From patchwork Thu Jul 8 18:14:20 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Luck, Tony" X-Patchwork-Id: 12366045 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-17.0 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A3531C07E9C for ; Thu, 8 Jul 2021 18:14:40 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 8F2CC6193D for ; Thu, 8 Jul 2021 18:14:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229469AbhGHSRV (ORCPT ); Thu, 8 Jul 2021 14:17:21 -0400 Received: from mga01.intel.com ([192.55.52.88]:2094 "EHLO mga01.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230139AbhGHSRT (ORCPT ); Thu, 8 Jul 2021 14:17:19 -0400 X-IronPort-AV: E=McAfee;i="6200,9189,10039"; a="231327152" X-IronPort-AV: E=Sophos;i="5.84,224,1620716400"; d="scan'208";a="231327152" Received: from fmsmga004.fm.intel.com ([10.253.24.48]) by fmsmga101.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 08 Jul 2021 11:14:35 -0700 X-IronPort-AV: E=Sophos;i="5.84,224,1620716400"; d="scan'208";a="482637390" Received: from agluck-desk2.sc.intel.com ([10.3.52.146]) by fmsmga004-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 08 Jul 2021 11:14:34 -0700 From: Tony Luck To: tony.luck@intel.com Cc: Jarkko Sakkinen , Dave Hansen , x86@kernel.org, linux-sgx@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 1/4] x86/sgx: Track phase and type of SGX EPC pages Date: Thu, 8 Jul 2021 11:14:20 -0700 Message-Id: <20210708181423.1312359-2-tony.luck@intel.com> X-Mailer: git-send-email 2.29.2 In-Reply-To: <20210708181423.1312359-1-tony.luck@intel.com> References: <20210708181423.1312359-1-tony.luck@intel.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-sgx@vger.kernel.org Memory errors can be reported either synchronously as memory is accessed, or asynchronously by speculative access or by a memory controller page scrubber. The life cycle of an EPC page takes it through: dirty -> free -> in-use -> free. Memory errors are reported using physical addresses. It is a simple matter to find which sgx_epc_page structure maps a given address. But then recovery code needs to be able to determine the current use of the page to take the appropriate recovery action. Within the "in-use" phase different actions are needed based on how the page is used in the enclave. Add new flags bits to describe the phase (with an extra bit for the new phase of "poisoned"). Drop pages marked as poisoned instead of adding them to a free list to make sure they are not re-used. Add a type field to struct epc_page for how an in-use page has been allocated. Re-use "enum sgx_page_type" for this type, with a couple of additions for s/w types. Signed-off-by: Tony Luck --- arch/x86/include/asm/sgx.h | 6 ++++++ arch/x86/kernel/cpu/sgx/encl.c | 4 ++-- arch/x86/kernel/cpu/sgx/ioctl.c | 4 ++-- arch/x86/kernel/cpu/sgx/main.c | 21 +++++++++++++++++++-- arch/x86/kernel/cpu/sgx/sgx.h | 14 ++++++++++++-- arch/x86/kernel/cpu/sgx/virt.c | 2 +- 6 files changed, 42 insertions(+), 9 deletions(-) diff --git a/arch/x86/include/asm/sgx.h b/arch/x86/include/asm/sgx.h index 9c31e0ebc55b..9619a6d77a83 100644 --- a/arch/x86/include/asm/sgx.h +++ b/arch/x86/include/asm/sgx.h @@ -216,6 +216,8 @@ struct sgx_pageinfo { * %SGX_PAGE_TYPE_REG: a regular page * %SGX_PAGE_TYPE_VA: a VA page * %SGX_PAGE_TYPE_TRIM: a page in trimmed state + * + * Also used to track current use of &struct sgx_epc_page */ enum sgx_page_type { SGX_PAGE_TYPE_SECS, @@ -223,6 +225,10 @@ enum sgx_page_type { SGX_PAGE_TYPE_REG, SGX_PAGE_TYPE_VA, SGX_PAGE_TYPE_TRIM, + + /* sgx_epc_page.type */ + SGX_PAGE_TYPE_FREE = 100, + SGX_PAGE_TYPE_KVM = 101, }; #define SGX_NR_PAGE_TYPES 5 diff --git a/arch/x86/kernel/cpu/sgx/encl.c