linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: "Paraschiv, Andra-Irina" <andraprs@amazon.com>
To: <linux-kernel@vger.kernel.org>
Cc: Anthony Liguori <aliguori@amazon.com>,
	Benjamin Herrenschmidt <benh@kernel.crashing.org>,
	Colm MacCarthaigh <colmmacc@amazon.com>,
	"Bjoern Doebel" <doebel@amazon.de>,
	David Woodhouse <dwmw@amazon.co.uk>,
	"Frank van der Linden" <fllinden@amazon.com>,
	Alexander Graf <graf@amazon.de>,
	"Martin Pohlack" <mpohlack@amazon.de>,
	Matt Wilson <msw@amazon.com>, Paolo Bonzini <pbonzini@redhat.com>,
	Balbir Singh <sblbir@amazon.com>,
	Stefano Garzarella <sgarzare@redhat.com>,
	Stefan Hajnoczi <stefanha@redhat.com>,
	Stewart Smith <trawets@amazon.com>,
	Uwe Dannowski <uwed@amazon.de>, <kvm@vger.kernel.org>,
	<ne-devel-upstream@amazon.com>
Subject: Re: [PATCH v2 00/18] Add support for Nitro Enclaves
Date: Fri, 22 May 2020 09:39:49 +0300	[thread overview]
Message-ID: <6a660c02-0278-d25f-3f64-adc37c8de579@amazon.com> (raw)
In-Reply-To: <20200522062946.28973-1-andraprs@amazon.com>



On 22/05/2020 09:29, Andra Paraschiv wrote:
> Nitro Enclaves (NE) is a new Amazon Elastic Compute Cloud (EC2) capability
> that allows customers to carve out isolated compute environments within EC2
> instances [1].
>
> For example, an application that processes sensitive data and runs in a VM,
> can be separated from other applications running in the same VM. This
> application then runs in a separate VM than the primary VM, namely an enclave.
>
> An enclave runs alongside the VM that spawned it. This setup matches low latency
> applications needs. The resources that are allocated for the enclave, such as
> memory and CPU, are carved out of the primary VM. Each enclave is mapped to a
> process running in the primary VM, that communicates with the NE driver via an
> ioctl interface.
>
> In this sense, there are two components:
>
> 1. An enclave abstraction process - a user space process running in the primary
> VM guest  that uses the provided ioctl interface of the NE driver to spawn an
> enclave VM (that's 2 below).
>
> How does all gets to an enclave VM running on the host?
>
> There is a NE emulated PCI device exposed to the primary VM. The driver for this
> new PCI device is included in the current patch series.
>
> The ioctl logic is mapped to PCI device commands e.g. the NE_START_ENCLAVE ioctl
> maps to an enclave start PCI command or the KVM_SET_USER_MEMORY_REGION maps to
> an add memory PCI command. The PCI device commands are then translated into
> actions taken on the hypervisor side; that's the Nitro hypervisor running on the
> host where the primary VM is running. The Nitro hypervisor is based on core KVM
> technology.
>
> 2. The enclave itself - a VM running on the same host as the primary VM that
> spawned it. Memory and CPUs are carved out of the primary VM and are dedicated
> for the enclave VM. An enclave does not have persistent storage attached.
>
> An enclave communicates with the primary VM via a local communication channel,
> using virtio-vsock [2]. The primary VM has virtio-pci vsock emulated device,
> while the enclave VM has a virtio-mmio vsock emulated device. The vsock device
> uses eventfd for signaling. The enclave VM sees the usual interfaces - local
> APIC and IOAPIC - to get interrupts from virtio-vsock device. The virtio-mmio
> device is placed in memory below the typical 4 GiB.
>
> The application that runs in the enclave needs to be packaged in an enclave
> image together with the OS ( e.g. kernel, ramdisk, init ) that will run in the
> enclave VM. The enclave VM has its own kernel and follows the standard Linux
> boot protocol.
>
> The kernel bzImage, the kernel command line, the ramdisk(s) are part of the
> Enclave Image Format (EIF); plus an EIF header including metadata such as magic
> number, eif version, image size and CRC.

