![]() [ Upstream commit 65be5c95d08eedda570a6c888a12384c77fe7614 ] The kernel requires X86_FEATURE_SGX_LC to be able to create SGX enclaves, not just X86_FEATURE_SGX. There is quite a number of hardware which has X86_FEATURE_SGX but not X86_FEATURE_SGX_LC. A kernel running on such hardware does not create the /dev/sgx_enclave file and does so silently. Explicitly warn if X86_FEATURE_SGX_LC is not enabled to properly notify users that the kernel disabled the SGX driver. The X86_FEATURE_SGX_LC, a.k.a. SGX Launch Control, is a CPU feature that enables LE (Launch Enclave) hash MSRs to be writable (with additional opt-in required in the 'feature control' MSR) when running enclaves, i.e. using a custom root key rather than the Intel proprietary key for enclave signing. I've hit this issue myself and have spent some time researching where my /dev/sgx_enclave file went on SGX-enabled hardware. Related links: https://github.com/intel/linux-sgx/issues/837 https://patchwork.kernel.org/project/platform-driver-x86/patch/20180827185507.17087-3-jarkko.sakkinen@linux.intel.com/ [ mingo: Made the error message a bit more verbose, and added other cases where the kernel fails to create the /dev/sgx_enclave device node. ] Signed-off-by: Vladis Dronov <vdronov@redhat.com> Signed-off-by: Ingo Molnar <mingo@kernel.org> Acked-by: Kai Huang <kai.huang@intel.com> Cc: Jarkko Sakkinen <jarkko@kernel.org> Cc: Andy Lutomirski <luto@kernel.org> Cc: Sean Christopherson <sean.j.christopherson@intel.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Link: https://lore.kernel.org/r/20250309172215.21777-2-vdronov@redhat.com Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
---|---|---|
.. | ||
acpi | ||
apic | ||
cpu | ||
fpu | ||
kprobes | ||
.gitignore | ||
alternative.c | ||
amd_gart_64.c | ||
amd_nb.c | ||
aperture_64.c | ||
apm_32.c | ||
asm-offsets_32.c | ||
asm-offsets_64.c | ||
asm-offsets.c | ||
audit_64.c | ||
bootflag.c | ||
cfi.c | ||
check.c | ||
cpuid.c | ||
crash_core_32.c | ||
crash_core_64.c | ||
crash_dump_32.c | ||
crash_dump_64.c | ||
crash.c | ||
devicetree.c | ||
doublefault_32.c | ||
dumpstack_32.c | ||
dumpstack_64.c | ||
dumpstack.c | ||
e820.c | ||
early_printk.c | ||
early-quirks.c | ||
ebda.c | ||
eisa.c | ||
espfix_64.c | ||
ftrace_32.S | ||
ftrace_64.S | ||
ftrace.c | ||
head32.c | ||
head64.c | ||
head_32.S | ||
head_64.S | ||
hpet.c | ||
hw_breakpoint.c | ||
i8237.c | ||
i8253.c | ||
i8259.c | ||
idt.c | ||
io_delay.c | ||
ioport.c | ||
irq_32.c | ||
irq_64.c | ||
irq_work.c | ||
irq.c | ||
irqflags.S | ||
irqinit.c | ||
itmt.c | ||
jailhouse.c | ||
jump_label.c | ||
kdebugfs.c | ||
kexec-bzimage64.c | ||
kgdb.c | ||
ksysfs.c | ||
kvm.c | ||
kvmclock.c | ||
ldt.c | ||
machine_kexec_32.c | ||
machine_kexec_64.c | ||
Makefile | ||
mmconf-fam10h_64.c | ||
module.c | ||
mpparse.c | ||
msr.c | ||
nmi_selftest.c | ||
nmi.c | ||
paravirt-spinlocks.c | ||
paravirt.c | ||
pci-dma.c | ||
pcspeaker.c | ||
perf_regs.c | ||
platform-quirks.c | ||
pmem.c | ||
probe_roms.c | ||
process_32.c | ||
process_64.c | ||
process.c | ||
process.h | ||
ptrace.c | ||
pvclock.c | ||
quirks.c | ||
reboot_fixups_32.c | ||
reboot.c | ||
relocate_kernel_32.S | ||
relocate_kernel_64.S | ||
resource.c | ||
rethook.c | ||
rtc.c | ||
setup_percpu.c | ||
setup.c | ||
sev_verify_cbit.S | ||
sev-shared.c | ||
sev.c | ||
signal_compat.c | ||
signal.c | ||
smp.c | ||
smpboot.c | ||
stacktrace.c | ||
static_call.c | ||
step.c | ||
sys_ia32.c | ||
sys_x86_64.c | ||
tboot.c | ||
time.c | ||
tls.c | ||
tls.h | ||
topology.c | ||
trace_clock.c | ||
trace.c | ||
tracepoint.c | ||
traps.c | ||
tsc_msr.c | ||
tsc_sync.c | ||
tsc.c | ||
umip.c | ||
unwind_frame.c | ||
unwind_guess.c | ||
unwind_orc.c | ||
uprobes.c | ||
verify_cpu.S | ||
vm86_32.c | ||
vmlinux.lds.S | ||
vsmp_64.c | ||
x86_init.c |