b/arch/x86/kernel/cpu/sgx/encl.c index 3be203297988..abf6e1a704c0 100644 --- a/arch/x86/kernel/cpu/sgx/encl.c +++ b/arch/x86/kernel/cpu/sgx/encl.c @@ -72,7 +72,7 @@ static struct sgx_epc_page *sgx_encl_eldu(struct sgx_encl_page *encl_page, struct sgx_epc_page *epc_page; int ret; - epc_page = sgx_alloc_epc_page(encl_page, false); + epc_page = sgx_alloc_epc_page(encl_page, SGX_PAGE_TYPE_REG, false); if (IS_ERR(epc_page)) return epc_page; @@ -679,7 +679,7 @@ struct sgx_epc_page *sgx_alloc_va_page(void) struct sgx_epc_page *epc_page; int ret; - epc_page = sgx_alloc_epc_page(NULL, true); + epc_page = sgx_alloc_epc_page(NULL, SGX_PAGE_TYPE_VA, true); if (IS_ERR(epc_page)) return ERR_CAST(epc_page); diff --git a/arch/x86/kernel/cpu/sgx/ioctl.c b/arch/x86/kernel/cpu/sgx/ioctl.c index 83df20e3e633..a74ae00194cc 100644 --- a/arch/x86/kernel/cpu/sgx/ioctl.c +++ b/arch/x86/kernel/cpu/sgx/ioctl.c @@ -83,7 +83,7 @@ static int sgx_encl_create(struct sgx_encl *encl, struct sgx_secs *secs) encl->backing = backing; - secs_epc = sgx_alloc_epc_page(&encl->secs, true); + secs_epc = sgx_alloc_epc_page(&encl->secs, SGX_PAGE_TYPE_SECS, true); if (IS_ERR(secs_epc)) { ret = PTR_ERR(secs_epc); goto err_out_backing; @@ -300,7 +300,7 @@ static int sgx_encl_add_page(struct sgx_encl *encl, unsigned long src, if (IS_ERR(encl_page)) return PTR_ERR(encl_page); - epc_page = sgx_alloc_epc_page(encl_page, true); + epc_page = sgx_alloc_epc_page(encl_page, SGX_PAGE_TYPE_REG, true); if (IS_ERR(epc_page)) { kfree(encl_page); return PTR_ERR(epc_page); diff --git a/arch/x86/kernel/cpu/sgx/main.c b/arch/x86/kernel/cpu/sgx/main.c index 63d3de02bbcc..643df87b3e01 100644 --- a/arch/x86/kernel/cpu/sgx/main.c +++ b/arch/x86/kernel/cpu/sgx/main.c @@ -401,7 +401,12 @@ static void sgx_reclaim_pages(void) section = &sgx_epc_sections[epc_page->section]; node = section->node; + /* drop poison pages instead of adding to free list */ + if (epc_page->flags & SGX_EPC_PAGE_POISON) + continue; + spin_lock(&node->lock); + epc_page->flags = SGX_EPC_PAGE_FREE; list_add_tail(&epc_page->list, &node->free_page_list); sgx_nr_free_pages++; spin_unlock(&node->lock); @@ -560,6 +565,7 @@ int sgx_unmark_page_reclaimable(struct sgx_epc_page *page) /** * sgx_alloc_epc_page() - Allocate an EPC page * @owner: the owner of the EPC page + * @type: type of page being allocated * @reclaim: reclaim pages if necessary * * Iterate through EPC sections and borrow a free EPC page to the caller. When a @@ -574,7 +580,7 @@ int sgx_unmark_page_reclaimable(struct sgx_epc_page *page) * an EPC page, * -errno on error */ -struct sgx_epc_page *sgx_alloc_epc_page(void *owner, bool reclaim) +struct sgx_epc_page *sgx_alloc_epc_page(void *owner, enum sgx_page_type type, bool reclaim) { struct sgx_epc_page *page; @@ -582,6 +588,8 @@ struct sgx_epc_page *sgx_alloc_epc_page(void *owner, bool reclaim) page = __sgx_alloc_epc_page(); if (!IS_ERR(page)) { page->owner = owner; + page->type = type; + page->flags = 0; break; } @@ -616,14 +624,22 @@ struct sgx_epc_page *sgx_alloc_epc_page(void *owner, bool reclaim) * responsibility to make sure that the page is in uninitialized state. In other * words, do EREMOVE, EWB or whatever operation is necessary before calling * this function. + * + * Note that if the page has been tagged as poisoned, it is simply + * dropped on the floor instead of added to the free list to make + * sure we do not re-use it. */ void sgx_free_epc_page(struct sgx_epc_page *page) { struct sgx_epc_section *section = &sgx_epc_sections[page->section]; struct sgx_numa_node *node = section->node; + if (page->flags & SGX_EPC_PAGE_POISON) + return; + spin_lock(&node->lock); + page->flags = SGX_EPC_PAGE_FREE; list_add_tail(&page->list, &node->free_page_list); sgx_nr_free_pages++; @@ -651,7 +667,8 @@ static bool __init sgx_setup_epc_section(u64 phys_addr, u64 size, for (i = 0; i < nr_pages; i++) { section->pages[i].section = index; - section->pages[i].flags = 0; + section->pages[i].flags = SGX_EPC_PAGE_DIRTY; + section->pages[i].type = SGX_PAGE_TYPE_FREE; section->pages[i].owner = NULL; list_add_tail(§ion->pages[i].list, &sgx_dirty_page_list); } diff --git a/arch/x86/kernel/cpu/sgx/sgx.h b/arch/x86/kernel/cpu/sgx/sgx.h index 4628acec0009..e43d3c27eb96 100644 --- a/arch/x86/kernel/cpu/sgx/sgx.h +++ b/arch/x86/kernel/cpu/sgx/sgx.h @@ -26,9 +26,19 @@ /* Pages, which are being tracked by the page reclaimer. */ #define SGX_EPC_PAGE_RECLAIMER_TRACKED BIT(0) +/* Pages, on the "sgx_dirty_page_list" */ +#define SGX_EPC_PAGE_DIRTY BIT(1) + +/* Pages, on one of the node free lists */ +#define SGX_EPC_PAGE_FREE BIT(2) + +/* Pages, with h/w poison errors */ +#define SGX_EPC_PAGE_POISON BIT(3) + struct sgx_epc_page { unsigned int section; - unsigned int flags; + u16 flags; + u16 type; struct sgx_encl_page *owner; struct list_head list; }; @@ -82,7 +92,7 @@ void sgx_free_epc_page(struct sgx_epc_page *page); void sgx_mark_page_reclaimable(struct sgx_epc_page *page); int sgx_unmark_page_reclaimable(struct sgx_epc_page *page); -struct sgx_epc_page *sgx_alloc_epc_page(void *owner, bool reclaim); +struct sgx_epc_page *sgx_alloc_epc_page(void *owner, enum sgx_page_type type, bool reclaim); #ifdef CONFIG_X86_SGX_KVM int __init sgx_vepc_init(void); diff --git a/arch/x86/kernel/cpu/sgx/virt.c b/arch/x86/kernel/cpu/sgx/virt.c index 64511c4a5200..044dd92ebd63 100644 --- a/arch/x86/kernel/cpu/sgx/virt.c +++ b/arch/x86/kernel/cpu/sgx/virt.c @@ -46,7 +46,7 @@ static int __sgx_vepc_fault(struct sgx_vepc *vepc, if (epc_page) return 0; - epc_page = sgx_alloc_epc_page(vepc, false); + epc_page = sgx_alloc_epc_page(vepc, SGX_PAGE_TYPE_KVM, false); if (IS_ERR(epc_page)) return PTR_ERR(epc_page); From patchwork Thu Jul 8 18:14:21 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Luck, Tony" X-Patchwork-Id: 12366039 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-17.0 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 51103C07E96 for ; Thu, 8 Jul 2021 18:14:37 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 297EA61629 for ; Thu, 8 Jul 2021 18:14:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229619AbhGHSRS (ORCPT ); Thu, 8 Jul 2021 14:17:18 -0400 Received: from mga01.intel.com ([192.55.52.88]:2094 "EHLO mga01.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229469AbhGHSRR (ORCPT ); Thu, 8 Jul 2021 14:17:17 -0400 X-IronPort-AV: E=McAfee;i="6200,9189,10039"; a="231327147" X-IronPort-AV: E=Sophos;i="5.84,224,1620716400"; d="scan'208";a="231327147" Received: from fmsmga004.fm.intel.com ([10.253.24.48]) by fmsmga101.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 08 Jul 2021 11:14:35 -0700 X-IronPort-AV: E=Sophos;i="5.84,224,1620716400"; d="scan'208";a="482637380" Received: from agluck-desk2.sc.intel.com ([10.3.52.146]) by fmsmga004-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 08 Jul 2021 11:14:35 -0700 From: Tony Luck To: tony.luck@intel.com Cc: Jarkko Sakkinen , Dave Hansen , x86@kernel.org, linux-sgx@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 2/4] x86/sgx: Add basic infrastructure to recover from errors in SGX memory Date: Thu, 8 Jul 2021 11:14:21 -0700 Message-Id: <20210708181423.1312359-3-tony.luck@intel.com> X-Mailer: git-send-email 2.29.2 In-Reply-To: <20210708181423.1312359-1-tony.luck@intel.com> References: <20210708181423.1312359-1-tony.luck@intel.