Received: by 2002:ac0:98c7:0:0:0:0:0 with SMTP id g7-v6csp2692530imd; Fri, 2 Nov 2018 16:19:01 -0700 (PDT) X-Google-Smtp-Source: AJdET5enHjC83uor77A/aNzyVGhb8cbNeOquKL1fVIAoZwiR8VJGkdsDi1uilchMSq6XnZoi4XIS X-Received: by 2002:a62:90db:: with SMTP id q88-v6mr13376394pfk.98.1541200741351; Fri, 02 Nov 2018 16:19:01 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1541200741; cv=none; d=google.com; s=arc-20160816; b=WgK6meteEyNijP7s8xs5TQ5jZjR0s4+MntVELdkPEc63v4K8ojE+R/xk46JLlG9ewx c/zlz7pDn8IkOG+d99pjAlVacTAMNCLd4wsIl8NCqLe8AN4hU1sBrbJ1nrSz6UIspFyS Pz3lxBtW45iw5K26s0fRfQ0xlFeEQTN+CVKgV9A4y3OGMrRDs0DxjI7MrfylO16U4YWe UiuZs8frY2vICyXQXNYBvwLiufnHjGTaNWiZMhmqzNDYX5CnPkfWfh8QF1T9MGBRam2W SO4q3a71e/fnhZQg9gCxvKrw+Ko+hSSmBLVI9C+s7Nrfav8E26mg/n+G1jvDrLeDDFO7 pIEw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from; bh=tT98duk+RcgaP3WOpcGgQoc2RxM2D7EhMESlOqiSUAI=; b=pGDCLmJCDNWxj1Nbpmk1Sh8aSJAqkkUlSRbylft4EtAr57fm57qozjsTzRQXIybITa xXBYkBxR4c5BF/8GHC+no4YhBBssCf02urqKWZKpFaM67IBQ60nF4//dobrfpCZtpu6s eLtBGzQCH0WJoHE6pdZrmiCBRnooRQYD6VSDerVXTRUbc2sAIgcHzah4oauLkEdGLZYa p5dN9sJopiujs+5BLmrQAP5Aov7vwbTLwEtGGzxvOBh9ARI/Z8o+tCcCOP4yKKJNcLFu VNlSCmw5nkrlWPogcx8QAEw3vf20+OU9yfT9UIpI8XYJj84oJJdTM9nN/xWtRiwLuAnd 5kzA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=intel.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id bi6-v6si22770602plb.348.2018.11.02.16.18.47; Fri, 02 Nov 2018 16:19:01 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728549AbeKCIZj (ORCPT + 99 others); Sat, 3 Nov 2018 04:25:39 -0400 Received: from mga03.intel.com ([134.134.136.65]:2406 "EHLO mga03.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726705AbeKCIZj (ORCPT ); Sat, 3 Nov 2018 04:25:39 -0400 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga005.jf.intel.com ([10.7.209.41]) by orsmga103.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 02 Nov 2018 16:16:31 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.54,457,1534834800"; d="scan'208";a="270987996" Received: from btyborox-mobl.ger.corp.intel.com (HELO localhost) ([10.249.254.138]) by orsmga005.jf.intel.com with ESMTP; 02 Nov 2018 16:16:21 -0700 From: Jarkko Sakkinen To: x86@kernel.org, platform-driver-x86@vger.kernel.org, linux-sgx@vger.kernel.org Cc: dave.hansen@intel.com, sean.j.christopherson@intel.com, nhorman@redhat.com, npmccallum@redhat.com, serge.ayoun@intel.com, shay.katz-zamir@intel.com, haitao.huang@intel.com, mark.shanahan@intel.com, andriy.shevchenko@linux.intel.com, Haim Cohen , Thomas Gleixner , Ingo Molnar , Borislav Petkov , "H. Peter Anvin" , Jarkko Sakkinen , Tom Lendacky , Konrad Rzeszutek Wilk , Paolo Bonzini , David Woodhouse , Janakarajan Natarajan , Matt Turner , linux-kernel@vger.kernel.org (open list:X86 ARCHITECTURE (32-BIT AND 64-BIT)) Subject: [PATCH v15 13/23] x86/msr: Add SGX Launch Control MSR definitions Date: Sat, 3 Nov 2018 01:11:12 +0200 Message-Id: <20181102231320.29164-14-jarkko.sakkinen@linux.intel.com> X-Mailer: git-send-email 2.19.1 In-Reply-To: <20181102231320.29164-1-jarkko.sakkinen@linux.intel.com> References: <20181102231320.29164-1-jarkko.sakkinen@linux.intel.