From: Dave Hansen <dave.hansen@intel.com>
To: Pavel Machek <pavel@ucw.cz>,
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Cc: x86@kernel.org, platform-driver-x86@vger.kernel.org,
sean.j.christopherson@intel.com, nhorman@redhat.com,
npmccallum@redhat.com, serge.ayoun@intel.com,
shay.katz-zamir@intel.com, linux-sgx@vger.kernel.org,
andriy.shevchenko@linux.intel.com,
Jonathan Corbet <corbet@lwn.net>,
Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
"H. Peter Anvin" <hpa@zytor.com>,
"open list:DOCUMENTATION" <linux-doc@vger.kernel.org>,
open list <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH v14 19/19] x86/sgx: Driver documentation
Date: Wed, 17 Oct 2018 16:56:51 -0700 [thread overview]
Message-ID: <fe28962d-367b-b8bb-8280-fe48c7d08813@intel.com> (raw)
In-Reply-To: <20181015205436.GA28500@amd>
On 10/15/2018 01:54 PM, Pavel Machek wrote:
>> +Intel(R) SGX is a set of CPU instructions that can be used by applications to
>> +set aside private regions of code and data. The code outside the enclave is
>> +disallowed to access the memory inside the enclave by the CPU access control.
>> +In a way you can think that SGX provides inverted sandbox. It protects the
>> +application from a malicious host.
> Well, recently hardware had some problems keeping its
> promises. So... what about rowhammer, meltdown and spectre?
There's a ton of documentation out there about what kinds of protections
SGX provides. I don't think this is an appropriate place to have an
exhaustive discussion about it. But, there's extensive discussion of it
on Intel's security site:
https://software.intel.com/security-software-guidance/
There's documentation on how L1TF affects SGX here:
https://software.intel.com/security-software-guidance/software-guidance/l1-terminal-fault
Or Spectre v2 here:
https://software.intel.com/security-software-guidance/software-guidance/bounds-check-bypass
> Which ones apply, which ones do not, and on what cpu generations?
The CVEs list this in pretty exhaustive detail. The L1TF/SGX one, for
example:
https://nvd.nist.gov/vuln/detail/CVE-2018-3615
Lists a bunch of processor models.
prev parent reply other threads:[~2018-10-17 23:56 UTC|newest]
Thread overview: 71+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-09-25 13:06 [PATCH v14 00/19] Intel SGX1 support Jarkko Sakkinen
2018-09-25 13:06 ` [PATCH v14 01/19] x86/sgx: Update MAINTAINERS Jarkko Sakkinen
2018-09-25 13:06 ` [PATCH v14 02/19] x86/sgx: Architectural structures Jarkko Sakkinen
2018-09-25 13:06 ` [PATCH v14 03/19] x86/cpufeature: Add SGX and SGX_LC CPU features Jarkko Sakkinen
2018-09-25 13:06 ` [PATCH v14 04/19] x86/cpufeatures: Add SGX feature bits Jarkko Sakkinen
2018-09-25 16:48 ` Borislav Petkov
2018-09-26 11:11 ` Jarkko Sakkinen
2018-09-26 11:36 ` Borislav Petkov
2018-09-27 13:16 ` Jarkko Sakkinen
2018-09-27 13:51 ` Borislav Petkov
2018-09-27 14:52 ` Jarkko Sakkinen
2018-09-25 13:06 ` [PATCH v14 05/19] x86/msr: Add SGX definitions to msr-index.h Jarkko Sakkinen
2018-09-25 13:06 ` [PATCH v14 06/19] x86/mm: x86/sgx: Add new 'PF_SGX' page fault error code bit Jarkko Sakkinen
2018-09-25 13:06 ` [PATCH v14 07/19] x86/fault: x86/mm/pkeys: relocate stale comment regarding OSPKE Jarkko Sakkinen
2018-09-25 13:06 ` [PATCH v14 08/19] signal: x86/sgx: Add SIGSEGV siginfo code for SGX EPCM fault Jarkko Sakkinen
