sgx_enclave_exit_handler_t handler);
+#endif
+SYM_FUNC_START(__vdso_sgx_enter_enclave)
+ /* Prolog */
+ .cfi_startproc
+ push %rbp
+ .cfi_adjust_cfa_offset 8
+ .cfi_rel_offset %rbp, 0
+ mov %rsp, %rbp
+ .cfi_def_cfa_register %rbp
+
+.Lenter_enclave:
+ /* EENTER <= leaf <= ERESUME */
+ cmp $0x2, %eax
+ jb .Linvalid_leaf
+ cmp $0x3, %eax
+ ja .Linvalid_leaf
+
+ /* Load TCS and AEP */
+ mov 0x10(%rbp), %rbx
+ lea .Lasync_exit_pointer(%rip), %rcx
+
+ /* Single ENCLU serving as both EENTER and AEP (ERESUME) */
+.Lasync_exit_pointer:
+.Lenclu_eenter_eresume:
+ enclu
+
+ /* EEXIT jumps here unless the enclave is doing something fancy. */
+ xor %eax, %eax
+
+ /* Invoke userspace's exit handler if one was provided. */
+.Lhandle_exit:
+ cmp $0, 0x20(%rbp)
+ jne .Linvoke_userspace_handler
+
+.Lout:
+ leave
+ .cfi_def_cfa %rsp, 8
+ ret
+
+ /* The out-of-line code runs with the pre-leave stack frame. */
+ .cfi_def_cfa %rbp, 16
+
+.Linvalid_leaf:
+ mov $(-EINVAL), %eax
+ jmp .Lout
+
+.Lhandle_exception:
+ mov 0x18(%rbp), %rcx
+ test %rcx, %rcx
+ je .Lskip_exception_info
+
+ /* Fill optional exception info. */
+ mov %eax, EX_LEAF(%rcx)
+ mov %di, EX_TRAPNR(%rcx)
+ mov %si, EX_ERROR_CODE(%rcx)
+ mov %rdx, EX_ADDRESS(%rcx)
+.Lskip_exception_info:
+ mov $(-EFAULT), %eax
+ jmp .Lhandle_exit
+
+.Linvoke_userspace_handler:
+ /* Pass the untrusted RSP (at exit) to the callback via %rcx. */
+ mov %rsp, %rcx
+
+ /* Save the untrusted RSP in %rbx (non-volatile register). */
+ mov %rsp, %rbx
+
+ /*
+ * Align stack per x86_64 ABI. Note, %rsp needs to be 16-byte aligned
+ * _after_ pushing the parameters on the stack, hence the bonus push.
+ */
+ and $-0x10, %rsp
+ push %rax
+
+ /* Push @e, the "return" value and @tcs as params to the callback. */
+ push 0x18(%rbp)
+ push %rax
+ push 0x10(%rbp)
+
+ /* Clear RFLAGS.DF per x86_64 ABI */
+ cld
+
+ /* Load the callback pointer to %rax and invoke it via retpoline. */
+ mov 0x20(%rbp), %rax
+ call .Lretpoline
+
+ /* Restore %rsp to its post-exit value. */
+ mov %rbx, %rsp
+
+ /*
+ * If the return from callback is zero or negative, return immediately,
+ * else re-execute ENCLU with the postive return value interpreted as
+ * the requested ENCLU leaf.
+ */
+ cmp $0, %eax
+ jle .Lout
+ jmp .Lenter_enclave
+
+.Lretpoline:
+ call 2f
+1: pause
+ lfence
+ jmp 1b
+2: mov %rax, (%rsp)
+ ret
+ .cfi_endproc
+
+_ASM_VDSO_EXTABLE_HANDLE(.Lenclu_eenter_eresume, .Lhandle_exception)
+
+SYM_FUNC_END(__vdso_sgx_enter_enclave)
diff --git a/arch/x86/include/uapi/asm/sgx.h b/arch/x86/include/uapi/asm/sgx.h
index 57d0d30c79b3..e196cfd44b70 100644
--- a/arch/x86/include/uapi/asm/sgx.h
+++ b/arch/x86/include/uapi/asm/sgx.h
@@ -74,4 +74,41 @@ struct sgx_enclave_set_attribute {
__u64 attribute_fd;
};
+/**
+ * struct sgx_enclave_exception - structure to report exceptions encountered in
+ * __vdso_sgx_enter_enclave()
+ *
+ * @leaf: ENCLU leaf from \%eax at time of exception
+ * @trapnr: exception trap number, a.k.a. fault vector
+ * @error_code: exception error code
+ * @address: exception address, e.g. CR2 on a #PF
+ * @reserved: reserved for future use
+ */
+struct sgx_enclave_exception {
+ __u32 leaf;
+ __u16 trapnr;
+ __u16 error_code;
+ __u64 address;
+ __u64 reserved[2];
+};
+
+/**
+ * typedef sgx_enclave_exit_handler_t - Exit handler function accepted by
+ * __vdso_sgx_enter_enclave()
+ *
+ * @rdi: RDI at the time of enclave exit
+ * @rsi: RSI at the time of enclave exit
+ * @rdx: RDX at the time of enclave exit
+ * @ursp: RSP at the time of enclave exit (untrusted stack)
+ * @r8: R8 at the time of enclave exit
+ * @r9: R9 at the time of enclave exit
+ * @tcs: Thread Control Structure used to enter enclave
+ * @ret: 0 on success (EEXIT), -EFAULT on an exception
+ * @e: Pointer to struct sgx_enclave_exception (as provided by caller)
+ */
+typedef int (*sgx_enclave_exit_handler_t)(long rdi, long rsi, long rdx,
+ long ursp, long r8, long r9,
+ void *tcs, int ret,
+ struct sgx_enclave_exception *e);
+
#endif /* _UAPI_ASM_X86_SGX_H */
--
2.25.0
There is a limited amount of SGX reserved memory available. Therefore,
some of it must be copied to the regular memory, and only subset kept in
the SGX reserved memory. While kernel cannot directly access enclave
memory, SGX provides ENCLS leaf functions to perform reclaiming
functionality.
This commits implements a page reclaimer by using these leaf functions,
which picks the victim pages in LRU fashion from all enclaves running in
an enclave's pages back to the SGX reserved memory.
The thread ksgxswapd reclaims pages on the event when the number of free
EPC pages goes below %SGX_NR_LOW_PAGES up until it reaches
%SGX_NR_HIGH_PAGES.
sgx_alloc_page() can now optionally reclaim pages with @reclaim boolean
parameter. The caller must also supply owner for each page so that the
reclaimer can access the associated enclaves. This is needed for locking,
as most of the ENCLS leafs cannot be executed concurrently for an enclave,
and accessing SECS, which is required to be resident when its child pages
are being reclaimed.
Cc: [email protected]
Co-developed-by: Sean Christopherson <[email protected]>
Signed-off-by: Sean Christopherson <[email protected]>
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
arch/x86/kernel/cpu/sgx/driver.c | 1 +
arch/x86/kernel/cpu/sgx/encl.c | 337 ++++++++++++++++++++++++++-
arch/x86/kernel/cpu/sgx/encl.h | 40 ++++
arch/x86/kernel/cpu/sgx/ioctl.c | 76 +++++-
arch/x86/kernel/cpu/sgx/main.c | 61 ++++-
arch/x86/kernel/cpu/sgx/reclaim.c | 375 ++++++++++++++++++++++++++++++
arch/x86/kernel/cpu/sgx/sgx.h | 35 +++
7 files changed, 917 insertions(+), 8 deletions(-)
diff --git a/arch/x86/kernel/cpu/sgx/driver.c b/arch/x86/kernel/cpu/sgx/driver.c
index d90114cec1c3..997a7f4117c5 100644
--- a/arch/x86/kernel/cpu/sgx/driver.c
+++ b/arch/x86/kernel/cpu/sgx/driver.c
@@ -32,6 +32,7 @@ static int sgx_open(struct inode *inode, struct file *file)
atomic_set(&encl->flags, 0);
kref_init(&encl->refcount);
+ INIT_LIST_HEAD(&encl->va_pages);
INIT_RADIX_TREE(&encl->page_tree, GFP_KERNEL);
mutex_init(&encl->lock);
INIT_LIST_HEAD(&encl->mm_list);
diff --git a/arch/x86/kernel/cpu/sgx/encl.c b/arch/x86/kernel/cpu/sgx/encl.c
index f349697c7508..dc597fdfd0dd 100644
--- a/arch/x86/kernel/cpu/sgx/encl.c
+++ b/arch/x86/kernel/cpu/sgx/encl.c
@@ -9,11 +9,86 @@
#include <linux/sched/mm.h>
#include "arch.h"
#include "encl.h"
+#include "encls.h"
#include "sgx.h"
+static int __sgx_encl_eldu(struct sgx_encl_page *encl_page,
+ struct sgx_epc_page *epc_page,
+ struct sgx_epc_page *secs_page)
+{
+ unsigned long va_offset = SGX_ENCL_PAGE_VA_OFFSET(encl_page);
+ struct sgx_encl *encl = encl_page->encl;
+ struct sgx_pageinfo pginfo;
+ struct sgx_backing b;
+ pgoff_t page_index;
+ int ret;
+
+ if (secs_page)
+ page_index = SGX_ENCL_PAGE_INDEX(encl_page);
+ else
+ page_index = PFN_DOWN(encl->size);
+
+ ret = sgx_encl_get_backing(encl, page_index, &b);
+ if (ret)
+ return ret;
+
+ pginfo.addr = SGX_ENCL_PAGE_ADDR(encl_page);
+ pginfo.contents = (unsigned long)kmap_atomic(b.contents);
+ pginfo.metadata = (unsigned long)kmap_atomic(b.pcmd) +
+ b.pcmd_offset;
+
+ if (secs_page)
+ pginfo.secs = (u64)sgx_epc_addr(secs_page);
+ else
+ pginfo.secs = 0;
+
+ ret = __eldu(&pginfo, sgx_epc_addr(epc_page),
+ sgx_epc_addr(encl_page->va_page->epc_page) + va_offset);
+ if (ret) {
+ if (encls_failed(ret))
+ ENCLS_WARN(ret, "ELDU");
+
+ ret = -EFAULT;
+ }
+
+ kunmap_atomic((void *)(unsigned long)(pginfo.metadata - b.pcmd_offset));
+ kunmap_atomic((void *)(unsigned long)pginfo.contents);
+
+ sgx_encl_put_backing(&b, false);
+
+ return ret;
+}
+
+static struct sgx_epc_page *sgx_encl_eldu(struct sgx_encl_page *encl_page,
+ struct sgx_epc_page *secs_page)
+{
+ unsigned long va_offset = SGX_ENCL_PAGE_VA_OFFSET(encl_page);
+ struct sgx_encl *encl = encl_page->encl;
+ struct sgx_epc_page *epc_page;
+ int ret;
+
+ epc_page = sgx_alloc_page(encl_page, false);
+ if (IS_ERR(epc_page))
+ return epc_page;
+
+ ret = __sgx_encl_eldu(encl_page, epc_page, secs_page);
+ if (ret) {
+ sgx_free_page(epc_page);
+ return ERR_PTR(ret);
+ }
+
+ sgx_free_va_slot(encl_page->va_page, va_offset);
+ list_move(&encl_page->va_page->list, &encl->va_pages);
+ encl_page->desc &= ~SGX_ENCL_PAGE_VA_OFFSET_MASK;
+ encl_page->epc_page = epc_page;
+
+ return epc_page;
+}
+
static struct sgx_encl_page *sgx_encl_load_page(struct sgx_encl *encl,
unsigned long addr)
{
+ struct sgx_epc_page *epc_page;
struct sgx_encl_page *entry;
unsigned int flags;
@@ -33,10 +108,27 @@ static struct sgx_encl_page *sgx_encl_load_page(struct sgx_encl *encl,
return ERR_PTR(-EFAULT);
/* Page is already resident in the EPC. */
- if (entry->epc_page)
+ if (entry->epc_page) {
+ if (entry->desc & SGX_ENCL_PAGE_RECLAIMED)
+ return ERR_PTR(-EBUSY);
+
return entry;
+ }
+
+ if (!(encl->secs.epc_page)) {
+ epc_page = sgx_encl_eldu(&encl->secs, NULL);
+ if (IS_ERR(epc_page))
+ return ERR_CAST(epc_page);
+ }
+
+ epc_page = sgx_encl_eldu(entry, encl->secs.epc_page);
+ if (IS_ERR(epc_page))
+ return ERR_CAST(epc_page);
- return ERR_PTR(-EFAULT);
+ encl->secs_child_cnt++;
+ sgx_mark_page_reclaimable(entry->epc_page);
+
+ return entry;
}
static void sgx_mmu_notifier_release(struct mmu_notifier *mn,
@@ -180,6 +272,8 @@ static unsigned int sgx_vma_fault(struct vm_fault *vmf)
goto out;
}
+ sgx_encl_test_and_clear_young(vma->vm_mm, entry);
+
out:
mutex_unlock(&encl->lock);
return ret;
@@ -284,6 +378,7 @@ int sgx_encl_find(struct mm_struct *mm, unsigned long addr,
*/
void sgx_encl_destroy(struct sgx_encl *encl)
{
+ struct sgx_va_page *va_page;
struct sgx_encl_page *entry;
struct radix_tree_iter iter;
void **slot;
@@ -294,6 +389,13 @@ void sgx_encl_destroy(struct sgx_encl *encl)
entry = *slot;
if (entry->epc_page) {
+ /*
+ * The page and its radix tree entry cannot be freed
+ * if the page is being held by the reclaimer.
+ */
+ if (sgx_unmark_page_reclaimable(entry->epc_page))
+ continue;
+
sgx_free_page(entry->epc_page);
encl->secs_child_cnt--;
entry->epc_page = NULL;
@@ -308,6 +410,19 @@ void sgx_encl_destroy(struct sgx_encl *encl)
sgx_free_page(encl->secs.epc_page);
encl->secs.epc_page = NULL;
}
+
+ /*
+ * The reclaimer is responsible for checking SGX_ENCL_DEAD before doing
+ * EWB, thus it's safe to free VA pages even if the reclaimer holds a
+ * reference to the enclave.
+ */
+ while (!list_empty(&encl->va_pages)) {
+ va_page = list_first_entry(&encl->va_pages, struct sgx_va_page,
+ list);
+ list_del(&va_page->list);
+ sgx_free_page(va_page->epc_page);
+ kfree(va_page);
+ }
}
/**
@@ -334,3 +449,221 @@ void sgx_encl_release(struct kref *ref)
kfree(encl);
}
+
+static struct page *sgx_encl_get_backing_page(struct sgx_encl *encl,
+ pgoff_t index)
+{
+ struct inode *inode = encl->backing->f_path.dentry->d_inode;
+ struct address_space *mapping = inode->i_mapping;
+ gfp_t gfpmask = mapping_gfp_mask(mapping);
+
+ return shmem_read_mapping_page_gfp(mapping, index, gfpmask);
+}
+
+/**
+ * sgx_encl_get_backing() - Pin the backing storage
+ * @encl: an enclave
+ * @page_index: enclave page index
+ * @backing: data for accessing backing storage for the page
+ *
+ * Pin the backing storage pages for storing the encrypted contents and Paging
+ * Crypto MetaData (PCMD) of an enclave page.
+ *
+ * Return:
+ * 0 on success,
+ * -errno otherwise.
+ */
+int sgx_encl_get_backing(struct sgx_encl *encl, unsigned long page_index,
+ struct sgx_backing *backing)
+{
+ pgoff_t pcmd_index = PFN_DOWN(encl->size) + 1 + (page_index >> 5);
+ struct page *contents;
+ struct page *pcmd;
+
+ contents = sgx_encl_get_backing_page(encl, page_index);
+ if (IS_ERR(contents))
+ return PTR_ERR(contents);
+
+ pcmd = sgx_encl_get_backing_page(encl, pcmd_index);
+ if (IS_ERR(pcmd)) {
+ put_page(contents);
+ return PTR_ERR(pcmd);
+ }
+
+ backing->page_index = page_index;
+ backing->contents = contents;
+ backing->pcmd = pcmd;
+ backing->pcmd_offset =
+ (page_index & (PAGE_SIZE / sizeof(struct sgx_pcmd) - 1)) *
+ sizeof(struct sgx_pcmd);
+
+ return 0;
+}
+
+/**
+ * sgx_encl_put_backing() - Unpin the backing storage
+ * @backing: data for accessing backing storage for the page
+ * @do_write: mark pages dirty
+ */
+void sgx_encl_put_backing(struct sgx_backing *backing, bool do_write)
+{
+ if (do_write) {
+ set_page_dirty(backing->pcmd);
+ set_page_dirty(backing->contents);
+ }
+
+ put_page(backing->pcmd);
+ put_page(backing->contents);
+}
+
+static int sgx_encl_test_and_clear_young_cb(pte_t *ptep, unsigned long addr,
+ void *data)
+{
+ pte_t pte;
+ int ret;
+
+ ret = pte_young(*ptep);
+ if (ret) {
+ pte = pte_mkold(*ptep);
+ set_pte_at((struct mm_struct *)data, addr, ptep, pte);
+ }
+
+ return ret;
+}
+
+/**
+ * sgx_encl_test_and_clear_young() - Test and reset the accessed bit
+ * @mm: mm_struct that is checked
+ * @page: enclave page to be tested for recent access
+ *
+ * Checks the Access (A) bit from the PTE corresponding to the enclave page and
+ * clears it.
+ *
+ * Return: 1 if the page has been recently accessed and 0 if not.
+ */
+int sgx_encl_test_and_clear_young(struct mm_struct *mm,
+ struct sgx_encl_page *page)
+{
+ unsigned long addr = SGX_ENCL_PAGE_ADDR(page);
+ struct sgx_encl *encl = page->encl;
+ struct vm_area_struct *vma;
+ int ret;
+
+ ret = sgx_encl_find(mm, addr, &vma);
+ if (ret)
+ return 0;
+
+ if (encl != vma->vm_private_data)
+ return 0;
+
+ ret = apply_to_page_range(vma->vm_mm, addr, PAGE_SIZE,
+ sgx_encl_test_and_clear_young_cb, vma->vm_mm);
+ if (ret < 0)
+ return 0;
+
+ return ret;
+}
+
+/**
+ * sgx_encl_reserve_page() - Reserve an enclave page
+ * @encl: an enclave
+ * @addr: a page address
+ *
+ * Load an enclave page and lock the enclave so that the page can be used by
+ * EDBG* and EMOD*.
+ *
+ * Return:
+ * an enclave page on success
+ * -EFAULT if the load fails
+ */
+struct sgx_encl_page *sgx_encl_reserve_page(struct sgx_encl *encl,
+ unsigned long addr)
+{
+ struct sgx_encl_page *entry;
+
+ for ( ; ; ) {
+ mutex_lock(&encl->lock);
+
+ entry = sgx_encl_load_page(encl, addr);
+ if (PTR_ERR(entry) != -EBUSY)
+ break;
+
+ mutex_unlock(&encl->lock);
+ }
+
+ if (IS_ERR(entry))
+ mutex_unlock(&encl->lock);
+
+ return entry;
+}
+
+/**
+ * sgx_alloc_page - allocate a VA page
+ *
+ * Allocates an &sgx_epc_page instance and converts it to a VA page.
+ *
+ * Return:
+ * a &struct sgx_va_page instance,
+ * -errno otherwise
+ */
+struct sgx_epc_page *sgx_alloc_va_page(void)
+{
+ struct sgx_epc_page *epc_page;
+ int ret;
+
+ epc_page = sgx_alloc_page(NULL, true);
+ if (IS_ERR(epc_page))
+ return ERR_CAST(epc_page);
+
+ ret = __epa(sgx_epc_addr(epc_page));
+ if (ret) {
+ WARN_ONCE(1, "EPA returned %d (0x%x)", ret, ret);
+ sgx_free_page(epc_page);
+ return ERR_PTR(-EFAULT);
+ }
+
+ return epc_page;
+}
+
+/**
+ * sgx_alloc_va_slot - allocate a VA slot
+ * @va_page: a &struct sgx_va_page instance
+ *
+ * Allocates a slot from a &struct sgx_va_page instance.
+ *
+ * Return: offset of the slot inside the VA page
+ */
+unsigned int sgx_alloc_va_slot(struct sgx_va_page *va_page)
+{
+ int slot = find_first_zero_bit(va_page->slots, SGX_VA_SLOT_COUNT);
+
+ if (slot < SGX_VA_SLOT_COUNT)
+ set_bit(slot, va_page->slots);
+
+ return slot << 3;
+}
+
+/**
+ * sgx_free_va_slot - free a VA slot
+ * @va_page: a &struct sgx_va_page instance
+ * @offset: offset of the slot inside the VA page
+ *
+ * Frees a slot from a &struct sgx_va_page instance.
+ */
+void sgx_free_va_slot(struct sgx_va_page *va_page, unsigned int offset)
+{
+ clear_bit(offset >> 3, va_page->slots);
+}
+
+/**
+ * sgx_va_page_full - is the VA page full?
+ * @va_page: a &struct sgx_va_page instance
+ *
+ * Return: true if all slots have been taken
+ */
+bool sgx_va_page_full(struct sgx_va_page *va_page)
+{
+ int slot = find_first_zero_bit(va_page->slots, SGX_VA_SLOT_COUNT);
+
+ return slot == SGX_VA_SLOT_COUNT;
+}
diff --git a/arch/x86/kernel/cpu/sgx/encl.h b/arch/x86/kernel/cpu/sgx/encl.h
index 1d1bc5d590ee..44b353aa8866 100644
--- a/arch/x86/kernel/cpu/sgx/encl.h
+++ b/arch/x86/kernel/cpu/sgx/encl.h
@@ -19,6 +19,10 @@
/**
* enum sgx_encl_page_desc - defines bits for an enclave page's descriptor
+ * %SGX_ENCL_PAGE_RECLAIMED: The page is in the process of being
+ * reclaimed.
+ * %SGX_ENCL_PAGE_VA_OFFSET_MASK: Holds the offset in the Version Array
+ * (VA) page for a swapped page.
* %SGX_ENCL_PAGE_ADDR_MASK: Holds the virtual address of the page.
*
* The page address for SECS is zero and is used by the subsystem to recognize
@@ -26,16 +30,23 @@
*/
enum sgx_encl_page_desc {
/* Bits 11:3 are available when the page is not swapped. */
+ SGX_ENCL_PAGE_RECLAIMED = BIT(3),
+ SGX_ENCL_PAGE_VA_OFFSET_MASK = GENMASK_ULL(11, 3),
SGX_ENCL_PAGE_ADDR_MASK = PAGE_MASK,
};
#define SGX_ENCL_PAGE_ADDR(page) \
((page)->desc & SGX_ENCL_PAGE_ADDR_MASK)
+#define SGX_ENCL_PAGE_VA_OFFSET(page) \
+ ((page)->desc & SGX_ENCL_PAGE_VA_OFFSET_MASK)
+#define SGX_ENCL_PAGE_INDEX(page) \
+ PFN_DOWN((page)->desc - (page)->encl->base)
struct sgx_encl_page {
unsigned long desc;
unsigned long vm_max_prot_bits;
struct sgx_epc_page *epc_page;
+ struct sgx_va_page *va_page;
struct sgx_encl *encl;
};
@@ -69,11 +80,20 @@ struct sgx_encl {
unsigned long base;
unsigned long size;
unsigned long ssaframesize;
+ struct list_head va_pages;
struct radix_tree_root page_tree;
struct sgx_encl_page secs;
cpumask_t cpumask;
};
+#define SGX_VA_SLOT_COUNT 512
+
+struct sgx_va_page {
+ struct sgx_epc_page *epc_page;
+ DECLARE_BITMAP(slots, SGX_VA_SLOT_COUNT);
+ struct list_head list;
+};
+
extern const struct vm_operations_struct sgx_vm_ops;
int sgx_encl_find(struct mm_struct *mm, unsigned long addr,
@@ -84,4 +104,24 @@ int sgx_encl_mm_add(struct sgx_encl *encl, struct mm_struct *mm);
int sgx_encl_may_map(struct sgx_encl *encl, unsigned long start,
unsigned long end, unsigned long vm_prot_bits);
+struct sgx_backing {
+ pgoff_t page_index;
+ struct page *contents;
+ struct page *pcmd;
+ unsigned long pcmd_offset;
+};
+
+int sgx_encl_get_backing(struct sgx_encl *encl, unsigned long page_index,
+ struct sgx_backing *backing);
+void sgx_encl_put_backing(struct sgx_backing *backing, bool do_write);
+int sgx_encl_test_and_clear_young(struct mm_struct *mm,
+ struct sgx_encl_page *page);
+struct sgx_encl_page *sgx_encl_reserve_page(struct sgx_encl *encl,
+ unsigned long addr);
+
+struct sgx_epc_page *sgx_alloc_va_page(void);
+unsigned int sgx_alloc_va_slot(struct sgx_va_page *va_page);
+void sgx_free_va_slot(struct sgx_va_page *va_page, unsigned int offset);
+bool sgx_va_page_full(struct sgx_va_page *va_page);
+
#endif /* _X86_ENCL_H */
diff --git a/arch/x86/kernel/cpu/sgx/ioctl.c b/arch/x86/kernel/cpu/sgx/ioctl.c
index 251b7a989606..12e1496f8a8b 100644
--- a/arch/x86/kernel/cpu/sgx/ioctl.c
+++ b/arch/x86/kernel/cpu/sgx/ioctl.c
@@ -19,6 +19,43 @@
/* A per-cpu cache for the last known values of IA32_SGXLEPUBKEYHASHx MSRs. */
static DEFINE_PER_CPU(u64 [4], sgx_lepubkeyhash_cache);
+static struct sgx_va_page *sgx_encl_grow(struct sgx_encl *encl)
+{
+ struct sgx_va_page *va_page = NULL;
+ void *err;
+
+ BUILD_BUG_ON(SGX_VA_SLOT_COUNT !=
+ (SGX_ENCL_PAGE_VA_OFFSET_MASK >> 3) + 1);
+
+ if (!(encl->page_cnt % SGX_VA_SLOT_COUNT)) {
+ va_page = kzalloc(sizeof(*va_page), GFP_KERNEL);
+ if (!va_page)
+ return ERR_PTR(-ENOMEM);
+
+ va_page->epc_page = sgx_alloc_va_page();
+ if (IS_ERR(va_page->epc_page)) {
+ err = ERR_CAST(va_page->epc_page);
+ kfree(va_page);
+ return err;
+ }
+
+ WARN_ON_ONCE(encl->page_cnt % SGX_VA_SLOT_COUNT);
+ }
+ encl->page_cnt++;
+ return va_page;
+}
+
+static void sgx_encl_shrink(struct sgx_encl *encl, struct sgx_va_page *va_page)
+{
+ encl->page_cnt--;
+
+ if (va_page) {
+ sgx_free_page(va_page->epc_page);
+ list_del(&va_page->list);
+ kfree(va_page);
+ }
+}
+
static u32 sgx_calc_ssaframesize(u32 miscselect, u64 xfrm)
{
u32 size_max = PAGE_SIZE;
@@ -114,6 +151,7 @@ static int sgx_encl_create(struct sgx_encl *encl, struct sgx_secs *secs)
{
unsigned long encl_size = secs->size + PAGE_SIZE;
struct sgx_epc_page *secs_epc;
+ struct sgx_va_page *va_page;
unsigned long ssaframesize;
struct sgx_pageinfo pginfo;
struct sgx_secinfo secinfo;
@@ -123,20 +161,29 @@ static int sgx_encl_create(struct sgx_encl *encl, struct sgx_secs *secs)
if (atomic_read(&encl->flags) & SGX_ENCL_CREATED)
return -EINVAL;
+ va_page = sgx_encl_grow(encl);
+ if (IS_ERR(va_page))
+ return PTR_ERR(va_page);
+ else if (va_page)
+ list_add(&va_page->list, &encl->va_pages);
+
ssaframesize = sgx_calc_ssaframesize(secs->miscselect, secs->xfrm);
if (sgx_validate_secs(secs, ssaframesize)) {
pr_debug("invalid SECS\n");
- return -EINVAL;
+ ret = -EINVAL;
+ goto err_out_shrink;
}
backing = shmem_file_setup("SGX backing", encl_size + (encl_size >> 5),
VM_NORESERVE);
- if (IS_ERR(backing))
- return PTR_ERR(backing);
+ if (IS_ERR(backing)) {
+ ret = PTR_ERR(backing);
+ goto err_out_shrink;
+ }
encl->backing = backing;
- secs_epc = sgx_try_alloc_page();
+ secs_epc = sgx_alloc_page(&encl->secs, true);
if (IS_ERR(secs_epc)) {
ret = PTR_ERR(secs_epc);
goto err_out_backing;
@@ -183,6 +230,9 @@ static int sgx_encl_create(struct sgx_encl *encl, struct sgx_secs *secs)
fput(encl->backing);
encl->backing = NULL;
+err_out_shrink:
+ sgx_encl_shrink(encl, va_page);
+
return ret;
}
@@ -319,13 +369,14 @@ static int sgx_encl_add_page(struct sgx_encl *encl, unsigned long src,
{
struct sgx_encl_page *encl_page;
struct sgx_epc_page *epc_page;
+ struct sgx_va_page *va_page;
int ret;
encl_page = sgx_encl_page_alloc(encl, offset, secinfo->flags);
if (IS_ERR(encl_page))
return PTR_ERR(encl_page);
- epc_page = sgx_try_alloc_page();
+ epc_page = sgx_alloc_page(encl_page, true);
if (IS_ERR(epc_page)) {
kfree(encl_page);
return PTR_ERR(epc_page);
@@ -337,9 +388,22 @@ static int sgx_encl_add_page(struct sgx_encl *encl, unsigned long src,
goto err_out_free;
}
+ va_page = sgx_encl_grow(encl);
+ if (IS_ERR(va_page)) {
+ ret = PTR_ERR(va_page);
+ goto err_out_free;
+ }
+
down_read(¤t->mm->mmap_sem);
mutex_lock(&encl->lock);
+ /*
+ * Adding to encl->va_pages must be done under encl->lock. Ditto for
+ * deleting (via sgx_encl_shrink()) in the error path.
+ */
+ if (va_page)
+ list_add(&va_page->list, &encl->va_pages);
+
/*
* Insert prior to EADD in case of OOM. EADD modifies MRENCLAVE, i.e.
* can't be gracefully unwound, while failure on EADD/EXTEND is limited
@@ -370,6 +434,7 @@ static int sgx_encl_add_page(struct sgx_encl *encl, unsigned long src,
goto err_out;
}
+ sgx_mark_page_reclaimable(encl_page->epc_page);
mutex_unlock(&encl->lock);
up_read(¤t->mm->mmap_sem);
return ret;
@@ -379,6 +444,7 @@ static int sgx_encl_add_page(struct sgx_encl *encl, unsigned long src,
PFN_DOWN(encl_page->desc));
err_out_unlock:
+ sgx_encl_shrink(encl, va_page);
mutex_unlock(&encl->lock);
up_read(¤t->mm->mmap_sem);
diff --git a/arch/x86/kernel/cpu/sgx/main.c b/arch/x86/kernel/cpu/sgx/main.c
index 842f9abba1c0..5ce77e554676 100644
--- a/arch/x86/kernel/cpu/sgx/main.c
+++ b/arch/x86/kernel/cpu/sgx/main.c
@@ -23,6 +23,8 @@ static struct sgx_epc_page *__sgx_try_alloc_page(struct sgx_epc_section *section
page = list_first_entry(§ion->page_list, struct sgx_epc_page, list);
list_del_init(&page->list);
+ section->free_cnt--;
+
return page;
}
@@ -54,23 +56,79 @@ struct sgx_epc_page *sgx_try_alloc_page(void)
return ERR_PTR(-ENOMEM);
}
+/**
+ * sgx_alloc_page() - Allocate an EPC page
+ * @owner: the owner of the EPC page
+ * @reclaim: reclaim pages if necessary
+ *
+ * Try to grab a page from the free EPC page list. If there is a free page
+ * available, it is returned to the caller. The @reclaim parameter hints
+ * the EPC memory manager to swap pages when required.
+ *
+ * Return:
+ * a pointer to a &struct sgx_epc_page instance,
+ * -errno on error
+ */
+struct sgx_epc_page *sgx_alloc_page(void *owner, bool reclaim)
+{
+ struct sgx_epc_page *entry;
+
+ for ( ; ; ) {
+ entry = sgx_try_alloc_page();
+ if (!IS_ERR(entry)) {
+ entry->owner = owner;
+ break;
+ }
+
+ if (list_empty(&sgx_active_page_list))
+ return ERR_PTR(-ENOMEM);
+
+ if (!reclaim) {
+ entry = ERR_PTR(-EBUSY);
+ break;
+ }
+
+ if (signal_pending(current)) {
+ entry = ERR_PTR(-ERESTARTSYS);
+ break;
+ }
+
+ sgx_reclaim_pages();
+ schedule();
+ }
+
+ if (sgx_should_reclaim(SGX_NR_LOW_PAGES))
+ wake_up(&ksgxswapd_waitq);
+
+ return entry;
+}
+
/**
* sgx_free_page() - Free an EPC page
* @page: pointer a previously allocated EPC page
*
- * EREMOVE an EPC page and insert it back to the list of free pages.
+ * EREMOVE an EPC page and insert it back to the list of free pages. The page
+ * must not be reclaimable.
*/
void sgx_free_page(struct sgx_epc_page *page)
{
struct sgx_epc_section *section = sgx_epc_section(page);
int ret;
+ /*
+ * Don't take sgx_active_page_list_lock when asserting the page isn't
+ * reclaimable, missing a WARN in the very rare case is preferable to
+ * unnecessarily taking a global lock in the common case.
+ */
+ WARN_ON_ONCE(page->desc & SGX_EPC_PAGE_RECLAIMABLE);
+
ret = __eremove(sgx_epc_addr(page));
if (WARN_ONCE(ret, "EREMOVE returned %d (0x%x)", ret, ret))
return;
spin_lock(§ion->lock);
list_add_tail(&page->list, §ion->page_list);
+ section->free_cnt++;
spin_unlock(§ion->lock);
}
@@ -121,6 +179,7 @@ static bool __init sgx_alloc_epc_section(u64 addr, u64 size,
list_add_tail(&page->list, §ion->unsanitized_page_list);
}
+ section->free_cnt = nr_pages;
return true;
err_out:
diff --git a/arch/x86/kernel/cpu/sgx/reclaim.c b/arch/x86/kernel/cpu/sgx/reclaim.c
index 9e6d3e147aa2..241c39d96f3c 100644
--- a/arch/x86/kernel/cpu/sgx/reclaim.c
+++ b/arch/x86/kernel/cpu/sgx/reclaim.c
@@ -9,10 +9,14 @@
#include <linux/slab.h>
#include <linux/sched/mm.h>
#include <linux/sched/signal.h>
+#include "encl.h"
#include "encls.h"
#include "driver.h"
struct task_struct *ksgxswapd_tsk;
+DECLARE_WAIT_QUEUE_HEAD(ksgxswapd_waitq);
+LIST_HEAD(sgx_active_page_list);
+DEFINE_SPINLOCK(sgx_active_page_list_lock);
static void sgx_sanitize_section(struct sgx_epc_section *section)
{
@@ -66,6 +70,20 @@ static int ksgxswapd(void *p)
WARN(1, "EPC section %d has unsanitized pages.\n", i);
}
+ while (!kthread_should_stop()) {
+ if (try_to_freeze())
+ continue;
+
+ wait_event_freezable(ksgxswapd_waitq,
+ kthread_should_stop() ||
+ sgx_should_reclaim(SGX_NR_HIGH_PAGES));
+
+ if (sgx_should_reclaim(SGX_NR_HIGH_PAGES))
+ sgx_reclaim_pages();
+
+ cond_resched();
+ }
+
return 0;
}
@@ -81,3 +99,360 @@ bool __init sgx_page_reclaimer_init(void)
return true;
}
+
+/**
+ * sgx_mark_page_reclaimable() - Mark a page as reclaimable
+ * @page: EPC page
+ *
+ * Mark a page as reclaimable and add it to the active page list. Pages
+ * are automatically removed from the active list when freed.
+ */
+void sgx_mark_page_reclaimable(struct sgx_epc_page *page)
+{
+ spin_lock(&sgx_active_page_list_lock);
+ page->desc |= SGX_EPC_PAGE_RECLAIMABLE;
+ list_add_tail(&page->list, &sgx_active_page_list);
+ spin_unlock(&sgx_active_page_list_lock);
+}
+
+/**
+ * sgx_unmark_page_reclaimable() - Remove a page from the reclaim list
+ * @page: EPC page
+ *
+ * Clear the reclaimable flag and remove the page from the active page list.
+ *
+ * Return:
+ * 0 on success,
+ * -EBUSY if the page is in the process of being reclaimed
+ */
+int sgx_unmark_page_reclaimable(struct sgx_epc_page *page)
+{
+ /*
+ * Remove the page from the active list if necessary. If the page
+ * is actively being reclaimed, i.e. RECLAIMABLE is set but the
+ * page isn't on the active list, return -EBUSY as we can't free
+ * the page at this time since it is "owned" by the reclaimer.
+ */
+ spin_lock(&sgx_active_page_list_lock);
+ if (page->desc & SGX_EPC_PAGE_RECLAIMABLE) {
+ if (list_empty(&page->list)) {
+ spin_unlock(&sgx_active_page_list_lock);
+ return -EBUSY;
+ }
+ list_del(&page->list);
+ page->desc &= ~SGX_EPC_PAGE_RECLAIMABLE;
+ }
+ spin_unlock(&sgx_active_page_list_lock);
+
+ return 0;
+}
+
+static bool sgx_reclaimer_age(struct sgx_epc_page *epc_page)
+{
+ struct sgx_encl_page *page = epc_page->owner;
+ struct sgx_encl *encl = page->encl;
+ struct sgx_encl_mm *encl_mm;
+ bool ret = true;
+ int idx;
+
+ idx = srcu_read_lock(&encl->srcu);
+
+ list_for_each_entry_rcu(encl_mm, &encl->mm_list, list) {
+ if (!mmget_not_zero(encl_mm->mm))
+ continue;
+
+ down_read(&encl_mm->mm->mmap_sem);
+ ret = !sgx_encl_test_and_clear_young(encl_mm->mm, page);
+ up_read(&encl_mm->mm->mmap_sem);
+
+ mmput_async(encl_mm->mm);
+
+ if (!ret || (atomic_read(&encl->flags) & SGX_ENCL_DEAD))
+ break;
+ }
+
+ srcu_read_unlock(&encl->srcu, idx);
+
+ if (!ret && !(atomic_read(&encl->flags) & SGX_ENCL_DEAD))
+ return false;
+
+ return true;
+}
+
+static void sgx_reclaimer_block(struct sgx_epc_page *epc_page)
+{
+ struct sgx_encl_page *page = epc_page->owner;
+ unsigned long addr = SGX_ENCL_PAGE_ADDR(page);
+ struct sgx_encl *encl = page->encl;
+ struct sgx_encl_mm *encl_mm;
+ struct vm_area_struct *vma;
+ int idx, ret;
+
+ idx = srcu_read_lock(&encl->srcu);
+
+ list_for_each_entry_rcu(encl_mm, &encl->mm_list, list) {
+ if (!mmget_not_zero(encl_mm->mm))
+ continue;
+
+ down_read(&encl_mm->mm->mmap_sem);
+
+ ret = sgx_encl_find(encl_mm->mm, addr, &vma);
+ if (!ret && encl == vma->vm_private_data)
+ zap_vma_ptes(vma, addr, PAGE_SIZE);
+
+ up_read(&encl_mm->mm->mmap_sem);
+
+ mmput_async(encl_mm->mm);
+ }
+
+ srcu_read_unlock(&encl->srcu, idx);
+
+ mutex_lock(&encl->lock);
+
+ if (!(atomic_read(&encl->flags) & SGX_ENCL_DEAD)) {
+ ret = __eblock(sgx_epc_addr(epc_page));
+ if (encls_failed(ret))
+ ENCLS_WARN(ret, "EBLOCK");
+ }
+
+ mutex_unlock(&encl->lock);
+}
+
+static int __sgx_encl_ewb(struct sgx_epc_page *epc_page, void *va_slot,
+ struct sgx_backing *backing)
+{
+ struct sgx_pageinfo pginfo;
+ int ret;
+
+ pginfo.addr = 0;
+ pginfo.secs = 0;
+
+ pginfo.contents = (unsigned long)kmap_atomic(backing->contents);
+ pginfo.metadata = (unsigned long)kmap_atomic(backing->pcmd) +
+ backing->pcmd_offset;
+
+ ret = __ewb(&pginfo, sgx_epc_addr(epc_page), va_slot);
+
+ kunmap_atomic((void *)(unsigned long)(pginfo.metadata -
+ backing->pcmd_offset));
+ kunmap_atomic((void *)(unsigned long)pginfo.contents);
+
+ return ret;
+}
+
+static void sgx_ipi_cb(void *info)
+{
+}
+
+static const cpumask_t *sgx_encl_ewb_cpumask(struct sgx_encl *encl)
+{
+ cpumask_t *cpumask = &encl->cpumask;
+ struct sgx_encl_mm *encl_mm;
+ int idx;
+
+ cpumask_clear(cpumask);
+
+ idx = srcu_read_lock(&encl->srcu);
+
+ list_for_each_entry_rcu(encl_mm, &encl->mm_list, list) {
+ if (!mmget_not_zero(encl_mm->mm))
+ continue;
+
+ cpumask_or(cpumask, cpumask, mm_cpumask(encl_mm->mm));
+
+ mmput_async(encl_mm->mm);
+ }
+
+ srcu_read_unlock(&encl->srcu, idx);
+
+ return cpumask;
+}
+
+static void sgx_encl_ewb(struct sgx_epc_page *epc_page,
+ struct sgx_backing *backing)
+{
+ struct sgx_encl_page *encl_page = epc_page->owner;
+ struct sgx_encl *encl = encl_page->encl;
+ struct sgx_va_page *va_page;
+ unsigned int va_offset;
+ void *va_slot;
+ int ret;
+
+ encl_page->desc &= ~SGX_ENCL_PAGE_RECLAIMED;
+
+ va_page = list_first_entry(&encl->va_pages, struct sgx_va_page,
+ list);
+ va_offset = sgx_alloc_va_slot(va_page);
+ va_slot = sgx_epc_addr(va_page->epc_page) + va_offset;
+ if (sgx_va_page_full(va_page))
+ list_move_tail(&va_page->list, &encl->va_pages);
+
+ ret = __sgx_encl_ewb(epc_page, va_slot, backing);
+ if (ret == SGX_NOT_TRACKED) {
+ ret = __etrack(sgx_epc_addr(encl->secs.epc_page));
+ if (ret) {
+ if (encls_failed(ret))
+ ENCLS_WARN(ret, "ETRACK");
+ }
+
+ ret = __sgx_encl_ewb(epc_page, va_slot, backing);
+ if (ret == SGX_NOT_TRACKED) {
+ /*
+ * Slow path, send IPIs to kick cpus out of the
+ * enclave. Note, it's imperative that the cpu
+ * mask is generated *after* ETRACK, else we'll
+ * miss cpus that entered the enclave between
+ * generating the mask and incrementing epoch.
+ */
+ on_each_cpu_mask(sgx_encl_ewb_cpumask(encl),
+ sgx_ipi_cb, NULL, 1);
+ ret = __sgx_encl_ewb(epc_page, va_slot, backing);
+ }
+ }
+
+ if (ret) {
+ if (encls_failed(ret))
+ ENCLS_WARN(ret, "EWB");
+
+ sgx_free_va_slot(va_page, va_offset);
+ } else {
+ encl_page->desc |= va_offset;
+ encl_page->va_page = va_page;
+ }
+}
+
+static void sgx_reclaimer_write(struct sgx_epc_page *epc_page,
+ struct sgx_backing *backing)
+{
+ struct sgx_encl_page *encl_page = epc_page->owner;
+ struct sgx_encl *encl = encl_page->encl;
+ struct sgx_backing secs_backing;
+ int ret;
+
+ mutex_lock(&encl->lock);
+
+ if (atomic_read(&encl->flags) & SGX_ENCL_DEAD) {
+ ret = __eremove(sgx_epc_addr(epc_page));
+ WARN(ret, "EREMOVE returned %d\n", ret);
+ } else {
+ sgx_encl_ewb(epc_page, backing);
+ }
+
+ encl_page->epc_page = NULL;
+ encl->secs_child_cnt--;
+
+ if (!encl->secs_child_cnt) {
+ if (atomic_read(&encl->flags) & SGX_ENCL_DEAD) {
+ sgx_free_page(encl->secs.epc_page);
+ encl->secs.epc_page = NULL;
+ } else if (atomic_read(&encl->flags) & SGX_ENCL_INITIALIZED) {
+ ret = sgx_encl_get_backing(encl, PFN_DOWN(encl->size),
+ &secs_backing);
+ if (ret)
+ goto out;
+
+ sgx_encl_ewb(encl->secs.epc_page, &secs_backing);
+
+ sgx_free_page(encl->secs.epc_page);
+ encl->secs.epc_page = NULL;
+
+ sgx_encl_put_backing(&secs_backing, true);
+ }
+ }
+
+out:
+ mutex_unlock(&encl->lock);
+}
+
+/**
+ * sgx_reclaim_pages() - Reclaim EPC pages from the consumers
+ *
+ * Take a fixed number of pages from the head of the active page pool and
+ * reclaim them to the enclave's private shmem files. Skip the pages, which
+ * have been accessed since the last scan. Move those pages to the tail of
+ * active page pool so that the pages get scanned in LRU like fashion.
+ */
+void sgx_reclaim_pages(void)
+{
+ struct sgx_epc_page *chunk[SGX_NR_TO_SCAN];
+ struct sgx_backing backing[SGX_NR_TO_SCAN];
+ struct sgx_epc_section *section;
+ struct sgx_encl_page *encl_page;
+ struct sgx_epc_page *epc_page;
+ int cnt = 0;
+ int ret;
+ int i;
+
+ spin_lock(&sgx_active_page_list_lock);
+ for (i = 0; i < SGX_NR_TO_SCAN; i++) {
+ if (list_empty(&sgx_active_page_list))
+ break;
+
+ epc_page = list_first_entry(&sgx_active_page_list,
+ struct sgx_epc_page, list);
+ list_del_init(&epc_page->list);
+ encl_page = epc_page->owner;
+
+ if (kref_get_unless_zero(&encl_page->encl->refcount) != 0)
+ chunk[cnt++] = epc_page;
+ else
+ /* The owner is freeing the page. No need to add the
+ * page back to the list of reclaimable pages.
+ */
+ epc_page->desc &= ~SGX_EPC_PAGE_RECLAIMABLE;
+ }
+ spin_unlock(&sgx_active_page_list_lock);
+
+ for (i = 0; i < cnt; i++) {
+ epc_page = chunk[i];
+ encl_page = epc_page->owner;
+
+ if (!sgx_reclaimer_age(epc_page))
+ goto skip;
+
+ ret = sgx_encl_get_backing(encl_page->encl,
+ SGX_ENCL_PAGE_INDEX(encl_page),
+ &backing[i]);
+ if (ret)
+ goto skip;
+
+ mutex_lock(&encl_page->encl->lock);
+ encl_page->desc |= SGX_ENCL_PAGE_RECLAIMED;
+ mutex_unlock(&encl_page->encl->lock);
+ continue;
+
+skip:
+ kref_put(&encl_page->encl->refcount, sgx_encl_release);
+
+ spin_lock(&sgx_active_page_list_lock);
+ list_add_tail(&epc_page->list, &sgx_active_page_list);
+ spin_unlock(&sgx_active_page_list_lock);
+
+ chunk[i] = NULL;
+ }
+
+ for (i = 0; i < cnt; i++) {
+ epc_page = chunk[i];
+ if (epc_page)
+ sgx_reclaimer_block(epc_page);
+ }
+
+ for (i = 0; i < cnt; i++) {
+ epc_page = chunk[i];
+ if (!epc_page)
+ continue;
+
+ encl_page = epc_page->owner;
+ sgx_reclaimer_write(epc_page, &backing[i]);
+ sgx_encl_put_backing(&backing[i], true);
+
+ kref_put(&encl_page->encl->refcount, sgx_encl_release);
+ epc_page->desc &= ~SGX_EPC_PAGE_RECLAIMABLE;
+
+ section = sgx_epc_section(epc_page);
+ spin_lock(§ion->lock);
+ list_add_tail(&epc_page->list, §ion->page_list);
+ section->free_cnt++;
+ spin_unlock(§ion->lock);
+ }
+}
diff --git a/arch/x86/kernel/cpu/sgx/sgx.h b/arch/x86/kernel/cpu/sgx/sgx.h
index aa85f85412d8..0c481e6f2c95 100644
--- a/arch/x86/kernel/cpu/sgx/sgx.h
+++ b/arch/x86/kernel/cpu/sgx/sgx.h
@@ -15,6 +15,7 @@
struct sgx_epc_page {
unsigned long desc;
+ struct sgx_encl_page *owner;
struct list_head list;
};
@@ -29,6 +30,7 @@ struct sgx_epc_page {
struct sgx_epc_section {
unsigned long pa;
void *va;
+ unsigned long free_cnt;
struct list_head page_list;
struct list_head unsanitized_page_list;
spinlock_t lock;
@@ -40,9 +42,14 @@ struct sgx_epc_section {
* physical memory. The existing and near-future
* hardware defines at most eight sections, hence
* three bits to hold a section.
+ * %SGX_EPC_PAGE_RECLAIMABLE: The page has been been marked as reclaimable.
+ * Pages need to be colored this way because a page
+ * can be out of the active page list in the
+ * process of being swapped out.
*/
enum sgx_epc_page_desc {
SGX_EPC_SECTION_MASK = GENMASK_ULL(3, 0),
+ SGX_EPC_PAGE_RECLAIMABLE = BIT(4),
/* bits 12-63 are reserved for the physical page address of the page */
};
@@ -62,12 +69,40 @@ static inline void *sgx_epc_addr(struct sgx_epc_page *page)
return section->va + (page->desc & PAGE_MASK) - section->pa;
}
+#define SGX_NR_TO_SCAN 16
+#define SGX_NR_LOW_PAGES 32
+#define SGX_NR_HIGH_PAGES 64
+
extern int sgx_nr_epc_sections;
extern struct task_struct *ksgxswapd_tsk;
+extern struct wait_queue_head(ksgxswapd_waitq);
+extern struct list_head sgx_active_page_list;
+extern spinlock_t sgx_active_page_list_lock;
+
+static inline unsigned long sgx_nr_free_pages(void)
+{
+ unsigned long cnt = 0;
+ int i;
+
+ for (i = 0; i < sgx_nr_epc_sections; i++)
+ cnt += sgx_epc_sections[i].free_cnt;
+
+ return cnt;
+}
+
+static inline bool sgx_should_reclaim(unsigned long watermark)
+{
+ return sgx_nr_free_pages() < watermark &&
+ !list_empty(&sgx_active_page_list);
+}
bool __init sgx_page_reclaimer_init(void);
+void sgx_mark_page_reclaimable(struct sgx_epc_page *page);
+int sgx_unmark_page_reclaimable(struct sgx_epc_page *page);
+void sgx_reclaim_pages(void);
struct sgx_epc_page *sgx_try_alloc_page(void);
+struct sgx_epc_page *sgx_alloc_page(void *owner, bool reclaim);
void sgx_free_page(struct sgx_epc_page *page);
#endif /* _X86_SGX_H */
--
2.25.0
From: Sean Christopherson <[email protected]>
The basic concept and implementation is very similar to the kernel's
exception fixup mechanism. The key differences are that the kernel
handler is hardcoded and the fixup entry addresses are relative to
the overall table as opposed to individual entries.
Hardcoding the kernel handler avoids the need to figure out how to
get userspace code to point at a kernel function. Given that the
expected usage is to propagate information to userspace, dumping all
fault information into registers is likely the desired behavior for
the vast majority of yet-to-be-created functions. Use registers
DI, SI and DX to communicate fault information, which follows Linux's
ABI for register consumption and hopefully avoids conflict with
hardware features that might leverage the fixup capabilities, e.g.
register usage for SGX instructions was at least partially designed
with calling conventions in mind.
Making fixup addresses relative to the overall table allows the table
to be stripped from the final vDSO image (it's a kernel construct)
without complicating the offset logic, e.g. entry-relative addressing
would also need to account for the table's location relative to the
image.
Regarding stripping the table, modify vdso2c to extract the table from
the raw, a.k.a. unstripped, data and dump it as a standalone byte array
in the resulting .c file. The original base of the table, its length
and a pointer to the byte array are captured in struct vdso_image.
Alternatively, the table could be dumped directly into the struct,
but because the number of entries can vary per image, that would
require either hardcoding a max sized table into the struct definition
or defining the table as a flexible length array. The flexible length
array approach has zero benefits, e.g. the base/size are still needed,
and prevents reusing the extraction code, while hardcoding the max size
adds ongoing maintenance just to avoid exporting the explicit size.
The immediate use case is for Intel Software Guard Extensions (SGX).
SGX introduces a new CPL3-only "enclave" mode that runs as a sort of
black box shared object that is hosted by an untrusted "normal" CPl3
process.
Entering an enclave can only be done through SGX-specific instructions,
EENTER and ERESUME, and is a non-trivial process. Because of the
complexity of transitioning to/from an enclave, the vast majority of
enclaves are expected to utilize a library to handle the actual
transitions. This is roughly analogous to how e.g. libc implementations
are used by most applications.
Another crucial characteristic of SGX enclaves is that they can generate
exceptions as part of their normal (at least as "normal" as SGX can be)
operation that need to be handled *in* the enclave and/or are unique
to SGX.
And because they are essentially fancy shared objects, a process can
host any number of enclaves, each of which can execute multiple threads
simultaneously.
Putting everything together, userspace enclaves will utilize a library
that must be prepared to handle any and (almost) all exceptions any time
at least one thread may be executing in an enclave. Leveraging signals
to handle the enclave exceptions is unpleasant, to put it mildly, e.g.
the SGX library must constantly (un)register its signal handler based
on whether or not at least one thread is executing in an enclave, and
filter and forward exceptions that aren't related to its enclaves. This
becomes particularly nasty when using multiple levels of libraries that
register signal handlers, e.g. running an enclave via cgo inside of the
Go runtime.
Enabling exception fixup in vDSO allows the kernel to provide a vDSO
function that wraps the low-level transitions to/from the enclave, i.e.
the EENTER and ERESUME instructions. The vDSO function can intercept
exceptions that would otherwise generate a signal and return the fault
information directly to its caller, thus avoiding the need to juggle
signal handlers.
Note that unlike the kernel's _ASM_EXTABLE_HANDLE implementation, the
'C' version of _ASM_VDSO_EXTABLE_HANDLE doesn't use a pre-compiled
assembly macro. Duplicating four lines of code is simpler than adding
the necessary infrastructure to generate pre-compiled assembly and the
intended benefit of massaging GCC's inlining algorithm is unlikely to
realized in the vDSO any time soon, if ever.
Suggested-by: Andy Lutomirski <[email protected]>
Signed-off-by: Sean Christopherson <[email protected]>
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
arch/x86/entry/vdso/Makefile | 6 +--
arch/x86/entry/vdso/extable.c | 46 +++++++++++++++++++++
arch/x86/entry/vdso/extable.h | 29 ++++++++++++++
arch/x86/entry/vdso/vdso-layout.lds.S | 9 ++++-
arch/x86/entry/vdso/vdso2c.h | 58 +++++++++++++++++++++++----
arch/x86/include/asm/vdso.h | 5 +++
6 files changed, 141 insertions(+), 12 deletions(-)
create mode 100644 arch/x86/entry/vdso/extable.c
create mode 100644 arch/x86/entry/vdso/extable.h
diff --git a/arch/x86/entry/vdso/Makefile b/arch/x86/entry/vdso/Makefile
index 433a1259f61d..657e01d34d02 100644
--- a/arch/x86/entry/vdso/Makefile
+++ b/arch/x86/entry/vdso/Makefile
@@ -26,7 +26,7 @@ VDSO32-$(CONFIG_IA32_EMULATION) := y
vobjs-y := vdso-note.o vclock_gettime.o vgetcpu.o
# files to link into kernel
-obj-y += vma.o
+obj-y += vma.o extable.o
OBJECT_FILES_NON_STANDARD_vma.o := n
# vDSO images to build
@@ -120,8 +120,8 @@ $(obj)/%-x32.o: $(obj)/%.o FORCE
targets += vdsox32.lds $(vobjx32s-y)
-$(obj)/%.so: OBJCOPYFLAGS := -S
-$(obj)/%.so: $(obj)/%.so.dbg FORCE
+$(obj)/%.so: OBJCOPYFLAGS := -S --remove-section __ex_table
+$(obj)/%.so: $(obj)/%.so.dbg
$(call if_changed,objcopy)
$(obj)/vdsox32.so.dbg: $(obj)/vdsox32.lds $(vobjx32s) FORCE
diff --git a/arch/x86/entry/vdso/extable.c b/arch/x86/entry/vdso/extable.c
new file mode 100644
index 000000000000..afcf5b65beef
--- /dev/null
+++ b/arch/x86/entry/vdso/extable.c
@@ -0,0 +1,46 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <linux/err.h>
+#include <linux/mm.h>
+#include <asm/current.h>
+#include <asm/traps.h>
+#include <asm/vdso.h>
+
+struct vdso_exception_table_entry {
+ int insn, fixup;
+};
+
+bool fixup_vdso_exception(struct pt_regs *regs, int trapnr,
+ unsigned long error_code, unsigned long fault_addr)
+{
+ const struct vdso_image *image = current->mm->context.vdso_image;
+ const struct vdso_exception_table_entry *extable;
+ unsigned int nr_entries, i;
+ unsigned long base;
+
+ /*
+ * Do not attempt to fixup #DB or #BP. It's impossible to identify
+ * whether or not a #DB/#BP originated from within an SGX enclave and
+ * SGX enclaves are currently the only use case for vDSO fixup.
+ */
+ if (trapnr == X86_TRAP_DB || trapnr == X86_TRAP_BP)
+ return false;
+
+ if (!current->mm->context.vdso)
+ return false;
+
+ base = (unsigned long)current->mm->context.vdso + image->extable_base;
+ nr_entries = image->extable_len / (sizeof(*extable));
+ extable = image->extable;
+
+ for (i = 0; i < nr_entries; i++) {
+ if (regs->ip == base + extable[i].insn) {
+ regs->ip = base + extable[i].fixup;
+ regs->di = trapnr;
+ regs->si = error_code;
+ regs->dx = fault_addr;
+ return true;
+ }
+ }
+
+ return false;
+}
diff --git a/arch/x86/entry/vdso/extable.h b/arch/x86/entry/vdso/extable.h
new file mode 100644
index 000000000000..aafdac396948
--- /dev/null
+++ b/arch/x86/entry/vdso/extable.h
@@ -0,0 +1,29 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef __VDSO_EXTABLE_H
+#define __VDSO_EXTABLE_H
+
+/*
+ * Inject exception fixup for vDSO code. Unlike normal exception fixup,
+ * vDSO uses a dedicated handler the addresses are relative to the overall
+ * exception table, not each individual entry.
+ */
+#ifdef __ASSEMBLY__
+#define _ASM_VDSO_EXTABLE_HANDLE(from, to) \
+ ASM_VDSO_EXTABLE_HANDLE from to
+
+.macro ASM_VDSO_EXTABLE_HANDLE from:req to:req
+ .pushsection __ex_table, "a"
+ .long (\from) - __ex_table
+ .long (\to) - __ex_table
+ .popsection
+.endm
+#else
+#define _ASM_VDSO_EXTABLE_HANDLE(from, to) \
+ ".pushsection __ex_table, \"a\"\n" \
+ ".long (" #from ") - __ex_table\n" \
+ ".long (" #to ") - __ex_table\n" \
+ ".popsection\n"
+#endif
+
+#endif /* __VDSO_EXTABLE_H */
+
diff --git a/arch/x86/entry/vdso/vdso-layout.lds.S b/arch/x86/entry/vdso/vdso-layout.lds.S
index ea7e0155c604..e9994ee62fdd 100644
--- a/arch/x86/entry/vdso/vdso-layout.lds.S
+++ b/arch/x86/entry/vdso/vdso-layout.lds.S
@@ -68,11 +68,18 @@ SECTIONS
* stuff that isn't used at runtime in between.
