[PATCH v5 00/11] Intel SGX Driver
by Jarkko Sakkinen
Intel(R) SGX is a set of CPU instructions that can be used by applications to
set aside private regions of code and data. The code outside the enclave is
disallowed to access the memory inside the enclave by the CPU access control.
In a way you can think that SGX provides inverted sandbox. It protects the
application from a malicious host.
There is a new hardware unit in the processor called Memory Encryption Engine
(MEE) starting from the Skylake microacrhitecture. BIOS can define one or many
MEE regions that can hold enclave data by configuring them with PRMRR
registers.
The MEE automatically encrypts the data leaving the processor package to the
MEE regions. The data is encrypted using a random key whose life-time is
exactly one power cycle.
You can tell if your CPU supports SGX by looking into /proc/cpuinfo:
cat /proc/cpuinfo | grep sgx
The GIT repositoy for SGX driver resides in
https://github.com/jsakkine-intel/linux-sgx.git
'le' branch contains the upstream candidate patches.
'master' branch contains the same patches with the following differences:
* top-level patch modifies the ioctl API to be SDK compatible
* does not use flexible launch control but instead relies on SDK provided
Intel launch enclave.
v5:
* Described IPC between the Launch Enclave and kernel in the commit messages.
* Fixed all relevant checkpatch.pl issues that I have forgot fix in earlier
versions except those that exist in the imported TinyCrypt code.
* Fixed spelling mistakes in the documentation.
* Forgot to check the return value of sgx_drv_subsys_init().
* Encapsulated properly page cache init and teardown.
* Collect epc pages to a temp list in sgx_add_epc_bank
* Removed SGX_ENCLAVE_INIT_ARCH constant.
v4:
* Tied life-cycle of the sgx_le_proxy process to /dev/sgx.
* Removed __exit annotation from sgx_drv_subsys_exit().
* Fixed a leak of a backing page in sgx_process_add_page_req() in the
case when vm_insert_pfn() fails.
* Removed unused symbol exports for sgx_page_cache.c.
* Updated sgx_alloc_page() to require encl parameter and documented the
behavior (Sean Christopherson).
* Refactored a more lean API for sgx_encl_find() and documented the behavior.
* Moved #PF handler to sgx_fault.c.
* Replaced subsys_system_register() with plain bus_register().
* Retry EINIT 2nd time only if MSRs are not locked.
v3:
* Check that FEATURE_CONTROL_LOCKED and FEATURE_CONTROL_SGX_ENABLE are set.
* Return -ERESTARTSYS in __sgx_encl_add_page() when sgx_alloc_page() fails.
* Use unused bits in epc_page->pa to store the bank number.
* Removed #ifdef for WQ_NONREENTRANT.
* If mmu_notifier_register() fails with -EINTR, return -ERESTARTSYS.
* Added --remove-section=.got.plt to objcopy flags in order to prevent a
dummy .got.plt, which will cause an inconsistent size for the LE.
* Documented sgx_encl_* functions.
* Added remark about AES implementation used inside the LE.
* Removed redundant sgx_sys_exit() from le/main.c.
* Fixed struct sgx_secinfo alignment from 128 to 64 bytes.
* Validate miscselect in sgx_encl_create().
* Fixed SSA frame size calculation to take the misc region into account.
* Implemented consistent exception handling to __encls() and __encls_ret().
* Implemented a proper device model in order to allow sysfs attributes
and in-kernel API.
* Cleaned up various "find enclave" implementations to the unified
sgx_encl_find().
* Validate that vm_pgoff is zero.
* Discard backing pages with shmem_truncate_range() after EADD.
* Added missing EEXTEND operations to LE signing and launch.
* Fixed SSA size for GPRS region from 168 to 184 bytes.
* Fixed the checks for TCS flags. Now DBGOPTIN is allowed.
* Check that TCS addresses are in ELRANGE and not just page aligned.
* Require kernel to be compiled with X64_64 and CPU_SUP_INTEL.
* Fixed an incorrect value for SGX_ATTR_DEBUG from 0x01 to 0x02.
v2:
* get_rand_uint32() changed the value of the pointer instead of value
where it is pointing at.
