v2: https://lore.kernel.org/lkml/20220315010300.10199-1-cathy.zhang@xxxxxxxxx/ Changes since v2: - Changes are made in patch "x86/sgx: Introduce mechanism to prevent new initializations of EPC pages" by moving SGX2 related changes out. It allows this series to be applied on tip/x86/sgx branch with only picking up some auxiliary changes from SGX2 series, rather than depend on the whole set. (Jarkko Sakkinen, Reinette Chatre) Changes since v1: - Remove the sysfs file svnupdate. (Thomas Gleixner, Dave Hansen) - Let late microcode load path call ENCLS[EUPDATESVN] procedure directly. (Borislav Petkov) - Update cover letter by removing saying that "...triggered by administrators via sysfs...". - Drop the patch for documentation change. cover letter: == General Microcode Background == Historically, microcode updates are applied by the BIOS or early in boot. In recent years, several trends have made these old approaches less palatable. First, the cadence of microcode updates has increased to deliver security mitigations. Second, the value of those updates has increased, meaning that any delay in applying them is unacceptable. Third, users have become accustomed to approaches like hot patching their kernels and have a growing aversion to reboots in general. Users want microcode updates to behave more like a hot patching a kernel and less like a BIOS update. == SGX Attestation Background == SGX enclaves have an attestation mechanism. An enclave might, for instance, need to attest to its state before it is given a special decryption key. Since SGX must trust the CPU microcode, attestation incorporates the microcode versions of all processors on the system and is affected by microcode updates. This allows the entity to which the enclave is attesting to make deployment decisions based on the microcode version. For example, an enclave might be denied a decryption key if it runs on a system that has old microcode without a specific mitigation. Unfortunately, this attestation metric (called CPUSVN) is only a snapshot. When the kernel first uses SGX (successfully executes any ENCLS instruction), SGX inspects all CPUs in the system and incorporates a record of their microcode versions into CPUSVN. Today, that value is locked and is not updated until a reboot. == Problems == This means that, although the microcode may be update, enclaves can never attest to this fact. Enclaves are stuck attesting to the old version until a reboot. Old enclaves created before the microcode update are presumed to be compromised must not be allowed to attest with the new microcode version. == Solution == EUPDATESVN is a new SGX instruction which allows enclave attestation to include information about updated microcode without a reboot. Whenever a microcode update affects SGX, the SGX attestation architecture assumes that all running enclaves and cryptographic assets (like internal SGX encryption keys) have been compromised. To mitigate the impact of this presumed compromise, EUPDATESVN success requires that all SGX memory to be marked as "unused" and its contents destroyed. This requirement ensures that no compromised enclave can survive the EUPDATESVN procedure and provides an opportunity to generate new cryptographic assets. This series implements the infrastructure needed to track and tear down bare-metal enclaves and then run EUPDATESVN, it will be called by the late microcode load path after the microcode update. This is a very slow operation. It is, of course, exceedingly disruptive to enclaves but should be infrequent as microcode updates are released on the order of every few months. Also, this is not the first piece of the SGX architecture which will destroy all enclave contents. A follow-on series will add Virtual EPC (KVM guest) support. Here is the spec for your reference: https://cdrdv2.intel.com/v1/dl/getContent/648682?explicitVersion=true This is series is based on tip/x86/sgx with the following additionally applied: "x86/sgx: Export sgx_encl_ewb_cpumask()" https://lore.kernel.org/lkml/cover.1644274683.git.reinette.chatre@xxxxxxxxx/T/#m44e2b931e82a87a8b2c80058130182eb747fbcf0 "x86/sgx: Rename sgx_encl_ewb_cpumask() as sgx_encl_cpumask()" https://lore.kernel.org/lkml/cover.1644274683.git.reinette.chatre@xxxxxxxxx/T/#mf6268a66b5c48ca9a18a772b6eaea097c315dc1d "x86/sgx: Make sgx_ipi_cb() available internally" https://lore.kernel.org/lkml/cover.1644274683.git.reinette.chatre@xxxxxxxxx/T/#ma3330f8ee8136aa084d0a2b5f110331e37f44c52 "x86/sgx: Keep record of SGX page type" https://lore.kernel.org/lkml/cover.1644274683.git.reinette.chatre@xxxxxxxxx/T/#m4ae80fdf67ad330119bfc2abaea845baa24ed14c Cathy Zhang (10): x86/sgx: Introduce mechanism to prevent new initializations of EPC pages x86/sgx: Provide VA page non-NULL owner x86/sgx: Save enclave pointer for VA page x86/sgx: Keep record for SGX VA and Guest page type x86/sgx: Save the size of each EPC section x86/sgx: Forced EPC page zapping for EUPDATESVN x86/sgx: Define error codes for ENCLS[EUPDATESVN] x86/sgx: Implement ENCLS[EUPDATESVN] x86/cpu: Call ENCLS[EUPDATESVN] procedure in microcode update x86/sgx: Call ENCLS[EUPDATESVN] during SGX initialization arch/x86/include/asm/microcode.h | 5 + arch/x86/include/asm/sgx.h | 48 +++- arch/x86/kernel/cpu/sgx/encl.h | 4 +- arch/x86/kernel/cpu/sgx/encls.h | 14 + arch/x86/kernel/cpu/sgx/sgx.h | 23 +- arch/x86/kernel/cpu/common.c | 9 + arch/x86/kernel/cpu/sgx/encl.c | 40 ++- arch/x86/kernel/cpu/sgx/ioctl.c | 28 +- arch/x86/kernel/cpu/sgx/main.c | 459 ++++++++++++++++++++++++++++++- arch/x86/kernel/cpu/sgx/virt.c | 22 ++ 10 files changed, 628 insertions(+), 24 deletions(-) -- 2.17.1