*/
- .text : { *(.text*) } :text =0x90909090,
+ .text : {
+ *(.text*)
+ *(.fixup)
+ } :text =0x90909090,
+
+
.altinstructions : { *(.altinstructions) } :text
.altinstr_replacement : { *(.altinstr_replacement) } :text
+ __ex_table : { *(__ex_table) } :text
+
/DISCARD/ : {
*(.discard)
*(.discard.*)
diff --git a/arch/x86/entry/vdso/vdso2c.h b/arch/x86/entry/vdso/vdso2c.h
index a20b134de2a8..04d04e46c98c 100644
--- a/arch/x86/entry/vdso/vdso2c.h
+++ b/arch/x86/entry/vdso/vdso2c.h
@@ -5,6 +5,41 @@
* are built for 32-bit userspace.
*/
+static void BITSFUNC(copy)(FILE *outfile, const unsigned char *data, size_t len)
+{
+ size_t i;
+
+ for (i = 0; i < len; i++) {
+ if (i % 10 == 0)
+ fprintf(outfile, "\n\t");
+ fprintf(outfile, "0x%02X, ", (int)(data)[i]);
+ }
+}
+
+
+/*
+ * Extract a section from the input data into a standalone blob. Used to
+ * capture kernel-only data that needs to persist indefinitely, e.g. the
+ * exception fixup tables, but only in the kernel, i.e. the section can
+ * be stripped from the final vDSO image.
+ */
+static void BITSFUNC(extract)(const unsigned char *data, size_t data_len,
+ FILE *outfile, ELF(Shdr) *sec, const char *name)
+{
+ unsigned long offset;
+ size_t len;
+
+ offset = (unsigned long)GET_LE(&sec->sh_offset);
+ len = (size_t)GET_LE(&sec->sh_size);
+
+ if (offset + len > data_len)
+ fail("section to extract overruns input data");
+
+ fprintf(outfile, "static const unsigned char %s[%lu] = {", name, len);
+ BITSFUNC(copy)(outfile, data + offset, len);
+ fprintf(outfile, "\n};\n\n");
+}
+
static void BITSFUNC(go)(void *raw_addr, size_t raw_len,
void *stripped_addr, size_t stripped_len,
FILE *outfile, const char *image_name)
@@ -14,9 +49,8 @@ static void BITSFUNC(go)(void *raw_addr, size_t raw_len,
unsigned long mapping_size;
ELF(Ehdr) *hdr = (ELF(Ehdr) *)raw_addr;
int i;
- unsigned long j;
ELF(Shdr) *symtab_hdr = NULL, *strtab_hdr, *secstrings_hdr,
- *alt_sec = NULL;
+ *alt_sec = NULL, *extable_sec = NULL;
ELF(Dyn) *dyn = 0, *dyn_end = 0;
const char *secstrings;
INT_BITS syms[NSYMS] = {};
@@ -78,6 +112,8 @@ static void BITSFUNC(go)(void *raw_addr, size_t raw_len,
if (!strcmp(secstrings + GET_LE(&sh->sh_name),
".altinstructions"))
alt_sec = sh;
+ if (!strcmp(secstrings + GET_LE(&sh->sh_name), "__ex_table"))
+ extable_sec = sh;
}
if (!symtab_hdr)
@@ -150,13 +186,11 @@ static void BITSFUNC(go)(void *raw_addr, size_t raw_len,
fprintf(outfile,
"static unsigned char raw_data[%lu] __ro_after_init __aligned(PAGE_SIZE) = {",
mapping_size);
- for (j = 0; j < stripped_len; j++) {
- if (j % 10 == 0)
- fprintf(outfile, "\n\t");
- fprintf(outfile, "0x%02X, ",
- (int)((unsigned char *)stripped_addr)[j]);
- }
+ BITSFUNC(copy)(outfile, stripped_addr, stripped_len);
fprintf(outfile, "\n};\n\n");
+ if (extable_sec)
+ BITSFUNC(extract)(raw_addr, raw_len, outfile,
+ extable_sec, "extable");
fprintf(outfile, "const struct vdso_image %s = {\n", image_name);
fprintf(outfile, "\t.data = raw_data,\n");
@@ -167,6 +201,14 @@ static void BITSFUNC(go)(void *raw_addr, size_t raw_len,
fprintf(outfile, "\t.alt_len = %lu,\n",
(unsigned long)GET_LE(&alt_sec->sh_size));
}
+ if (extable_sec) {
+ fprintf(outfile, "\t.extable_base = %lu,\n",
+ (unsigned long)GET_LE(&extable_sec->sh_offset));
+ fprintf(outfile, "\t.extable_len = %lu,\n",
+ (unsigned long)GET_LE(&extable_sec->sh_size));
+ fprintf(outfile, "\t.extable = extable,\n");
+ }
+
for (i = 0; i < NSYMS; i++) {
if (required_syms[i].export && syms[i])
fprintf(outfile, "\t.sym_%s = %" PRIi64 ",\n",
diff --git a/arch/x86/include/asm/vdso.h b/arch/x86/include/asm/vdso.h
index bbcdc7b8f963..b5d23470f56b 100644
--- a/arch/x86/include/asm/vdso.h
+++ b/arch/x86/include/asm/vdso.h
@@ -15,6 +15,8 @@ struct vdso_image {
unsigned long size; /* Always a multiple of PAGE_SIZE */
unsigned long alt, alt_len;
+ unsigned long extable_base, extable_len;
+ const void *extable;
long sym_vvar_start; /* Negative offset to the vvar area */
@@ -45,6 +47,9 @@ extern void __init init_vdso_image(const struct vdso_image *image);
extern int map_vdso_once(const struct vdso_image *image, unsigned long addr);
+extern bool fixup_vdso_exception(struct pt_regs *regs, int trapnr,
+ unsigned long error_code,
+ unsigned long fault_addr);
#endif /* __ASSEMBLER__ */
#endif /* _ASM_X86_VDSO_H */
--
2.25.0
From: Sean Christopherson <[email protected]>
Add helper function to sanitize error code to prepare for vDSO exception
fixup, which will expose the error code to userspace and runs before
set_signal_archinfo(), i.e. suppresses the signal when fixup is successful.
Signed-off-by: Sean Christopherson <[email protected]>
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
arch/x86/mm/fault.c | 24 +++++++++++++++++-------
1 file changed, 17 insertions(+), 7 deletions(-)
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index dee9504cde79..6b662d272af6 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -682,6 +682,18 @@ pgtable_bad(struct pt_regs *regs, unsigned long error_code,
oops_end(flags, regs, sig);
}
+static void sanitize_error_code(unsigned long address,
+ unsigned long *error_code)
+{
+ /*
+ * To avoid leaking information about the kernel page
+ * table layout, pretend that user-mode accesses to
+ * kernel addresses are always protection faults.
+ */
+ if (address >= TASK_SIZE_MAX)
+ *error_code |= X86_PF_PROT;
+}
+
static void set_signal_archinfo(unsigned long address,
unsigned long error_code)
{
@@ -738,6 +750,8 @@ no_context(struct pt_regs *regs, unsigned long error_code,
* faulting through the emulate_vsyscall() logic.
*/
if (current->thread.sig_on_uaccess_err && signal) {
+ sanitize_error_code(address, &error_code);
+
set_signal_archinfo(address, error_code);
/* XXX: hwpoison faults will set the wrong code. */
@@ -886,13 +900,7 @@ __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,
if (is_errata100(regs, address))
return;
- /*
- * To avoid leaking information about the kernel page table
- * layout, pretend that user-mode accesses to kernel addresses
- * are always protection faults.
- */
- if (address >= TASK_SIZE_MAX)
- error_code |= X86_PF_PROT;
+ sanitize_error_code(address, &error_code);
if (likely(show_unhandled_signals))
show_signal_msg(regs, error_code, address, tsk);
@@ -1009,6 +1017,8 @@ do_sigbus(struct pt_regs *regs, unsigned long error_code, unsigned long address,
if (is_prefetch(regs, error_code, address))
return;
+ sanitize_error_code(address, &error_code);
+
set_signal_archinfo(address, error_code);
#ifdef CONFIG_MEMORY_FAILURE
--
2.25.0
Expand the selftest by invoking the enclave by using
__vdso_sgx_enter_enclave() in addition to direct ENCLS[EENTER].
Cc: [email protected]
Signed-off-by: Jarkko Sakkinen <[email protected]>
---
tools/testing/selftests/x86/sgx/main.c | 132 +++++++++++++++++++++
tools/testing/selftests/x86/sgx/sgx_call.S | 43 +++++++
tools/testing/selftests/x86/sgx/sgx_call.h | 3 +
3 files changed, 178 insertions(+)
diff --git a/tools/testing/selftests/x86/sgx/main.c b/tools/testing/selftests/x86/sgx/main.c
index 48ed5fdfb3cb..d97cc3cf0093 100644
--- a/tools/testing/selftests/x86/sgx/main.c
+++ b/tools/testing/selftests/x86/sgx/main.c
@@ -21,6 +21,109 @@
#define PAGE_SIZE 4096
static const uint64_t MAGIC = 0x1122334455667788ULL;
+void *eenter;
+
+struct vdso_symtab {
+ Elf64_Sym *elf_symtab;
+ const char *elf_symstrtab;
+ Elf64_Word *elf_hashtab;
+};
+
+static void *vdso_get_base_addr(char *envp[])
+{
+ Elf64_auxv_t *auxv;
+ int i;
+
+ for (i = 0; envp[i]; i++)
+ ;
+
+ auxv = (Elf64_auxv_t *)&envp[i + 1];
+
+ for (i = 0; auxv[i].a_type != AT_NULL; i++) {
+ if (auxv[i].a_type == AT_SYSINFO_EHDR)
+ return (void *)auxv[i].a_un.a_val;
+ }
+
+ return NULL;
+}
+
+static Elf64_Dyn *vdso_get_dyntab(void *addr)
+{
+ Elf64_Ehdr *ehdr = addr;
+ Elf64_Phdr *phdrtab = addr + ehdr->e_phoff;
+ int i;
+
+ for (i = 0; i < ehdr->e_phnum; i++)
+ if (phdrtab[i].p_type == PT_DYNAMIC)
+ return addr + phdrtab[i].p_offset;
+
+ return NULL;
+}
+
+static void *vdso_get_dyn(void *addr, Elf64_Dyn *dyntab, Elf64_Sxword tag)
+{
+ int i;
+
+ for (i = 0; dyntab[i].d_tag != DT_NULL; i++)
+ if (dyntab[i].d_tag == tag)
+ return addr + dyntab[i].d_un.d_ptr;
+
+ return NULL;
+}
+
+static bool vdso_get_symtab(void *addr, struct vdso_symtab *symtab)
+{
+ Elf64_Dyn *dyntab = vdso_get_dyntab(addr);
+
+ symtab->elf_symtab = vdso_get_dyn(addr, dyntab, DT_SYMTAB);
+ if (!symtab->elf_symtab)
+ return false;
+
+ symtab->elf_symstrtab = vdso_get_dyn(addr, dyntab, DT_STRTAB);
+ if (!symtab->elf_symstrtab)
+ return false;
+
+ symtab->elf_hashtab = vdso_get_dyn(addr, dyntab, DT_HASH);
+ if (!symtab->elf_hashtab)
+ return false;
+
+ return true;
+}
+
+static unsigned long elf_sym_hash(const char *name)
+{
+ unsigned long h = 0, high;
+
+ while (*name) {
+ h = (h << 4) + *name++;
+ high = h & 0xf0000000;
+
+ if (high)
+ h ^= high >> 24;
+
+ h &= ~high;
+ }
+
+ return h;
+}
+
+static Elf64_Sym *vdso_symtab_get(struct vdso_symtab *symtab, const char *name)
+{
+ Elf64_Word bucketnum = symtab->elf_hashtab[0];
+ Elf64_Word *buckettab = &symtab->elf_hashtab[2];
+ Elf64_Word *chaintab = &symtab->elf_hashtab[2 + bucketnum];
+ Elf64_Sym *sym;
+ Elf64_Word i;
+
+ for (i = buckettab[elf_sym_hash(name) % bucketnum]; i != STN_UNDEF;
+ i = chaintab[i]) {
+ sym = &symtab->elf_symtab[i];
+ if (!strcmp(name, &symtab->elf_symstrtab[sym->st_name]))
+ return sym;
+ }
+
+ return NULL;
+}
static bool encl_create(int dev_fd, unsigned long bin_size,
struct sgx_secs *secs)
@@ -218,10 +321,14 @@ bool load_sigstruct(const char *path, void *sigstruct)
int main(int argc, char *argv[], char *envp[])
{
+ struct sgx_enclave_exception exception;
struct sgx_sigstruct sigstruct;
+ struct vdso_symtab symtab;
+ Elf64_Sym *eenter_sym;
struct sgx_secs secs;
uint64_t result = 0;
off_t bin_size;
+ void *addr;
void *bin;
if (!encl_data_map("encl.bin", &bin, &bin_size))
@@ -243,5 +350,30 @@ int main(int argc, char *argv[], char *envp[])
printf("Output: 0x%lx\n", result);
+ memset(&exception, 0, sizeof(exception));
+
+ addr = vdso_get_base_addr(envp);
+ if (!addr)
+ exit(1);
+
+ if (!vdso_get_symtab(addr, &symtab))
+ exit(1);
+
+ eenter_sym = vdso_symtab_get(&symtab, "__vdso_sgx_enter_enclave");
+ if (!eenter_sym)
+ exit(1);
+ eenter = addr + eenter_sym->st_value;
+
+ printf("Input: 0x%lx\n", MAGIC);
+
+ sgx_call_vdso((void *)&MAGIC, &result, 0, NULL, NULL, NULL,
+ (void *)secs.base, &exception, NULL);
+ if (result != MAGIC) {
+ fprintf(stderr, "0x%lx != 0x%lx\n", result, MAGIC);
+ exit(1);
+ }
+
+ printf("Output: 0x%lx\n", result);
+
exit(0);
}
diff --git a/tools/testing/selftests/x86/sgx/sgx_call.S b/tools/testing/selftests/x86/sgx/sgx_call.S
index ca4c7893f9d9..e71f44f7a995 100644
--- a/tools/testing/selftests/x86/sgx/sgx_call.S
+++ b/tools/testing/selftests/x86/sgx/sgx_call.S
@@ -21,3 +21,46 @@ sgx_async_exit:
ENCLU
pop %rbx
ret
+
+ .global sgx_call_vdso
+sgx_call_vdso:
+ .cfi_startproc
+ push %r15
+ .cfi_adjust_cfa_offset 8
+ .cfi_rel_offset %r15, 0
+ push %r14
+ .cfi_adjust_cfa_offset 8
+ .cfi_rel_offset %r14, 0
+ push %r13
+ .cfi_adjust_cfa_offset 8
+ .cfi_rel_offset %r13, 0
+ push %r12
+ .cfi_adjust_cfa_offset 8
+ .cfi_rel_offset %r12, 0
+ push %rbx
+ .cfi_adjust_cfa_offset 8
+ .cfi_rel_offset %rbx, 0
+ push $0
+ .cfi_adjust_cfa_offset 8
+ push 0x48(%rsp)
+ .cfi_adjust_cfa_offset 8
+ push 0x48(%rsp)
+ .cfi_adjust_cfa_offset 8
+ push 0x48(%rsp)
+ .cfi_adjust_cfa_offset 8
+ mov $2, %eax
+ call *eenter(%rip)
+ add $0x20, %rsp
+ .cfi_adjust_cfa_offset -0x20
+ pop %rbx
+ .cfi_adjust_cfa_offset -8
+ pop %r12
+ .cfi_adjust_cfa_offset -8
+ pop %r13
+ .cfi_adjust_cfa_offset -8
+ pop %r14
+ .cfi_adjust_cfa_offset -8
+ pop %r15
+ .cfi_adjust_cfa_offset -8
+ ret
+ .cfi_endproc
diff --git a/tools/testing/selftests/x86/sgx/sgx_call.h b/tools/testing/selftests/x86/sgx/sgx_call.h
index bf72068ada23..a4072c5ecce7 100644
--- a/tools/testing/selftests/x86/sgx/sgx_call.h
+++ b/tools/testing/selftests/x86/sgx/sgx_call.h
@@ -8,4 +8,7 @@
void sgx_call_eenter(void *rdi, void *rsi, void *entry);
+int sgx_call_vdso(void *rdi, void *rsi, long rdx, void *rcx, void *r8, void *r9,
+ void *tcs, struct sgx_enclave_exception *ei, void *cb);
+
#endif /* SGX_CALL_H */
--
2.25.0
FYI, builds of the Fedora kernel with this patch set should complete
shortly at this copr repo:
https://copr.fedorainfracloud.org/coprs/npmccallum/enarx/builds/
On Tue, Mar 3, 2020 at 6:36 PM Jarkko Sakkinen
<[email protected]> wrote:
>
> Intel(R) SGX is a set of CPU instructions that can be used by applications
> to set aside private regions of code and data. The code outside the enclave
> is disallowed to access the memory inside the enclave by the CPU access
> control.
>
> There is a new hardware unit in the processor called Memory Encryption
> Engine (MEE) starting from the Skylake microacrhitecture. BIOS can define
> one or many MEE regions that can hold enclave data by configuring them with
> PRMRR registers.
>
> The MEE automatically encrypts the data leaving the processor package to
> the MEE regions. The data is encrypted using a random key whose life-time
> is exactly one power cycle.
>
> The current implementation requires that the firmware sets
> IA32_SGXLEPUBKEYHASH* MSRs as writable so that ultimately the kernel can
> decide what enclaves it wants run. The implementation does not create
> any bottlenecks to support read-only MSRs later on.
>
> You can tell if your CPU supports SGX by looking into /proc/cpuinfo:
>
> cat /proc/cpuinfo | grep sgx
>
> v28:
> * Documented to Documentation/x86/sgx.rst how the kernel manages the
> enclave ownership.
> * Removed non-LC flow from sgx_einit().
> * Removed struct sgx_einittoken since only the size of the corresponding
> microarchitectural structure is used in the series ATM.
>
> v27:
> * Disallow RIE processes to use enclaves as there could a permission
> conflict between VMA and enclave permissions.
> * In the documentation, replace "grep /proc/cpuinfo" with
> "grep sgx /proc/cpuinfo".
>
> v26:
> * Fixed the commit author in "x86/sgx: Linux Enclave Driver", which was
> changed in v25 by mistake.
> * Addressed a bunch of grammar mistakes in sgx.rst (thanks Randy once
> again for such a detailed feedback).
> * Added back the MAINTAINERS update commit, which was mistakenly removed
> in v25.
> * EREMOVE's for SECS cannot be done while sanitizing an EPC section. The
> CPU does not allow to remove a SECS page before all of its children have
> been removed, and a child page can be in some other section than the one
> currently being processed. Thus, removed special SECS processing from
> sgx_sanitize_page() and instead put sections through it twice. In the
> 2nd round the lists should only contain SECS pages.
>
> v25:
> * Fix a double-free issue when SGX_IOC_ENCLAVE_ADD_PAGES
> fails on executing ENCLS[EADD]. The rollback path executed
> radix_tree_delete() on the same address twice when this happened.
> * Return -EINTR instead of -ERESTARTSYS in SGX_IOC_ENCLAVE_ADD_PAGES when
> a signal is pending.
> * As requested by Borislav, move the CPUID 0x12 features to their own word
> in cpufeatures.
> * Sean fixed a bug from sgx_reclaimer_write() where sgx_encl_put_backing()
> was called with an uninitialized pointer when sgx_encl_get_backing()
> fails.
> * Migrated /dev/sgx/* to misc. This is future-proof as struct miscdevice
> has 'groups' for setting up sysfs attributes for the device.
> * Use device_initcall instead of subsys_initcall so that misc_class is
> initialized before SGX is initialized.
> * Return -EACCES in SGX_IOC_ENCLAVE_INIT when caller tries to select
> enclave attributes that we the kernel does not allow it to set instead
> of -EINVAL.
> * Unless SGX public key MSRs are writable always deny the feature from
> Linux. Previously this was only denied from driver. How VMs should be
> supported is not really part of initial patch set, which makes this
> an obvious choice.
> * Cleaned up and refined documentation to be more approachable.
>
> v24:
> * Reclaim unmeasured and TCS pages (regression in v23).
> * Replace usages of GFP_HIGHUSER with GFP_KERNEL.
> * Return -EIO on when EADD or EEXTEND fails in %SGX_IOC_ENCLAVE_ADD_PAGES
> and use the same rollback (destroy enclave). This can happen when host
> suspends itself unknowingly to a VM running enclaves. From -EIO the user
> space can deduce what happened.
> * Have a separate @count in struct sgx_enclave_add_pages to output number
> of bytes processed instead of overwriting the input parameters for
> clarity and more importantly that the API provides means for partial
> processing (@count could be less than @length in success case).
>
> v23:
> * Replace SGX_ENCLAVE_ADD_PAGE with SGX_ENCLAVE_ADD_PAGES. Replace @mrmask
> with %SGX_PAGE_MEASURE flag.
> * Return -EIO instead of -ECANCELED when ptrace() fails to read a TCS page.
> * In the reclaimer, pin page before ENCLS[EBLOCK] because pinning can fail
> (because of OOM) even in legit behaviour and after EBLOCK the reclaiming
> flow can be only reverted by killing the whole enclave.
> * Fixed SGX_ATTR_RESERVED_MASK. Bit 7 was marked as reserved while in fact
> it should have been bit 6 (Table 37-3 in the SDM).
> * Return -EPERM from SGX_IOC_ENCLAVE_INIT when ENCLS[EINIT] returns an SGX
> error code.
>
> v22:
> * Refined bunch commit messages and added associated SDM references as
> many of them were too exhausting and some outdated.
> * Alignment checks have been removed from mmap() because it does not define the
> ELRANGE. VMAs only act as windows to the enclave. The semantics compare
> somewhat how mmap() works with regular files.
> * We now require user space addresses given to SGX_IOC_ENCLAVE_ADD_PAGE to be
> page aligned so that we can pass the page directly to EADD and do not have
> to do an extra copy. This was made effectively possible by removing the
> worker thread for adding pages.
> * The selftest build files have been refined throughout of various glitches
> and work properly in a cross compilation environment such as BuildRoot.
> In addition, libcalls fail the build with an assertion in the linker
> script, if they end up to the enclave binary.
> * CONFIG_INTEL_SGX_DRIVER has been removed because you cannot use SGX core
> for anything without having the driver. This could change when KVM support
> is added.
> * We require zero permissions in SECINFO for TCS pages because the CPU
> overwrites SECINFO flags with zero permissions and measures the page
> only after that. Allowing to pass TCS with non-zero permissions would
> cause mismatching measurement between the one provided in SIGSTRUCT and
> the one computed by the CPU.
> * Obviously lots of small fixes and clean ups (does make sense to
> document them all).
>
> v21:
> * Check on mmap() that the VMA does cover an area that does not have
> enclave pages. Only mapping with PROT_NONE can do that to reserve
> initial address space for an enclave.
> * Check om mmap() and mprotect() that the VMA permissions do not
> surpass the enclave permissions.
> * Remove two refcounts from vma_close(): mm_list and encl->refcount.
> Enclave refcount is only need for swapper/enclave sync and we can
> remove mm_list refcount by destroying mm_struct when the process
> is closed. By not having vm_close() the Linux MM can merge VMAs.
> * Do not naturally align MAP_FIXED address.
> * Numerous small fixes and clean ups.
> * Use SRCU for synchronizing the list of mm_struct's.
> * Move to stack based call convention in the vDSO.
>
> v20:
> * Fine-tune Kconfig messages and spacing and remove MMU_NOTIFIER
> dependency as MMU notifiers are no longer used in the driver.
> * Use mm_users instead of mm_count as refcount for mm_struct as mm_count
> only protects from deleting mm_struct, not removing its contents.
> * Sanitize EPC when the reclaimer thread starts by doing EREMOVE for all
> of them. They could be in initialized state when the kernel starts
> because it might be spawned by kexec().
> * Documentation overhaul.
> * Use a device /dev/sgx/provision for delivering the provision token
> instead of securityfs.
> * Create a reference to the enclave when already when opening
> /dev/sgx/enclave. The file is then associated with this enclave only.
> mmap() can be done at free at any point and always get a reference to
> the enclave. To summarize the file now represents the enclave.
>
> v19:
> * Took 3-4 months but in some sense this was more like a rewrite of most
> of the corners of the source code. If I've forgotten to deal with some
> feedback, please don't shout me. Make a remark and I will fix it for
> the next version. Hopefully there won't be this big turnovers anymore.
> * Validate SECS attributes properly against CPUID given attributes and
> against allowed attributes. SECS attributes are the ones that are
> enforced whereas SIGSTRUCT attributes tell what is required to run
> the enclave.
> * Add KSS (Key Sharing Support) to the enclave attributes.
> * Deny MAP_PRIVATE as an enclave is always a shared memory entity.
> * Revert back to shmem backing storage so that it can be easily shared
> by multiple processes.
> * Split the recognization of an ENCLS leaf failure by using three
> functions to detect it: encsl_faulted(), encls_returned_code() and
> sgx_failed(). encls_failed() is only caused by a spurious expections that
> should never happen. Thus, it is not defined as an inline function in
> order to easily insert a kprobe to it.
> * Move low-level enclave management routines, page fault handler and page
> reclaiming routines from driver to the core. These cannot be separated
> from each other as they are heavily interdependent. The rationale is that
> the core does not call any code from the driver.
> * Allow the driver to be compiled as a module now that it no code is using
> its routines and it only uses exported symbols. Now the driver is
> essentially just a thin ioctl layer.
> * Reworked the driver to maintain a list of mm_struct's. The VMA callbacks
> add new entries to this list as the process is forked. Each entry has
> its own refcount because they have a different life-cycle as the enclave
> does. In effect @tgid and @mm have been removed from struct sgx_encl
> and we allow forking by removing VM_DONTCOPY from vm flags.
> * Generate a cpu mask in the reclaimer from the cpu mask's of all
> mm_struct's. This will kick out the hardware threads out of the enclave
> from multiple processes. It is not a local variable because it would
> eat too much of the stack space but instead a field in struct
> sgx_encl.
> * Allow forking i.e. remove VM_DONTCOPY. I did not change the API
> because the old API scaled to the workload that Andy described. The
> codebase is now mostly API independent i.e. changing the API is a
> small task. For me the proper trigger to chanage it is a as concrete
> as possible workload that cannot be fulfilled. I hope you understand
> my thinking here. I don't want to change anything w/o proper basis
> but I'm ready to change anything if there is a proper basis. I do
> not have any kind of attachment to any particular type of API.
> * Add Sean's vDSO ENCLS(EENTER) patches and update selftest to use the
> new vDSO.
>
> v18:
> * Update the ioctl-number.txt.
> * Move the driver under arch/x86.
> * Add SGX features (SGX, SGX1, SGX2) to the disabled-features.h.
> * Rename the selftest as test_sgx (previously sgx-selftest).
> * In order to enable process accounting, swap EPC pages and PCMD's to a VMA
> instead of shmem.
> * Allow only to initialize and run enclaves with a subset of
> {DEBUG, MODE64BIT} set.
> * Add SGX_IOC_ENCLAVE_SET_ATTRIBUTE to allow an enclave to have privileged
> attributes e.g. PROVISIONKEY.
>
> v17:
> * Add a simple selftest.
> * Fix a null pointer dereference to section->pages when its
> allocation fails.
> * Add Sean's description of the exception handling to the documentation.
>
> v16:
> * Fixed SOB's in the commits that were a bit corrupted in v15.
> * Implemented exceptio handling properly to detect_sgx().
> * Use GENMASK() to define SGX_CPUID_SUB_LEAF_TYPE_MASK.
> * Updated the documentation to use rst definition lists.
> * Added the missing Documentation/x86/index.rst, which has a link to
> intel_sgx.rst. Now the SGX and uapi documentation is properly generated
> with 'make htmldocs'.
> * While enumerating EPC sections, if an undefined section is found, fail
> the driver initialization instead of continuing the initialization.
> * Issue a warning if there are more than %SGX_MAX_EPC_SECTIONS.
> * Remove copyright notice from arch/x86/include/asm/sgx.h.
> * Migrated from ioremap_cache() to memremap().
>
> v15:
> * Split into more digestable size patches.
> * Lots of small fixes and clean ups.
> * Signal a "plain" SIGSEGV on an EPCM violation.
>
> v14:
> * Change the comment about X86_FEATURE_SGX_LC from “SGX launch
> configuration” to “SGX launch control”.
> * Move the SGX-related CPU feature flags as part of the Linux defined
> virtual leaf 8.
> * Add SGX_ prefix to the constants defining the ENCLS leaf functions.
> * Use GENMASK*() and BIT*() in sgx_arch.h instead of raw hex numbers.
> * Refine the long description for CONFIG_INTEL_SGX_CORE.
> * Do not use pr_*_ratelimited() in the driver. The use of the rate limited
> versions is legacy cruft from the prototyping phase.
> * Detect sleep with SGX_INVALID_EINIT_TOKEN instead of counting power
> cycles.
> * Manually prefix with “sgx:” in the core SGX code instead of redefining
> pr_fmt.
> * Report if IA32_SGXLEPUBKEYHASHx MSRs are not writable in the driver
> instead of core because it is a driver requirement.
> * Change prompt to bool in the entry for CONFIG_INTEL_SGX_CORE because the
> default is ‘n’.
> * Rename struct sgx_epc_bank as struct sgx_epc_section in order to match
> the SDM.
> * Allocate struct sgx_epc_page instances one at a time.
> * Use “__iomem void *” pointers for the mapped EPC memory consistently.
> * Retry once on SGX_INVALID_TOKEN in sgx_einit() instead of counting power
> cycles.
> * Call enclave swapping operations directly from the driver instead of
> calling them .indirectly through struct sgx_epc_page_ops because indirect
> calls are not required yet as the patch set does not contain the KVM
> support.
> * Added special signal SEGV_SGXERR to notify about SGX EPCM violation
> errors.
>
> v13:
> * Always use SGX_CPUID constant instead of a hardcoded value.
> * Simplified and documented the macros and functions for ENCLS leaves.
> * Enable sgx_free_page() to free active enclave pages on demand
> in order to allow sgx_invalidate() to delete enclave pages.
> It no longer performs EREMOVE if a page is in the process of
> being reclaimed.
> * Use PM notifier per enclave so that we don't have to traverse
> the global list of active EPC pages to find enclaves.
> * Removed unused SGX_LE_ROLLBACK constant from uapi/asm/sgx.h
> * Always use ioremap() to map EPC banks as we only support 64-bit kernel.
> * Invalidate IA32_SGXLEPUBKEYHASH cache used by sgx_einit() when going
> to sleep.
>
> v12:
> * Split to more narrow scoped commits in order to ease the review process and
> use co-developed-by tag for co-authors of commits instead of listing them in
> the source files.
> * Removed cruft EXPORT_SYMBOL() declarations and converted to static variables.
> * Removed in-kernel LE i.e. this version of the SGX software stack only
> supports unlocked IA32_SGXLEPUBKEYHASHx MSRs.
> * Refined documentation on launching enclaves, swapping and enclave
> construction.
> * Refined sgx_arch.h to include alignment information for every struct that
> requires it and removed structs that are not needed without an LE.
> * Got rid of SGX_CPUID.
> * SGX detection now prints log messages about firmware configuration issues.
>
> v11:
> * Polished ENCLS wrappers with refined exception handling.
> * ksgxswapd was not stopped (regression in v5) in
> sgx_page_cache_teardown(), which causes a leaked kthread after driver
> deinitialization.
> * Shutdown sgx_le_proxy when going to suspend because its EPC pages will be
> invalidated when resuming, which will cause it not function properly
> anymore.
> * Set EINITTOKEN.VALID to zero for a token that is passed when
> SGXLEPUBKEYHASH matches MRSIGNER as alloc_page() does not give a zero
> page.
> * Fixed the check in sgx_edbgrd() for a TCS page. Allowed to read offsets
> around the flags field, which causes a #GP. Only flags read is readable.
> * On read access memcpy() call inside sgx_vma_access() had src and dest
> parameters in wrong order.
> * The build issue with CONFIG_KASAN is now fixed. Added undefined symbols
> to LE even if “KASAN_SANITIZE := false” was set in the makefile.
> * Fixed a regression in the #PF handler. If a page has
> SGX_ENCL_PAGE_RESERVED flag the #PF handler should unconditionally fail.
> It did not, which caused weird races when trying to change other parts of
> swapping code.
> * EPC management has been refactored to a flat LRU cache and moved to
> arch/x86. The swapper thread reads a cluster of EPC pages and swaps all
> of them. It can now swap from multiple enclaves in the same round.
> * For the sake of consistency with SGX_IOC_ENCLAVE_ADD_PAGE, return -EINVAL
> when an enclave is already initialized or dead instead of zero.
>
> v10:
> * Cleaned up anon inode based IPC between the ring-0 and ring-3 parts
> of the driver.
> * Unset the reserved flag from an enclave page if EDBGRD/WR fails
> (regression in v6).
> * Close the anon inode when LE is stopped (regression in v9).
> * Update the documentation with a more detailed description of SGX.
>
> v9:
> * Replaced kernel-LE IPC based on pipes with an anonymous inode.
> The driver does not require anymore new exports.
>
> v8:
> * Check that public key MSRs match the LE public key hash in the
> driver initialization when the MSRs are read-only.
> * Fix the race in VA slot allocation by checking the fullness
> immediately after succeesful allocation.
> * Fix the race in hash mrsigner calculation between the launch
> enclave and user enclaves by having a separate lock for hash
> calculation.
>
> v7:
> * Fixed offset calculation in sgx_edbgr/wr(). Address was masked with PAGE_MASK
> when it should have been masked with ~PAGE_MASK.
> * Fixed a memory leak in sgx_ioc_enclave_create().
> * Simplified swapping code by using a pointer array for a cluster
> instead of a linked list.
> * Squeezed struct sgx_encl_page to 32 bytes.
> * Fixed deferencing of an RSA key on OpenSSL 1.1.0.
> * Modified TC's CMAC to use kernel AES-NI. Restructured the code
> a bit in order to better align with kernel conventions.
>
> v6:
> * Fixed semaphore underrun when accessing /dev/sgx from the launch enclave.
> * In sgx_encl_create() s/IS_ERR(secs)/IS_ERR(encl)/.
> * Removed virtualization chapter from the documentation.
> * Changed the default filename for the signing key as signing_key.pem.
> * Reworked EPC management in a way that instead of a linked list of
> struct sgx_epc_page instances there is an array of integers that
> encodes address and bank of an EPC page (the same data as 'pa' field
> earlier). The locking has been moved to the EPC bank level instead
> of a global lock.
> * Relaxed locking requirements for EPC management. EPC pages can be
> released back to the EPC bank concurrently.
> * Cleaned up ptrace() code.
> * Refined commit messages for new architectural constants.
> * Sorted includes in every source file.
> * Sorted local variable declarations according to the line length in
> every function.
> * Style fixes based on Darren's comments to sgx_le.c.
>
> v5:
> * Described IPC between the Launch Enclave and kernel in the commit messages.
> * Fixed all relevant checkpatch.pl issues that I have forgot fix in earlier
> versions except those that exist in the imported TinyCrypt code.
> * Fixed spelling mistakes in the documentation.
> * Forgot to check the return value of sgx_drv_subsys_init().
> * Encapsulated properly page cache init and teardown.
> * Collect epc pages to a temp list in sgx_add_epc_bank
> * Removed SGX_ENCLAVE_INIT_ARCH constant.
>
> v4:
> * Tied life-cycle of the sgx_le_proxy process to /dev/sgx.
> * Removed __exit annotation from sgx_drv_subsys_exit().
> * Fixed a leak of a backing page in sgx_process_add_page_req() in the
> case when vm_insert_pfn() fails.
> * Removed unused symbol exports for sgx_page_cache.c.
> * Updated sgx_alloc_page() to require encl parameter and documented the
> behavior (Sean Christopherson).
> * Refactored a more lean API for sgx_encl_find() and documented the behavior.
> * Moved #PF handler to sgx_fault.c.
> * Replaced subsys_system_register() with plain bus_register().
> * Retry EINIT 2nd time only if MSRs are not locked.
>
> v3:
> * Check that FEATURE_CONTROL_LOCKED and FEATURE_CONTROL_SGX_ENABLE are set.
> * Return -ERESTARTSYS in __sgx_encl_add_page() when sgx_alloc_page() fails.
> * Use unused bits in epc_page->pa to store the bank number.
> * Removed #ifdef for WQ_NONREENTRANT.
> * If mmu_notifier_register() fails with -EINTR, return -ERESTARTSYS.
> * Added --remove-section=.got.plt to objcopy flags in order to prevent a
> dummy .got.plt, which will cause an inconsistent size for the LE.
> * Documented sgx_encl_* functions.
> * Added remark about AES implementation used inside the LE.
> * Removed redundant sgx_sys_exit() from le/main.c.
> * Fixed struct sgx_secinfo alignment from 128 to 64 bytes.
> * Validate miscselect in sgx_encl_create().
> * Fixed SSA frame size calculation to take the misc region into account.
> * Implemented consistent exception handling to __encls() and __encls_ret().
> * Implemented a proper device model in order to allow sysfs attributes
> and in-kernel API.
> * Cleaned up various "find enclave" implementations to the unified
> sgx_encl_find().
> * Validate that vm_pgoff is zero.
> * Discard backing pages with shmem_truncate_range() after EADD.
> * Added missing EEXTEND operations to LE signing and launch.
> * Fixed SSA size for GPRS region from 168 to 184 bytes.
> * Fixed the checks for TCS flags. Now DBGOPTIN is allowed.
> * Check that TCS addresses are in ELRANGE and not just page aligned.
> * Require kernel to be compiled with X64_64 and CPU_SUP_INTEL.
> * Fixed an incorrect value for SGX_ATTR_DEBUG from 0x01 to 0x02.
>
> v2:
> * get_rand_uint32() changed the value of the pointer instead of value
> where it is pointing at.
> * Launch enclave incorrectly used sigstruct attributes-field instead of
> enclave attributes-field.
> * Removed unused struct sgx_add_page_req from sgx_ioctl.c
> * Removed unused sgx_has_sgx2.
> * Updated arch/x86/include/asm/sgx.h so that it provides stub
> implementations when sgx in not enabled.
> * Removed cruft rdmsr-calls from sgx_set_pubkeyhash_msrs().
> * return -ENOMEM in sgx_alloc_page() when VA pages consume too much space
> * removed unused global sgx_nr_pids
> * moved sgx_encl_release to sgx_encl.c
> * return -ERESTARTSYS instead of -EINTR in sgx_encl_init()
>
> Jarkko Sakkinen (12):
> x86/sgx: Update MAINTAINERS
> x86/sgx: Add SGX microarchitectural data structures
> x86/sgx: Add wrappers for ENCLS leaf functions
> x86/sgx: Add functions to allocate and free EPC pages
> x86/sgx: Linux Enclave Driver
> docs: x86/sgx: Document SGX micro architecture and kernel internals
> selftests/x86: Recurse into subdirectories
> selftests/x86: Add a selftest for SGX
> x86/sgx: Add provisioning
> x86/sgx: Add a page reclaimer
> x86/sgx: ptrace() support for the SGX driver
> selftests/x86: Add vDSO selftest for SGX
>
> Sean Christopherson (10):
> x86/cpufeatures: x86/msr: Add Intel SGX hardware bits
> x86/cpufeatures: x86/msr: Intel SGX Launch Control hardware bits
> x86/mm: x86/sgx: Signal SIGSEGV with PF_SGX
> x86/cpu/intel: Detect SGX supprt
> x86/sgx: Enumerate and track EPC sections
> mm: Introduce vm_ops->may_mprotect()
> x86/vdso: Add support for exception fixup in vDSO functions
> x86/fault: Add helper function to sanitize error code
> x86/traps: Attempt to fixup exceptions in vDSO before signaling
> x86/vdso: Implement a vDSO for Intel SGX enclave call
>
> .../userspace-api/ioctl/ioctl-number.rst | 1 +
> Documentation/x86/index.rst | 1 +
> Documentation/x86/sgx.rst | 192 +++++
> MAINTAINERS | 11 +
> arch/x86/Kconfig | 14 +
> arch/x86/entry/vdso/Makefile | 8 +-
> arch/x86/entry/vdso/extable.c | 46 +
> arch/x86/entry/vdso/extable.h | 29 +
> arch/x86/entry/vdso/vdso-layout.lds.S | 9 +-
> arch/x86/entry/vdso/vdso.lds.S | 1 +
> arch/x86/entry/vdso/vdso2c.h | 58 +-
> arch/x86/entry/vdso/vsgx_enter_enclave.S | 187 ++++
> arch/x86/include/asm/cpufeature.h | 5 +-
> arch/x86/include/asm/cpufeatures.h | 8 +-
> arch/x86/include/asm/disabled-features.h | 18 +-
> arch/x86/include/asm/msr-index.h | 8 +
> arch/x86/include/asm/required-features.h | 2 +-
> arch/x86/include/asm/traps.h | 1 +
> arch/x86/include/asm/vdso.h | 5 +
> arch/x86/include/uapi/asm/sgx.h | 114 +++
> arch/x86/kernel/cpu/Makefile | 1 +
> arch/x86/kernel/cpu/common.c | 4 +
> arch/x86/kernel/cpu/feat_ctl.c | 29 +-
> arch/x86/kernel/cpu/sgx/Makefile | 6 +
> arch/x86/kernel/cpu/sgx/arch.h | 343 ++++++++
> arch/x86/kernel/cpu/sgx/driver.c | 209 +++++
> arch/x86/kernel/cpu/sgx/driver.h | 32 +
> arch/x86/kernel/cpu/sgx/encl.c | 757 ++++++++++++++++
> arch/x86/kernel/cpu/sgx/encl.h | 127 +++
> arch/x86/kernel/cpu/sgx/encls.h | 238 ++++++
> arch/x86/kernel/cpu/sgx/ioctl.c | 805 ++++++++++++++++++
> arch/x86/kernel/cpu/sgx/main.c | 280 ++++++
> arch/x86/kernel/cpu/sgx/reclaim.c | 458 ++++++++++
> arch/x86/kernel/cpu/sgx/sgx.h | 108 +++
> arch/x86/kernel/traps.c | 14 +
> arch/x86/mm/fault.c | 45 +-
> include/linux/mm.h | 2 +
> mm/mprotect.c | 14 +-
> tools/arch/x86/include/asm/cpufeatures.h | 7 +-
> tools/testing/selftests/x86/Makefile | 44 +
> tools/testing/selftests/x86/sgx/.gitignore | 3 +
> tools/testing/selftests/x86/sgx/Makefile | 48 ++
> tools/testing/selftests/x86/sgx/defines.h | 17 +
> tools/testing/selftests/x86/sgx/encl.c | 20 +
> tools/testing/selftests/x86/sgx/encl.lds | 34 +
> .../selftests/x86/sgx/encl_bootstrap.S | 94 ++
> tools/testing/selftests/x86/sgx/main.c | 379 +++++++++
> tools/testing/selftests/x86/sgx/sgx_call.S | 66 ++
> tools/testing/selftests/x86/sgx/sgx_call.h | 14 +
> tools/testing/selftests/x86/sgx/sgxsign.c | 493 +++++++++++
> .../testing/selftests/x86/sgx/signing_key.pem | 39 +
> 51 files changed, 5417 insertions(+), 31 deletions(-)
> create mode 100644 Documentation/x86/sgx.rst
> create mode 100644 arch/x86/entry/vdso/extable.c
> create mode 100644 arch/x86/entry/vdso/extable.h
> create mode 100644 arch/x86/entry/vdso/vsgx_enter_enclave.S
> create mode 100644 arch/x86/include/uapi/asm/sgx.h
> create mode 100644 arch/x86/kernel/cpu/sgx/Makefile
> create mode 100644 arch/x86/kernel/cpu/sgx/arch.h
> create mode 100644 arch/x86/kernel/cpu/sgx/driver.c
> create mode 100644 arch/x86/kernel/cpu/sgx/driver.h
> create mode 100644 arch/x86/kernel/cpu/sgx/encl.c
> create mode 100644 arch/x86/kernel/cpu/sgx/encl.h
> create mode 100644 arch/x86/kernel/cpu/sgx/encls.h
> create mode 100644 arch/x86/kernel/cpu/sgx/ioctl.c
> create mode 100644 arch/x86/kernel/cpu/sgx/main.c
> create mode 100644 arch/x86/kernel/cpu/sgx/reclaim.c
> create mode 100644 arch/x86/kernel/cpu/sgx/sgx.h
> create mode 100644 tools/testing/selftests/x86/sgx/.gitignore
> create mode 100644 tools/testing/selftests/x86/sgx/Makefile
> create mode 100644 tools/testing/selftests/x86/sgx/defines.h
> create mode 100644 tools/testing/selftests/x86/sgx/encl.c
> create mode 100644 tools/testing/selftests/x86/sgx/encl.lds
> create mode 100644 tools/testing/selftests/x86/sgx/encl_bootstrap.S
> create mode 100644 tools/testing/selftests/x86/sgx/main.c
> create mode 100644 tools/testing/selftests/x86/sgx/sgx_call.S
> create mode 100644 tools/testing/selftests/x86/sgx/sgx_call.h
> create mode 100644 tools/testing/selftests/x86/sgx/sgxsign.c
> create mode 100644 tools/testing/selftests/x86/sgx/signing_key.pem
>
> --
> 2.25.0
>
On Tue, Mar 3, 2020 at 6:39 PM Jarkko Sakkinen
<[email protected]> wrote:
>
> Add a selftest for SGX. It is a trivial test where a simple enclave
> copies one 64-bit word of memory between two memory locations given to
> the enclave as arguments. Use ENCLS[EENTER] to invoke the enclave.
>
> Cc: [email protected]
> Cc: [email protected]
> Signed-off-by: Jarkko Sakkinen <[email protected]>
> ---
> tools/testing/selftests/x86/sgx/.gitignore | 3 +
> tools/testing/selftests/x86/sgx/Makefile | 48 ++
> tools/testing/selftests/x86/sgx/defines.h | 17 +
> tools/testing/selftests/x86/sgx/encl.c | 20 +
> tools/testing/selftests/x86/sgx/encl.lds | 34 ++
> .../selftests/x86/sgx/encl_bootstrap.S | 94 ++++
> tools/testing/selftests/x86/sgx/main.c | 247 +++++++++
> tools/testing/selftests/x86/sgx/sgx_call.S | 23 +
> tools/testing/selftests/x86/sgx/sgx_call.h | 11 +
> tools/testing/selftests/x86/sgx/sgxsign.c | 493 ++++++++++++++++++
> .../testing/selftests/x86/sgx/signing_key.pem | 39 ++
> 11 files changed, 1029 insertions(+)
> create mode 100644 tools/testing/selftests/x86/sgx/.gitignore
> create mode 100644 tools/testing/selftests/x86/sgx/Makefile
> create mode 100644 tools/testing/selftests/x86/sgx/defines.h
> create mode 100644 tools/testing/selftests/x86/sgx/encl.c
> create mode 100644 tools/testing/selftests/x86/sgx/encl.lds
> create mode 100644 tools/testing/selftests/x86/sgx/encl_bootstrap.S
> create mode 100644 tools/testing/selftests/x86/sgx/main.c
> create mode 100644 tools/testing/selftests/x86/sgx/sgx_call.S
> create mode 100644 tools/testing/selftests/x86/sgx/sgx_call.h
> create mode 100644 tools/testing/selftests/x86/sgx/sgxsign.c
> create mode 100644 tools/testing/selftests/x86/sgx/signing_key.pem
>
> diff --git a/tools/testing/selftests/x86/sgx/.gitignore b/tools/testing/selftests/x86/sgx/.gitignore
> new file mode 100644
> index 000000000000..98eb2d439606
> --- /dev/null
> +++ b/tools/testing/selftests/x86/sgx/.gitignore
> @@ -0,0 +1,3 @@
> +encl.ss
> +sgxsign
> +test_sgx
> diff --git a/tools/testing/selftests/x86/sgx/Makefile b/tools/testing/selftests/x86/sgx/Makefile
> new file mode 100644
> index 000000000000..f838700029e2
> --- /dev/null
> +++ b/tools/testing/selftests/x86/sgx/Makefile
> @@ -0,0 +1,48 @@
> +top_srcdir = ../../../../..
> +
> +include ../../lib.mk
> +
> +ifndef OBJCOPY
> +OBJCOPY := $(CROSS_COMPILE)objcopy
> +endif
> +
> +INCLUDES := -I$(top_srcdir)/tools/include
> +HOST_CFLAGS := -Wall -Werror -g $(INCLUDES) -fPIC -z noexecstack
> +ENCL_CFLAGS := -Wall -Werror -static -nostdlib -nostartfiles -fPIC \
> + -fno-stack-protector -mrdrnd $(INCLUDES)
> +
> +TEST_CUSTOM_PROGS := $(OUTPUT)/test_sgx $(OUTPUT)/encl.bin $(OUTPUT)/encl.ss
> +
> +all: $(TEST_CUSTOM_PROGS)
> +
> +$(OUTPUT)/test_sgx: $(OUTPUT)/main.o $(OUTPUT)/sgx_call.o
> + $(CC) $(HOST_CFLAGS) -o $@ $^
> +
> +$(OUTPUT)/main.o: main.c
> + $(CC) $(HOST_CFLAGS) -c $< -o $@
> +
> +$(OUTPUT)/sgx_call.o: sgx_call.S
> + $(CC) $(HOST_CFLAGS) -c $< -o $@
> +
> +$(OUTPUT)/encl.bin: $(OUTPUT)/encl.elf $(OUTPUT)/sgxsign
> + $(OBJCOPY) -O binary $< $@
> +
> +$(OUTPUT)/encl.elf: encl.lds encl.c encl_bootstrap.S
> + $(CC) $(ENCL_CFLAGS) -T $^ -o $@
> +
> +$(OUTPUT)/encl.ss: $(OUTPUT)/encl.bin
> + $(OUTPUT)/sgxsign signing_key.pem $(OUTPUT)/encl.bin $(OUTPUT)/encl.ss
> +
> +$(OUTPUT)/sgxsign: sgxsign.c
> + $(CC) $(INCLUDES) -o $@ $< -lcrypto
> +
> +EXTRA_CLEAN := \
> + $(OUTPUT)/encl.bin \
> + $(OUTPUT)/encl.elf \
> + $(OUTPUT)/encl.ss \
> + $(OUTPUT)/sgx_call.o \
> + $(OUTPUT)/sgxsign \
> + $(OUTPUT)/test_sgx \
> + $(OUTPUT)/test_sgx.o \
> +
> +.PHONY: clean
> diff --git a/tools/testing/selftests/x86/sgx/defines.h b/tools/testing/selftests/x86/sgx/defines.h
> new file mode 100644
> index 000000000000..87264f85cb9f
> --- /dev/null
> +++ b/tools/testing/selftests/x86/sgx/defines.h
> @@ -0,0 +1,17 @@
> +/* SPDX-License-Identifier: GPL-2.0 */
> +/*
> + * Copyright(c) 2016-19 Intel Corporation.
> + */
> +
> +#ifndef DEFINES_H
> +#define DEFINES_H
> +
> +#include <stdint.h>
> +
> +#define __aligned(x) __attribute__((__aligned__(x)))
> +#define __packed __attribute__((packed))
> +
> +#include "../../../../../arch/x86/kernel/cpu/sgx/arch.h"
> +#include "../../../../../arch/x86/include/uapi/asm/sgx.h"
> +
> +#endif /* DEFINES_H */
> diff --git a/tools/testing/selftests/x86/sgx/encl.c b/tools/testing/selftests/x86/sgx/encl.c
> new file mode 100644
> index 000000000000..ede915399742
> --- /dev/null
> +++ b/tools/testing/selftests/x86/sgx/encl.c
> @@ -0,0 +1,20 @@
> +// SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause)
> +// Copyright(c) 2016-18 Intel Corporation.
> +
> +#include <stddef.h>
> +#include "defines.h"
> +
> +static void *memcpy(void *dest, const void *src, size_t n)
> +{
> + size_t i;
> +
> + for (i = 0; i < n; i++)
> + ((char *)dest)[i] = ((char *)src)[i];
> +
> + return dest;
> +}
> +
> +void encl_body(void *rdi, void *rsi)
> +{
> + memcpy(rsi, rdi, 8);
> +}
> diff --git a/tools/testing/selftests/x86/sgx/encl.lds b/tools/testing/selftests/x86/sgx/encl.lds
> new file mode 100644
> index 000000000000..9a56d3064104
> --- /dev/null
> +++ b/tools/testing/selftests/x86/sgx/encl.lds
> @@ -0,0 +1,34 @@
> +OUTPUT_FORMAT(elf64-x86-64)
> +
> +SECTIONS
> +{
> + . = 0;
> + .tcs : {
> + *(.tcs*)
> + }
> +
> + . = ALIGN(4096);
> + .text : {
> + *(.text*)
> + *(.rodata*)
> + }
> +
> + . = ALIGN(4096);
> + .data : {
> + *(.data*)
> + }
> +
> + /DISCARD/ : {
> + *(.data*)
> + *(.comment*)
> + *(.note*)
> + *(.debug*)
> + *(.eh_frame*)
> + }
> +}
> +
> +ASSERT(!DEFINED(.altinstructions), "ALTERNATIVES are not supported in enclaves")
> +ASSERT(!DEFINED(.altinstr_replacement), "ALTERNATIVES are not supported in enclaves")
> +ASSERT(!DEFINED(.discard.retpoline_safe), "RETPOLINE ALTERNATIVES are not supported in enclaves")
> +ASSERT(!DEFINED(.discard.nospec), "RETPOLINE ALTERNATIVES are not supported in enclaves")
> +ASSERT(!DEFINED(.got.plt), "Libcalls are not supported in enclaves")
> diff --git a/tools/testing/selftests/x86/sgx/encl_bootstrap.S b/tools/testing/selftests/x86/sgx/encl_bootstrap.S
> new file mode 100644
> index 000000000000..d07f970ccdf9
> --- /dev/null
> +++ b/tools/testing/selftests/x86/sgx/encl_bootstrap.S
> @@ -0,0 +1,94 @@
> +/* SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause) */
> +/*
> + * Copyright(c) 2016-18 Intel Corporation.
> + */
> +
> + .macro ENCLU
> + .byte 0x0f, 0x01, 0xd7
> + .endm
> +
> + .section ".tcs", "a"
> + .balign 4096
> +
> + .fill 1, 8, 0 # STATE (set by CPU)
> + .fill 1, 8, 0 # FLAGS
> + .quad encl_ssa # OSSA
> + .fill 1, 4, 0 # CSSA (set by CPU)
> + .fill 1, 4, 1 # NSSA
> + .quad encl_entry # OENTRY
> + .fill 1, 8, 0 # AEP (set by EENTER and ERESUME)
> + .fill 1, 8, 0 # OFSBASE
> + .fill 1, 8, 0 # OGSBASE
> + .fill 1, 4, 0xFFFFFFFF # FSLIMIT
> + .fill 1, 4, 0xFFFFFFFF # GSLIMIT
> + .fill 4024, 1, 0 # Reserved
> +
> + .text
> +
> +encl_entry:
> + # RBX contains the base address for TCS, which is also the first address
> + # inside the enclave. By adding the value of le_stack_end to it, we get
> + # the absolute address for the stack.
> + lea (encl_stack)(%rbx), %rax
> + xchg %rsp, %rax
> + push %rax
> +
> + push %rcx # push the address after EENTER
> + push %rbx # push the enclave base address
> +
> + call encl_body
> +
> + pop %rbx # pop the enclave base address
> +
> + # Restore XSAVE registers to a synthetic state.
> + mov $0xFFFFFFFF, %rax
> + mov $0xFFFFFFFF, %rdx
> + lea (xsave_area)(%rbx), %rdi
> + fxrstor (%rdi)
> +
> + # Clear GPRs.
> + xor %rcx, %rcx
> + xor %rdx, %rdx
> + xor %rdi, %rdi
> + xor %rsi, %rsi
> + xor %r8, %r8
> + xor %r9, %r9
> + xor %r10, %r10
> + xor %r11, %r11
> + xor %r12, %r12
> + xor %r13, %r13
> + xor %r14, %r14
> + xor %r15, %r15
> +
> + # Reset status flags.
> + add %rdx, %rdx # OF = SF = AF = CF = 0; ZF = PF = 1
> +
> + # Prepare EEXIT target by popping the address of the instruction after
> + # EENTER to RBX.
> + pop %rbx
> +
> + # Restore the caller stack.
> + pop %rax
> + mov %rax, %rsp
> +
> + # EEXIT
> + mov $4, %rax
> + enclu
> +
> + .section ".data", "aw"
> +
> +encl_ssa:
> + .space 4096
> +
> +xsave_area:
> + .fill 1, 4, 0x037F # FCW
> + .fill 5, 4, 0
> + .fill 1, 4, 0x1F80 # MXCSR
> + .fill 1, 4, 0xFFFF # MXCSR_MASK
> + .fill 123, 4, 0
> + .fill 1, 4, 0x80000000 # XCOMP_BV[63] = 1, compaction mode
> + .fill 12, 4, 0
I find this much more readable:
xsave_area:
# Legacy
.fill 1, 4, 0x037F # FCW
.fill 5, 4, 0
.fill 1, 4, 0x1F80 # MXCSR
.fill 1, 4, 0xFFFF # MXCSR_MASK
.fill 60, 8, 0
# Header
.fill 1, 8, 0 # XSTATE_BV
.fill 1, 8, 1 << 63 # XCOMP_BV (compaction mode)
.fill 6, 8, 0
Also, since people are likely to copy this code for their own
enclaves, it would be helpful to document which flags are set in FCW
and MXCSR.
> +
> + .balign 4096
> + .space 8192
> +encl_stack:
> diff --git a/tools/testing/selftests/x86/sgx/main.c b/tools/testing/selftests/x86/sgx/main.c
> new file mode 100644
> index 000000000000..48ed5fdfb3cb
> --- /dev/null
> +++ b/tools/testing/selftests/x86/sgx/main.c
> @@ -0,0 +1,247 @@
> +// SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause)
> +// Copyright(c) 2016-18 Intel Corporation.