* Launch enclave incorrectly used sigstruct attributes-field instead of
enclave attributes-field.
* Removed unused struct sgx_add_page_req from sgx_ioctl.c
* Removed unused sgx_has_sgx2.
* Updated arch/x86/include/asm/sgx.h so that it provides stub
implementations when sgx in not enabled.
* Removed cruft rdmsr-calls from sgx_set_pubkeyhash_msrs().
* return -ENOMEM in sgx_alloc_page() when VA pages consume too much space
* removed unused global sgx_nr_pids
* moved sgx_encl_release to sgx_encl.c
* return -ERESTARTSYS instead of -EINTR in sgx_encl_init()
Haim Cohen (1):
x86: add SGX MSRs to msr-index.h
Jarkko Sakkinen (8):
intel_sgx: updated MAINTAINERS
x86: define the feature control MSR's SGX launch control bit
intel_sgx: driver for Intel Software Guard Extensions
intel_sgx: ptrace() support
intel_sgx: in-kernel launch enclave
fs/pipe.c: export create_pipe_files() and replace_fd()
intel_sgx: glue code for in-kernel LE
intel_sgx: driver documentation
Kai Huang (1):
x86: add SGX definition to cpufeature
Sean Christopherson (1):
x86: define the feature control MSR's SGX enable bit
Documentation/index.rst | 1 +
Documentation/x86/intel_sgx.rst | 131 +++
MAINTAINERS | 5 +
arch/x86/include/asm/cpufeatures.h | 2 +
arch/x86/include/asm/msr-index.h | 8 +
arch/x86/include/asm/sgx.h | 233 +++++
arch/x86/include/asm/sgx_arch.h | 268 ++++++
arch/x86/include/uapi/asm/sgx.h | 138 +++
drivers/platform/x86/Kconfig | 2 +
drivers/platform/x86/Makefile | 1 +
drivers/platform/x86/intel_sgx/Kconfig | 34 +
drivers/platform/x86/intel_sgx/Makefile | 32 +
drivers/platform/x86/intel_sgx/le/Makefile | 26 +
drivers/platform/x86/intel_sgx/le/enclave/Makefile | 46 +
.../x86/intel_sgx/le/enclave/aes_encrypt.c | 191 ++++
.../platform/x86/intel_sgx/le/enclave/cmac_mode.c | 254 +++++
.../x86/intel_sgx/le/enclave/encl_bootstrap.S | 163 ++++
.../intel_sgx/le/enclave/include/tinycrypt/aes.h | 133 +++
.../le/enclave/include/tinycrypt/cmac_mode.h | 194 ++++
.../le/enclave/include/tinycrypt/constants.h | 59 ++
.../intel_sgx/le/enclave/include/tinycrypt/utils.h | 95 ++
drivers/platform/x86/intel_sgx/le/enclave/main.c | 203 ++++
.../platform/x86/intel_sgx/le/enclave/sgx_le.lds | 28 +
.../platform/x86/intel_sgx/le/enclave/sgxsign.c | 538 +++++++++++
drivers/platform/x86/intel_sgx/le/enclave/utils.c | 78 ++
drivers/platform/x86/intel_sgx/le/entry.S | 117 +++
.../platform/x86/intel_sgx/le/include/sgx_asm.h | 64 ++
.../platform/x86/intel_sgx/le/include/sgx_encl.h | 110 +++
drivers/platform/x86/intel_sgx/le/main.c | 214 +++++
drivers/platform/x86/intel_sgx/le/sgx_le_piggy.S | 15 +
drivers/platform/x86/intel_sgx/sgx.h | 277 ++++++
drivers/platform/x86/intel_sgx/sgx_encl.c | 1007 ++++++++++++++++++++
drivers/platform/x86/intel_sgx/sgx_ioctl.c | 279 ++++++
drivers/platform/x86/intel_sgx/sgx_le.c | 313 ++++++
.../platform/x86/intel_sgx/sgx_le_proxy_piggy.S | 15 +
drivers/platform/x86/intel_sgx/sgx_main.c | 457 +++++++++
drivers/platform/x86/intel_sgx/sgx_page_cache.c | 614 ++++++++++++
drivers/platform/x86/intel_sgx/sgx_util.c | 397 ++++++++
drivers/platform/x86/intel_sgx/sgx_vma.c | 232 +++++