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-sgx@vger.kernel.org X86 machine check architecture reports a physical address when there is a memory error. Add an end_phys_addr field to the sgx_epc_section structure and a new function sgx_paddr_to_page() that searches all such structures to see if a physical address is part of an SGX EPC page. The ACPI EINJ module has a sanity check that the injection address is valid. Add and export a function sgx_is_epc_page() so that it can be changed to allow injection to SGX EPC pages. Provide a recovery function sgx_memory_failure(). If the poison was consumed synchronously inside the enclave send a SIGBUS just the same as for poison consumption outside of an enclave. For asynchronously reported errors the easiest cases are when the page is currently free. Just drop the page from the free list so that it will never be allocated. An SGX_PAGE_TYPE_REG page can just be unmapped from the enclave. If the enclave doesn't ever touch that page again all is well. If it does touch the page it will die. Possible future enhancement here to mark the unmapped PTE so that it will cause a SIGBUS. SGX_PAGE_TYPE_KVM pages may be recoverable depending on how they are being used by guests. To fix that properly requires injecting the machine check into the guest. For now just kill it. Signed-off-by: Tony Luck --- arch/x86/kernel/cpu/sgx/main.c | 126 +++++++++++++++++++++++++++++++++ arch/x86/kernel/cpu/sgx/sgx.h | 3 +- arch/x86/kernel/cpu/sgx/virt.c | 9 +++ 3 files changed, 137 insertions(+), 1 deletion(-) diff --git a/arch/x86/kernel/cpu/sgx/main.c b/arch/x86/kernel/cpu/sgx/main.c index 643df87b3e01..4a354f89373e 100644 --- a/arch/x86/kernel/cpu/sgx/main.c +++ b/arch/x86/kernel/cpu/sgx/main.c @@ -664,6 +664,7 @@ static bool __init sgx_setup_epc_section(u64 phys_addr, u64 size, } section->phys_addr = phys_addr; + section->end_phys_addr = phys_addr + size - 1; for (i = 0; i < nr_pages; i++) { section->pages[i].section = index; @@ -676,6 +677,131 @@ static bool __init sgx_setup_epc_section(u64 phys_addr, u64 size, return true; } +static struct sgx_epc_page *sgx_paddr_to_page(u64 paddr) +{ + struct sgx_epc_section *section; + int i; + + for (i = 0; i < ARRAY_SIZE(sgx_epc_sections); i++) { + section = &sgx_epc_sections[i]; + + if (paddr < section->phys_addr || paddr > section->end_phys_addr) + continue; + + return §ion->pages[PFN_DOWN(paddr - section->phys_addr)]; + } + + return NULL; +} + +bool sgx_is_epc_page(u64 paddr) +{ + return !!sgx_paddr_to_page(paddr); +} +EXPORT_SYMBOL_GPL(sgx_is_epc_page); + +void __attribute__((weak)) sgx_memory_failure_vepc(struct sgx_epc_page *epc_page) +{ +} + +/* + * This can be called in three ways: + * a) When an enclave has just consumed poison. In this case + * calling process context is the owner of the enclave. + * b) For some asychronous poison notification (e.g. patrol + * scrubber or speculative execution saw the poison.) + * In this case calling context is a kernel thread. + * c) Someone asked to take a page offline using the + * /sys/devices/system/memory/{hard,soft}_offline_page. + * In this case caller is the process writing these files. + */ +int sgx_memory_failure(unsigned long pfn, int flags) +{ + struct sgx_epc_page *epc_page = sgx_paddr_to_page(pfn << PAGE_SHIFT); + struct sgx_epc_section *section; + struct sgx_encl_page *encl_page; + struct sgx_numa_node *node; + unsigned long addr; + u16 page_flags; + + if (!epc_page) + return -ENXIO; + + spin_lock(&sgx_reclaimer_lock); + + page_flags = epc_page->flags; + epc_page->flags |= SGX_EPC_PAGE_POISON; + + /* + * Poison was synchronously consumed by an enclave in the current + * task. Send a SIGBUS here. Hardware