From: "Du, Fan" <fan.du@intel.com>
To: "Li, Zhiquan1" <zhiquan1.li@intel.com>,
"linux-sgx@vger.kernel.org" <linux-sgx@vger.kernel.org>,
"Luck, Tony" <tony.luck@intel.com>,
"jarkko@kernel.org" <jarkko@kernel.org>,
"dave.hansen@linux.intel.com" <dave.hansen@linux.intel.com>
Cc: "Christopherson,, Sean" <seanjc@google.com>,
"Huang, Kai" <kai.huang@intel.com>,
"Zhang, Cathy" <cathy.zhang@intel.com>,
"Du, Fan" <fan.du@intel.com>
Subject: RE: [PATCH v6 0/3] x86/sgx: fine grained SGX MCA behavior
Date: Mon, 15 Aug 2022 03:11:35 +0000 [thread overview]
Message-ID: <MN0PR11MB6181A14ED05182E44C1F5E6B99689@MN0PR11MB6181.namprd11.prod.outlook.com> (raw)
In-Reply-To: <20220723122343.598783-1-zhiquan1.li@intel.com>
Hi Dave,
Any more comments for v6?
Thanks!
> -----Original Message-----
> From: Li, Zhiquan1 <zhiquan1.li@intel.com>
> Sent: Saturday, July 23, 2022 8:24 PM
> To: linux-sgx@vger.kernel.org; Luck, Tony <tony.luck@intel.com>;
> jarkko@kernel.org; dave.hansen@linux.intel.com
> Cc: Christopherson,, Sean <seanjc@google.com>; Huang, Kai
> <kai.huang@intel.com>; Du, Fan <fan.du@intel.com>; Zhang, Cathy
> <cathy.zhang@intel.com>; Li, Zhiquan1 <zhiquan1.li@intel.com>
> Subject: [PATCH v6 0/3] x86/sgx: fine grained SGX MCA behavior
>
> V5: https://lore.kernel.org/linux-sgx/Yrf27fugD7lkyaek@kernel.org/T/#t
>
> Changes since V5:
> - Rename the 'owner' field as 'encl_owner' and update the references
> as a separate patch.
> - To prevent casting the 'encl_owner' field, introduce a union with
> another field - "vepc_vaddr".
> - Clean up the commit message of patch 02 suggested by Dave.
> - Remove patch 03 unless there is a better reason to keep it.
> - Add Reviewed-by from Jarkko.
>
> V4: https://lore.kernel.org/linux-sgx/20220608032654.1764936-1-
> zhiquan1.li@intel.com/T/#t
>
> Changes since V4:
> - Switch the order of the two variables at patch 02 so all of variables
> are in reverse Christmas style.
> - Do not initialize 'ret' because it will be overridden by the return
> value of force_sig_mceerr() unconditionally.
> - Add Co-developed-by and Signed-off-by from Cathy Zhang at patch 01.
> - Add Acked-by from Kai Huang at patch 01.
>
> V3: https://lore.kernel.org/linux-
> sgx/41704e5d4c03b49fcda12e695595211d950cfb08.camel@kernel.org/T/#t
>
> Changes since V3:
> - Take the definition of EPC page flag SGX_EPC_PAGE_KVM_GUEST from
> Cathy Zhang's third patch of SGX rebootless recovery patch set but
> discard irrelevant portion, since it might need some time to re-forge
> and these are two different features.
> Link: https://lore.kernel.org/linux-
> sgx/41704e5d4c03b49fcda12e695595211d950cfb08.camel@kernel.org/T/#m
> 9782d23496cacecb7da07a67daa79f4b322ae170
>
> V2: https://lore.kernel.org/linux-sgx/694234d7-6a0d-e85f-f2f9-
> e52b4a61e1ec@intel.com/T/#t
>
> Changes since V2:
> - Repurpose the owner field as the virtual address of virtual EPC page
> - Remove struct sgx_vepc_page and relevant code.
> - Remove patch 01 as the changes are not necessary in new design.
> - Rework patch 02 suggested by Jarkko.
> - Adapt patch 03 and 04 since struct sgx_vepc_page was discarded.
> - Replace EPC page flag SGX_EPC_PAGE_IS_VEPC with
> SGX_EPC_PAGE_KVM_GUEST as they are duplicated.