fs/file.c | 1 +
fs/pipe.c | 1 +
41 files changed, 6976 insertions(+)
create mode 100644 Documentation/x86/intel_sgx.rst
create mode 100644 arch/x86/include/asm/sgx.h
create mode 100644 arch/x86/include/asm/sgx_arch.h
create mode 100644 arch/x86/include/uapi/asm/sgx.h
create mode 100644 drivers/platform/x86/intel_sgx/Kconfig
create mode 100644 drivers/platform/x86/intel_sgx/Makefile
create mode 100644 drivers/platform/x86/intel_sgx/le/Makefile
create mode 100644 drivers/platform/x86/intel_sgx/le/enclave/Makefile
create mode 100644 drivers/platform/x86/intel_sgx/le/enclave/aes_encrypt.c
create mode 100644 drivers/platform/x86/intel_sgx/le/enclave/cmac_mode.c
create mode 100644 drivers/platform/x86/intel_sgx/le/enclave/encl_bootstrap.S
create mode 100644 drivers/platform/x86/intel_sgx/le/enclave/include/tinycrypt/aes.h
create mode 100644 drivers/platform/x86/intel_sgx/le/enclave/include/tinycrypt/cmac_mode.h
create mode 100644 drivers/platform/x86/intel_sgx/le/enclave/include/tinycrypt/constants.h
create mode 100644 drivers/platform/x86/intel_sgx/le/enclave/include/tinycrypt/utils.h
create mode 100644 drivers/platform/x86/intel_sgx/le/enclave/main.c
create mode 100644 drivers/platform/x86/intel_sgx/le/enclave/sgx_le.lds
create mode 100644 drivers/platform/x86/intel_sgx/le/enclave/sgxsign.c
create mode 100644 drivers/platform/x86/intel_sgx/le/enclave/utils.c
create mode 100644 drivers/platform/x86/intel_sgx/le/entry.S
create mode 100644 drivers/platform/x86/intel_sgx/le/include/sgx_asm.h
create mode 100644 drivers/platform/x86/intel_sgx/le/include/sgx_encl.h
create mode 100644 drivers/platform/x86/intel_sgx/le/main.c
create mode 100644 drivers/platform/x86/intel_sgx/le/sgx_le_piggy.S
create mode 100644 drivers/platform/x86/intel_sgx/sgx.h
create mode 100644 drivers/platform/x86/intel_sgx/sgx_encl.c
create mode 100644 drivers/platform/x86/intel_sgx/sgx_ioctl.c
create mode 100644 drivers/platform/x86/intel_sgx/sgx_le.c
create mode 100644 drivers/platform/x86/intel_sgx/sgx_le_proxy_piggy.S
create mode 100644 drivers/platform/x86/intel_sgx/sgx_main.c
create mode 100644 drivers/platform/x86/intel_sgx/sgx_page_cache.c
create mode 100644 drivers/platform/x86/intel_sgx/sgx_util.c
create mode 100644 drivers/platform/x86/intel_sgx/sgx_vma.c
--
2.14.1
4 years, 9 months
[PATCH RFC v3 00/12] Intel(R) SGX Driver
by Jarkko Sakkinen
Intel(R) SGX is a set of CPU instructions that can be used by applications to
set aside private regions of code and data. The code outside the enclave is
disallowed to access the memory inside the enclave by the CPU access control.
In a way you can think that SGX provides inverted sandbox. It protects the
application from a malicious host.
There is a new hardware unit in the processor called Memory Encryption Engine
(MEE) starting from the Skylake microachitecture. BIOS can define one or many
MEE regions that can hold enclave data by configuring them with PRMRR registers.
The MEE automatically encrypts the data leaving the processor package to the MEE
regions. The data is encrypted using a random key whose life-time is exactly one
power cycle.