> +
> +#include <elf.h>
> +#include <errno.h>
> +#include <fcntl.h>
> +#include <stdbool.h>
> +#include <stdio.h>
> +#include <stdint.h>
> +#include <stdlib.h>
> +#include <string.h>
> +#include <unistd.h>
> +#include <sys/ioctl.h>
> +#include <sys/mman.h>
> +#include <sys/stat.h>
> +#include <sys/time.h>
> +#include <sys/types.h>
> +#include "defines.h"
> +#include "sgx_call.h"
> +
> +#define PAGE_SIZE 4096
> +
> +static const uint64_t MAGIC = 0x1122334455667788ULL;
> +
> +static bool encl_create(int dev_fd, unsigned long bin_size,
> + struct sgx_secs *secs)
> +{
> + struct sgx_enclave_create ioc;
> + void *area;
> + int rc;
> +
> + memset(secs, 0, sizeof(*secs));
> + secs->ssa_frame_size = 1;
> + secs->attributes = SGX_ATTR_MODE64BIT;
> + secs->xfrm = 3;
> +
> + for (secs->size = 4096; secs->size < bin_size; )
> + secs->size <<= 1;
> +
> + area = mmap(NULL, secs->size * 2, PROT_NONE, MAP_SHARED, dev_fd, 0);
> + if (area == MAP_FAILED) {
> + perror("mmap");
> + return false;
> + }
> +
> + secs->base = ((uint64_t)area + secs->size - 1) & ~(secs->size - 1);
> +
> + munmap(area, secs->base - (uint64_t)area);
> + munmap((void *)(secs->base + secs->size),
> + (uint64_t)area + secs->size - secs->base);
> +
> + ioc.src = (unsigned long)secs;
> + rc = ioctl(dev_fd, SGX_IOC_ENCLAVE_CREATE, &ioc);
> + if (rc) {
> + fprintf(stderr, "ECREATE failed rc=%d, err=%d.\n", rc, errno);
> + munmap((void *)secs->base, secs->size);
> + return false;
> + }
> +
> + return true;
> +}
> +
> +static bool encl_add_pages(int dev_fd, unsigned long offset, void *data,
> + unsigned long length, uint64_t flags)
> +{
> + struct sgx_enclave_add_pages ioc;
> + struct sgx_secinfo secinfo;
> + int rc;
> +
> + memset(&secinfo, 0, sizeof(secinfo));
> + secinfo.flags = flags;
> +
> + ioc.src = (uint64_t)data;
> + ioc.offset = offset;
> + ioc.length = length;
> + ioc.secinfo = (unsigned long)&secinfo;
> + ioc.flags = SGX_PAGE_MEASURE;
> +
> + rc = ioctl(dev_fd, SGX_IOC_ENCLAVE_ADD_PAGES, &ioc);
> + if (rc) {
> + fprintf(stderr, "EADD failed rc=%d.\n", rc);
> + return false;
> + }
> +
> + if (ioc.count != ioc.length) {
> + fprintf(stderr, "Partially processed, update the test.\n");
> + return false;
> + }
> +
> + return true;
> +}
> +
> +#define SGX_REG_PAGE_FLAGS \
> + (SGX_SECINFO_REG | SGX_SECINFO_R | SGX_SECINFO_W | SGX_SECINFO_X)
> +
> +static bool encl_build(struct sgx_secs *secs, void *bin,
> + unsigned long bin_size, struct sgx_sigstruct *sigstruct)
> +{
> + struct sgx_enclave_init ioc;
> + void *addr;
> + int dev_fd;
> + int rc;
> +
> + dev_fd = open("/dev/sgx/enclave", O_RDWR);
> + if (dev_fd < 0) {
> + fprintf(stderr, "Unable to open /dev/sgx\n");
> + return false;
> + }
> +
> + if (!encl_create(dev_fd, bin_size, secs))
> + goto out_dev_fd;
> +
> + if (!encl_add_pages(dev_fd, 0, bin, PAGE_SIZE, SGX_SECINFO_TCS))
> + goto out_dev_fd;
> +
> + if (!encl_add_pages(dev_fd, PAGE_SIZE, bin + PAGE_SIZE,
> + bin_size - PAGE_SIZE, SGX_REG_PAGE_FLAGS))
> + goto out_dev_fd;
> +
> + ioc.sigstruct = (uint64_t)sigstruct;
> + rc = ioctl(dev_fd, SGX_IOC_ENCLAVE_INIT, &ioc);
> + if (rc) {
> + printf("EINIT failed rc=%d\n", rc);
> + goto out_map;
> + }
> +
> + addr = mmap((void *)secs->base, PAGE_SIZE, PROT_READ | PROT_WRITE,
> + MAP_SHARED | MAP_FIXED, dev_fd, 0);
> + if (addr == MAP_FAILED) {
> + fprintf(stderr, "mmap() failed on TCS, errno=%d.\n", errno);
> + return false;
> + }
> +
> + addr = mmap((void *)(secs->base + PAGE_SIZE), bin_size - PAGE_SIZE,
> + PROT_READ | PROT_WRITE | PROT_EXEC,
> + MAP_SHARED | MAP_FIXED, dev_fd, 0);
> + if (addr == MAP_FAILED) {
> + fprintf(stderr, "mmap() failed, errno=%d.\n", errno);
> + return false;
> + }
> +
> + close(dev_fd);
> + return true;
> +out_map:
> + munmap((void *)secs->base, secs->size);
> +out_dev_fd:
> + close(dev_fd);
> + return false;
> +}
> +
> +bool get_file_size(const char *path, off_t *bin_size)
> +{
> + struct stat sb;
> + int ret;
> +
> + ret = stat(path, &sb);
> + if (ret) {
> + perror("stat");
> + return false;
> + }
> +
> + if (!sb.st_size || sb.st_size & 0xfff) {
> + fprintf(stderr, "Invalid blob size %lu\n", sb.st_size);
> + return false;
> + }
> +
> + *bin_size = sb.st_size;
> + return true;
> +}
> +
> +bool encl_data_map(const char *path, void **bin, off_t *bin_size)
> +{
> + int fd;
> +
> + fd = open(path, O_RDONLY);
> + if (fd == -1) {
> + fprintf(stderr, "open() %s failed, errno=%d.\n", path, errno);
> + return false;
> + }
> +
> + if (!get_file_size(path, bin_size))
> + goto err_out;
> +
> + *bin = mmap(NULL, *bin_size, PROT_READ, MAP_PRIVATE, fd, 0);
> + if (*bin == MAP_FAILED) {
> + fprintf(stderr, "mmap() %s failed, errno=%d.\n", path, errno);
> + goto err_out;
> + }
> +
> + close(fd);
> + return true;
> +
> +err_out:
> + close(fd);
> + return false;
> +}
> +
> +bool load_sigstruct(const char *path, void *sigstruct)
> +{
> + int fd;
> +
> + fd = open(path, O_RDONLY);
> + if (fd == -1) {
> + fprintf(stderr, "open() %s failed, errno=%d.\n", path, errno);
> + return false;
> + }
> +
> + if (read(fd, sigstruct, sizeof(struct sgx_sigstruct)) !=
> + sizeof(struct sgx_sigstruct)) {
> + fprintf(stderr, "read() %s failed, errno=%d.\n", path, errno);
> + close(fd);
> + return false;
> + }
> +
> + close(fd);
> + return true;
> +}
> +
> +int main(int argc, char *argv[], char *envp[])
> +{
> + struct sgx_sigstruct sigstruct;
> + struct sgx_secs secs;
> + uint64_t result = 0;
> + off_t bin_size;
> + void *bin;
> +
> + if (!encl_data_map("encl.bin", &bin, &bin_size))
> + exit(1);
> +
> + if (!load_sigstruct("encl.ss", &sigstruct))
> + exit(1);
> +
> + if (!encl_build(&secs, bin, bin_size, &sigstruct))
> + exit(1);
> +
> + printf("Input: 0x%lx\n", MAGIC);
> +
> + sgx_call_eenter((void *)&MAGIC, &result, (void *)secs.base);
> + if (result != MAGIC) {
> + fprintf(stderr, "0x%lx != 0x%lx\n", result, MAGIC);
> + exit(1);
> + }
> +
> + printf("Output: 0x%lx\n", result);
> +
> + exit(0);
> +}
> diff --git a/tools/testing/selftests/x86/sgx/sgx_call.S b/tools/testing/selftests/x86/sgx/sgx_call.S
> new file mode 100644
> index 000000000000..ca4c7893f9d9
> --- /dev/null
> +++ b/tools/testing/selftests/x86/sgx/sgx_call.S
> @@ -0,0 +1,23 @@
> +/* SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause) */
> +/**
> +* Copyright(c) 2016-18 Intel Corporation.
> +*/
> +
> + .text
> +
> + .macro ENCLU
> + .byte 0x0f, 0x01, 0xd7
> + .endm
> +
> + .text
> +
> + .global sgx_call_eenter
> +sgx_call_eenter:
> + push %rbx
> + mov $0x02, %rax
> + mov %rdx, %rbx
> + lea sgx_async_exit(%rip), %rcx
> +sgx_async_exit:
> + ENCLU
> + pop %rbx
> + ret
> diff --git a/tools/testing/selftests/x86/sgx/sgx_call.h b/tools/testing/selftests/x86/sgx/sgx_call.h
> new file mode 100644
> index 000000000000..bf72068ada23
> --- /dev/null
> +++ b/tools/testing/selftests/x86/sgx/sgx_call.h
> @@ -0,0 +1,11 @@
> +/* SPDX-License-Identifier: GPL-2.0 */
> +/*
> + * Copyright(c) 2016-19 Intel Corporation.
> + */
> +
> +#ifndef SGX_CALL_H
> +#define SGX_CALL_H
> +
> +void sgx_call_eenter(void *rdi, void *rsi, void *entry);
> +
> +#endif /* SGX_CALL_H */
> diff --git a/tools/testing/selftests/x86/sgx/sgxsign.c b/tools/testing/selftests/x86/sgx/sgxsign.c
> new file mode 100644
> index 000000000000..3d9007af40c9
> --- /dev/null
> +++ b/tools/testing/selftests/x86/sgx/sgxsign.c
> @@ -0,0 +1,493 @@
> +// SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause)
> +// Copyright(c) 2016-18 Intel Corporation.
> +
> +#define _GNU_SOURCE
> +#include <getopt.h>
> +#include <stdbool.h>
> +#include <stdint.h>
> +#include <stdio.h>
> +#include <stdlib.h>
> +#include <string.h>
> +#include <sys/stat.h>
> +#include <sys/types.h>
> +#include <unistd.h>
> +#include <openssl/err.h>
> +#include <openssl/pem.h>
> +#include "defines.h"
> +
> +struct sgx_sigstruct_payload {
> + struct sgx_sigstruct_header header;
> + struct sgx_sigstruct_body body;
> +};
> +
> +static bool check_crypto_errors(void)
> +{
> + int err;
> + bool had_errors = false;
> + const char *filename;
> + int line;
> + char str[256];
> +
> + for ( ; ; ) {
> + if (ERR_peek_error() == 0)
> + break;
> +
> + had_errors = true;
> + err = ERR_get_error_line(&filename, &line);
> + ERR_error_string_n(err, str, sizeof(str));
> + fprintf(stderr, "crypto: %s: %s:%d\n", str, filename, line);
> + }
> +
> + return had_errors;
> +}
> +
> +static void exit_usage(const char *program)
> +{
> + fprintf(stderr,
> + "Usage: %s/sign-le <key> <enclave> <sigstruct>\n", program);
> + exit(1);
> +}
> +
> +static inline const BIGNUM *get_modulus(RSA *key)
> +{
> +#if OPENSSL_VERSION_NUMBER < 0x10100000L
> + return key->n;
> +#else
> + const BIGNUM *n;
> +
> + RSA_get0_key(key, &n, NULL, NULL);
> + return n;
> +#endif
> +}
> +
> +static RSA *load_sign_key(const char *path)
> +{
> + FILE *f;
> + RSA *key;
> +
> + f = fopen(path, "rb");
> + if (!f) {
> + fprintf(stderr, "Unable to open %s\n", path);
> + return NULL;
> + }
> + key = RSA_new();
> + if (!PEM_read_RSAPrivateKey(f, &key, NULL, NULL))
> + return NULL;
> + fclose(f);
> +
> + if (BN_num_bytes(get_modulus(key)) != SGX_MODULUS_SIZE) {
> + fprintf(stderr, "Invalid key size %d\n",
> + BN_num_bytes(get_modulus(key)));
> + RSA_free(key);
> + return NULL;
> + }
> +
> + return key;
> +}
> +
> +static void reverse_bytes(void *data, int length)
> +{
> + int i = 0;
> + int j = length - 1;
> + uint8_t temp;
> + uint8_t *ptr = data;
> +
> + while (i < j) {
> + temp = ptr[i];
> + ptr[i] = ptr[j];
> + ptr[j] = temp;
> + i++;
> + j--;
> + }
> +}
> +
> +enum mrtags {
> + MRECREATE = 0x0045544145524345,
> + MREADD = 0x0000000044444145,
> + MREEXTEND = 0x00444E4554584545,
> +};
> +
> +static bool mrenclave_update(EVP_MD_CTX *ctx, const void *data)
> +{
> + if (!EVP_DigestUpdate(ctx, data, 64)) {
> + fprintf(stderr, "digest update failed\n");
> + return false;
> + }
> +
> + return true;
> +}
> +
> +static bool mrenclave_commit(EVP_MD_CTX *ctx, uint8_t *mrenclave)
> +{
> + unsigned int size;
> +
> + if (!EVP_DigestFinal_ex(ctx, (unsigned char *)mrenclave, &size)) {
> + fprintf(stderr, "digest commit failed\n");
> + return false;
> + }
> +
> + if (size != 32) {
> + fprintf(stderr, "invalid digest size = %u\n", size);
> + return false;
> + }
> +
> + return true;
> +}
> +
> +struct mrecreate {
> + uint64_t tag;
> + uint32_t ssaframesize;
> + uint64_t size;
> + uint8_t reserved[44];
> +} __attribute__((__packed__));
> +
> +
> +static bool mrenclave_ecreate(EVP_MD_CTX *ctx, uint64_t blob_size)
> +{
> + struct mrecreate mrecreate;
> + uint64_t encl_size;
> +
> + for (encl_size = 0x1000; encl_size < blob_size; )
> + encl_size <<= 1;
> +
> + memset(&mrecreate, 0, sizeof(mrecreate));
> + mrecreate.tag = MRECREATE;
> + mrecreate.ssaframesize = 1;
> + mrecreate.size = encl_size;
> +
> + if (!EVP_DigestInit_ex(ctx, EVP_sha256(), NULL))
> + return false;
> +
> + return mrenclave_update(ctx, &mrecreate);
> +}
> +
> +struct mreadd {
> + uint64_t tag;
> + uint64_t offset;
> + uint64_t flags; /* SECINFO flags */
> + uint8_t reserved[40];
> +} __attribute__((__packed__));
> +
> +static bool mrenclave_eadd(EVP_MD_CTX *ctx, uint64_t offset, uint64_t flags)
> +{
> + struct mreadd mreadd;
> +
> + memset(&mreadd, 0, sizeof(mreadd));
> + mreadd.tag = MREADD;
> + mreadd.offset = offset;
> + mreadd.flags = flags;
> +
> + return mrenclave_update(ctx, &mreadd);
> +}
> +
> +struct mreextend {
> + uint64_t tag;
> + uint64_t offset;
> + uint8_t reserved[48];
> +} __attribute__((__packed__));
> +
> +static bool mrenclave_eextend(EVP_MD_CTX *ctx, uint64_t offset, uint8_t *data)
> +{
> + struct mreextend mreextend;
> + int i;
> +
> + for (i = 0; i < 0x1000; i += 0x100) {
> + memset(&mreextend, 0, sizeof(mreextend));
> + mreextend.tag = MREEXTEND;
> + mreextend.offset = offset + i;
> +
> + if (!mrenclave_update(ctx, &mreextend))
> + return false;
> +
> + if (!mrenclave_update(ctx, &data[i + 0x00]))
> + return false;
> +
> + if (!mrenclave_update(ctx, &data[i + 0x40]))
> + return false;
> +
> + if (!mrenclave_update(ctx, &data[i + 0x80]))
> + return false;
> +
> + if (!mrenclave_update(ctx, &data[i + 0xC0]))
> + return false;
> + }
> +
> + return true;
> +}
> +
> +/**
> + * measure_encl - measure enclave
> + * @path: path to the enclave
> + * @mrenclave: measurement
> + *
> + * Calculates MRENCLAVE. Assumes that the very first page is a TCS page and
> + * following pages are regular pages. Does not measure the contents of the
> + * enclave as the signing tool is used at the moment only for the launch
> + * enclave, which is pass-through (everything gets a token).
> + */
> +static bool measure_encl(const char *path, uint8_t *mrenclave)
> +{
> + FILE *file;
> + struct stat sb;
> + EVP_MD_CTX *ctx;
> + uint64_t flags;
> + uint64_t offset;
> + uint8_t data[0x1000];
> + int rc;
> +
> + ctx = EVP_MD_CTX_create();
> + if (!ctx)
> + return false;
> +
> + file = fopen(path, "rb");
> + if (!file) {
> + perror("fopen");
> + EVP_MD_CTX_destroy(ctx);
> + return false;
> + }
> +
> + rc = stat(path, &sb);
> + if (rc) {
> + perror("stat");
> + goto out;
> + }
> +
> + if (!sb.st_size || sb.st_size & 0xfff) {
> + fprintf(stderr, "Invalid blob size %lu\n", sb.st_size);
> + goto out;
> + }
> +
> + if (!mrenclave_ecreate(ctx, sb.st_size))
> + goto out;
> +
> + for (offset = 0; offset < sb.st_size; offset += 0x1000) {
> + if (!offset)
> + flags = SGX_SECINFO_TCS;
> + else
> + flags = SGX_SECINFO_REG | SGX_SECINFO_R |
> + SGX_SECINFO_W | SGX_SECINFO_X;
> +
> + if (!mrenclave_eadd(ctx, offset, flags))
> + goto out;
> +
> + rc = fread(data, 1, 0x1000, file);
> + if (!rc)
> + break;
> + if (rc < 0x1000)
> + goto out;
> +
> + if (!mrenclave_eextend(ctx, offset, data))
> + goto out;
> + }
> +
> + if (!mrenclave_commit(ctx, mrenclave))
> + goto out;
> +
> + fclose(file);
> + EVP_MD_CTX_destroy(ctx);
> + return true;
> +out:
> + fclose(file);
> + EVP_MD_CTX_destroy(ctx);
> + return false;
> +}
> +
> +/**
> + * sign_encl - sign enclave
> + * @sigstruct: pointer to SIGSTRUCT
> + * @key: 3072-bit RSA key
> + * @signature: byte array for the signature
> + *
> + * Calculates EMSA-PKCSv1.5 signature for the given SIGSTRUCT. The result is
> + * stored in big-endian format so that it can be further passed to OpenSSL
> + * libcrypto functions.
> + */
> +static bool sign_encl(const struct sgx_sigstruct *sigstruct, RSA *key,
> + uint8_t *signature)
> +{
> + struct sgx_sigstruct_payload payload;
> + unsigned int siglen;
> + uint8_t digest[SHA256_DIGEST_LENGTH];
> + bool ret;
> +
> + memcpy(&payload.header, &sigstruct->header, sizeof(sigstruct->header));
> + memcpy(&payload.body, &sigstruct->body, sizeof(sigstruct->body));
> +
> + SHA256((unsigned char *)&payload, sizeof(payload), digest);
> +
> + ret = RSA_sign(NID_sha256, digest, SHA256_DIGEST_LENGTH, signature,
> + &siglen, key);
> +
> + return ret;
> +}
> +
> +struct q1q2_ctx {
> + BN_CTX *bn_ctx;
> + BIGNUM *m;
> + BIGNUM *s;
> + BIGNUM *q1;
> + BIGNUM *qr;
> + BIGNUM *q2;
> +};
> +
> +static void free_q1q2_ctx(struct q1q2_ctx *ctx)
> +{
> + BN_CTX_free(ctx->bn_ctx);
> + BN_free(ctx->m);
> + BN_free(ctx->s);
> + BN_free(ctx->q1);
> + BN_free(ctx->qr);
> + BN_free(ctx->q2);
> +}
> +
> +static bool alloc_q1q2_ctx(const uint8_t *s, const uint8_t *m,
> + struct q1q2_ctx *ctx)
> +{
> + ctx->bn_ctx = BN_CTX_new();
> + ctx->s = BN_bin2bn(s, SGX_MODULUS_SIZE, NULL);
> + ctx->m = BN_bin2bn(m, SGX_MODULUS_SIZE, NULL);
> + ctx->q1 = BN_new();
> + ctx->qr = BN_new();
> + ctx->q2 = BN_new();
> +
> + if (!ctx->bn_ctx || !ctx->s || !ctx->m || !ctx->q1 || !ctx->qr ||
> + !ctx->q2) {
> + free_q1q2_ctx(ctx);
> + return false;
> + }
> +
> + return true;
> +}
> +
> +static bool calc_q1q2(const uint8_t *s, const uint8_t *m, uint8_t *q1,
> + uint8_t *q2)
> +{
> + struct q1q2_ctx ctx;
> +
> + if (!alloc_q1q2_ctx(s, m, &ctx)) {
> + fprintf(stderr, "Not enough memory for Q1Q2 calculation\n");
> + return false;
> + }
> +
> + if (!BN_mul(ctx.q1, ctx.s, ctx.s, ctx.bn_ctx))
> + goto out;
> +
> + if (!BN_div(ctx.q1, ctx.qr, ctx.q1, ctx.m, ctx.bn_ctx))
> + goto out;
> +
> + if (BN_num_bytes(ctx.q1) > SGX_MODULUS_SIZE) {
> + fprintf(stderr, "Too large Q1 %d bytes\n",
> + BN_num_bytes(ctx.q1));
> + goto out;
> + }
> +
> + if (!BN_mul(ctx.q2, ctx.s, ctx.qr, ctx.bn_ctx))
> + goto out;
> +
> + if (!BN_div(ctx.q2, NULL, ctx.q2, ctx.m, ctx.bn_ctx))
> + goto out;
> +
> + if (BN_num_bytes(ctx.q2) > SGX_MODULUS_SIZE) {
> + fprintf(stderr, "Too large Q2 %d bytes\n",
> + BN_num_bytes(ctx.q2));
> + goto out;
> + }
> +
> + BN_bn2bin(ctx.q1, q1);
> + BN_bn2bin(ctx.q2, q2);
> +
> + free_q1q2_ctx(&ctx);
> + return true;
> +out:
> + free_q1q2_ctx(&ctx);
> + return false;
> +}
> +
> +static bool save_sigstruct(const struct sgx_sigstruct *sigstruct,
> + const char *path)
> +{
> + FILE *f = fopen(path, "wb");
> +
> + if (!f) {
> + fprintf(stderr, "Unable to open %s\n", path);
> + return false;
> + }
> +
> + fwrite(sigstruct, sizeof(*sigstruct), 1, f);
> + fclose(f);
> + return true;
> +}
> +
> +int main(int argc, char **argv)
> +{
> + uint64_t header1[2] = {0x000000E100000006, 0x0000000000010000};
> + uint64_t header2[2] = {0x0000006000000101, 0x0000000100000060};
> + struct sgx_sigstruct ss;
> + const char *program;
> + int opt;
> + RSA *sign_key;
> +
> + memset(&ss, 0, sizeof(ss));
> + ss.header.header1[0] = header1[0];
> + ss.header.header1[1] = header1[1];
> + ss.header.header2[0] = header2[0];
> + ss.header.header2[1] = header2[1];
> + ss.exponent = 3;
> +
> +#ifndef CONFIG_EINITTOKENKEY
> + ss.body.attributes = SGX_ATTR_MODE64BIT;
> +#else
> + ss.body.attributes = SGX_ATTR_MODE64BIT | SGX_ATTR_EINITTOKENKEY;
> +#endif
> + ss.body.xfrm = 3,
> +
> + program = argv[0];
> +
> + do {
> + opt = getopt(argc, argv, "");
> + switch (opt) {
> + case -1:
> + break;
> + default:
> + exit_usage(program);
> + }
> + } while (opt != -1);
> +
> + argc -= optind;
> + argv += optind;
> +
> + if (argc < 3)
> + exit_usage(program);
> +
> + /* sanity check only */
> + if (check_crypto_errors())
> + exit(1);
> +
> + sign_key = load_sign_key(argv[0]);
> + if (!sign_key)
> + goto out;
> +
> + BN_bn2bin(get_modulus(sign_key), ss.modulus);
> +
> + if (!measure_encl(argv[1], ss.body.mrenclave))
> + goto out;
> +
> + if (!sign_encl(&ss, sign_key, ss.signature))
> + goto out;
> +
> + if (!calc_q1q2(ss.signature, ss.modulus, ss.q1, ss.q2))
> + goto out;
> +
> + /* convert to little endian */
> + reverse_bytes(ss.signature, SGX_MODULUS_SIZE);
> + reverse_bytes(ss.modulus, SGX_MODULUS_SIZE);
> + reverse_bytes(ss.q1, SGX_MODULUS_SIZE);
> + reverse_bytes(ss.q2, SGX_MODULUS_SIZE);
> +
> + if (!save_sigstruct(&ss, argv[2]))
> + goto out;
> + exit(0);
> +out:
> + check_crypto_errors();
> + exit(1);
> +}
> diff --git a/tools/testing/selftests/x86/sgx/signing_key.pem b/tools/testing/selftests/x86/sgx/signing_key.pem
> new file mode 100644
> index 000000000000..d76f21f19187
> --- /dev/null
> +++ b/tools/testing/selftests/x86/sgx/signing_key.pem
> @@ -0,0 +1,39 @@
> +-----BEGIN RSA PRIVATE KEY-----
> +MIIG4wIBAAKCAYEApalGbq7Q+usM91CPtksu3D+b0Prc8gAFL6grM3mg85A5Bx8V
> +cfMXPgtrw8EYFwQxDAvzZWwl+9VfOX0ECrFRBkOHcOiG0SnADN8+FLj1UiNUQwbp
> +S6OzhNWuRcSbGraSOyUlVlV0yMQSvewyzGklOaXBe30AJqzIBc8QfdSxKuP8rs0Z
> +ga6k/Bl73osrYKByILJTUUeZqjLERsE6GebsdzbWgKn8qVqng4ZS4yMNg6LeRlH3
> ++9CIPgg4jwpSLHcp7dq2qTIB9a0tGe9ayp+5FbucpB6U7ePold0EeRN6RlJGDF9k
> +L93v8P5ykz5G5gYZ2g0K1X2sHIWV4huxPgv5PXgdyQYbK+6olqj0d5rjYuwX57Ul
> +k6SroPS1U6UbdCjG5txM+BNGU0VpD0ZhrIRw0leQdnNcCO9sTJuInZrgYacSVJ7u
> +mtB+uCt+uzUesc+l+xPRYA+9e14lLkZp7AAmo9FvL816XDI09deehJ3i/LmHKCRN
> +tuqC5TprRjFwUr6dAgEDAoIBgG5w2Z8fNfycs0+LCnmHdJLVEotR6KFVWMpwHMz7
> +wKJgJgS/Y6FMuilc8oKAuroCy11dTO5IGVKOP3uorVx2NgQtBPXwWeDGgAiU1A3Q
> +o4wXjYIEm4fCd63jyYPYZ2ckYXzDbjmOTdstYdPyzIhGGNEZK6eoqsRzMAPfYFPj
> +IMdCqHSIu6vJw1K7p+myHOsVoWshjODaZnF3LYSA0WaZ8vokjwBxUxuRxQJZjJds
> +s60XPtmL+qfgWtQFewoG4XL6GuD8FcXccynRRtzrLtFNPIl9BQfWfjBBhTC1/Te1
> +0Z6XbZvpdUTD9OfLB7SbR2OUFNpKQgriO0iYVdbW3cr7uu38Zwp4W1TX73DPjoi6
> +KNooP6SGWd4mRJW2+dUmSYS4QNG8eVVZswKcploEIXlAKRsOe4kzJJ1iETugIe85
> +uX8nd1WYEp65xwoRUg8hqng0MeyveVbXqNKuJG6tzNDt9kgFYo+hmC/oouAW2Dtc
> +T9jdRAwKJXqA2Eg6OkgXCEv+kwKBwQDYaQiFMlFhsmLlqI+EzCUh7c941/cL7m6U
> +7j98+8ngl0HgCEcrc10iJVCKakQW3YbPzAx3XkKTaGjWazvvrFarXIGlOud64B8a
> +iWyQ7VdlnmZnNEdk+C83tI91OQeaTKqRLDGzKh29Ry/jL8Pcbazt+kDgxa0H7qJp
> +roADUanLQuNkYubpbhFBh3xpa2EExaVq6rF7nIVsD8W9TrbmPKA4LgH7z0iy544D
> +kVCNYsTjYDdUWP+WiSor8kCnnpjnN9sCgcEAw/eNezUD1UDf6OYFC9+5JZJFn4Tg
> +mZMyN93JKIb199ffwnjtHUSjcyiWeesXucpzwtGbTcwQnDisSW4oneYKLSEBlBaq
> +scqiUugyGZZOthFSCbdXYXMViK2vHrKlkse7GxVlROKcEhM/pRBrmjaGO8eWR+D4
> +FO2wCXzVs3KgV6j779frw0vC54oHOxc9+Lu1rSHp4i+600koyvL/zF6U/5tZXIvN
> +YW2yoiQJnjCmVA1pwbwV6KAUTPDTMnBK+YjnAoHBAJBGBa4hi5Z27JkbCliIGMFJ
> +NPs6pLKe9GNJf6in2+sPgUAFhMeiPhbDiwbxgrnpBIqICE+ULGJFmzmc0p/IOceT
> +ARjR76dAFLxbnbXzj5kURETNhO36yiUjCk4mBRGIcbYddndxaSjaH+zKgpLzyJ6m
> +1esuc1qfFvEfAAI2cTIsl5hB70ZJYNZaUvDyQK3ZGPHxy6e9rkgKg9OJz0QoatAe
> +q/002yHvtAJg4F5B2JeVejg7VQ8GHB1MKxppu0TP5wKBwQCCpQj8zgKOKz/wmViy
> +lSYZDC5qWJW7t3bP6TDFr06lOpUsUJ4TgxeiGw778g/RMaKB4RIz3WBoJcgw9BsT
> +7rFza1ZiucchMcGMmswRDt8kC4wGejpA92Owc8oUdxkMhSdnY5jYlxK2t3/DYEe8
> +JFl9L7mFQKVjSSAGUzkiTGrlG1Kf5UfXh9dFBq98uilQfSPIwUaWynyM23CHTKqI
> +Pw3/vOY9sojrnncWwrEUIG7is5vWfWPwargzSzd29YdRBe8CgcEAuRVewK/YeNOX
> +B7ZG6gKKsfsvrGtY7FPETzLZAHjoVXYNea4LVZ2kn4hBXXlvw/4HD+YqcTt4wmif
> +5JQlDvjNobUiKJZpzy7hklVhF7wZFl4pCF7Yh43q9iQ7gKTaeUG7MiaK+G8Zz8aY
> +HW9rsiihbdZkccMvnPfO9334XMxl3HtBRzLstjUlbLB7Sdh+7tZ3JQidCOFNs5pE
> +XyWwnASPu4tKfDahH1UUTp1uJcq/6716CSWg080avYxFcn75qqsb
> +-----END RSA PRIVATE KEY-----
> --
> 2.25.0
>
On Tue, Mar 3, 2020 at 6:39 PM Jarkko Sakkinen
<[email protected]> wrote:
>
> Add a selftest for SGX. It is a trivial test where a simple enclave
> copies one 64-bit word of memory between two memory locations given to
> the enclave as arguments. Use ENCLS[EENTER] to invoke the enclave.
>
> Cc: [email protected]
> Cc: [email protected]
> Signed-off-by: Jarkko Sakkinen <[email protected]>
> ---
> tools/testing/selftests/x86/sgx/.gitignore | 3 +
> tools/testing/selftests/x86/sgx/Makefile | 48 ++
> tools/testing/selftests/x86/sgx/defines.h | 17 +
> tools/testing/selftests/x86/sgx/encl.c | 20 +
> tools/testing/selftests/x86/sgx/encl.lds | 34 ++
> .../selftests/x86/sgx/encl_bootstrap.S | 94 ++++
> tools/testing/selftests/x86/sgx/main.c | 247 +++++++++
> tools/testing/selftests/x86/sgx/sgx_call.S | 23 +
> tools/testing/selftests/x86/sgx/sgx_call.h | 11 +
> tools/testing/selftests/x86/sgx/sgxsign.c | 493 ++++++++++++++++++
> .../testing/selftests/x86/sgx/signing_key.pem | 39 ++
> 11 files changed, 1029 insertions(+)
> create mode 100644 tools/testing/selftests/x86/sgx/.gitignore
> create mode 100644 tools/testing/selftests/x86/sgx/Makefile
> create mode 100644 tools/testing/selftests/x86/sgx/defines.h
> create mode 100644 tools/testing/selftests/x86/sgx/encl.c
> create mode 100644 tools/testing/selftests/x86/sgx/encl.lds
> create mode 100644 tools/testing/selftests/x86/sgx/encl_bootstrap.S
> create mode 100644 tools/testing/selftests/x86/sgx/main.c
> create mode 100644 tools/testing/selftests/x86/sgx/sgx_call.S
> create mode 100644 tools/testing/selftests/x86/sgx/sgx_call.h
> create mode 100644 tools/testing/selftests/x86/sgx/sgxsign.c
> create mode 100644 tools/testing/selftests/x86/sgx/signing_key.pem
>
> diff --git a/tools/testing/selftests/x86/sgx/.gitignore b/tools/testing/selftests/x86/sgx/.gitignore
> new file mode 100644
> index 000000000000..98eb2d439606
> --- /dev/null
> +++ b/tools/testing/selftests/x86/sgx/.gitignore
> @@ -0,0 +1,3 @@
> +encl.ss
> +sgxsign
> +test_sgx
> diff --git a/tools/testing/selftests/x86/sgx/Makefile b/tools/testing/selftests/x86/sgx/Makefile
> new file mode 100644
> index 000000000000..f838700029e2
> --- /dev/null
> +++ b/tools/testing/selftests/x86/sgx/Makefile
> @@ -0,0 +1,48 @@
> +top_srcdir = ../../../../..
> +
> +include ../../lib.mk
> +
> +ifndef OBJCOPY
> +OBJCOPY := $(CROSS_COMPILE)objcopy
> +endif
> +
> +INCLUDES := -I$(top_srcdir)/tools/include
> +HOST_CFLAGS := -Wall -Werror -g $(INCLUDES) -fPIC -z noexecstack
> +ENCL_CFLAGS := -Wall -Werror -static -nostdlib -nostartfiles -fPIC \
> + -fno-stack-protector -mrdrnd $(INCLUDES)
> +
> +TEST_CUSTOM_PROGS := $(OUTPUT)/test_sgx $(OUTPUT)/encl.bin $(OUTPUT)/encl.ss
> +
> +all: $(TEST_CUSTOM_PROGS)
> +
> +$(OUTPUT)/test_sgx: $(OUTPUT)/main.o $(OUTPUT)/sgx_call.o
> + $(CC) $(HOST_CFLAGS) -o $@ $^
> +
> +$(OUTPUT)/main.o: main.c
> + $(CC) $(HOST_CFLAGS) -c $< -o $@
> +
> +$(OUTPUT)/sgx_call.o: sgx_call.S
> + $(CC) $(HOST_CFLAGS) -c $< -o $@
> +
> +$(OUTPUT)/encl.bin: $(OUTPUT)/encl.elf $(OUTPUT)/sgxsign
> + $(OBJCOPY) -O binary $< $@
> +
> +$(OUTPUT)/encl.elf: encl.lds encl.c encl_bootstrap.S
> + $(CC) $(ENCL_CFLAGS) -T $^ -o $@
> +
> +$(OUTPUT)/encl.ss: $(OUTPUT)/encl.bin
> + $(OUTPUT)/sgxsign signing_key.pem $(OUTPUT)/encl.bin $(OUTPUT)/encl.ss
> +
> +$(OUTPUT)/sgxsign: sgxsign.c
> + $(CC) $(INCLUDES) -o $@ $< -lcrypto
> +
> +EXTRA_CLEAN := \
> + $(OUTPUT)/encl.bin \
> + $(OUTPUT)/encl.elf \
> + $(OUTPUT)/encl.ss \
> + $(OUTPUT)/sgx_call.o \
> + $(OUTPUT)/sgxsign \
> + $(OUTPUT)/test_sgx \
> + $(OUTPUT)/test_sgx.o \
> +
> +.PHONY: clean
> diff --git a/tools/testing/selftests/x86/sgx/defines.h b/tools/testing/selftests/x86/sgx/defines.h
> new file mode 100644
> index 000000000000..87264f85cb9f
> --- /dev/null
> +++ b/tools/testing/selftests/x86/sgx/defines.h
> @@ -0,0 +1,17 @@
> +/* SPDX-License-Identifier: GPL-2.0 */
> +/*
> + * Copyright(c) 2016-19 Intel Corporation.
> + */
> +
> +#ifndef DEFINES_H
> +#define DEFINES_H
> +
> +#include <stdint.h>
> +
> +#define __aligned(x) __attribute__((__aligned__(x)))
> +#define __packed __attribute__((packed))
> +
> +#include "../../../../../arch/x86/kernel/cpu/sgx/arch.h"
> +#include "../../../../../arch/x86/include/uapi/asm/sgx.h"
> +
> +#endif /* DEFINES_H */
> diff --git a/tools/testing/selftests/x86/sgx/encl.c b/tools/testing/selftests/x86/sgx/encl.c
> new file mode 100644
> index 000000000000..ede915399742
> --- /dev/null
> +++ b/tools/testing/selftests/x86/sgx/encl.c
> @@ -0,0 +1,20 @@
> +// SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause)
> +// Copyright(c) 2016-18 Intel Corporation.
> +
> +#include <stddef.h>
> +#include "defines.h"
> +
> +static void *memcpy(void *dest, const void *src, size_t n)
> +{
> + size_t i;
> +
> + for (i = 0; i < n; i++)
> + ((char *)dest)[i] = ((char *)src)[i];
> +
> + return dest;
> +}
> +
> +void encl_body(void *rdi, void *rsi)
> +{
> + memcpy(rsi, rdi, 8);
> +}
> diff --git a/tools/testing/selftests/x86/sgx/encl.lds b/tools/testing/selftests/x86/sgx/encl.lds
> new file mode 100644
> index 000000000000..9a56d3064104
> --- /dev/null
> +++ b/tools/testing/selftests/x86/sgx/encl.lds
> @@ -0,0 +1,34 @@
> +OUTPUT_FORMAT(elf64-x86-64)
> +
> +SECTIONS
> +{
> + . = 0;
> + .tcs : {
> + *(.tcs*)
> + }
> +
> + . = ALIGN(4096);
> + .text : {
> + *(.text*)
> + *(.rodata*)
> + }
> +
> + . = ALIGN(4096);
> + .data : {
> + *(.data*)
> + }
> +
> + /DISCARD/ : {
> + *(.data*)
> + *(.comment*)
> + *(.note*)
> + *(.debug*)
> + *(.eh_frame*)
> + }
> +}
> +
> +ASSERT(!DEFINED(.altinstructions), "ALTERNATIVES are not supported in enclaves")
> +ASSERT(!DEFINED(.altinstr_replacement), "ALTERNATIVES are not supported in enclaves")
> +ASSERT(!DEFINED(.discard.retpoline_safe), "RETPOLINE ALTERNATIVES are not supported in enclaves")
> +ASSERT(!DEFINED(.discard.nospec), "RETPOLINE ALTERNATIVES are not supported in enclaves")
> +ASSERT(!DEFINED(.got.plt), "Libcalls are not supported in enclaves")
> diff --git a/tools/testing/selftests/x86/sgx/encl_bootstrap.S b/tools/testing/selftests/x86/sgx/encl_bootstrap.S
> new file mode 100644
> index 000000000000..d07f970ccdf9
> --- /dev/null
> +++ b/tools/testing/selftests/x86/sgx/encl_bootstrap.S
> @@ -0,0 +1,94 @@
> +/* SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause) */
> +/*
> + * Copyright(c) 2016-18 Intel Corporation.
> + */
> +
> + .macro ENCLU
> + .byte 0x0f, 0x01, 0xd7
> + .endm
> +
> + .section ".tcs", "a"
> + .balign 4096
> +
> + .fill 1, 8, 0 # STATE (set by CPU)
> + .fill 1, 8, 0 # FLAGS
> + .quad encl_ssa # OSSA
> + .fill 1, 4, 0 # CSSA (set by CPU)
> + .fill 1, 4, 1 # NSSA
> + .quad encl_entry # OENTRY
> + .fill 1, 8, 0 # AEP (set by EENTER and ERESUME)
> + .fill 1, 8, 0 # OFSBASE
> + .fill 1, 8, 0 # OGSBASE
> + .fill 1, 4, 0xFFFFFFFF # FSLIMIT
> + .fill 1, 4, 0xFFFFFFFF # GSLIMIT
> + .fill 4024, 1, 0 # Reserved
> +
> + .text
> +
> +encl_entry:
> + # RBX contains the base address for TCS, which is also the first address
> + # inside the enclave. By adding the value of le_stack_end to it, we get
> + # the absolute address for the stack.
> + lea (encl_stack)(%rbx), %rax
> + xchg %rsp, %rax
> + push %rax
> +
> + push %rcx # push the address after EENTER
> + push %rbx # push the enclave base address
> +
> + call encl_body
> +
> + pop %rbx # pop the enclave base address
> +
> + # Restore XSAVE registers to a synthetic state.
> + mov $0xFFFFFFFF, %rax
> + mov $0xFFFFFFFF, %rdx
> + lea (xsave_area)(%rbx), %rdi
> + fxrstor (%rdi)
> +
> + # Clear GPRs.
> + xor %rcx, %rcx
> + xor %rdx, %rdx
> + xor %rdi, %rdi
> + xor %rsi, %rsi
> + xor %r8, %r8
> + xor %r9, %r9
> + xor %r10, %r10
> + xor %r11, %r11
> + xor %r12, %r12
> + xor %r13, %r13
> + xor %r14, %r14
> + xor %r15, %r15
> +
> + # Reset status flags.
> + add %rdx, %rdx # OF = SF = AF = CF = 0; ZF = PF = 1
# Reset status flags.
add %rdx, %rdx # OF = SF = AF = CF = 0; ZF = PF = 1
cld # DF = 0
This was a recent CVE on the SDK. We don't need more people copying
vulnerable code into their own projects.
Likewise, you should also clear GPRs, reset extended GPU state and
reset flags before calling encl_body().
Alternatively, drop all the state clearing and simply put a comment in
for people to do that. My general rule here is to either not provide
an example at all or provide a secure example that people can copy.
> + # Prepare EEXIT target by popping the address of the instruction after
> + # EENTER to RBX.
> + pop %rbx
> +
> + # Restore the caller stack.
> + pop %rax
> + mov %rax, %rsp
> +
> + # EEXIT
> + mov $4, %rax
> + enclu
> +
> + .section ".data", "aw"
> +
> +encl_ssa:
> + .space 4096
> +
> +xsave_area:
> + .fill 1, 4, 0x037F # FCW
> + .fill 5, 4, 0
> + .fill 1, 4, 0x1F80 # MXCSR
> + .fill 1, 4, 0xFFFF # MXCSR_MASK
> + .fill 123, 4, 0
> + .fill 1, 4, 0x80000000 # XCOMP_BV[63] = 1, compaction mode
> + .fill 12, 4, 0
> +
> + .balign 4096
> + .space 8192
> +encl_stack:
> diff --git a/tools/testing/selftests/x86/sgx/main.c b/tools/testing/selftests/x86/sgx/main.c
> new file mode 100644
> index 000000000000..48ed5fdfb3cb
> --- /dev/null
> +++ b/tools/testing/selftests/x86/sgx/main.c
> @@ -0,0 +1,247 @@
> +// SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause)
> +// Copyright(c) 2016-18 Intel Corporation.
> +
> +#include <elf.h>
> +#include <errno.h>
> +#include <fcntl.h>
> +#include <stdbool.h>
> +#include <stdio.h>
> +#include <stdint.h>
> +#include <stdlib.h>
> +#include <string.h>
> +#include <unistd.h>
> +#include <sys/ioctl.h>
> +#include <sys/mman.h>
> +#include <sys/stat.h>
> +#include <sys/time.h>
> +#include <sys/types.h>
> +#include "defines.h"
> +#include "sgx_call.h"
> +
> +#define PAGE_SIZE 4096
> +
> +static const uint64_t MAGIC = 0x1122334455667788ULL;
> +
> +static bool encl_create(int dev_fd, unsigned long bin_size,
> + struct sgx_secs *secs)
> +{
> + struct sgx_enclave_create ioc;
> + void *area;
> + int rc;
> +
> + memset(secs, 0, sizeof(*secs));
> + secs->ssa_frame_size = 1;
> + secs->attributes = SGX_ATTR_MODE64BIT;
> + secs->xfrm = 3;
> +
> + for (secs->size = 4096; secs->size < bin_size; )
> + secs->size <<= 1;
> +
> + area = mmap(NULL, secs->size * 2, PROT_NONE, MAP_SHARED, dev_fd, 0);
> + if (area == MAP_FAILED) {
> + perror("mmap");
> + return false;
> + }
> +
> + secs->base = ((uint64_t)area + secs->size - 1) & ~(secs->size - 1);
> +
> + munmap(area, secs->base - (uint64_t)area);
> + munmap((void *)(secs->base + secs->size),
> + (uint64_t)area + secs->size - secs->base);
> +
> + ioc.src = (unsigned long)secs;
> + rc = ioctl(dev_fd, SGX_IOC_ENCLAVE_CREATE, &ioc);
> + if (rc) {
> + fprintf(stderr, "ECREATE failed rc=%d, err=%d.\n", rc, errno);
> + munmap((void *)secs->base, secs->size);
> + return false;
> + }
> +
> + return true;
> +}
> +
> +static bool encl_add_pages(int dev_fd, unsigned long offset, void *data,
> + unsigned long length, uint64_t flags)
> +{
> + struct sgx_enclave_add_pages ioc;
> + struct sgx_secinfo secinfo;
> + int rc;
> +
> + memset(&secinfo, 0, sizeof(secinfo));
> + secinfo.flags = flags;
> +
> + ioc.src = (uint64_t)data;
> + ioc.offset = offset;
> + ioc.length = length;
> + ioc.secinfo = (unsigned long)&secinfo;
> + ioc.flags = SGX_PAGE_MEASURE;
> +
> + rc = ioctl(dev_fd, SGX_IOC_ENCLAVE_ADD_PAGES, &ioc);
> + if (rc) {
> + fprintf(stderr, "EADD failed rc=%d.\n", rc);
> + return false;
> + }
> +
> + if (ioc.count != ioc.length) {
> + fprintf(stderr, "Partially processed, update the test.\n");
> + return false;
> + }
> +
> + return true;
> +}
> +
> +#define SGX_REG_PAGE_FLAGS \
> + (SGX_SECINFO_REG | SGX_SECINFO_R | SGX_SECINFO_W | SGX_SECINFO_X)
> +
> +static bool encl_build(struct sgx_secs *secs, void *bin,
> + unsigned long bin_size, struct sgx_sigstruct *sigstruct)
> +{
> + struct sgx_enclave_init ioc;
> + void *addr;
> + int dev_fd;
> + int rc;
> +
> + dev_fd = open("/dev/sgx/enclave", O_RDWR);
> + if (dev_fd < 0) {
> + fprintf(stderr, "Unable to open /dev/sgx\n");
> + return false;
> + }
> +
> + if (!encl_create(dev_fd, bin_size, secs))
> + goto out_dev_fd;
> +
> + if (!encl_add_pages(dev_fd, 0, bin, PAGE_SIZE, SGX_SECINFO_TCS))
> + goto out_dev_fd;
> +
> + if (!encl_add_pages(dev_fd, PAGE_SIZE, bin + PAGE_SIZE,
> + bin_size - PAGE_SIZE, SGX_REG_PAGE_FLAGS))
> + goto out_dev_fd;
> +
> + ioc.sigstruct = (uint64_t)sigstruct;
> + rc = ioctl(dev_fd, SGX_IOC_ENCLAVE_INIT, &ioc);
> + if (rc) {
> + printf("EINIT failed rc=%d\n", rc);
> + goto out_map;
> + }
> +
> + addr = mmap((void *)secs->base, PAGE_SIZE, PROT_READ | PROT_WRITE,
> + MAP_SHARED | MAP_FIXED, dev_fd, 0);
> + if (addr == MAP_FAILED) {
> + fprintf(stderr, "mmap() failed on TCS, errno=%d.\n", errno);
> + return false;
> + }
> +
> + addr = mmap((void *)(secs->base + PAGE_SIZE), bin_size - PAGE_SIZE,
> + PROT_READ | PROT_WRITE | PROT_EXEC,
> + MAP_SHARED | MAP_FIXED, dev_fd, 0);
> + if (addr == MAP_FAILED) {
> + fprintf(stderr, "mmap() failed, errno=%d.\n", errno);
> + return false;
> + }
> +
> + close(dev_fd);
> + return true;
> +out_map:
> + munmap((void *)secs->base, secs->size);
> +out_dev_fd:
> + close(dev_fd);
> + return false;
> +}
> +
> +bool get_file_size(const char *path, off_t *bin_size)
> +{
> + struct stat sb;
> + int ret;
> +
> + ret = stat(path, &sb);
> + if (ret) {
> + perror("stat");
> + return false;
> + }
> +
> + if (!sb.st_size || sb.st_size & 0xfff) {
> + fprintf(stderr, "Invalid blob size %lu\n", sb.st_size);
> + return false;
> + }
> +
> + *bin_size = sb.st_size;
> + return true;
> +}
> +
> +bool encl_data_map(const char *path, void **bin, off_t *bin_size)
> +{
> + int fd;
> +
> + fd = open(path, O_RDONLY);
> + if (fd == -1) {
> + fprintf(stderr, "open() %s failed, errno=%d.\n", path, errno);
> + return false;
> + }
> +
> + if (!get_file_size(path, bin_size))
> + goto err_out;
> +
> + *bin = mmap(NULL, *bin_size, PROT_READ, MAP_PRIVATE, fd, 0);
> + if (*bin == MAP_FAILED) {
> + fprintf(stderr, "mmap() %s failed, errno=%d.\n", path, errno);
> + goto err_out;
> + }
> +
> + close(fd);
> + return true;
> +
> +err_out:
> + close(fd);
> + return false;
> +}
> +
> +bool load_sigstruct(const char *path, void *sigstruct)
> +{
> + int fd;
> +
> + fd = open(path, O_RDONLY);
> + if (fd == -1) {
> + fprintf(stderr, "open() %s failed, errno=%d.\n", path, errno);
> + return false;
> + }
> +
> + if (read(fd, sigstruct, sizeof(struct sgx_sigstruct)) !=
> + sizeof(struct sgx_sigstruct)) {
> + fprintf(stderr, "read() %s failed, errno=%d.\n", path, errno);
> + close(fd);
> + return false;
> + }
> +
> + close(fd);
> + return true;
> +}
> +
> +int main(int argc, char *argv[], char *envp[])
> +{
> + struct sgx_sigstruct sigstruct;
> + struct sgx_secs secs;
> + uint64_t result = 0;
> + off_t bin_size;
> + void *bin;
> +
> + if (!encl_data_map("encl.bin", &bin, &bin_size))
> + exit(1);
> +
> + if (!load_sigstruct("encl.ss", &sigstruct))
> + exit(1);
> +
> + if (!encl_build(&secs, bin, bin_size, &sigstruct))
> + exit(1);
> +
> + printf("Input: 0x%lx\n", MAGIC);
> +
> + sgx_call_eenter((void *)&MAGIC, &result, (void *)secs.base);
> + if (result != MAGIC) {
> + fprintf(stderr, "0x%lx != 0x%lx\n", result, MAGIC);
> + exit(1);
> + }
> +
> + printf("Output: 0x%lx\n", result);
> +
> + exit(0);
> +}
> diff --git a/tools/testing/selftests/x86/sgx/sgx_call.S b/tools/testing/selftests/x86/sgx/sgx_call.S
> new file mode 100644
> index 000000000000..ca4c7893f9d9
> --- /dev/null
> +++ b/tools/testing/selftests/x86/sgx/sgx_call.S
> @@ -0,0 +1,23 @@
> +/* SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause) */
> +/**
> +* Copyright(c) 2016-18 Intel Corporation.
> +*/
> +
> + .text
> +
> + .macro ENCLU
> + .byte 0x0f, 0x01, 0xd7
> + .endm
> +
> + .text
> +
> + .global sgx_call_eenter
> +sgx_call_eenter:
> + push %rbx
> + mov $0x02, %rax
> + mov %rdx, %rbx
> + lea sgx_async_exit(%rip), %rcx
> +sgx_async_exit:
> + ENCLU
> + pop %rbx
> + ret
> diff --git a/tools/testing/selftests/x86/sgx/sgx_call.h b/tools/testing/selftests/x86/sgx/sgx_call.h
> new file mode 100644
> index 000000000000..bf72068ada23
> --- /dev/null
> +++ b/tools/testing/selftests/x86/sgx/sgx_call.h
> @@ -0,0 +1,11 @@
> +/* SPDX-License-Identifier: GPL-2.0 */
> +/*
> + * Copyright(c) 2016-19 Intel Corporation.
> + */
> +
> +#ifndef SGX_CALL_H
> +#define SGX_CALL_H
> +
> +void sgx_call_eenter(void *rdi, void *rsi, void *entry);
> +
> +#endif /* SGX_CALL_H */
> diff --git a/tools/testing/selftests/x86/sgx/sgxsign.c b/tools/testing/selftests/x86/sgx/sgxsign.c
> new file mode 100644
> index 000000000000..3d9007af40c9
> --- /dev/null
> +++ b/tools/testing/selftests/x86/sgx/sgxsign.c
> @@ -0,0 +1,493 @@
> +// SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause)
> +// Copyright(c) 2016-18 Intel Corporation.
> +
> +#define _GNU_SOURCE
> +#include <getopt.h>
> +#include <stdbool.h>
> +#include <stdint.h>
> +#include <stdio.h>
> +#include <stdlib.h>
> +#include <string.h>
> +#include <sys/stat.h>
> +#include <sys/types.h>
> +#include <unistd.h>
> +#include <openssl/err.h>
> +#include <openssl/pem.h>
> +#include "defines.h"
> +
> +struct sgx_sigstruct_payload {
> + struct sgx_sigstruct_header header;
> + struct sgx_sigstruct_body body;
> +};
> +
> +static bool check_crypto_errors(void)
> +{
> + int err;
> + bool had_errors = false;
> + const char *filename;
> + int line;
> + char str[256];
> +
> + for ( ; ; ) {
> + if (ERR_peek_error() == 0)
> + break;
> +
> + had_errors = true;
> + err = ERR_get_error_line(&filename, &line);
> + ERR_error_string_n(err, str, sizeof(str));
> + fprintf(stderr, "crypto: %s: %s:%d\n", str, filename, line);
> + }
> +
> + return had_errors;
> +}
> +
> +static void exit_usage(const char *program)
> +{
> + fprintf(stderr,
> + "Usage: %s/sign-le <key> <enclave> <sigstruct>\n", program);
> + exit(1);
> +}
> +
> +static inline const BIGNUM *get_modulus(RSA *key)
> +{
> +#if OPENSSL_VERSION_NUMBER < 0x10100000L
> + return key->n;
> +#else
> + const BIGNUM *n;
> +
> + RSA_get0_key(key, &n, NULL, NULL);
> + return n;
> +#endif
> +}
> +
> +static RSA *load_sign_key(const char *path)
> +{
> + FILE *f;
> + RSA *key;
> +
> + f = fopen(path, "rb");
> + if (!f) {
> + fprintf(stderr, "Unable to open %s\n", path);
> + return NULL;
> + }
> + key = RSA_new();
> + if (!PEM_read_RSAPrivateKey(f, &key, NULL, NULL))
> + return NULL;
> + fclose(f);
> +
> + if (BN_num_bytes(get_modulus(key)) != SGX_MODULUS_SIZE) {
> + fprintf(stderr, "Invalid key size %d\n",
> + BN_num_bytes(get_modulus(key)));
> + RSA_free(key);
> + return NULL;
> + }
> +
> + return key;
> +}
> +
> +static void reverse_bytes(void *data, int length)
> +{
> + int i = 0;
> + int j = length - 1;
> + uint8_t temp;
> + uint8_t *ptr = data;
> +
> + while (i < j) {
> + temp = ptr[i];
> + ptr[i] = ptr[j];
> + ptr[j] = temp;
> + i++;
> + j--;
> + }
> +}
> +
> +enum mrtags {
> + MRECREATE = 0x0045544145524345,
> + MREADD = 0x0000000044444145,
> + MREEXTEND = 0x00444E4554584545,
> +};
> +
> +static bool mrenclave_update(EVP_MD_CTX *ctx, const void *data)
> +{
> + if (!EVP_DigestUpdate(ctx, data, 64)) {
> + fprintf(stderr, "digest update failed\n");
> + return false;
> + }
> +
> + return true;
> +}
> +
> +static bool mrenclave_commit(EVP_MD_CTX *ctx, uint8_t *mrenclave)
> +{
> + unsigned int size;
> +
> + if (!EVP_DigestFinal_ex(ctx, (unsigned char *)mrenclave, &size)) {
> + fprintf(stderr, "digest commit failed\n");
> + return false;
> + }
> +
> + if (size != 32) {
> + fprintf(stderr, "invalid digest size = %u\n", size);
> + return false;
> + }
> +
> + return true;
> +}
> +
> +struct mrecreate {
> + uint64_t tag;
> + uint32_t ssaframesize;
> + uint64_t size;
> + uint8_t reserved[44];
> +} __attribute__((__packed__));
> +
> +
> +static bool mrenclave_ecreate(EVP_MD_CTX *ctx, uint64_t blob_size)
> +{
> + struct mrecreate mrecreate;
> + uint64_t encl_size;
> +
> + for (encl_size = 0x1000; encl_size < blob_size; )
> + encl_size <<= 1;
> +
> + memset(&mrecreate, 0, sizeof(mrecreate));
> + mrecreate.tag = MRECREATE;
> + mrecreate.ssaframesize = 1;
> + mrecreate.size = encl_size;
> +
> + if (!EVP_DigestInit_ex(ctx, EVP_sha256(), NULL))
> + return false;
> +
> + return mrenclave_update(ctx, &mrecreate);
> +}
> +
> +struct mreadd {
> + uint64_t tag;
> + uint64_t offset;
> + uint64_t flags; /* SECINFO flags */
> + uint8_t reserved[40];
> +} __attribute__((__packed__));
> +
> +static bool mrenclave_eadd(EVP_MD_CTX *ctx, uint64_t offset, uint64_t flags)
> +{
> + struct mreadd mreadd;
> +
> + memset(&mreadd, 0, sizeof(mreadd));
> + mreadd.tag = MREADD;
> + mreadd.offset = offset;
> + mreadd.flags = flags;
> +
> + return mrenclave_update(ctx, &mreadd);
> +}
> +
> +struct mreextend {
> + uint64_t tag;
> + uint64_t offset;
> + uint8_t reserved[48];
> +} __attribute__((__packed__));
> +
> +static bool mrenclave_eextend(EVP_MD_CTX *ctx, uint64_t offset, uint8_t *data)
> +{
> + struct mreextend mreextend;
> + int i;
> +
> + for (i = 0; i < 0x1000; i += 0x100) {
> + memset(&mreextend, 0, sizeof(mreextend));
> + mreextend.tag = MREEXTEND;
> + mreextend.offset = offset + i;
> +
> + if (!mrenclave_update(ctx, &mreextend))
> + return false;
> +
> + if (!mrenclave_update(ctx, &data[i + 0x00]))
> + return false;
> +
> + if (!mrenclave_update(ctx, &data[i + 0x40]))
> + return false;
> +
> + if (!mrenclave_update(ctx, &data[i + 0x80]))
> + return false;
> +
> + if (!mrenclave_update(ctx, &data[i + 0xC0]))
> + return false;
> + }
> +
> + return true;
> +}
> +
> +/**
> + * measure_encl - measure enclave
> + * @path: path to the enclave
> + * @mrenclave: measurement
> + *
> + * Calculates MRENCLAVE. Assumes that the very first page is a TCS page and
> + * following pages are regular pages. Does not measure the contents of the
> + * enclave as the signing tool is used at the moment only for the launch
> + * enclave, which is pass-through (everything gets a token).
> + */
> +static bool measure_encl(const char *path, uint8_t *mrenclave)
> +{
> + FILE *file;
> + struct stat sb;
> + EVP_MD_CTX *ctx;
> + uint64_t flags;
> + uint64_t offset;
> + uint8_t data[0x1000];
> + int rc;
> +
> + ctx = EVP_MD_CTX_create();
> + if (!ctx)
> + return false;
> +
> + file = fopen(path, "rb");
> + if (!file) {
> + perror("fopen");
> + EVP_MD_CTX_destroy(ctx);
> + return false;
> + }
> +
> + rc = stat(path, &sb);
> + if (rc) {
> + perror("stat");
> + goto out;
> + }
> +
> + if (!sb.st_size || sb.st_size & 0xfff) {
> + fprintf(stderr, "Invalid blob size %lu\n", sb.st_size);
> + goto out;
> + }
> +
> + if (!mrenclave_ecreate(ctx, sb.st_size))
> + goto out;
> +
> + for (offset = 0; offset < sb.st_size; offset += 0x1000) {
> + if (!offset)
> + flags = SGX_SECINFO_TCS;
> + else
> + flags = SGX_SECINFO_REG | SGX_SECINFO_R |
> + SGX_SECINFO_W | SGX_SECINFO_X;
> +
> + if (!mrenclave_eadd(ctx, offset, flags))
> + goto out;
> +
> + rc = fread(data, 1, 0x1000, file);
> + if (!rc)
> + break;
> + if (rc < 0x1000)
> + goto out;
> +
> + if (!mrenclave_eextend(ctx, offset, data))
> + goto out;
> + }
> +
> + if (!mrenclave_commit(ctx, mrenclave))
> + goto out;
> +
> + fclose(file);
> + EVP_MD_CTX_destroy(ctx);
> + return true;
> +out:
> + fclose(file);
> + EVP_MD_CTX_destroy(ctx);
> + return false;
> +}
> +
> +/**
> + * sign_encl - sign enclave
> + * @sigstruct: pointer to SIGSTRUCT
> + * @key: 3072-bit RSA key
> + * @signature: byte array for the signature
> + *
> + * Calculates EMSA-PKCSv1.5 signature for the given SIGSTRUCT. The result is
> + * stored in big-endian format so that it can be further passed to OpenSSL
> + * libcrypto functions.