Adding here that we've also considered FIT image format [1] as an option.

Andra

[1] https://github.com/u-boot/u-boot/tree/master/doc/uImage.FIT

>
> Hash values are computed for the entire enclave image (EIF), the kernel and
> ramdisk(s). That's used, for example, to check that the enclave image that is
> loaded in the enclave VM is the one that was intended to be run.
>
> These crypto measurements are included in a signed attestation document
> generated by the Nitro Hypervisor and further used to prove the identity of the
> enclave; KMS is an example of service that NE is integrated with and that checks
> the attestation doc.
>
> The enclave image (EIF) is loaded in the enclave memory at offset 8 MiB. The
> init process in the enclave connects to the vsock CID of the primary VM and a
> predefined port - 9000 - to send a heartbeat value - 0xb7. This mechanism is
> used to check in the primary VM that the enclave has booted.
>
> If the enclave VM crashes or gracefully exits, an interrupt event is received by
> the NE driver. This event is sent further to the user space enclave process
> running in the primary VM via a poll notification mechanism. Then the user space
> enclave process can exit.
>
> The following patch series covers the NE driver for enclave lifetime management.
> It provides an ioctl interface to the user space and includes the NE PCI device
> driver that is the means of communication with the hypervisor running on the
> host where the primary VM and the enclave are launched.
>
> The proposed solution is following the KVM model and uses KVM ioctls to be able
> to create and set resources for enclaves. Additional NE ioctl commands, besides
> the ones provided by KVM, are used to start an enclave and get memory offset for
> in-memory enclave image loading.
>
> Thank you.
>
> Andra
>
> [1] https://aws.amazon.com/ec2/nitro/nitro-enclaves/
> [2] http://man7.org/linux/man-pages/man7/vsock.7.html
>
> ---
>
> Patch Series Changelog
>
> The patch series is built on top of v5.7-rc6.
>
> v1 -> v2
>
> * Rebase on top of v5.7-rc6.
> * Adapt codebase based on feedback from v1.
> * Update ioctl number definition - major and minor.
> * Add sample / documentation for the ioctl interface basic flow usage.
> * Update cover letter to include more context on the NE overall.
> * Add fix for the enclave / vcpu fd creation error cleanup path.
> * Add fix reported by kbuild test robot <lkp@intel.com>.
> * v1: https://lore.kernel.org/lkml/20200421184150.68011-1-andraprs@amazon.com/
>
> ---
>
> Andra Paraschiv (18):
>    nitro_enclaves: Add ioctl interface definition
>    nitro_enclaves: Define the PCI device interface
>    nitro_enclaves: Define enclave info for internal bookkeeping
>    nitro_enclaves: Init PCI device driver
>    nitro_enclaves: Handle PCI device command requests
