On Thursday, 2020-07-16 at 16:52:41 +03, Jarkko Sakkinen wrote: > From: Sean Christopherson <[email protected]> > > Add X86_FEATURE_SGX_LC, which informs whether or not the CPU supports SGX > Launch Control. > > Add MSR_IA32_SGXLEPUBKEYHASH{0, 1, 2, 3}, which when combined contain a > SHA256 hash of a 3072-bit RSA public key. SGX backed software packages, so > called enclaves, are always signed. All enclaves signed with the public key > are unconditionally allowed to initialize. [1] > > Add FEAT_CTL_SGX_LC_ENABLED, which informs whether the aformentioned MSRs > are writable or not. If the bit is off, the public key MSRs are read-only > for the OS. > > If the MSRs are read-only, the platform must provide a launch enclave (LE). > LE can create cryptographic tokens for other enclaves that they can pass > together with their signature to the ENCLS(EINIT) opcode, which is used > to initialize enclaves. > > Linux is unlikely to support the locked configuration because it takes away > the control of the launch decisions from the kernel. > > [1] Intel SDM: 38.1.4 Intel SGX Launch Control Configuration > > Reviewed-by: Borislav Petkov <[email protected]> > Acked-by: Jethro Beekman <[email protected]> > Signed-off-by: Sean Christopherson <[email protected]> > Co-developed-by: Jarkko Sakkinen <[email protected]> > Signed-off-by: Jarkko Sakkinen <[email protected]>
Reviewed-by: Darren Kenny <[email protected]> > --- > arch/x86/include/asm/cpufeatures.h | 1 + > arch/x86/include/asm/msr-index.h | 7 +++++++ > 2 files changed, 8 insertions(+) > > diff --git a/arch/x86/include/asm/cpufeatures.h > b/arch/x86/include/asm/cpufeatures.h > index 545ac3e0e269..0a4541e4f076 100644 > --- a/arch/x86/include/asm/cpufeatures.h > +++ b/arch/x86/include/asm/cpufeatures.h > @@ -352,6 +352,7 @@ > #define X86_FEATURE_CLDEMOTE (16*32+25) /* CLDEMOTE instruction */ > #define X86_FEATURE_MOVDIRI (16*32+27) /* MOVDIRI instruction */ > #define X86_FEATURE_MOVDIR64B (16*32+28) /* MOVDIR64B > instruction */ > +#define X86_FEATURE_SGX_LC (16*32+30) /* Software Guard Extensions > Launch Control */ > > /* AMD-defined CPU features, CPUID level 0x80000007 (EBX), word 17 */ > #define X86_FEATURE_OVERFLOW_RECOV (17*32+ 0) /* MCA overflow recovery > support */ > diff --git a/arch/x86/include/asm/msr-index.h > b/arch/x86/include/asm/msr-index.h > index 18e08da19f16..3d7c89a8533f 100644 > --- a/arch/x86/include/asm/msr-index.h > +++ b/arch/x86/include/asm/msr-index.h > @@ -582,6 +582,7 @@ > #define FEAT_CTL_LOCKED BIT(0) > #define FEAT_CTL_VMX_ENABLED_INSIDE_SMX BIT(1) > #define FEAT_CTL_VMX_ENABLED_OUTSIDE_SMX BIT(2) > +#define FEAT_CTL_SGX_LC_ENABLED BIT(17) > #define FEAT_CTL_SGX_ENABLED BIT(18) > #define FEAT_CTL_LMCE_ENABLED BIT(20) > > @@ -602,6 +603,12 @@ > #define MSR_IA32_UCODE_WRITE 0x00000079 > #define MSR_IA32_UCODE_REV 0x0000008b > > +/* Intel SGX Launch Enclave Public Key Hash MSRs */ > +#define MSR_IA32_SGXLEPUBKEYHASH0 0x0000008C > +#define MSR_IA32_SGXLEPUBKEYHASH1 0x0000008D > +#define MSR_IA32_SGXLEPUBKEYHASH2 0x0000008E > +#define MSR_IA32_SGXLEPUBKEYHASH3 0x0000008F > + > #define MSR_IA32_SMM_MONITOR_CTL 0x0000009b > #define MSR_IA32_SMBASE 0x0000009e > > -- > 2.25.1