You can tell if your CPU supports SGX by looking into ``/proc/cpuinfo``:
``cat /proc/cpuinfo | grep ' sgx '``
The GIT repositoy for SGX driver resides in
https://github.com/jsakkine-intel/linux-sgx.git
'le' branch contains the upstream candidate patches.
'master' branch contains the same patches with the following differences:
* top-level patch modifies the ioctl API to be SDK compatible
* does not use flexible launch control but instead relies on SDK provided
Intel launch enclave.
'master' is just maintained to allow people to test the code.
v3:
* Check that FEATURE_CONTROL_LOCKED and FEATURE_CONTROL_SGX_ENABLE are set.
* Return -ERESTARTSYS in __sgx_encl_add_page() when sgx_alloc_page() fails.
* Use unused bits in epc_page->pa to store the bank number.
* Removed #ifdef for WQ_NONREENTRANT.
* If mmu_notifier_register() fails with -EINTR, return -ERESTARTSYS.
* Added --remove-section=.got.plt to objcopy flags in order to prevent a
dummy .got.plt, which will cause an inconsistent size for the LE.
* Documented sgx_encl_* functions.
* Added remark about AES implementation used inside the LE.
* Removed redundant sgx_sys_exit() from le/main.c.
* Fixed struct sgx_secinfo alignment from 128 to 64 bytes.
* Validate miscselect in sgx_encl_create().
* Fixed SSA frame size calculation to take the misc region into account.
* Implemented consistent exception handling to __encls() and __encls_ret().
* Implemented a proper device model in order to allow sysfs attributes
and in-kernel API.
* Cleaned up various "find enclave" implementations to the unified
sgx_encl_find().
* Validate that vm_pgoff is zero.
* Discard backing pages with shmem_truncate_range() after EADD.
* Added missing EEXTEND operations to LE signing and launch.
* Fixed SSA size for GPRS region from 168 to 184 bytes.
* Fixed the checks for TCS flags. Now DBGOPTIN is allowed.
* Check that TCS addresses are in ELRANGE and not just page aligned.
* Require kernel to be compiled with X64_64 and CPU_SUP_INTEL.
* Fixed an incorrect value for SGX_ATTR_DEBUG from 0x01 to 0x02.
v2:
* get_rand_uint32() changed the value of the pointer instead of value
where it is pointing at.
* Launch enclave incorrectly used sigstruct attributes-field instead of
enclave attributes-field.
* Removed unused struct sgx_add_page_req from sgx_ioctl.c
* Removed unused sgx_has_sgx2.
* Updated arch/x86/include/asm/sgx.h so that it provides stub
implementations when sgx in not enabled.
* Removed cruft rdmsr-calls from sgx_set_pubkeyhash_msrs().
* return -ENOMEM in sgx_alloc_page() when VA pages consume too much space
* removed unused global sgx_nr_pids
* moved sgx_encl_release to sgx_encl.c
* return -ERESTARTSYS instead of -EINTR in sgx_encl_init()
Haim Cohen (1):
x86: add SGX MSRs to msr-index.h
Jarkko Sakkinen (9):
intel_sgx: updated MAINTAINERS
x86: define the feature control MSR's SGX launch control bit
fs/pipe.c: export create_pipe_files() and replace_fd()
intel_sgx: driver for Intel Software Guard Extensions
intel_sgx: ptrace() support
intel_sgx: driver documentation
intel_sgx: in-kernel launch enclave
intel_sgx: glue code for in-kernel LE
intel_sgx: update IA32_SGXLEPUBKEYHASH* MSRs
Kai Huang (1):
x86: add SGX definition to cpufeature
Sean Christopherson (1):
x86: define the feature control MSR's SGX enable bit
