[0/2] x86/sgx: Limit EPC overcommit

Message

Kristen Carlson Accardi Dec. 20, 2021, 5:46 p.m. UTC

SGX currently allows EPC pages to be overcommitted. If the system is
out of enclave memory, EPC pages are swapped to normal RAM via
a per enclave shared memory area. This shared memory is not charged
to the enclave or the task mapping it, making it hard to account
for using normal methods. Since SGX will allow EPC pages to be
overcommitted without limits, enclaves can consume system memory
for these backing pages without limits.

In order to prevent this, set a cap on the amount of overcommit SGX
allows based on a module param which can be set at boot time. Then,
whenever a backing page is requested by an enclave, keep track of
the total amount of shared memory pages used across all enclaves and
return an error if the overcommit limit has been reached. This will
restrict the total amount of backing pages that all enclaves can
consume to a maximum amount, and prevent enclaves from consuming
all the system RAM for backing pages.

The overcommit percentage has a default value of 100, which
limits shared memory page consumption to equal to the number of
EPC pages in the system. If sgx.overcommit_percent is set to a
negative value, SGX will not place any limits on the amount of
overcommit that might be requested, and SGX will behave as it has
previously without the sgx.overcommit_percent limit.


Kristen Carlson Accardi (2):
  x86/sgx: Add accounting for tracking overcommit
  x86/sgx: account backing pages

 .../admin-guide/kernel-parameters.txt         |  7 ++
 Documentation/x86/sgx.rst                     | 16 +++-
 arch/x86/kernel/cpu/sgx/Makefile              |  6 +-
 arch/x86/kernel/cpu/sgx/encl.c                | 76 ++++++++++++++++++-
 arch/x86/kernel/cpu/sgx/encl.h                |  6 +-
 arch/x86/kernel/cpu/sgx/main.c                | 70 ++++++++++++++++-
 arch/x86/kernel/cpu/sgx/sgx.h                 |  2 +
 7 files changed, 173 insertions(+), 10 deletions(-)