should prevent this enclave + * from being re-entered, so no concern that the poisoned page + * will be touched a second time. The poisoned EPC page will be + * dropped as pages are freed during task exit. + */ + if (flags & MF_ACTION_REQUIRED) { + if (epc_page->type == SGX_PAGE_TYPE_REG) { + encl_page = epc_page->owner; + addr = encl_page->desc & PAGE_MASK; + force_sig_mceerr(BUS_MCEERR_AR, (void *)addr, PAGE_SHIFT); + } else { + force_sig(SIGBUS); + } + goto unlock; + } + + section = &sgx_epc_sections[epc_page->section]; + node = section->node; + + if (page_flags & SGX_EPC_PAGE_POISON) + goto unlock; + + if (page_flags & SGX_EPC_PAGE_DIRTY) { + list_del(&epc_page->list); + } else if (page_flags & SGX_EPC_PAGE_FREE) { + spin_lock(&node->lock); + epc_page->owner = NULL; + list_del(&epc_page->list); + sgx_nr_free_pages--; + spin_unlock(&node->lock); + goto unlock; + } + + switch (epc_page->type) { + case SGX_PAGE_TYPE_REG: + encl_page = epc_page->owner; + /* Unmap the page, unless it was already in progress to be freed */ + if (kref_get_unless_zero(&encl_page->encl->refcount) != 0) { + spin_unlock(&sgx_reclaimer_lock); + sgx_reclaimer_block(epc_page); + kref_put(&encl_page->encl->refcount, sgx_encl_release); + goto done; + } + break; + + case SGX_PAGE_TYPE_KVM: + spin_unlock(&sgx_reclaimer_lock); + sgx_memory_failure_vepc(epc_page); + break; + + default: + /* + * I don't expect SECS, TCS, VA pages would result + * in recoverable machine checks. If it turns out + * that they do, then add cases for recovery for + * each of them. + */ + panic("Poisoned active SGX page type %d\n", epc_page->type); + break; + } + goto done; + +unlock: + spin_unlock(&sgx_reclaimer_lock); +done: + return 0; +} + /** * A section metric is concatenated in a way that @low bits 12-31 define the * bits 12-31 of the metric and @high bits 0-19 define the bits 32-51 of the diff --git a/arch/x86/kernel/cpu/sgx/sgx.h b/arch/x86/kernel/cpu/sgx/sgx.h index e43d3c27eb96..7701f5f88b61 100644 --- a/arch/x86/kernel/cpu/sgx/sgx.h +++ b/arch/x86/kernel/cpu/sgx/sgx.h @@ -39,7 +39,7 @@ struct sgx_epc_page { unsigned int section; u16 flags; u16 type; - struct sgx_encl_page *owner; + void *owner; struct list_head list; }; @@ -60,6 +60,7 @@ struct sgx_numa_node { */ struct sgx_epc_section { unsigned long phys_addr; + unsigned long end_phys_addr; void *virt_addr; struct sgx_epc_page *pages; struct sgx_numa_node *node; diff --git a/arch/x86/kernel/cpu/sgx/virt.c b/arch/x86/kernel/cpu/sgx/virt.c index 044dd92ebd63..08918166394f 100644 --- a/arch/x86/kernel/cpu/sgx/virt.c +++ b/arch/x86/kernel/cpu/sgx/virt.c @@ -21,6 +21,7 @@ struct sgx_vepc { struct xarray page_array; struct mutex lock; + struct task_struct *task; }; /* @@ -218,6 +219,13 @@ static int sgx_vepc_release(struct inode *inode, struct file *file) return 0; } +void sgx_memory_failure_vepc(struct sgx_epc_page *epc_page) +{ + struct sgx_vepc *vepc = epc_page->owner; + + send_sig(SIGBUS, vepc->task, false); +} + static int sgx_vepc_open(struct inode *inode, struct file *file) { struct sgx_vepc *vepc; @@ -227,6 +235,7 @@ static int sgx_vepc_open(struct inode *inode, struct file *file) return -ENOMEM; mutex_init(&vepc->lock); xa_init(&vepc->page_array); + vepc->task = current; file->private_data = vepc; From patchwork Thu Jul 8 18:14:22 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Luck, Tony" X-Patchwork-Id: 12366037 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-17.0 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 97D93C07E9C for ; Thu, 8 Jul 2021 18:14:37 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 786BA61624 for ; Thu, 8 Jul 2021 18:14:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230082AbhGHSRS (ORCPT ); Thu, 8 Jul 2021 14:17:18 -0400 Received: from mga01.intel.com ([192.55.52.88]:2094 "EHLO mga01.