All of lore.kernel.org
 help / color / mirror / Atom feed
From: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
To: intel-sgx-kernel-dev@lists.01.org,
	platform-driver-x86@vger.kernel.org, x86@kernel.org
Cc: linux-kernel@vger.kernel.org,
	Sean Christopherson <sean.j.christopherson@intel.com>,
	Haim Cohen <haim.cohen@intel.com>,
	Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>,
	Thomas Gleixner <tglx@linutronix.de>,
	Ingo Molnar <mingo@redhat.com>, "H. Peter Anvin" <hpa@zytor.com>,
	Len Brown <len.brown@intel.com>, Kyle Huey <me@kylehuey.com>,
	Borislav Petkov <bp@suse.de>,
	Tom Lendacky <thomas.lendacky@amd.com>,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	Grzegorz Andrejczuk <grzegorz.andrejczuk@intel.com>
Subject: [PATCH v9 3/7] x86: add SGX definitions to msr-index.h
Date: Sat, 16 Dec 2017 18:19:50 +0200	[thread overview]
Message-ID: <20171216162200.20243-4-jarkko.sakkinen@linux.intel.com> (raw)
In-Reply-To: <20171216162200.20243-1-jarkko.sakkinen@linux.intel.com>

From: Sean Christopherson <sean.j.christopherson@intel.com>

ENCLS and ENCLU are usable if and only if SGX_ENABLE is set and After
SGX is activated the IA32_SGXLEPUBKEYHASHn MSRs are writable if
SGX_LC_WR is set and the feature control is locked.

SGX related bits in IA32_FEATURE_CONTROL cannot be set before SGX is
activated by the pre-boot firmware. SGX activation is triggered by
setting bit 0 in the MSR 0x7a. Until SGX is activated, the LE hash MSRs
are writable to allow pre-boot firmware to lock down the LE root key
with a non-Intel value.

Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
Signed-off-by: Haim Cohen <haim.cohen@intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Tested-by: Serge Ayoun <serge.ayoun@intel.com>
---
 arch/x86/include/asm/msr-index.h | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
index 34c4922bbc3f..8647a2470487 100644
--- a/arch/x86/include/asm/msr-index.h
+++ b/arch/x86/include/asm/msr-index.h
@@ -439,6 +439,8 @@
 #define FEATURE_CONTROL_LOCKED				(1<<0)
 #define FEATURE_CONTROL_VMXON_ENABLED_INSIDE_SMX	(1<<1)
 #define FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX	(1<<2)
+#define FEATURE_CONTROL_SGX_ENABLE                      (1<<18)
+#define FEATURE_CONTROL_SGX_LE_WR			(1<<17)
 #define FEATURE_CONTROL_LMCE				(1<<20)
 
 #define MSR_IA32_APICBASE		0x0000001b
@@ -505,6 +507,12 @@
 #define PACKAGE_THERM_INT_LOW_ENABLE		(1 << 1)
 #define PACKAGE_THERM_INT_PLN_ENABLE		(1 << 24)
 
+/* Intel SGX MSRs */
+#define MSR_IA32_SGXLEPUBKEYHASH0	0x0000008C
+#define MSR_IA32_SGXLEPUBKEYHASH1	0x0000008D
+#define MSR_IA32_SGXLEPUBKEYHASH2	0x0000008E
+#define MSR_IA32_SGXLEPUBKEYHASH3	0x0000008F
+
 /* Thermal Thresholds Support */
 #define THERM_INT_THRESHOLD0_ENABLE    (1 << 15)
 #define THERM_SHIFT_THRESHOLD0        8
-- 
2.14.1

  parent reply	other threads:[~2017-12-16 16:27 UTC|newest]

Thread overview: 16+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-12-16 16:19 [PATCH v9 0/7] Intel SGX Driver Jarkko Sakkinen
2017-12-16 16:19 ` Jarkko Sakkinen
2017-12-16 16:19 ` [PATCH v9 1/7] intel_sgx: updated MAINTAINERS Jarkko Sakkinen
2017-12-16 16:19 ` [PATCH v9 2/7] x86: add SGX definitions to cpufeature Jarkko Sakkinen
2017-12-16 16:19 ` Jarkko Sakkinen [this message]
2017-12-16 16:19 ` [PATCH v9 4/7] intel_sgx: driver for Intel Software Guard Extensions Jarkko Sakkinen
2017-12-16 18:31   ` Philippe Ombredanne
2017-12-17 16:01     ` Jarkko Sakkinen
2017-12-16 16:19 ` [PATCH v9 5/7] intel_sgx: ptrace() support Jarkko Sakkinen
2017-12-16 16:19 ` [PATCH v9 6/7] intel_sgx: driver documentation Jarkko Sakkinen
2017-12-16 16:19   ` Jarkko Sakkinen
2017-12-16 16:19 ` [PATCH v9 7/7] intel_sgx: in-kernel launch enclave Jarkko Sakkinen
2017-12-19 13:59   ` Jarkko Sakkinen
2017-12-19 13:59     ` Jarkko Sakkinen
2017-12-19 15:36     ` Andy Shevchenko
2017-12-19 23:57       ` Jarkko Sakkinen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20171216162200.20243-4-jarkko.sakkinen@linux.intel.com \
    --to=jarkko.sakkinen@linux.intel.com \
    --cc=bp@suse.de \
    --cc=gregkh@linuxfoundation.org \
    --cc=grzegorz.andrejczuk@intel.com \
    --cc=haim.cohen@intel.com \
    --cc=hpa@zytor.com \
    --cc=intel-sgx-kernel-dev@lists.01.org \
    --cc=len.brown@intel.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=me@kylehuey.com \
    --cc=mingo@redhat.com \
    --cc=platform-driver-x86@vger.kernel.org \
    --cc=sean.j.christopherson@intel.com \
    --cc=tglx@linutronix.de \
    --cc=thomas.lendacky@amd.com \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.