Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Message-ID: <8ac3fc3e-9d90-48cf-d84e-40f9cbddd9ac@intel.com>
Date:   Thu, 20 Jan 2022 10:20:01 -0800
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101
 Firefox/91.0 Thunderbird/91.5.0
Subject: Re: [PATCH V2] x86/sgx: Add poison handling to reclaimer
Content-Language: en-US
To:     Jarkko Sakkinen <jarkko@kernel.org>, <tony.luck@intel.com>,
        <dave.hansen@linux.intel.com>, <tglx@linutronix.de>,
        <bp@alien8.de>, <luto@kernel.org>, <mingo@redhat.com>,
        <linux-sgx@vger.kernel.org>, <x86@kernel.org>
CC:     <linux-kernel@vger.kernel.org>
References: <be5af586f667c7bcb8ef01286ce75675de5d100f.1642630582.git.reinette.chatre@intel.com>
 <3bfe66204ee84a0bbccaf7cd20af0d8300fb9f26.camel@kernel.org>
From:   Reinette Chatre <reinette.chatre@intel.com>
In-Reply-To: <3bfe66204ee84a0bbccaf7cd20af0d8300fb9f26.camel@kernel.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 8bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?dnFlaTA3ZjRrRDdIUUF5cG5GQzZ0NFgvTG9wOUZSVnVmWVhoR3REVldjL1BX?=
 =?utf-8?B?NENqa3BZK3BzMmtEbU50TTA3UzVvL3h4NlJJN2RHQXhHaTc0VHViRTlvUUll?=
 =?utf-8?B?UFdPaTdSejRUV2IvTDdZb3VDK3RKb3A0MWpYUkVhaVhHU2FIM2NnQnE3amNX?=
 =?utf-8?B?bFh1eDFrejRnSVpvWFhWNDk1Tkg1emRJUUh1MWV5VDNNL08zZHZIK0l5Sjdh?=
 =?utf-8?B?bmZ4L3R5eVJpRWt1RHZaSFNlRUpDaHk5YkVHZ3B2VU5wdWFiZm94Z3Btdkhm?=
 =?utf-8?B?REJKMVNKSnJZL3VkR3RrbWNZTnVyOCt0RXkvcS8zUEQyMkpzMlZ1emVDdHJw?=
 =?utf-8?B?RUtLbnJOZUJWYzg0V2phSGIySHVaL2V2YTcrK1pjWGdzdDFFaDZWL01NWURm?=
 =?utf-8?B?RU1lNTZzWEF2aE9NR2p0K1NQb0F5RHJ1bE5RZGROMTJZdk1hdUVXa29RVXNS?=
 =?utf-8?B?MVNsOVJLWUI5VExWd05iMWU0d21TQUI0aHlTWWpSV3dha1NxWFl3VDcvNGtX?=
 =?utf-8?B?ekdheTd4b3ZqMFBxYXk2YmF2S1dKQ2x1YnFld1VTZVg2T0lqWU9qc3hETEFv?=
 =?utf-8?B?MXVhQkxLWkM1K0doQjJrOFdrMmJBQ2VMbDN2eEc2MEZQZmtKd1hpLzM5K0Q2?=
 =?utf-8?B?UXREM0ZDRUY4R0RXei8rdm1GMXF5MHViUWJGUmx4TGtURGIrV0tUQmx0cElj?=
 =?utf-8?B?LzdLZVJiTGdOLys0alEvTzFTVldCOFBXSzNET0Z4SFAraVVNcW04WWtMK3Fh?=
 =?utf-8?B?YjVtRXlrY0pwaWpDUmdKTTNMLzdGRFA3SitrNllocjQyQUMzTGpwUmVpWFh5?=
 =?utf-8?B?N3lxTTd6V0l3ZTBCbnY1Q0tjNkRnNFJpVERBUXlleVk5czNYRnhSY251SUgr?=
 =?utf-8?B?RHluVHpCdWtDK0w3ZnVrYzd3UlBnK2pMQ0kvNVBxeFI1dWxxeFVVNXNRZDNL?=
 =?utf-8?B?UFdkclBsZTlQYS9CNFU5SU4rV3psUUFSYmVZcG9QNkF4bHdGZ0s5bHNSVkkr?=
 =?utf-8?B?aFRIVWVoaDJoWFgzWDhjR0FqSm5PTXltRE5ZdXVTQ3JMQTM1akZIdkVIUk4x?=
 =?utf-8?B?OFhtT3dacXViNmowWi91ekJPMmxTRHZmS3F4dk8vWDcwQ0R1cjFWQkoya2JO?=
 =?utf-8?B?Wm12NjErZkVETWR2NG5ybVVKcFQ5U3d4TDlTdWVjK2JEK0Nkc2Y5SEhsaFFK?=
 =?utf-8?B?Rm1pSEE1T3ZHUW5EamoxdG9qcElBME9CNCt0ZG5Ub0dRV0ZSc1JCWlJZUWhH?=
 =?utf-8?B?N3I3bkZUVUd2bFNHZmFCdHc2WDFsQlYvN0MrSUVCNHFndDNVTGFySXk0c2Rh?=
 =?utf-8?B?OEUreDRPQ1M5UmFneU9pbjk5SVRESHdLNzEyRUx5a2xoeXJiWUVxT043YmRm?=
 =?utf-8?B?Sk5ZZkIxSjczai9QLzhRWmVhQThiMFo5UlJ2Z2wvcFAyYytUaXlRdjNjUzRT?=
 =?utf-8?B?UFF4dEJRNzdsWWk1K1Y0UzY0U3YrcEZRQlR2K3V3Ujk3WVJkRjJlY1ZMTmQ0?=
 =?utf-8?B?cGZSeGI4OHF6cUE3WHZLV3E3QktLbml6UWdSQldFQnZSWVNXbnoxV1VDeWNi?=
 =?utf-8?B?N3VseWFjQTkrdTZFdnN5NGwxVTNCQ3g1MG5oL0tMOU9paXpSZTJIKzgvcXF5?=
 =?utf-8?B?M0w3T3dvT3QyeFZEQXR4c0s0cUJHMXFLcitGbWI3UGdPYnB1d2xvQTE0QkNZ?=
 =?utf-8?B?UHl3UitudnhTR1ErOU10RWNtVW5peEZQY21FYzhaRU1IamJEeTFSUjZUZ2g5?=
 =?utf-8?B?clJMSkVXajRDOHVMZ3AxR3V6WHI2b0MxQi9ZWDJiUjJKK1p6UVQ4VGdiTVFN?=
 =?utf-8?B?NlhiWDllbDgyWSszb2FvbXFXeXBCK004SnNpRExhbStic3VsSG5PY2RwM0U0?=
 =?utf-8?B?VTluR2x2MUliOElIa3l6aUpSN256b1VpbndtL1FONlhwUXRPbHRkaUN5SG16?=
 =?utf-8?B?NVpsNmw4QkcvQjczQXQrOWxXUlhZZ0VYUFRFaDlYbURIR04zKzNiaEc0MjVH?=
 =?utf-8?B?ZUhLVlJldHl1THNTMyt6N2ZIbkJKVXVQY1lzT2NaV2tEWHpMZ0VuK2dCNE5B?=
 =?utf-8?B?MkkwRTlwQ1hwejN6Q1ZZaWx5SWdwelZpVTRqS3JFWjhCMzRVay9BYW1kK0Zo?=
 =?utf-8?B?TFc3SituRnN6VjBQaGdiVE5ZTy9NTjdxMlo2Y2UzVEF4L21nMXpEZmpxK0Yr?=
 =?utf-8?B?dU82UG15LzNNbEs5UnRBcm0xdFpHRVl2MDY5WmNud0YzeHBBSFl0cHY5Yzcx?=
 =?utf-8?Q?9ZC3EWX7497xB7hNWznYENYGSBqFA6CLTB8Zp7rDJg=3D?=
X-MS-Exchange-CrossTenant-Network-Message-Id: 16b0ebd7-0715-4620-162a-08d9dc417b6c
X-MS-Exchange-CrossTenant-AuthSource: BN0PR11MB5744.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Jan 2022 18:20:05.4291
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: irmwpRHgBZzHlKQLZHIdHWjgoS+y12/U4kSOtdx63e0rCPBXquBqoNhX+P22JdlPs4qxuuL7ypynYDi8wI+IDBK7E6IF1+AIh3mj2jYKwjE=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN6PR11MB1265
X-OriginatorOrg: intel.com
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Hi Jarkko,