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229580AbhGHSRS (ORCPT ); Thu, 8 Jul 2021 14:17:18 -0400 X-IronPort-AV: E=McAfee;i="6200,9189,10039"; a="231327148" X-IronPort-AV: E=Sophos;i="5.84,224,1620716400"; d="scan'208";a="231327148" Received: from fmsmga004.fm.intel.com ([10.253.24.48]) by fmsmga101.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 08 Jul 2021 11:14:35 -0700 X-IronPort-AV: E=Sophos;i="5.84,224,1620716400"; d="scan'208";a="482637383" Received: from agluck-desk2.sc.intel.com ([10.3.52.146]) by fmsmga004-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 08 Jul 2021 11:14:35 -0700 From: Tony Luck To: tony.luck@intel.com Cc: Jarkko Sakkinen , Dave Hansen , x86@kernel.org, linux-sgx@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 3/4] x86/sgx: Hook sgx_memory_failure() into mainline code Date: Thu, 8 Jul 2021 11:14:22 -0700 Message-Id: <20210708181423.1312359-4-tony.luck@intel.com> X-Mailer: git-send-email 2.29.2 In-Reply-To: <20210708181423.1312359-1-tony.luck@intel.com> References: <20210708181423.1312359-1-tony.luck@intel.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-sgx@vger.kernel.org Add a call inside memory_failure() to check if the address is an SGX EPC page and handle it. Note the SGX EPC pages do not have a "struct page" entry, so the hook goes in at the same point as the device mapping hook. Signed-off-by: Tony Luck --- include/linux/mm.h | 9 +++++++++ mm/memory-failure.c | 4 ++++ 2 files changed, 13 insertions(+) diff --git a/include/linux/mm.h b/include/linux/mm.h index 8ae31622deef..1b9d0912942a 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -3251,5 +3251,14 @@ static inline int seal_check_future_write(int seals, struct vm_area_struct *vma) return 0; } +#ifdef CONFIG_X86_SGX +int sgx_memory_failure(unsigned long pfn, int flags); +#else +static inline int sgx_memory_failure(unsigned long pfn, int flags) +{ + return -ENXIO; +} +#endif + #endif /* __KERNEL__ */ #endif /* _LINUX_MM_H */ diff --git a/mm/memory-failure.c b/mm/memory-failure.c index 6f5f78885ab4..02b1c58729c1 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -1453,6 +1453,10 @@ int memory_failure(unsigned long pfn, int flags) p = pfn_to_online_page(pfn); if (!p) { + res = sgx_memory_failure(pfn, flags); + if (res == 0) + return 0; + if (pfn_valid(pfn)) { pgmap = get_dev_pagemap(pfn, NULL); if (pgmap) From patchwork Thu Jul 8 18:14:23 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Luck, Tony" X-Patchwork-Id: 12366043 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-17.0 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3BFA6C11F67 for ; Thu, 8 Jul 2021 18:14:40 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 1DD9E6187E for ; Thu, 8 Jul 2021 18:14:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230155AbhGHSRU (ORCPT ); Thu, 8 Jul 2021 14:17:20 -0400 Received: from mga01.intel.com ([192.55.52.88]:2094 "EHLO mga01.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230115AbhGHSRS (ORCPT ); Thu, 8 Jul 2021 14:17:18 -0400 X-IronPort-AV: E=McAfee;i="6200,9189,10039"; a="231327151" X-IronPort-AV: E=Sophos;i="5.84,224,1620716400"; d="scan'208";a="231327151" Received: from fmsmga004.fm.intel.com ([10.253.24.48]) by fmsmga101.