> + */
> +static bool sign_encl(const struct sgx_sigstruct *sigstruct, RSA *key,
> + uint8_t *signature)
> +{
> + struct sgx_sigstruct_payload payload;
> + unsigned int siglen;
> + uint8_t digest[SHA256_DIGEST_LENGTH];
> + bool ret;
> +
> + memcpy(&payload.header, &sigstruct->header, sizeof(sigstruct->header));
> + memcpy(&payload.body, &sigstruct->body, sizeof(sigstruct->body));
> +
> + SHA256((unsigned char *)&payload, sizeof(payload), digest);
> +
> + ret = RSA_sign(NID_sha256, digest, SHA256_DIGEST_LENGTH, signature,
> + &siglen, key);
> +
> + return ret;
> +}
> +
> +struct q1q2_ctx {
> + BN_CTX *bn_ctx;
> + BIGNUM *m;
> + BIGNUM *s;
> + BIGNUM *q1;
> + BIGNUM *qr;
> + BIGNUM *q2;
> +};
> +
> +static void free_q1q2_ctx(struct q1q2_ctx *ctx)
> +{
> + BN_CTX_free(ctx->bn_ctx);
> + BN_free(ctx->m);
> + BN_free(ctx->s);
> + BN_free(ctx->q1);
> + BN_free(ctx->qr);
> + BN_free(ctx->q2);
> +}
> +
> +static bool alloc_q1q2_ctx(const uint8_t *s, const uint8_t *m,
> + struct q1q2_ctx *ctx)
> +{
> + ctx->bn_ctx = BN_CTX_new();
> + ctx->s = BN_bin2bn(s, SGX_MODULUS_SIZE, NULL);
> + ctx->m = BN_bin2bn(m, SGX_MODULUS_SIZE, NULL);
> + ctx->q1 = BN_new();
> + ctx->qr = BN_new();
> + ctx->q2 = BN_new();
> +
> + if (!ctx->bn_ctx || !ctx->s || !ctx->m || !ctx->q1 || !ctx->qr ||
> + !ctx->q2) {
> + free_q1q2_ctx(ctx);
> + return false;
> + }
> +
> + return true;
> +}
> +
> +static bool calc_q1q2(const uint8_t *s, const uint8_t *m, uint8_t *q1,
> + uint8_t *q2)
> +{
> + struct q1q2_ctx ctx;
> +
> + if (!alloc_q1q2_ctx(s, m, &ctx)) {
> + fprintf(stderr, "Not enough memory for Q1Q2 calculation\n");
> + return false;
> + }
> +
> + if (!BN_mul(ctx.q1, ctx.s, ctx.s, ctx.bn_ctx))
> + goto out;
> +
> + if (!BN_div(ctx.q1, ctx.qr, ctx.q1, ctx.m, ctx.bn_ctx))
> + goto out;
> +
> + if (BN_num_bytes(ctx.q1) > SGX_MODULUS_SIZE) {
> + fprintf(stderr, "Too large Q1 %d bytes\n",
> + BN_num_bytes(ctx.q1));
> + goto out;
> + }
> +
> + if (!BN_mul(ctx.q2, ctx.s, ctx.qr, ctx.bn_ctx))
> + goto out;
> +
> + if (!BN_div(ctx.q2, NULL, ctx.q2, ctx.m, ctx.bn_ctx))
> + goto out;
> +
> + if (BN_num_bytes(ctx.q2) > SGX_MODULUS_SIZE) {
> + fprintf(stderr, "Too large Q2 %d bytes\n",
> + BN_num_bytes(ctx.q2));
> + goto out;
> + }
> +
> + BN_bn2bin(ctx.q1, q1);
> + BN_bn2bin(ctx.q2, q2);
> +
> + free_q1q2_ctx(&ctx);
> + return true;
> +out:
> + free_q1q2_ctx(&ctx);
> + return false;
> +}
> +
> +static bool save_sigstruct(const struct sgx_sigstruct *sigstruct,
> + const char *path)
> +{
> + FILE *f = fopen(path, "wb");
> +
> + if (!f) {
> + fprintf(stderr, "Unable to open %s\n", path);
> + return false;
> + }
> +
> + fwrite(sigstruct, sizeof(*sigstruct), 1, f);
> + fclose(f);
> + return true;
> +}
> +
> +int main(int argc, char **argv)
> +{
> + uint64_t header1[2] = {0x000000E100000006, 0x0000000000010000};
> + uint64_t header2[2] = {0x0000006000000101, 0x0000000100000060};
> + struct sgx_sigstruct ss;
> + const char *program;
> + int opt;
> + RSA *sign_key;
> +
> + memset(&ss, 0, sizeof(ss));
> + ss.header.header1[0] = header1[0];
> + ss.header.header1[1] = header1[1];
> + ss.header.header2[0] = header2[0];
> + ss.header.header2[1] = header2[1];
> + ss.exponent = 3;
> +
> +#ifndef CONFIG_EINITTOKENKEY
> + ss.body.attributes = SGX_ATTR_MODE64BIT;
> +#else
> + ss.body.attributes = SGX_ATTR_MODE64BIT | SGX_ATTR_EINITTOKENKEY;
> +#endif
> + ss.body.xfrm = 3,
> +
> + program = argv[0];
> +
> + do {
> + opt = getopt(argc, argv, "");
> + switch (opt) {
> + case -1:
> + break;
> + default:
> + exit_usage(program);
> + }
> + } while (opt != -1);
> +
> + argc -= optind;
> + argv += optind;
> +
> + if (argc < 3)
> + exit_usage(program);
> +
> + /* sanity check only */
> + if (check_crypto_errors())
> + exit(1);
> +
> + sign_key = load_sign_key(argv[0]);
> + if (!sign_key)
> + goto out;
> +
> + BN_bn2bin(get_modulus(sign_key), ss.modulus);
> +
> + if (!measure_encl(argv[1], ss.body.mrenclave))
> + goto out;
> +
> + if (!sign_encl(&ss, sign_key, ss.signature))
> + goto out;
> +
> + if (!calc_q1q2(ss.signature, ss.modulus, ss.q1, ss.q2))
> + goto out;
> +
> + /* convert to little endian */
> + reverse_bytes(ss.signature, SGX_MODULUS_SIZE);
> + reverse_bytes(ss.modulus, SGX_MODULUS_SIZE);
> + reverse_bytes(ss.q1, SGX_MODULUS_SIZE);
> + reverse_bytes(ss.q2, SGX_MODULUS_SIZE);
> +
> + if (!save_sigstruct(&ss, argv[2]))
> + goto out;
> + exit(0);
> +out:
> + check_crypto_errors();
> + exit(1);
> +}
> diff --git a/tools/testing/selftests/x86/sgx/signing_key.pem b/tools/testing/selftests/x86/sgx/signing_key.pem
> new file mode 100644
> index 000000000000..d76f21f19187
> --- /dev/null
> +++ b/tools/testing/selftests/x86/sgx/signing_key.pem
> @@ -0,0 +1,39 @@
> +-----BEGIN RSA PRIVATE KEY-----
> +MIIG4wIBAAKCAYEApalGbq7Q+usM91CPtksu3D+b0Prc8gAFL6grM3mg85A5Bx8V
> +cfMXPgtrw8EYFwQxDAvzZWwl+9VfOX0ECrFRBkOHcOiG0SnADN8+FLj1UiNUQwbp
> +S6OzhNWuRcSbGraSOyUlVlV0yMQSvewyzGklOaXBe30AJqzIBc8QfdSxKuP8rs0Z
> +ga6k/Bl73osrYKByILJTUUeZqjLERsE6GebsdzbWgKn8qVqng4ZS4yMNg6LeRlH3
> ++9CIPgg4jwpSLHcp7dq2qTIB9a0tGe9ayp+5FbucpB6U7ePold0EeRN6RlJGDF9k
> +L93v8P5ykz5G5gYZ2g0K1X2sHIWV4huxPgv5PXgdyQYbK+6olqj0d5rjYuwX57Ul
> +k6SroPS1U6UbdCjG5txM+BNGU0VpD0ZhrIRw0leQdnNcCO9sTJuInZrgYacSVJ7u
> +mtB+uCt+uzUesc+l+xPRYA+9e14lLkZp7AAmo9FvL816XDI09deehJ3i/LmHKCRN
> +tuqC5TprRjFwUr6dAgEDAoIBgG5w2Z8fNfycs0+LCnmHdJLVEotR6KFVWMpwHMz7
> +wKJgJgS/Y6FMuilc8oKAuroCy11dTO5IGVKOP3uorVx2NgQtBPXwWeDGgAiU1A3Q
> +o4wXjYIEm4fCd63jyYPYZ2ckYXzDbjmOTdstYdPyzIhGGNEZK6eoqsRzMAPfYFPj
> +IMdCqHSIu6vJw1K7p+myHOsVoWshjODaZnF3LYSA0WaZ8vokjwBxUxuRxQJZjJds
> +s60XPtmL+qfgWtQFewoG4XL6GuD8FcXccynRRtzrLtFNPIl9BQfWfjBBhTC1/Te1
> +0Z6XbZvpdUTD9OfLB7SbR2OUFNpKQgriO0iYVdbW3cr7uu38Zwp4W1TX73DPjoi6
> +KNooP6SGWd4mRJW2+dUmSYS4QNG8eVVZswKcploEIXlAKRsOe4kzJJ1iETugIe85
> +uX8nd1WYEp65xwoRUg8hqng0MeyveVbXqNKuJG6tzNDt9kgFYo+hmC/oouAW2Dtc
> +T9jdRAwKJXqA2Eg6OkgXCEv+kwKBwQDYaQiFMlFhsmLlqI+EzCUh7c941/cL7m6U
> +7j98+8ngl0HgCEcrc10iJVCKakQW3YbPzAx3XkKTaGjWazvvrFarXIGlOud64B8a
> +iWyQ7VdlnmZnNEdk+C83tI91OQeaTKqRLDGzKh29Ry/jL8Pcbazt+kDgxa0H7qJp
> +roADUanLQuNkYubpbhFBh3xpa2EExaVq6rF7nIVsD8W9TrbmPKA4LgH7z0iy544D
> +kVCNYsTjYDdUWP+WiSor8kCnnpjnN9sCgcEAw/eNezUD1UDf6OYFC9+5JZJFn4Tg
> +mZMyN93JKIb199ffwnjtHUSjcyiWeesXucpzwtGbTcwQnDisSW4oneYKLSEBlBaq
> +scqiUugyGZZOthFSCbdXYXMViK2vHrKlkse7GxVlROKcEhM/pRBrmjaGO8eWR+D4
> +FO2wCXzVs3KgV6j779frw0vC54oHOxc9+Lu1rSHp4i+600koyvL/zF6U/5tZXIvN
> +YW2yoiQJnjCmVA1pwbwV6KAUTPDTMnBK+YjnAoHBAJBGBa4hi5Z27JkbCliIGMFJ
> +NPs6pLKe9GNJf6in2+sPgUAFhMeiPhbDiwbxgrnpBIqICE+ULGJFmzmc0p/IOceT
> +ARjR76dAFLxbnbXzj5kURETNhO36yiUjCk4mBRGIcbYddndxaSjaH+zKgpLzyJ6m
> +1esuc1qfFvEfAAI2cTIsl5hB70ZJYNZaUvDyQK3ZGPHxy6e9rkgKg9OJz0QoatAe
> +q/002yHvtAJg4F5B2JeVejg7VQ8GHB1MKxppu0TP5wKBwQCCpQj8zgKOKz/wmViy
> +lSYZDC5qWJW7t3bP6TDFr06lOpUsUJ4TgxeiGw778g/RMaKB4RIz3WBoJcgw9BsT
> +7rFza1ZiucchMcGMmswRDt8kC4wGejpA92Owc8oUdxkMhSdnY5jYlxK2t3/DYEe8
> +JFl9L7mFQKVjSSAGUzkiTGrlG1Kf5UfXh9dFBq98uilQfSPIwUaWynyM23CHTKqI
> +Pw3/vOY9sojrnncWwrEUIG7is5vWfWPwargzSzd29YdRBe8CgcEAuRVewK/YeNOX
> +B7ZG6gKKsfsvrGtY7FPETzLZAHjoVXYNea4LVZ2kn4hBXXlvw/4HD+YqcTt4wmif
> +5JQlDvjNobUiKJZpzy7hklVhF7wZFl4pCF7Yh43q9iQ7gKTaeUG7MiaK+G8Zz8aY
> +HW9rsiihbdZkccMvnPfO9334XMxl3HtBRzLstjUlbLB7Sdh+7tZ3JQidCOFNs5pE
> +XyWwnASPu4tKfDahH1UUTp1uJcq/6716CSWg080avYxFcn75qqsb
> +-----END RSA PRIVATE KEY-----
> --
> 2.25.0
>
On Tue, Mar 3, 2020 at 6:39 PM Jarkko Sakkinen
<[email protected]> wrote:
> diff --git a/tools/testing/selftests/x86/sgx/sgx_call.S b/tools/testing/selftests/x86/sgx/sgx_call.S
> new file mode 100644
> index 000000000000..ca4c7893f9d9
> --- /dev/null
> +++ b/tools/testing/selftests/x86/sgx/sgx_call.S
> @@ -0,0 +1,23 @@
> +/* SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause) */
> +/**
> +* Copyright(c) 2016-18 Intel Corporation.
> +*/
> +
> + .text
> +
> + .macro ENCLU
> + .byte 0x0f, 0x01, 0xd7
> + .endm
> +
> + .text
> +
> + .global sgx_call_eenter
> +sgx_call_eenter:
> + push %rbx
> + mov $0x02, %rax
> + mov %rdx, %rbx
> + lea sgx_async_exit(%rip), %rcx
> +sgx_async_exit:
> + ENCLU
> + pop %rbx
> + ret
You need to push and pop all the callee-saved registers here since the
enclave zeros them. This code works today by accident. A future
compiler may emit different register allocation which will cause this
to break.
We might consider making it part of the Linux enclave ABI that the
enclave has to save and restore these registers. This would have a
slight performance advantage in a critical code-path compared to
zeroing and then restoring them. But the VDSO code will need to know
what the expectation is.
On Wed, 2020-03-04 at 14:27 -0500, Nathaniel McCallum wrote:
> > > +xsave_area:
> > + .fill 1, 4, 0x037F # FCW
> > + .fill 5, 4, 0
> > + .fill 1, 4, 0x1F80 # MXCSR
> > + .fill 1, 4, 0xFFFF # MXCSR_MASK
> > + .fill 123, 4, 0
> > + .fill 1, 4, 0x80000000 # XCOMP_BV[63] = 1, compaction mode
> > + .fill 12, 4, 0
>
> I find this much more readable:
And I always aim to get things more readable. Thank you.
> xsave_area:
> # Legacy
> .fill 1, 4, 0x037F # FCW
> .fill 5, 4, 0
> .fill 1, 4, 0x1F80 # MXCSR
> .fill 1, 4, 0xFFFF # MXCSR_MASK
> .fill 60, 8, 0
>
> # Header
> .fill 1, 8, 0 # XSTATE_BV
> .fill 1, 8, 1 << 63 # XCOMP_BV (compaction mode)
> .fill 6, 8, 0
>
> Also, since people are likely to copy this code for their own
> enclaves, it would be helpful to document which flags are set in FCW
> and MXCSR.
It was meant as a test program but I'd guess what you say is true
because it also might be the only alternative user space to Intel's
:-) And a great starting point if you want to do things from scratch.
Because I meant it as a smoke test program for SGX, not everything is
too well documented but given the multipurpose use for that code I'll
make the improvements that you are suggesting.
/Jarkko
On Wed, Mar 04, 2020 at 01:35:58AM +0200, Jarkko Sakkinen wrote:
> diff --git a/arch/x86/include/uapi/asm/sgx.h b/arch/x86/include/uapi/asm/sgx.h
> new file mode 100644
> index 000000000000..5edb08ab8fd0
> --- /dev/null
> +++ b/arch/x86/include/uapi/asm/sgx.h
> @@ -0,0 +1,66 @@
> +/* SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause) WITH Linux-syscall-note */
> +/*
> + * Copyright(c) 2016-19 Intel Corporation.
> + */
> +#ifndef _UAPI_ASM_X86_SGX_H
> +#define _UAPI_ASM_X86_SGX_H
> +
> +#include <linux/types.h>
> +#include <linux/ioctl.h>
> +
> +/**
> + * enum sgx_epage_flags - page control flags
> + * %SGX_PAGE_MEASURE: Measure the page contents with a sequence of
> + * ENCLS[EEXTEND] operations.
> + */
> +enum sgx_page_flags {
> + SGX_PAGE_MEASURE = 0x01,
> +};
> +
> +#define SGX_MAGIC 0xA4
> +
> +#define SGX_IOC_ENCLAVE_CREATE \
> + _IOW(SGX_MAGIC, 0x00, struct sgx_enclave_create)
> +#define SGX_IOC_ENCLAVE_ADD_PAGES \
> + _IOWR(SGX_MAGIC, 0x01, struct sgx_enclave_add_pages)
> +#define SGX_IOC_ENCLAVE_INIT \
> + _IOW(SGX_MAGIC, 0x02, struct sgx_enclave_init)
> +
> +/**
> + * struct sgx_enclave_create - parameter structure for the
> + * %SGX_IOC_ENCLAVE_CREATE ioctl
> + * @src: address for the SECS page data
> + */
> +struct sgx_enclave_create {
> + __u64 src;
Would it make sense to add reserved fields to the structs so that new
features can be added in a backwards compatible way? E.g. if we want to
allow userspace to control the backing store by passing in a file
descriptor ENCLAVE_CREATE.
> +};
> +
> +/**
> + * struct sgx_enclave_add_pages - parameter structure for the
> + * %SGX_IOC_ENCLAVE_ADD_PAGE ioctl
> + * @src: start address for the page data
> + * @offset: starting page offset
> + * @length: length of the data (multiple of the page size)
> + * @secinfo: address for the SECINFO data
> + * @flags: page control flags
> + * @count: number of bytes added (multiple of the page size)
> + */
> +struct sgx_enclave_add_pages {
> + __u64 src;
> + __u64 offset;
> + __u64 length;
> + __u64 secinfo;
> + __u64 flags;
> + __u64 count;
> +};
> +
> +/**
> + * struct sgx_enclave_init - parameter structure for the
> + * %SGX_IOC_ENCLAVE_INIT ioctl
> + * @sigstruct: address for the SIGSTRUCT data
> + */
> +struct sgx_enclave_init {
> + __u64 sigstruct;
> +};
On 2020-03-05 18:40, Sean Christopherson wrote:
> On Wed, Mar 04, 2020 at 01:35:58AM +0200, Jarkko Sakkinen wrote:
>> diff --git a/arch/x86/include/uapi/asm/sgx.h b/arch/x86/include/uapi/asm/sgx.h
>> new file mode 100644
>> index 000000000000..5edb08ab8fd0
>> --- /dev/null
>> +++ b/arch/x86/include/uapi/asm/sgx.h
>> @@ -0,0 +1,66 @@
>> +/* SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause) WITH Linux-syscall-note */
>> +/*
>> + * Copyright(c) 2016-19 Intel Corporation.
>> + */
>> +#ifndef _UAPI_ASM_X86_SGX_H
>> +#define _UAPI_ASM_X86_SGX_H
>> +
>> +#include <linux/types.h>
>> +#include <linux/ioctl.h>
>> +
>> +/**
>> + * enum sgx_epage_flags - page control flags
>> + * %SGX_PAGE_MEASURE: Measure the page contents with a sequence of
>> + * ENCLS[EEXTEND] operations.
>> + */
>> +enum sgx_page_flags {
>> + SGX_PAGE_MEASURE = 0x01,
>> +};
>> +
>> +#define SGX_MAGIC 0xA4
>> +
>> +#define SGX_IOC_ENCLAVE_CREATE \
>> + _IOW(SGX_MAGIC, 0x00, struct sgx_enclave_create)
>> +#define SGX_IOC_ENCLAVE_ADD_PAGES \
>> + _IOWR(SGX_MAGIC, 0x01, struct sgx_enclave_add_pages)
>> +#define SGX_IOC_ENCLAVE_INIT \
>> + _IOW(SGX_MAGIC, 0x02, struct sgx_enclave_init)
>> +
>> +/**
>> + * struct sgx_enclave_create - parameter structure for the
>> + * %SGX_IOC_ENCLAVE_CREATE ioctl
>> + * @src: address for the SECS page data
>> + */
>> +struct sgx_enclave_create {
>> + __u64 src;
>
> Would it make sense to add reserved fields to the structs so that new
> features can be added in a backwards compatible way? E.g. if we want to
> allow userspace to control the backing store by passing in a file
> descriptor ENCLAVE_CREATE.
Reserving space for future fields is not necessary because the size of the struct is encoded in the ioctl number. The kernel can use this to differentiate between different call versions from userspace.
--
Jethro Beekman | Fortanix
On Thu, Mar 05, 2020 at 07:24:11PM +0100, Jethro Beekman wrote:
> On 2020-03-05 18:40, Sean Christopherson wrote:
> > On Wed, Mar 04, 2020 at 01:35:58AM +0200, Jarkko Sakkinen wrote:
> >> diff --git a/arch/x86/include/uapi/asm/sgx.h b/arch/x86/include/uapi/asm/sgx.h
> >> new file mode 100644
> >> index 000000000000..5edb08ab8fd0
> >> --- /dev/null
> >> +++ b/arch/x86/include/uapi/asm/sgx.h
> >> @@ -0,0 +1,66 @@
> >> +/* SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause) WITH Linux-syscall-note */
> >> +/*
> >> + * Copyright(c) 2016-19 Intel Corporation.
> >> + */
> >> +#ifndef _UAPI_ASM_X86_SGX_H
> >> +#define _UAPI_ASM_X86_SGX_H
> >> +
> >> +#include <linux/types.h>
> >> +#include <linux/ioctl.h>
> >> +
> >> +/**
> >> + * enum sgx_epage_flags - page control flags
> >> + * %SGX_PAGE_MEASURE: Measure the page contents with a sequence of
> >> + * ENCLS[EEXTEND] operations.
> >> + */
> >> +enum sgx_page_flags {
> >> + SGX_PAGE_MEASURE = 0x01,
> >> +};
> >> +
> >> +#define SGX_MAGIC 0xA4
> >> +
> >> +#define SGX_IOC_ENCLAVE_CREATE \
> >> + _IOW(SGX_MAGIC, 0x00, struct sgx_enclave_create)
> >> +#define SGX_IOC_ENCLAVE_ADD_PAGES \
> >> + _IOWR(SGX_MAGIC, 0x01, struct sgx_enclave_add_pages)
> >> +#define SGX_IOC_ENCLAVE_INIT \
> >> + _IOW(SGX_MAGIC, 0x02, struct sgx_enclave_init)
> >> +
> >> +/**
> >> + * struct sgx_enclave_create - parameter structure for the
> >> + * %SGX_IOC_ENCLAVE_CREATE ioctl
> >> + * @src: address for the SECS page data
> >> + */
> >> +struct sgx_enclave_create {
> >> + __u64 src;
> >
> > Would it make sense to add reserved fields to the structs so that new
> > features can be added in a backwards compatible way? E.g. if we want to
> > allow userspace to control the backing store by passing in a file
> > descriptor ENCLAVE_CREATE.
>
> Reserving space for future fields is not necessary because the size of the
> struct is encoded in the ioctl number. The kernel can use this to
> differentiate between different call versions from userspace.
Ah, perfect! Thanks!
+cc some more Intel people
On Wed, Mar 04, 2020 at 01:36:03AM +0200, Jarkko Sakkinen wrote:
> +static struct page *sgx_encl_get_backing_page(struct sgx_encl *encl,
> + pgoff_t index)
> +{
> + struct inode *inode = encl->backing->f_path.dentry->d_inode;
> + struct address_space *mapping = inode->i_mapping;
> + gfp_t gfpmask = mapping_gfp_mask(mapping);
Question for folks that care about cgroup accounting: should the shmem page
allocation be accounted, even though it'll charge the "wrong" task? E.g.
gfp_t gfpmask = mapping_gfp_mask(mapping) | __GFP_ACCOUNT;
Background details...
To reclaim an EPC page, the encrypted data must be written to addressable
memory when the page is evicted from the EPC. I.e. RAM or persistent
memory acts as swap space for the EPC. In the SGX code this is referred to
as the "backing store" or just "backing".
As implemented, the backing for EPC reclaim is not pre-allocated. I don't
think anyone would want to change this behavior as it would eat regular
memory even if EPC isn't oversubscribed.
But, as implemented it's not accounted. The reason we haven't explicitly
forced accounting is because allocations for the backing would be charged
to the task doing the evicting, as opposed to the task that originally
allocated the EPC page. This means that task 'A' can do a DOS of sorts on
task 'B' by allocating a large amount of EPC with the goal of causing 'B'
to trigger (normal memory) OOM and get killed.
AFAICT, that's still preferable to not accounting at all, e.g. at least 'B'
would need to be allocating a decent amount of EPC as well to trigger OOM,
as opposed to today where the allocations are completely unaccounted and so
cause a more global OOM.
We've also discussed taking a file descriptor to hold the backing, but
unless I'm misreading the pagecache code, that doesn't solve the incorrect
accounting problem because the current task, i.e. evicting task, would be
charged. In other words, whether the backing is kernel or user controlled
is purely an ABI question.
In theory, SGX could do some form of manual memcg accounting in
sgx_encl_get_backing_page(), but that gets ridiculously ugly, if it's even
possible, e.g. determining whether or not the page was already allocated
would be a nightmare.
Long term, I think this can be solved, or at least mitigated, by adding
a "backing" limit to the EPC cgroup (which obviously doesn't exist in yet)
to allow limiting the amount of memory that can be indirectly consumed by
creating a large enclave. E.g. account each page during ENCLAVE_ADD_PAGES,
with some logic to transfer the charges when a mm_struct is disassociated
from an enclave (which will probably be needed for the base EPC cgroup
anyways).
> +
> + return shmem_read_mapping_page_gfp(mapping, index, gfpmask);
> +}
> +
> +/**
> + * sgx_encl_get_backing() - Pin the backing storage
> + * @encl: an enclave
> + * @page_index: enclave page index
> + * @backing: data for accessing backing storage for the page
> + *
> + * Pin the backing storage pages for storing the encrypted contents and Paging
> + * Crypto MetaData (PCMD) of an enclave page.
> + *
> + * Return:
> + * 0 on success,
> + * -errno otherwise.
> + */
> +int sgx_encl_get_backing(struct sgx_encl *encl, unsigned long page_index,
> + struct sgx_backing *backing)
> +{
> + pgoff_t pcmd_index = PFN_DOWN(encl->size) + 1 + (page_index >> 5);
> + struct page *contents;
> + struct page *pcmd;
> +
> + contents = sgx_encl_get_backing_page(encl, page_index);
> + if (IS_ERR(contents))
> + return PTR_ERR(contents);
> +
> + pcmd = sgx_encl_get_backing_page(encl, pcmd_index);
> + if (IS_ERR(pcmd)) {
> + put_page(contents);
> + return PTR_ERR(pcmd);
> + }
> +
> + backing->page_index = page_index;
> + backing->contents = contents;
> + backing->pcmd = pcmd;
> + backing->pcmd_offset =
> + (page_index & (PAGE_SIZE / sizeof(struct sgx_pcmd) - 1)) *
> + sizeof(struct sgx_pcmd);
> +
> + return 0;
> +}
> +
> +/**
> + * sgx_encl_put_backing() - Unpin the backing storage
> + * @backing: data for accessing backing storage for the page
> + * @do_write: mark pages dirty
> + */
> +void sgx_encl_put_backing(struct sgx_backing *backing, bool do_write)
> +{
> + if (do_write) {
> + set_page_dirty(backing->pcmd);
> + set_page_dirty(backing->contents);
> + }
> +
> + put_page(backing->pcmd);
> + put_page(backing->contents);
> +}
On Wed, Mar 04, 2020 at 01:36:01AM +0200, Jarkko Sakkinen wrote:
Good evening, I hope the end of the week is going well for everyone.
> Add a selftest for SGX. It is a trivial test where a simple enclave
> copies one 64-bit word of memory between two memory locations given
> to the enclave as arguments. Use ENCLS[EENTER] to invoke the
> enclave.
Just as a clarification, are you testing the new driver against signed
production class enclaves in .so format that also include metadata
layout directives or is the driver just getting tested against the two
page toy enclave that copies a word of memory from one memory location
to another?
Our PSW/runtime is currently failing to initialize production class
enclaves secondary to a return value of -4 from the ENCLU[EINIT]
instruction, which means the measurement of the loaded enclave has
failed to match the value in the signature structure.
The same enclave loads fine with the out of kernel driver. Our
diagnostics tell us we are feeding identical page streams and
permissions to the page add ioctl's of both drivers. The identity
modulus signature of the signing key for the enclave is being written
to the launch control registers.
We see the same behavior from both our unit test enclaves and the
Quoting Enclave from the Intel SGX runtime.
When we ported our runtime loader to the new driver ABI we kept things
simple and add only a single page at a time in order to replicate the
behavior of the old driver.
Secondly, we were wondering what distribution you are building the
self-tests with? Initial indications are that the selftest signing
utility doesn't build properly with OpenSSL 1.1.1.
Have a good day.
Dr. Greg
As always,
Dr. Greg Wettstein, Ph.D, Worker
IDfusion, LLC SGX secured infrastructure and
4206 N. 19th Ave. autonomously self-defensive platforms.
Fargo, ND 58102
PH: 701-281-1686 EMAIL: [email protected]
------------------------------------------------------------------------------
"Don't worry about people stealing your ideas. If your ideas are any
good, you'll have to ram them down people's throats."
-- Howard Aiken
On Thu, Mar 05, 2020 at 01:33:28PM +0200, Jarkko Sakkinen wrote:
Good morning, I hope the end of the week is going well for everyone.
> On Wed, 2020-03-04 at 14:27 -0500, Nathaniel McCallum wrote:
> > # Header
> > .fill 1, 8, 0 # XSTATE_BV
> > .fill 1, 8, 1 << 63 # XCOMP_BV (compaction mode)
> > .fill 6, 8, 0
> >
> > Also, since people are likely to copy this code for their own
> > enclaves, it would be helpful to document which flags are set in FCW
> > and MXCSR.
> It was meant as a test program but I'd guess what you say is true
> because it also might be the only alternative user space to Intel's
> :-) And a great starting point if you want to do things from
> scratch.
>
> Because I meant it as a smoke test program for SGX, not everything
> is too well documented but given the multipurpose use for that code
> I'll make the improvements that you are suggesting.
At the risk of what will certainly be a fair amount of criticism, I
will take on the moniker of being the pernicious voice of reality, if
not intellectual honesty, in all of this. No market or security
relevant enclaves are going to get built by developers starting from
scratch or copying this code, useful and informative as it might be,
into their enclaves.
That isn't to say that it isn't good to have some example code but
Nate's point in a previous e-mail is well taken, it shouldn't have
known security vulnerabilities in it. Given the current realities of
speculative execution attacks, there are a ton of subtle issues
surrounding entry and exit into enclaves, which by definition is the
primary attack surface for a trusted execution environment.
For the sake of those reading along at home, relevant enclave
development needs, at an absolute minimum, the following:
1.) A lot of trusted runtime initialization and scaffolding code.
2.) An embedded C/C++ library.
3.) A compiler intrinsics implementation.
That gets you, maybe, something that you can start thinking about,
'hello world', with, but nothing useful with respect to what anyone
would want to do with an enclave.
On top of that you need a lot of platform software to get the enclave
relevantly signed, loaded, executed and supported. Not the least of
which is support for remote attestation, which means rolling up one's
sleeves to do either a DCAP implementation or an EPID provisioning
implementation. The latter of which, believe me, is not for the faint
of heart given that you have to develop it in an unknown oracle model.
My point in all of this is that the only relevant consumers of this
driver are groups that are resourced well enough to understand,
deliver and support all of this infrastructure. I will leave it to
others, and history, to judge whether or not the driver has been
developed with this frame of reference.
> /Jarkko
Best wishes for a pleasant weekend.
Dr. Greg
As always,
Dr. Greg Wettstein, Ph.D. Enjellic Systems Development, LLC.
4206 N. 19th Ave. SGX secured infrastructure and autonomously
Fargo, ND 58102 self-defensive platforms.
PH: 701-281-1686 EMAIL: [email protected]
------------------------------------------------------------------------------
"The couple is registered at Herbergers, Target and Fleet Farm."
-- Wedding invitation
West Central Minnesota
On Thu, Mar 05, 2020 at 11:03:54AM -0800, Sean Christopherson wrote:
> We've also discussed taking a file descriptor to hold the backing, but
> unless I'm misreading the pagecache code, that doesn't solve the incorrect
> accounting problem because the current task, i.e. evicting task, would be
> charged. In other words, whether the backing is kernel or user controlled
> is purely an ABI question.
Even if the file is owned by a different process the account happens
to "current"?
/Jarkko
On Thu, Mar 05, 2020 at 09:40:15AM -0800, Sean Christopherson wrote:
> Would it make sense to add reserved fields to the structs so that new
> features can be added in a backwards compatible way? E.g. if we want to
> allow userspace to control the backing store by passing in a file
> descriptor ENCLAVE_CREATE.
It would not really be a huge win even if you did that since old
software would not be aware of the new fields. Sounds somewhat
messy to me.
Even a new ioctl later on is in my opinion always a better option
than reserved fields when you add ioctl's.
/Jarkko
On Thu, Mar 05, 2020 at 07:24:11PM +0100, Jethro Beekman wrote:
> On 2020-03-05 18:40, Sean Christopherson wrote:
> > On Wed, Mar 04, 2020 at 01:35:58AM +0200, Jarkko Sakkinen wrote:
> >> diff --git a/arch/x86/include/uapi/asm/sgx.h b/arch/x86/include/uapi/asm/sgx.h
> >> new file mode 100644
> >> index 000000000000..5edb08ab8fd0
> >> --- /dev/null
> >> +++ b/arch/x86/include/uapi/asm/sgx.h
> >> @@ -0,0 +1,66 @@
> >> +/* SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause) WITH Linux-syscall-note */
> >> +/*
> >> + * Copyright(c) 2016-19 Intel Corporation.
> >> + */
> >> +#ifndef _UAPI_ASM_X86_SGX_H
> >> +#define _UAPI_ASM_X86_SGX_H
> >> +
> >> +#include <linux/types.h>
> >> +#include <linux/ioctl.h>
> >> +
> >> +/**
> >> + * enum sgx_epage_flags - page control flags
> >> + * %SGX_PAGE_MEASURE: Measure the page contents with a sequence of
> >> + * ENCLS[EEXTEND] operations.
> >> + */
> >> +enum sgx_page_flags {
> >> + SGX_PAGE_MEASURE = 0x01,
> >> +};
> >> +
> >> +#define SGX_MAGIC 0xA4
> >> +
> >> +#define SGX_IOC_ENCLAVE_CREATE \
> >> + _IOW(SGX_MAGIC, 0x00, struct sgx_enclave_create)
> >> +#define SGX_IOC_ENCLAVE_ADD_PAGES \
> >> + _IOWR(SGX_MAGIC, 0x01, struct sgx_enclave_add_pages)
> >> +#define SGX_IOC_ENCLAVE_INIT \
> >> + _IOW(SGX_MAGIC, 0x02, struct sgx_enclave_init)
> >> +
> >> +/**
> >> + * struct sgx_enclave_create - parameter structure for the
> >> + * %SGX_IOC_ENCLAVE_CREATE ioctl
> >> + * @src: address for the SECS page data
> >> + */
> >> +struct sgx_enclave_create {
> >> + __u64 src;
> >
> > Would it make sense to add reserved fields to the structs so that new
> > features can be added in a backwards compatible way? E.g. if we want to
> > allow userspace to control the backing store by passing in a file
> > descriptor ENCLAVE_CREATE.
>
> Reserving space for future fields is not necessary because the size of
> the struct is encoded in the ioctl number. The kernel can use this to
> differentiate between different call versions from userspace.
Sure but I still would never change the signature once a ioctl is added.
/Jarkko
On Thu, Mar 05, 2020 at 11:32:10PM -0600, Dr. Greg wrote:
> On Wed, Mar 04, 2020 at 01:36:01AM +0200, Jarkko Sakkinen wrote:
>
> Good evening, I hope the end of the week is going well for everyone.
>
> > Add a selftest for SGX. It is a trivial test where a simple enclave
> > copies one 64-bit word of memory between two memory locations given
> > to the enclave as arguments. Use ENCLS[EENTER] to invoke the
> > enclave.
>
> Just as a clarification, are you testing the new driver against signed
> production class enclaves in .so format that also include metadata
> layout directives or is the driver just getting tested against the two
> page toy enclave that copies a word of memory from one memory location
> to another?
That is the kind of role kselftests to smoke stuff. Obviously it will
be refined over time but to do a "hello world" from scratch as an
enclave was already quite a big effort.
> Our PSW/runtime is currently failing to initialize production class
> enclaves secondary to a return value of -4 from the ENCLU[EINIT]
> instruction, which means the measurement of the loaded enclave has
> failed to match the value in the signature structure.
>
> The same enclave loads fine with the out of kernel driver. Our
> diagnostics tell us we are feeding identical page streams and
> permissions to the page add ioctl's of both drivers. The identity
> modulus signature of the signing key for the enclave is being written
> to the launch control registers.
>
> We see the same behavior from both our unit test enclaves and the
> Quoting Enclave from the Intel SGX runtime.
>
> When we ported our runtime loader to the new driver ABI we kept things
> simple and add only a single page at a time in order to replicate the
> behavior of the old driver.
>
> Secondly, we were wondering what distribution you are building the
> self-tests with? Initial indications are that the selftest signing
> utility doesn't build properly with OpenSSL 1.1.1.
I don't use a distribution. I just build user space with BuildRoot
when I test a kernel.
Do you have a build log available to look at?
/Jarkko
On Fri, Mar 06, 2020 at 09:42:22AM -0600, Dr. Greg wrote:
> On Thu, Mar 05, 2020 at 01:33:28PM +0200, Jarkko Sakkinen wrote:
>
> Good morning, I hope the end of the week is going well for everyone.
>
> > On Wed, 2020-03-04 at 14:27 -0500, Nathaniel McCallum wrote:
> > > # Header
> > > .fill 1, 8, 0 # XSTATE_BV
> > > .fill 1, 8, 1 << 63 # XCOMP_BV (compaction mode)
> > > .fill 6, 8, 0
> > >
> > > Also, since people are likely to copy this code for their own
> > > enclaves, it would be helpful to document which flags are set in FCW
> > > and MXCSR.
>
> > It was meant as a test program but I'd guess what you say is true
> > because it also might be the only alternative user space to Intel's
> > :-) And a great starting point if you want to do things from
> > scratch.
> >
> > Because I meant it as a smoke test program for SGX, not everything
> > is too well documented but given the multipurpose use for that code
> > I'll make the improvements that you are suggesting.
>
> At the risk of what will certainly be a fair amount of criticism, I
> will take on the moniker of being the pernicious voice of reality, if
> not intellectual honesty, in all of this. No market or security
> relevant enclaves are going to get built by developers starting from
> scratch or copying this code, useful and informative as it might be,
> into their enclaves.
>
> That isn't to say that it isn't good to have some example code but
> Nate's point in a previous e-mail is well taken, it shouldn't have
> known security vulnerabilities in it. Given the current realities of
> speculative execution attacks, there are a ton of subtle issues
> surrounding entry and exit into enclaves, which by definition is the
> primary attack surface for a trusted execution environment.
>
> For the sake of those reading along at home, relevant enclave
> development needs, at an absolute minimum, the following:
>
> 1.) A lot of trusted runtime initialization and scaffolding code.
> 2.) An embedded C/C++ library.
> 3.) A compiler intrinsics implementation.
>
> That gets you, maybe, something that you can start thinking about,
> 'hello world', with, but nothing useful with respect to what anyone
> would want to do with an enclave.
Actually many people have applaused to have a small scoped, even if not
perfect, test program to look at how SGX works. One that is only
dependent on glibc. None of the selftests are meant to be production
peaces of code. You are getting wrong the role of the selftest in the
first place.
/Jarkko
On Fri, Mar 06, 2020 at 09:07:53PM +0200, Jarkko Sakkinen wrote:
Good morning, I hope the weekend is going well for everyone.
> Actually many people have applaused to have a small scoped, even if
> not perfect, test program to look at how SGX works. One that is only
> dependent on glibc. None of the selftests are meant to be production
> peaces of code. You are getting wrong the role of the selftest in
> the first place.
We certainly want to be counted in the camp of those who are
applausing you for making the selftests available, particularly the
new VDSO setup and entry code.
We arguably have similar motivations. We architected and authored an
entire SGX runtime that has as its only dependencies the MUSL C
library, libelf and OpenSSL, primarily because we needed an easily
auditable and low footprint SGX implementation.
To the point at hand though, I'm certainly not a very smart guy so I
doubt that I am able to understand the role of the selftests. We do
seem to agree though that they only provide a rudimentary exercise of
the driver.
We also seem to agree that the primary role of the driver is to
service the needs of those of us that are building production level
SGX runtime stacks. In service of that premise, it would be helpful
to know if you are internally testing the driver/VDSO against enclaves
of production quality, with metadata, or just the two page selftest
enclave.
Since Intel signs and releases binary enclaves, (QE, LE, PCE), it
would seem that a load and initialization of these enclaves would
provide a good reference point for all of us to agree on with respect
to basic driver testing and validation.
> /Jarkko
Have a good remainder of the weekend.
Dr. Greg
As always,
Dr. G.W. Wettstein, Ph.D. Enjellic Systems Development, LLC.
4206 N. 19th Ave. SGX secured infrastructure and
Fargo, ND 58102 autonomously self-defensive platforms.
PH: 701-281-1686 EMAIL: [email protected]
------------------------------------------------------------------------------
"... remember that innovation is saying 'no' to 1000 things."
-- Moxie Marlinspike
On Wed, Mar 04, 2020 at 01:35:53AM +0200, Jarkko Sakkinen wrote:
> +/* Issue a WARN() about an ENCLS leaf. */
> +#define ENCLS_WARN(r, name) { \
> + do { \
> + int _r = (r); \
> + WARN(_r, "%s returned %d (0x%x)\n", (name), _r, _r); \
This should be a WARN_ONCE(), otherwise we'll spam the log if something
goes awry, e.g. if there's a correctable #MC or a rogue write to a MCi_CTL
MSR, either of which will "soft" disable SGX (CPUID 0x7 still reports
SGX/SGXLC support, but all CPUID 0x12 sub-leafs return zeros).
> + } while (0); \
> +}
On Wed, Mar 04, 2020 at 01:36:03AM +0200, Jarkko Sakkinen wrote:
> +static void sgx_reclaimer_write(struct sgx_epc_page *epc_page,
> + struct sgx_backing *backing)
> +{
> + struct sgx_encl_page *encl_page = epc_page->owner;
> + struct sgx_encl *encl = encl_page->encl;
> + struct sgx_backing secs_backing;
> + int ret;
> +
> + mutex_lock(&encl->lock);
> +
> + if (atomic_read(&encl->flags) & SGX_ENCL_DEAD) {
> + ret = __eremove(sgx_epc_addr(epc_page));
> + WARN(ret, "EREMOVE returned %d\n", ret);
This should use ENCLS_WARN().
> + } else {
> + sgx_encl_ewb(epc_page, backing);
> + }
> +
> + encl_page->epc_page = NULL;
> + encl->secs_child_cnt--;
> +
> + if (!encl->secs_child_cnt) {
> + if (atomic_read(&encl->flags) & SGX_ENCL_DEAD) {
> + sgx_free_page(encl->secs.epc_page);
> + encl->secs.epc_page = NULL;
> + } else if (atomic_read(&encl->flags) & SGX_ENCL_INITIALIZED) {
> + ret = sgx_encl_get_backing(encl, PFN_DOWN(encl->size),
> + &secs_backing);
> + if (ret)
> + goto out;
> +
> + sgx_encl_ewb(encl->secs.epc_page, &secs_backing);
> +
> + sgx_free_page(encl->secs.epc_page);
> + encl->secs.epc_page = NULL;
> +
> + sgx_encl_put_backing(&secs_backing, true);
> + }
> + }
> +
> +out:
> + mutex_unlock(&encl->lock);
> +}
s/supprt/support
On Wed, Mar 04, 2020 at 01:35:54AM +0200, Jarkko Sakkinen wrote:
> @@ -123,13 +132,21 @@ void init_ia32_feat_ctl(struct cpuinfo_x86 *c)
> msr |= FEAT_CTL_VMX_ENABLED_INSIDE_SMX;
> }
>
> + /*
> + * Enable SGX if and only if the kernel supports SGX and Launch Control
> + * is supported, i.e. disable SGX if the LE hash MSRs can't be written.
> + */
> + if (cpu_has(c, X86_FEATURE_SGX) && cpu_has(c, X86_FEATURE_SGX_LC) &&
> + IS_ENABLED(CONFIG_INTEL_SGX))
This should probably check X86_FEATURE_SGX1 to handle the (unlikely) case
where SGX is supported but is soft disabled, e.g. due to a (corrected) #MC.
> + msr |= FEAT_CTL_SGX_ENABLED | FEAT_CTL_SGX_LC_ENABLED;
> +
> wrmsrl(MSR_IA32_FEAT_CTL, msr);
>
> update_caps:
> set_cpu_cap(c, X86_FEATURE_MSR_IA32_FEAT_CTL);
>
> if (!cpu_has(c, X86_FEATURE_VMX))
> - return;
> + goto update_sgx;
>
> if ( (tboot && !(msr & FEAT_CTL_VMX_ENABLED_INSIDE_SMX)) ||
> (!tboot && !(msr & FEAT_CTL_VMX_ENABLED_OUTSIDE_SMX))) {
> @@ -142,4 +159,14 @@ void init_ia32_feat_ctl(struct cpuinfo_x86 *c)
> init_vmx_capabilities(c);
> #endif
> }
> +
> +update_sgx:
> + if (!cpu_has(c, X86_FEATURE_SGX) || !cpu_has(c, X86_FEATURE_SGX_LC)) {
Same thing here for SGX1. Since the checks are getting rather lengthy, it
probably makes sense to consolidate the logic using a local bool, e.g. as a
delta patch:
---
arch/x86/kernel/cpu/feat_ctl.c | 25 ++++++++++++++-----------
1 file changed, 14 insertions(+), 11 deletions(-)
diff --git a/arch/x86/kernel/cpu/feat_ctl.c b/arch/x86/kernel/cpu/feat_ctl.c
index b16b71a6da74..ef4ddd6c8630 100644
--- a/arch/x86/kernel/cpu/feat_ctl.c
+++ b/arch/x86/kernel/cpu/feat_ctl.c
@@ -103,6 +103,7 @@ static void clear_sgx_caps(void)
void init_ia32_feat_ctl(struct cpuinfo_x86 *c)
{
bool tboot = tboot_enabled();
+ bool enable_sgx;
u64 msr;
if (rdmsrl_safe(MSR_IA32_FEAT_CTL, &msr)) {
@@ -111,6 +112,15 @@ void init_ia32_feat_ctl(struct cpuinfo_x86 *c)
return;
}
+ /*
+ * Enable SGX if and only if the kernel supports SGX and Launch Control
+ * is supported, i.e. disable SGX if the LE hash MSRs can't be written.
+ */
+ enable_sgx = cpu_has(c, X86_FEATURE_SGX) &&
+ cpu_has(c, X86_FEATURE_SGX1) &&
+ cpu_has(c, X86_FEATURE_SGX_LC) &&
+ IS_ENABLED(CONFIG_INTEL_SGX);
+
if (msr & FEAT_CTL_LOCKED)
goto update_caps;
@@ -132,12 +142,7 @@ void init_ia32_feat_ctl(struct cpuinfo_x86 *c)
msr |= FEAT_CTL_VMX_ENABLED_INSIDE_SMX;
}
- /*
- * Enable SGX if and only if the kernel supports SGX and Launch Control
- * is supported, i.e. disable SGX if the LE hash MSRs can't be written.
- */
- if (cpu_has(c, X86_FEATURE_SGX) && cpu_has(c, X86_FEATURE_SGX_LC) &&
- IS_ENABLED(CONFIG_INTEL_SGX))
+ if (enable_sgx)
msr |= FEAT_CTL_SGX_ENABLED | FEAT_CTL_SGX_LC_ENABLED;
wrmsrl(MSR_IA32_FEAT_CTL, msr);
@@ -161,11 +166,9 @@ void init_ia32_feat_ctl(struct cpuinfo_x86 *c)
}
update_sgx:
- if (!cpu_has(c, X86_FEATURE_SGX) || !cpu_has(c, X86_FEATURE_SGX_LC)) {
- clear_sgx_caps();
- } else if (!(msr & FEAT_CTL_SGX_ENABLED) ||
- !(msr & FEAT_CTL_SGX_LC_ENABLED)) {
- if (IS_ENABLED(CONFIG_INTEL_SGX))
+ if (!(msr & FEAT_CTL_SGX_ENABLED) ||
+ !(msr & FEAT_CTL_SGX_LC_ENABLED) || !enable_sgx) {
+ if (enable_sgx)
pr_err_once("SGX disabled by BIOS\n");
clear_sgx_caps();
}
--
2.24.1
> + clear_sgx_caps();
> + } else if (!(msr & FEAT_CTL_SGX_ENABLED) ||
> + !(msr & FEAT_CTL_SGX_LC_ENABLED)) {
> + if (IS_ENABLED(CONFIG_INTEL_SGX))
> + pr_err_once("SGX disabled by BIOS\n");
> + clear_sgx_caps();
> + }
> }
> --
> 2.25.0
>
On Sat, Mar 07, 2020 at 11:42:23AM -0600, Dr. Greg wrote:
> On Fri, Mar 06, 2020 at 09:07:53PM +0200, Jarkko Sakkinen wrote:
>
> Good morning, I hope the weekend is going well for everyone.
>
> > Actually many people have applaused to have a small scoped, even if
> > not perfect, test program to look at how SGX works. One that is only
> > dependent on glibc. None of the selftests are meant to be production
> > peaces of code. You are getting wrong the role of the selftest in
> > the first place.
>
> We certainly want to be counted in the camp of those who are
> applausing you for making the selftests available, particularly the
> new VDSO setup and entry code.
>
> We arguably have similar motivations. We architected and authored an
> entire SGX runtime that has as its only dependencies the MUSL C
> library, libelf and OpenSSL, primarily because we needed an easily
> auditable and low footprint SGX implementation.
Good to hear!
> To the point at hand though, I'm certainly not a very smart guy so I
> doubt that I am able to understand the role of the selftests. We do
> seem to agree though that they only provide a rudimentary exercise of
> the driver.
The role of kselftests is not to be production code. They are somewhat
adhoc pieces of code that just check that "things turn on" e.g. in a
new kernel release or a new hardware platform.
> We also seem to agree that the primary role of the driver is to
> service the needs of those of us that are building production level
> SGX runtime stacks. In service of that premise, it would be helpful
> to know if you are internally testing the driver/VDSO against enclaves
> of production quality, with metadata, or just the two page selftest
> enclave.
I do agree that a more complete test suite would be an essential thing
to have. In that I'd just use the SDK and implement it outside the
kernel tree.
Unfortunately I do not have time to implement such.
/Jarkko
On Thu, 05 Mar 2020 23:32:10 -0600, Dr. Greg <[email protected]> wrote:
> On Wed, Mar 04, 2020 at 01:36:01AM +0200, Jarkko Sakkinen wrote:
>
> Good evening, I hope the end of the week is going well for everyone.
>
>> Add a selftest for SGX. It is a trivial test where a simple enclave
>> copies one 64-bit word of memory between two memory locations given
>> to the enclave as arguments. Use ENCLS[EENTER] to invoke the
>> enclave.
>
> Just as a clarification, are you testing the new driver against signed
> production class enclaves in .so format that also include metadata
> layout directives or is the driver just getting tested against the two
> page toy enclave that copies a word of memory from one memory location
> to another?
>
We (Intel SGX SDK/PSW team) tested this driver for enclaves in .so format
with metadata. Our 2.8 release supports v24 and 2.9 supports v25+. Both
production signed and debug signed enclaves worked.
*Note* we did make some code changes in our runtime for v24+, mainly
dealing with src & EPC page alignment for EADD, open one fd per enclave,
use -z noexecstack linker option, etc. You can see the changes on GitHub.
> Our PSW/runtime is currently failing to initialize production class
> enclaves secondary to a return value of -4 from the ENCLU[EINIT]
> instruction, which means the measurement of the loaded enclave has
> failed to match the value in the signature structure.
>
> The same enclave loads fine with the out of kernel driver. Our
> diagnostics tell us we are feeding identical page streams and
> permissions to the page add ioctl's of both drivers. The identity
> modulus signature of the signing key for the enclave is being written
> to the launch control registers.
>
> We see the same behavior from both our unit test enclaves and the
> Quoting Enclave from the Intel SGX runtime.
>
We did not see any issue loading QE in our tests. Please directly email me
on this test if you have specific questions.
> When we ported our runtime loader to the new driver ABI we kept things
> simple and add only a single page at a time in order to replicate the
> behavior of the old driver.
>
> Secondly, we were wondering what distribution you are building the
> self-tests with? Initial indications are that the selftest signing
> utility doesn't build properly with OpenSSL 1.1.1.
>
> Have a good day.
>
> Dr. Greg
>
> As always,
> Dr. Greg Wettstein, Ph.D, Worker
> IDfusion, LLC SGX secured infrastructure and
> 4206 N. 19th Ave. autonomously self-defensive platforms.
> Fargo, ND 58102
> PH: 701-281-1686 EMAIL: [email protected]
> ------------------------------------------------------------------------------
> "Don't worry about people stealing your ideas. If your ideas are any
> good, you'll have to ram them down people's throats."
> -- Howard Aiken
--
Using Opera's mail client: http://www.opera.com/mail/
On Tue, Mar 10, 2020 at 02:29:41PM -0500, Haitao Huang wrote:
Good morning, I hope this note finds the week going well for everyone.
> On Thu, 05 Mar 2020 23:32:10 -0600, Dr. Greg <[email protected]> wrote:
>
> >On Wed, Mar 04, 2020 at 01:36:01AM +0200, Jarkko Sakkinen wrote:
> >
> >Good evening, I hope the end of the week is going well for everyone.
> >
> >>Add a selftest for SGX. It is a trivial test where a simple enclave
> >>copies one 64-bit word of memory between two memory locations given
> >>to the enclave as arguments. Use ENCLS[EENTER] to invoke the
> >>enclave.
> >
> >Just as a clarification, are you testing the new driver against signed
> >production class enclaves in .so format that also include metadata
> >layout directives or is the driver just getting tested against the two
> >page toy enclave that copies a word of memory from one memory location
> >to another?
> We (Intel SGX SDK/PSW team) tested this driver for enclaves in .so
> format with metadata. Our 2.8 release supports v24 and 2.9 supports
> v25+. Both production signed and debug signed enclaves worked.
Very good, this was the feedback we were hoping to get.
> *Note* we did make some code changes in our runtime for v24+, mainly
> dealing with src & EPC page alignment for EADD, open one fd per
> enclave, use -z noexecstack linker option, etc. You can see the
> changes on GitHub.
Yes, we made all of those changes as well, in a similar fashion.
This was the third time that we have changed the enclave creation
mmap() and alignment constraints, only to take us back to what we had
started with... :-)(
> >Our PSW/runtime is currently failing to initialize production class
> >enclaves secondary to a return value of -4 from the ENCLU[EINIT]
> >instruction, which means the measurement of the loaded enclave has
> >failed to match the value in the signature structure.
> >
> >The same enclave loads fine with the out of kernel driver. Our
> >diagnostics tell us we are feeding identical page streams and
> >permissions to the page add ioctl's of both drivers. The identity
> >modulus signature of the signing key for the enclave is being written
> >to the launch control registers.
> >
> >We see the same behavior from both our unit test enclaves and the
> >Quoting Enclave from the Intel SGX runtime.
> We did not see any issue loading QE in our tests. Please directly
> email me on this test if you have specific questions.
It isn't anything specific to the QE, we just used that as an example,
since it has no special attribute requirements and would seem to be a
good reference test for everyone working on runtimes.
We are missing some nuance with the latest version of the driver, our
runtime was working fine with the new driver a year ago.
It almost has to be a problem with metadata, we are suspicious of
guard page processing.
We are following the same strategy that we had used previously and
leaving a 'hole' in the enclave for each guard page at its RVA offset.
The comment in the add page ioctl indicating that the page range has
to be contiguous caught our eye and has us questioning if this
continues to be the correct approach.
Do you remember, off the top of your head, having to address guard
pages differently?
Have a good remainder of the week.
Dr. Greg
> Using Opera's mail client: http://www.opera.com/mail/
As always,
Dr. Greg Wettstein, Ph.D, Worker
IDfusion, LLC SGX secured infrastructure and
4206 N. 19th Ave. autonomously self-defensive platforms.
Fargo, ND 58102
PH: 701-281-1686 EMAIL: [email protected]
------------------------------------------------------------------------------
"Work makes life enjoyable."
-- North Dakota Germans
On Thu, Mar 05, 2020 at 01:33:28PM +0200, Jarkko Sakkinen wrote:
> On Wed, 2020-03-04 at 14:27 -0500, Nathaniel McCallum wrote:
> > > > +xsave_area:
> > > + .fill 1, 4, 0x037F # FCW
> > > + .fill 5, 4, 0
> > > + .fill 1, 4, 0x1F80 # MXCSR
> > > + .fill 1, 4, 0xFFFF # MXCSR_MASK
> > > + .fill 123, 4, 0
> > > + .fill 1, 4, 0x80000000 # XCOMP_BV[63] = 1, compaction mode
> > > + .fill 12, 4, 0
> >
> > I find this much more readable:
>
> And I always aim to get things more readable. Thank you.
>
> > xsave_area:
> > # Legacy
> > .fill 1, 4, 0x037F # FCW
> > .fill 5, 4, 0
> > .fill 1, 4, 0x1F80 # MXCSR
> > .fill 1, 4, 0xFFFF # MXCSR_MASK
> > .fill 60, 8, 0
> >
> > # Header
> > .fill 1, 8, 0 # XSTATE_BV
> > .fill 1, 8, 1 << 63 # XCOMP_BV (compaction mode)
> > .fill 6, 8, 0
> >
> > Also, since people are likely to copy this code for their own
> > enclaves, it would be helpful to document which flags are set in FCW
> > and MXCSR.
>
> It was meant as a test program but I'd guess what you say is true
> because it also might be the only alternative user space to Intel's
> :-) And a great starting point if you want to do things from scratch.
>
> Because I meant it as a smoke test program for SGX, not everything is
> too well documented but given the multipurpose use for that code I'll
> make the improvements that you are suggesting.
For FPU Control World (FCW), I think 0x037F is not the right value even
if section 18.5 in the x86 SDM says that it is the initial value for it.
I took that value from that section.
The reason I think that there is an error in the SDM is that if you look
at the section 8.1.5, you'll see that bit 6 is a reserved bit. Thus,
does not make to set it on.
I think the legit value ought to be 0x33F i.e. unset bit 6.
In any case check:
https://raw.githubusercontent.com/jsakkine-intel/linux-sgx/master/tools/testing/selftests/x86/sgx/encl_bootstrap.S
I.e. both have now a reference:
1. To the section that describes the default.
2. To the section that describes what the bits mean.
/Jarkko
On Wed, Mar 11, 2020 at 03:28:32PM +0200, Jarkko Sakkinen wrote:
> On Thu, Mar 05, 2020 at 01:33:28PM +0200, Jarkko Sakkinen wrote:
> > On Wed, 2020-03-04 at 14:27 -0500, Nathaniel McCallum wrote:
> > > > > +xsave_area:
> > > > + .fill 1, 4, 0x037F # FCW
> > > > + .fill 5, 4, 0
> > > > + .fill 1, 4, 0x1F80 # MXCSR
> > > > + .fill 1, 4, 0xFFFF # MXCSR_MASK
> > > > + .fill 123, 4, 0
> > > > + .fill 1, 4, 0x80000000 # XCOMP_BV[63] = 1, compaction mode
> > > > + .fill 12, 4, 0
> > >
> > > I find this much more readable:
> >
> > And I always aim to get things more readable. Thank you.
> >
> > > xsave_area:
> > > # Legacy
> > > .fill 1, 4, 0x037F # FCW
> > > .fill 5, 4, 0
> > > .fill 1, 4, 0x1F80 # MXCSR
> > > .fill 1, 4, 0xFFFF # MXCSR_MASK
> > > .fill 60, 8, 0
> > >
> > > # Header
> > > .fill 1, 8, 0 # XSTATE_BV
> > > .fill 1, 8, 1 << 63 # XCOMP_BV (compaction mode)
> > > .fill 6, 8, 0
> > >
> > > Also, since people are likely to copy this code for their own
> > > enclaves, it would be helpful to document which flags are set in FCW
> > > and MXCSR.
> >
> > It was meant as a test program but I'd guess what you say is true
> > because it also might be the only alternative user space to Intel's
> > :-) And a great starting point if you want to do things from scratch.
> >
> > Because I meant it as a smoke test program for SGX, not everything is
> > too well documented but given the multipurpose use for that code I'll
> > make the improvements that you are suggesting.
>
> For FPU Control World (FCW), I think 0x037F is not the right value even
> if section 18.5 in the x86 SDM says that it is the initial value for it.
>
> I took that value from that section.