2018-09-26 19:14 ` Sean Christopherson
2018-09-27 18:41 ` Eric W. Biederman
2018-09-25 13:06 ` [PATCH v14 09/19] x86/mm: x86/sgx: Signal SEGV_SGXERR for #PFs w/ PF_SGX Jarkko Sakkinen
2018-09-25 22:53 ` Andy Lutomirski
2018-09-26 17:35 ` Sean Christopherson
2018-09-26 18:12 ` Andy Lutomirski
2018-09-26 20:16 ` Dave Hansen
2018-09-26 20:44 ` Sean Christopherson
2018-09-26 20:49 ` Dave Hansen
2018-09-26 21:15 ` Andy Lutomirski
2018-09-26 21:45 ` Dave Hansen
2018-09-26 22:37 ` Andy Lutomirski
2018-09-27 14:21 ` Jarkko Sakkinen
2018-09-27 14:41 ` Andy Lutomirski
2018-09-27 13:56 ` Jarkko Sakkinen
2018-10-01 21:42 ` Jethro Beekman
2018-10-01 22:03 ` Dave Hansen
2018-10-31 21:30 ` Sean Christopherson
2018-10-31 21:35 ` Dave Hansen
2018-11-01 17:42 ` Jarkko Sakkinen
2018-11-01 17:44 ` Jarkko Sakkinen
2018-10-02 0:31 ` Jarkko Sakkinen
2018-10-01 14:29 ` Sean Christopherson
2018-10-01 14:41 ` Dave Hansen
2018-10-02 0:07 ` Jarkko Sakkinen
2018-09-27 13:42 ` Jarkko Sakkinen
2018-09-27 14:58 ` Dave Hansen
2018-09-27 15:39 ` Jarkko Sakkinen
2018-09-27 15:53 ` Dave Hansen
2018-09-27 13:14 ` Jarkko Sakkinen
2018-09-27 19:43 ` Eric W. Biederman
2018-09-28 12:17 ` Jarkko Sakkinen
2018-09-25 13:06 ` [PATCH v14 10/19] x86/sgx: Detect Intel SGX Jarkko Sakkinen
2018-09-25 20:02 ` Randy Dunlap
2018-09-27 13:13 ` Jarkko Sakkinen
2018-09-25 13:06 ` [PATCH v14 11/19] x86/sgx: Add wrappers for ENCLS leaf functions Jarkko Sakkinen
2018-09-25 20:01 ` Randy Dunlap
2018-09-27 13:12 ` Jarkko Sakkinen
2018-09-25 13:06 ` [PATCH v14 12/19] x86/sgx: Add data structures for tracking the EPC pages Jarkko Sakkinen
2018-09-25 20:00 ` Randy Dunlap
2018-09-27 13:11 ` Jarkko Sakkinen
2018-09-25 13:06 ` [PATCH v14 13/19] x86/sgx: Enclave Page Cache (EPC) memory manager Jarkko Sakkinen
2018-09-25 13:06 ` [PATCH v14 14/19] x86/sgx: Add sgx_einit() for initializing enclaves Jarkko Sakkinen
2018-09-25 13:06 ` [PATCH v14 15/19] platform/x86: Intel SGX driver Jarkko Sakkinen
2018-10-04 18:01 ` Sean Christopherson
2018-10-05 11:32 ` Jarkko Sakkinen
2018-09-25 13:06 ` [PATCH v14 16/19] platform/x86: Add swapping functionality to the " Jarkko Sakkinen
2018-09-25 13:06 ` [PATCH v14 17/19] x86/sgx: Add a simple swapper for the EPC memory manager Jarkko Sakkinen
2018-09-25 13:06 ` [PATCH v14 18/19] platform/x86: ptrace() support for the SGX driver Jarkko Sakkinen
2018-09-25 13:06 ` [PATCH v14 19/19] x86/sgx: Driver documentation Jarkko Sakkinen
2018-09-25 13:27 ` Jonathan Corbet
2018-10-15 20:54 ` Pavel Machek
2018-10-17 23:45 ` Jarkko Sakkinen
2018-10-18 9:57 ` Pavel Machek
2018-10-19 23:59 ` Jarkko Sakkinen
2018-10-17 23:56 ` Dave Hansen [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=fe28962d-367b-b8bb-8280-fe48c7d08813@intel.com \
--to=dave.hansen@intel.com \
--cc=andriy.shevchenko@linux.intel.com \
--cc=bp@alien8.de \
--cc=corbet@lwn.net \
--cc=hpa@zytor.com \
--cc=jarkko.sakkinen@linux.intel.com \
--cc=linux-doc@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-sgx@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=nhorman@redhat.com \
--cc=npmccallum@redhat.com \
--cc=pavel@ucw.cz \
--cc=platform-driver-x86@vger.kernel.org \
--cc=sean.j.christopherson@intel.com \
--cc=serge.ayoun@intel.com \
--cc=shay.katz-zamir@intel.com \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome