From patchwork Fri Jun 8 17:09:42 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jarkko Sakkinen X-Patchwork-Id: 10454871 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 962FD60159 for ; Fri, 8 Jun 2018 17:28:55 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8C7FE2929F for ; Fri, 8 Jun 2018 17:28:55 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 7F57A292A6; Fri, 8 Jun 2018 17:28:55 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.9 required=2.0 tests=BAYES_00, MAILING_LIST_MULTI, RCVD_IN_DNSWL_NONE autolearn=unavailable version=3.3.1 Received: from ml01.01.org (ml01.01.org [198.145.21.10]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id DD2D329255 for ; Fri, 8 Jun 2018 17:28:54 +0000 (UTC) Received: from [127.0.0.1] (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id 8633C2114AD1E; Fri, 8 Jun 2018 10:22:31 -0700 (PDT) X-Original-To: intel-sgx-kernel-dev@lists.01.org Delivered-To: intel-sgx-kernel-dev@lists.01.org Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=192.55.52.43; helo=mga05.intel.com; envelope-from=jarkko.sakkinen@intel.com; receiver=intel-sgx-kernel-dev@lists.01.org Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 1383F210F2018 for ; Fri, 8 Jun 2018 10:20:51 -0700 (PDT) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga005.jf.intel.com ([10.7.209.41]) by fmsmga105.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 08 Jun 2018 10:20:50 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.49,490,1520924400"; d="scan'208";a="231035296" Received: from nzou1-mobl1.ccr.corp.intel.com (HELO localhost) ([10.249.254.60]) by orsmga005.jf.intel.com with ESMTP; 08 Jun 2018 10:20:42 -0700 From: Jarkko Sakkinen To: x86@kernel.org, platform-driver-x86@vger.kernel.org Date: Fri, 8 Jun 2018 19:09:42 +0200 Message-Id: <20180608171216.26521-8-jarkko.sakkinen@linux.intel.com> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20180608171216.26521-1-jarkko.sakkinen@linux.intel.com> References: <20180608171216.26521-1-jarkko.sakkinen@linux.intel.com> X-Mailman-Approved-At: Fri, 08 Jun 2018 10:22:30 -0700 Subject: [intel-sgx-kernel-dev] [PATCH v11 07/13] x86, sgx: detect Intel SGX X-BeenThere: intel-sgx-kernel-dev@lists.01.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: =?iso-8859-1?q?Project=3A_Intel=AE_Software_Guard_Extensions_for_Linux*=3A_https=3A//01=2Eorg/intel-software-guard-extensions?= List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: nhorman@redhat.com, Andi Kleen , Greg Kroah-Hartman , "Rafael J. Wysocki" , npmccallum@redhat.com, "open list:X86 ARCHITECTURE 32-BIT AND 64-BIT" , Ingo Molnar , "open list:INTEL SGX" , "H. Peter Anvin" , Vikas Shivappa , Thomas Gleixner , "Kirill A. Shutemov" MIME-Version: 1.0 Errors-To: intel-sgx-kernel-dev-bounces@lists.01.org Sender: "intel-sgx-kernel-dev" X-Virus-Scanned: ClamAV using ClamSMTP From: Sean Christopherson Intel(R) SGX is a set of CPU instructions that can be used by applications to set aside private regions of code and data. The code outside the enclave is disallowed to access the memory inside the enclave by the CPU access control. This commit adds the check for SGX to arch/x86 and a new config option, INTEL_SGX_CORE. Exposes a boolean variable 'sgx_enabled' to query whether or not the SGX support is available. Signed-off-by: Sean Christopherson Reviewed-by: Jarkko Sakkinen Tested-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen --- arch/x86/Kconfig | 19 ++++++++++++ arch/x86/include/asm/sgx.h | 25 ++++++++++++++++ arch/x86/include/asm/sgx_pr.h | 20 +++++++++++++ arch/x86/kernel/cpu/Makefile | 1 + arch/x86/kernel/cpu/intel_sgx.c | 53 +++++++++++++++++++++++++++++++++ 5 files changed, 118 insertions(+) create mode 100644 arch/x86/include/asm/sgx.h create mode 100644 arch/x86/include/asm/sgx_pr.h create mode 100644 