>
> The reason I think that there is an error in the SDM is that if you look
> at the section 8.1.5, you'll see that bit 6 is a reserved bit. Thus,
> does not make to set it on.
>
> I think the legit value ought to be 0x33F i.e. unset bit 6.
Bit 6 is reserved, but it's forced to '1' by the CPU.
Regardless, IMO it'd be better to drop this code entirely, it's all kinds
of wonky. The label says "xsave_area" and implies XSAVE state is being
loaded, but the code uses FXRSTOR, which will only load x86/MMX/XMM state,
i.e. the first 512 bytes of the so called xsave_area.
The test enclave doesn't touch state managed by XSAVE, let alone put
secrets into said state. I see no reason to bother purging anything.
> In any case check:
>
> https://raw.githubusercontent.com/jsakkine-intel/linux-sgx/master/tools/testing/selftests/x86/sgx/encl_bootstrap.S
>
> I.e. both have now a reference:
>
> 1. To the section that describes the default.
> 2. To the section that describes what the bits mean.
>
> /Jarkko
On Mon, Mar 09, 2020 at 02:56:22PM -0700, Sean Christopherson wrote:
> s/supprt/support
Summary:
* Selftest: document FCW and MXCSR settings in the XSAVE template.
* Use WARN_ONCE() in ENCLS_WARN() instead of WARN().
* Use ENCLS_WARN() instead of WARN() in sgx_reclaimer_write().
* Clean up SGX detection and explicitly check SGX1 support.
to address the findings. The GIT tree is in sync with these updates.
/Jarkko
On Wed, 11 Mar 2020 04:13:13 -0500, Dr. Greg <[email protected]> wrote:
...
>
> Do you remember, off the top of your head, having to address guard
> pages differently?
>
No, we did not make changes specific to guard pages.
Haitao
On Tue, Mar 3, 2020 at 6:40 PM Jarkko Sakkinen
<[email protected]> wrote:
>
> From: Sean Christopherson <[email protected]>
>
> An SGX runtime must be aware of the exceptions, which happen inside an
> enclave. Introduce a vDSO call that wraps EENTER/ERESUME cycle and returns
> the CPU exception back to the caller exactly when it happens.
>
> Kernel fixups the exception information to RDI, RSI and RDX. The SGX call
> vDSO handler fills this information to the user provided buffer or
> alternatively trigger user provided callback at the time of the exception.
>
> The calling convention is custom and does not follow System V x86-64 ABI.
>
> Suggested-by: Andy Lutomirski <[email protected]>
> Signed-off-by: Sean Christopherson <[email protected]>
> Co-developed-by: Cedric Xing <[email protected]>
> Signed-off-by: Cedric Xing <[email protected]>
> Tested-by: Jethro Beekman <[email protected]>
> Signed-off-by: Jarkko Sakkinen <[email protected]>
> ---
> arch/x86/entry/vdso/Makefile | 2 +
> arch/x86/entry/vdso/vdso.lds.S | 1 +
> arch/x86/entry/vdso/vsgx_enter_enclave.S | 187 +++++++++++++++++++++++
> arch/x86/include/uapi/asm/sgx.h | 37 +++++
> 4 files changed, 227 insertions(+)
> create mode 100644 arch/x86/entry/vdso/vsgx_enter_enclave.S
>
> diff --git a/arch/x86/entry/vdso/Makefile b/arch/x86/entry/vdso/Makefile
> index 657e01d34d02..fa50c76a17a8 100644
> --- a/arch/x86/entry/vdso/Makefile
> +++ b/arch/x86/entry/vdso/Makefile
> @@ -24,6 +24,7 @@ VDSO32-$(CONFIG_IA32_EMULATION) := y
>
> # files to link into the vdso
> vobjs-y := vdso-note.o vclock_gettime.o vgetcpu.o
> +vobjs-$(VDSO64-y) += vsgx_enter_enclave.o
>
> # files to link into kernel
> obj-y += vma.o extable.o
> @@ -90,6 +91,7 @@ $(vobjs): KBUILD_CFLAGS := $(filter-out $(GCC_PLUGINS_CFLAGS) $(RETPOLINE_CFLAGS
> CFLAGS_REMOVE_vclock_gettime.o = -pg
> CFLAGS_REMOVE_vdso32/vclock_gettime.o = -pg
> CFLAGS_REMOVE_vgetcpu.o = -pg
> +CFLAGS_REMOVE_vsgx_enter_enclave.o = -pg
>
> #
> # X32 processes use x32 vDSO to access 64bit kernel data.
> diff --git a/arch/x86/entry/vdso/vdso.lds.S b/arch/x86/entry/vdso/vdso.lds.S
> index 36b644e16272..4bf48462fca7 100644
> --- a/arch/x86/entry/vdso/vdso.lds.S
> +++ b/arch/x86/entry/vdso/vdso.lds.S
> @@ -27,6 +27,7 @@ VERSION {
> __vdso_time;
> clock_getres;
> __vdso_clock_getres;
> + __vdso_sgx_enter_enclave;
> local: *;
> };
> }
> diff --git a/arch/x86/entry/vdso/vsgx_enter_enclave.S b/arch/x86/entry/vdso/vsgx_enter_enclave.S
> new file mode 100644
> index 000000000000..94a8e5f99961
> --- /dev/null
> +++ b/arch/x86/entry/vdso/vsgx_enter_enclave.S
> @@ -0,0 +1,187 @@
> +/* SPDX-License-Identifier: GPL-2.0 */
> +
> +#include <linux/linkage.h>
> +#include <asm/export.h>
> +#include <asm/errno.h>
> +
> +#include "extable.h"
> +
> +#define EX_LEAF 0*8
> +#define EX_TRAPNR 0*8+4
> +#define EX_ERROR_CODE 0*8+6
> +#define EX_ADDRESS 1*8
> +
> +.code64
> +.section .text, "ax"
> +
> +/**
> + * __vdso_sgx_enter_enclave() - Enter an SGX enclave
> + * @leaf: ENCLU leaf, must be EENTER or ERESUME
> + * @tcs: TCS, must be non-NULL
> + * @e: Optional struct sgx_enclave_exception instance
> + * @handler: Optional enclave exit handler
> + *
> + * **Important!** __vdso_sgx_enter_enclave() is **NOT** compliant with the
> + * x86-64 ABI, i.e. cannot be called from standard C code.
> + *
> + * Input ABI:
> + * @leaf %eax
> + * @tcs 8(%rsp)
> + * @e 0x10(%rsp)
> + * @handler 0x18(%rsp)
> + *
> + * Output ABI:
> + * @ret %eax
> + *
> + * All general purpose registers except RAX, RBX and RCX are passed as-is to
> + * the enclave. RAX, RBX and RCX are consumed by EENTER and ERESUME and are
> + * loaded with @leaf, asynchronous exit pointer, and @tcs respectively.
> + *
> + * RBP and the stack are used to anchor __vdso_sgx_enter_enclave() to the
> + * pre-enclave state, e.g. to retrieve @e and @handler after an enclave exit.
> + * All other registers are available for use by the enclave and its runtime,
> + * e.g. an enclave can push additional data onto the stack (and modify RSP) to
> + * pass information to the optional exit handler (see below).
> + *
> + * Most exceptions reported on ENCLU, including those that occur within the
> + * enclave, are fixed up and reported synchronously instead of being delivered
> + * via a standard signal. Debug Exceptions (#DB) and Breakpoints (#BP) are
> + * never fixed up and are always delivered via standard signals. On synchrously
> + * reported exceptions, -EFAULT is returned and details about the exception are
> + * recorded in @e, the optional sgx_enclave_exception struct.
> +
> + * If an exit handler is provided, the handler will be invoked on synchronous
> + * exits from the enclave and for all synchronously reported exceptions. In
> + * latter case, @e is filled prior to invoking the handler.
> + *
> + * The exit handler's return value is interpreted as follows:
> + * >0: continue, restart __vdso_sgx_enter_enclave() with @ret as @leaf
> + * 0: success, return @ret to the caller
> + * <0: error, return @ret to the caller
> + *
> + * The userspace exit handler is responsible for unwinding the stack, e.g. to
> + * pop @e, u_rsp and @tcs, prior to returning to __vdso_sgx_enter_enclave().
> + * The exit handler may also transfer control, e.g. via longjmp() or a C++
> + * exception, without returning to __vdso_sgx_enter_enclave().
> + *
> + * Return:
> + * 0 on success,
> + * -EINVAL if ENCLU leaf is not allowed,
> + * -EFAULT if an exception occurs on ENCLU or within the enclave
> + * -errno for all other negative values returned by the userspace exit handler
> + */
> +#ifdef SGX_KERNEL_DOC
> +/* C-style function prototype to coerce kernel-doc into parsing the comment. */
> +int __vdso_sgx_enter_enclave(int leaf, void *tcs,
> + struct sgx_enclave_exception *e,
> + sgx_enclave_exit_handler_t handler);
> +#endif
> +SYM_FUNC_START(__vdso_sgx_enter_enclave)
Currently, the selftest has a wrapper around
__vdso_sgx_enter_enclave() which preserves all x86-64 ABI callee-saved
registers (CSRs), though it uses none of them. Then it calls this
function which uses %rbx but preserves none of the CSRs. Then it jumps
into an enclave which zeroes all these registers before returning.
Thus:
1. wrapper saves all CSRs
2. wrapper repositions stack arguments
3. __vdso_sgx_enter_enclave() modifies, but does not save %rbx
4. selftest zeros all CSRs
5. wrapper loads all CSRs
I'd like to propose instead that the enclave be responsible for saving
and restoring CSRs. So instead of the above we have:
1. __vdso_sgx_enter_enclave() saves %rbx
2. enclave saves CSRs
3. enclave loads CSRs
4. __vdso_sgx_enter_enclave() loads %rbx
I know that lots of other stuff happens during enclave transitions,
but at the very least we could reduce the number of instructions
through this critical path.
> + /* Prolog */
> + .cfi_startproc
> + push %rbp
> + .cfi_adjust_cfa_offset 8
> + .cfi_rel_offset %rbp, 0
> + mov %rsp, %rbp
> + .cfi_def_cfa_register %rbp
> +
> +.Lenter_enclave:
> + /* EENTER <= leaf <= ERESUME */
> + cmp $0x2, %eax
> + jb .Linvalid_leaf
> + cmp $0x3, %eax
> + ja .Linvalid_leaf
> +
> + /* Load TCS and AEP */
> + mov 0x10(%rbp), %rbx
> + lea .Lasync_exit_pointer(%rip), %rcx
> +
> + /* Single ENCLU serving as both EENTER and AEP (ERESUME) */
> +.Lasync_exit_pointer:
> +.Lenclu_eenter_eresume:
> + enclu
> +
> + /* EEXIT jumps here unless the enclave is doing something fancy. */
> + xor %eax, %eax
> +
> + /* Invoke userspace's exit handler if one was provided. */
> +.Lhandle_exit:
> + cmp $0, 0x20(%rbp)
> + jne .Linvoke_userspace_handler
> +
> +.Lout:
> + leave
> + .cfi_def_cfa %rsp, 8
> + ret
> +
> + /* The out-of-line code runs with the pre-leave stack frame. */
> + .cfi_def_cfa %rbp, 16
> +
> +.Linvalid_leaf:
> + mov $(-EINVAL), %eax
> + jmp .Lout
> +
> +.Lhandle_exception:
> + mov 0x18(%rbp), %rcx
> + test %rcx, %rcx
> + je .Lskip_exception_info
> +
> + /* Fill optional exception info. */
> + mov %eax, EX_LEAF(%rcx)
> + mov %di, EX_TRAPNR(%rcx)
> + mov %si, EX_ERROR_CODE(%rcx)
> + mov %rdx, EX_ADDRESS(%rcx)
> +.Lskip_exception_info:
> + mov $(-EFAULT), %eax
> + jmp .Lhandle_exit
> +
> +.Linvoke_userspace_handler:
> + /* Pass the untrusted RSP (at exit) to the callback via %rcx. */
> + mov %rsp, %rcx
> +
> + /* Save the untrusted RSP in %rbx (non-volatile register). */
> + mov %rsp, %rbx
> +
> + /*
> + * Align stack per x86_64 ABI. Note, %rsp needs to be 16-byte aligned
> + * _after_ pushing the parameters on the stack, hence the bonus push.
> + */
> + and $-0x10, %rsp
> + push %rax
> +
> + /* Push @e, the "return" value and @tcs as params to the callback. */
> + push 0x18(%rbp)
> + push %rax
> + push 0x10(%rbp)
> +
> + /* Clear RFLAGS.DF per x86_64 ABI */
> + cld
> +
> + /* Load the callback pointer to %rax and invoke it via retpoline. */
> + mov 0x20(%rbp), %rax
> + call .Lretpoline
> +
> + /* Restore %rsp to its post-exit value. */
> + mov %rbx, %rsp
> +
> + /*
> + * If the return from callback is zero or negative, return immediately,
> + * else re-execute ENCLU with the postive return value interpreted as
> + * the requested ENCLU leaf.
> + */
> + cmp $0, %eax
> + jle .Lout
> + jmp .Lenter_enclave
> +
> +.Lretpoline:
> + call 2f
> +1: pause
> + lfence
> + jmp 1b
> +2: mov %rax, (%rsp)
> + ret
> + .cfi_endproc
> +
> +_ASM_VDSO_EXTABLE_HANDLE(.Lenclu_eenter_eresume, .Lhandle_exception)
> +
> +SYM_FUNC_END(__vdso_sgx_enter_enclave)
> diff --git a/arch/x86/include/uapi/asm/sgx.h b/arch/x86/include/uapi/asm/sgx.h
> index 57d0d30c79b3..e196cfd44b70 100644
> --- a/arch/x86/include/uapi/asm/sgx.h
> +++ b/arch/x86/include/uapi/asm/sgx.h
> @@ -74,4 +74,41 @@ struct sgx_enclave_set_attribute {
> __u64 attribute_fd;
> };
>
> +/**
> + * struct sgx_enclave_exception - structure to report exceptions encountered in
> + * __vdso_sgx_enter_enclave()
> + *
> + * @leaf: ENCLU leaf from \%eax at time of exception
> + * @trapnr: exception trap number, a.k.a. fault vector
> + * @error_code: exception error code
> + * @address: exception address, e.g. CR2 on a #PF
> + * @reserved: reserved for future use
> + */
> +struct sgx_enclave_exception {
> + __u32 leaf;
> + __u16 trapnr;
> + __u16 error_code;
> + __u64 address;
> + __u64 reserved[2];
> +};
> +
> +/**
> + * typedef sgx_enclave_exit_handler_t - Exit handler function accepted by
> + * __vdso_sgx_enter_enclave()
> + *
> + * @rdi: RDI at the time of enclave exit
> + * @rsi: RSI at the time of enclave exit
> + * @rdx: RDX at the time of enclave exit
> + * @ursp: RSP at the time of enclave exit (untrusted stack)
> + * @r8: R8 at the time of enclave exit
> + * @r9: R9 at the time of enclave exit
> + * @tcs: Thread Control Structure used to enter enclave
> + * @ret: 0 on success (EEXIT), -EFAULT on an exception
> + * @e: Pointer to struct sgx_enclave_exception (as provided by caller)
> + */
> +typedef int (*sgx_enclave_exit_handler_t)(long rdi, long rsi, long rdx,
> + long ursp, long r8, long r9,
> + void *tcs, int ret,
> + struct sgx_enclave_exception *e);
> +
> #endif /* _UAPI_ASM_X86_SGX_H */
> --
> 2.25.0
>
On 2020-03-11 18:30, Nathaniel McCallum wrote:
> On Tue, Mar 3, 2020 at 6:40 PM Jarkko Sakkinen
> <[email protected]> wrote:
>>
>> From: Sean Christopherson <[email protected]>
>>
>> An SGX runtime must be aware of the exceptions, which happen inside an
>> enclave. Introduce a vDSO call that wraps EENTER/ERESUME cycle and returns
>> the CPU exception back to the caller exactly when it happens.
>>
>> Kernel fixups the exception information to RDI, RSI and RDX. The SGX call
>> vDSO handler fills this information to the user provided buffer or
>> alternatively trigger user provided callback at the time of the exception.
>>
>> The calling convention is custom and does not follow System V x86-64 ABI.
>>
>> Suggested-by: Andy Lutomirski <[email protected]>
>> Signed-off-by: Sean Christopherson <[email protected]>
>> Co-developed-by: Cedric Xing <[email protected]>
>> Signed-off-by: Cedric Xing <[email protected]>
>> Tested-by: Jethro Beekman <[email protected]>
>> Signed-off-by: Jarkko Sakkinen <[email protected]>
>> ---
>> arch/x86/entry/vdso/Makefile | 2 +
>> arch/x86/entry/vdso/vdso.lds.S | 1 +
>> arch/x86/entry/vdso/vsgx_enter_enclave.S | 187 +++++++++++++++++++++++
>> arch/x86/include/uapi/asm/sgx.h | 37 +++++
>> 4 files changed, 227 insertions(+)
>> create mode 100644 arch/x86/entry/vdso/vsgx_enter_enclave.S
>>
>> diff --git a/arch/x86/entry/vdso/Makefile b/arch/x86/entry/vdso/Makefile
>> index 657e01d34d02..fa50c76a17a8 100644
>> --- a/arch/x86/entry/vdso/Makefile
>> +++ b/arch/x86/entry/vdso/Makefile
>> @@ -24,6 +24,7 @@ VDSO32-$(CONFIG_IA32_EMULATION) := y
>>
>> # files to link into the vdso
>> vobjs-y := vdso-note.o vclock_gettime.o vgetcpu.o
>> +vobjs-$(VDSO64-y) += vsgx_enter_enclave.o
>>
>> # files to link into kernel
>> obj-y += vma.o extable.o
>> @@ -90,6 +91,7 @@ $(vobjs): KBUILD_CFLAGS := $(filter-out $(GCC_PLUGINS_CFLAGS) $(RETPOLINE_CFLAGS
>> CFLAGS_REMOVE_vclock_gettime.o = -pg
>> CFLAGS_REMOVE_vdso32/vclock_gettime.o = -pg
>> CFLAGS_REMOVE_vgetcpu.o = -pg
>> +CFLAGS_REMOVE_vsgx_enter_enclave.o = -pg
>>
>> #
>> # X32 processes use x32 vDSO to access 64bit kernel data.
>> diff --git a/arch/x86/entry/vdso/vdso.lds.S b/arch/x86/entry/vdso/vdso.lds.S
>> index 36b644e16272..4bf48462fca7 100644
>> --- a/arch/x86/entry/vdso/vdso.lds.S
>> +++ b/arch/x86/entry/vdso/vdso.lds.S
>> @@ -27,6 +27,7 @@ VERSION {
>> __vdso_time;
>> clock_getres;
>> __vdso_clock_getres;
>> + __vdso_sgx_enter_enclave;
>> local: *;
>> };
>> }
>> diff --git a/arch/x86/entry/vdso/vsgx_enter_enclave.S b/arch/x86/entry/vdso/vsgx_enter_enclave.S
>> new file mode 100644
>> index 000000000000..94a8e5f99961
>> --- /dev/null
>> +++ b/arch/x86/entry/vdso/vsgx_enter_enclave.S
>> @@ -0,0 +1,187 @@
>> +/* SPDX-License-Identifier: GPL-2.0 */
>> +
>> +#include <linux/linkage.h>
>> +#include <asm/export.h>
>> +#include <asm/errno.h>
>> +
>> +#include "extable.h"
>> +
>> +#define EX_LEAF 0*8
>> +#define EX_TRAPNR 0*8+4
>> +#define EX_ERROR_CODE 0*8+6
>> +#define EX_ADDRESS 1*8
>> +
>> +.code64
>> +.section .text, "ax"
>> +
>> +/**
>> + * __vdso_sgx_enter_enclave() - Enter an SGX enclave
>> + * @leaf: ENCLU leaf, must be EENTER or ERESUME
>> + * @tcs: TCS, must be non-NULL
>> + * @e: Optional struct sgx_enclave_exception instance
>> + * @handler: Optional enclave exit handler
>> + *
>> + * **Important!** __vdso_sgx_enter_enclave() is **NOT** compliant with the
>> + * x86-64 ABI, i.e. cannot be called from standard C code.
>> + *
>> + * Input ABI:
>> + * @leaf %eax
>> + * @tcs 8(%rsp)
>> + * @e 0x10(%rsp)
>> + * @handler 0x18(%rsp)
>> + *
>> + * Output ABI:
>> + * @ret %eax
>> + *
>> + * All general purpose registers except RAX, RBX and RCX are passed as-is to
>> + * the enclave. RAX, RBX and RCX are consumed by EENTER and ERESUME and are
>> + * loaded with @leaf, asynchronous exit pointer, and @tcs respectively.
>> + *
>> + * RBP and the stack are used to anchor __vdso_sgx_enter_enclave() to the
>> + * pre-enclave state, e.g. to retrieve @e and @handler after an enclave exit.
>> + * All other registers are available for use by the enclave and its runtime,
>> + * e.g. an enclave can push additional data onto the stack (and modify RSP) to
>> + * pass information to the optional exit handler (see below).
>> + *
>> + * Most exceptions reported on ENCLU, including those that occur within the
>> + * enclave, are fixed up and reported synchronously instead of being delivered
>> + * via a standard signal. Debug Exceptions (#DB) and Breakpoints (#BP) are
>> + * never fixed up and are always delivered via standard signals. On synchrously
>> + * reported exceptions, -EFAULT is returned and details about the exception are
>> + * recorded in @e, the optional sgx_enclave_exception struct.
>> +
>> + * If an exit handler is provided, the handler will be invoked on synchronous
>> + * exits from the enclave and for all synchronously reported exceptions. In
>> + * latter case, @e is filled prior to invoking the handler.
>> + *
>> + * The exit handler's return value is interpreted as follows:
>> + * >0: continue, restart __vdso_sgx_enter_enclave() with @ret as @leaf
>> + * 0: success, return @ret to the caller
>> + * <0: error, return @ret to the caller
>> + *
>> + * The userspace exit handler is responsible for unwinding the stack, e.g. to
>> + * pop @e, u_rsp and @tcs, prior to returning to __vdso_sgx_enter_enclave().
>> + * The exit handler may also transfer control, e.g. via longjmp() or a C++
>> + * exception, without returning to __vdso_sgx_enter_enclave().
>> + *
>> + * Return:
>> + * 0 on success,
>> + * -EINVAL if ENCLU leaf is not allowed,
>> + * -EFAULT if an exception occurs on ENCLU or within the enclave
>> + * -errno for all other negative values returned by the userspace exit handler
>> + */
>> +#ifdef SGX_KERNEL_DOC
>> +/* C-style function prototype to coerce kernel-doc into parsing the comment. */
>> +int __vdso_sgx_enter_enclave(int leaf, void *tcs,
>> + struct sgx_enclave_exception *e,
>> + sgx_enclave_exit_handler_t handler);
>> +#endif
>> +SYM_FUNC_START(__vdso_sgx_enter_enclave)
>
> Currently, the selftest has a wrapper around
> __vdso_sgx_enter_enclave() which preserves all x86-64 ABI callee-saved
> registers (CSRs), though it uses none of them. Then it calls this
> function which uses %rbx but preserves none of the CSRs. Then it jumps
> into an enclave which zeroes all these registers before returning.
> Thus:
>
> 1. wrapper saves all CSRs
> 2. wrapper repositions stack arguments
> 3. __vdso_sgx_enter_enclave() modifies, but does not save %rbx
> 4. selftest zeros all CSRs
> 5. wrapper loads all CSRs
>
> I'd like to propose instead that the enclave be responsible for saving
> and restoring CSRs. So instead of the above we have:
> 1. __vdso_sgx_enter_enclave() saves %rbx
> 2. enclave saves CSRs
> 3. enclave loads CSRs
> 4. __vdso_sgx_enter_enclave() loads %rbx
>
> I know that lots of other stuff happens during enclave transitions,
> but at the very least we could reduce the number of instructions
> through this critical path.
The current calling convention for __vdso_sgx_enter_enclave has been carefully designed to mimic just calling ENCLU[EENTER] as closely as possible.
I'm not sure why you're referring to the selftest wrapper here, that doesn't seem relevant to me.
--
Jethro Beekman | Fortanix
On Wed, Mar 11, 2020 at 1:38 PM Jethro Beekman <[email protected]> wrote:
>
> On 2020-03-11 18:30, Nathaniel McCallum wrote:
> > On Tue, Mar 3, 2020 at 6:40 PM Jarkko Sakkinen
> > <[email protected]> wrote:
> >>
> >> From: Sean Christopherson <[email protected]>
> >>
> >> An SGX runtime must be aware of the exceptions, which happen inside an
> >> enclave. Introduce a vDSO call that wraps EENTER/ERESUME cycle and returns
> >> the CPU exception back to the caller exactly when it happens.
> >>
> >> Kernel fixups the exception information to RDI, RSI and RDX. The SGX call
> >> vDSO handler fills this information to the user provided buffer or
> >> alternatively trigger user provided callback at the time of the exception.
> >>
> >> The calling convention is custom and does not follow System V x86-64 ABI.
> >>
> >> Suggested-by: Andy Lutomirski <[email protected]>
> >> Signed-off-by: Sean Christopherson <[email protected]>
> >> Co-developed-by: Cedric Xing <[email protected]>
> >> Signed-off-by: Cedric Xing <[email protected]>
> >> Tested-by: Jethro Beekman <[email protected]>
> >> Signed-off-by: Jarkko Sakkinen <[email protected]>
> >> ---
> >> arch/x86/entry/vdso/Makefile | 2 +
> >> arch/x86/entry/vdso/vdso.lds.S | 1 +
> >> arch/x86/entry/vdso/vsgx_enter_enclave.S | 187 +++++++++++++++++++++++
> >> arch/x86/include/uapi/asm/sgx.h | 37 +++++
> >> 4 files changed, 227 insertions(+)
> >> create mode 100644 arch/x86/entry/vdso/vsgx_enter_enclave.S
> >>
> >> diff --git a/arch/x86/entry/vdso/Makefile b/arch/x86/entry/vdso/Makefile
> >> index 657e01d34d02..fa50c76a17a8 100644
> >> --- a/arch/x86/entry/vdso/Makefile
> >> +++ b/arch/x86/entry/vdso/Makefile
> >> @@ -24,6 +24,7 @@ VDSO32-$(CONFIG_IA32_EMULATION) := y
> >>
> >> # files to link into the vdso
> >> vobjs-y := vdso-note.o vclock_gettime.o vgetcpu.o
> >> +vobjs-$(VDSO64-y) += vsgx_enter_enclave.o
> >>
> >> # files to link into kernel
> >> obj-y += vma.o extable.o
> >> @@ -90,6 +91,7 @@ $(vobjs): KBUILD_CFLAGS := $(filter-out $(GCC_PLUGINS_CFLAGS) $(RETPOLINE_CFLAGS
> >> CFLAGS_REMOVE_vclock_gettime.o = -pg
> >> CFLAGS_REMOVE_vdso32/vclock_gettime.o = -pg
> >> CFLAGS_REMOVE_vgetcpu.o = -pg
> >> +CFLAGS_REMOVE_vsgx_enter_enclave.o = -pg
> >>
> >> #
> >> # X32 processes use x32 vDSO to access 64bit kernel data.
> >> diff --git a/arch/x86/entry/vdso/vdso.lds.S b/arch/x86/entry/vdso/vdso.lds.S
> >> index 36b644e16272..4bf48462fca7 100644
> >> --- a/arch/x86/entry/vdso/vdso.lds.S
> >> +++ b/arch/x86/entry/vdso/vdso.lds.S
> >> @@ -27,6 +27,7 @@ VERSION {
> >> __vdso_time;
> >> clock_getres;
> >> __vdso_clock_getres;
> >> + __vdso_sgx_enter_enclave;
> >> local: *;
> >> };
> >> }
> >> diff --git a/arch/x86/entry/vdso/vsgx_enter_enclave.S b/arch/x86/entry/vdso/vsgx_enter_enclave.S
> >> new file mode 100644
> >> index 000000000000..94a8e5f99961
> >> --- /dev/null
> >> +++ b/arch/x86/entry/vdso/vsgx_enter_enclave.S
> >> @@ -0,0 +1,187 @@
> >> +/* SPDX-License-Identifier: GPL-2.0 */
> >> +
> >> +#include <linux/linkage.h>
> >> +#include <asm/export.h>
> >> +#include <asm/errno.h>
> >> +
> >> +#include "extable.h"
> >> +
> >> +#define EX_LEAF 0*8
> >> +#define EX_TRAPNR 0*8+4
> >> +#define EX_ERROR_CODE 0*8+6
> >> +#define EX_ADDRESS 1*8
> >> +
> >> +.code64
> >> +.section .text, "ax"
> >> +
> >> +/**
> >> + * __vdso_sgx_enter_enclave() - Enter an SGX enclave
> >> + * @leaf: ENCLU leaf, must be EENTER or ERESUME
> >> + * @tcs: TCS, must be non-NULL
> >> + * @e: Optional struct sgx_enclave_exception instance
> >> + * @handler: Optional enclave exit handler
> >> + *
> >> + * **Important!** __vdso_sgx_enter_enclave() is **NOT** compliant with the
> >> + * x86-64 ABI, i.e. cannot be called from standard C code.
> >> + *
> >> + * Input ABI:
> >> + * @leaf %eax
> >> + * @tcs 8(%rsp)
> >> + * @e 0x10(%rsp)
> >> + * @handler 0x18(%rsp)
> >> + *
> >> + * Output ABI:
> >> + * @ret %eax
> >> + *
> >> + * All general purpose registers except RAX, RBX and RCX are passed as-is to
> >> + * the enclave. RAX, RBX and RCX are consumed by EENTER and ERESUME and are
> >> + * loaded with @leaf, asynchronous exit pointer, and @tcs respectively.
> >> + *
> >> + * RBP and the stack are used to anchor __vdso_sgx_enter_enclave() to the
> >> + * pre-enclave state, e.g. to retrieve @e and @handler after an enclave exit.
> >> + * All other registers are available for use by the enclave and its runtime,
> >> + * e.g. an enclave can push additional data onto the stack (and modify RSP) to
> >> + * pass information to the optional exit handler (see below).
> >> + *
> >> + * Most exceptions reported on ENCLU, including those that occur within the
> >> + * enclave, are fixed up and reported synchronously instead of being delivered
> >> + * via a standard signal. Debug Exceptions (#DB) and Breakpoints (#BP) are
> >> + * never fixed up and are always delivered via standard signals. On synchrously
> >> + * reported exceptions, -EFAULT is returned and details about the exception are
> >> + * recorded in @e, the optional sgx_enclave_exception struct.
> >> +
> >> + * If an exit handler is provided, the handler will be invoked on synchronous
> >> + * exits from the enclave and for all synchronously reported exceptions. In
> >> + * latter case, @e is filled prior to invoking the handler.
> >> + *
> >> + * The exit handler's return value is interpreted as follows:
> >> + * >0: continue, restart __vdso_sgx_enter_enclave() with @ret as @leaf
> >> + * 0: success, return @ret to the caller
> >> + * <0: error, return @ret to the caller
> >> + *
> >> + * The userspace exit handler is responsible for unwinding the stack, e.g. to
> >> + * pop @e, u_rsp and @tcs, prior to returning to __vdso_sgx_enter_enclave().
> >> + * The exit handler may also transfer control, e.g. via longjmp() or a C++
> >> + * exception, without returning to __vdso_sgx_enter_enclave().
> >> + *
> >> + * Return:
> >> + * 0 on success,
> >> + * -EINVAL if ENCLU leaf is not allowed,
> >> + * -EFAULT if an exception occurs on ENCLU or within the enclave
> >> + * -errno for all other negative values returned by the userspace exit handler
> >> + */
> >> +#ifdef SGX_KERNEL_DOC
> >> +/* C-style function prototype to coerce kernel-doc into parsing the comment. */
> >> +int __vdso_sgx_enter_enclave(int leaf, void *tcs,
> >> + struct sgx_enclave_exception *e,
> >> + sgx_enclave_exit_handler_t handler);
> >> +#endif
> >> +SYM_FUNC_START(__vdso_sgx_enter_enclave)
> >
> > Currently, the selftest has a wrapper around
> > __vdso_sgx_enter_enclave() which preserves all x86-64 ABI callee-saved
> > registers (CSRs), though it uses none of them. Then it calls this
> > function which uses %rbx but preserves none of the CSRs. Then it jumps
> > into an enclave which zeroes all these registers before returning.
> > Thus:
> >
> > 1. wrapper saves all CSRs
> > 2. wrapper repositions stack arguments
> > 3. __vdso_sgx_enter_enclave() modifies, but does not save %rbx
> > 4. selftest zeros all CSRs
> > 5. wrapper loads all CSRs
> >
> > I'd like to propose instead that the enclave be responsible for saving
> > and restoring CSRs. So instead of the above we have:
> > 1. __vdso_sgx_enter_enclave() saves %rbx
> > 2. enclave saves CSRs
> > 3. enclave loads CSRs
> > 4. __vdso_sgx_enter_enclave() loads %rbx
> >
> > I know that lots of other stuff happens during enclave transitions,
> > but at the very least we could reduce the number of instructions
> > through this critical path.
>
> The current calling convention for __vdso_sgx_enter_enclave has been carefully designed to mimic just calling ENCLU[EENTER] as closely as possible.
That seems like a reasonable contract. Thanks!
On Tue, Mar 3, 2020 at 6:40 PM Jarkko Sakkinen
<[email protected]> wrote:
>
> From: Sean Christopherson <[email protected]>
>
> An SGX runtime must be aware of the exceptions, which happen inside an
> enclave. Introduce a vDSO call that wraps EENTER/ERESUME cycle and returns
> the CPU exception back to the caller exactly when it happens.
>
> Kernel fixups the exception information to RDI, RSI and RDX. The SGX call
> vDSO handler fills this information to the user provided buffer or
> alternatively trigger user provided callback at the time of the exception.
>
> The calling convention is custom and does not follow System V x86-64 ABI.
>
> Suggested-by: Andy Lutomirski <[email protected]>
> Signed-off-by: Sean Christopherson <[email protected]>
> Co-developed-by: Cedric Xing <[email protected]>
> Signed-off-by: Cedric Xing <[email protected]>
> Tested-by: Jethro Beekman <[email protected]>
> Signed-off-by: Jarkko Sakkinen <[email protected]>
> ---
> arch/x86/entry/vdso/Makefile | 2 +
> arch/x86/entry/vdso/vdso.lds.S | 1 +
> arch/x86/entry/vdso/vsgx_enter_enclave.S | 187 +++++++++++++++++++++++
> arch/x86/include/uapi/asm/sgx.h | 37 +++++
> 4 files changed, 227 insertions(+)
> create mode 100644 arch/x86/entry/vdso/vsgx_enter_enclave.S
>
> diff --git a/arch/x86/entry/vdso/Makefile b/arch/x86/entry/vdso/Makefile
> index 657e01d34d02..fa50c76a17a8 100644
> --- a/arch/x86/entry/vdso/Makefile
> +++ b/arch/x86/entry/vdso/Makefile
> @@ -24,6 +24,7 @@ VDSO32-$(CONFIG_IA32_EMULATION) := y
>
> # files to link into the vdso
> vobjs-y := vdso-note.o vclock_gettime.o vgetcpu.o
> +vobjs-$(VDSO64-y) += vsgx_enter_enclave.o
>
> # files to link into kernel
> obj-y += vma.o extable.o
> @@ -90,6 +91,7 @@ $(vobjs): KBUILD_CFLAGS := $(filter-out $(GCC_PLUGINS_CFLAGS) $(RETPOLINE_CFLAGS
> CFLAGS_REMOVE_vclock_gettime.o = -pg
> CFLAGS_REMOVE_vdso32/vclock_gettime.o = -pg
> CFLAGS_REMOVE_vgetcpu.o = -pg
> +CFLAGS_REMOVE_vsgx_enter_enclave.o = -pg
>
> #
> # X32 processes use x32 vDSO to access 64bit kernel data.
> diff --git a/arch/x86/entry/vdso/vdso.lds.S b/arch/x86/entry/vdso/vdso.lds.S
> index 36b644e16272..4bf48462fca7 100644
> --- a/arch/x86/entry/vdso/vdso.lds.S
> +++ b/arch/x86/entry/vdso/vdso.lds.S
> @@ -27,6 +27,7 @@ VERSION {
> __vdso_time;
> clock_getres;
> __vdso_clock_getres;
> + __vdso_sgx_enter_enclave;
> local: *;
> };
> }
> diff --git a/arch/x86/entry/vdso/vsgx_enter_enclave.S b/arch/x86/entry/vdso/vsgx_enter_enclave.S
> new file mode 100644
> index 000000000000..94a8e5f99961
> --- /dev/null
> +++ b/arch/x86/entry/vdso/vsgx_enter_enclave.S
> @@ -0,0 +1,187 @@
> +/* SPDX-License-Identifier: GPL-2.0 */
> +
> +#include <linux/linkage.h>
> +#include <asm/export.h>
> +#include <asm/errno.h>
> +
> +#include "extable.h"
> +
> +#define EX_LEAF 0*8
> +#define EX_TRAPNR 0*8+4
> +#define EX_ERROR_CODE 0*8+6
> +#define EX_ADDRESS 1*8
> +
> +.code64
> +.section .text, "ax"
> +
> +/**
> + * __vdso_sgx_enter_enclave() - Enter an SGX enclave
> + * @leaf: ENCLU leaf, must be EENTER or ERESUME
> + * @tcs: TCS, must be non-NULL
> + * @e: Optional struct sgx_enclave_exception instance
> + * @handler: Optional enclave exit handler
> + *
> + * **Important!** __vdso_sgx_enter_enclave() is **NOT** compliant with the
> + * x86-64 ABI, i.e. cannot be called from standard C code.
> + *
> + * Input ABI:
> + * @leaf %eax
> + * @tcs 8(%rsp)
> + * @e 0x10(%rsp)
> + * @handler 0x18(%rsp)
> + *
> + * Output ABI:
> + * @ret %eax
> + *
> + * All general purpose registers except RAX, RBX and RCX are passed as-is to
> + * the enclave. RAX, RBX and RCX are consumed by EENTER and ERESUME and are
> + * loaded with @leaf, asynchronous exit pointer, and @tcs respectively.
> + *
> + * RBP and the stack are used to anchor __vdso_sgx_enter_enclave() to the
> + * pre-enclave state, e.g. to retrieve @e and @handler after an enclave exit.
> + * All other registers are available for use by the enclave and its runtime,
> + * e.g. an enclave can push additional data onto the stack (and modify RSP) to
> + * pass information to the optional exit handler (see below).
> + *
> + * Most exceptions reported on ENCLU, including those that occur within the
> + * enclave, are fixed up and reported synchronously instead of being delivered
> + * via a standard signal. Debug Exceptions (#DB) and Breakpoints (#BP) are
> + * never fixed up and are always delivered via standard signals. On synchrously
> + * reported exceptions, -EFAULT is returned and details about the exception are
> + * recorded in @e, the optional sgx_enclave_exception struct.
> +
> + * If an exit handler is provided, the handler will be invoked on synchronous
> + * exits from the enclave and for all synchronously reported exceptions. In
> + * latter case, @e is filled prior to invoking the handler.
> + *
> + * The exit handler's return value is interpreted as follows:
> + * >0: continue, restart __vdso_sgx_enter_enclave() with @ret as @leaf
> + * 0: success, return @ret to the caller
> + * <0: error, return @ret to the caller
> + *
> + * The userspace exit handler is responsible for unwinding the stack, e.g. to
> + * pop @e, u_rsp and @tcs, prior to returning to __vdso_sgx_enter_enclave().
Unless I misunderstand, this documentation...
> + * The exit handler may also transfer control, e.g. via longjmp() or a C++
> + * exception, without returning to __vdso_sgx_enter_enclave().
> + *
> + * Return:
> + * 0 on success,
> + * -EINVAL if ENCLU leaf is not allowed,
> + * -EFAULT if an exception occurs on ENCLU or within the enclave
> + * -errno for all other negative values returned by the userspace exit handler
> + */
> +#ifdef SGX_KERNEL_DOC
> +/* C-style function prototype to coerce kernel-doc into parsing the comment. */
> +int __vdso_sgx_enter_enclave(int leaf, void *tcs,
> + struct sgx_enclave_exception *e,
> + sgx_enclave_exit_handler_t handler);
> +#endif
> +SYM_FUNC_START(__vdso_sgx_enter_enclave)
> + /* Prolog */
> + .cfi_startproc
> + push %rbp
> + .cfi_adjust_cfa_offset 8
> + .cfi_rel_offset %rbp, 0
> + mov %rsp, %rbp
> + .cfi_def_cfa_register %rbp
> +
> +.Lenter_enclave:
> + /* EENTER <= leaf <= ERESUME */
> + cmp $0x2, %eax
> + jb .Linvalid_leaf
> + cmp $0x3, %eax
> + ja .Linvalid_leaf
> +
> + /* Load TCS and AEP */
> + mov 0x10(%rbp), %rbx
> + lea .Lasync_exit_pointer(%rip), %rcx
> +
> + /* Single ENCLU serving as both EENTER and AEP (ERESUME) */
> +.Lasync_exit_pointer:
> +.Lenclu_eenter_eresume:
> + enclu
> +
> + /* EEXIT jumps here unless the enclave is doing something fancy. */
> + xor %eax, %eax
> +
> + /* Invoke userspace's exit handler if one was provided. */
> +.Lhandle_exit:
> + cmp $0, 0x20(%rbp)
> + jne .Linvoke_userspace_handler
> +
> +.Lout:
> + leave
> + .cfi_def_cfa %rsp, 8
> + ret
> +
> + /* The out-of-line code runs with the pre-leave stack frame. */
> + .cfi_def_cfa %rbp, 16
> +
> +.Linvalid_leaf:
> + mov $(-EINVAL), %eax
> + jmp .Lout
> +
> +.Lhandle_exception:
> + mov 0x18(%rbp), %rcx
> + test %rcx, %rcx
> + je .Lskip_exception_info
> +
> + /* Fill optional exception info. */
> + mov %eax, EX_LEAF(%rcx)
> + mov %di, EX_TRAPNR(%rcx)
> + mov %si, EX_ERROR_CODE(%rcx)
> + mov %rdx, EX_ADDRESS(%rcx)
> +.Lskip_exception_info:
> + mov $(-EFAULT), %eax
> + jmp .Lhandle_exit
> +
> +.Linvoke_userspace_handler:
> + /* Pass the untrusted RSP (at exit) to the callback via %rcx. */
> + mov %rsp, %rcx
> +
> + /* Save the untrusted RSP in %rbx (non-volatile register). */
> + mov %rsp, %rbx
> +
> + /*
> + * Align stack per x86_64 ABI. Note, %rsp needs to be 16-byte aligned
> + * _after_ pushing the parameters on the stack, hence the bonus push.
> + */
> + and $-0x10, %rsp
> + push %rax
> +
> + /* Push @e, the "return" value and @tcs as params to the callback. */
> + push 0x18(%rbp)
> + push %rax
> + push 0x10(%rbp)
> +
> + /* Clear RFLAGS.DF per x86_64 ABI */
> + cld
> +
> + /* Load the callback pointer to %rax and invoke it via retpoline. */
> + mov 0x20(%rbp), %rax
> + call .Lretpoline
> +
> + /* Restore %rsp to its post-exit value. */
> + mov %rbx, %rsp
... doesn't seem to match this code.
If the handler pops from the stack and then we restore the stack here,
the handler had no effect.
Also, one difference between this interface and a raw ENCLU[EENTER] is
that we can't pass arguments on the untrusted stack during EEXIT. If
we want to support that workflow, then we need to allow the ability
for the handler to pop "additional" values without restoring the stack
pointer to the exact value here.
> + /*
> + * If the return from callback is zero or negative, return immediately,
> + * else re-execute ENCLU with the postive return value interpreted as
> + * the requested ENCLU leaf.
> + */
> + cmp $0, %eax
> + jle .Lout
> + jmp .Lenter_enclave
> +
> +.Lretpoline:
> + call 2f
> +1: pause
> + lfence
> + jmp 1b
> +2: mov %rax, (%rsp)
> + ret
> + .cfi_endproc
> +
> +_ASM_VDSO_EXTABLE_HANDLE(.Lenclu_eenter_eresume, .Lhandle_exception)
> +
> +SYM_FUNC_END(__vdso_sgx_enter_enclave)
> diff --git a/arch/x86/include/uapi/asm/sgx.h b/arch/x86/include/uapi/asm/sgx.h
> index 57d0d30c79b3..e196cfd44b70 100644
> --- a/arch/x86/include/uapi/asm/sgx.h
> +++ b/arch/x86/include/uapi/asm/sgx.h
> @@ -74,4 +74,41 @@ struct sgx_enclave_set_attribute {
> __u64 attribute_fd;
> };
>
> +/**
> + * struct sgx_enclave_exception - structure to report exceptions encountered in
> + * __vdso_sgx_enter_enclave()
> + *
> + * @leaf: ENCLU leaf from \%eax at time of exception
> + * @trapnr: exception trap number, a.k.a. fault vector
> + * @error_code: exception error code
> + * @address: exception address, e.g. CR2 on a #PF
> + * @reserved: reserved for future use
> + */
> +struct sgx_enclave_exception {
> + __u32 leaf;
> + __u16 trapnr;
> + __u16 error_code;
> + __u64 address;
> + __u64 reserved[2];
> +};
> +
> +/**
> + * typedef sgx_enclave_exit_handler_t - Exit handler function accepted by
> + * __vdso_sgx_enter_enclave()
> + *
> + * @rdi: RDI at the time of enclave exit
> + * @rsi: RSI at the time of enclave exit
> + * @rdx: RDX at the time of enclave exit
> + * @ursp: RSP at the time of enclave exit (untrusted stack)
> + * @r8: R8 at the time of enclave exit
> + * @r9: R9 at the time of enclave exit
> + * @tcs: Thread Control Structure used to enter enclave
> + * @ret: 0 on success (EEXIT), -EFAULT on an exception
> + * @e: Pointer to struct sgx_enclave_exception (as provided by caller)
> + */
> +typedef int (*sgx_enclave_exit_handler_t)(long rdi, long rsi, long rdx,
> + long ursp, long r8, long r9,
> + void *tcs, int ret,
> + struct sgx_enclave_exception *e);
> +
> #endif /* _UAPI_ASM_X86_SGX_H */
> --
> 2.25.0
>
On Fri, Mar 06, 2020 at 08:47:02PM +0200, Jarkko Sakkinen wrote:
> On Thu, Mar 05, 2020 at 11:03:54AM -0800, Sean Christopherson wrote:
> > We've also discussed taking a file descriptor to hold the backing, but
> > unless I'm misreading the pagecache code, that doesn't solve the incorrect
> > accounting problem because the current task, i.e. evicting task, would be
> > charged. In other words, whether the backing is kernel or user controlled
> > is purely an ABI question.
>
> Even if the file is owned by a different process the account happens
> to "current"?
Yes. Which makes sense as files do not have a 1:1 association with tasks.
On Wed, Mar 11, 2020 at 03:30:44PM -0400, Nathaniel McCallum wrote:
> On Tue, Mar 3, 2020 at 6:40 PM Jarkko Sakkinen
> <[email protected]> wrote:
> > + * The exit handler's return value is interpreted as follows:
> > + * >0: continue, restart __vdso_sgx_enter_enclave() with @ret as @leaf
> > + * 0: success, return @ret to the caller
> > + * <0: error, return @ret to the caller
> > + *
> > + * The userspace exit handler is responsible for unwinding the stack, e.g. to
> > + * pop @e, u_rsp and @tcs, prior to returning to __vdso_sgx_enter_enclave().
>
> Unless I misunderstand, this documentation...
Hrm, that does appear wrong. I'm guessing that was leftover from a previous
incarnation of the code. Or I botched the description, which is just as
likely.
> > + * The exit handler may also transfer control, e.g. via longjmp() or a C++
> > + * exception, without returning to __vdso_sgx_enter_enclave().
> > + *
> > + * Return:
> > + * 0 on success,
> > + * -EINVAL if ENCLU leaf is not allowed,
> > + * -EFAULT if an exception occurs on ENCLU or within the enclave
> > + * -errno for all other negative values returned by the userspace exit handler
> > + */
...
> > + /* Load the callback pointer to %rax and invoke it via retpoline. */
> > + mov 0x20(%rbp), %rax
> > + call .Lretpoline
> > +
> > + /* Restore %rsp to its post-exit value. */
> > + mov %rbx, %rsp
>
> ... doesn't seem to match this code.
>
> If the handler pops from the stack and then we restore the stack here,
> the handler had no effect.
>
> Also, one difference between this interface and a raw ENCLU[EENTER] is
> that we can't pass arguments on the untrusted stack during EEXIT. If
> we want to support that workflow, then we need to allow the ability
> for the handler to pop "additional" values without restoring the stack
> pointer to the exact value here.
> Also, one difference between this interface and a raw ENCLU[EENTER] is
> that we can't pass arguments on the untrusted stack during EEXIT. If
> we want to support that workflow, then we need to allow the ability
> for the handler to pop "additional" values without restoring the stack
> pointer to the exact value here.
The callback shenanigans exist precisely to allow passing arguments on the
untrusted stack. The vDSO is very careful to preserve the stack memory
above RSP, and to snapshot RSP at the time of exit, e.g. the arguments in
memory and their addresses relative to u_rsp live across EEXIT. It's the
same basic concept as regular function calls, e.g. the callee doesn't pop
params off the stack, it just knows what addresses relative to RSP hold
the data it wants. The enclave, being the caller, is responsible for
cleaning up u_rsp.
FWIW, if the handler reaaaly wanted to pop off the stack, it could do so,
fixup the stack, and then re-call __vdso_sgx_enter_enclave() instead of
returning (to the original __vdso_sgx_enter_enclave()).
> > + /*
> > + * If the return from callback is zero or negative, return immediately,
> > + * else re-execute ENCLU with the postive return value interpreted as
> > + * the requested ENCLU leaf.
> > + */
> > + cmp $0, %eax
> > + jle .Lout
> > + jmp .Lenter_enclave
> > +
> > +.Lretpoline:
> > + call 2f
> > +1: pause
> > + lfence
> > + jmp 1b
> > +2: mov %rax, (%rsp)
> > + ret
> > + .cfi_endproc
> > +
> > +_ASM_VDSO_EXTABLE_HANDLE(.Lenclu_eenter_eresume, .Lhandle_exception)
On Wed, Mar 11, 2020 at 1:38 PM Jethro Beekman <[email protected]> wrote:
>
> On 2020-03-11 18:30, Nathaniel McCallum wrote:
> > On Tue, Mar 3, 2020 at 6:40 PM Jarkko Sakkinen
> > <[email protected]> wrote:
> >>
> >> From: Sean Christopherson <[email protected]>
> >>
> >> An SGX runtime must be aware of the exceptions, which happen inside an
> >> enclave. Introduce a vDSO call that wraps EENTER/ERESUME cycle and returns
> >> the CPU exception back to the caller exactly when it happens.
> >>
> >> Kernel fixups the exception information to RDI, RSI and RDX. The SGX call
> >> vDSO handler fills this information to the user provided buffer or
> >> alternatively trigger user provided callback at the time of the exception.
> >>
> >> The calling convention is custom and does not follow System V x86-64 ABI.
> >>
> >> Suggested-by: Andy Lutomirski <[email protected]>
> >> Signed-off-by: Sean Christopherson <[email protected]>
> >> Co-developed-by: Cedric Xing <[email protected]>
> >> Signed-off-by: Cedric Xing <[email protected]>
> >> Tested-by: Jethro Beekman <[email protected]>
> >> Signed-off-by: Jarkko Sakkinen <[email protected]>
> >> ---
> >> arch/x86/entry/vdso/Makefile | 2 +
> >> arch/x86/entry/vdso/vdso.lds.S | 1 +
> >> arch/x86/entry/vdso/vsgx_enter_enclave.S | 187 +++++++++++++++++++++++
> >> arch/x86/include/uapi/asm/sgx.h | 37 +++++
> >> 4 files changed, 227 insertions(+)
> >> create mode 100644 arch/x86/entry/vdso/vsgx_enter_enclave.S
> >>
> >> diff --git a/arch/x86/entry/vdso/Makefile b/arch/x86/entry/vdso/Makefile
> >> index 657e01d34d02..fa50c76a17a8 100644
> >> --- a/arch/x86/entry/vdso/Makefile
> >> +++ b/arch/x86/entry/vdso/Makefile
> >> @@ -24,6 +24,7 @@ VDSO32-$(CONFIG_IA32_EMULATION) := y
> >>
> >> # files to link into the vdso
> >> vobjs-y := vdso-note.o vclock_gettime.o vgetcpu.o
> >> +vobjs-$(VDSO64-y) += vsgx_enter_enclave.o
> >>
> >> # files to link into kernel
> >> obj-y += vma.o extable.o
> >> @@ -90,6 +91,7 @@ $(vobjs): KBUILD_CFLAGS := $(filter-out $(GCC_PLUGINS_CFLAGS) $(RETPOLINE_CFLAGS
> >> CFLAGS_REMOVE_vclock_gettime.o = -pg
> >> CFLAGS_REMOVE_vdso32/vclock_gettime.o = -pg
> >> CFLAGS_REMOVE_vgetcpu.o = -pg
> >> +CFLAGS_REMOVE_vsgx_enter_enclave.o = -pg
> >>
> >> #
> >> # X32 processes use x32 vDSO to access 64bit kernel data.
> >> diff --git a/arch/x86/entry/vdso/vdso.lds.S b/arch/x86/entry/vdso/vdso.lds.S
> >> index 36b644e16272..4bf48462fca7 100644
> >> --- a/arch/x86/entry/vdso/vdso.lds.S
> >> +++ b/arch/x86/entry/vdso/vdso.lds.S
> >> @@ -27,6 +27,7 @@ VERSION {
> >> __vdso_time;
> >> clock_getres;
> >> __vdso_clock_getres;
> >> + __vdso_sgx_enter_enclave;
> >> local: *;
> >> };
> >> }
> >> diff --git a/arch/x86/entry/vdso/vsgx_enter_enclave.S b/arch/x86/entry/vdso/vsgx_enter_enclave.S
> >> new file mode 100644
> >> index 000000000000..94a8e5f99961
> >> --- /dev/null
> >> +++ b/arch/x86/entry/vdso/vsgx_enter_enclave.S
> >> @@ -0,0 +1,187 @@
> >> +/* SPDX-License-Identifier: GPL-2.0 */
> >> +
> >> +#include <linux/linkage.h>
> >> +#include <asm/export.h>
> >> +#include <asm/errno.h>
> >> +
> >> +#include "extable.h"
> >> +
> >> +#define EX_LEAF 0*8
> >> +#define EX_TRAPNR 0*8+4
> >> +#define EX_ERROR_CODE 0*8+6
> >> +#define EX_ADDRESS 1*8
> >> +
> >> +.code64
> >> +.section .text, "ax"
> >> +
> >> +/**
> >> + * __vdso_sgx_enter_enclave() - Enter an SGX enclave
> >> + * @leaf: ENCLU leaf, must be EENTER or ERESUME
> >> + * @tcs: TCS, must be non-NULL
> >> + * @e: Optional struct sgx_enclave_exception instance
> >> + * @handler: Optional enclave exit handler
> >> + *
> >> + * **Important!** __vdso_sgx_enter_enclave() is **NOT** compliant with the
> >> + * x86-64 ABI, i.e. cannot be called from standard C code.
> >> + *
> >> + * Input ABI:
> >> + * @leaf %eax
> >> + * @tcs 8(%rsp)
> >> + * @e 0x10(%rsp)
> >> + * @handler 0x18(%rsp)
> >> + *
> >> + * Output ABI:
> >> + * @ret %eax
> >> + *
> >> + * All general purpose registers except RAX, RBX and RCX are passed as-is to
> >> + * the enclave. RAX, RBX and RCX are consumed by EENTER and ERESUME and are
> >> + * loaded with @leaf, asynchronous exit pointer, and @tcs respectively.
> >> + *
> >> + * RBP and the stack are used to anchor __vdso_sgx_enter_enclave() to the
> >> + * pre-enclave state, e.g. to retrieve @e and @handler after an enclave exit.
> >> + * All other registers are available for use by the enclave and its runtime,
> >> + * e.g. an enclave can push additional data onto the stack (and modify RSP) to
> >> + * pass information to the optional exit handler (see below).
> >> + *
> >> + * Most exceptions reported on ENCLU, including those that occur within the
> >> + * enclave, are fixed up and reported synchronously instead of being delivered
> >> + * via a standard signal. Debug Exceptions (#DB) and Breakpoints (#BP) are
> >> + * never fixed up and are always delivered via standard signals. On synchrously
> >> + * reported exceptions, -EFAULT is returned and details about the exception are
> >> + * recorded in @e, the optional sgx_enclave_exception struct.
> >> +
> >> + * If an exit handler is provided, the handler will be invoked on synchronous
> >> + * exits from the enclave and for all synchronously reported exceptions. In
> >> + * latter case, @e is filled prior to invoking the handler.
> >> + *
> >> + * The exit handler's return value is interpreted as follows:
> >> + * >0: continue, restart __vdso_sgx_enter_enclave() with @ret as @leaf
> >> + * 0: success, return @ret to the caller
> >> + * <0: error, return @ret to the caller
> >> + *
> >> + * The userspace exit handler is responsible for unwinding the stack, e.g. to
> >> + * pop @e, u_rsp and @tcs, prior to returning to __vdso_sgx_enter_enclave().
> >> + * The exit handler may also transfer control, e.g. via longjmp() or a C++
> >> + * exception, without returning to __vdso_sgx_enter_enclave().
> >> + *
> >> + * Return:
> >> + * 0 on success,
> >> + * -EINVAL if ENCLU leaf is not allowed,
> >> + * -EFAULT if an exception occurs on ENCLU or within the enclave
> >> + * -errno for all other negative values returned by the userspace exit handler
> >> + */
> >> +#ifdef SGX_KERNEL_DOC
> >> +/* C-style function prototype to coerce kernel-doc into parsing the comment. */
> >> +int __vdso_sgx_enter_enclave(int leaf, void *tcs,
> >> + struct sgx_enclave_exception *e,
> >> + sgx_enclave_exit_handler_t handler);
> >> +#endif
> >> +SYM_FUNC_START(__vdso_sgx_enter_enclave)
> >
> > Currently, the selftest has a wrapper around
> > __vdso_sgx_enter_enclave() which preserves all x86-64 ABI callee-saved
> > registers (CSRs), though it uses none of them. Then it calls this
> > function which uses %rbx but preserves none of the CSRs. Then it jumps
> > into an enclave which zeroes all these registers before returning.
> > Thus:
> >
> > 1. wrapper saves all CSRs
> > 2. wrapper repositions stack arguments
> > 3. __vdso_sgx_enter_enclave() modifies, but does not save %rbx
> > 4. selftest zeros all CSRs
> > 5. wrapper loads all CSRs
> >
> > I'd like to propose instead that the enclave be responsible for saving
> > and restoring CSRs. So instead of the above we have:
> > 1. __vdso_sgx_enter_enclave() saves %rbx
> > 2. enclave saves CSRs
> > 3. enclave loads CSRs
> > 4. __vdso_sgx_enter_enclave() loads %rbx
> >
> > I know that lots of other stuff happens during enclave transitions,
> > but at the very least we could reduce the number of instructions
> > through this critical path.
>()
> The current calling convention for __vdso_sgx_enter_enclave has been carefully designed to mimic just calling ENCLU[EENTER] as closely as possible.
>
> I'm not sure why you're referring to the selftest wrapper here, that doesn't seem relevant to me.
Thinking about this more carefully, I still think that at least part
of my critique still stands.
__vdso_sgx_enter_enclave() doesn't use the x86-64 ABI. This means that
there will always be an assembly wrapper for
__vdso_sgx_enter_enclave(). But because __vdso_sgx_enter_enclave()
doesn't save %rbx, the wrapper is forced to in order to be called from
C.
A common pattern for the wrapper will be to do something like this:
# void enter_enclave(rdi, rsi, rdx, unused, r8, r9, @tcs, @e,
@handler, @leaf, @vdso)
enter_enclave:
push %rbx
push $0 /* align */
push 0x48(%rsp)
push 0x48(%rsp)
push 0x48(%rsp)
mov 0x70(%rsp), %eax
call *0x68(%rsp)
add $0x20, %rsp
pop %rbx
ret
Because __vdso_sgx_enter_enclave() doesn't preserve %rbx, the wrapper
is forced to reposition stack parameters in a performance-critical
path. On the other hand, if __vdso_sgx_enter_enclave() preserved %rbx,
you could implement the above as:
# void enter_enclave(rdi, rsi, rdx, unused, r8, r9, @tcs, @e,
@handler, @leaf, @vdso)
enter_enclave:
mov 0x20(%rsp), %eax
jmp *0x28(%rsp)
This also implies that if __vdso_sgx_enter_enclave() took @leaf as a
stack parameter and preserved %rbx, it would be x86-64 ABI compliant
enough to call from C if the enclave preserves all callee-saved
registers besides %rbx (Enarx does).
