lkml.org 
[lkml]   [2020]   [Nov]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[tip: x86/sgx] x86/cpu/intel: Detect SGX support
    The following commit has been merged into the x86/sgx branch of tip:

    Commit-ID: 224ab3527f89f69ae57dc53555826667ac46a3cc
    Gitweb: https://git.kernel.org/tip/224ab3527f89f69ae57dc53555826667ac46a3cc
    Author: Sean Christopherson <sean.j.christopherson@intel.com>
    AuthorDate: Fri, 13 Nov 2020 00:01:18 +02:00
    Committer: Borislav Petkov <bp@suse.de>
    CommitterDate: Tue, 17 Nov 2020 14:36:13 +01:00

    x86/cpu/intel: Detect SGX support

    Kernel support for SGX is ultimately decided by the state of the launch
    control bits in the feature control MSR (MSR_IA32_FEAT_CTL). If the
    hardware supports SGX, but neglects to support flexible launch control, the
    kernel will not enable SGX.

    Enable SGX at feature control MSR initialization and update the associated
    X86_FEATURE flags accordingly. Disable X86_FEATURE_SGX (and all
    derivatives) if the kernel is not able to establish itself as the authority
    over SGX Launch Control.

    All checks are performed for each logical CPU (not just boot CPU) in order
    to verify that MSR_IA32_FEATURE_CONTROL is correctly configured on all
    CPUs. All SGX code in this series expects the same configuration from all
    CPUs.

    This differs from VMX where X86_FEATURE_VMX is intentionally cleared only
    for the current CPU so that KVM can provide additional information if KVM
    fails to load like which CPU doesn't support VMX. There’s not much the
    kernel or an administrator can do to fix the situation, so SGX neglects to
    convey additional details about these kinds of failures if they occur.

    Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
    Co-developed-by: Jarkko Sakkinen <jarkko@kernel.org>
    Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
    Signed-off-by: Borislav Petkov <bp@suse.de>
    Acked-by: Jethro Beekman <jethro@fortanix.com>
    Link: https://lkml.kernel.org/r/20201112220135.165028-8-jarkko@kernel.org
    ---
    arch/x86/kernel/cpu/feat_ctl.c | 29 ++++++++++++++++++++++++++++-
    1 file changed, 28 insertions(+), 1 deletion(-)

    diff --git a/arch/x86/kernel/cpu/feat_ctl.c b/arch/x86/kernel/cpu/feat_ctl.c
    index 29a3bed..d38e973 100644
    --- a/arch/x86/kernel/cpu/feat_ctl.c
    +++ b/arch/x86/kernel/cpu/feat_ctl.c
    @@ -93,16 +93,32 @@ static void init_vmx_capabilities(struct cpuinfo_x86 *c)
    }
    #endif /* CONFIG_X86_VMX_FEATURE_NAMES */

    +static void clear_sgx_caps(void)
    +{
    + setup_clear_cpu_cap(X86_FEATURE_SGX);
    + setup_clear_cpu_cap(X86_FEATURE_SGX_LC);
    +}
    +
    void init_ia32_feat_ctl(struct cpuinfo_x86 *c)
    {
    bool tboot = tboot_enabled();
    + bool enable_sgx;
    u64 msr;

    if (rdmsrl_safe(MSR_IA32_FEAT_CTL, &msr)) {
    clear_cpu_cap(c, X86_FEATURE_VMX);
    + clear_sgx_caps();
    return;
    }

    + /*
    + * Enable SGX if and only if the kernel supports SGX and Launch Control
    + * is supported, i.e. disable SGX if the LE hash MSRs can't be written.
    + */
    + enable_sgx = cpu_has(c, X86_FEATURE_SGX) &&
    + cpu_has(c, X86_FEATURE_SGX_LC) &&
    + IS_ENABLED(CONFIG_X86_SGX);
    +
    if (msr & FEAT_CTL_LOCKED)
    goto update_caps;

    @@ -124,13 +140,16 @@ void init_ia32_feat_ctl(struct cpuinfo_x86 *c)
    msr |= FEAT_CTL_VMX_ENABLED_INSIDE_SMX;
    }

    + if (enable_sgx)
    + msr |= FEAT_CTL_SGX_ENABLED | FEAT_CTL_SGX_LC_ENABLED;
    +
    wrmsrl(MSR_IA32_FEAT_CTL, msr);

    update_caps:
    set_cpu_cap(c, X86_FEATURE_MSR_IA32_FEAT_CTL);

    if (!cpu_has(c, X86_FEATURE_VMX))
    - return;
    + goto update_sgx;

    if ( (tboot && !(msr & FEAT_CTL_VMX_ENABLED_INSIDE_SMX)) ||
    (!tboot && !(msr & FEAT_CTL_VMX_ENABLED_OUTSIDE_SMX))) {
    @@ -143,4 +162,12 @@ update_caps:
    init_vmx_capabilities(c);
    #endif
    }
    +
    +update_sgx:
    + if (!(msr & FEAT_CTL_SGX_ENABLED) ||
    + !(msr & FEAT_CTL_SGX_LC_ENABLED) || !enable_sgx) {
    + if (enable_sgx)
    + pr_err_once("SGX disabled by BIOS\n");
    + clear_sgx_caps();
    + }
    }
    \
     
     \ /
      Last update: 2020-11-18 18:39    [W:4.189 / U:0.532 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site