Documentation/index.rst | 1 +
Documentation/x86/intel_sgx.rst | 131 +++
MAINTAINERS | 5 +
arch/x86/include/asm/cpufeatures.h | 2 +
arch/x86/include/asm/msr-index.h | 8 +
arch/x86/include/asm/sgx.h | 233 +++++
arch/x86/include/asm/sgx_arch.h | 268 ++++++
arch/x86/include/uapi/asm/sgx.h | 147 +++
drivers/platform/x86/Kconfig | 2 +
drivers/platform/x86/Makefile | 1 +
drivers/platform/x86/intel_sgx/Kconfig | 34 +
drivers/platform/x86/intel_sgx/Makefile | 32 +
drivers/platform/x86/intel_sgx/le/Makefile | 26 +
drivers/platform/x86/intel_sgx/le/enclave/Makefile | 46 +
.../x86/intel_sgx/le/enclave/aes_encrypt.c | 191 ++++
.../platform/x86/intel_sgx/le/enclave/cmac_mode.c | 254 +++++
.../x86/intel_sgx/le/enclave/encl_bootstrap.S | 163 ++++
.../intel_sgx/le/enclave/include/tinycrypt/aes.h | 133 +++
.../le/enclave/include/tinycrypt/cmac_mode.h | 194 ++++
.../le/enclave/include/tinycrypt/constants.h | 59 ++
.../intel_sgx/le/enclave/include/tinycrypt/utils.h | 95 ++
drivers/platform/x86/intel_sgx/le/enclave/main.c | 203 ++++
.../platform/x86/intel_sgx/le/enclave/sgx_le.lds | 28 +
.../platform/x86/intel_sgx/le/enclave/sgxsign.c | 537 +++++++++++
drivers/platform/x86/intel_sgx/le/enclave/utils.c | 78 ++
drivers/platform/x86/intel_sgx/le/entry.S | 117 +++
.../platform/x86/intel_sgx/le/include/sgx_asm.h | 64 ++
.../platform/x86/intel_sgx/le/include/sgx_encl.h | 105 ++
drivers/platform/x86/intel_sgx/le/main.c | 219 +++++
drivers/platform/x86/intel_sgx/le/sgx_le_piggy.S | 15 +
drivers/platform/x86/intel_sgx/sgx.h | 264 +++++
drivers/platform/x86/intel_sgx/sgx_encl.c | 1009 ++++++++++++++++++++
drivers/platform/x86/intel_sgx/sgx_ioctl.c | 282 ++++++
drivers/platform/x86/intel_sgx/sgx_le.c | 290 ++++++
.../platform/x86/intel_sgx/sgx_le_proxy_piggy.S | 15 +
drivers/platform/x86/intel_sgx/sgx_main.c | 475 +++++++++
drivers/platform/x86/intel_sgx/sgx_page_cache.c | 586 ++++++++++++
drivers/platform/x86/intel_sgx/sgx_util.c | 396 ++++++++
drivers/platform/x86/intel_sgx/sgx_vma.c | 230 +++++
fs/file.c | 1 +
fs/pipe.c | 1 +
41 files changed, 6940 insertions(+)
create mode 100644 Documentation/x86/intel_sgx.rst
create mode 100644 arch/x86/include/asm/sgx.h
create mode 100644 arch/x86/include/asm/sgx_arch.h
create mode 100644 arch/x86/include/uapi/asm/sgx.h
create mode 100644 drivers/platform/x86/intel_sgx/Kconfig
create mode 100644 drivers/platform/x86/intel_sgx/Makefile
create mode 100644 drivers/platform/x86/intel_sgx/le/Makefile
create mode 100644 drivers/platform/x86/intel_sgx/le/enclave/Makefile
create mode 100644 drivers/platform/x86/intel_sgx/le/enclave/aes_encrypt.c
create mode 100644 drivers/platform/x86/intel_sgx/le/enclave/cmac_mode.c
create mode 100644 drivers/platform/x86/intel_sgx/le/enclave/encl_bootstrap.S
create mode 100644 drivers/platform/x86/intel_sgx/le/enclave/include/tinycrypt/aes.h
create mode 100644 drivers/platform/x86/intel_sgx/le/enclave/include/tinycrypt/cmac_mode.h
create mode 100644 drivers/platform/x86/intel_sgx/le/enclave/include/tinycrypt/constants.h
create mode 100644 drivers/platform/x86/intel_sgx/le/enclave/include/tinycrypt/utils.h
create mode 100644 drivers/platform/x86/intel_sgx/le/enclave/main.c
create mode 100644 drivers/platform/x86/intel_sgx/le/enclave/sgx_le.lds
create mode 100644 drivers/platform/x86/intel_sgx/le/enclave/sgxsign.c