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 08 Jul 2021 11:14:35 -0700 X-IronPort-AV: E=Sophos;i="5.84,224,1620716400"; d="scan'208";a="482637388" Received: from agluck-desk2.sc.intel.com ([10.3.52.146]) by fmsmga004-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 08 Jul 2021 11:14:35 -0700 From: Tony Luck To: tony.luck@intel.com Cc: Jarkko Sakkinen , Dave Hansen , x86@kernel.org, linux-sgx@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 4/4] x86/sgx: Add hook to error injection address validation Date: Thu, 8 Jul 2021 11:14:23 -0700 Message-Id: <20210708181423.1312359-5-tony.luck@intel.com> X-Mailer: git-send-email 2.29.2 In-Reply-To: <20210708181423.1312359-1-tony.luck@intel.com> References: <20210708181423.1312359-1-tony.luck@intel.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-sgx@vger.kernel.org SGX reserved memory does not appear in the standard address maps. Add hook to call into the SGX code to check if an address is located in SGX memory. There are other challenges in injecting errors into SGX. Update the documentation with a sequence of operations to inject. Signed-off-by: Tony Luck --- .../firmware-guide/acpi/apei/einj.rst | 19 +++++++++++++++++++ drivers/acpi/apei/einj.c | 3 ++- include/linux/mm.h | 6 ++++++ 3 files changed, 27 insertions(+), 1 deletion(-) diff --git a/Documentation/firmware-guide/acpi/apei/einj.rst b/Documentation/firmware-guide/acpi/apei/einj.rst index c042176e1707..55e2331a6438 100644 --- a/Documentation/firmware-guide/acpi/apei/einj.rst +++ b/Documentation/firmware-guide/acpi/apei/einj.rst @@ -181,5 +181,24 @@ You should see something like this in dmesg:: [22715.834759] EDAC sbridge MC3: PROCESSOR 0:306e7 TIME 1422553404 SOCKET 0 APIC 0 [22716.616173] EDAC MC3: 1 CE memory read error on CPU_SrcID#0_Channel#0_DIMM#0 (channel:0 slot:0 page:0x12345 offset:0x0 grain:32 syndrome:0x0 - area:DRAM err_code:0001:0090 socket:0 channel_mask:1 rank:0) +Special notes for injection into SGX enclaves: + +There may be a separate BIOS setup option to enable SGX injection. + +The injection process consists of setting some special memory controller +trigger that will inject the error on the next write to the target +address. But the h/w prevents any software outside of an SGX enclave +from accessing enclave pages (even BIOS SMM mode). + +The following sequence can be used: + 1) Determine physical address of enclave page + 2) Use "notrigger=1" mode to inject (this will setup + the injection address, but will not actually inject) + 3) Enter the enclave + 4) Store data to the virtual address matching physical address from step 1 + 5) Execute CLFLUSH for that virtual address + 6) Spin delay for 250ms + 7) Read from the virtual address. This will trigger the error + For more information about EINJ, please refer to ACPI specification version 4.0, section 17.5 and ACPI 5.0, section 18.6. diff --git a/drivers/acpi/apei/einj.c b/drivers/acpi/apei/einj.c index 328e8aeece6c..fb634219e232 100644 --- a/drivers/acpi/apei/einj.c +++ b/drivers/acpi/apei/einj.c @@ -544,7 +544,8 @@ static int einj_error_inject(u32 type, u32 flags, u64 param1, u64 param2, ((region_intersects(base_addr, size, IORESOURCE_SYSTEM_RAM, IORES_DESC_NONE) != REGION_INTERSECTS) && (region_intersects(base_addr, size, IORESOURCE_MEM, IORES_DESC_PERSISTENT_MEMORY) - != REGION_INTERSECTS))) + != REGION_INTERSECTS) && + !sgx_is_epc_page(base_addr))) return -EINVAL; inject: diff --git a/include/linux/mm.h b/include/linux/mm.h index 1b9d0912942a..47eb960516cf 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -3253,11 +3253,17 @@ static inline int seal_check_future_write(int seals, struct vm_area_struct *vma) #ifdef CONFIG_X86_SGX int sgx_memory_failure(unsigned long pfn, int flags); +bool sgx_is_epc_page(u64 paddr); #else static inline int sgx_memory_failure(unsigned long pfn, int flags) { return -ENXIO; } + +static inline bool sgx_is_epc_page(u64 paddr) +{ + return false; +} #endif #endif /* __KERNEL__ */