From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id AD6EEC433EF for ; Tue, 16 Nov 2021 00:06:51 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 9800B61027 for ; Tue, 16 Nov 2021 00:06:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353533AbhKPAJo (ORCPT ); Mon, 15 Nov 2021 19:09:44 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52292 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347419AbhKOUe7 (ORCPT ); Mon, 15 Nov 2021 15:34:59 -0500 Received: from galois.linutronix.de (Galois.linutronix.de [IPv6:2a0a:51c0:0:12e:550::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7B188C043199; Mon, 15 Nov 2021 12:22:39 -0800 (PST) Date: Mon, 15 Nov 2021 20:22:31 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1637007752; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=U0poEbGRIAIQwnalG99rOoeDiTmGZoMifsJsnzTCb9M=; b=06iMdouW2NHax6Hd5CVoVh2VT+/al1gQPu1naHFWny4sn9QlBGLZtV5C706Wo3xedvc60A HQQZ9qnM4a0bpZ69KhXoCFr9KvJkdkMHRJPBI9L0ONHn4elAc5XxSUiwSo/aEtybY5EKZa 6dqsOjqJttb/CmqbSI+fe66HLbvtESX78JE7vj2R2GKKGes9pXTvSA6UTXCQMo2J+nEv8G 5MkbqiNRDckAdBHGCfGUeaRGb4etNFr7DD0zCJLxtUctrbUzHzSZezJB24B3Ck4+9RvYPA QrcotRhVKsrKfAsKlJKqalOUpzfI5xqWeyrxhu1dSKmpNe0Ja7/o/9zWKXkOvg== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1637007752; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=U0poEbGRIAIQwnalG99rOoeDiTmGZoMifsJsnzTCb9M=; b=pI61CcWJpMd+VHhqSPJRbR9DvxqJctBG68fWCC6xRp08UHB4NzZNmpb84YfPM4tjYArXHn /qhhX13kLdVjFODg== From: "tip-bot2 for Tony Luck" Sender: tip-bot2@linutronix.de Reply-to: linux-kernel@vger.kernel.org To: linux-tip-commits@vger.kernel.org Subject: [tip: x86/sgx] x86/sgx: Add SGX infrastructure to recover from poison Cc: Tony Luck , Dave Hansen , Jarkko Sakkinen , Reinette Chatre , x86@kernel.org, linux-kernel@vger.kernel.org In-Reply-To: <20211026220050.697075-5-tony.luck@intel.com> References: <20211026220050.697075-5-tony.luck@intel.com> MIME-Version: 1.0 Message-ID: <163700775140.414.1869416199298479421.tip-bot2@tip-bot2> Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The following commit has been merged into the x86/sgx branch of tip: Commit-ID: a495cbdffa30558b34f3c95555cecc4fd9688039 Gitweb: https://git.kernel.org/tip/a495cbdffa30558b34f3c95555cecc4fd9688039 Author: Tony Luck AuthorDate: Tue, 26 Oct 2021 15:00:47 -07:00 Committer: Dave Hansen CommitterDate: Mon, 15 Nov 2021 11:13:16 -08:00 x86/sgx: Add SGX infrastructure to recover from poison Provide a recovery function sgx_memory_failure(). If the poison was consumed synchronously then send a SIGBUS. Note that the virtual address of the access is not included with the SIGBUS as is the case for poison outside of SGX enclaves. This doesn't matter as addresses of code/data inside an enclave is of little to no use to code executing outside the (now dead) enclave. Poison found in a free page results in the page being moved from the free list to the per-node poison page list. Signed-off-by: Tony Luck Signed-off-by: Dave Hansen Reviewed-by: Jarkko Sakkinen Tested-by: Reinette Chatre Link: https://lkml.kernel.org/r/20211026220050.697075-5-tony.luck@intel.com --- arch/x86/kernel/cpu/sgx/main.c | 76 +++++++++++++++++++++++++++++++++- 1 file changed, 76 insertions(+) diff --git a/arch/x86/kernel/cpu/sgx/main.c b/arch/x86/kernel/cpu/sgx/main.c index e5fcb83..231c494 100644 --- a/arch/x86/kernel/cpu/sgx/main.c +++ b/arch/x86/kernel/cpu/sgx/main.c @@ -693,6 +693,82 @@ bool arch_is_platform_page(u64 paddr) } EXPORT_SYMBOL_GPL(arch_is_platform_page); +static struct sgx_epc_page *sgx_paddr_to_page(u64 paddr) +{ + struct sgx_epc_section *section; + + section = xa_load(&sgx_epc_address_space, paddr); + if (!section) + return NULL; + + return §ion->pages[PFN_DOWN(paddr - section->phys_addr)]; +} + +/* + * Called in process context to handle a hardware reported + * error in an SGX EPC page. + * If the MF_ACTION_REQUIRED bit is set in flags, then the + * context is the task that consumed the poison data. Otherwise + * this is called from a kernel thread unrelated to the page. + */ +int arch_memory_failure(unsigned long pfn, int flags) +{ + struct sgx_epc_page *page = sgx_paddr_to_page(pfn << PAGE_SHIFT); + struct sgx_epc_section *section; + struct sgx_numa_node *node; + + /* + * mm/memory-failure.c calls this routine for all errors + * where there isn't a "struct page" for the address. But that + * includes other address ranges besides SGX. + */ + if (!page) + return -ENXIO; + + /* + * If poison was consumed synchronously. Send a SIGBUS to + * the task. Hardware has already exited the SGX enclave and + * will not allow re-entry to an enclave that has a memory + * error. The signal may help the task understand why the + * enclave is broken. + */ + if (flags & MF_ACTION_REQUIRED) + force_sig(SIGBUS); + + section = &sgx_epc_sections[page->section]; + node = section->node; + + spin_lock(&node->lock); + + /* Already poisoned? Nothing more to do */ + if (page->poison) + goto out; + + page->poison = 1; + + /* + * If the page is on a free list, move it to the per-node + * poison page list. + */ + if (page->flags & SGX_EPC_PAGE_IS_FREE) { + list_move(&page->list, &node->sgx_poison_page_list); + goto out; + } + + /* + * TBD: Add additional plumbing to enable pre-emptive + * action for asynchronous poison notification. Until + * then just hope that the poison: + * a) is not accessed - sgx_free_epc_page() will deal with it + * when the user gives it back + * b) results in a recoverable machine check rather than + * a fatal one + */ +out: + spin_unlock(&node->lock); + return 0; +} + /** * A section metric is concatenated in a way that @low bits 12-31 define the * bits 12-31 of the metric and @high bits 0-19 define the bits 32-51 of the