What are the downsides of this approach? It also doesn't harm the more
extended case when you need to use an assembly wrapper to setup
additional registers. This can still be done. It does imply an extra
push and mov instruction. But because there are currently an odd
number of stack function parameters, the push also removes an
alignment instruction where the stack is aligned before the call to
__vdso_sgx_enter_enclave() (likely). Further, the push and mov are
going to be performed by *someone* in order to call
__vdso_sgx_enter_enclave() from C.
Therefore, I'd like to propose that __vdso_sgx_enter_enclave():
* Preserve %rbx.
* Take the leaf as an additional stack parameter instead of passing
it in %rax.
Then C can call it without additional overhead. And people who need to
"extend" the C ABI can still do so.
On Thu, Mar 12, 2020 at 8:52 PM Sean Christopherson
<[email protected]> wrote:
>
> On Wed, Mar 11, 2020 at 03:30:44PM -0400, Nathaniel McCallum wrote:
> > On Tue, Mar 3, 2020 at 6:40 PM Jarkko Sakkinen
> > <[email protected]> wrote:
> > > + * The exit handler's return value is interpreted as follows:
> > > + * >0: continue, restart __vdso_sgx_enter_enclave() with @ret as @leaf
> > > + * 0: success, return @ret to the caller
> > > + * <0: error, return @ret to the caller
> > > + *
> > > + * The userspace exit handler is responsible for unwinding the stack, e.g. to
> > > + * pop @e, u_rsp and @tcs, prior to returning to __vdso_sgx_enter_enclave().
> >
> > Unless I misunderstand, this documentation...
>
> Hrm, that does appear wrong. I'm guessing that was leftover from a previous
> incarnation of the code. Or I botched the description, which is just as
> likely.
I figured out what happened on my end. This documentation error led me
to misread the code. More below.
> > > + * The exit handler may also transfer control, e.g. via longjmp() or a C++
> > > + * exception, without returning to __vdso_sgx_enter_enclave().
> > > + *
> > > + * Return:
> > > + * 0 on success,
> > > + * -EINVAL if ENCLU leaf is not allowed,
> > > + * -EFAULT if an exception occurs on ENCLU or within the enclave
> > > + * -errno for all other negative values returned by the userspace exit handler
> > > + */
>
> ...
>
> > > + /* Load the callback pointer to %rax and invoke it via retpoline. */
> > > + mov 0x20(%rbp), %rax
> > > + call .Lretpoline
> > > +
> > > + /* Restore %rsp to its post-exit value. */
> > > + mov %rbx, %rsp
> >
> > ... doesn't seem to match this code.
> >
> > If the handler pops from the stack and then we restore the stack here,
> > the handler had no effect.
> >
> > Also, one difference between this interface and a raw ENCLU[EENTER] is
> > that we can't pass arguments on the untrusted stack during EEXIT. If
> > we want to support that workflow, then we need to allow the ability
> > for the handler to pop "additional" values without restoring the stack
> > pointer to the exact value here.
>
> > Also, one difference between this interface and a raw ENCLU[EENTER] is
> > that we can't pass arguments on the untrusted stack during EEXIT. If
> > we want to support that workflow, then we need to allow the ability
> > for the handler to pop "additional" values without restoring the stack
> > pointer to the exact value here.
>
> The callback shenanigans exist precisely to allow passing arguments on the
> untrusted stack. The vDSO is very careful to preserve the stack memory
> above RSP, and to snapshot RSP at the time of exit, e.g. the arguments in
> memory and their addresses relative to u_rsp live across EEXIT. It's the
> same basic concept as regular function calls, e.g. the callee doesn't pop
> params off the stack, it just knows what addresses relative to RSP hold
> the data it wants. The enclave, being the caller, is responsible for
> cleaning up u_rsp.
>
> FWIW, if the handler reaaaly wanted to pop off the stack, it could do so,
> fixup the stack, and then re-call __vdso_sgx_enter_enclave() instead of
> returning (to the original __vdso_sgx_enter_enclave()).
My understanding from the documentation issue above was that *if* you
wanted to push parameters back on the stack during enclave exit, you
would *have* to supply a handler so it could pop the parameters and
reset the stack. Which is why restoring %rsp from %rbx didn't make
sense to me.
Related to my other message in this thread, if
__vdso_sgx_enter_enclave() preserved %rbx and took @leaf as a stack
parameter, you could call __vdso_sgx_enter_enclave() from C so long as
the enclave didn't push return arguments on the stack. A workaround
for that case would be to fix up the stack in the handler. It would be
enough for the handler to simply set %rbx to the desired stack
location and return (though all of this unclean of course).
> > > + /*
> > > + * If the return from callback is zero or negative, return immediately,
> > > + * else re-execute ENCLU with the postive return value interpreted as
> > > + * the requested ENCLU leaf.
> > > + */
> > > + cmp $0, %eax
> > > + jle .Lout
> > > + jmp .Lenter_enclave
> > > +
> > > +.Lretpoline:
> > > + call 2f
> > > +1: pause
> > > + lfence
> > > + jmp 1b
> > > +2: mov %rax, (%rsp)
> > > + ret
> > > + .cfi_endproc
> > > +
> > > +_ASM_VDSO_EXTABLE_HANDLE(.Lenclu_eenter_eresume, .Lhandle_exception)
>
On Fri, Mar 13, 2020 at 12:07:55PM -0400, Nathaniel McCallum wrote:
> On Thu, Mar 12, 2020 at 8:52 PM Sean Christopherson
> <[email protected]> wrote:
> > FWIW, if the handler reaaaly wanted to pop off the stack, it could do so,
> > fixup the stack, and then re-call __vdso_sgx_enter_enclave() instead of
> > returning (to the original __vdso_sgx_enter_enclave()).
>
> My understanding from the documentation issue above was that *if* you
> wanted to push parameters back on the stack during enclave exit, you
> would *have* to supply a handler so it could pop the parameters and
> reset the stack. Which is why restoring %rsp from %rbx didn't make
> sense to me.
Yep.
On Fri, Mar 13, 2020 at 11:48:54AM -0400, Nathaniel McCallum wrote:
> Thinking about this more carefully, I still think that at least part
> of my critique still stands.
>
> __vdso_sgx_enter_enclave() doesn't use the x86-64 ABI. This means that
> there will always be an assembly wrapper for
> __vdso_sgx_enter_enclave(). But because __vdso_sgx_enter_enclave()
> doesn't save %rbx, the wrapper is forced to in order to be called from
> C.
>
> A common pattern for the wrapper will be to do something like this:
>
> # void enter_enclave(rdi, rsi, rdx, unused, r8, r9, @tcs, @e,
> @handler, @leaf, @vdso)
> enter_enclave:
> push %rbx
> push $0 /* align */
> push 0x48(%rsp)
> push 0x48(%rsp)
> push 0x48(%rsp)
>
> mov 0x70(%rsp), %eax
> call *0x68(%rsp)
>
> add $0x20, %rsp
> pop %rbx
> ret
>
> Because __vdso_sgx_enter_enclave() doesn't preserve %rbx, the wrapper
> is forced to reposition stack parameters in a performance-critical
> path. On the other hand, if __vdso_sgx_enter_enclave() preserved %rbx,
> you could implement the above as:
>
> # void enter_enclave(rdi, rsi, rdx, unused, r8, r9, @tcs, @e,
> @handler, @leaf, @vdso)
> enter_enclave:
> mov 0x20(%rsp), %eax
> jmp *0x28(%rsp)
>
> This also implies that if __vdso_sgx_enter_enclave() took @leaf as a
> stack parameter and preserved %rbx, it would be x86-64 ABI compliant
> enough to call from C if the enclave preserves all callee-saved
> registers besides %rbx (Enarx does).
>
> What are the downsides of this approach? It also doesn't harm the more
> extended case when you need to use an assembly wrapper to setup
> additional registers. This can still be done. It does imply an extra
> push and mov instruction. But because there are currently an odd
> number of stack function parameters, the push also removes an
> alignment instruction where the stack is aligned before the call to
> __vdso_sgx_enter_enclave() (likely). Further, the push and mov are
> going to be performed by *someone* in order to call
> __vdso_sgx_enter_enclave() from C.
>
> Therefore, I'd like to propose that __vdso_sgx_enter_enclave():
> * Preserve %rbx.
At first glance, that looks sane. Being able to call __vdso... from C
would certainly be nice.
> * Take the leaf as an additional stack parameter instead of passing
> it in %rax.
Does the leaf even need to be a stack param? Wouldn't it be possible to
use %rcx as @leaf instead of @unusued? E.g.
int __vdso_sgx_enter_enclave(unsigned long rdi, unsigned long rsi,
unsigned long rdx, unsigned int leaf,
unsigned long r8, unsigned long r9,
void *tcs, struct sgx_enclave_exception *e,
sgx_enclave_exit_handler_t handler)
{
push %rbp
mov %rsp, %rbp
push %rbx
mov %ecx, %eax
.Lenter_enclave
cmp $0x2, %eax
jb .Linvalid_leaf
cmp $0x3, %eax
ja .Linvalid_leaf
mov 0x0x10(%rbp), %rbx
lea .Lasync_exit_pointer(%rip), %rcx
.Lasync_exit_pointer:
.Lenclu_eenter_eresume:
enclu
xor %eax, %eax
.Lhandle_exit:
cmp $0, 0x20(%rbp)
jne .Linvoke_userspace_handler
.Lout
pop %rbx
leave
ret
}
> Then C can call it without additional overhead. And people who need to
> "extend" the C ABI can still do so.
>
On Fri, Mar 13, 2020 at 12:46 PM Sean Christopherson
<[email protected]> wrote:
>
> On Fri, Mar 13, 2020 at 11:48:54AM -0400, Nathaniel McCallum wrote:
> > Thinking about this more carefully, I still think that at least part
> > of my critique still stands.
> >
> > __vdso_sgx_enter_enclave() doesn't use the x86-64 ABI. This means that
> > there will always be an assembly wrapper for
> > __vdso_sgx_enter_enclave(). But because __vdso_sgx_enter_enclave()
> > doesn't save %rbx, the wrapper is forced to in order to be called from
> > C.
> >
> > A common pattern for the wrapper will be to do something like this:
> >
> > # void enter_enclave(rdi, rsi, rdx, unused, r8, r9, @tcs, @e,
> > @handler, @leaf, @vdso)
> > enter_enclave:
> > push %rbx
> > push $0 /* align */
> > push 0x48(%rsp)
> > push 0x48(%rsp)
> > push 0x48(%rsp)
> >
> > mov 0x70(%rsp), %eax
> > call *0x68(%rsp)
> >
> > add $0x20, %rsp
> > pop %rbx
> > ret
> >
> > Because __vdso_sgx_enter_enclave() doesn't preserve %rbx, the wrapper
> > is forced to reposition stack parameters in a performance-critical
> > path. On the other hand, if __vdso_sgx_enter_enclave() preserved %rbx,
> > you could implement the above as:
> >
> > # void enter_enclave(rdi, rsi, rdx, unused, r8, r9, @tcs, @e,
> > @handler, @leaf, @vdso)
> > enter_enclave:
> > mov 0x20(%rsp), %eax
> > jmp *0x28(%rsp)
> >
> > This also implies that if __vdso_sgx_enter_enclave() took @leaf as a
> > stack parameter and preserved %rbx, it would be x86-64 ABI compliant
> > enough to call from C if the enclave preserves all callee-saved
> > registers besides %rbx (Enarx does).
> >
> > What are the downsides of this approach? It also doesn't harm the more
> > extended case when you need to use an assembly wrapper to setup
> > additional registers. This can still be done. It does imply an extra
> > push and mov instruction. But because there are currently an odd
> > number of stack function parameters, the push also removes an
> > alignment instruction where the stack is aligned before the call to
> > __vdso_sgx_enter_enclave() (likely). Further, the push and mov are
> > going to be performed by *someone* in order to call
> > __vdso_sgx_enter_enclave() from C.
> >
> > Therefore, I'd like to propose that __vdso_sgx_enter_enclave():
> > * Preserve %rbx.
>
> At first glance, that looks sane. Being able to call __vdso... from C
> would certainly be nice.
Agreed. I think ergonomically we want __vdso...() to be called from C
and the handler to be implemented in asm (optionally); without
breaking the ability to call __vdso..() from asm in special cases.
I think all ergonomic issues get solved by the following:
* Pass a void * into the handler from C through __vdso...().
* Allow the handler to pop parameters off of the output stack without hacks.
This allows the handler to pop extra arguments off the stack and write
them into the memory at the void *. Then the handler can be very small
and pass logic back to the caller of __vdso...().
Here's what this all means for the enclave. For maximum usability, the
enclave should preserve all callee-saved registers (except %rbx, which
is preserved by __vdso..()). For each ABI rule that the enclave
breaks, you need logic in a handler to fix it. So if you push return
params on the stack, the handler needs to undo that.
This doesn't compromise the ability to treat __vsdo...() like ENCLU if
you need the full power. But it does make it significantly easier to
consume when you don't have special needs. So as I see it, __vdso...()
should:
1. preserve %rbx
2. take leaf in %rcx
3. gain a void* stack param which is passed to the handler
4. sub/add to %rsp rather than save/restore
That would make this a very usable and fast interface without
sacrificing any of its current power.
> > * Take the leaf as an additional stack parameter instead of passing
> > it in %rax.
>
> Does the leaf even need to be a stack param? Wouldn't it be possible to
> use %rcx as @leaf instead of @unusued? E.g.
Even better!
> int __vdso_sgx_enter_enclave(unsigned long rdi, unsigned long rsi,
> unsigned long rdx, unsigned int leaf,
> unsigned long r8, unsigned long r9,
> void *tcs, struct sgx_enclave_exception *e,
> sgx_enclave_exit_handler_t handler)
> {
> push %rbp
> mov %rsp, %rbp
> push %rbx
>
> mov %ecx, %eax
> .Lenter_enclave
> cmp $0x2, %eax
> jb .Linvalid_leaf
> cmp $0x3, %eax
> ja .Linvalid_leaf
>
> mov 0x0x10(%rbp), %rbx
> lea .Lasync_exit_pointer(%rip), %rcx
>
> .Lasync_exit_pointer:
> .Lenclu_eenter_eresume:
> enclu
>
> xor %eax, %eax
>
> .Lhandle_exit:
> cmp $0, 0x20(%rbp)
> jne .Linvoke_userspace_handler
>
> .Lout
> pop %rbx
> leave
> ret
> }
>
>
> > Then C can call it without additional overhead. And people who need to
> > "extend" the C ABI can still do so.
> >
>
On Fri, Mar 13, 2020 at 02:32:29PM -0400, Nathaniel McCallum wrote:
> On Fri, Mar 13, 2020 at 12:46 PM Sean Christopherson
> <[email protected]> wrote:
> >
> > On Fri, Mar 13, 2020 at 11:48:54AM -0400, Nathaniel McCallum wrote:
> > > Therefore, I'd like to propose that __vdso_sgx_enter_enclave():
> > > * Preserve %rbx.
> >
> > At first glance, that looks sane. Being able to call __vdso... from C
> > would certainly be nice.
>
> Agreed. I think ergonomically we want __vdso...() to be called from C
> and the handler to be implemented in asm (optionally); without
> breaking the ability to call __vdso..() from asm in special cases.
>
> I think all ergonomic issues get solved by the following:
> * Pass a void * into the handler from C through __vdso...().
> * Allow the handler to pop parameters off of the output stack without hacks.
>
> This allows the handler to pop extra arguments off the stack and write
> them into the memory at the void *. Then the handler can be very small
> and pass logic back to the caller of __vdso...().
>
> Here's what this all means for the enclave. For maximum usability, the
> enclave should preserve all callee-saved registers (except %rbx, which
> is preserved by __vdso..()). For each ABI rule that the enclave
> breaks, you need logic in a handler to fix it. So if you push return
> params on the stack, the handler needs to undo that.
Or the untrusted runtime needs to wrap the __vdso() to save state that is
clobbered by the enclave. Just want to make it crystal clear that using a
handler is only required for stack shenanigans.
> This doesn't compromise the ability to treat __vsdo...() like ENCLU if
> you need the full power. But it does make it significantly easier to
> consume when you don't have special needs. So as I see it, __vdso...()
> should:
>
> 1. preserve %rbx
> 2. take leaf in %rcx
> 3. gain a void* stack param which is passed to the handler
Unless I'm misunderstanding the request, this already exists. %rsp at the
time of EEXIT is passed to the handler.
> 4. sub/add to %rsp rather than save/restore
Can you elaborate on why you want to sub/add to %rsp instead of having the
enclave unwind the stack? Preserving %rsp across EEXIT/ERESUME seems more
in line with function call semantics, which I assume is desirable? E.g.
push param3
push param2
push param1
enclu[EEXIT]
add $0x18, %rsp
> That would make this a very usable and fast interface without
> sacrificing any of its current power.
On Wed, Mar 11, 2020 at 09:40:47AM -0700, Sean Christopherson wrote:
> On Wed, Mar 11, 2020 at 03:28:32PM +0200, Jarkko Sakkinen wrote:
> > On Thu, Mar 05, 2020 at 01:33:28PM +0200, Jarkko Sakkinen wrote:
> > > On Wed, 2020-03-04 at 14:27 -0500, Nathaniel McCallum wrote:
> > > > > > +xsave_area:
> > > > > + .fill 1, 4, 0x037F # FCW
> > > > > + .fill 5, 4, 0
> > > > > + .fill 1, 4, 0x1F80 # MXCSR
> > > > > + .fill 1, 4, 0xFFFF # MXCSR_MASK
> > > > > + .fill 123, 4, 0
> > > > > + .fill 1, 4, 0x80000000 # XCOMP_BV[63] = 1, compaction mode
> > > > > + .fill 12, 4, 0
> > > >
> > > > I find this much more readable:
> > >
> > > And I always aim to get things more readable. Thank you.
> > >
> > > > xsave_area:
> > > > # Legacy
> > > > .fill 1, 4, 0x037F # FCW
> > > > .fill 5, 4, 0
> > > > .fill 1, 4, 0x1F80 # MXCSR
> > > > .fill 1, 4, 0xFFFF # MXCSR_MASK
> > > > .fill 60, 8, 0
> > > >
> > > > # Header
> > > > .fill 1, 8, 0 # XSTATE_BV
> > > > .fill 1, 8, 1 << 63 # XCOMP_BV (compaction mode)
> > > > .fill 6, 8, 0
> > > >
> > > > Also, since people are likely to copy this code for their own
> > > > enclaves, it would be helpful to document which flags are set in FCW
> > > > and MXCSR.
> > >
> > > It was meant as a test program but I'd guess what you say is true
> > > because it also might be the only alternative user space to Intel's
> > > :-) And a great starting point if you want to do things from scratch.
> > >
> > > Because I meant it as a smoke test program for SGX, not everything is
> > > too well documented but given the multipurpose use for that code I'll
> > > make the improvements that you are suggesting.
> >
> > For FPU Control World (FCW), I think 0x037F is not the right value even
> > if section 18.5 in the x86 SDM says that it is the initial value for it.
> >
> > I took that value from that section.
> >
> > The reason I think that there is an error in the SDM is that if you look
> > at the section 8.1.5, you'll see that bit 6 is a reserved bit. Thus,
> > does not make to set it on.
> >
> > I think the legit value ought to be 0x33F i.e. unset bit 6.
>
> Bit 6 is reserved, but it's forced to '1' by the CPU.
>
> Regardless, IMO it'd be better to drop this code entirely, it's all kinds
> of wonky. The label says "xsave_area" and implies XSAVE state is being
> loaded, but the code uses FXRSTOR, which will only load x86/MMX/XMM state,
> i.e. the first 512 bytes of the so called xsave_area.
>
> The test enclave doesn't touch state managed by XSAVE, let alone put
> secrets into said state. I see no reason to bother purging anything.
Makes sense.
/Jarkko
On Fri, Mar 13, 2020 at 2:45 PM Sean Christopherson
<[email protected]> wrote:
>
> On Fri, Mar 13, 2020 at 02:32:29PM -0400, Nathaniel McCallum wrote:
> > On Fri, Mar 13, 2020 at 12:46 PM Sean Christopherson
> > <[email protected]> wrote:
> > >
> > > On Fri, Mar 13, 2020 at 11:48:54AM -0400, Nathaniel McCallum wrote:
> > > > Therefore, I'd like to propose that __vdso_sgx_enter_enclave():
> > > > * Preserve %rbx.
> > >
> > > At first glance, that looks sane. Being able to call __vdso... from C
> > > would certainly be nice.
> >
> > Agreed. I think ergonomically we want __vdso...() to be called from C
> > and the handler to be implemented in asm (optionally); without
> > breaking the ability to call __vdso..() from asm in special cases.
> >
> > I think all ergonomic issues get solved by the following:
> > * Pass a void * into the handler from C through __vdso...().
> > * Allow the handler to pop parameters off of the output stack without hacks.
> >
> > This allows the handler to pop extra arguments off the stack and write
> > them into the memory at the void *. Then the handler can be very small
> > and pass logic back to the caller of __vdso...().
> >
> > Here's what this all means for the enclave. For maximum usability, the
> > enclave should preserve all callee-saved registers (except %rbx, which
> > is preserved by __vdso..()). For each ABI rule that the enclave
> > breaks, you need logic in a handler to fix it. So if you push return
> > params on the stack, the handler needs to undo that.
>
> Or the untrusted runtime needs to wrap the __vdso() to save state that is
> clobbered by the enclave. Just want to make it crystal clear that using a
> handler is only required for stack shenanigans.
Yup.
> > This doesn't compromise the ability to treat __vsdo...() like ENCLU if
> > you need the full power. But it does make it significantly easier to
> > consume when you don't have special needs. So as I see it, __vdso...()
> > should:
> >
> > 1. preserve %rbx
> > 2. take leaf in %rcx
> > 3. gain a void* stack param which is passed to the handler
>
> Unless I'm misunderstanding the request, this already exists. %rsp at the
> time of EEXIT is passed to the handler.
Sorry, different stack parameter. I mean this:
typedef int (*sgx_enclave_exit_handler_t)(
long rdi,
long rsi,
long rdx,
long ursp,
long r8,
long r9,
int ret,
void *tcs,
struct sgx_enclave_exception *e,
void *misc
);
int __vdso_sgx_enter_enclave(
long rdi,
long rsi,
long rdx,
int leaf,
long r8,
long r9,
void *tcs,
struct sgx_enclave_exception *e,
void *misc,
sgx_enclave_exit_handler_t handler
);
This is so that the caller of __vdso...() can pass context into the
handler. Note that I've also reordered the stack parameters so that
the stack order can be reused.
> > 4. sub/add to %rsp rather than save/restore
>
> Can you elaborate on why you want to sub/add to %rsp instead of having the
> enclave unwind the stack? Preserving %rsp across EEXIT/ERESUME seems more
> in line with function call semantics, which I assume is desirable? E.g.
>
> push param3
> push param2
> push param1
>
> enclu[EEXIT]
>
> add $0x18, %rsp
Before enclave EEXIT, the enclave restores %rsp to the value it had
before EENTER was called. Then it pushes additional output arguments
onto the stack. The enclave calls EENCLU[EEXIT].
We are now in __vdso...() on the way back to the caller. However, %rsp
has a different value than we entered the function with. This breaks
x86_64 ABI, obviously. The handler needs to fix this up: how does it
do so?
In the current code, __vdso..() saves the value of %rsp, calls the
handler and then restores %rsp. The handler can fix up the stack by
setting the correct value to %rbx and returning without restoring it.
But this requires internal knowledge of the __vdso...() function,
which could theoretically change in the future.
If instead the __vdso...() only did add/sub, then the handler could do:
1. pop return address
2. pop handler stack params
3. pop enclave additional output stack params
4. push handler stack params
5. push return address
While this is more work, it is standard calling convention work that
doesn't require internal knowledge of __vdso..(). Alternatively, if we
don't like the extra work, we can document the %rbx hack explicitly
into the handler documentation and make it part of the interface. But
we need some explicit way for the handler to pop enclave output stack
params that doesn't depend on internal knowledge of the __vdso...()
invariants.
> > That would make this a very usable and fast interface without
> > sacrificing any of its current power.
>
On Fri, Mar 13, 2020 at 04:14:01PM -0400, Nathaniel McCallum wrote:
> On Fri, Mar 13, 2020 at 2:45 PM Sean Christopherson
> <[email protected]> wrote:
> > This doesn't compromise the ability to treat __vsdo...() like ENCLU if
> > > you need the full power. But it does make it significantly easier to
> > > consume when you don't have special needs. So as I see it, __vdso...()
> > > should:
> > >
> > > 1. preserve %rbx
> > > 2. take leaf in %rcx
> > > 3. gain a void* stack param which is passed to the handler
> >
> > Unless I'm misunderstanding the request, this already exists. %rsp at the
> > time of EEXIT is passed to the handler.
>
> Sorry, different stack parameter. I mean this:
>
> typedef int (*sgx_enclave_exit_handler_t)(
> long rdi,
> long rsi,
> long rdx,
> long ursp,
> long r8,
> long r9,
> int ret,
> void *tcs,
> struct sgx_enclave_exception *e,
> void *misc
> );
>
> int __vdso_sgx_enter_enclave(
> long rdi,
> long rsi,
> long rdx,
> int leaf,
> long r8,
> long r9,
> void *tcs,
> struct sgx_enclave_exception *e,
> void *misc,
> sgx_enclave_exit_handler_t handler
> );
>
> This is so that the caller of __vdso...() can pass context into the
> handler.
Hrm, I'm not a fan of adding a param that is only consumed by the handler,
especially when there are multiple alternatives, e.g. fudge the param in
assembly before calling __vdso(), have the enclave supply the context in a
volatile register, etc...
> Note that I've also reordered the stack parameters so that the stack
> order can be reused.
Ah, ret<->tcs, took me a minute...
Does preserving tsc->e->misc ordering matter all that much? __vdso() needs
to manually copy them either way. I ask because putting @misc at the end
would allow implementations that don't use @handler to omit the param (if
I've done my math correctly, which is always a big if). That would make
adding the handler-only param a little more palatable.
> > > 4. sub/add to %rsp rather than save/restore
> >
> > Can you elaborate on why you want to sub/add to %rsp instead of having the
> > enclave unwind the stack? Preserving %rsp across EEXIT/ERESUME seems more
> > in line with function call semantics, which I assume is desirable? E.g.
> >
> > push param3
> > push param2
> > push param1
> >
> > enclu[EEXIT]
> >
> > add $0x18, %rsp
>
> Before enclave EEXIT, the enclave restores %rsp to the value it had
> before EENTER was called. Then it pushes additional output arguments
> onto the stack. The enclave calls EENCLU[EEXIT].
>
> We are now in __vdso...() on the way back to the caller. However, %rsp
> has a different value than we entered the function with. This breaks
> x86_64 ABI, obviously. The handler needs to fix this up: how does it
> do so?
>
> In the current code, __vdso..() saves the value of %rsp, calls the
> handler and then restores %rsp. The handler can fix up the stack by
> setting the correct value to %rbx and returning without restoring it.
Ah, you're referring to the patch where the handler decides to return all
the way back to the caller of __vdso...().
> But this requires internal knowledge of the __vdso...() function,
> which could theoretically change in the future.
>
> If instead the __vdso...() only did add/sub, then the handler could do:
> 1. pop return address
> 2. pop handler stack params
> 3. pop enclave additional output stack params
> 4. push handler stack params
> 5. push return address
>
> While this is more work, it is standard calling convention work that
> doesn't require internal knowledge of __vdso..(). Alternatively, if we
> don't like the extra work, we can document the %rbx hack explicitly
> into the handler documentation and make it part of the interface. But
> we need some explicit way for the handler to pop enclave output stack
> params that doesn't depend on internal knowledge of the __vdso...()
> invariants.
IIUC, this is what you're suggesting? Having to align the stack makes this
a bit annoying, but it's not bad by any means.
diff --git a/arch/x86/entry/vdso/vsgx_enter_enclave.S b/arch/x86/entry/vdso/vsgx_enter_enclave.S
index 94a8e5f99961..05d54f79b557 100644
--- a/arch/x86/entry/vdso/vsgx_enter_enclave.S
+++ b/arch/x86/entry/vdso/vsgx_enter_enclave.S
@@ -139,8 +139,9 @@ SYM_FUNC_START(__vdso_sgx_enter_enclave)
/* Pass the untrusted RSP (at exit) to the callback via %rcx. */
mov %rsp, %rcx
- /* Save the untrusted RSP in %rbx (non-volatile register). */
+ /* Save the untrusted RSP offset in %rbx (non-volatile register). */
mov %rsp, %rbx
+ and $0xf, %rbx
/*
* Align stack per x86_64 ABI. Note, %rsp needs to be 16-byte aligned
@@ -161,8 +162,8 @@ SYM_FUNC_START(__vdso_sgx_enter_enclave)
mov 0x20(%rbp), %rax
call .Lretpoline
- /* Restore %rsp to its post-exit value. */
- mov %rbx, %rsp
+ /* Undo the post-exit %rsp adjustment. */
+ lea 0x20(%rsp,%rbx), %rsp
That's reasonable, let's the handler play more games with minimal overhead.
> > > That would make this a very usable and fast interface without
> > > sacrificing any of its current power.
> >
>
On Wed, Mar 11, 2020 at 01:30:07PM -0400, Nathaniel McCallum wrote:
> Currently, the selftest has a wrapper around
> __vdso_sgx_enter_enclave() which preserves all x86-64 ABI callee-saved
> registers (CSRs), though it uses none of them. Then it calls this
> function which uses %rbx but preserves none of the CSRs. Then it jumps
> into an enclave which zeroes all these registers before returning.
> Thus:
>
> 1. wrapper saves all CSRs
> 2. wrapper repositions stack arguments
> 3. __vdso_sgx_enter_enclave() modifies, but does not save %rbx
> 4. selftest zeros all CSRs
> 5. wrapper loads all CSRs
>
> I'd like to propose instead that the enclave be responsible for saving
> and restoring CSRs. So instead of the above we have:
> 1. __vdso_sgx_enter_enclave() saves %rbx
> 2. enclave saves CSRs
> 3. enclave loads CSRs
> 4. __vdso_sgx_enter_enclave() loads %rbx
>
> I know that lots of other stuff happens during enclave transitions,
> but at the very least we could reduce the number of instructions
> through this critical path.
What Jethro said and also that it is a good general principle to cut
down the semantics of any vdso as minimal as possible.
I.e. even if saving RBX would make somehow sense it *can* be left
out without loss in terms of what can be done with the vDSO.
/Jarkko
On Sun, Mar 15, 2020 at 02:27:46AM +0200, Jarkko Sakkinen wrote:
> On Thu, Mar 12, 2020 at 11:38:24AM -0700, Sean Christopherson wrote:
> > On Fri, Mar 06, 2020 at 08:47:02PM +0200, Jarkko Sakkinen wrote:
> > > On Thu, Mar 05, 2020 at 11:03:54AM -0800, Sean Christopherson wrote:
> > > > We've also discussed taking a file descriptor to hold the backing, but
> > > > unless I'm misreading the pagecache code, that doesn't solve the incorrect
> > > > accounting problem because the current task, i.e. evicting task, would be
> > > > charged. In other words, whether the backing is kernel or user controlled
> > > > is purely an ABI question.
> > >
> > > Even if the file is owned by a different process the account happens
> > > to "current"?
> >
> > Yes. Which makes sense as files do not have a 1:1 association with tasks.
>
> Yeah, that makes sense. Looking at mm/memory.c.
>
> Looking at finish_fault/alloc_set_pte/inc_mm_counter_fast code path that
> is also what happens.
Ugh, I meant __set_page_dirty/account_page_dirtied/task_io_account_write
path :-/ Anyway.
/Jarkko
On Thu, Mar 12, 2020 at 11:38:24AM -0700, Sean Christopherson wrote:
> On Fri, Mar 06, 2020 at 08:47:02PM +0200, Jarkko Sakkinen wrote:
> > On Thu, Mar 05, 2020 at 11:03:54AM -0800, Sean Christopherson wrote:
> > > We've also discussed taking a file descriptor to hold the backing, but
> > > unless I'm misreading the pagecache code, that doesn't solve the incorrect
> > > accounting problem because the current task, i.e. evicting task, would be
> > > charged. In other words, whether the backing is kernel or user controlled
> > > is purely an ABI question.
> >
> > Even if the file is owned by a different process the account happens
> > to "current"?
>
> Yes. Which makes sense as files do not have a 1:1 association with tasks.
Yeah, that makes sense. Looking at mm/memory.c.
Looking at finish_fault/alloc_set_pte/inc_mm_counter_fast code path that
is also what happens.
/Jarkko
On Fri, Mar 13, 2020 at 6:08 PM Sean Christopherson
<[email protected]> wrote:
>
> On Fri, Mar 13, 2020 at 04:14:01PM -0400, Nathaniel McCallum wrote:
> > On Fri, Mar 13, 2020 at 2:45 PM Sean Christopherson
> > <[email protected]> wrote:
> > > This doesn't compromise the ability to treat __vsdo...() like ENCLU if
> > > > you need the full power. But it does make it significantly easier to
> > > > consume when you don't have special needs. So as I see it, __vdso...()
> > > > should:
> > > >
> > > > 1. preserve %rbx
> > > > 2. take leaf in %rcx
> > > > 3. gain a void* stack param which is passed to the handler
> > >
> > > Unless I'm misunderstanding the request, this already exists. %rsp at the
> > > time of EEXIT is passed to the handler.
> >
> > Sorry, different stack parameter. I mean this:
> >
> > typedef int (*sgx_enclave_exit_handler_t)(
> > long rdi,
> > long rsi,
> > long rdx,
> > long ursp,
> > long r8,
> > long r9,
> > int ret,
> > void *tcs,
> > struct sgx_enclave_exception *e,
> > void *misc
> > );
> >
> > int __vdso_sgx_enter_enclave(
> > long rdi,
> > long rsi,
> > long rdx,
> > int leaf,
> > long r8,
> > long r9,
> > void *tcs,
> > struct sgx_enclave_exception *e,
> > void *misc,
> > sgx_enclave_exit_handler_t handler
> > );
> >
> > This is so that the caller of __vdso...() can pass context into the
> > handler.
>
> Hrm, I'm not a fan of adding a param that is only consumed by the handler,
> especially when there are multiple alternatives, e.g. fudge the param in
> assembly before calling __vdso(), have the enclave supply the context in a
> volatile register, etc...
Yes, but all of those require assembly. The whole point of this is
ergonomics without assembly. Once you can call __vdso() without
assembly, having to resort to assembly to make it useful will feel
painful. I imagine it would be pretty common to pass something like a
jmp_buf reference or a reference to a struct for collecting output
stack arguments through misc.
> > Note that I've also reordered the stack parameters so that the stack
> > order can be reused.
>
> Ah, ret<->tcs, took me a minute...
>
> Does preserving tsc->e->misc ordering matter all that much?
Not really. I was just trying to aid the reader of the assembly. If
there are more important concerns, fine.
> __vdso() needs
> to manually copy them either way. I ask because putting @misc at the end
> would allow implementations that don't use @handler to omit the param (if
> I've done my math correctly, which is always a big if). That would make
> adding the handler-only param a little more palatable.
Fine by me.
> > > > 4. sub/add to %rsp rather than save/restore
> > >
> > > Can you elaborate on why you want to sub/add to %rsp instead of having the
> > > enclave unwind the stack? Preserving %rsp across EEXIT/ERESUME seems more
> > > in line with function call semantics, which I assume is desirable? E.g.
> > >
> > > push param3
> > > push param2
> > > push param1
> > >
> > > enclu[EEXIT]
> > >
> > > add $0x18, %rsp
> >
> > Before enclave EEXIT, the enclave restores %rsp to the value it had
> > before EENTER was called. Then it pushes additional output arguments
> > onto the stack. The enclave calls EENCLU[EEXIT].
> >
> > We are now in __vdso...() on the way back to the caller. However, %rsp
> > has a different value than we entered the function with. This breaks
> > x86_64 ABI, obviously. The handler needs to fix this up: how does it
> > do so?
> >
> > In the current code, __vdso..() saves the value of %rsp, calls the
> > handler and then restores %rsp. The handler can fix up the stack by
> > setting the correct value to %rbx and returning without restoring it.
>
> Ah, you're referring to the patch where the handler decides to return all
> the way back to the caller of __vdso...().
>
> > But this requires internal knowledge of the __vdso...() function,
> > which could theoretically change in the future.
> >
> > If instead the __vdso...() only did add/sub, then the handler could do:
> > 1. pop return address
> > 2. pop handler stack params
> > 3. pop enclave additional output stack params
> > 4. push handler stack params
> > 5. push return address
> >
> > While this is more work, it is standard calling convention work that
> > doesn't require internal knowledge of __vdso..(). Alternatively, if we
> > don't like the extra work, we can document the %rbx hack explicitly
> > into the handler documentation and make it part of the interface. But
> > we need some explicit way for the handler to pop enclave output stack
> > params that doesn't depend on internal knowledge of the __vdso...()
> > invariants.
>
> IIUC, this is what you're suggesting? Having to align the stack makes this
> a bit annoying, but it's not bad by any means.
>
> diff --git a/arch/x86/entry/vdso/vsgx_enter_enclave.S b/arch/x86/entry/vdso/vsgx_enter_enclave.S
> index 94a8e5f99961..05d54f79b557 100644
> --- a/arch/x86/entry/vdso/vsgx_enter_enclave.S
> +++ b/arch/x86/entry/vdso/vsgx_enter_enclave.S
> @@ -139,8 +139,9 @@ SYM_FUNC_START(__vdso_sgx_enter_enclave)
> /* Pass the untrusted RSP (at exit) to the callback via %rcx. */
> mov %rsp, %rcx
>
> - /* Save the untrusted RSP in %rbx (non-volatile register). */
> + /* Save the untrusted RSP offset in %rbx (non-volatile register). */
> mov %rsp, %rbx
> + and $0xf, %rbx
>
> /*
> * Align stack per x86_64 ABI. Note, %rsp needs to be 16-byte aligned
> @@ -161,8 +162,8 @@ SYM_FUNC_START(__vdso_sgx_enter_enclave)
> mov 0x20(%rbp), %rax
> call .Lretpoline
>
> - /* Restore %rsp to its post-exit value. */
> - mov %rbx, %rsp
> + /* Undo the post-exit %rsp adjustment. */
> + lea 0x20(%rsp,%rbx), %rsp
>
>
> That's reasonable, let's the handler play more games with minimal overhead.
Yes, exactly!
> > > > That would make this a very usable and fast interface without
> > > > sacrificing any of its current power.
> > >
> >
>
On Sat, Mar 14, 2020 at 9:25 PM Jarkko Sakkinen
<[email protected]> wrote:
>
> On Wed, Mar 11, 2020 at 01:30:07PM -0400, Nathaniel McCallum wrote:
> > Currently, the selftest has a wrapper around
> > __vdso_sgx_enter_enclave() which preserves all x86-64 ABI callee-saved
> > registers (CSRs), though it uses none of them. Then it calls this
> > function which uses %rbx but preserves none of the CSRs. Then it jumps
> > into an enclave which zeroes all these registers before returning.
> > Thus:
> >
> > 1. wrapper saves all CSRs
> > 2. wrapper repositions stack arguments
> > 3. __vdso_sgx_enter_enclave() modifies, but does not save %rbx
> > 4. selftest zeros all CSRs
> > 5. wrapper loads all CSRs
> >
> > I'd like to propose instead that the enclave be responsible for saving
> > and restoring CSRs. So instead of the above we have:
> > 1. __vdso_sgx_enter_enclave() saves %rbx
> > 2. enclave saves CSRs
> > 3. enclave loads CSRs
> > 4. __vdso_sgx_enter_enclave() loads %rbx
> >
> > I know that lots of other stuff happens during enclave transitions,
> > but at the very least we could reduce the number of instructions
> > through this critical path.
>
> What Jethro said and also that it is a good general principle to cut
> down the semantics of any vdso as minimal as possible.
>
> I.e. even if saving RBX would make somehow sense it *can* be left
> out without loss in terms of what can be done with the vDSO.
Please read the rest of the thread. Sean and I have hammered out some
sensible and effective changes.
On 2020-03-15 18:53, Nathaniel McCallum wrote:
> On Sat, Mar 14, 2020 at 9:25 PM Jarkko Sakkinen
> <[email protected]> wrote:
>>
>> On Wed, Mar 11, 2020 at 01:30:07PM -0400, Nathaniel McCallum wrote:
>>> Currently, the selftest has a wrapper around
>>> __vdso_sgx_enter_enclave() which preserves all x86-64 ABI callee-saved
>>> registers (CSRs), though it uses none of them. Then it calls this
>>> function which uses %rbx but preserves none of the CSRs. Then it jumps
>>> into an enclave which zeroes all these registers before returning.
>>> Thus:
>>>
>>> 1. wrapper saves all CSRs
>>> 2. wrapper repositions stack arguments
>>> 3. __vdso_sgx_enter_enclave() modifies, but does not save %rbx
>>> 4. selftest zeros all CSRs
>>> 5. wrapper loads all CSRs
>>>
>>> I'd like to propose instead that the enclave be responsible for saving
>>> and restoring CSRs. So instead of the above we have:
>>> 1. __vdso_sgx_enter_enclave() saves %rbx
>>> 2. enclave saves CSRs
>>> 3. enclave loads CSRs
>>> 4. __vdso_sgx_enter_enclave() loads %rbx
>>>
>>> I know that lots of other stuff happens during enclave transitions,
>>> but at the very least we could reduce the number of instructions
>>> through this critical path.
>>
>> What Jethro said and also that it is a good general principle to cut
>> down the semantics of any vdso as minimal as possible.
>>
>> I.e. even if saving RBX would make somehow sense it *can* be left
>> out without loss in terms of what can be done with the vDSO.
>
> Please read the rest of the thread. Sean and I have hammered out some
> sensible and effective changes.
I'm not sure they're sensible? By departing from the ENCLU calling convention, both the VDSO and the wrapper become more complicated. The wrapper because now it needs to implement all kinds of logic for different behavior depending on whether the VDSO is or isn't available.
I agree with Jarkko that everything should be kept small and simple. Calling a couple extra instructions is going to have a negligible effect compared to the actual time EENTER/EEXIT take.
Can someone remind me why we're not passing TCS in RBX but on the stack?
--
Jethro Beekman | Fortanix
On Sun, 2020-03-15 at 13:53 -0400, Nathaniel McCallum wrote:
> On Sat, Mar 14, 2020 at 9:25 PM Jarkko Sakkinen
> <[email protected]> wrote:
> > On Wed, Mar 11, 2020 at 01:30:07PM -0400, Nathaniel McCallum wrote:
> > > Currently, the selftest has a wrapper around
> > > __vdso_sgx_enter_enclave() which preserves all x86-64 ABI callee-saved
> > > registers (CSRs), though it uses none of them. Then it calls this
> > > function which uses %rbx but preserves none of the CSRs. Then it jumps
> > > into an enclave which zeroes all these registers before returning.
> > > Thus:
> > >
> > > 1. wrapper saves all CSRs
> > > 2. wrapper repositions stack arguments
> > > 3. __vdso_sgx_enter_enclave() modifies, but does not save %rbx
> > > 4. selftest zeros all CSRs
> > > 5. wrapper loads all CSRs
> > >
> > > I'd like to propose instead that the enclave be responsible for saving
> > > and restoring CSRs. So instead of the above we have:
> > > 1. __vdso_sgx_enter_enclave() saves %rbx
> > > 2. enclave saves CSRs
> > > 3. enclave loads CSRs
> > > 4. __vdso_sgx_enter_enclave() loads %rbx
> > >
> > > I know that lots of other stuff happens during enclave transitions,
> > > but at the very least we could reduce the number of instructions
> > > through this critical path.
> >
> > What Jethro said and also that it is a good general principle to cut
> > down the semantics of any vdso as minimal as possible.
> >
> > I.e. even if saving RBX would make somehow sense it *can* be left
> > out without loss in terms of what can be done with the vDSO.
>
> Please read the rest of the thread. Sean and I have hammered out some
> sensible and effective changes.
Have skimmed through that discussion but it comes down how much you get
by obviously degrading some of the robustness. Complexity of the calling
pattern is not something that should be emphasized as that is something
that is anyway hidden inside the runtime.
/Jarkko
On Mon, Mar 16, 2020 at 9:32 AM Jethro Beekman <[email protected]> wrote:
>
> On 2020-03-15 18:53, Nathaniel McCallum wrote:
> > On Sat, Mar 14, 2020 at 9:25 PM Jarkko Sakkinen
> > <[email protected]> wrote:
> >>
> >> On Wed, Mar 11, 2020 at 01:30:07PM -0400, Nathaniel McCallum wrote:
> >>> Currently, the selftest has a wrapper around
> >>> __vdso_sgx_enter_enclave() which preserves all x86-64 ABI callee-saved
> >>> registers (CSRs), though it uses none of them. Then it calls this
> >>> function which uses %rbx but preserves none of the CSRs. Then it jumps
> >>> into an enclave which zeroes all these registers before returning.
> >>> Thus:
> >>>
> >>> 1. wrapper saves all CSRs
> >>> 2. wrapper repositions stack arguments
> >>> 3. __vdso_sgx_enter_enclave() modifies, but does not save %rbx
> >>> 4. selftest zeros all CSRs
> >>> 5. wrapper loads all CSRs
> >>>
> >>> I'd like to propose instead that the enclave be responsible for saving
> >>> and restoring CSRs. So instead of the above we have:
> >>> 1. __vdso_sgx_enter_enclave() saves %rbx
> >>> 2. enclave saves CSRs
> >>> 3. enclave loads CSRs
> >>> 4. __vdso_sgx_enter_enclave() loads %rbx
> >>>
> >>> I know that lots of other stuff happens during enclave transitions,
> >>> but at the very least we could reduce the number of instructions
> >>> through this critical path.
> >>
> >> What Jethro said and also that it is a good general principle to cut
> >> down the semantics of any vdso as minimal as possible.
> >>
> >> I.e. even if saving RBX would make somehow sense it *can* be left
> >> out without loss in terms of what can be done with the vDSO.
> >
> > Please read the rest of the thread. Sean and I have hammered out some
> > sensible and effective changes.
>
> I'm not sure they're sensible? By departing from the ENCLU calling convention, both the VDSO
> and the wrapper become more complicated.
For the vDSO, only marginally. I'm counting +4,-2 instructions in my
suggestions. For the wrapper, things become significantly simpler.
> The wrapper because now it needs to implement all
> kinds of logic for different behavior depending on whether the VDSO is or isn't available.
When isn't the vDSO available? Once the patches are merged it will
always be available. Then we also get to live with this interface
forever. I'd rather have a good, usable interface for the long term.
> I agree with Jarkko that everything should be kept small and simple. Calling a couple extra instructions is going to have a negligible effect compared to the actual time EENTER/EEXIT take.
We all agree on small and simple. Nothing I've proposed fails either
of those criteria.
> Can someone remind me why we're not passing TCS in RBX but on the stack?
If you do that, the vDSO will never be callable from C. And, as you've
stated above, calling a couple extra instructions is going to have a
negligible effect.
On 2020-03-16 14:57, Nathaniel McCallum wrote:
> On Mon, Mar 16, 2020 at 9:32 AM Jethro Beekman <[email protected]> wrote:
>>
>> On 2020-03-15 18:53, Nathaniel McCallum wrote:
>>> On Sat, Mar 14, 2020 at 9:25 PM Jarkko Sakkinen
>>> <[email protected]> wrote:
>>>>
>>>> On Wed, Mar 11, 2020 at 01:30:07PM -0400, Nathaniel McCallum wrote:
>>>>> Currently, the selftest has a wrapper around
>>>>> __vdso_sgx_enter_enclave() which preserves all x86-64 ABI callee-saved
>>>>> registers (CSRs), though it uses none of them. Then it calls this
>>>>> function which uses %rbx but preserves none of the CSRs. Then it jumps
>>>>> into an enclave which zeroes all these registers before returning.
>>>>> Thus:
>>>>>
>>>>> 1. wrapper saves all CSRs
>>>>> 2. wrapper repositions stack arguments
>>>>> 3. __vdso_sgx_enter_enclave() modifies, but does not save %rbx
>>>>> 4. selftest zeros all CSRs
>>>>> 5. wrapper loads all CSRs
>>>>>
>>>>> I'd like to propose instead that the enclave be responsible for saving
>>>>> and restoring CSRs. So instead of the above we have:
>>>>> 1. __vdso_sgx_enter_enclave() saves %rbx
>>>>> 2. enclave saves CSRs
>>>>> 3. enclave loads CSRs
>>>>> 4. __vdso_sgx_enter_enclave() loads %rbx
>>>>>
>>>>> I know that lots of other stuff happens during enclave transitions,
>>>>> but at the very least we could reduce the number of instructions
>>>>> through this critical path.
>>>>
>>>> What Jethro said and also that it is a good general principle to cut
>>>> down the semantics of any vdso as minimal as possible.
>>>>
>>>> I.e. even if saving RBX would make somehow sense it *can* be left
>>>> out without loss in terms of what can be done with the vDSO.
>>>
>>> Please read the rest of the thread. Sean and I have hammered out some
>>> sensible and effective changes.
>>
>> I'm not sure they're sensible? By departing from the ENCLU calling convention, both the VDSO
>> and the wrapper become more complicated.
>
> For the vDSO, only marginally. I'm counting +4,-2 instructions in my
> suggestions. For the wrapper, things become significantly simpler.
>
>> The wrapper because now it needs to implement all
>> kinds of logic for different behavior depending on whether the VDSO is or isn't available.
>
> When isn't the vDSO available?
When you're not on Linux. Or when you're on an old kernel.
--
Jethro Beekman | Fortanix
On Mon, Mar 16, 2020 at 9:56 AM Jarkko Sakkinen
<[email protected]> wrote:
>
> On Sun, 2020-03-15 at 13:53 -0400, Nathaniel McCallum wrote:
> > On Sat, Mar 14, 2020 at 9:25 PM Jarkko Sakkinen
> > <[email protected]> wrote:
> > > On Wed, Mar 11, 2020 at 01:30:07PM -0400, Nathaniel McCallum wrote:
> > > > Currently, the selftest has a wrapper around
> > > > __vdso_sgx_enter_enclave() which preserves all x86-64 ABI callee-saved
> > > > registers (CSRs), though it uses none of them. Then it calls this
> > > > function which uses %rbx but preserves none of the CSRs. Then it jumps
> > > > into an enclave which zeroes all these registers before returning.
> > > > Thus:
> > > >
> > > > 1. wrapper saves all CSRs
> > > > 2. wrapper repositions stack arguments
> > > > 3. __vdso_sgx_enter_enclave() modifies, but does not save %rbx
> > > > 4. selftest zeros all CSRs
> > > > 5. wrapper loads all CSRs
> > > >
> > > > I'd like to propose instead that the enclave be responsible for saving
> > > > and restoring CSRs. So instead of the above we have:
> > > > 1. __vdso_sgx_enter_enclave() saves %rbx
> > > > 2. enclave saves CSRs
> > > > 3. enclave loads CSRs
> > > > 4. __vdso_sgx_enter_enclave() loads %rbx
> > > >
> > > > I know that lots of other stuff happens during enclave transitions,
> > > > but at the very least we could reduce the number of instructions
> > > > through this critical path.
> > >
> > > What Jethro said and also that it is a good general principle to cut
> > > down the semantics of any vdso as minimal as possible.
> > >
> > > I.e. even if saving RBX would make somehow sense it *can* be left
> > > out without loss in terms of what can be done with the vDSO.
> >
> > Please read the rest of the thread. Sean and I have hammered out some
> > sensible and effective changes.
>
> Have skimmed through that discussion but it comes down how much you get
> by obviously degrading some of the robustness. Complexity of the calling
> pattern is not something that should be emphasized as that is something
> that is anyway hidden inside the runtime.
My suggestions explicitly maintained robustness, and in fact increased
it. If you think we've lost capability, please speak with specificity
rather than in vague generalities. Under my suggestions we can:
1. call the vDSO from C
2. pass context to the handler
3. have additional stack manipulation options in the handler
The cost for this is a net 2 additional instructions. No existing
capability is lost.
On Mon, Mar 16, 2020 at 9:59 AM Jethro Beekman <[email protected]> wrote:
>
> On 2020-03-16 14:57, Nathaniel McCallum wrote:
> > On Mon, Mar 16, 2020 at 9:32 AM Jethro Beekman <[email protected]> wrote:
> >>
> >> On 2020-03-15 18:53, Nathaniel McCallum wrote:
> >>> On Sat, Mar 14, 2020 at 9:25 PM Jarkko Sakkinen
> >>> <[email protected]> wrote:
> >>>>
> >>>> On Wed, Mar 11, 2020 at 01:30:07PM -0400, Nathaniel McCallum wrote:
> >>>>> Currently, the selftest has a wrapper around
> >>>>> __vdso_sgx_enter_enclave() which preserves all x86-64 ABI callee-saved
> >>>>> registers (CSRs), though it uses none of them. Then it calls this
> >>>>> function which uses %rbx but preserves none of the CSRs. Then it jumps
> >>>>> into an enclave which zeroes all these registers before returning.
> >>>>> Thus:
> >>>>>
> >>>>> 1. wrapper saves all CSRs
> >>>>> 2. wrapper repositions stack arguments
> >>>>> 3. __vdso_sgx_enter_enclave() modifies, but does not save %rbx
> >>>>> 4. selftest zeros all CSRs
> >>>>> 5. wrapper loads all CSRs
> >>>>>
> >>>>> I'd like to propose instead that the enclave be responsible for saving
> >>>>> and restoring CSRs. So instead of the above we have:
> >>>>> 1. __vdso_sgx_enter_enclave() saves %rbx
> >>>>> 2. enclave saves CSRs
> >>>>> 3. enclave loads CSRs
> >>>>> 4. __vdso_sgx_enter_enclave() loads %rbx
> >>>>>
> >>>>> I know that lots of other stuff happens during enclave transitions,
> >>>>> but at the very least we could reduce the number of instructions
> >>>>> through this critical path.
> >>>>
> >>>> What Jethro said and also that it is a good general principle to cut
> >>>> down the semantics of any vdso as minimal as possible.
> >>>>
> >>>> I.e. even if saving RBX would make somehow sense it *can* be left
> >>>> out without loss in terms of what can be done with the vDSO.
> >>>
> >>> Please read the rest of the thread. Sean and I have hammered out some
> >>> sensible and effective changes.
> >>
> >> I'm not sure they're sensible? By departing from the ENCLU calling convention, both the VDSO
> >> and the wrapper become more complicated.
> >
> > For the vDSO, only marginally. I'm counting +4,-2 instructions in my
> > suggestions. For the wrapper, things become significantly simpler.
> >
> >> The wrapper because now it needs to implement all
> >> kinds of logic for different behavior depending on whether the VDSO is or isn't available.
> >
> > When isn't the vDSO available?
>
> When you're not on Linux. Or when you're on an old kernel.
I fail to see why the Linux kernel should degrade its new interfaces
for those use cases.
On Mon, Mar 16, 2020 at 10:03:31AM -0400, Nathaniel McCallum wrote:
> On Mon, Mar 16, 2020 at 9:59 AM Jethro Beekman <[email protected]> wrote:
> >
> > On 2020-03-16 14:57, Nathaniel McCallum wrote:
> > > On Mon, Mar 16, 2020 at 9:32 AM Jethro Beekman <[email protected]> wrote:
> > >>
> > >> On 2020-03-15 18:53, Nathaniel McCallum wrote:
> > >>> On Sat, Mar 14, 2020 at 9:25 PM Jarkko Sakkinen
> > >>> <[email protected]> wrote:
> > >>>>
> > >>>> On Wed, Mar 11, 2020 at 01:30:07PM -0400, Nathaniel McCallum wrote:
> > >>>>> Currently, the selftest has a wrapper around
> > >>>>> __vdso_sgx_enter_enclave() which preserves all x86-64 ABI callee-saved
> > >>>>> registers (CSRs), though it uses none of them. Then it calls this
> > >>>>> function which uses %rbx but preserves none of the CSRs. Then it jumps
> > >>>>> into an enclave which zeroes all these registers before returning.
> > >>>>> Thus:
> > >>>>>
> > >>>>> 1. wrapper saves all CSRs
> > >>>>> 2. wrapper repositions stack arguments
> > >>>>> 3. __vdso_sgx_enter_enclave() modifies, but does not save %rbx
> > >>>>> 4. selftest zeros all CSRs
> > >>>>> 5. wrapper loads all CSRs
> > >>>>>
> > >>>>> I'd like to propose instead that the enclave be responsible for saving
> > >>>>> and restoring CSRs. So instead of the above we have:
> > >>>>> 1. __vdso_sgx_enter_enclave() saves %rbx
> > >>>>> 2. enclave saves CSRs
> > >>>>> 3. enclave loads CSRs
> > >>>>> 4. __vdso_sgx_enter_enclave() loads %rbx
> > >>>>>
> > >>>>> I know that lots of other stuff happens during enclave transitions,
> > >>>>> but at the very least we could reduce the number of instructions
> > >>>>> through this critical path.
> > >>>>
> > >>>> What Jethro said and also that it is a good general principle to cut
> > >>>> down the semantics of any vdso as minimal as possible.
> > >>>>
> > >>>> I.e. even if saving RBX would make somehow sense it *can* be left
> > >>>> out without loss in terms of what can be done with the vDSO.
> > >>>
> > >>> Please read the rest of the thread. Sean and I have hammered out some
> > >>> sensible and effective changes.
> > >>
> > >> I'm not sure they're sensible? By departing from the ENCLU calling
> > >> convention, both the VDSO and the wrapper become more complicated.
> > >
> > > For the vDSO, only marginally. I'm counting +4,-2 instructions in my
> > > suggestions. For the wrapper, things become significantly simpler.
> > >
> > >> The wrapper because now it needs to implement all kinds of logic for
> > >> different behavior depending on whether the VDSO is or isn't available.
How so? The wrapper, if one is needed, will need to have dedicated logic
for the vDSO no matter what interface is defined by the vDSO. Taking the
leaf in %rcx instead of %rax would at worst add a single instruction. At
best, it would eliminate the wrapper entirely by making the vDSO callable
from C, e.g. for enclaves+runtimes that treat EENTER/ERESUME as glorified
function calls, i.e. more or less follow the x86-64 ABI.
> > > When isn't the vDSO available?
> >
> > When you're not on Linux. Or when you're on an old kernel.
>
> I fail to see why the Linux kernel should degrade its new interfaces for
> those use cases.
There are effectively four related, but independent, changes to consider:
1. Make the RSP fixup in the "return from handler" path relative instead
of absolute.
2. Preserve RBX in the vDSO.
3. Use %rcx instead of %rax to pass @leaf.
4. Allow the untrusted runtime to pass a parameter directly to its exit
handler.
For me, #1 is an easy "yes". It's arguably a bug fix, and the cost is one
uop.
My vote for #2 and #3 would also be a strong "yes". Although passing @leaf
in %rcx technically diverges from ENCLU, I actually think it will make it
easier to swap between the vDSO and a bare ENCLU. E.g. have the prototype
for the vDSO be the prototype for the assembly wrapper:
typedef void (*enter_enclave_fn)(unsigned long rdi, unsigned long rsi,
unsigned long rdx, unsigned int leaf,
unsigned long r8, unsigned long r9,
void *tcs,
struct sgx_enclave_exception *e,
sgx_enclave_exit_handler_t handler);
int run_enclave(...)
{
enter_enclave_fn enter_enclave;
if (vdso)
enter_enclave = vdso;
else
enter_enclave = my_wrapper;
return enter_enclave(...);
}
I don't have a strong opinion on #4. It seems superfluous, but if the
parameter is buried at the end of the prototype then it can be completely
ignored by runtimes that don't utilize a handler.
On Mon, 2020-03-16 at 09:57 -0400, Nathaniel McCallum wrote:
> For the vDSO, only marginally. I'm counting +4,-2 instructions in my
> suggestions. For the wrapper, things become significantly simpler.
Simpler is not a quality that has very high importance here except
when it comes to vDSO.
At least it is not enough to change to vDSO. What else?
Anyway, I think the documentation should fixed and streamlined 1st.
It is way too verbose prose in some places and in some it completely
lacks the information e.g.
"Debug Exceptions (#DB) and Breakpoints (#BP) are ever fixed up and are
always delivered via standard signals."
Never should state things like that without explaining the reasons.
