From: Borislav Petkov <bp@alien8.de>
To: Cathy Zhang <cathy.zhang@intel.com>
Cc: linux-sgx@vger.kernel.org, x86@kernel.org, dave.hansen@intel.com,
lkml <linux-kernel@vger.kernel.org>
Subject: Re: [RFC PATCH 09/11] x86/microcode: Expose EUPDATESVN procedure via sysfs
Date: Wed, 9 Mar 2022 12:20:16 +0100 [thread overview]
Message-ID: <YiiNPWdsYtWiULZm@zn.tnic> (raw)
In-Reply-To: <20220309104050.18207-10-cathy.zhang@intel.com>
On all your patches for the future: don't forget to Cc LKML.
On Wed, Mar 09, 2022 at 06:40:48PM +0800, Cathy Zhang wrote:
> EUPDATESVN is the SGX instruction which allows enclave attestation
> to include information about updated microcode without a reboot.
>
> Microcode updates which affect SGX require two phases:
>
> 1. Do the main microcode update
> 2. Make the new CPUSVN available for enclave attestation via
> EUPDATESVN.
>
> Before a EUPDATESVN can succeed, all enclave pages (EPC) must be
> marked as unused in the SGX metadata (EPCM). This operation destroys
> all preexisting SGX enclave data and metadata. This is by design and
> mitigates the impact of vulnerabilities that may have compromised
> enclaves or the SGX hardware itself prior to the update.
>
> Signed-off-by: Cathy Zhang <cathy.zhang@intel.com>
> ---
> arch/x86/include/asm/microcode.h | 5 ++++
> arch/x86/include/asm/sgx.h | 5 ++++
> arch/x86/kernel/cpu/microcode/core.c | 44 ++++++++++++++++++++++++++++
Why is all this code here at all?
What does that have *actually* to do with microcode loading?
AFAICT, you want to hook into microcode_check() which runs after the
microcode update and do your EUPDATESVN there...
--
Regards/Gruss,
Boris.
https://people.kernel.org/tglx/notes-about-netiquette
next prev parent reply other threads:[~2022-03-09 11:20 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-03-09 10:40 [RFC PATCH 00/11] Support microcode updates affecting SGX Cathy Zhang
2022-03-09 10:40 ` [RFC PATCH 01/11] x86/sgx: Introduce mechanism to prevent new initializations of EPC pages Cathy Zhang
2022-03-09 10:40 ` [RFC PATCH 02/11] x86/sgx: Provide VA page non-NULL owner Cathy Zhang
2022-03-09 10:40 ` [RFC PATCH 03/11] x86/sgx: Save enclave pointer for VA page Cathy Zhang
2022-03-09 10:40 ` [RFC PATCH 04/11] x86/sgx: Keep record for SGX VA and Guest page type Cathy Zhang
2022-03-09 10:40 ` [RFC PATCH 05/11] x86/sgx: Save the size of each EPC section Cathy Zhang
2022-03-09 10:40 ` [RFC PATCH 06/11] x86/sgx: Forced EPC page zapping for EUPDATESVN Cathy Zhang
2022-03-09 10:40 ` [RFC PATCH 07/11] x86/sgx: Define error codes for ENCLS[EUPDATESVN] Cathy Zhang
2022-03-09 10:40 ` [RFC PATCH 08/11] x86/sgx: Implement ENCLS[EUPDATESVN] Cathy Zhang
2022-03-09 10:40 ` [RFC PATCH 09/11] x86/microcode: Expose EUPDATESVN procedure via sysfs Cathy Zhang
2022-03-09 11:20 ` Borislav Petkov [this message]
2022-03-09 15:42 ` Dave Hansen
2022-03-09 15:48 ` Borislav Petkov
2022-03-10 5:15 ` Zhang, Cathy
2022-03-09 10:40 ` [RFC PATCH 10/11] x86/sgx: Call ENCLS[EUPDATESVN] during SGX initialization Cathy Zhang
2022-03-09 10:40 ` [RFC PATCH 11/11] Documentation/x86/sgx: Document EUPDATESVN sysfs file Cathy Zhang
2022-03-09 19:01 ` [RFC PATCH 00/11] Support microcode updates affecting SGX Thomas Gleixner
2022-03-09 19:14 ` Dave Hansen
2022-03-09 19:36 ` Borislav Petkov
2022-03-09 19:52 ` Dave Hansen
2022-03-09 20:15 ` Thomas Gleixner
2022-03-09 20:32 ` Dave Hansen
2022-03-09 20:48 ` Raj, Ashok
2022-03-09 23:09 ` Thomas Gleixner
2022-03-10 5:24 ` Zhang, Cathy
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YiiNPWdsYtWiULZm@zn.tnic \
--to=bp@alien8.de \
--cc=cathy.zhang@intel.com \
--cc=dave.hansen@intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-sgx@vger.kernel.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.