From: Borislav Petkov <bp@alien8.de> To: Sean Christopherson <sean.j.christopherson@intel.com> Cc: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>, linux-kernel@vger.kernel.org, x86@kernel.org, linux-sgx@vger.kernel.org, akpm@linux-foundation.org, dave.hansen@intel.com, nhorman@redhat.com, npmccallum@redhat.com, serge.ayoun@intel.com, shay.katz-zamir@intel.com, haitao.huang@intel.com, andriy.shevchenko@linux.intel.com, tglx@linutronix.de, kai.svahn@intel.com, josh@joshtriplett.org, luto@kernel.org, kai.huang@intel.com, rientjes@google.com, cedric.xing@intel.com, Kai Huang <kai.huang@linux.intel.com>, Haim Cohen <haim.cohen@intel.com> Subject: Re: [PATCH v22 02/24] x86/cpufeatures: x86/msr: Intel SGX Launch Control hardware bits Date: Wed, 25 Sep 2019 20:31:36 +0200 Message-ID: <20190925183136.GH3891@zn.tnic> (raw) In-Reply-To: <20190925171824.GF31852@linux.intel.com> On Wed, Sep 25, 2019 at 10:18:24AM -0700, Sean Christopherson wrote: > Realistically, there will likely be a non-trivial number of systems with > SGX_LE_WR=0 but SGX enabled. Well no. We won't support those. I remember very vividly at Tech Days a couple of years ago where we said we won't support locked down systems. > Given the number of steps BIOS needs to take to enable SGX, that'd be one > "inventive" BIOS. :-) Oh, you have no idea the amount of BIOS shit I've experienced. > It's inevitable that some systems will lock down the LE hash MSRs, either > intentionally or due to lack of support for SGX_LE_WR. The latter is > probably going to be more common than OEMs intentionally locking the MSRs, > because some Intel reference BIOSes simply don't support SGX_LE_WR, e.g. I > have a Coffee Lake SDP that has hardware support for SGX_LC, but the BIOS > doesn't provide any way to set SGX_LE_WR or leave FEATURE_CONTROL unlocked. We won't support those too. Nothing changes since a couple of years ago. We won't support locked down systems and unfinished BIOS systems. ... reading your other mail about KVM... I guess KVM could be an exception here if people wanna run different OSes in the guest. IMHO. For that, though, we should still clear all SGX feature bits in the host, I'd say, and let the kvm module rediscover everything itself through CPUID directly and not using *cpu_has* Why, you ask? Because otherwise users will start asking why do they have "sgx" in /proc/cpuinfo but they can't run their own enclaves. But maybe someone has a better idea. In any case, I think it would be bad idea to show only a subset of features in /proc/cpuinfo of a locked-down system and have to explain it to users why they can't do own enclaves. But again, someone might have a better idea. Thx. -- Regards/Gruss, Boris. https://people.kernel.org/tglx/notes-about-netiquette