create mode 100644 drivers/platform/x86/intel_sgx/le/enclave/utils.c
create mode 100644 drivers/platform/x86/intel_sgx/le/entry.S
create mode 100644 drivers/platform/x86/intel_sgx/le/include/sgx_asm.h
create mode 100644 drivers/platform/x86/intel_sgx/le/include/sgx_encl.h
create mode 100644 drivers/platform/x86/intel_sgx/le/main.c
create mode 100644 drivers/platform/x86/intel_sgx/le/sgx_le_piggy.S
create mode 100644 drivers/platform/x86/intel_sgx/sgx.h
create mode 100644 drivers/platform/x86/intel_sgx/sgx_encl.c
create mode 100644 drivers/platform/x86/intel_sgx/sgx_ioctl.c
create mode 100644 drivers/platform/x86/intel_sgx/sgx_le.c
create mode 100644 drivers/platform/x86/intel_sgx/sgx_le_proxy_piggy.S
create mode 100644 drivers/platform/x86/intel_sgx/sgx_main.c
create mode 100644 drivers/platform/x86/intel_sgx/sgx_page_cache.c
create mode 100644 drivers/platform/x86/intel_sgx/sgx_util.c
create mode 100644 drivers/platform/x86/intel_sgx/sgx_vma.c
--
2.14.1
4 years, 10 months
Re: [intel-sgx-kernel-dev] [PATCH v5 10/11] intel_sgx: glue code for in-kernel LE
by Jarkko Sakkinen
On Fri, Nov 17, 2017 at 03:07:05PM -0800, Darren Hart wrote:
> On Mon, Nov 13, 2017 at 09:45:27PM +0200, Jarkko Sakkinen wrote:
> > Glue code for hosting in-kernel Launch Enclave (LE) by using the user
> > space helper framework.
> >
> > Tokens for launching enclaves are generated with by the following
> > protocol:
> >
> > 1. The driver sends a SIGSTRUCT blob to the LE hosting process
> > to the input pipe.
> > 2. The LE hosting process reads the SIGSTRUCT blob from the input
> > pipe.
> > 3. After generating a EINITTOKEN blob, the LE hosting process writes
> > it to the output pipe.
> > 4. The driver reads the EINITTOKEN blob from the output pipe.
> >
> > If IA32_SGXLEPUBKEYHASH* MSRs are writable and they don't have the
> > public key hash of the LE they will be updated.
> >
>
> A few nits throughout to keep in mind:
>
> * #includes in alphabetical order in general
> * function local variables declared in order of decreasing line length
> * don't insert newlines where coding_style doesn't compel you to
>
> > Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com>
> > -
> ...--
> > diff --git a/drivers/platform/x86/intel_sgx/sgx_le.c b/drivers/platform/x86/intel_sgx/sgx_le.c
> > new file mode 100644
> > index 000000000000..d49c58f09db6
> > --- /dev/null
> > +++ b/drivers/platform/x86/intel_sgx/sgx_le.c
> > @@ -0,0 +1,313 @@
> ...
> > +#include <linux/file.h>
> > +#include <linux/fs.h>
> > +#include <linux/kmod.h>
> > +#include <linux/mutex.h>
> > +#include <linux/wait.h>
> > +#include <linux/pipe_fs_i.h>
> > +#include <linux/sched/signal.h>
> > +#include <linux/shmem_fs.h>
> > +#include <linux/anon_inodes.h>
>
> alphabetical order
> ...
> > +static int sgx_le_create_pipe(struct sgx_le_ctx *ctx,
> > + unsigned int fd)
> > +{
> > + struct file *files[2];
> > + int ret;
> > +
> > + ret = create_pipe_files(files, 0);
> > + if (ret)
> > + goto out;
>
> Fairly inconsistent in the use of the goto out: model and returning
> inline where there is no cleanup to be done. Whatever you do, please be
> consistent within the file.
>
> If there is no cleanup to do, a local return is fine.
It is cruft that I haven't remembered to clean up eg there used to be
clean up. Thanks for spotting that.
