A reclaimed page is represented by two entities:
1. A version number in the Enclave Page Cache (EPC). Version numbers are
stored in Version Array (VA) pages [1].
2. Page contents and MAC [2] encrypted with a random transient key and the
version number in the system memory.
This commit introduces a wrapper function for ENCLS[EWB], which transforms
a page from EPC to the system memory, resulting the forementioned entities.
The reason for having struct sgx_ewb_context is that the reclaiming process
can pin the resources in early phases of the page reclaiming process when a
clean rollback from a failure (e.g. running out of memory) is still
possible.
[1] Intel SDM: 37.18 VERSION ARRAY (VA)
[2] Intel SDM: 37.12 PAGING CRYPTO METADATA (PCMD)
Cc: Sean Christopherson <sean.j.christopherson@xxxxxxxxx>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@xxxxxxxxxxxxxxx>
---
arch/x86/kernel/cpu/sgx/encls.c | 33 +++++++++++++++++++++++++++++++++
arch/x86/kernel/cpu/sgx/encls.h | 10 ++++++++++
2 files changed, 43 insertions(+)
diff --git a/arch/x86/kernel/cpu/sgx/encls.c b/arch/x86/kernel/cpu/sgx/encls.c
index cda09cf8b927..06004b665d88 100644
--- a/arch/x86/kernel/cpu/sgx/encls.c
+++ b/arch/x86/kernel/cpu/sgx/encls.c
@@ -54,3 +54,36 @@ int sgx_einit(struct sgx_sigstruct *sigstruct, struct sgx_einittoken *token,
preempt_enable();
return ret;
}
+
+/**
+ * sgx_ewb() - Execute ENCLS[EWB]
+ * @ctx: a struct &sgx_ewb_context
+ *
+ * Execute ENCLS[EWB], which transforms a page from EPC to the system memory.
+ * @ctx should be initialized to reference all of the data needed in this
+ * process.
+ *
+ * Return:
+ * 0 on success,
+ * -errno or SGX error on failure
+ */
+int sgx_ewb(struct sgx_ewb_context *ctx)
+{
+ struct sgx_pageinfo pginfo;
+ int ret;
+
+ pginfo.addr = 0;
+ pginfo.contents = (unsigned long)kmap_atomic(ctx->contents);
+ pginfo.metadata = (unsigned long)kmap_atomic(ctx->pcmd) +
+ ctx->pcmd_offset;
+ pginfo.secs = 0;
+
+ ret = __ewb(&pginfo, sgx_epc_addr(ctx->page),
+ sgx_epc_addr(ctx->version_array) + ctx->version_offset);
+
+ kunmap_atomic((void *)(unsigned long)(pginfo.metadata -
+ ctx->pcmd_offset));
+ kunmap_atomic((void *)(unsigned long)pginfo.contents);
+
+ return ret;
+}
diff --git a/arch/x86/kernel/cpu/sgx/encls.h b/arch/x86/kernel/cpu/sgx/encls.h
index e3713337c187..d27cbc2f76e0 100644
--- a/arch/x86/kernel/cpu/sgx/encls.h
+++ b/arch/x86/kernel/cpu/sgx/encls.h
@@ -257,7 +257,17 @@ static inline int __emodt(struct sgx_secinfo *secinfo, void *addr)
return __encls_ret_2(SGX_EMODT, secinfo, addr);
}
+struct sgx_ewb_context {
+ struct sgx_epc_page *page;
+ struct page *contents;
+ struct page *pcmd;
+ unsigned long pcmd_offset;
+ struct sgx_epc_page *version_array;
+ unsigned long version_offset;
+};
+
int sgx_einit(struct sgx_sigstruct *sigstruct, struct sgx_einittoken *token,
struct sgx_epc_page *secs, u64 *lepubkeyhash);
+int sgx_ewb(struct sgx_ewb_context *ctx);
#endif /* _X86_ENCLS_H */
--
2.20.1