next prev parent reply index Thread overview: 102+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-09-03 14:26 [PATCH v22 00/24] Intel SGX foundations Jarkko Sakkinen 2019-09-03 14:26 ` [PATCH v22 01/24] x86/cpufeatures: x86/msr: Add Intel SGX hardware bits Jarkko Sakkinen 2019-09-24 15:28 ` Borislav Petkov 2019-09-24 16:11 ` Sean Christopherson 2019-09-24 16:25 ` Borislav Petkov 2019-09-03 14:26 ` [PATCH v22 02/24] x86/cpufeatures: x86/msr: Intel SGX Launch Control " Jarkko Sakkinen 2019-09-24 15:52 ` Borislav Petkov 2019-09-24 20:22 ` Sean Christopherson 2019-09-25 8:51 ` Borislav Petkov 2019-09-25 17:18 ` Sean Christopherson 2019-09-25 18:31 ` Borislav Petkov [this message] 2019-09-25 19:08 ` Sean Christopherson 2019-09-27 16:11 ` Jarkko Sakkinen 2019-09-25 14:09 ` Jarkko Sakkinen 2019-09-25 14:10 ` Jarkko Sakkinen 2019-09-25 14:38 ` Jarkko Sakkinen 2019-09-25 15:19 ` Borislav Petkov 2019-09-25 16:49 ` Sean Christopherson 2019-09-25 17:28 ` Borislav Petkov 2019-09-25 18:18 ` Sean Christopherson 2019-09-03 14:26 ` [PATCH v22 03/24] x86/mm: x86/sgx: Signal SIGSEGV with PF_SGX Jarkko Sakkinen 2019-09-24 16:04 ` Borislav Petkov 2019-09-25 14:16 ` Jarkko Sakkinen 2019-09-03 14:26 ` [PATCH v22 04/24] x86/cpu/intel: Detect SGX supprt Jarkko Sakkinen 2019-09-24 16:13 ` Borislav Petkov 2019-09-24 17:43 ` Sean Christopherson 2019-09-24 18:21 ` Borislav Petkov 2019-09-25 14:46 ` Jarkko Sakkinen 2019-09-03 14:26 ` [PATCH v22 05/24] x86/sgx: Add ENCLS architectural error codes Jarkko Sakkinen 2019-09-27 10:20 ` Borislav Petkov 2019-09-27 16:08 ` Jarkko Sakkinen 2019-09-27 17:20 ` Sean Christopherson 2019-10-01 20:23 ` Jarkko Sakkinen 2019-09-03 14:26 ` [PATCH v22 06/24] x86/sgx: Add SGX microarchitectural data structures Jarkko Sakkinen 2019-09-27 16:27 ` Borislav Petkov 2019-10-01 19:10 ` Jarkko Sakkinen 2019-10-01 20:39 ` Jarkko Sakkinen 2019-09-03 14:26 ` [PATCH v22 07/24] x86/sgx: Add wrappers for ENCLS leaf functions Jarkko Sakkinen 2019-10-04 9:45 ` Borislav Petkov 2019-10-04 18:56 ` Jarkko Sakkinen 2019-10-08 4:04 ` Sean Christopherson 2019-10-08 7:18 ` Borislav Petkov 2019-10-08 13:35 ` Sean Christopherson 2019-10-08 14:56 ` Borislav Petkov 2019-09-03 14:26 ` [PATCH v22 08/24] x86/sgx: Enumerate and track EPC sections Jarkko Sakkinen 2019-10-05 9:26 ` Borislav Petkov 2019-10-07 11:58 ` Jarkko Sakkinen 2019-09-03 14:26 ` [PATCH v22 09/24] x86/sgx: Add functions to allocate and free EPC pages Jarkko Sakkinen 2019-10-05 16:44 ` Borislav Petkov 2019-10-07 14:50 ` Sean Christopherson 2019-10-08 9:09 ` Borislav Petkov 2019-10-08 13:31 ` Sean Christopherson 2019-10-07 17:55 ` Jarkko Sakkinen 2019-10-07 18:09 ` Borislav Petkov 2019-09-03 14:26 ` [PATCH v22 10/24] x86/sgx: Add sgx_einit() for wrapping ENCLS[EINIT] Jarkko Sakkinen 2019-10-08 17:30 ` Borislav Petkov 2019-10-08 17:45 ` Sean Christopherson 2019-10-08 17:46 ` Sean Christopherson 2019-10-08 17:53 ` Borislav Petkov 2019-09-03 14:26 ` [PATCH v22 11/24] mm: Introduce vm_ops->may_mprotect() Jarkko Sakkinen 2019-10-08 17:41 ` Borislav Petkov 2019-09-03 14:26 ` [PATCH v22 12/24] x86/sgx: Linux Enclave Driver Jarkko Sakkinen 2019-10-08 17:59 ` Borislav Petkov 2019-10-08 18:17 ` Sean Christopherson 2019-10-08 19:19 ` Borislav Petkov 2019-09-03 14:26 ` [PATCH v22 13/24] x86/sgx: Add provisioning Jarkko Sakkinen 2019-09-03 14:26 ` [PATCH v22 14/24] x86/sgx: Add a page reclaimer Jarkko Sakkinen 2019-09-03 14:26 ` [PATCH v22 15/24] x86/sgx: ptrace() support for the SGX driver Jarkko Sakkinen 2019-09-03 14:26 ` [PATCH v22 16/24] x86/vdso: Add support for exception