/Jarkko
4 years, 10 months
Re: [intel-sgx-kernel-dev] [PATCH v5 01/11] intel_sgx: updated MAINTAINERS
by Jarkko Sakkinen
On Fri, Nov 17, 2017 at 01:54:22PM -0800, Darren Hart wrote:
> On Mon, Nov 13, 2017 at 09:45:18PM +0200, Jarkko Sakkinen wrote:
> > Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com>
> > ---
> > MAINTAINERS | 5 +++++
> > 1 file changed, 5 insertions(+)
> >
> > diff --git a/MAINTAINERS b/MAINTAINERS
> > index 2d3d750b19c0..30a4b7f97a93 100644
> > --- a/MAINTAINERS
> > +++ b/MAINTAINERS
> > @@ -14932,6 +14932,11 @@ L: linux-mm(a)kvack.org
> > S: Maintained
> > F: mm/zswap.c
> >
> > +INTEL SGX
> > +M: Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com>
>
> It is clear from the review thus far that this is going to need
> additional entries here. Likely from the x86 folks at the very least. If
> not maintainers then at least reviewers (R:).
Point taken. I think I can cope with maintaining SGX tree once it is in
the mainline but additional R-entries would make sense. Who do you
suggest? I'm thinking of Dave Hansen at least.
/Jarkko
4 years, 10 months
Re: [intel-sgx-kernel-dev] [PATCH v5 11/11] intel_sgx: driver documentation
by Jarkko Sakkinen
On Fri, Nov 17, 2017 at 01:43:10PM -0800, Darren Hart wrote:
> This series will need to be updated per the comments received so far, as
> well as with commit messages and a complete Cc list *per patch* giving
> all required parties an opportunity to review.
>
> With respect to the obvious security nature of this series, who from the
> kernel security folks are going to be reviewing this?
> security(a)kernel.org?
I think it would make sense to CC this to linux-security module.
> Cc updated for this thread, and specifically the question regarding
> location below:
>
> > Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com>
> > ---
> > Documentation/index.rst | 1 +
> > Documentation/x86/intel_sgx.rst | 131 ++++++++++++++++++++++++++++++++++++++++
> > 2 files changed, 132 insertions(+)
> > create mode 100644 Documentation/x86/intel_sgx.rst
> >
>
> ...
>
> > diff --git a/Documentation/x86/intel_sgx.rst b/Documentation/x86/intel_sgx.rst
> > new file mode 100644
> > index 000000000000..34bcf6a2a495
> > --- /dev/null
> > +++ b/Documentation/x86/intel_sgx.rst
> > @@ -0,0 +1,131 @@
> > +===================
> > +Intel(R) SGX driver
> > +===================
> > +
> > +Introduction
> > +============
> > +
> > +Intel(R) SGX is a set of CPU instructions that can be used by applications to
> > +set aside private regions of code and data. The code outside the enclave is
> > +disallowed to access the memory inside the enclave by the CPU access control.
> > +In a way you can think that SGX provides inverted sandbox. It protects the
> > +application from a malicious host.
> > +
> > +There is a new hardware unit in the processor called Memory Encryption Engine
> > +(MEE) starting from the Skylake microarchitecture. BIOS can define one or many
> > +MEE regions that can hold enclave data by configuring them with PRMRR registers.
> > +
> > +The MEE automatically encrypts the data leaving the processor package to the MEE
> > +regions. The data is encrypted using a random key whose life-time is exactly one
> > +power cycle.
> > +
> > +You can tell if your CPU supports SGX by looking into ``/proc/cpuinfo``:
> > +
> > + ``cat /proc/cpuinfo | grep sgx``
>
> Is SGX considered architectural or not? A quick search of the SDM
> includes it in Volume 3:
>
> Volume 3: Includes the full system programming guide, parts 1, 2, 3, and
> 4. Describes the operating-system support environment of Intel® 64 and
> IA-32 architectures, including: memory management, protection, task
> management, interrupt and exception handling, multi-processor support,
> thermal and power management features, debugging, performance
> monitoring, system management mode, virtual machine extensions (VMX)
> instructions, Intel® Virtualization Technology (Intel® VT), and Intel®
> Software Guard Extensions (Intel® SGX).