On the other hand:
"Most exceptions reported on ENCLU, including those that occur within
the enclave, are fixed up and reported synchronously instead of being
delivered via a standard signal. Debug Exceptions (#DB) and Breakpoints
(#BP) are never fixed up and are always delivered via standard signals.
On synchrously reported exceptions, -EFAULT is returned and details
about the exception are recorded in @e, the optional
sgx_enclave_exception struct."
Duplicates information already elsewhere (e.g. return values) and is
just pain to read and comprehend in general.
/Jarkko
On Mon, 2020-03-16 at 23:27 +0200, Jarkko Sakkinen wrote:
> On Mon, 2020-03-16 at 09:57 -0400, Nathaniel McCallum wrote:
> > For the vDSO, only marginally. I'm counting +4,-2 instructions in my
> > suggestions. For the wrapper, things become significantly simpler.
>
> Simpler is not a quality that has very high importance here except
> when it comes to vDSO.
>
> At least it is not enough to change to vDSO. What else?
~~
the
In any case, where I stand is that the vDSO implementation itself is
exactly how it should be. The process to get it to this form was
tedious. Now we have a form that the known userbase can live with.
The documentation sucks, agreed. I think by fixing that this would
be a wholelot better.
/Jarkko
On Mon, 2020-03-16 at 10:01 -0400, Nathaniel McCallum wrote:
> On Mon, Mar 16, 2020 at 9:56 AM Jarkko Sakkinen
> <[email protected]> wrote:
> > On Sun, 2020-03-15 at 13:53 -0400, Nathaniel McCallum wrote:
> > > On Sat, Mar 14, 2020 at 9:25 PM Jarkko Sakkinen
> > > <[email protected]> wrote:
> > > > On Wed, Mar 11, 2020 at 01:30:07PM -0400, Nathaniel McCallum wrote:
> > > > > Currently, the selftest has a wrapper around
> > > > > __vdso_sgx_enter_enclave() which preserves all x86-64 ABI callee-saved
> > > > > registers (CSRs), though it uses none of them. Then it calls this
> > > > > function which uses %rbx but preserves none of the CSRs. Then it jumps
> > > > > into an enclave which zeroes all these registers before returning.
> > > > > Thus:
> > > > >
> > > > > 1. wrapper saves all CSRs
> > > > > 2. wrapper repositions stack arguments
> > > > > 3. __vdso_sgx_enter_enclave() modifies, but does not save %rbx
> > > > > 4. selftest zeros all CSRs
> > > > > 5. wrapper loads all CSRs
> > > > >
> > > > > I'd like to propose instead that the enclave be responsible for saving
> > > > > and restoring CSRs. So instead of the above we have:
> > > > > 1. __vdso_sgx_enter_enclave() saves %rbx
> > > > > 2. enclave saves CSRs
> > > > > 3. enclave loads CSRs
> > > > > 4. __vdso_sgx_enter_enclave() loads %rbx
> > > > >
> > > > > I know that lots of other stuff happens during enclave transitions,
> > > > > but at the very least we could reduce the number of instructions
> > > > > through this critical path.
> > > >
> > > > What Jethro said and also that it is a good general principle to cut
> > > > down the semantics of any vdso as minimal as possible.
> > > >
> > > > I.e. even if saving RBX would make somehow sense it *can* be left
> > > > out without loss in terms of what can be done with the vDSO.
> > >
> > > Please read the rest of the thread. Sean and I have hammered out some
> > > sensible and effective changes.
> >
> > Have skimmed through that discussion but it comes down how much you get
> > by obviously degrading some of the robustness. Complexity of the calling
> > pattern is not something that should be emphasized as that is something
> > that is anyway hidden inside the runtime.
>
> My suggestions explicitly maintained robustness, and in fact increased
> it. If you think we've lost capability, please speak with specificity
> rather than in vague generalities. Under my suggestions we can:
> 1. call the vDSO from C
> 2. pass context to the handler
> 3. have additional stack manipulation options in the handler
>
> The cost for this is a net 2 additional instructions. No existing
> capability is lost.
My vague generality in this case is just that the whole design
approach so far has been to minimize the amount of wrapping to
EENTER. And since this has been kind of agreed by most of the
stakeholders doing something against the chosen strategy is
something I do hold some resistance.
I get the idea technically what you are suggesting. Please
understand these are orthogonal axes that I have to care about.
In coummunity sense, it opens a possibility to unknown unknowns [1].
[1] https://www.youtube.com/watch?v=GiPe1OiKQuk
/Jarkko
On Mon, Mar 16, 2020 at 11:38:24PM +0200, Jarkko Sakkinen wrote:
> On Mon, 2020-03-16 at 10:01 -0400, Nathaniel McCallum wrote:
> > On Mon, Mar 16, 2020 at 9:56 AM Jarkko Sakkinen
> > <[email protected]> wrote:
> > > On Sun, 2020-03-15 at 13:53 -0400, Nathaniel McCallum wrote:
> > > > On Sat, Mar 14, 2020 at 9:25 PM Jarkko Sakkinen
> > > > <[email protected]> wrote:
> > > > > On Wed, Mar 11, 2020 at 01:30:07PM -0400, Nathaniel McCallum wrote:
> > > > > > Currently, the selftest has a wrapper around
> > > > > > __vdso_sgx_enter_enclave() which preserves all x86-64 ABI callee-saved
> > > > > > registers (CSRs), though it uses none of them. Then it calls this
> > > > > > function which uses %rbx but preserves none of the CSRs. Then it jumps
> > > > > > into an enclave which zeroes all these registers before returning.
> > > > > > Thus:
> > > > > >
> > > > > > 1. wrapper saves all CSRs
> > > > > > 2. wrapper repositions stack arguments
> > > > > > 3. __vdso_sgx_enter_enclave() modifies, but does not save %rbx
> > > > > > 4. selftest zeros all CSRs
> > > > > > 5. wrapper loads all CSRs
> > > > > >
> > > > > > I'd like to propose instead that the enclave be responsible for saving
> > > > > > and restoring CSRs. So instead of the above we have:
> > > > > > 1. __vdso_sgx_enter_enclave() saves %rbx
> > > > > > 2. enclave saves CSRs
> > > > > > 3. enclave loads CSRs
> > > > > > 4. __vdso_sgx_enter_enclave() loads %rbx
> > > > > >
> > > > > > I know that lots of other stuff happens during enclave transitions,
> > > > > > but at the very least we could reduce the number of instructions
> > > > > > through this critical path.
> > > > >
> > > > > What Jethro said and also that it is a good general principle to cut
> > > > > down the semantics of any vdso as minimal as possible.
> > > > >
> > > > > I.e. even if saving RBX would make somehow sense it *can* be left
> > > > > out without loss in terms of what can be done with the vDSO.
> > > >
> > > > Please read the rest of the thread. Sean and I have hammered out some
> > > > sensible and effective changes.
> > >
> > > Have skimmed through that discussion but it comes down how much you get
> > > by obviously degrading some of the robustness. Complexity of the calling
> > > pattern is not something that should be emphasized as that is something
> > > that is anyway hidden inside the runtime.
> >
> > My suggestions explicitly maintained robustness, and in fact increased
> > it. If you think we've lost capability, please speak with specificity
> > rather than in vague generalities. Under my suggestions we can:
> > 1. call the vDSO from C
> > 2. pass context to the handler
> > 3. have additional stack manipulation options in the handler
> >
> > The cost for this is a net 2 additional instructions. No existing
> > capability is lost.
>
> My vague generality in this case is just that the whole design
> approach so far has been to minimize the amount of wrapping to
> EENTER.
Yes and no. If we wanted to minimize the amount of wrapping around the
vDSO's ENCLU then we wouldn't have the exit handler shenanigans in the
first place. The whole process has been about balancing the wants of each
use case against the overall quality of the API and code.
> And since this has been kind of agreed by most of the
> stakeholders doing something against the chosen strategy is
> something I do hold some resistance.
Up until Nathaniel joined the party, the only stakeholder in terms of the
exit handler was the Intel SDK. There was a general consensus to pass
registers as-is when there isn't a strong reason to do otherwise. Note
that Nathaniel has also expressed approval of that approach.
So I think the question that needs to be answered is whether the benefits
of using %rcx instead of %rax to pass @leaf justify the "pass registers
as-is" guideline. We've effectively already given this waiver for %rbx,
as the whole reason why the TCS is passed in on the stack instead of via
%rbx is so that it can be passed to the exit handler. E.g. the vDSO
could take the TCS in %rbx and save it on the stack, but we're throwing
the baby out with the bathwater at that point.
The major benefits being that the vDSO would be callable from C and that
the kernel could define a legitimate prototype instead of a frankenstein
prototype that's half assembly and half C. For me, those are significant
benefits and well worth the extra MOV, PUSH and POP. For some use cases
it would eliminate the need for an assembly wrapper. For runtimes that
need an assembly wrapper for whatever reason, it's probably still a win as
a well designed runtime can avoid register shuffling in the wrapper. And
if there is a runtime that isn't covered by the above, it's at worst an
extra MOV.
On Mon, Mar 16, 2020 at 02:31:36PM +0100, Jethro Beekman wrote:
> Can someone remind me why we're not passing TCS in RBX but on the stack?
I finally remembered why. It's pulled off the stack and passed into the
exit handler. I'm pretty sure the vDSO could take it in %rbx and manually
save it on the stack, but I'd rather keep the current behavior so that the
vDSO is callable from C (assuming @leaf is changed to be passed via %rcx).
On 3/16/2020 3:53 PM, Sean Christopherson wrote:
> On Mon, Mar 16, 2020 at 11:38:24PM +0200, Jarkko Sakkinen wrote:
>> On Mon, 2020-03-16 at 10:01 -0400, Nathaniel McCallum wrote:
>>> On Mon, Mar 16, 2020 at 9:56 AM Jarkko Sakkinen
>>> <[email protected]> wrote:
>>>> On Sun, 2020-03-15 at 13:53 -0400, Nathaniel McCallum wrote:
>>>>> On Sat, Mar 14, 2020 at 9:25 PM Jarkko Sakkinen
>>>>> <[email protected]> wrote:
>>>>>> On Wed, Mar 11, 2020 at 01:30:07PM -0400, Nathaniel McCallum wrote:
>>>>>>> Currently, the selftest has a wrapper around
>>>>>>> __vdso_sgx_enter_enclave() which preserves all x86-64 ABI callee-saved
>>>>>>> registers (CSRs), though it uses none of them. Then it calls this
>>>>>>> function which uses %rbx but preserves none of the CSRs. Then it jumps
>>>>>>> into an enclave which zeroes all these registers before returning.
>>>>>>> Thus:
>>>>>>>
>>>>>>> 1. wrapper saves all CSRs
>>>>>>> 2. wrapper repositions stack arguments
>>>>>>> 3. __vdso_sgx_enter_enclave() modifies, but does not save %rbx
>>>>>>> 4. selftest zeros all CSRs
>>>>>>> 5. wrapper loads all CSRs
>>>>>>>
>>>>>>> I'd like to propose instead that the enclave be responsible for saving
>>>>>>> and restoring CSRs. So instead of the above we have:
>>>>>>> 1. __vdso_sgx_enter_enclave() saves %rbx
>>>>>>> 2. enclave saves CSRs
>>>>>>> 3. enclave loads CSRs
>>>>>>> 4. __vdso_sgx_enter_enclave() loads %rbx
>>>>>>>
>>>>>>> I know that lots of other stuff happens during enclave transitions,
>>>>>>> but at the very least we could reduce the number of instructions
>>>>>>> through this critical path.
>>>>>>
>>>>>> What Jethro said and also that it is a good general principle to cut
>>>>>> down the semantics of any vdso as minimal as possible.
>>>>>>
>>>>>> I.e. even if saving RBX would make somehow sense it *can* be left
>>>>>> out without loss in terms of what can be done with the vDSO.
>>>>>
>>>>> Please read the rest of the thread. Sean and I have hammered out some
>>>>> sensible and effective changes.
>>>>
>>>> Have skimmed through that discussion but it comes down how much you get
>>>> by obviously degrading some of the robustness. Complexity of the calling
>>>> pattern is not something that should be emphasized as that is something
>>>> that is anyway hidden inside the runtime.
>>>
>>> My suggestions explicitly maintained robustness, and in fact increased
>>> it. If you think we've lost capability, please speak with specificity
>>> rather than in vague generalities. Under my suggestions we can:
>>> 1. call the vDSO from C
>>> 2. pass context to the handler
>>> 3. have additional stack manipulation options in the handler
>>>
>>> The cost for this is a net 2 additional instructions. No existing
>>> capability is lost.
>>
>> My vague generality in this case is just that the whole design
>> approach so far has been to minimize the amount of wrapping to
>> EENTER.
>
> Yes and no. If we wanted to minimize the amount of wrapping around the
> vDSO's ENCLU then we wouldn't have the exit handler shenanigans in the
> first place. The whole process has been about balancing the wants of each
> use case against the overall quality of the API and code.
>
The design of this vDSO API was NOT to minimize wrapping, but to allow
maximal flexibility. More specifically, we strove not to restrict how
info was exchanged between the enclave and its host process. After all,
calling convention is compiler specific - i.e. the enclave could be
built by a different compiler (e.g. MSVC) that doesn't share the same
list of CSRs as the host process. Therefore, the API has been
implemented to pass through virtually all registers except those used by
EENTER itself. Similarly, all registers are passed back from enclave to
the caller (or the exit handler) except those used by EEXIT. %rbp is an
exception because the vDSO API has to anchor the stack, using either
%rsp or %rbp. We picked %rbp to allow the enclave to allocate space on
the stack.
On 3/16/2020 3:55 PM, Sean Christopherson wrote:
> On Mon, Mar 16, 2020 at 02:31:36PM +0100, Jethro Beekman wrote:
>> Can someone remind me why we're not passing TCS in RBX but on the stack?
>
> I finally remembered why. It's pulled off the stack and passed into the
> exit handler. I'm pretty sure the vDSO could take it in %rbx and manually
> save it on the stack, but I'd rather keep the current behavior so that the
> vDSO is callable from C (assuming @leaf is changed to be passed via %rcx).
>
The idea is that the caller of this vDSO API is C callable, hence it
cannot receive TCS in %rbx anyway. Then it has to either MOV to %rbx or
PUSH to stack. Either way the complexity is the same. The vDSO API
however has to always save it on stack for exit handler. So receiving it
via stack ends up in simplest code.
On Mon, Mar 16, 2020 at 04:50:26PM -0700, Xing, Cedric wrote:
> On 3/16/2020 3:53 PM, Sean Christopherson wrote:
> >On Mon, Mar 16, 2020 at 11:38:24PM +0200, Jarkko Sakkinen wrote:
> >>>My suggestions explicitly maintained robustness, and in fact increased
> >>>it. If you think we've lost capability, please speak with specificity
> >>>rather than in vague generalities. Under my suggestions we can:
> >>>1. call the vDSO from C
> >>>2. pass context to the handler
> >>>3. have additional stack manipulation options in the handler
> >>>
> >>>The cost for this is a net 2 additional instructions. No existing
> >>>capability is lost.
> >>
> >>My vague generality in this case is just that the whole design
> >>approach so far has been to minimize the amount of wrapping to
> >>EENTER.
> >
> >Yes and no. If we wanted to minimize the amount of wrapping around the
> >vDSO's ENCLU then we wouldn't have the exit handler shenanigans in the
> >first place. The whole process has been about balancing the wants of each
> >use case against the overall quality of the API and code.
> >
> The design of this vDSO API was NOT to minimize wrapping, but to allow
> maximal flexibility. More specifically, we strove not to restrict how info
> was exchanged between the enclave and its host process. After all, calling
> convention is compiler specific - i.e. the enclave could be built by a
> different compiler (e.g. MSVC) that doesn't share the same list of CSRs as
> the host process. Therefore, the API has been implemented to pass through
> virtually all registers except those used by EENTER itself. Similarly, all
> registers are passed back from enclave to the caller (or the exit handler)
> except those used by EEXIT. %rbp is an exception because the vDSO API has to
> anchor the stack, using either %rsp or %rbp. We picked %rbp to allow the
> enclave to allocate space on the stack.
And unless I'm missing something, using %rcx to pass @leaf would still
satisfy the above, correct? Ditto for saving/restoring %rbx.
I.e. a runtime that's designed to work with enclave's using a different
calling convention wouldn't be able to take advantage of being able to call
the vDSO from C, but neither would it take on any meaningful burden.
On 3/16/2020 4:59 PM, Sean Christopherson wrote:
> On Mon, Mar 16, 2020 at 04:50:26PM -0700, Xing, Cedric wrote:
>> On 3/16/2020 3:53 PM, Sean Christopherson wrote:
>>> On Mon, Mar 16, 2020 at 11:38:24PM +0200, Jarkko Sakkinen wrote:
>>>>> My suggestions explicitly maintained robustness, and in fact increased
>>>>> it. If you think we've lost capability, please speak with specificity
>>>>> rather than in vague generalities. Under my suggestions we can:
>>>>> 1. call the vDSO from C
>>>>> 2. pass context to the handler
>>>>> 3. have additional stack manipulation options in the handler
>>>>>
>>>>> The cost for this is a net 2 additional instructions. No existing
>>>>> capability is lost.
>>>>
>>>> My vague generality in this case is just that the whole design
>>>> approach so far has been to minimize the amount of wrapping to
>>>> EENTER.
>>>
>>> Yes and no. If we wanted to minimize the amount of wrapping around the
>>> vDSO's ENCLU then we wouldn't have the exit handler shenanigans in the
>>> first place. The whole process has been about balancing the wants of each
>>> use case against the overall quality of the API and code.
>>>
>> The design of this vDSO API was NOT to minimize wrapping, but to allow
>> maximal flexibility. More specifically, we strove not to restrict how info
>> was exchanged between the enclave and its host process. After all, calling
>> convention is compiler specific - i.e. the enclave could be built by a
>> different compiler (e.g. MSVC) that doesn't share the same list of CSRs as
>> the host process. Therefore, the API has been implemented to pass through
>> virtually all registers except those used by EENTER itself. Similarly, all
>> registers are passed back from enclave to the caller (or the exit handler)
>> except those used by EEXIT. %rbp is an exception because the vDSO API has to
>> anchor the stack, using either %rsp or %rbp. We picked %rbp to allow the
>> enclave to allocate space on the stack.
>
> And unless I'm missing something, using %rcx to pass @leaf would still
> satisfy the above, correct? Ditto for saving/restoring %rbx.
>
> I.e. a runtime that's designed to work with enclave's using a different
> calling convention wouldn't be able to take advantage of being able to call
> the vDSO from C, but neither would it take on any meaningful burden.
>
Not exactly.
If called directly from C code, the caller would expect CSRs to be
preserved. Then who should preserve CSRs? It can't be the enclave
because it may not follow the same calling convention. Moreover, the
enclave may run into an exception, in which case it doesn't have the
ability to restore CSRs. So it has to be done by the vDSO API. That
means CSRs will be overwritten upon enclave exits, which violates the
goal of "passing all registers back to the caller except those used by
EEXIT".
On Mon, Mar 16, 2020 at 05:18:14PM -0700, Xing, Cedric wrote:
> On 3/16/2020 4:59 PM, Sean Christopherson wrote:
> >On Mon, Mar 16, 2020 at 04:50:26PM -0700, Xing, Cedric wrote:
> >>On 3/16/2020 3:53 PM, Sean Christopherson wrote:
> >>>On Mon, Mar 16, 2020 at 11:38:24PM +0200, Jarkko Sakkinen wrote:
> >>>>>My suggestions explicitly maintained robustness, and in fact increased
> >>>>>it. If you think we've lost capability, please speak with specificity
> >>>>>rather than in vague generalities. Under my suggestions we can:
> >>>>>1. call the vDSO from C
> >>>>>2. pass context to the handler
> >>>>>3. have additional stack manipulation options in the handler
> >>>>>
> >>>>>The cost for this is a net 2 additional instructions. No existing
> >>>>>capability is lost.
> >>>>
> >>>>My vague generality in this case is just that the whole design
> >>>>approach so far has been to minimize the amount of wrapping to
> >>>>EENTER.
> >>>
> >>>Yes and no. If we wanted to minimize the amount of wrapping around the
> >>>vDSO's ENCLU then we wouldn't have the exit handler shenanigans in the
> >>>first place. The whole process has been about balancing the wants of each
> >>>use case against the overall quality of the API and code.
> >>>
> >>The design of this vDSO API was NOT to minimize wrapping, but to allow
> >>maximal flexibility. More specifically, we strove not to restrict how info
> >>was exchanged between the enclave and its host process. After all, calling
> >>convention is compiler specific - i.e. the enclave could be built by a
> >>different compiler (e.g. MSVC) that doesn't share the same list of CSRs as
> >>the host process. Therefore, the API has been implemented to pass through
> >>virtually all registers except those used by EENTER itself. Similarly, all
> >>registers are passed back from enclave to the caller (or the exit handler)
> >>except those used by EEXIT. %rbp is an exception because the vDSO API has to
> >>anchor the stack, using either %rsp or %rbp. We picked %rbp to allow the
> >>enclave to allocate space on the stack.
> >
> >And unless I'm missing something, using %rcx to pass @leaf would still
> >satisfy the above, correct? Ditto for saving/restoring %rbx.
> >
> >I.e. a runtime that's designed to work with enclave's using a different
> >calling convention wouldn't be able to take advantage of being able to call
> >the vDSO from C, but neither would it take on any meaningful burden.
> >
> Not exactly.
>
> If called directly from C code, the caller would expect CSRs to be
> preserved. Then who should preserve CSRs? It can't be the enclave because it
> may not follow the same calling convention. Moreover, the enclave may run
> into an exception, in which case it doesn't have the ability to restore
> CSRs. So it has to be done by the vDSO API. That means CSRs will be
> overwritten upon enclave exits, which violates the goal of "passing all
> registers back to the caller except those used by EEXIT".
IIUC, Nathaniel's use case is to run only enclaves that are compatible
with Linux's calling convention and to handle enclave exceptions in the
exit handler.
As I qualified above, there would certainly be runtimes and use cases that
would find no advantage in passing @leaf via %rcx and preserving %rbx. I'm
well aware the Intel SDK falls into that bucket. But again, the cost to
such runtimes is precisely one reg->reg MOV instruction.
On Tue, Mar 10, 2020 at 02:29:41PM -0500, Haitao Huang wrote:
Good evening, I hope the week is going well for everyone.
> >Just as a clarification, are you testing the new driver against
> >signed production class enclaves in .so format that also include
> >metadata layout directives or is the driver just getting tested
> >against the two page toy enclave that copies a word of memory from
> >one memory location to another?
> We (Intel SGX SDK/PSW team) tested this driver for enclaves in .so
> format with metadata. Our 2.8 release supports v24 and 2.9 supports
> v25+. Both production signed and debug signed enclaves worked.
>
> *Note* we did make some code changes in our runtime for v24+, mainly
> dealing with src & EPC page alignment for EADD, open one fd per
> enclave, use -z noexecstack linker option, etc. You can see the
> changes on GitHub.
Lots of knobs getting turned at the same time but we sorted out all
the issues and our runtime is now passing its regression tests with
the new driver, with an exception that we note below.
I suspect that we might have the only complete and architecturally
independent runtime implementation so if the new driver is working
against yours and ours it would seem to be a reasonable test spectrum
for the driver.
> >We see the same behavior from both our unit test enclaves and the
> >Quoting Enclave from the Intel SGX runtime.
> We did not see any issue loading QE in our tests. Please directly
> email me on this test if you have specific questions.
As it turns out the major problem we were running into with respect to
the QE test was the fact that generic use of atexit() handlers was
disabled by changes that went into the 2.8 SDK. Our runtime and SDK
assume that enclave atexit() handling works.
The enclave UNINIT ECALL is only allowed on runtimes that are
advertising EDMM support. That seems excessively restrictive since
atexit() handling is generically useful for enclaves that are not
using EDMM. Our runtime allows EDMM to be disabled and we have
enclaves that gate on that for security purposes.
On a quasi-related note, it appears that the 1.4 compatibility
metadata created by post 2.0 signing tools is leaking layout
descriptors that a version 1.4 runtime doesn't understand.
Do you want to exchange e-mail on this or should we direct
conversations about these issues with others on your SDK team.
Have a good remainder of the week.
Dr. Greg
As always,
Dr. Greg Wettstein, Ph.D, Worker SGX secured infrastructure and
Enjellic Systems Development, LLC autonomously self-defensive
4206 N. 19th Ave. platforms.
Fargo, ND 58102
PH: 701-281-1686 EMAIL: [email protected]
------------------------------------------------------------------------------
"All parts should go together without forcing. You must remember that
the parts you are reassembling were disassembled by you. Therefore,
if you can't get them together again, there must be a reason. By all
means, do not use a hammer."
-- IBM maintenance manual, 1925
I tested with the Open Enclave SDK test suite (~200 test and sample
enclaves), no issues. Used Intel PSW version 2.8.
Tested-by: Jordan Hand <[email protected]>
Thanks,
Jordan
On 3/3/20 3:35 PM, Jarkko Sakkinen wrote:
> Intel(R) SGX is a set of CPU instructions that can be used by applications
> to set aside private regions of code and data. The code outside the enclave
> is disallowed to access the memory inside the enclave by the CPU access
> control.
>
> There is a new hardware unit in the processor called Memory Encryption
> Engine (MEE) starting from the Skylake microacrhitecture. BIOS can define
> one or many MEE regions that can hold enclave data by configuring them with
> PRMRR registers.
>
> The MEE automatically encrypts the data leaving the processor package to
> the MEE regions. The data is encrypted using a random key whose life-time
> is exactly one power cycle.
>
> The current implementation requires that the firmware sets
> IA32_SGXLEPUBKEYHASH* MSRs as writable so that ultimately the kernel can
> decide what enclaves it wants run. The implementation does not create
> any bottlenecks to support read-only MSRs later on.
>
> You can tell if your CPU supports SGX by looking into /proc/cpuinfo:
>
> cat /proc/cpuinfo | grep sgx
>
> v28:
> * Documented to Documentation/x86/sgx.rst how the kernel manages the
> enclave ownership.
> * Removed non-LC flow from sgx_einit().
> * Removed struct sgx_einittoken since only the size of the corresponding
> microarchitectural structure is used in the series ATM.
>
> v27:
> * Disallow RIE processes to use enclaves as there could a permission
> conflict between VMA and enclave permissions.
> * In the documentation, replace "grep /proc/cpuinfo" with
> "grep sgx /proc/cpuinfo".
>
> v26:
> * Fixed the commit author in "x86/sgx: Linux Enclave Driver", which was
> changed in v25 by mistake.
> * Addressed a bunch of grammar mistakes in sgx.rst (thanks Randy once
> again for such a detailed feedback).
> * Added back the MAINTAINERS update commit, which was mistakenly removed
> in v25.
> * EREMOVE's for SECS cannot be done while sanitizing an EPC section. The
> CPU does not allow to remove a SECS page before all of its children have
> been removed, and a child page can be in some other section than the one
> currently being processed. Thus, removed special SECS processing from
> sgx_sanitize_page() and instead put sections through it twice. In the
> 2nd round the lists should only contain SECS pages.
>
> v25:
> * Fix a double-free issue when SGX_IOC_ENCLAVE_ADD_PAGES
> fails on executing ENCLS[EADD]. The rollback path executed
> radix_tree_delete() on the same address twice when this happened.
> * Return -EINTR instead of -ERESTARTSYS in SGX_IOC_ENCLAVE_ADD_PAGES when
> a signal is pending.
> * As requested by Borislav, move the CPUID 0x12 features to their own word
> in cpufeatures.
> * Sean fixed a bug from sgx_reclaimer_write() where sgx_encl_put_backing()
> was called with an uninitialized pointer when sgx_encl_get_backing()
> fails.
> * Migrated /dev/sgx/* to misc. This is future-proof as struct miscdevice
> has 'groups' for setting up sysfs attributes for the device.
> * Use device_initcall instead of subsys_initcall so that misc_class is
> initialized before SGX is initialized.
> * Return -EACCES in SGX_IOC_ENCLAVE_INIT when caller tries to select
> enclave attributes that we the kernel does not allow it to set instead
> of -EINVAL.
> * Unless SGX public key MSRs are writable always deny the feature from
> Linux. Previously this was only denied from driver. How VMs should be
> supported is not really part of initial patch set, which makes this
> an obvious choice.
> * Cleaned up and refined documentation to be more approachable.
>
> v24:
> * Reclaim unmeasured and TCS pages (regression in v23).
> * Replace usages of GFP_HIGHUSER with GFP_KERNEL.
> * Return -EIO on when EADD or EEXTEND fails in %SGX_IOC_ENCLAVE_ADD_PAGES
> and use the same rollback (destroy enclave). This can happen when host
> suspends itself unknowingly to a VM running enclaves. From -EIO the user
> space can deduce what happened.
> * Have a separate @count in struct sgx_enclave_add_pages to output number
> of bytes processed instead of overwriting the input parameters for
> clarity and more importantly that the API provides means for partial
> processing (@count could be less than @length in success case).
>
> v23:
> * Replace SGX_ENCLAVE_ADD_PAGE with SGX_ENCLAVE_ADD_PAGES. Replace @mrmask
> with %SGX_PAGE_MEASURE flag.
> * Return -EIO instead of -ECANCELED when ptrace() fails to read a TCS page.
> * In the reclaimer, pin page before ENCLS[EBLOCK] because pinning can fail
> (because of OOM) even in legit behaviour and after EBLOCK the reclaiming
> flow can be only reverted by killing the whole enclave.
> * Fixed SGX_ATTR_RESERVED_MASK. Bit 7 was marked as reserved while in fact
> it should have been bit 6 (Table 37-3 in the SDM).
> * Return -EPERM from SGX_IOC_ENCLAVE_INIT when ENCLS[EINIT] returns an SGX
> error code.
>
> v22:
> * Refined bunch commit messages and added associated SDM references as
> many of them were too exhausting and some outdated.
> * Alignment checks have been removed from mmap() because it does not define the
> ELRANGE. VMAs only act as windows to the enclave. The semantics compare
> somewhat how mmap() works with regular files.
> * We now require user space addresses given to SGX_IOC_ENCLAVE_ADD_PAGE to be
> page aligned so that we can pass the page directly to EADD and do not have
> to do an extra copy. This was made effectively possible by removing the
> worker thread for adding pages.
> * The selftest build files have been refined throughout of various glitches
> and work properly in a cross compilation environment such as BuildRoot.
> In addition, libcalls fail the build with an assertion in the linker
> script, if they end up to the enclave binary.
> * CONFIG_INTEL_SGX_DRIVER has been removed because you cannot use SGX core
> for anything without having the driver. This could change when KVM support
> is added.
> * We require zero permissions in SECINFO for TCS pages because the CPU
> overwrites SECINFO flags with zero permissions and measures the page
> only after that. Allowing to pass TCS with non-zero permissions would
> cause mismatching measurement between the one provided in SIGSTRUCT and
> the one computed by the CPU.
> * Obviously lots of small fixes and clean ups (does make sense to
> document them all).
>
> v21:
> * Check on mmap() that the VMA does cover an area that does not have
> enclave pages. Only mapping with PROT_NONE can do that to reserve
> initial address space for an enclave.
> * Check om mmap() and mprotect() that the VMA permissions do not
> surpass the enclave permissions.
> * Remove two refcounts from vma_close(): mm_list and encl->refcount.
> Enclave refcount is only need for swapper/enclave sync and we can
> remove mm_list refcount by destroying mm_struct when the process
> is closed. By not having vm_close() the Linux MM can merge VMAs.
> * Do not naturally align MAP_FIXED address.
> * Numerous small fixes and clean ups.
> * Use SRCU for synchronizing the list of mm_struct's.
> * Move to stack based call convention in the vDSO.
>
> v20:
> * Fine-tune Kconfig messages and spacing and remove MMU_NOTIFIER
> dependency as MMU notifiers are no longer used in the driver.
> * Use mm_users instead of mm_count as refcount for mm_struct as mm_count
> only protects from deleting mm_struct, not removing its contents.
> * Sanitize EPC when the reclaimer thread starts by doing EREMOVE for all
> of them. They could be in initialized state when the kernel starts
> because it might be spawned by kexec().
> * Documentation overhaul.
> * Use a device /dev/sgx/provision for delivering the provision token
> instead of securityfs.
> * Create a reference to the enclave when already when opening
> /dev/sgx/enclave. The file is then associated with this enclave only.
> mmap() can be done at free at any point and always get a reference to
> the enclave. To summarize the file now represents the enclave.
>
> v19:
> * Took 3-4 months but in some sense this was more like a rewrite of most
> of the corners of the source code. If I've forgotten to deal with some
> feedback, please don't shout me. Make a remark and I will fix it for
> the next version. Hopefully there won't be this big turnovers anymore.
> * Validate SECS attributes properly against CPUID given attributes and
> against allowed attributes. SECS attributes are the ones that are
> enforced whereas SIGSTRUCT attributes tell what is required to run
> the enclave.
> * Add KSS (Key Sharing Support) to the enclave attributes.
> * Deny MAP_PRIVATE as an enclave is always a shared memory entity.
> * Revert back to shmem backing storage so that it can be easily shared
> by multiple processes.
> * Split the recognization of an ENCLS leaf failure by using three
> functions to detect it: encsl_faulted(), encls_returned_code() and
> sgx_failed(). encls_failed() is only caused by a spurious expections that
> should never happen. Thus, it is not defined as an inline function in
> order to easily insert a kprobe to it.
> * Move low-level enclave management routines, page fault handler and page
> reclaiming routines from driver to the core. These cannot be separated
> from each other as they are heavily interdependent. The rationale is that
> the core does not call any code from the driver.
> * Allow the driver to be compiled as a module now that it no code is using
> its routines and it only uses exported symbols. Now the driver is
> essentially just a thin ioctl layer.
> * Reworked the driver to maintain a list of mm_struct's. The VMA callbacks
> add new entries to this list as the process is forked. Each entry has
> its own refcount because they have a different life-cycle as the enclave
> does. In effect @tgid and @mm have been removed from struct sgx_encl
> and we allow forking by removing VM_DONTCOPY from vm flags.
> * Generate a cpu mask in the reclaimer from the cpu mask's of all
> mm_struct's. This will kick out the hardware threads out of the enclave
> from multiple processes. It is not a local variable because it would
> eat too much of the stack space but instead a field in struct
> sgx_encl.
> * Allow forking i.e. remove VM_DONTCOPY. I did not change the API
> because the old API scaled to the workload that Andy described. The
> codebase is now mostly API independent i.e. changing the API is a
> small task. For me the proper trigger to chanage it is a as concrete
> as possible workload that cannot be fulfilled. I hope you understand
> my thinking here. I don't want to change anything w/o proper basis
> but I'm ready to change anything if there is a proper basis. I do
> not have any kind of attachment to any particular type of API.
> * Add Sean's vDSO ENCLS(EENTER) patches and update selftest to use the
> new vDSO.
>
> v18:
> * Update the ioctl-number.txt.
> * Move the driver under arch/x86.
> * Add SGX features (SGX, SGX1, SGX2) to the disabled-features.h.
> * Rename the selftest as test_sgx (previously sgx-selftest).
> * In order to enable process accounting, swap EPC pages and PCMD's to a VMA
> instead of shmem.
> * Allow only to initialize and run enclaves with a subset of
> {DEBUG, MODE64BIT} set.
> * Add SGX_IOC_ENCLAVE_SET_ATTRIBUTE to allow an enclave to have privileged
> attributes e.g. PROVISIONKEY.
>
> v17:
> * Add a simple selftest.
> * Fix a null pointer dereference to section->pages when its
> allocation fails.
> * Add Sean's description of the exception handling to the documentation.
>
> v16:
> * Fixed SOB's in the commits that were a bit corrupted in v15.
> * Implemented exceptio handling properly to detect_sgx().
> * Use GENMASK() to define SGX_CPUID_SUB_LEAF_TYPE_MASK.
> * Updated the documentation to use rst definition lists.
> * Added the missing Documentation/x86/index.rst, which has a link to
> intel_sgx.rst. Now the SGX and uapi documentation is properly generated
> with 'make htmldocs'.
> * While enumerating EPC sections, if an undefined section is found, fail
> the driver initialization instead of continuing the initialization.
> * Issue a warning if there are more than %SGX_MAX_EPC_SECTIONS.
> * Remove copyright notice from arch/x86/include/asm/sgx.h.
> * Migrated from ioremap_cache() to memremap().
>
> v15:
> * Split into more digestable size patches.
> * Lots of small fixes and clean ups.
> * Signal a "plain" SIGSEGV on an EPCM violation.
>
> v14:
> * Change the comment about X86_FEATURE_SGX_LC from “SGX launch
> configuration” to “SGX launch control”.
> * Move the SGX-related CPU feature flags as part of the Linux defined
> virtual leaf 8.
> * Add SGX_ prefix to the constants defining the ENCLS leaf functions.
> * Use GENMASK*() and BIT*() in sgx_arch.h instead of raw hex numbers.
> * Refine the long description for CONFIG_INTEL_SGX_CORE.
> * Do not use pr_*_ratelimited() in the driver. The use of the rate limited
> versions is legacy cruft from the prototyping phase.
> * Detect sleep with SGX_INVALID_EINIT_TOKEN instead of counting power
> cycles.
> * Manually prefix with “sgx:” in the core SGX code instead of redefining
> pr_fmt.
> * Report if IA32_SGXLEPUBKEYHASHx MSRs are not writable in the driver
> instead of core because it is a driver requirement.
> * Change prompt to bool in the entry for CONFIG_INTEL_SGX_CORE because the
> default is ‘n’.
> * Rename struct sgx_epc_bank as struct sgx_epc_section in order to match
> the SDM.
> * Allocate struct sgx_epc_page instances one at a time.
> * Use “__iomem void *” pointers for the mapped EPC memory consistently.
> * Retry once on SGX_INVALID_TOKEN in sgx_einit() instead of counting power
> cycles.
> * Call enclave swapping operations directly from the driver instead of
> calling them .indirectly through struct sgx_epc_page_ops because indirect
> calls are not required yet as the patch set does not contain the KVM
> support.
> * Added special signal SEGV_SGXERR to notify about SGX EPCM violation
> errors.
>
> v13:
> * Always use SGX_CPUID constant instead of a hardcoded value.
> * Simplified and documented the macros and functions for ENCLS leaves.
> * Enable sgx_free_page() to free active enclave pages on demand
> in order to allow sgx_invalidate() to delete enclave pages.
> It no longer performs EREMOVE if a page is in the process of
> being reclaimed.
> * Use PM notifier per enclave so that we don't have to traverse
> the global list of active EPC pages to find enclaves.
> * Removed unused SGX_LE_ROLLBACK constant from uapi/asm/sgx.h
> * Always use ioremap() to map EPC banks as we only support 64-bit kernel.
> * Invalidate IA32_SGXLEPUBKEYHASH cache used by sgx_einit() when going
> to sleep.
>
> v12:
> * Split to more narrow scoped commits in order to ease the review process and
> use co-developed-by tag for co-authors of commits instead of listing them in
> the source files.
> * Removed cruft EXPORT_SYMBOL() declarations and converted to static variables.
> * Removed in-kernel LE i.e. this version of the SGX software stack only
> supports unlocked IA32_SGXLEPUBKEYHASHx MSRs.
> * Refined documentation on launching enclaves, swapping and enclave
> construction.
> * Refined sgx_arch.h to include alignment information for every struct that
> requires it and removed structs that are not needed without an LE.
> * Got rid of SGX_CPUID.
> * SGX detection now prints log messages about firmware configuration issues.
>
> v11:
> * Polished ENCLS wrappers with refined exception handling.
> * ksgxswapd was not stopped (regression in v5) in
> sgx_page_cache_teardown(), which causes a leaked kthread after driver
> deinitialization.
> * Shutdown sgx_le_proxy when going to suspend because its EPC pages will be
> invalidated when resuming, which will cause it not function properly
> anymore.
> * Set EINITTOKEN.VALID to zero for a token that is passed when
> SGXLEPUBKEYHASH matches MRSIGNER as alloc_page() does not give a zero
> page.
> * Fixed the check in sgx_edbgrd() for a TCS page. Allowed to read offsets
> around the flags field, which causes a #GP. Only flags read is readable.
> * On read access memcpy() call inside sgx_vma_access() had src and dest
> parameters in wrong order.
> * The build issue with CONFIG_KASAN is now fixed. Added undefined symbols
> to LE even if “KASAN_SANITIZE := false” was set in the makefile.
> * Fixed a regression in the #PF handler. If a page has
> SGX_ENCL_PAGE_RESERVED flag the #PF handler should unconditionally fail.
> It did not, which caused weird races when trying to change other parts of
> swapping code.
> * EPC management has been refactored to a flat LRU cache and moved to
> arch/x86. The swapper thread reads a cluster of EPC pages and swaps all
> of them. It can now swap from multiple enclaves in the same round.
> * For the sake of consistency with SGX_IOC_ENCLAVE_ADD_PAGE, return -EINVAL
> when an enclave is already initialized or dead instead of zero.
>
> v10:
> * Cleaned up anon inode based IPC between the ring-0 and ring-3 parts
> of the driver.
> * Unset the reserved flag from an enclave page if EDBGRD/WR fails
> (regression in v6).
> * Close the anon inode when LE is stopped (regression in v9).
> * Update the documentation with a more detailed description of SGX.
>
> v9:
> * Replaced kernel-LE IPC based on pipes with an anonymous inode.
> The driver does not require anymore new exports.
>
> v8:
> * Check that public key MSRs match the LE public key hash in the
> driver initialization when the MSRs are read-only.
> * Fix the race in VA slot allocation by checking the fullness
> immediately after succeesful allocation.
> * Fix the race in hash mrsigner calculation between the launch
> enclave and user enclaves by having a separate lock for hash
> calculation.
>
> v7:
> * Fixed offset calculation in sgx_edbgr/wr(). Address was masked with PAGE_MASK
> when it should have been masked with ~PAGE_MASK.
> * Fixed a memory leak in sgx_ioc_enclave_create().
> * Simplified swapping code by using a pointer array for a cluster
> instead of a linked list.
> * Squeezed struct sgx_encl_page to 32 bytes.
> * Fixed deferencing of an RSA key on OpenSSL 1.1.0.
> * Modified TC's CMAC to use kernel AES-NI. Restructured the code
> a bit in order to better align with kernel conventions.
>
> v6:
> * Fixed semaphore underrun when accessing /dev/sgx from the launch enclave.
> * In sgx_encl_create() s/IS_ERR(secs)/IS_ERR(encl)/.
> * Removed virtualization chapter from the documentation.
> * Changed the default filename for the signing key as signing_key.pem.
> * Reworked EPC management in a way that instead of a linked list of
> struct sgx_epc_page instances there is an array of integers that
> encodes address and bank of an EPC page (the same data as 'pa' field
> earlier). The locking has been moved to the EPC bank level instead
> of a global lock.
> * Relaxed locking requirements for EPC management. EPC pages can be
> released back to the EPC bank concurrently.
> * Cleaned up ptrace() code.
> * Refined commit messages for new architectural constants.
> * Sorted includes in every source file.
> * Sorted local variable declarations according to the line length in
> every function.
> * Style fixes based on Darren's comments to sgx_le.c.
>
> v5:
> * Described IPC between the Launch Enclave and kernel in the commit messages.
> * Fixed all relevant checkpatch.pl issues that I have forgot fix in earlier
> versions except those that exist in the imported TinyCrypt code.
> * Fixed spelling mistakes in the documentation.
> * Forgot to check the return value of sgx_drv_subsys_init().
> * Encapsulated properly page cache init and teardown.
> * Collect epc pages to a temp list in sgx_add_epc_bank
> * Removed SGX_ENCLAVE_INIT_ARCH constant.
>
> v4:
> * Tied life-cycle of the sgx_le_proxy process to /dev/sgx.
> * Removed __exit annotation from sgx_drv_subsys_exit().
> * Fixed a leak of a backing page in sgx_process_add_page_req() in the
> case when vm_insert_pfn() fails.
> * Removed unused symbol exports for sgx_page_cache.c.
> * Updated sgx_alloc_page() to require encl parameter and documented the
> behavior (Sean Christopherson).
> * Refactored a more lean API for sgx_encl_find() and documented the behavior.
> * Moved #PF handler to sgx_fault.c.
> * Replaced subsys_system_register() with plain bus_register().
> * Retry EINIT 2nd time only if MSRs are not locked.
>
> v3:
> * Check that FEATURE_CONTROL_LOCKED and FEATURE_CONTROL_SGX_ENABLE are set.
> * Return -ERESTARTSYS in __sgx_encl_add_page() when sgx_alloc_page() fails.
> * Use unused bits in epc_page->pa to store the bank number.
> * Removed #ifdef for WQ_NONREENTRANT.
> * If mmu_notifier_register() fails with -EINTR, return -ERESTARTSYS.
> * Added --remove-section=.got.plt to objcopy flags in order to prevent a
> dummy .got.plt, which will cause an inconsistent size for the LE.
> * Documented sgx_encl_* functions.
> * Added remark about AES implementation used inside the LE.
> * Removed redundant sgx_sys_exit() from le/main.c.
> * Fixed struct sgx_secinfo alignment from 128 to 64 bytes.
> * Validate miscselect in sgx_encl_create().
> * Fixed SSA frame size calculation to take the misc region into account.
> * Implemented consistent exception handling to __encls() and __encls_ret().
> * Implemented a proper device model in order to allow sysfs attributes
> and in-kernel API.
> * Cleaned up various "find enclave" implementations to the unified
> sgx_encl_find().
> * Validate that vm_pgoff is zero.
> * Discard backing pages with shmem_truncate_range() after EADD.
> * Added missing EEXTEND operations to LE signing and launch.
> * Fixed SSA size for GPRS region from 168 to 184 bytes.
> * Fixed the checks for TCS flags. Now DBGOPTIN is allowed.
> * Check that TCS addresses are in ELRANGE and not just page aligned.
> * Require kernel to be compiled with X64_64 and CPU_SUP_INTEL.
> * Fixed an incorrect value for SGX_ATTR_DEBUG from 0x01 to 0x02.
>
> v2:
> * get_rand_uint32() changed the value of the pointer instead of value
> where it is pointing at.
> * Launch enclave incorrectly used sigstruct attributes-field instead of
> enclave attributes-field.
> * Removed unused struct sgx_add_page_req from sgx_ioctl.c
> * Removed unused sgx_has_sgx2.
> * Updated arch/x86/include/asm/sgx.h so that it provides stub
> implementations when sgx in not enabled.
> * Removed cruft rdmsr-calls from sgx_set_pubkeyhash_msrs().
> * return -ENOMEM in sgx_alloc_page() when VA pages consume too much space
> * removed unused global sgx_nr_pids
> * moved sgx_encl_release to sgx_encl.c
> * return -ERESTARTSYS instead of -EINTR in sgx_encl_init()
>
> Jarkko Sakkinen (12):
> x86/sgx: Update MAINTAINERS
> x86/sgx: Add SGX microarchitectural data structures
> x86/sgx: Add wrappers for ENCLS leaf functions
> x86/sgx: Add functions to allocate and free EPC pages
> x86/sgx: Linux Enclave Driver
> docs: x86/sgx: Document SGX micro architecture and kernel internals
> selftests/x86: Recurse into subdirectories
> selftests/x86: Add a selftest for SGX
> x86/sgx: Add provisioning
> x86/sgx: Add a page reclaimer
> x86/sgx: ptrace() support for the SGX driver
> selftests/x86: Add vDSO selftest for SGX
>
> Sean Christopherson (10):
> x86/cpufeatures: x86/msr: Add Intel SGX hardware bits
> x86/cpufeatures: x86/msr: Intel SGX Launch Control hardware bits
> x86/mm: x86/sgx: Signal SIGSEGV with PF_SGX
> x86/cpu/intel: Detect SGX supprt
> x86/sgx: Enumerate and track EPC sections
> mm: Introduce vm_ops->may_mprotect()
> x86/vdso: Add support for exception fixup in vDSO functions
> x86/fault: Add helper function to sanitize error code
> x86/traps: Attempt to fixup exceptions in vDSO before signaling
> x86/vdso: Implement a vDSO for Intel SGX enclave call
>
> .../userspace-api/ioctl/ioctl-number.rst | 1 +
> Documentation/x86/index.rst | 1 +
> Documentation/x86/sgx.rst | 192 +++++
> MAINTAINERS | 11 +
> arch/x86/Kconfig | 14 +
> arch/x86/entry/vdso/Makefile | 8 +-
> arch/x86/entry/vdso/extable.c | 46 +
> arch/x86/entry/vdso/extable.h | 29 +
> arch/x86/entry/vdso/vdso-layout.lds.S | 9 +-
> arch/x86/entry/vdso/vdso.lds.S | 1 +
> arch/x86/entry/vdso/vdso2c.h | 58 +-
> arch/x86/entry/vdso/vsgx_enter_enclave.S | 187 ++++
> arch/x86/include/asm/cpufeature.h | 5 +-
> arch/x86/include/asm/cpufeatures.h | 8 +-
> arch/x86/include/asm/disabled-features.h | 18 +-
> arch/x86/include/asm/msr-index.h | 8 +
> arch/x86/include/asm/required-features.h | 2 +-
> arch/x86/include/asm/traps.h | 1 +
> arch/x86/include/asm/vdso.h | 5 +
> arch/x86/include/uapi/asm/sgx.h | 114 +++
> arch/x86/kernel/cpu/Makefile | 1 +
> arch/x86/kernel/cpu/common.c | 4 +
> arch/x86/kernel/cpu/feat_ctl.c | 29 +-
> arch/x86/kernel/cpu/sgx/Makefile | 6 +
> arch/x86/kernel/cpu/sgx/arch.h | 343 ++++++++
> arch/x86/kernel/cpu/sgx/driver.c | 209 +++++
> arch/x86/kernel/cpu/sgx/driver.h | 32 +
> arch/x86/kernel/cpu/sgx/encl.c | 757 ++++++++++++++++
> arch/x86/kernel/cpu/sgx/encl.h | 127 +++
> arch/x86/kernel/cpu/sgx/encls.h | 238 ++++++
> arch/x86/kernel/cpu/sgx/ioctl.c | 805 ++++++++++++++++++
> arch/x86/kernel/cpu/sgx/main.c | 280 ++++++
> arch/x86/kernel/cpu/sgx/reclaim.c | 458 ++++++++++
> arch/x86/kernel/cpu/sgx/sgx.h | 108 +++
> arch/x86/kernel/traps.c | 14 +
> arch/x86/mm/fault.c | 45 +-
> include/linux/mm.h | 2 +
> mm/mprotect.c | 14 +-
> tools/arch/x86/include/asm/cpufeatures.h | 7 +-
> tools/testing/selftests/x86/Makefile | 44 +
> tools/testing/selftests/x86/sgx/.gitignore | 3 +
> tools/testing/selftests/x86/sgx/Makefile | 48 ++
> tools/testing/selftests/x86/sgx/defines.h | 17 +
> tools/testing/selftests/x86/sgx/encl.c | 20 +
> tools/testing/selftests/x86/sgx/encl.lds | 34 +
> .../selftests/x86/sgx/encl_bootstrap.S | 94 ++
> tools/testing/selftests/x86/sgx/main.c | 379 +++++++++
> tools/testing/selftests/x86/sgx/sgx_call.S | 66 ++
> tools/testing/selftests/x86/sgx/sgx_call.h | 14 +
> tools/testing/selftests/x86/sgx/sgxsign.c | 493 +++++++++++
> .../testing/selftests/x86/sgx/signing_key.pem | 39 +
> 51 files changed, 5417 insertions(+), 31 deletions(-)
> create mode 100644 Documentation/x86/sgx.rst
> create mode 100644 arch/x86/entry/vdso/extable.c
> create mode 100644 arch/x86/entry/vdso/extable.h
> create mode 100644 arch/x86/entry/vdso/vsgx_enter_enclave.S
> create mode 100644 arch/x86/include/uapi/asm/sgx.h
> create mode 100644 arch/x86/kernel/cpu/sgx/Makefile
> create mode 100644 arch/x86/kernel/cpu/sgx/arch.h
> create mode 100644 arch/x86/kernel/cpu/sgx/driver.c
> create mode 100644 arch/x86/kernel/cpu/sgx/driver.h
> create mode 100644 arch/x86/kernel/cpu/sgx/encl.c
> create mode 100644 arch/x86/kernel/cpu/sgx/encl.h
> create mode 100644 arch/x86/kernel/cpu/sgx/encls.h
> create mode 100644 arch/x86/kernel/cpu/sgx/ioctl.c
> create mode 100644 arch/x86/kernel/cpu/sgx/main.c
> create mode 100644 arch/x86/kernel/cpu/sgx/reclaim.c
> create mode 100644 arch/x86/kernel/cpu/sgx/sgx.h
> create mode 100644 tools/testing/selftests/x86/sgx/.gitignore
> create mode 100644 tools/testing/selftests/x86/sgx/Makefile
> create mode 100644 tools/testing/selftests/x86/sgx/defines.h
> create mode 100644 tools/testing/selftests/x86/sgx/encl.c
> create mode 100644 tools/testing/selftests/x86/sgx/encl.lds
> create mode 100644 tools/testing/selftests/x86/sgx/encl_bootstrap.S
> create mode 100644 tools/testing/selftests/x86/sgx/main.c
> create mode 100644 tools/testing/selftests/x86/sgx/sgx_call.S
> create mode 100644 tools/testing/selftests/x86/sgx/sgx_call.h
> create mode 100644 tools/testing/selftests/x86/sgx/sgxsign.c
> create mode 100644 tools/testing/selftests/x86/sgx/signing_key.pem
>
On Mon, Mar 16, 2020 at 6:53 PM Sean Christopherson
<[email protected]> wrote:
>
> On Mon, Mar 16, 2020 at 11:38:24PM +0200, Jarkko Sakkinen wrote:
> > On Mon, 2020-03-16 at 10:01 -0400, Nathaniel McCallum wrote:
> > > On Mon, Mar 16, 2020 at 9:56 AM Jarkko Sakkinen
> > > <[email protected]> wrote:
> > > > On Sun, 2020-03-15 at 13:53 -0400, Nathaniel McCallum wrote:
> > > > > On Sat, Mar 14, 2020 at 9:25 PM Jarkko Sakkinen
> > > > > <[email protected]> wrote:
> > > > > > On Wed, Mar 11, 2020 at 01:30:07PM -0400, Nathaniel McCallum wrote:
> > > > > > > Currently, the selftest has a wrapper around
> > > > > > > __vdso_sgx_enter_enclave() which preserves all x86-64 ABI callee-saved
> > > > > > > registers (CSRs), though it uses none of them. Then it calls this
> > > > > > > function which uses %rbx but preserves none of the CSRs. Then it jumps
> > > > > > > into an enclave which zeroes all these registers before returning.
> > > > > > > Thus:
> > > > > > >
> > > > > > > 1. wrapper saves all CSRs
> > > > > > > 2. wrapper repositions stack arguments
> > > > > > > 3. __vdso_sgx_enter_enclave() modifies, but does not save %rbx
> > > > > > > 4. selftest zeros all CSRs
> > > > > > > 5. wrapper loads all CSRs
> > > > > > >
> > > > > > > I'd like to propose instead that the enclave be responsible for saving
> > > > > > > and restoring CSRs. So instead of the above we have:
> > > > > > > 1. __vdso_sgx_enter_enclave() saves %rbx
> > > > > > > 2. enclave saves CSRs
> > > > > > > 3. enclave loads CSRs
> > > > > > > 4. __vdso_sgx_enter_enclave() loads %rbx
> > > > > > >
> > > > > > > I know that lots of other stuff happens during enclave transitions,
> > > > > > > but at the very least we could reduce the number of instructions
> > > > > > > through this critical path.
> > > > > >
> > > > > > What Jethro said and also that it is a good general principle to cut
> > > > > > down the semantics of any vdso as minimal as possible.
> > > > > >
> > > > > > I.e. even if saving RBX would make somehow sense it *can* be left
> > > > > > out without loss in terms of what can be done with the vDSO.
> > > > >
> > > > > Please read the rest of the thread. Sean and I have hammered out some
> > > > > sensible and effective changes.
> > > >
> > > > Have skimmed through that discussion but it comes down how much you get
> > > > by obviously degrading some of the robustness. Complexity of the calling
> > > > pattern is not something that should be emphasized as that is something
> > > > that is anyway hidden inside the runtime.
> > >
> > > My suggestions explicitly maintained robustness, and in fact increased
> > > it. If you think we've lost capability, please speak with specificity
> > > rather than in vague generalities. Under my suggestions we can:
> > > 1. call the vDSO from C
> > > 2. pass context to the handler
> > > 3. have additional stack manipulation options in the handler
> > >
> > > The cost for this is a net 2 additional instructions. No existing
> > > capability is lost.
> >
> > My vague generality in this case is just that the whole design
> > approach so far has been to minimize the amount of wrapping to
> > EENTER.
>
> Yes and no. If we wanted to minimize the amount of wrapping around the
> vDSO's ENCLU then we wouldn't have the exit handler shenanigans in the
> first place. The whole process has been about balancing the wants of each
> use case against the overall quality of the API and code.
>
> > And since this has been kind of agreed by most of the
> > stakeholders doing something against the chosen strategy is
> > something I do hold some resistance.
>
> Up until Nathaniel joined the party, the only stakeholder in terms of the
> exit handler was the Intel SDK.
I would hope that having additional stakeholders would ease the path
to adoption.
> There was a general consensus to pass
> registers as-is when there isn't a strong reason to do otherwise. Note
> that Nathaniel has also expressed approval of that approach.
I still approve that approach.
> So I think the question that needs to be answered is whether the benefits
> of using %rcx instead of %rax to pass @leaf justify the "pass registers
> as-is" guideline. We've effectively already given this waiver for %rbx,
> as the whole reason why the TCS is passed in on the stack instead of via
> %rbx is so that it can be passed to the exit handler. E.g. the vDSO
> could take the TCS in %rbx and save it on the stack, but we're throwing
> the baby out with the bathwater at that point.
>
> The major benefits being that the vDSO would be callable from C and that
> the kernel could define a legitimate prototype instead of a frankenstein
> prototype that's half assembly and half C. For me, those are significant
> benefits and well worth the extra MOV, PUSH and POP. For some use cases
> it would eliminate the need for an assembly wrapper. For runtimes that
> need an assembly wrapper for whatever reason, it's probably still a win as
> a well designed runtime can avoid register shuffling in the wrapper. And
> if there is a runtime that isn't covered by the above, it's at worst an
> extra MOV.
>
On Mon, Mar 16, 2020 at 8:27 PM Sean Christopherson
<[email protected]> wrote:
>
> On Mon, Mar 16, 2020 at 05:18:14PM -0700, Xing, Cedric wrote:
> > On 3/16/2020 4:59 PM, Sean Christopherson wrote:
> > >On Mon, Mar 16, 2020 at 04:50:26PM -0700, Xing, Cedric wrote:
> > >>On 3/16/2020 3:53 PM, Sean Christopherson wrote:
> > >>>On Mon, Mar 16, 2020 at 11:38:24PM +0200, Jarkko Sakkinen wrote:
> > >>>>>My suggestions explicitly maintained robustness, and in fact increased
> > >>>>>it. If you think we've lost capability, please speak with specificity
> > >>>>>rather than in vague generalities. Under my suggestions we can:
> > >>>>>1. call the vDSO from C
> > >>>>>2. pass context to the handler
> > >>>>>3. have additional stack manipulation options in the handler
> > >>>>>
> > >>>>>The cost for this is a net 2 additional instructions. No existing
> > >>>>>capability is lost.
> > >>>>
> > >>>>My vague generality in this case is just that the whole design
> > >>>>approach so far has been to minimize the amount of wrapping to
> > >>>>EENTER.
> > >>>
> > >>>Yes and no. If we wanted to minimize the amount of wrapping around the
> > >>>vDSO's ENCLU then we wouldn't have the exit handler shenanigans in the
> > >>>first place. The whole process has been about balancing the wants of each
> > >>>use case against the overall quality of the API and code.
> > >>>
> > >>The design of this vDSO API was NOT to minimize wrapping, but to allow
> > >>maximal flexibility. More specifically, we strove not to restrict how info
> > >>was exchanged between the enclave and its host process. After all, calling
> > >>convention is compiler specific - i.e. the enclave could be built by a
> > >>different compiler (e.g. MSVC) that doesn't share the same list of CSRs as
> > >>the host process. Therefore, the API has been implemented to pass through
> > >>virtually all registers except those used by EENTER itself. Similarly, all
> > >>registers are passed back from enclave to the caller (or the exit handler)
> > >>except those used by EEXIT. %rbp is an exception because the vDSO API has to
> > >>anchor the stack, using either %rsp or %rbp. We picked %rbp to allow the
> > >>enclave to allocate space on the stack.