On 1/20/2022 5:09 AM, Jarkko Sakkinen wrote:
> On Wed, 2022-01-19 at 14:23 -0800, Reinette Chatre wrote:
>> The SGX reclaimer code lacks page poison handling in its main
>> free path. This can lead to avoidable machine checks if a
>> poisoned page is freed and reallocated instead of being
>> isolated.
>>
>> A troublesome scenario is:
>>  1. Machine check (#MC) occurs (asynchronous, !MF_ACTION_REQUIRED)
>>  2. arch_memory_failure() is eventually called
>>  3. (SGX) page->poison set to 1
>>  4. Page is reclaimed
>>  5. Page added to normal free lists by sgx_reclaim_pages()
>>     ^ This is the bug (poison pages should be isolated on the
>>     sgx_poison_page_list instead)
>>  6. Page is reallocated by some innocent enclave, a second
>> (synchronous)
>>     in-kernel #MC is induced, probably during EADD instruction.
>>     ^ This is the fallout from the bug
>>
>> (6) is unfortunate and can be avoided by replacing the open coded
>> enclave page freeing code in the reclaimer with sgx_free_epc_page()
>> to obtain support for poison page handling that includes placing the
>> poisoned page on the correct list.
>>
>> Fixes: d6d261bded8a ("x86/sgx: Add new sgx_epc_page flag bit to mark
>> free pages")
>> Fixes: 992801ae9243 ("x86/sgx: Initial poison handling for dirty and
>> free pages")
> 
> Same comment as for the first version: remove the first fixes tag.
> 

For completeness I'll duplicate my response also:

The commit you refer to, commit d6d261bded8a ("x86/sgx: Add new
sgx_epc_page flag bit to mark free pages", introduced a new page flag bit
(SGX_EPC_PAGE_IS_FREE) that should be set when an EPC page is freed. The
commit also sets the bit in sgx_free_epc_page() when an EPC page is freed.
The commit should also have set that bit when the EPC page is freed in the
reclaimer, which contains an open coded version of sgx_free_epc_page(),
but it did not. This fix adds the snippet that was omitted from that
commit.

Reinette