arch/x86/kernel/cpu/intel_sgx.c diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index c07f492b871a..42015d5366ef 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -1925,6 +1925,25 @@ config X86_INTEL_MEMORY_PROTECTION_KEYS If unsure, say y. +config INTEL_SGX_CORE + prompt "Intel SGX core functionality" + def_bool n + depends on X86_64 && CPU_SUP_INTEL + help + Intel Software Guard eXtensions (SGX) is a set of CPU instructions + that allows ring 3 applications to create enclaves; private regions + of memory that are protected, by hardware, from unauthorized access + and/or modification. + + This option enables kernel recognition of SGX, high-level management + of the Enclave Page Cache (EPC), tracking and writing of SGX Launch + Enclave Hash MSRs, and allows for virtualization of SGX via KVM. By + iteslf, this option does not provide SGX support to userspace. + + For details, see Documentation/x86/intel_sgx.rst + + If unsure, say N. + config EFI bool "EFI runtime service support" depends on ACPI diff --git a/arch/x86/include/asm/sgx.h b/arch/x86/include/asm/sgx.h new file mode 100644 index 000000000000..fa3e6e0eb8af --- /dev/null +++ b/arch/x86/include/asm/sgx.h @@ -0,0 +1,25 @@ +// SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause) +// Copyright(c) 2016-18 Intel Corporation. +// +// Authors: +// +// Jarkko Sakkinen +// Suresh Siddha +// Sean Christopherson + +#ifndef _ASM_X86_SGX_H +#define _ASM_X86_SGX_H + +#include + +#define SGX_CPUID 0x12 + +enum sgx_cpuid { + SGX_CPUID_CAPABILITIES = 0, + SGX_CPUID_ATTRIBUTES = 1, + SGX_CPUID_EPC_BANKS = 2, +}; + +extern bool sgx_enabled; + +#endif /* _ASM_X86_SGX_H */ diff --git a/arch/x86/include/asm/sgx_pr.h b/arch/x86/include/asm/sgx_pr.h new file mode 100644 index 000000000000..876dc44c2ccc --- /dev/null +++ b/arch/x86/include/asm/sgx_pr.h @@ -0,0 +1,20 @@ +// SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause) +// Copyright(c) 2016-17 Intel Corporation. +// +// Authors: +// +// Jarkko Sakkinen +// Suresh Siddha +// Serge Ayoun +// Shay Katz-zamir + +#ifndef _ASM_X86_SGX_PR_H +#define _ASM_X86_SGX_PR_H + +#include +#include + +#undef pr_fmt +#define pr_fmt(fmt) "intel_sgx: " fmt + +#endif /* _ASM_X86_SGX_PR_H */ diff --git a/arch/x86/kernel/cpu/Makefile b/arch/x86/kernel/cpu/Makefile index a66229f51b12..9552ff5b4ec3 100644 --- a/arch/x86/kernel/cpu/Makefile +++ b/arch/x86/kernel/cpu/Makefile @@ -36,6 +36,7 @@ obj-$(CONFIG_CPU_SUP_TRANSMETA_32) += transmeta.o obj-$(CONFIG_CPU_SUP_UMC_32) += umc.o obj-$(CONFIG_INTEL_RDT) += intel_rdt.o intel_rdt_rdtgroup.o intel_rdt_monitor.o intel_rdt_ctrlmondata.o +obj-$(CONFIG_INTEL_SGX_CORE) += intel_sgx.o obj-$(CONFIG_X86_MCE) += mcheck/ obj-$(CONFIG_MTRR) += mtrr/ diff --git a/arch/x86/kernel/cpu/intel_sgx.c b/arch/x86/kernel/cpu/intel_sgx.c new file mode 100644 index 000000000000..db6b315334f4 --- /dev/null +++ b/arch/x86/kernel/cpu/intel_sgx.c @@ -0,0 +1,53 @@ +// SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause) +// Copyright(c) 2016-17 Intel Corporation. +// +// Authors: +// +// Jarkko Sakkinen +// Suresh Siddha +// Serge Ayoun +// Shay Katz-zamir +// Sean Christopherson + +#include +#include +#include +#include +#include +#include +#include +#include + +bool sgx_enabled __ro_after_init = false; +EXPORT_SYMBOL(sgx_enabled); + +static __init bool sgx_is_enabled(void) +{ + unsigned long fc; + + if (boot_cpu_data.x86_vendor != X86_VENDOR_INTEL) + return false; + + if (!boot_cpu_has(X86_FEATURE_SGX)) + return false; + + if (!boot_cpu_has(X86_FEATURE_SGX1)) + return false; + + rdmsrl(MSR_IA32_FEATURE_CONTROL, fc); + if (!(fc & FEATURE_CONTROL_LOCKED)) + return false; + + if (!(fc & FEATURE_CONTROL_SGX_ENABLE)) + return false; + + return true; +} + +static __init int sgx_init(void) +{ + sgx_enabled = sgx_is_enabled(); + return 0; +} + +arch_initcall(sgx_init);