[PATCH 1/2] x86/sgx: Wrap ENCLS[EWB]

* [PATCH 1/2] x86/sgx: Wrap ENCLS[EWB]
@ 2019-09-12 19:38 Jarkko Sakkinen
  2019-09-12 19:38 ` [PATCH 2/2] x86/sgx: Take sgx_ewb() into use Jarkko Sakkinen
  2019-09-14 12:22 ` [PATCH 1/2] x86/sgx: Wrap ENCLS[EWB] Jarkko Sakkinen
  0 siblings, 2 replies; 3+ messages in thread
From: Jarkko Sakkinen @ 2019-09-12 19:38 UTC (permalink / raw)
  To: linux-sgx
  Cc: sean.j.christopherson, serge.ayoun, shay.katz-zamir, Jarkko Sakkinen

A reclaimed page is represented by two entities:

1. A version number in the Enclave Page Cache (EPC). Version numbers are
   stored in Version Array (VA) pages [1].
2. Page contents and MAC [2] encrypted with a random transient key and the
   version number in the system memory.

This commit introduces a wrapper function for ENCLS[EWB], which transforms
a page from EPC to the system memory, resulting the forementioned entities.
The reason for having struct sgx_ewb_context is that the reclaiming process
can pin the resources in early phases of the page reclaiming process when a
clean rollback from a failure (e.g. running out of memory) is still
possible.

[1] Intel SDM: 37.18 VERSION ARRAY (VA)
[2] Intel SDM: 37.12 PAGING CRYPTO METADATA (PCMD)

Cc: Sean Christopherson <sean.j.christopherson@intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
---
 arch/x86/kernel/cpu/sgx/encls.c | 33 +++++++++++++++++++++++++++++++++
 arch/x86/kernel/cpu/sgx/encls.h | 10 ++++++++++
 2 files changed, 43 insertions(+)

diff --git a/arch/x86/kernel/cpu/sgx/encls.c b/arch/x86/kernel/cpu/sgx/encls.c
index cda09cf8b927..06004b665d88 100644
--- a/arch/x86/kernel/cpu/sgx/encls.c
+++ b/arch/x86/kernel/cpu/sgx/encls.c
@@ -54,3 +54,36 @@ int sgx_einit(struct sgx_sigstruct *sigstruct, struct sgx_einittoken *token,
 	preempt_enable();
 	return ret;
 }
+
+/**
+ * sgx_ewb() - Execute ENCLS[EWB]
+ * @ctx:		a struct &sgx_ewb_context
+ *
+ * Execute ENCLS[EWB], which transforms a page from EPC to the system memory.
+ * @ctx should be initialized to reference all of the data needed in this
+ * process.
+ *
+ * Return:
+ *   0 on success,
+ *   -errno or SGX error on failure
+ */
+int sgx_ewb(struct sgx_ewb_context *ctx)
+{
+	struct sgx_pageinfo pginfo;
+	int ret;
+
+	pginfo.addr = 0;
+	pginfo.contents = (unsigned long)kmap_atomic(ctx->contents);
+	pginfo.metadata = (unsigned long)kmap_atomic(ctx->pcmd) +
+						     ctx->pcmd_offset;
+	pginfo.secs = 0;
+
+	ret = __ewb(&pginfo, sgx_epc_addr(ctx->page),
+		    sgx_epc_addr(ctx->version_array) + ctx->version_offset);
+
+	kunmap_atomic((void *)(unsigned long)(pginfo.metadata -
+					      ctx->pcmd_offset));
+	kunmap_atomic((void *)(unsigned long)pginfo.contents);
+
+	return ret;
+}
diff --git a/arch/x86/kernel/cpu/sgx/encls.h b/arch/x86/kernel/cpu/sgx/encls.h
index e3713337c187..d27cbc2f76e0 100644
--- a/arch/x86/kernel/cpu/sgx/encls.h
+++ b/arch/x86/kernel/cpu/sgx/encls.h
@@ -257,7 +257,17 @@ static inline int __emodt(struct sgx_secinfo *secinfo, void *addr)
 	return __encls_ret_2(SGX_EMODT, secinfo, addr);
 }
 
+struct sgx_ewb_context {
+	struct sgx_epc_page *page;
+	struct page *contents;
+	struct page *pcmd;
+	unsigned long pcmd_offset;
+	struct sgx_epc_page *version_array;
+	unsigned long version_offset;
+};
+
 int sgx_einit(struct sgx_sigstruct *sigstruct, struct sgx_einittoken *token,
 	      struct sgx_epc_page *secs, u64 *lepubkeyhash);
+int sgx_ewb(struct sgx_ewb_context *ctx);
 
 #endif /* _X86_ENCLS_H */
-- 
2.20.1


^ permalink raw reply related	[flat|nested] 3+ messages in thread