>
> https://software.intel.com/en-us/articles/intel-sdm
>
> Depending on the answer, this impacts whether this belongs in
> drivers/platform/x86 or arch/x86/platform per our recent agreement with
> Thomas.
>
> Thomas, Mingo, HPA, do you wish to see this organized/located
> differently than it is here in v5?
The code is made easily relocatable. I just wanted to keep it as an
encapsulated driver up until I hear the maintainer feedback. I'll submit
v6 with code otherwise fixed according to the feedback that I've heard
up until that point and relocate it in v7 based on your feedback.
> > +Launch control
> > +==============
> > +
> > +For launching an enclave, two structures must be provided for ENCLS(EINIT):
> > +
> > +1. **SIGSTRUCT:** a signed measurement of the enclave binary.
> > +2. **EINITTOKEN:** the measurement, the public key of the signer and various
> > + enclave attributes. This structure contains a MAC of its contents using
> > + hardware derived symmetric key called *launch key*.
> > +
> > +The hardware platform contains a root key pair for signing the SIGTRUCT
> > +for a *launch enclave* that is able to acquire the *launch key* for
> > +creating EINITTOKEN's for other enclaves. For the launch enclave
> > +EINITTOKEN is not needed because it is signed with the private root key.
> > +
> > +There are two feature control bits associate with launch control
>
> Nit: missing colon at the end of the line above ^
Yes. Thanks for spotting that out :-)
/Jarkko
4 years, 10 months
Re: [intel-sgx-kernel-dev] [PATCH v5 11/11] intel_sgx: driver documentation
by Jarkko Sakkinen
On Mon, Nov 20, 2017 at 11:42:56PM +0100, Borislav Petkov wrote:
> On Tue, Nov 21, 2017 at 12:37:41AM +0200, Jarkko Sakkinen wrote:
> > Firmware cannot access the memory inside an enclave. CPU asserts every
> > memory access coming outside the enclave.
>
> But "firmware could potentially configure the root key hash for the
> enclave." How about the owner configures the root key hash instead?
> Along with deciding whether to lock down the feature control register or
In potential deployments of SGX, the owner could do this either in the
firmware level or OS level depending whether the MSRs are configured as
writable in the feature control.
One option would be to have a config flag to decide whether to require
MSRs to be writable or not.
/Jarkko
4 years, 10 months
Re: [intel-sgx-kernel-dev] [PATCH v5 11/11] intel_sgx: driver documentation
by Jarkko Sakkinen
On Tue, Nov 14, 2017 at 10:53:27PM +0100, Borislav Petkov wrote:
> On Tue, Nov 14, 2017 at 10:49:48PM +0200, Jarkko Sakkinen wrote:
> > Pre-boot firmware could potentially configure the root key hash for the
> > enclave that signs launch tokens for other enclaves i.e. the launch
> > enclave that is built and signed during the kbuild.
>
> So how about firmware doesn't do anything and the machine owner decide
> what enclaves get launched and what key hashes to load for a change?
> I.e., let the owner really own the hardware she paid money for.
>
> Or are we doing encrypted enclaves but then the firmware vendor can look
> inside too?
>
> --
> Regards/Gruss,
> Boris.
Firmware cannot access the memory inside an enclave. CPU asserts every
memory access coming outside the enclave.
/Jarkko
4 years, 10 months
Re: [intel-sgx-kernel-dev] [PATCH v5 00/11] Intel SGX Driver
by Jarkko Sakkinen
On Wed, Nov 15, 2017 at 11:35:42AM +0100, Thomas Gleixner wrote:
> On Mon, 13 Nov 2017, Jarkko Sakkinen wrote:
>
> Any reason why you did not CC the x86 maintainers and other x86 developers
> who have had opinions on the first attempt to get SGX into the kernel?
>
> This is not some driver for a random peripheral. This has substantional
> effects. I'm assuming you simply forgot or were not aware, but this is not
> the way this works.
>
> Thanks,
>
> tglx
I'll CC v6 to x86 maintainers. I'm sorry about this.
/Jarkko
4 years, 10 months