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Sean Christopherson Add a new IA32_FEATURE_CONTROL bit, SGX_LE_WR. When set, SGX_LE_WR allows software to write the SGXLEPUBKEYHASH MSRs (see below). The The existence of the bit is enumerated by CPUID as X86_FEATURE_SGX_LC. Like all other flags in IA32_FEATURE_CONTROL, the MSR must be locked for SGX_LE_WR to take effect. Add four MSRs, SGXLEPUBKEYHASH{0,1,2,3}, or in human readable form, the SGX Launch Enclave Public Key Hash MSRs. These MSRs correspond to the key that is used by the CPU to determine whether or not to allow software to enter an enclave. When ENCLS[EINIT] is executed, which is a prerequisite to entering the enclave, the CPU compares the key (technically its hash) used to sign the enclave with the key hash stored in the MSRs, and will reject EINIT if the keys do not match. Enclaves can also be blessed by proxy, in which case a Launch Enclave generates and signs an EINIT TOKEN. If a valid token is provided, ENCLS[EINIT] compares the signer of the token against the MSRs instead of the signer of the enclave. The SGXLEPUBKEYHASH MSRs only exist on CPUs that support SGX Launch Control, enumerated by X86_FEATURE_SGX_LC. CPUs without Launch Control use a hardcoded key for the ENCLS[EINIT] checks. An internal hardcoded key is also used as the reset value for the hash MSRs when they exist. As a final note, the SGX_LEPUBKEYHASH MSRs can also be written by pre-boot firmware prior to activating SGX (SGX activation is done by setting bit 0 in MSR 0x7A). Thus, firmware can lock the MSRs to a non-Intel value by writing the MSRs and locking IA32_FEATURE_CONTROL without setting SGX_LE_WR. Co-developed-by: Haim Cohen Signed-off-by: Haim Cohen Signed-off-by: Sean Christopherson --- arch/x86/include/asm/msr-index.h | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h index 2837f65ac817..ffae9df1c0ab 100644 --- a/arch/x86/include/asm/msr-index.h +++ b/arch/x86/include/asm/msr-index.h @@ -486,6 +486,7 @@ #define FEATURE_CONTROL_LOCKED (1<<0) #define FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX (1<<1) #define FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX (1<<2) +#define FEATURE_CONTROL_SGX_LE_WR (1<<17) #define FEATURE_CONTROL_SGX_ENABLE (1<<18) #define FEATURE_CONTROL_LMCE (1<<20) @@ -499,6 +500,12 @@ #define MSR_IA32_UCODE_WRITE 0x00000079 #define MSR_IA32_UCODE_REV 0x0000008b +/* Intel SGX Launch Enclave Public Key Hash MSRs */ +#define MSR_IA32_SGXLEPUBKEYHASH0 0x0000008C +#define MSR_IA32_SGXLEPUBKEYHASH1 0x0000008D +#define MSR_IA32_SGXLEPUBKEYHASH2 0x0000008E +#define MSR_IA32_SGXLEPUBKEYHASH3 0x0000008F + #define MSR_IA32_SMM_MONITOR_CTL 0x0000009b #define MSR_IA32_SMBASE 0x0000009e -- 2.19.1