>    nitro_enclaves: Handle out-of-band PCI device events
>    nitro_enclaves: Init misc device providing the ioctl interface
>    nitro_enclaves: Add logic for enclave vm creation
>    nitro_enclaves: Add logic for enclave vcpu creation
>    nitro_enclaves: Add logic for enclave image load metadata
>    nitro_enclaves: Add logic for enclave memory region set
>    nitro_enclaves: Add logic for enclave start
>    nitro_enclaves: Add logic for enclave termination
>    nitro_enclaves: Add Kconfig for the Nitro Enclaves driver
>    nitro_enclaves: Add Makefile for the Nitro Enclaves driver
>    nitro_enclaves: Add sample for ioctl interface usage
>    nitro_enclaves: Add overview documentation
>    MAINTAINERS: Add entry for the Nitro Enclaves driver
>
>   Documentation/nitro_enclaves/ne_overview.txt  |   86 ++
>   .../userspace-api/ioctl/ioctl-number.rst      |    5 +-
>   MAINTAINERS                                   |   13 +
>   drivers/virt/Kconfig                          |    2 +
>   drivers/virt/Makefile                         |    2 +
>   drivers/virt/nitro_enclaves/Kconfig           |   28 +
>   drivers/virt/nitro_enclaves/Makefile          |   23 +
>   drivers/virt/nitro_enclaves/ne_misc_dev.c     | 1152 +++++++++++++++++
>   drivers/virt/nitro_enclaves/ne_misc_dev.h     |  121 ++
>   drivers/virt/nitro_enclaves/ne_pci_dev.c      |  717 ++++++++++
>   drivers/virt/nitro_enclaves/ne_pci_dev.h      |  266 ++++
>   include/linux/nitro_enclaves.h                |   23 +
>   include/uapi/linux/nitro_enclaves.h           |   77 ++
>   samples/nitro_enclaves/.gitignore             |    2 +
>   samples/nitro_enclaves/Makefile               |   28 +
>   .../include/linux/nitro_enclaves.h            |   23 +
>   .../include/uapi/linux/nitro_enclaves.h       |   77 ++
>   samples/nitro_enclaves/ne_ioctl_sample.c      |  502 +++++++
>   18 files changed, 3146 insertions(+), 1 deletion(-)
>   create mode 100644 Documentation/nitro_enclaves/ne_overview.txt
>   create mode 100644 drivers/virt/nitro_enclaves/Kconfig
>   create mode 100644 drivers/virt/nitro_enclaves/Makefile
>   create mode 100644 drivers/virt/nitro_enclaves/ne_misc_dev.c
>   create mode 100644 drivers/virt/nitro_enclaves/ne_misc_dev.h
>   create mode 100644 drivers/virt/nitro_enclaves/ne_pci_dev.c
>   create mode 100644 drivers/virt/nitro_enclaves/ne_pci_dev.h
>   create mode 100644 include/linux/nitro_enclaves.h
>   create mode 100644 include/uapi/linux/nitro_enclaves.h
>   create mode 100644 samples/nitro_enclaves/.gitignore
>   create mode 100644 samples/nitro_enclaves/Makefile
>   create mode 100644 samples/nitro_enclaves/include/linux/nitro_enclaves.h
>   create mode 100644 samples/nitro_enclaves/include/uapi/linux/nitro_enclaves.h
>   create mode 100644 samples/nitro_enclaves/ne_ioctl_sample.c
>