> Link: https://lore.kernel.org/linux-
> sgx/eb95b32ecf3d44a695610cf7f2816785@intel.com/T/#u
>
> V1: https://lore.kernel.org/linux-sgx/443cb425-009c-2784-56f4-
> 5e707122de76@intel.com/T/#t
>
> Changes since V1:
> - Updated cover letter and commit messages, added valuable
> information from Jarkko, Tony and Kai's comments.
> - Added documentations for struct struct sgx_vepc and
> struct sgx_vepc_page.
>
> Hi everyone,
>
> This series contains a few patches to fine grained SGX MCA behavior.
>
> Today, if a guest accesses an SGX EPC page with memory failure,
> the kernel behavior will kill the entire guest. This blast
> radius is too large. It would be idea to kill only the SGX
> application inside the guest.
>
> To fix this, send a SIGBUS to host userspace (like QEMU) which can
> follow up by injecting a #MC to the guest.
>
> However, when a page triggers a machine check, it only reports the
> PFN. But in order to inject #MC into hypervisor, the virtual address
> is required. The 'encl_owner' field is useless in virtualization
> case, then repurpose it as 'vepc_vaddr' - the virtual address of the
> virtual EPC page in such case so that arch_memory_failure() can easily
> retrieve it.
>
> Suppose an enclave is shared by multiple processes, when an enclave
> page triggers a machine check, the enclave will be disabled so that
> it couldn't be entered again. Killing other processes with the same
> enclave mapped would perhaps be overkill, but they are going to find
> that the enclave is "dead" next time they try to use it. Thanks for
> Jarkko’s head up and Tony’s clarification on this point.
>
> Unlike host enclaves, virtual EPC instance cannot be shared by multiple
> VMs. It is because how enclaves are created is totally up to the guest.
> Sharing virtual EPC instance will be very likely to unexpectedly break
> enclaves in all VMs.
>
> SGX virtual EPC driver doesn't explicitly prevent virtual EPC instance
> being shared by multiple VMs via fork(). However KVM doesn't support
> running a VM across multiple mm structures, and the de facto userspace
> hypervisor (Qemu) doesn't use fork() to create a new VM, so in practice
> this should not happen.
>
> This series is based on tip/x86/sgx.
>
> Tests:
> 1. MCE injection test for SGX in VM.
> As we expected, the application was killed and VM was alive.
> 2. Kernel selftest/sgx: PASS
> 3. Internal SGX stress test: PASS
> 4. kmemleak test: No memory leakage detected.
>
> Much appreciate your feedback.
>
> Best Regards,
> Zhiquan
>
> Zhiquan Li (3):
> x86/sgx: Rename the owner field of struct sgx_epc_page as encl_owner
> x86/sgx: Introduce union with vepc_vaddr field for virtualization case
> x86/sgx: Fine grained SGX MCA behavior for virtualization
>
> arch/x86/kernel/cpu/sgx/main.c | 48 +++++++++++++++++++++++++---------
> arch/x86/kernel/cpu/sgx/sgx.h | 8 +++++-
> arch/x86/kernel/cpu/sgx/virt.c | 4 ++-
> 3 files changed, 46 insertions(+), 14 deletions(-)
>
> --
> 2.25.1
prev parent reply other threads:[~2022-08-15 3:11 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-07-23 12:23 [PATCH v6 0/3] x86/sgx: fine grained SGX MCA behavior Zhiquan Li
2022-07-23 12:23 ` [PATCH v6 1/3] x86/sgx: Rename the owner field of struct sgx_epc_page as encl_owner Zhiquan Li
2022-07-23 12:23 ` [PATCH v6 2/3] x86/sgx: Introduce union with vepc_vaddr field for virtualization case Zhiquan Li
2022-07-23 12:23 ` [PATCH v6 3/3] x86/sgx: Fine grained SGX MCA behavior for virtualization Zhiquan Li
2022-08-15 3:11 ` Du, Fan [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=MN0PR11MB6181A14ED05182E44C1F5E6B99689@MN0PR11MB6181.namprd11.prod.outlook.com \
--to=fan.du@intel.com \
--cc=cathy.zhang@intel.com \
--cc=dave.hansen@linux.intel.com \
--cc=jarkko@kernel.org \
--cc=kai.huang@intel.com \
--cc=linux-sgx@vger.kernel.org \
--cc=seanjc@google.com \
--cc=tony.luck@intel.com \
--cc=zhiquan1.li@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).