> > >
> > >And unless I'm missing something, using %rcx to pass @leaf would still
> > >satisfy the above, correct? Ditto for saving/restoring %rbx.
> > >
> > >I.e. a runtime that's designed to work with enclave's using a different
> > >calling convention wouldn't be able to take advantage of being able to call
> > >the vDSO from C, but neither would it take on any meaningful burden.
> > >
> > Not exactly.
> >
> > If called directly from C code, the caller would expect CSRs to be
> > preserved. Then who should preserve CSRs? It can't be the enclave because it
> > may not follow the same calling convention. Moreover, the enclave may run
> > into an exception, in which case it doesn't have the ability to restore
> > CSRs. So it has to be done by the vDSO API. That means CSRs will be
> > overwritten upon enclave exits, which violates the goal of "passing all
> > registers back to the caller except those used by EEXIT".
>
> IIUC, Nathaniel's use case is to run only enclaves that are compatible
> with Linux's calling convention and to handle enclave exceptions in the
> exit handler.
>
> As I qualified above, there would certainly be runtimes and use cases that
> would find no advantage in passing @leaf via %rcx and preserving %rbx. I'm
> well aware the Intel SDK falls into that bucket. But again, the cost to
> such runtimes is precisely one reg->reg MOV instruction.
It seems to me that some think my proposal represents a shift in
strategic direction. I do not see it that way. I affirm the existing
strategic direction. My proposal only represents a specific
optimization of that strategic direction that benefits certain use
cases without significant cost to all other use cases.
On Mon, Mar 16, 2020 at 8:18 PM Xing, Cedric <[email protected]> wrote:
>
> On 3/16/2020 4:59 PM, Sean Christopherson wrote:
> > On Mon, Mar 16, 2020 at 04:50:26PM -0700, Xing, Cedric wrote:
> >> On 3/16/2020 3:53 PM, Sean Christopherson wrote:
> >>> On Mon, Mar 16, 2020 at 11:38:24PM +0200, Jarkko Sakkinen wrote:
> >>>>> My suggestions explicitly maintained robustness, and in fact increased
> >>>>> it. If you think we've lost capability, please speak with specificity
> >>>>> rather than in vague generalities. Under my suggestions we can:
> >>>>> 1. call the vDSO from C
> >>>>> 2. pass context to the handler
> >>>>> 3. have additional stack manipulation options in the handler
> >>>>>
> >>>>> The cost for this is a net 2 additional instructions. No existing
> >>>>> capability is lost.
> >>>>
> >>>> My vague generality in this case is just that the whole design
> >>>> approach so far has been to minimize the amount of wrapping to
> >>>> EENTER.
> >>>
> >>> Yes and no. If we wanted to minimize the amount of wrapping around the
> >>> vDSO's ENCLU then we wouldn't have the exit handler shenanigans in the
> >>> first place. The whole process has been about balancing the wants of each
> >>> use case against the overall quality of the API and code.
> >>>
> >> The design of this vDSO API was NOT to minimize wrapping, but to allow
> >> maximal flexibility. More specifically, we strove not to restrict how info
> >> was exchanged between the enclave and its host process. After all, calling
> >> convention is compiler specific - i.e. the enclave could be built by a
> >> different compiler (e.g. MSVC) that doesn't share the same list of CSRs as
> >> the host process. Therefore, the API has been implemented to pass through
> >> virtually all registers except those used by EENTER itself. Similarly, all
> >> registers are passed back from enclave to the caller (or the exit handler)
> >> except those used by EEXIT. %rbp is an exception because the vDSO API has to
> >> anchor the stack, using either %rsp or %rbp. We picked %rbp to allow the
> >> enclave to allocate space on the stack.
> >
> > And unless I'm missing something, using %rcx to pass @leaf would still
> > satisfy the above, correct? Ditto for saving/restoring %rbx.
> >
> > I.e. a runtime that's designed to work with enclave's using a different
> > calling convention wouldn't be able to take advantage of being able to call
> > the vDSO from C, but neither would it take on any meaningful burden.
> >
> Not exactly.
>
> If called directly from C code, the caller would expect CSRs to be
> preserved.
Correct. This requires collaboration between the caller of the vDSO
and the enclave.
> Then who should preserve CSRs?
The enclave.
> It can't be the enclave
> because it may not follow the same calling convention.
This is incorrect. You are presuming there is not tight integration
between the caller of the vDSO and the enclave. In my case, the
integration is total and complete. We have working code today that
does this.
> Moreover, the
> enclave may run into an exception, in which case it doesn't have the
> ability to restore CSRs.
There are two solutions to this:
1. Write the handler in assembly and don't return to C on AEX.
2. The caller can simply preserve the registers. Nothing stops that.
We have implemented #1.
> So it has to be done by the vDSO API.
Nope. See above.
> That
> means CSRs will be overwritten upon enclave exits, which violates the
> goal of "passing all registers back to the caller except those used by
> EEXIT".
All registers get passed to the handler in this scenario, not the caller.
The approach is as follows: the vDSO is callable by C so long as the
enclave respects the ABI *OR* the handler patches up any enclave
deviation from the ABI.
Hi Nathaniel,
I reread your email today and thought I might have misunderstood your
email earlier. What changes are you asking for exactly? Is that just
passing @leaf in %ecx rather than in %eax? If so, I wouldn't have any
problem. I agree with you that the resulted API would then be callable
from C, even though it wouldn't be able to return back to C due to
tampered %rbx. But I think the vDSO API can preserve %rbx too, given it
is used by both EENTER and EEXIT (so is unavailable for parameter
passing anyway). Alternatively, the C caller can setjmp() to be
longjmp()'d back from within the exit handler.
-Cedric
On Tue, Mar 17, 2020 at 02:40:34PM -0700, Xing, Cedric wrote:
> Hi Nathaniel,
>
> I reread your email today and thought I might have misunderstood your email
> earlier. What changes are you asking for exactly? Is that just passing @leaf
> in %ecx rather than in %eax? If so, I wouldn't have any problem. I agree
> with you that the resulted API would then be callable from C, even though it
> wouldn't be able to return back to C due to tampered %rbx. But I think the
> vDSO API can preserve %rbx too, given it is used by both EENTER and EEXIT
> (so is unavailable for parameter passing anyway). Alternatively, the C
> caller can setjmp() to be longjmp()'d back from within the exit handler.
Yep, exactly. The other proposed change that is fairly straightforward is
to make the save/restore of %rsp across the exit handler call relative
instead of absolute, i.e. allow the exit handler to modify %rsp. I don't
think this would conflict with the Intel SDK usage model?
diff --git a/arch/x86/entry/vdso/vsgx_enter_enclave.S b/arch/x86/entry/vdso/vsgx_enter_enclave.S
index 94a8e5f99961..05d54f79b557 100644
--- a/arch/x86/entry/vdso/vsgx_enter_enclave.S
+++ b/arch/x86/entry/vdso/vsgx_enter_enclave.S
@@ -139,8 +139,9 @@ SYM_FUNC_START(__vdso_sgx_enter_enclave)
/* Pass the untrusted RSP (at exit) to the callback via %rcx. */
mov %rsp, %rcx
- /* Save the untrusted RSP in %rbx (non-volatile register). */
+ /* Save the untrusted RSP offset in %rbx (non-volatile register). */
mov %rsp, %rbx
+ and $0xf, %rbx
/*
* Align stack per x86_64 ABI. Note, %rsp needs to be 16-byte aligned
@@ -161,8 +162,8 @@ SYM_FUNC_START(__vdso_sgx_enter_enclave)
mov 0x20(%rbp), %rax
call .Lretpoline
- /* Restore %rsp to its post-exit value. */
- mov %rbx, %rsp
+ /* Undo the post-exit %rsp adjustment. */
+ lea 0x20(%rsp,%rbx), %rsp
On 3/17/2020 9:50 AM, Nathaniel McCallum wrote:
> On Mon, Mar 16, 2020 at 8:18 PM Xing, Cedric <[email protected]> wrote:
>>
>> On 3/16/2020 4:59 PM, Sean Christopherson wrote:
>>> On Mon, Mar 16, 2020 at 04:50:26PM -0700, Xing, Cedric wrote:
>>>> On 3/16/2020 3:53 PM, Sean Christopherson wrote:
>>>>> On Mon, Mar 16, 2020 at 11:38:24PM +0200, Jarkko Sakkinen wrote:
>>>>>>> My suggestions explicitly maintained robustness, and in fact increased
>>>>>>> it. If you think we've lost capability, please speak with specificity
>>>>>>> rather than in vague generalities. Under my suggestions we can:
>>>>>>> 1. call the vDSO from C
>>>>>>> 2. pass context to the handler
>>>>>>> 3. have additional stack manipulation options in the handler
>>>>>>>
>>>>>>> The cost for this is a net 2 additional instructions. No existing
>>>>>>> capability is lost.
>>>>>>
>>>>>> My vague generality in this case is just that the whole design
>>>>>> approach so far has been to minimize the amount of wrapping to
>>>>>> EENTER.
>>>>>
>>>>> Yes and no. If we wanted to minimize the amount of wrapping around the
>>>>> vDSO's ENCLU then we wouldn't have the exit handler shenanigans in the
>>>>> first place. The whole process has been about balancing the wants of each
>>>>> use case against the overall quality of the API and code.
>>>>>
>>>> The design of this vDSO API was NOT to minimize wrapping, but to allow
>>>> maximal flexibility. More specifically, we strove not to restrict how info
>>>> was exchanged between the enclave and its host process. After all, calling
>>>> convention is compiler specific - i.e. the enclave could be built by a
>>>> different compiler (e.g. MSVC) that doesn't share the same list of CSRs as
>>>> the host process. Therefore, the API has been implemented to pass through
>>>> virtually all registers except those used by EENTER itself. Similarly, all
>>>> registers are passed back from enclave to the caller (or the exit handler)
>>>> except those used by EEXIT. %rbp is an exception because the vDSO API has to
>>>> anchor the stack, using either %rsp or %rbp. We picked %rbp to allow the
>>>> enclave to allocate space on the stack.
>>>
>>> And unless I'm missing something, using %rcx to pass @leaf would still
>>> satisfy the above, correct? Ditto for saving/restoring %rbx.
>>>
>>> I.e. a runtime that's designed to work with enclave's using a different
>>> calling convention wouldn't be able to take advantage of being able to call
>>> the vDSO from C, but neither would it take on any meaningful burden.
>>>
>> Not exactly.
>>
>> If called directly from C code, the caller would expect CSRs to be
>> preserved.
>
> Correct. This requires collaboration between the caller of the vDSO
> and the enclave.
>
>> Then who should preserve CSRs?
>
> The enclave.
>
>> It can't be the enclave
>> because it may not follow the same calling convention.
>
> This is incorrect. You are presuming there is not tight integration
> between the caller of the vDSO and the enclave. In my case, the
> integration is total and complete. We have working code today that
> does this.
>
>> Moreover, the
>> enclave may run into an exception, in which case it doesn't have the
>> ability to restore CSRs.
>
> There are two solutions to this:
> 1. Write the handler in assembly and don't return to C on AEX.
> 2. The caller can simply preserve the registers. Nothing stops that.
>
> We have implemented #1.
>
What if the enclave cannot proceed due to an unhandled exception so the
execution has to get back to the C caller of the vDSO API?
It seems to me the caller has to preserve CSRs by itself, otherwise it
cannot continue execution after any enclave exception. Passing @leaf in
%ecx will allow saving/restoring CSRs in C by setjmp()/longjmp(), with
the help of an exit handler. But if the C caller has already preserved
CSRs, why preserve CSRs again inside the enclave? It looks to me things
can be simplified only if the host process handles no enclave exceptions
(or exceptions inside the enclave will crash the calling thread). Thus
the only case of enclave EEXIT'ing back to its caller is considered
valid, hence the enclave will always be able to restore CSRs, so that
neither vDSO nor its caller has to preserve CSRs.
Is my understanding correct?
On 3/17/2020 3:09 PM, Sean Christopherson wrote:
> On Tue, Mar 17, 2020 at 02:40:34PM -0700, Xing, Cedric wrote:
>> Hi Nathaniel,
>>
>> I reread your email today and thought I might have misunderstood your email
>> earlier. What changes are you asking for exactly? Is that just passing @leaf
>> in %ecx rather than in %eax? If so, I wouldn't have any problem. I agree
>> with you that the resulted API would then be callable from C, even though it
>> wouldn't be able to return back to C due to tampered %rbx. But I think the
>> vDSO API can preserve %rbx too, given it is used by both EENTER and EEXIT
>> (so is unavailable for parameter passing anyway). Alternatively, the C
>> caller can setjmp() to be longjmp()'d back from within the exit handler.
>
> Yep, exactly. The other proposed change that is fairly straightforward is
> to make the save/restore of %rsp across the exit handler call relative
> instead of absolute, i.e. allow the exit handler to modify %rsp. I don't
> think this would conflict with the Intel SDK usage model?
>
> diff --git a/arch/x86/entry/vdso/vsgx_enter_enclave.S b/arch/x86/entry/vdso/vsgx_enter_enclave.S
> index 94a8e5f99961..05d54f79b557 100644
> --- a/arch/x86/entry/vdso/vsgx_enter_enclave.S
> +++ b/arch/x86/entry/vdso/vsgx_enter_enclave.S
> @@ -139,8 +139,9 @@ SYM_FUNC_START(__vdso_sgx_enter_enclave)
> /* Pass the untrusted RSP (at exit) to the callback via %rcx. */
> mov %rsp, %rcx
>
> - /* Save the untrusted RSP in %rbx (non-volatile register). */
> + /* Save the untrusted RSP offset in %rbx (non-volatile register). */
> mov %rsp, %rbx
> + and $0xf, %rbx
>
> /*
> * Align stack per x86_64 ABI. Note, %rsp needs to be 16-byte aligned
> @@ -161,8 +162,8 @@ SYM_FUNC_START(__vdso_sgx_enter_enclave)
> mov 0x20(%rbp), %rax
> call .Lretpoline
>
> - /* Restore %rsp to its post-exit value. */
> - mov %rbx, %rsp
> + /* Undo the post-exit %rsp adjustment. */
> + lea 0x20(%rsp,%rbx), %rsp
>
Yep. Though it looks a bit uncommon, I do think it will work.
On Tue, Mar 17, 2020 at 03:36:57PM -0700, Xing, Cedric wrote:
> On 3/17/2020 3:09 PM, Sean Christopherson wrote:
> >On Tue, Mar 17, 2020 at 02:40:34PM -0700, Xing, Cedric wrote:
> >>Hi Nathaniel,
> >>
> >>I reread your email today and thought I might have misunderstood your email
> >>earlier. What changes are you asking for exactly? Is that just passing @leaf
> >>in %ecx rather than in %eax? If so, I wouldn't have any problem. I agree
> >>with you that the resulted API would then be callable from C, even though it
> >>wouldn't be able to return back to C due to tampered %rbx. But I think the
> >>vDSO API can preserve %rbx too, given it is used by both EENTER and EEXIT
> >>(so is unavailable for parameter passing anyway). Alternatively, the C
> >>caller can setjmp() to be longjmp()'d back from within the exit handler.
> >
> >Yep, exactly. The other proposed change that is fairly straightforward is
> >to make the save/restore of %rsp across the exit handler call relative
> >instead of absolute, i.e. allow the exit handler to modify %rsp. I don't
> >think this would conflict with the Intel SDK usage model?
> >
> >diff --git a/arch/x86/entry/vdso/vsgx_enter_enclave.S b/arch/x86/entry/vdso/vsgx_enter_enclave.S
> >index 94a8e5f99961..05d54f79b557 100644
> >--- a/arch/x86/entry/vdso/vsgx_enter_enclave.S
> >+++ b/arch/x86/entry/vdso/vsgx_enter_enclave.S
> >@@ -139,8 +139,9 @@ SYM_FUNC_START(__vdso_sgx_enter_enclave)
> > /* Pass the untrusted RSP (at exit) to the callback via %rcx. */
> > mov %rsp, %rcx
> >
> >- /* Save the untrusted RSP in %rbx (non-volatile register). */
> >+ /* Save the untrusted RSP offset in %rbx (non-volatile register). */
> > mov %rsp, %rbx
> >+ and $0xf, %rbx
> >
> > /*
> > * Align stack per x86_64 ABI. Note, %rsp needs to be 16-byte aligned
> >@@ -161,8 +162,8 @@ SYM_FUNC_START(__vdso_sgx_enter_enclave)
> > mov 0x20(%rbp), %rax
> > call .Lretpoline
> >
> >- /* Restore %rsp to its post-exit value. */
> >- mov %rbx, %rsp
> >+ /* Undo the post-exit %rsp adjustment. */
> >+ lea 0x20(%rsp,%rbx), %rsp
> >
> Yep. Though it looks a bit uncommon, I do think it will work.
Heh, I had about the same level of confidence.
I'll put together a set of patches tomorrow and post them to linux-sgx (and
cc relevant parties). It'll be easier to continue the discussion with code
to look at and we can stop spamming LKML for a bit :-)
On Tue, Mar 17, 2020 at 6:23 PM Xing, Cedric <[email protected]> wrote:
>
> On 3/17/2020 9:50 AM, Nathaniel McCallum wrote:
> > On Mon, Mar 16, 2020 at 8:18 PM Xing, Cedric <[email protected]> wrote:
> >>
> >> On 3/16/2020 4:59 PM, Sean Christopherson wrote:
> >>> On Mon, Mar 16, 2020 at 04:50:26PM -0700, Xing, Cedric wrote:
> >>>> On 3/16/2020 3:53 PM, Sean Christopherson wrote:
> >>>>> On Mon, Mar 16, 2020 at 11:38:24PM +0200, Jarkko Sakkinen wrote:
> >>>>>>> My suggestions explicitly maintained robustness, and in fact increased
> >>>>>>> it. If you think we've lost capability, please speak with specificity
> >>>>>>> rather than in vague generalities. Under my suggestions we can:
> >>>>>>> 1. call the vDSO from C
> >>>>>>> 2. pass context to the handler
> >>>>>>> 3. have additional stack manipulation options in the handler
> >>>>>>>
> >>>>>>> The cost for this is a net 2 additional instructions. No existing
> >>>>>>> capability is lost.
> >>>>>>
> >>>>>> My vague generality in this case is just that the whole design
> >>>>>> approach so far has been to minimize the amount of wrapping to
> >>>>>> EENTER.
> >>>>>
> >>>>> Yes and no. If we wanted to minimize the amount of wrapping around the
> >>>>> vDSO's ENCLU then we wouldn't have the exit handler shenanigans in the
> >>>>> first place. The whole process has been about balancing the wants of each
> >>>>> use case against the overall quality of the API and code.
> >>>>>
> >>>> The design of this vDSO API was NOT to minimize wrapping, but to allow
> >>>> maximal flexibility. More specifically, we strove not to restrict how info
> >>>> was exchanged between the enclave and its host process. After all, calling
> >>>> convention is compiler specific - i.e. the enclave could be built by a
> >>>> different compiler (e.g. MSVC) that doesn't share the same list of CSRs as
> >>>> the host process. Therefore, the API has been implemented to pass through
> >>>> virtually all registers except those used by EENTER itself. Similarly, all
> >>>> registers are passed back from enclave to the caller (or the exit handler)
> >>>> except those used by EEXIT. %rbp is an exception because the vDSO API has to
> >>>> anchor the stack, using either %rsp or %rbp. We picked %rbp to allow the
> >>>> enclave to allocate space on the stack.
> >>>
> >>> And unless I'm missing something, using %rcx to pass @leaf would still
> >>> satisfy the above, correct? Ditto for saving/restoring %rbx.
> >>>
> >>> I.e. a runtime that's designed to work with enclave's using a different
> >>> calling convention wouldn't be able to take advantage of being able to call
> >>> the vDSO from C, but neither would it take on any meaningful burden.
> >>>
> >> Not exactly.
> >>
> >> If called directly from C code, the caller would expect CSRs to be
> >> preserved.
> >
> > Correct. This requires collaboration between the caller of the vDSO
> > and the enclave.
> >
> >> Then who should preserve CSRs?
> >
> > The enclave.
> >
> >> It can't be the enclave
> >> because it may not follow the same calling convention.
> >
> > This is incorrect. You are presuming there is not tight integration
> > between the caller of the vDSO and the enclave. In my case, the
> > integration is total and complete. We have working code today that
> > does this.
> >
> >> Moreover, the
> >> enclave may run into an exception, in which case it doesn't have the
> >> ability to restore CSRs.
> >
> > There are two solutions to this:
> > 1. Write the handler in assembly and don't return to C on AEX.
> > 2. The caller can simply preserve the registers. Nothing stops that.
> >
> > We have implemented #1.
> >
> What if the enclave cannot proceed due to an unhandled exception so the
> execution has to get back to the C caller of the vDSO API?
mov $60, %rax
mov $1, %rdi
syscall
We exit in all such cases.
> It seems to me the caller has to preserve CSRs by itself, otherwise it
> cannot continue execution after any enclave exception. Passing @leaf in
> %ecx will allow saving/restoring CSRs in C by setjmp()/longjmp(), with
> the help of an exit handler. But if the C caller has already preserved
> CSRs, why preserve CSRs again inside the enclave? It looks to me things
> can be simplified only if the host process handles no enclave exceptions
> (or exceptions inside the enclave will crash the calling thread). Thus
> the only case of enclave EEXIT'ing back to its caller is considered
> valid, hence the enclave will always be able to restore CSRs, so that
> neither vDSO nor its caller has to preserve CSRs.
>
> Is my understanding correct?
>
On Mon, Mar 16, 2020 at 04:56:42PM -0700, Xing, Cedric wrote:
> On 3/16/2020 3:55 PM, Sean Christopherson wrote:
> > On Mon, Mar 16, 2020 at 02:31:36PM +0100, Jethro Beekman wrote:
> > > Can someone remind me why we're not passing TCS in RBX but on the stack?
> >
> > I finally remembered why. It's pulled off the stack and passed into the
> > exit handler. I'm pretty sure the vDSO could take it in %rbx and manually
> > save it on the stack, but I'd rather keep the current behavior so that the
> > vDSO is callable from C (assuming @leaf is changed to be passed via %rcx).
> >
> The idea is that the caller of this vDSO API is C callable, hence it cannot
> receive TCS in %rbx anyway. Then it has to either MOV to %rbx or PUSH to
> stack. Either way the complexity is the same. The vDSO API however has to
> always save it on stack for exit handler. So receiving it via stack ends up
> in simplest code.
It is never C callable anyway given that not following the ABI so
who cares about being C callable anyway?
/Jarkko
On Tue, Mar 17, 2020 at 09:00:15AM -0700, Jordan Hand wrote:
> I tested with the Open Enclave SDK test suite (~200 test and sample
> enclaves), no issues. Used Intel PSW version 2.8.
>
> Tested-by: Jordan Hand <[email protected]>
OK, cool. Thank you.
/Jarkko
On Thu, Mar 19, 2020 at 12:01:26AM +0200, Jarkko Sakkinen wrote:
> On Mon, Mar 16, 2020 at 04:56:42PM -0700, Xing, Cedric wrote:
> > On 3/16/2020 3:55 PM, Sean Christopherson wrote:
> > > On Mon, Mar 16, 2020 at 02:31:36PM +0100, Jethro Beekman wrote:
> > > > Can someone remind me why we're not passing TCS in RBX but on the stack?
> > >
> > > I finally remembered why. It's pulled off the stack and passed into the
> > > exit handler. I'm pretty sure the vDSO could take it in %rbx and manually
> > > save it on the stack, but I'd rather keep the current behavior so that the
> > > vDSO is callable from C (assuming @leaf is changed to be passed via %rcx).
> > >
> > The idea is that the caller of this vDSO API is C callable, hence it cannot
> > receive TCS in %rbx anyway. Then it has to either MOV to %rbx or PUSH to
> > stack. Either way the complexity is the same. The vDSO API however has to
> > always save it on stack for exit handler. So receiving it via stack ends up
> > in simplest code.
>
> It is never C callable anyway given that not following the ABI so
> who cares about being C callable anyway?
A direct quote from the documentation:
"**Important!** __vdso_sgx_enter_enclave() is **NOT** compliant with
the x86-64 ABI, i.e. cannot be called from standard C code."
/Jarkko
On Mon, Mar 16, 2020 at 03:53:22PM -0700, Sean Christopherson wrote:
> Yes and no. If we wanted to minimize the amount of wrapping around the
> vDSO's ENCLU then we wouldn't have the exit handler shenanigans in the
> first place. The whole process has been about balancing the wants of each
> use case against the overall quality of the API and code.
Minimizing is not something that happens in a void. Given the user base
for the SDK having the handler was a necessity. Otherwise, we would not
have that handler in the first place.
> Up until Nathaniel joined the party, the only stakeholder in terms of the
> exit handler was the Intel SDK. There was a general consensus to pass
> registers as-is when there isn't a strong reason to do otherwise. Note
> that Nathaniel has also expressed approval of that approach.
OK, great.
> The major benefits being that the vDSO would be callable from C and that
> the kernel could define a legitimate prototype instead of a frankenstein
> prototype that's half assembly and half C. For me, those are significant
I was not aware that there was a plot to make it callable by C.
OK, so right now
A. @leaf = %eax
B. @tcs = 8(%rsp)
C. @e = 0x10(%rsp)
D. @handler = 0x18(%rsp)
On x86-64 Linux C calling convention means DI/SI/DX/CX type of thing.
So what is the thing that we are referring to C calling convetion in
this email discussion?
> benefits and well worth the extra MOV, PUSH and POP. For some use cases
> it would eliminate the need for an assembly wrapper. For runtimes that
> need an assembly wrapper for whatever reason, it's probably still a win as
> a well designed runtime can avoid register shuffling in the wrapper. And
> if there is a runtime that isn't covered by the above, it's at worst an
> extra MOV.
Is it cool if I rip of the documentation from vsgx_enter_enclave.S and
move it to Documentation/ ? It is nasty to keep and update it where it
is right now. How it is right now, it is destined to rotten.
/Jarkko
On Tue, Mar 17, 2020 at 12:28:58PM -0400, Nathaniel McCallum wrote:
> On Mon, Mar 16, 2020 at 6:53 PM Sean Christopherson
> <[email protected]> wrote:
> >
> > On Mon, Mar 16, 2020 at 11:38:24PM +0200, Jarkko Sakkinen wrote:
> > > On Mon, 2020-03-16 at 10:01 -0400, Nathaniel McCallum wrote:
> > > > On Mon, Mar 16, 2020 at 9:56 AM Jarkko Sakkinen
> > > > <[email protected]> wrote:
> > > > > On Sun, 2020-03-15 at 13:53 -0400, Nathaniel McCallum wrote:
> > > > > > On Sat, Mar 14, 2020 at 9:25 PM Jarkko Sakkinen
> > > > > > <[email protected]> wrote:
> > > > > > > On Wed, Mar 11, 2020 at 01:30:07PM -0400, Nathaniel McCallum wrote:
> > > > > > > > Currently, the selftest has a wrapper around
> > > > > > > > __vdso_sgx_enter_enclave() which preserves all x86-64 ABI callee-saved
> > > > > > > > registers (CSRs), though it uses none of them. Then it calls this
> > > > > > > > function which uses %rbx but preserves none of the CSRs. Then it jumps
> > > > > > > > into an enclave which zeroes all these registers before returning.
> > > > > > > > Thus:
> > > > > > > >
> > > > > > > > 1. wrapper saves all CSRs
> > > > > > > > 2. wrapper repositions stack arguments
> > > > > > > > 3. __vdso_sgx_enter_enclave() modifies, but does not save %rbx
> > > > > > > > 4. selftest zeros all CSRs
> > > > > > > > 5. wrapper loads all CSRs
> > > > > > > >
> > > > > > > > I'd like to propose instead that the enclave be responsible for saving
> > > > > > > > and restoring CSRs. So instead of the above we have:
> > > > > > > > 1. __vdso_sgx_enter_enclave() saves %rbx
> > > > > > > > 2. enclave saves CSRs
> > > > > > > > 3. enclave loads CSRs
> > > > > > > > 4. __vdso_sgx_enter_enclave() loads %rbx
> > > > > > > >
> > > > > > > > I know that lots of other stuff happens during enclave transitions,
> > > > > > > > but at the very least we could reduce the number of instructions
> > > > > > > > through this critical path.
> > > > > > >
> > > > > > > What Jethro said and also that it is a good general principle to cut
> > > > > > > down the semantics of any vdso as minimal as possible.
> > > > > > >
> > > > > > > I.e. even if saving RBX would make somehow sense it *can* be left
> > > > > > > out without loss in terms of what can be done with the vDSO.
> > > > > >
> > > > > > Please read the rest of the thread. Sean and I have hammered out some
> > > > > > sensible and effective changes.
> > > > >
> > > > > Have skimmed through that discussion but it comes down how much you get
> > > > > by obviously degrading some of the robustness. Complexity of the calling
> > > > > pattern is not something that should be emphasized as that is something
> > > > > that is anyway hidden inside the runtime.
> > > >
> > > > My suggestions explicitly maintained robustness, and in fact increased
> > > > it. If you think we've lost capability, please speak with specificity
> > > > rather than in vague generalities. Under my suggestions we can:
> > > > 1. call the vDSO from C
> > > > 2. pass context to the handler
> > > > 3. have additional stack manipulation options in the handler
> > > >
> > > > The cost for this is a net 2 additional instructions. No existing
> > > > capability is lost.
> > >
> > > My vague generality in this case is just that the whole design
> > > approach so far has been to minimize the amount of wrapping to
> > > EENTER.
> >
> > Yes and no. If we wanted to minimize the amount of wrapping around the
> > vDSO's ENCLU then we wouldn't have the exit handler shenanigans in the
> > first place. The whole process has been about balancing the wants of each
> > use case against the overall quality of the API and code.
> >
> > > And since this has been kind of agreed by most of the
> > > stakeholders doing something against the chosen strategy is
> > > something I do hold some resistance.
> >
> > Up until Nathaniel joined the party, the only stakeholder in terms of the
> > exit handler was the Intel SDK.
>
> I would hope that having additional stakeholders would ease the path
> to adoption.
>
> > There was a general consensus to pass
> > registers as-is when there isn't a strong reason to do otherwise. Note
> > that Nathaniel has also expressed approval of that approach.
>
> I still approve that approach.
>
> > So I think the question that needs to be answered is whether the benefits
> > of using %rcx instead of %rax to pass @leaf justify the "pass registers
> > as-is" guideline. We've effectively already given this waiver for %rbx,
> > as the whole reason why the TCS is passed in on the stack instead of via
> > %rbx is so that it can be passed to the exit handler. E.g. the vDSO
> > could take the TCS in %rbx and save it on the stack, but we're throwing
> > the baby out with the bathwater at that point.
> >
> > The major benefits being that the vDSO would be callable from C and that
> > the kernel could define a legitimate prototype instead of a frankenstein
> > prototype that's half assembly and half C. For me, those are significant
> > benefits and well worth the extra MOV, PUSH and POP. For some use cases
> > it would eliminate the need for an assembly wrapper. For runtimes that
> > need an assembly wrapper for whatever reason, it's probably still a win as
> > a well designed runtime can avoid register shuffling in the wrapper. And
> > if there is a runtime that isn't covered by the above, it's at worst an
> > extra MOV.
> >
>
Guys, maybe it is just enough discussing. I see things go in circles at
least. Just send a patch against current tree and we'll look into it
then?
I'm a strong believer of "good enough" well, in everything in life. With
a legit patch it is easier to evaluate if what we get is just a
different version of good enough, or perhaps we might get some useful
value out of it.
If you think that you get together something C callable, please
*prove* that by also updating the self test.
Fair enough?
/Jarkko
On Sat, Mar 14, 2020 at 10:10:26AM -0400, Nathaniel McCallum wrote:
> On Fri, Mar 13, 2020 at 6:08 PM Sean Christopherson
> <[email protected]> wrote:
> > > > > 4. sub/add to %rsp rather than save/restore
> > > >
> > > > Can you elaborate on why you want to sub/add to %rsp instead of having the
> > > > enclave unwind the stack? Preserving %rsp across EEXIT/ERESUME seems more
> > > > in line with function call semantics, which I assume is desirable? E.g.
> > > >
> > > > push param3
> > > > push param2
> > > > push param1
> > > >
> > > > enclu[EEXIT]
> > > >
> > > > add $0x18, %rsp
> > >
> > > Before enclave EEXIT, the enclave restores %rsp to the value it had
> > > before EENTER was called. Then it pushes additional output arguments
> > > onto the stack. The enclave calls EENCLU[EEXIT].
> > >
> > > We are now in __vdso...() on the way back to the caller. However, %rsp
> > > has a different value than we entered the function with. This breaks
> > > x86_64 ABI, obviously. The handler needs to fix this up: how does it
> > > do so?
Circling back to this request, because I just realized that the above is
handled by saving %rsp into %rbp and requiring the enclave and handler
to preserve %rbp at all times.
So the below discussion on making the %rsp adjustment relative is moot,
at least with respect to getting out of __vdso() if the enclave has mucked
with the untrusted stack.
> > > In the current code, __vdso..() saves the value of %rsp, calls the
> > > handler and then restores %rsp. The handler can fix up the stack by
> > > setting the correct value to %rbx and returning without restoring it.
> >
> > Ah, you're referring to the patch where the handler decides to return all
> > the way back to the caller of __vdso...().
> >
> > > But this requires internal knowledge of the __vdso...() function,
> > > which could theoretically change in the future.
> > >
> > > If instead the __vdso...() only did add/sub, then the handler could do:
> > > 1. pop return address
> > > 2. pop handler stack params
> > > 3. pop enclave additional output stack params
> > > 4. push handler stack params
> > > 5. push return address
Per above, this is unnecessary when returning to the caller of __vdso().
It would be necessary if the enclave wasn't smart enough to do it's own
stack cleanup, but that seems like a very bizarre contract between the
enclave and its runtime.
The caveat is if %rbx is saved/restored by __vdso(). If we want a
traditional frame pointer, then %rbx would be restored from the stack
before %rsp itself is restored (from %rbp), in which case the exit handler
would need to adjust %rsp using a sequence similar to what you listed
above.
If __vdso() uses a non-standard frame pointer, e.g.
push %rbp
push %rbx
mov %rsp, %rbp
then %rbx would come off the stack after %rsp is restored from %rbp, i.e.
would be guaranteed to be restored to the pre-EENTER value (unless the
enclave or handler mucks with %rbp).
Anyways, we can discuss how to implement the frame pointer in the context
of the patches, just wanted to point this out here for completeness.
> > > While this is more work, it is standard calling convention work that
> > > doesn't require internal knowledge of __vdso..(). Alternatively, if we
> > > don't like the extra work, we can document the %rbx hack explicitly
> > > into the handler documentation and make it part of the interface. But
> > > we need some explicit way for the handler to pop enclave output stack
> > > params that doesn't depend on internal knowledge of the __vdso...()
> > > invariants.
> >
> > IIUC, this is what you're suggesting? Having to align the stack makes this
> > a bit annoying, but it's not bad by any means.
> >
> > diff --git a/arch/x86/entry/vdso/vsgx_enter_enclave.S b/arch/x86/entry/vdso/vsgx_enter_enclave.S
> > index 94a8e5f99961..05d54f79b557 100644
> > --- a/arch/x86/entry/vdso/vsgx_enter_enclave.S
> > +++ b/arch/x86/entry/vdso/vsgx_enter_enclave.S
> > @@ -139,8 +139,9 @@ SYM_FUNC_START(__vdso_sgx_enter_enclave)
> > /* Pass the untrusted RSP (at exit) to the callback via %rcx. */
> > mov %rsp, %rcx
> >
> > - /* Save the untrusted RSP in %rbx (non-volatile register). */
> > + /* Save the untrusted RSP offset in %rbx (non-volatile register). */
> > mov %rsp, %rbx
> > + and $0xf, %rbx
> >
> > /*
> > * Align stack per x86_64 ABI. Note, %rsp needs to be 16-byte aligned
> > @@ -161,8 +162,8 @@ SYM_FUNC_START(__vdso_sgx_enter_enclave)
> > mov 0x20(%rbp), %rax
> > call .Lretpoline
> >
> > - /* Restore %rsp to its post-exit value. */
> > - mov %rbx, %rsp
> > + /* Undo the post-exit %rsp adjustment. */
> > + lea 0x20(%rsp,%rbx), %rsp
> >
> >
> > That's reasonable, let's the handler play more games with minimal overhead.
>
> Yes, exactly!
>
> > > > > That would make this a very usable and fast interface without
> > > > > sacrificing any of its current power.
> > > >
> > >
> >
>
On 3/18/2020 4:40 PM, Sean Christopherson wrote:
> On Sat, Mar 14, 2020 at 10:10:26AM -0400, Nathaniel McCallum wrote:
>> On Fri, Mar 13, 2020 at 6:08 PM Sean Christopherson
>> <[email protected]> wrote:
>>>>>> 4. sub/add to %rsp rather than save/restore
>>>>>
>>>>> Can you elaborate on why you want to sub/add to %rsp instead of having the
>>>>> enclave unwind the stack? Preserving %rsp across EEXIT/ERESUME seems more
>>>>> in line with function call semantics, which I assume is desirable? E.g.
>>>>>
>>>>> push param3
>>>>> push param2
>>>>> push param1
>>>>>
>>>>> enclu[EEXIT]
>>>>>
>>>>> add $0x18, %rsp
>>>>
>>>> Before enclave EEXIT, the enclave restores %rsp to the value it had
>>>> before EENTER was called. Then it pushes additional output arguments
>>>> onto the stack. The enclave calls EENCLU[EEXIT].
>>>>
>>>> We are now in __vdso...() on the way back to the caller. However, %rsp
>>>> has a different value than we entered the function with. This breaks
>>>> x86_64 ABI, obviously. The handler needs to fix this up: how does it
>>>> do so?
>
> Circling back to this request, because I just realized that the above is
> handled by saving %rsp into %rbp and requiring the enclave and handler
> to preserve %rbp at all times.
>
> So the below discussion on making the %rsp adjustment relative is moot,
> at least with respect to getting out of __vdso() if the enclave has mucked
> with the untrusted stack.
>
I didn't follow the discussion closely enough to understand the
motivation behind "add/sub" rather than "restore" %rsp. Now I understand
and I agree with you that the requested change is unnecessary.
>>>> In the current code, __vdso..() saves the value of %rsp, calls the
>>>> handler and then restores %rsp. The handler can fix up the stack by
>>>> setting the correct value to %rbx and returning without restoring it.
>>>
>>> Ah, you're referring to the patch where the handler decides to return all
>>> the way back to the caller of __vdso...().
>>>
>>>> But this requires internal knowledge of the __vdso...() function,
>>>> which could theoretically change in the future.
>>>>
>>>> If instead the __vdso...() only did add/sub, then the handler could do:
>>>> 1. pop return address
>>>> 2. pop handler stack params
>>>> 3. pop enclave additional output stack params
>>>> 4. push handler stack params
>>>> 5. push return address
>
> Per above, this is unnecessary when returning to the caller of __vdso().
> It would be necessary if the enclave wasn't smart enough to do it's own
> stack cleanup, but that seems like a very bizarre contract between the
> enclave and its runtime.
>
> The caveat is if %rbx is saved/restored by __vdso(). If we want a
> traditional frame pointer, then %rbx would be restored from the stack
> before %rsp itself is restored (from %rbp), in which case the exit handler
> would need to adjust %rsp using a sequence similar to what you listed
> above.
>
> If __vdso() uses a non-standard frame pointer, e.g.
>
> push %rbp
> push %rbx
> mov %rsp, %rbp
>
> then %rbx would come off the stack after %rsp is restored from %rbp, i.e.
> would be guaranteed to be restored to the pre-EENTER value (unless the
> enclave or handler mucks with %rbp).
>
> Anyways, we can discuss how to implement the frame pointer in the context
> of the patches, just wanted to point this out here for completeness.
>
%rbx can always be restored as long as it is saved at a fixed offset
from %rbp. For example, given the standard prolog below:
push %rbp
mov %rsp, %rbp
push %rbx
It can be paired with the following standard epilog:
mov -8(%rbp), %rbx
leave
ret
Alternatively, given "red zone" of 128 bytes, the following epilog will
also work:
leave
mov -0x10(%rsp), %rbx
ret
In no cases do we have to worry about enclave mucking the stack as long
as %rbp is preserved.
>>>> While this is more work, it is standard calling convention work that
>>>> doesn't require internal knowledge of __vdso..(). Alternatively, if we
>>>> don't like the extra work, we can document the %rbx hack explicitly
>>>> into the handler documentation and make it part of the interface. But
>>>> we need some explicit way for the handler to pop enclave output stack
>>>> params that doesn't depend on internal knowledge of the __vdso...()
>>>> invariants.
>>>
>>> IIUC, this is what you're suggesting? Having to align the stack makes this
>>> a bit annoying, but it's not bad by any means.
>>>
>>> diff --git a/arch/x86/entry/vdso/vsgx_enter_enclave.S b/arch/x86/entry/vdso/vsgx_enter_enclave.S
>>> index 94a8e5f99961..05d54f79b557 100644
>>> --- a/arch/x86/entry/vdso/vsgx_enter_enclave.S
>>> +++ b/arch/x86/entry/vdso/vsgx_enter_enclave.S
>>> @@ -139,8 +139,9 @@ SYM_FUNC_START(__vdso_sgx_enter_enclave)
>>> /* Pass the untrusted RSP (at exit) to the callback via %rcx. */
>>> mov %rsp, %rcx
>>>
>>> - /* Save the untrusted RSP in %rbx (non-volatile register). */
>>> + /* Save the untrusted RSP offset in %rbx (non-volatile register). */
>>> mov %rsp, %rbx
>>> + and $0xf, %rbx
>>>
>>> /*
>>> * Align stack per x86_64 ABI. Note, %rsp needs to be 16-byte aligned
>>> @@ -161,8 +162,8 @@ SYM_FUNC_START(__vdso_sgx_enter_enclave)
>>> mov 0x20(%rbp), %rax
>>> call .Lretpoline
>>>
>>> - /* Restore %rsp to its post-exit value. */
>>> - mov %rbx, %rsp
>>> + /* Undo the post-exit %rsp adjustment. */
>>> + lea 0x20(%rsp,%rbx), %rsp
>>>
Per discussion above, this is useful only if the enclave has problem
cleaning up its own mess left on the untrusted stack, and the exit
handler wants to EENTER the enclave again by returning to __vdso...().
It sounds very uncommon to me, and more like a bug than an expected
behavior. Are there any existing code doing this or any particular
application that needs this. If no, I'd say not to do it.
On Wed, Mar 18, 2020 at 05:38:29PM -0700, Xing, Cedric wrote:
> On 3/18/2020 4:40 PM, Sean Christopherson wrote:
> %rbx can always be restored as long as it is saved at a fixed offset from
> %rbp. For example, given the standard prolog below:
>
> push %rbp
> mov %rsp, %rbp
> push %rbx
>
> It can be paired with the following standard epilog:
>
> mov -8(%rbp), %rbx
> leave
> ret
>
> Alternatively, given "red zone" of 128 bytes, the following epilog will also
> work:
>
> leave
> mov -0x10(%rsp), %rbx
> ret
>
> In no cases do we have to worry about enclave mucking the stack as long as
> %rbp is preserved.
>
> >>>>While this is more work, it is standard calling convention work that
> >>>>doesn't require internal knowledge of __vdso..(). Alternatively, if we
> >>>>don't like the extra work, we can document the %rbx hack explicitly
> >>>>into the handler documentation and make it part of the interface. But
> >>>>we need some explicit way for the handler to pop enclave output stack
> >>>>params that doesn't depend on internal knowledge of the __vdso...()
> >>>>invariants.
> >>>
> >>>IIUC, this is what you're suggesting? Having to align the stack makes this
> >>>a bit annoying, but it's not bad by any means.
> >>>
> >>>diff --git a/arch/x86/entry/vdso/vsgx_enter_enclave.S b/arch/x86/entry/vdso/vsgx_enter_enclave.S
> >>>index 94a8e5f99961..05d54f79b557 100644
> >>>--- a/arch/x86/entry/vdso/vsgx_enter_enclave.S
> >>>+++ b/arch/x86/entry/vdso/vsgx_enter_enclave.S
> >>>@@ -139,8 +139,9 @@ SYM_FUNC_START(__vdso_sgx_enter_enclave)
> >>> /* Pass the untrusted RSP (at exit) to the callback via %rcx. */
> >>> mov %rsp, %rcx
> >>>
> >>>- /* Save the untrusted RSP in %rbx (non-volatile register). */
> >>>+ /* Save the untrusted RSP offset in %rbx (non-volatile register). */
> >>> mov %rsp, %rbx
> >>>+ and $0xf, %rbx
> >>>
> >>> /*
> >>> * Align stack per x86_64 ABI. Note, %rsp needs to be 16-byte aligned
> >>>@@ -161,8 +162,8 @@ SYM_FUNC_START(__vdso_sgx_enter_enclave)
> >>> mov 0x20(%rbp), %rax
> >>> call .Lretpoline
> >>>
> >>>- /* Restore %rsp to its post-exit value. */
> >>>- mov %rbx, %rsp
> >>>+ /* Undo the post-exit %rsp adjustment. */
> >>>+ lea 0x20(%rsp,%rbx), %rsp
> >>>
>
> Per discussion above, this is useful only if the enclave has problem
> cleaning up its own mess left on the untrusted stack, and the exit handler
> wants to EENTER the enclave again by returning to __vdso...(). It sounds
> very uncommon to me, and more like a bug than an expected behavior. Are
> there any existing code doing this or any particular application that needs
> this. If no, I'd say not to do it.
Ya, I'm on the fence as well. The only counter-argument is that doing:
push %rbp
mov %rsp, %rbp
push %rbx
...
pop %rbx
leave
ret
with the relative adjustment would allow the exit handler (or enclave) to
change %rbx. I'm not saying that is remote sane, but if we're going for
maximum flexibility...
Anyways, patches incoming, let's discuss there.
On Tue, Mar 17, 2020 at 09:00:15AM -0700, Jordan Hand wrote:
Hi, I hope the week is going well for everyone.
> I tested with the Open Enclave SDK test suite (~200 test and sample
> enclaves), no issues. Used Intel PSW version 2.8.
>
> Tested-by: Jordan Hand <[email protected]>
Which effectively translates into a second test of the Intel PSW,
since it appears from Haitao's comments they are unit testing against
the new driver.
Unless of course you wired up the OpenEnclave infrastructure to use
the new VDSO and exception handling, as that would be a significant
test, is that the case?
Getting a real live enclave loaded and initialized in memory is
essentially a contract with the enclave ELF parser and metadata
interpreter that the runtime implements. There is nothing subtle
about whether or not that is working correctly. The acid test after
that is the enclave entry and exit handling which is ultimately a
function of the exception handling.
> Thanks,
> Jordan
Have a good remainder of the week.
Dr. Greg
As always,
Dr. Greg Wettstein, Ph.D, Worker SGX secured infrastructure and
Enjellic Systems Development, LLC autonomously self-defensive
4206 N. 19th Ave. platforms.
Fargo, ND 58102
PH: 701-281-1686 EMAIL: [email protected]
------------------------------------------------------------------------------
"God made man, the appendix was the result of a committee."
-- Dr. G.W. Wettstein
Guerrilla Tactics for Corporate Survival
On Fri, Mar 06, 2020 at 09:00:03PM +0200, Jarkko Sakkinen wrote:
Good afternoon, I hope the day is going well for everyone.
> > >> +/**
> > >> + * struct sgx_enclave_create - parameter structure for the
> > >> + * %SGX_IOC_ENCLAVE_CREATE ioctl
> > >> + * @src: address for the SECS page data
> > >> + */
> > >> +struct sgx_enclave_create {
> > >> + __u64 src;
> > >
> > > Would it make sense to add reserved fields to the structs so that new
> > > features can be added in a backwards compatible way? E.g. if we want to
> > > allow userspace to control the backing store by passing in a file
> > > descriptor ENCLAVE_CREATE.
> > Reserving space for future fields is not necessary because the
> > size of the struct is encoded in the ioctl number. The kernel can
> > use this to differentiate between different call versions from
> > userspace.
> Sure but I still would never change the signature once a ioctl is
> added.
These reflections cause me to call, once again, what will be an
unpopular question, but if we pride ourselves on intellectual honesty
in our engineering practices we need to address it.
If we are locking ioctl's and ABI's down, then we need to address,
before the driver goes in, how we are going to handle support for
those of us that have engineering needs around launch token
technology.
On an FLC (unlocked) platform, which is the only thing the driver will
initialize on, there is no reason not to preserve the initialization
IOCTL argument structure that accepts a pointer to a launch token or
to disallow an enclave that has the attribute bit/mask set that allows
the enclave to have access to the launch key. When presented with an
enclave with the launch bit set the driver can simply set the launch
control registers to the MRSIGNER value of that enclave.
It is a straight forward process to provide a root based mechanism
that allows the owner of the platform to control that behavior, if
there are concerns about how the platform is to be used, much like
what is currently being done with access to the provision key.
The ideological purity statement is made by the decision to limit what
hardware the driver will run on. Once that statement is made, and the
driver firmly implements that decision, the owner of that platform
should be able to decide how they want to use and implement the
technology from there.
Unless someone else chirps up there are essentially only two complete
runtimes that are concerned with this issue. Intel can enforce
enhanced ideological purity, if they desire, by simply disallowing
anyone to pass a non-null EINIT structure pointer through their
runtime to the driver, which leaves us to implement the behavior we
want without ABI concerns.
There is a fairly fundamental question here regarding 'software
freedom', maybe Jonathan Corbet and company will even pick up on
it.... :-)
> /Jarkko
Hopefully all of this makes sense and is reasonable.
Have a good remainder of the week, wherever you happen to be locked in
at.
We now return you to your regularly scheduled programming on the
register dance surrounding enclave entry.
Dr. Greg
As always,
Dr. Greg Wettstein, Ph.D, Worker SGX secured infrastructure and
Enjellic Systems Development, LLC autonomously self-defensive
4206 N. 19th Ave. platforms.
Fargo, ND 58102
PH: 701-281-1686 EMAIL: [email protected]
------------------------------------------------------------------------------
"More people are killed every year by pigs than by sharks, which shows
you how good we are at evaluating risk."
-- Bruce Schneier
Beyond Fear
On Wed, Mar 18, 2020 at 7:41 PM Sean Christopherson
<[email protected]> wrote:
>
> On Sat, Mar 14, 2020 at 10:10:26AM -0400, Nathaniel McCallum wrote:
> > On Fri, Mar 13, 2020 at 6:08 PM Sean Christopherson
> > <[email protected]> wrote:
> > > > > > 4. sub/add to %rsp rather than save/restore
> > > > >
> > > > > Can you elaborate on why you want to sub/add to %rsp instead of having the
> > > > > enclave unwind the stack? Preserving %rsp across EEXIT/ERESUME seems more
> > > > > in line with function call semantics, which I assume is desirable? E.g.
> > > > >
> > > > > push param3
> > > > > push param2
> > > > > push param1
> > > > >
> > > > > enclu[EEXIT]
> > > > >
> > > > > add $0x18, %rsp
> > > >
> > > > Before enclave EEXIT, the enclave restores %rsp to the value it had
> > > > before EENTER was called. Then it pushes additional output arguments
> > > > onto the stack. The enclave calls EENCLU[EEXIT].
> > > >
> > > > We are now in __vdso...() on the way back to the caller. However, %rsp
> > > > has a different value than we entered the function with. This breaks
> > > > x86_64 ABI, obviously. The handler needs to fix this up: how does it
> > > > do so?
>
> Circling back to this request, because I just realized that the above is
> handled by saving %rsp into %rbp and requiring the enclave and handler
> to preserve %rbp at all times.
>
> So the below discussion on making the %rsp adjustment relative is moot,
> at least with respect to getting out of __vdso() if the enclave has mucked
> with the untrusted stack.
You're right. __vdso() will always restore the caller's stack via the
leave instruction at .Lout. So no change is necessary.
> > > > In the current code, __vdso..() saves the value of %rsp, calls the
> > > > handler and then restores %rsp. The handler can fix up the stack by
> > > > setting the correct value to %rbx and returning without restoring it.
> > >
> > > Ah, you're referring to the patch where the handler decides to return all
> > > the way back to the caller of __vdso...().
> > >
> > > > But this requires internal knowledge of the __vdso...() function,
> > > > which could theoretically change in the future.
> > > >
> > > > If instead the __vdso...() only did add/sub, then the handler could do:
> > > > 1. pop return address
> > > > 2. pop handler stack params
> > > > 3. pop enclave additional output stack params
> > > > 4. push handler stack params
> > > > 5. push return address
>
> Per above, this is unnecessary when returning to the caller of __vdso().
> It would be necessary if the enclave wasn't smart enough to do it's own
> stack cleanup, but that seems like a very bizarre contract between the
> enclave and its runtime.
>
> The caveat is if %rbx is saved/restored by __vdso(). If we want a
> traditional frame pointer, then %rbx would be restored from the stack
> before %rsp itself is restored (from %rbp), in which case the exit handler
> would need to adjust %rsp using a sequence similar to what you listed
> above.
>
> If __vdso() uses a non-standard frame pointer, e.g.
>
> push %rbp
> push %rbx
> mov %rsp, %rbp
>
> then %rbx would come off the stack after %rsp is restored from %rbp, i.e.
> would be guaranteed to be restored to the pre-EENTER value (unless the
> enclave or handler mucks with %rbp).
>
> Anyways, we can discuss how to implement the frame pointer in the context
> of the patches, just wanted to point this out here for completeness.
>
> > > > While this is more work, it is standard calling convention work that
> > > > doesn't require internal knowledge of __vdso..(). Alternatively, if we
> > > > don't like the extra work, we can document the %rbx hack explicitly
> > > > into the handler documentation and make it part of the interface. But
> > > > we need some explicit way for the handler to pop enclave output stack
> > > > params that doesn't depend on internal knowledge of the __vdso...()
> > > > invariants.
> > >
> > > IIUC, this is what you're suggesting? Having to align the stack makes this
> > > a bit annoying, but it's not bad by any means.
> > >
> > > diff --git a/arch/x86/entry/vdso/vsgx_enter_enclave.S b/arch/x86/entry/vdso/vsgx_enter_enclave.S
> > > index 94a8e5f99961..05d54f79b557 100644
> > > --- a/arch/x86/entry/vdso/vsgx_enter_enclave.S
> > > +++ b/arch/x86/entry/vdso/vsgx_enter_enclave.S
> > > @@ -139,8 +139,9 @@ SYM_FUNC_START(__vdso_sgx_enter_enclave)
> > > /* Pass the untrusted RSP (at exit) to the callback via %rcx. */
> > > mov %rsp, %rcx
> > >
> > > - /* Save the untrusted RSP in %rbx (non-volatile register). */
> > > + /* Save the untrusted RSP offset in %rbx (non-volatile register). */
> > > mov %rsp, %rbx
> > > + and $0xf, %rbx
> > >
> > > /*
> > > * Align stack per x86_64 ABI. Note, %rsp needs to be 16-byte aligned
> > > @@ -161,8 +162,8 @@ SYM_FUNC_START(__vdso_sgx_enter_enclave)
> > > mov 0x20(%rbp), %rax
> > > call .Lretpoline
> > >
> > > - /* Restore %rsp to its post-exit value. */
> > > - mov %rbx, %rsp
> > > + /* Undo the post-exit %rsp adjustment. */
> > > + lea 0x20(%rsp,%rbx), %rsp
> > >
> > >
> > > That's reasonable, let's the handler play more games with minimal overhead.
> >
> > Yes, exactly!
> >
> > > > > > That would make this a very usable and fast interface without
> > > > > > sacrificing any of its current power.
> > > > >
> > > >
> > >
> >
>
On Wed, Mar 18, 2020 at 9:01 AM Nathaniel McCallum
<[email protected]> wrote:
>
> On Tue, Mar 17, 2020 at 6:23 PM Xing, Cedric <[email protected]> wrote:
> >
> > On 3/17/2020 9:50 AM, Nathaniel McCallum wrote:
> > > On Mon, Mar 16, 2020 at 8:18 PM Xing, Cedric <[email protected]> wrote:
> > >>
> > >> On 3/16/2020 4:59 PM, Sean Christopherson wrote:
> > >>> On Mon, Mar 16, 2020 at 04:50:26PM -0700, Xing, Cedric wrote:
> > >>>> On 3/16/2020 3:53 PM, Sean Christopherson wrote:
> > >>>>> On Mon, Mar 16, 2020 at 11:38:24PM +0200, Jarkko Sakkinen wrote:
> > >>>>>>> My suggestions explicitly maintained robustness, and in fact increased
> > >>>>>>> it. If you think we've lost capability, please speak with specificity
> > >>>>>>> rather than in vague generalities. Under my suggestions we can:
> > >>>>>>> 1. call the vDSO from C
> > >>>>>>> 2. pass context to the handler
> > >>>>>>> 3. have additional stack manipulation options in the handler
> > >>>>>>>
> > >>>>>>> The cost for this is a net 2 additional instructions. No existing
> > >>>>>>> capability is lost.
> > >>>>>>
> > >>>>>> My vague generality in this case is just that the whole design
> > >>>>>> approach so far has been to minimize the amount of wrapping to
> > >>>>>> EENTER.
> > >>>>>
> > >>>>> Yes and no. If we wanted to minimize the amount of wrapping around the
> > >>>>> vDSO's ENCLU then we wouldn't have the exit handler shenanigans in the
> > >>>>> first place. The whole process has been about balancing the wants of each
> > >>>>> use case against the overall quality of the API and code.
> > >>>>>
> > >>>> The design of this vDSO API was NOT to minimize wrapping, but to allow
> > >>>> maximal flexibility. More specifically, we strove not to restrict how info
> > >>>> was exchanged between the enclave and its host process. After all, calling
> > >>>> convention is compiler specific - i.e. the enclave could be built by a
> > >>>> different compiler (e.g. MSVC) that doesn't share the same list of CSRs as
> > >>>> the host process. Therefore, the API has been implemented to pass through
> > >>>> virtually all registers except those used by EENTER itself. Similarly, all
> > >>>> registers are passed back from enclave to the caller (or the exit handler)
> > >>>> except those used by EEXIT. %rbp is an exception because the vDSO API has to
> > >>>> anchor the stack, using either %rsp or %rbp. We picked %rbp to allow the
> > >>>> enclave to allocate space on the stack.
> > >>>
> > >>> And unless I'm missing something, using %rcx to pass @leaf would still
> > >>> satisfy the above, correct? Ditto for saving/restoring %rbx.
> > >>>
> > >>> I.e. a runtime that's designed to work with enclave's using a different
> > >>> calling convention wouldn't be able to take advantage of being able to call
> > >>> the vDSO from C, but neither would it take on any meaningful burden.
> > >>>
> > >> Not exactly.
> > >>
> > >> If called directly from C code, the caller would expect CSRs to be
> > >> preserved.
> > >
> > > Correct. This requires collaboration between the caller of the vDSO
> > > and the enclave.
> > >
> > >> Then who should preserve CSRs?
> > >
> > > The enclave.
> > >
> > >> It can't be the enclave
> > >> because it may not follow the same calling convention.
> > >
> > > This is incorrect. You are presuming there is not tight integration
> > > between the caller of the vDSO and the enclave. In my case, the
> > > integration is total and complete. We have working code today that
> > > does this.
> > >
> > >> Moreover, the
> > >> enclave may run into an exception, in which case it doesn't have the
> > >> ability to restore CSRs.
> > >
> > > There are two solutions to this:
> > > 1. Write the handler in assembly and don't return to C on AEX.
> > > 2. The caller can simply preserve the registers. Nothing stops that.
> > >
> > > We have implemented #1.
> > >
> > What if the enclave cannot proceed due to an unhandled exception so the
> > execution has to get back to the C caller of the vDSO API?
>
> mov $60, %rax
> mov $1, %rdi
> syscall
>
> We exit in all such cases.
Another solution is for the enclave to push the non-volatile registers
to the non-enclave stack upon entry and let the handler restore them.
That works for both EEXIT and AEX and you can return to C code then.
> > It seems to me the caller has to preserve CSRs by itself, otherwise it
> > cannot continue execution after any enclave exception. Passing @leaf in
> > %ecx will allow saving/restoring CSRs in C by setjmp()/longjmp(), with
> > the help of an exit handler. But if the C caller has already preserved
> > CSRs, why preserve CSRs again inside the enclave? It looks to me things
> > can be simplified only if the host process handles no enclave exceptions
> > (or exceptions inside the enclave will crash the calling thread). Thus
> > the only case of enclave EEXIT'ing back to its caller is considered
> > valid, hence the enclave will always be able to restore CSRs, so that
> > neither vDSO nor its caller has to preserve CSRs.
> >
> > Is my understanding correct?
> >