[devel-5.10] Intel-SIG: backport some SGX fixes to 5.10 - part1 · Pull Request !4509 · anolis/cloud-kernel

bugzilla: https://bugzilla.openanolis.cn/show_bug.cgi?id=13561

This PR includes incremental backporting patches which mainly covers some SGX bugfix.

**About the patches** 
The total patch number is 9:
```c
7efb4d8a392a KVM: VMX: Also clear SGX EDECCSSA in KVM CPU caps when SGX is disabled
2e52ac6b8e2e x86/sgx: Add overflow check in sgx_validate_offset_length()
16a7fe3728a8 KVM/VMX: Allow exposing EDECCSSA user leaf function to KVM guest
370839c241f7 x86/sgx: Allow enclaves to use Asynchrounous Exit Notification
7b72c823ddf8 x86/sgx: Reduce delay and interference of enclave release
ee56a283988d x86/sgx: Improve comments for sgx_encl_lookup/alloc_backing()
81fa6fd13b5c x86/sgx: Handle VA page allocation failure for EAUG on PF.
133e049a3f8c x86/sgx: Do not fail on incomplete sanitization on premature stop of ksgxd
5f4d1fd5b5d3 selftests/sgx: Ignore OpenSSL 3.0 deprecated functions warning
```

**Tests**

1. Build successfully for each commits
2. Kernel selftest - SGX: PASSED
```
cd tools/testing/selftests/sgx/
make
./test_sgx
```
3. Kernel selftest - SGX in VM: PASSED
4. Function test
Step 1. Original SGX EDECCSSA status in guest
```sh
[root@guest ~]# cpuid -1 -l 0x12
CPU:
   Software Guard Extensions (SGX) capability (0x12/0):
      SGX1 supported                           = true
      SGX2 supported                           = true
      SGX ENCLV E*VIRTCHILD, ESETCONTEXT       = false
      SGX ENCLS ETRACKC, ERDINFO, ELDBC, ELDUC = false
      SGX ENCLU EVERIFYREPORT2                 = false
      SGX ENCLS EUPDATESVN                     = false
      SGX ENCLU EDECCSSA                       = true
      MISCSELECT.EXINFO supported: #PF & #GP   = true
      MISCSELECT.CPINFO supported: #CP         = false
      MaxEnclaveSize_Not64 (log2)              = 0x1f (31)
      MaxEnclaveSize_64 (log2)                 = 0x38 (56)
```

Step 2. Disable SGX in guest
```sh
root@KVM-host:~# rmmod kvm_intel
root@KVM-host:~# modprobe kvm_intel sgx=0 
```

Step 3. The SGX EDECCSSA capability is cleared in KVM, then its status becomes `false`
```sh
[root@guest ~]# cpuid -1 -l 0x12
CPU:
   Software Guard Extensions (SGX) capability (0x12/0):
      SGX1 supported                           = false
      SGX2 supported                           = false
      SGX ENCLV E*VIRTCHILD, ESETCONTEXT       = false
      SGX ENCLS ETRACKC, ERDINFO, ELDBC, ELDUC = false
      SGX ENCLU EVERIFYREPORT2                 = false
      SGX ENCLS EUPDATESVN                     = false
      SGX ENCLU EDECCSSA                       = false
      MISCSELECT.EXINFO supported: #PF & #GP   = false
      MISCSELECT.CPINFO supported: #CP         = false
      MaxEnclaveSize_Not64 (log2)              = 0x0 (0)
      MaxEnclaveSize_64 (log2)                 = 0x0 (0)
[root@TDX-guest ~]# 
```

**Known issue:** 
None

**Default config change:** 
None

类型	指派人员	状态
审查	Guanjun Artie Ding guobin zelindeng Xuchun Shang	已完成 (0/0人)
测试	小龙已测试通过	已完成 (1/1人)

GVPanolis/cloud-kernel

搜索帮助

GVP anolis/cloud-kernel