Unverified Commit 16046abd authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!158 Intel SPR: SGX: Backport SGX EDMM support 

Merge Pull Request from: @zhiquan1-li 
 
**Content:**
This PR includes incremental backporting patches which mainly covers [SGX EDMM](https://lore.kernel.org/linux-sgx/239f0f5692d9c00f3c9e0d5d58cd77d2e5ba5eb4.camel@kernel.org/T/#m5f94561a7fef3f33e9922a41f45e5dcf88ad9880) (Enclave Dynamic
Memory Management) support and its dependencies, as well as subsequent fix until upstream v6.0.

This total patch number is 54, it includes:
- SGX EDMM support (commit 22~52)
  [[PATCH V5 00/31] x86/sgx and selftests/sgx: Support SGX2](https://lore.kernel.org/linux-sgx/239f0f5692d9c00f3c9e0d5d58cd77d2e5ba5eb4.camel@kernel.org/T/#m5f94561a7fef3f33e9922a41f45e5dcf88ad9880)
- Its dependencies (commit 1~21)
- Subsequent bug fix until upstream v6.0 (commit 53~54)

**Intel-kernel issue:**
https://gitee.com/openeuler/intel-kernel/issues/I5USAM

**Test:**
1. Build successfully for each commits
2. Kernel selftest - SGX: PASSED
   (this patchset includes dedicated test cases against EDMM)
   ```sh
   cd tools/testing/selftests/sgx/
   make
   ./test_sgx
   ```
3. SGX internal stress test: No new failure

**Known issue:**
None

**Default config change:**
None 
 
Link:https://gitee.com/openeuler/kernel/pulls/158

 
Reviewed-by: default avatarJun Tian <jun.j.tian@intel.com>
Reviewed-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
Signed-off-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
parents 96921e00 68203083

Documentation/ABI/stable/sysfs-devices-node

+6 −0
Original line number Diff line number Diff line
@@ -176,3 +176,9 @@ Contact: Keith Busch <keith.busch@intel.com> 
Description:

		The cache write policy: 0 for write-back, 1 for write-through,

		other or unknown.



What:		/sys/devices/system/node/nodeX/x86/sgx_total_bytes

Date:		November 2021

Contact:	Jarkko Sakkinen <jarkko@kernel.org>

Description:

		The total amount of SGX physical memory in bytes.

Documentation/x86/sgx.rst

+22 −7
Original line number Diff line number Diff line
@@ -10,7 +10,7 @@ Overview 
Software Guard eXtensions (SGX) hardware enables for user space applications

to set aside private memory regions of code and data:



* Privileged (ring-0) ENCLS functions orchestrate the construction of the.

* Privileged (ring-0) ENCLS functions orchestrate the construction of the

  regions.

* Unprivileged (ring-3) ENCLU functions allow an application to enter and

  execute inside the regions.
@@ -91,7 +91,7 @@ In addition to the traditional compiler and linker build process, SGX has a 
separate enclave “build” process.  Enclaves must be built before they can be

executed (entered). The first step in building an enclave is opening the

**/dev/sgx_enclave** device.  Since enclave memory is protected from direct

access, special privileged instructions are Then used to copy data into enclave

access, special privileged instructions are then used to copy data into enclave

pages and establish enclave page permissions.



.. kernel-doc:: arch/x86/kernel/cpu/sgx/ioctl.c
@@ -100,6 +100,21 @@ pages and establish enclave page permissions. 
               sgx_ioc_enclave_init

               sgx_ioc_enclave_provision



Enclave runtime management

--------------------------



Systems supporting SGX2 additionally support changes to initialized

enclaves: modifying enclave page permissions and type, and dynamically

adding and removing of enclave pages. When an enclave accesses an address

within its address range that does not have a backing page then a new

regular page will be dynamically added to the enclave. The enclave is

still required to run EACCEPT on the new page before it can be used.



.. kernel-doc:: arch/x86/kernel/cpu/sgx/ioctl.c

   :functions: sgx_ioc_enclave_restrict_permissions

               sgx_ioc_enclave_modify_types

               sgx_ioc_enclave_remove_pages



Enclave vDSO

------------
@@ -126,13 +141,13 @@ the need to juggle signal handlers. 
ksgxd

=====



SGX support includes a kernel thread called *ksgxwapd*.

SGX support includes a kernel thread called *ksgxd*.



EPC sanitization

----------------



ksgxd is started when SGX initializes.  Enclave memory is typically ready

For use when the processor powers on or resets.  However, if SGX has been in

for use when the processor powers on or resets.  However, if SGX has been in

use since the reset, enclave pages may be in an inconsistent state.  This might

occur after a crash and kexec() cycle, for instance.  At boot, ksgxd

reinitializes all enclave pages so that they can be allocated and re-used.
@@ -147,7 +162,7 @@ Page reclaimer 


Similar to the core kswapd, ksgxd, is responsible for managing the

overcommitment of enclave memory.  If the system runs out of enclave memory,

*ksgxwapd* “swaps” enclave memory to normal memory.

*ksgxd* “swaps” enclave memory to normal memory.



Launch Control

==============
@@ -156,7 +171,7 @@ SGX provides a launch control mechanism. After all enclave pages have been 
copied, kernel executes EINIT function, which initializes the enclave. Only after

this the CPU can execute inside the enclave.



ENIT function takes an RSA-3072 signature of the enclave measurement.  The function

EINIT function takes an RSA-3072 signature of the enclave measurement.  The function

checks that the measurement is correct and signature is signed with the key

hashed to the four **IA32_SGXLEPUBKEYHASH{0, 1, 2, 3}** MSRs representing the

SHA256 of a public key.
@@ -184,7 +199,7 @@ CPUs starting from Icelake use Total Memory Encryption (TME) in the place of 
MEE. TME-based SGX implementations do not have an integrity Merkle tree, which

means integrity and replay-attacks are not mitigated.  B, it includes

additional changes to prevent cipher text from being returned and SW memory

aliases from being Created.

aliases from being created.



DMA to enclave memory is blocked by range registers on both MEE and TME systems

(SDM section 41.10).

arch/Kconfig

+4 −0
Original line number Diff line number Diff line
@@ -1119,6 +1119,10 @@ config ARCH_SPLIT_ARG64 
	   If a 32-bit architecture requires 64-bit arguments to be split into

	   pairs of 32-bit arguments, select this option.



# Select, if arch has a named attribute group bound to NUMA device nodes.

config HAVE_ARCH_NODE_DEV_GROUP

	bool



source "kernel/gcov/Kconfig"



source "scripts/gcc-plugins/Kconfig"

arch/x86/Kconfig

+1 −0
Original line number Diff line number Diff line
@@ -250,6 +250,7 @@ config X86 
	select HAVE_ARCH_KCSAN			if X86_64

	select X86_FEATURE_NAMES		if PROC_FS

	select PROC_PID_ARCH_STATUS		if PROC_FS

	select HAVE_ARCH_NODE_DEV_GROUP		if X86_SGX

	imply IMA_SECURE_AND_OR_TRUSTED_BOOT    if EFI



config INSTRUCTION_DECODER

arch/x86/include/asm/sgx.h

+8 −0
Original line number Diff line number Diff line
@@ -47,17 +47,22 @@ enum sgx_encls_function { 


/**

 * enum sgx_return_code - The return code type for ENCLS, ENCLU and ENCLV

 * %SGX_EPC_PAGE_CONFLICT:	Page is being written by other ENCLS function.

 * %SGX_NOT_TRACKED:		Previous ETRACK's shootdown sequence has not

 *				been completed yet.

 * %SGX_CHILD_PRESENT		SECS has child pages present in the EPC.

 * %SGX_INVALID_EINITTOKEN:	EINITTOKEN is invalid and enclave signer's

 *				public key does not match IA32_SGXLEPUBKEYHASH.

 * %SGX_PAGE_NOT_MODIFIABLE:	The EPC page cannot be modified because it

 *				is in the PENDING or MODIFIED state.

 * %SGX_UNMASKED_EVENT:		An unmasked event, e.g. INTR, was received

 */

enum sgx_return_code {

	SGX_EPC_PAGE_CONFLICT		= 7,

	SGX_NOT_TRACKED			= 11,

	SGX_CHILD_PRESENT		= 13,

	SGX_INVALID_EINITTOKEN		= 16,

	SGX_PAGE_NOT_MODIFIABLE		= 20,

	SGX_UNMASKED_EVENT		= 128,

};
@@ -216,6 +221,9 @@ struct sgx_pageinfo { 
 * %SGX_PAGE_TYPE_REG:	a regular page

 * %SGX_PAGE_TYPE_VA:	a VA page

 * %SGX_PAGE_TYPE_TRIM:	a page in trimmed state

 *

 * Make sure when making changes to this enum that its values can still fit

 * in the bitfield within &struct sgx_encl_page

 */

enum sgx_page_type {

	SGX_PAGE_TYPE_SECS,