lkml.org 
[lkml]   [2020]   [Feb]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v27 06/22] x86/cpu/intel: Detect SGX supprt
    Date
    From: Sean Christopherson <sean.j.christopherson@intel.com>

    Configure SGX as part of feature control MSR initialization and update
    the associated X86_FEATURE flags accordingly. Because the kernel will
    require the LE hash MSRs to be writable when running native enclaves,
    disable X86_FEATURE_SGX (and all derivatives) if SGX Launch Control is
    not (or cannot) be fully enabled via feature control MSR.

    The check is done for every CPU, not just BSP, in order to verify that
    MSR_IA32_FEATURE_CONTROL is correctly configured on all CPUs. The other
    parts of the kernel, like the enclave driver, expect the same
    configuration from all CPUs.

    Note, unlike VMX, clear the X86_FEATURE_SGX* flags for all CPUs if any
    CPU lacks SGX support as the kernel expects SGX to be available on all
    CPUs. X86_FEATURE_VMX is intentionally cleared only for the current CPU
    so that KVM can provide additional information if KVM fails to load,
    e.g. print which CPU doesn't support VMX. KVM/VMX requires additional
    per-CPU enabling, e.g. to set CR4.VMXE and do VMXON, and so already has
    the necessary infrastructure to do per-CPU checks. SGX on the other
    hand doesn't require additional enabling, so clearing the feature flags
    on all CPUs means the SGX subsystem doesn't need to manually do support
    checks on a per-CPU basis.

    Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
    Co-developed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
    Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
    ---
    arch/x86/kernel/cpu/feat_ctl.c | 29 ++++++++++++++++++++++++++++-
    1 file changed, 28 insertions(+), 1 deletion(-)

    diff --git a/arch/x86/kernel/cpu/feat_ctl.c b/arch/x86/kernel/cpu/feat_ctl.c
    index 0268185bef94..b16b71a6da74 100644
    --- a/arch/x86/kernel/cpu/feat_ctl.c
    +++ b/arch/x86/kernel/cpu/feat_ctl.c
    @@ -92,6 +92,14 @@ static void init_vmx_capabilities(struct cpuinfo_x86 *c)
    }
    #endif /* CONFIG_X86_VMX_FEATURE_NAMES */

    +static void clear_sgx_caps(void)
    +{
    + setup_clear_cpu_cap(X86_FEATURE_SGX);
    + setup_clear_cpu_cap(X86_FEATURE_SGX_LC);
    + setup_clear_cpu_cap(X86_FEATURE_SGX1);
    + setup_clear_cpu_cap(X86_FEATURE_SGX2);
    +}
    +
    void init_ia32_feat_ctl(struct cpuinfo_x86 *c)
    {
    bool tboot = tboot_enabled();
    @@ -99,6 +107,7 @@ void init_ia32_feat_ctl(struct cpuinfo_x86 *c)

    if (rdmsrl_safe(MSR_IA32_FEAT_CTL, &msr)) {
    clear_cpu_cap(c, X86_FEATURE_VMX);
    + clear_sgx_caps();
    return;
    }

    @@ -123,13 +132,21 @@ void init_ia32_feat_ctl(struct cpuinfo_x86 *c)
    msr |= FEAT_CTL_VMX_ENABLED_INSIDE_SMX;
    }

    + /*
    + * Enable SGX if and only if the kernel supports SGX and Launch Control
    + * is supported, i.e. disable SGX if the LE hash MSRs can't be written.
    + */
    + if (cpu_has(c, X86_FEATURE_SGX) && cpu_has(c, X86_FEATURE_SGX_LC) &&
    + IS_ENABLED(CONFIG_INTEL_SGX))
    + msr |= FEAT_CTL_SGX_ENABLED | FEAT_CTL_SGX_LC_ENABLED;
    +
    wrmsrl(MSR_IA32_FEAT_CTL, msr);

    update_caps:
    set_cpu_cap(c, X86_FEATURE_MSR_IA32_FEAT_CTL);

    if (!cpu_has(c, X86_FEATURE_VMX))
    - return;
    + goto update_sgx;

    if ( (tboot && !(msr & FEAT_CTL_VMX_ENABLED_INSIDE_SMX)) ||
    (!tboot && !(msr & FEAT_CTL_VMX_ENABLED_OUTSIDE_SMX))) {
    @@ -142,4 +159,14 @@ void init_ia32_feat_ctl(struct cpuinfo_x86 *c)
    init_vmx_capabilities(c);
    #endif
    }
    +
    +update_sgx:
    + if (!cpu_has(c, X86_FEATURE_SGX) || !cpu_has(c, X86_FEATURE_SGX_LC)) {
    + clear_sgx_caps();
    + } else if (!(msr & FEAT_CTL_SGX_ENABLED) ||
    + !(msr & FEAT_CTL_SGX_LC_ENABLED)) {
    + if (IS_ENABLED(CONFIG_INTEL_SGX))
    + pr_err_once("SGX disabled by BIOS\n");
    + clear_sgx_caps();
    + }
    }
    --
    2.20.1
    \
     
     \ /
      Last update: 2020-02-23 18:27    [W:3.058 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site