Amazon Development Center (Romania) S.R.L. registered office: 27A Sf. Lazar Street, UBC5, floor 2, Iasi, Iasi County, 700045, Romania. Registered in Romania. Registration number J22/2621/2005.

      parent reply	other threads:[~2020-05-22  6:40 UTC|newest]

Thread overview: 47+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-05-22  6:29 [PATCH v2 00/18] Add support for Nitro Enclaves Andra Paraschiv
2020-05-22  6:29 ` [PATCH v2 01/18] nitro_enclaves: Add ioctl interface definition Andra Paraschiv
2020-05-22  7:00   ` Greg KH
2020-05-22  8:16     ` Paraschiv, Andra-Irina
2020-05-22  6:29 ` [PATCH v2 02/18] nitro_enclaves: Define the PCI device interface Andra Paraschiv
2020-05-22  6:29 ` [PATCH v2 03/18] nitro_enclaves: Define enclave info for internal bookkeeping Andra Paraschiv
2020-05-22  6:29 ` [PATCH v2 04/18] nitro_enclaves: Init PCI device driver Andra Paraschiv
2020-05-22  7:04   ` Greg KH
2020-05-23 20:25     ` Alexander Graf
2020-05-24  6:32       ` Greg KH
2020-05-25 11:15         ` Paraschiv, Andra-Irina
2020-05-25 10:54     ` Paraschiv, Andra-Irina
2020-05-22  6:29 ` [PATCH v2 05/18] nitro_enclaves: Handle PCI device command requests Andra Paraschiv
2020-05-22  6:29 ` [PATCH v2 06/18] nitro_enclaves: Handle out-of-band PCI device events Andra Paraschiv
2020-05-22  6:29 ` [PATCH v2 07/18] nitro_enclaves: Init misc device providing the ioctl interface Andra Paraschiv
2020-05-22  7:07   ` Greg KH
2020-05-25 20:49     ` Paraschiv, Andra-Irina
2020-05-26  6:42       ` Greg KH
2020-05-26  8:17         ` Paraschiv, Andra-Irina
2020-05-22  6:29 ` [PATCH v2 08/18] nitro_enclaves: Add logic for enclave vm creation Andra Paraschiv
2020-05-22  7:08   ` Greg KH
2020-05-25 20:53     ` Paraschiv, Andra-Irina
2020-05-22  6:29 ` [PATCH v2 09/18] nitro_enclaves: Add logic for enclave vcpu creation Andra Paraschiv
2020-05-22  6:29 ` [PATCH v2 10/18] nitro_enclaves: Add logic for enclave image load metadata Andra Paraschiv
2020-05-22  6:29 ` [PATCH v2 11/18] nitro_enclaves: Add logic for enclave memory region set Andra Paraschiv
2020-05-22  6:29 ` [PATCH v2 12/18] nitro_enclaves: Add logic for enclave start Andra Paraschiv
2020-05-22  6:29 ` [PATCH v2 13/18] nitro_enclaves: Add logic for enclave termination Andra Paraschiv
2020-05-22  6:29 ` [PATCH v2 14/18] nitro_enclaves: Add Kconfig for the Nitro Enclaves driver Andra Paraschiv
2020-05-22  7:09   ` Greg KH
2020-05-25 21:00     ` Paraschiv, Andra-Irina
2020-05-22  6:29 ` [PATCH v2 15/18] nitro_enclaves: Add Makefile " Andra Paraschiv
2020-05-22  7:09   ` Greg KH
2020-05-25 21:02     ` Paraschiv, Andra-Irina
2020-05-22  6:29 ` [PATCH v2 16/18] nitro_enclaves: Add sample for ioctl interface usage Andra Paraschiv
2020-05-22  7:08   ` Greg KH
2020-05-25 20:57     ` Paraschiv, Andra-Irina
2020-05-26  6:41       ` Greg KH
2020-05-26  8:06         ` Paraschiv, Andra-Irina
2020-05-22  7:11   ` Greg KH
2020-05-25 21:10     ` Paraschiv, Andra-Irina
2020-05-22  6:29 ` [PATCH v2 17/18] nitro_enclaves: Add overview documentation Andra Paraschiv
2020-05-22  7:09   ` Greg KH
2020-05-25 21:04     ` Paraschiv, Andra-Irina
2020-05-22  6:29 ` [PATCH v2 18/18] MAINTAINERS: Add entry for the Nitro Enclaves driver Andra Paraschiv
2020-05-22  7:03   ` Joe Perches
2020-05-22  8:20     ` Paraschiv, Andra-Irina
2020-05-22  6:39 ` Paraschiv, Andra-Irina [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=6a660c02-0278-d25f-3f64-adc37c8de579@amazon.com \
    --to=andraprs@amazon.com \
    --cc=aliguori@amazon.com \
    --cc=benh@kernel.crashing.org \
    --cc=colmmacc@amazon.com \
    --cc=doebel@amazon.de \
    --cc=dwmw@amazon.co.uk \
    --cc=fllinden@amazon.com \
    --cc=graf@amazon.de \
    --cc=kvm@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mpohlack@amazon.de \
    --cc=msw@amazon.com \
    --cc=ne-devel-upstream@amazon.com \
    --cc=pbonzini@redhat.com \
    --cc=sblbir@amazon.com \
    --cc=sgarzare@redhat.com \
    --cc=stefanha@redhat.com \
    --cc=trawets@amazon.com \
    --cc=uwed@amazon.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).