fixup in vDSO functions Jarkko Sakkinen 2019-10-02 23:18 ` Jarkko Sakkinen 2019-10-02 23:45 ` Jarkko Sakkinen 2019-10-04 0:03 ` Sean Christopherson 2019-10-04 18:49 ` Jarkko Sakkinen 2019-10-04 0:15 ` Sean Christopherson 2019-10-04 18:52 ` Jarkko Sakkinen 2019-10-05 15:54 ` Sean Christopherson 2019-10-07 7:57 ` Jarkko Sakkinen 2019-10-07 8:10 ` Jarkko Sakkinen 2019-10-07 12:04 ` Jarkko Sakkinen 2019-10-08 4:54 ` Sean Christopherson 2019-10-05 18:39 ` Sean Christopherson 2019-10-07 8:01 ` Jarkko Sakkinen 2019-10-06 23:38 ` Jarkko Sakkinen 2019-10-06 23:40 ` Jarkko Sakkinen 2019-09-03 14:26 ` [PATCH v22 17/24] x86/fault: Add helper function to sanitize error code Jarkko Sakkinen 2019-09-03 14:26 ` [PATCH v22 18/24] x86/traps: Attempt to fixup exceptions in vDSO before signaling Jarkko Sakkinen 2019-09-03 14:26 ` [PATCH v22 19/24] x86/vdso: Add __vdso_sgx_enter_enclave() to wrap SGX enclave transitions Jarkko Sakkinen 2019-09-03 14:26 ` [PATCH v22 20/24] selftests/x86: Add a selftest for SGX Jarkko Sakkinen 2019-09-03 14:26 ` [PATCH v22 21/24] selftests/x86: Recurse into subdirectories Jarkko Sakkinen 2019-09-03 14:26 ` [PATCH v22 22/24] x86/sgx: Update MAINTAINERS Jarkko Sakkinen 2019-09-03 14:26 ` [PATCH v22 23/24] docs: x86/sgx: Document microarchitecture Jarkko Sakkinen 2019-09-27 18:15 ` Randy Dunlap 2019-09-03 14:26 ` [PATCH v22 24/24] docs: x86/sgx: Document kernel internals Jarkko Sakkinen 2019-09-27 17:07 ` Randy Dunlap 2019-10-01 19:34 ` Jarkko Sakkinen 2019-09-13 20:38 ` [PATCH v22 00/24] Intel SGX foundations Dave Hansen 2019-09-14 13:41 ` Jarkko Sakkinen 2019-09-14 15:32 ` Dave Hansen 2019-09-16 5:23 ` Jarkko Sakkinen 2019-09-24 17:20 ` Andy Lutomirski 2019-09-25 14:32 ` Jarkko Sakkinen 2019-10-02 23:42 ` Jarkko Sakkinen
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20190925183136.GH3891@zn.tnic \ --to=bp@alien8.de \ --cc=akpm@linux-foundation.org \ --cc=andriy.shevchenko@linux.intel.com \ --cc=cedric.xing@intel.com \ --cc=dave.hansen@intel.com \ --cc=haim.cohen@intel.com \ --cc=haitao.huang@intel.com \ --cc=jarkko.sakkinen@linux.intel.com \ --cc=josh@joshtriplett.org \ --cc=kai.huang@intel.com \ --cc=kai.huang@linux.intel.com \ --cc=kai.svahn@intel.com \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-sgx@vger.kernel.org \ --cc=luto@kernel.org \ --cc=nhorman@redhat.com \ --cc=npmccallum@redhat.com \ --cc=rientjes@google.com \ --cc=sean.j.christopherson@intel.com \ --cc=serge.ayoun@intel.com \ --cc=shay.katz-zamir@intel.com \ --cc=tglx@linutronix.de \ --cc=x86@kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
Linux-Sgx Archive on lore.kernel.org Archives are clonable: git clone --mirror https://lore.kernel.org/linux-sgx/0 linux-sgx/git/0.git # If you have public-inbox 1.1+ installed, you may # initialize and index your mirror using the following commands: public-inbox-init -V2 linux-sgx linux-sgx/ https://lore.kernel.org/linux-sgx \ linux-sgx@vger.kernel.org public-inbox-index linux-sgx Example config snippet for mirrors Newsgroup available over NNTP: nntp://nntp.lore.kernel.org/org.kernel.vger.linux-sgx AGPL code for this site: git clone https://public-inbox.org/public-inbox.git