mirror of
https://git.proxmox.com/git/mirror_ubuntu-kernels.git
synced 2025-12-10 00:17:18 +00:00
45d546b8c1
Every enclave contains one or more Thread Control Structures (TCS). The TCS contains meta-data used by the hardware to save and restore thread specific information when entering/exiting the enclave. With SGX1 an enclave needs to be created with enough TCSs to support the largest number of threads expecting to use the enclave and enough enclave pages to meet all its anticipated memory demands. In SGX1 all pages remain in the enclave until the enclave is unloaded. SGX2 introduces a new function, ENCLS[EMODT], that is used to change the type of an enclave page from a regular (SGX_PAGE_TYPE_REG) enclave page to a TCS (SGX_PAGE_TYPE_TCS) page or change the type from a regular (SGX_PAGE_TYPE_REG) or TCS (SGX_PAGE_TYPE_TCS) page to a trimmed (SGX_PAGE_TYPE_TRIM) page (setting it up for later removal). With the existing support of dynamically adding regular enclave pages to an initialized enclave and changing the page type to TCS it is possible to dynamically increase the number of threads supported by an enclave. Changing the enclave page type to SGX_PAGE_TYPE_TRIM is the first step of dynamically removing pages from an initialized enclave. The complete page removal flow is: 1) Change the type of the pages to be removed to SGX_PAGE_TYPE_TRIM using the SGX_IOC_ENCLAVE_MODIFY_TYPES ioctl() introduced here. 2) Approve the page removal by running ENCLU[EACCEPT] from within the enclave. 3) Initiate actual page removal using the ioctl() introduced in the following patch. Add ioctl() SGX_IOC_ENCLAVE_MODIFY_TYPES to support changing SGX enclave page types within an initialized enclave. With SGX_IOC_ENCLAVE_MODIFY_TYPES the user specifies a page range and the enclave page type to be applied to all pages in the provided range. The ioctl() itself can return an error code based on failures encountered by the kernel. It is also possible for SGX specific failures to be encountered. Add a result output parameter to communicate the SGX return code. It is possible for the enclave page type change request to fail on any page within the provided range. Support partial success by returning the number of pages that were successfully changed. After the page type is changed the page continues to be accessible from the kernel perspective with page table entries and internal state. The page may be moved to swap. Any access until ENCLU[EACCEPT] will encounter a page fault with SGX flag set in error code. Signed-off-by: Reinette Chatre <reinette.chatre@intel.com> Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> Tested-by: Jarkko Sakkinen <jarkko@kernel.org> Tested-by: Haitao Huang <haitao.huang@intel.com> Tested-by: Vijay Dhanraj <vijay.dhanraj@intel.com> Link: https://lkml.kernel.org/r/babe39318c5bf16fc65fbfb38896cdee72161575.1652137848.git.reinette.chatre@intel.com |
||
|---|---|---|
| .. | ||
| acpi | ||
| apic | ||
| cpu | ||
| fpu | ||
| kprobes | ||
| .gitignore | ||
| alternative.c | ||
| amd_gart_64.c | ||
| amd_nb.c | ||
| aperture_64.c | ||
| apm_32.c | ||
| asm-offsets_32.c | ||
| asm-offsets_64.c | ||
| asm-offsets.c | ||
| audit_64.c | ||
| bootflag.c | ||
| check.c | ||
| cpuid.c | ||
| crash_core_32.c | ||
| crash_core_64.c | ||
| crash_dump_32.c | ||
| crash_dump_64.c | ||
| crash.c | ||
| devicetree.c | ||
| doublefault_32.c | ||
| dumpstack_32.c | ||
| dumpstack_64.c | ||
| dumpstack.c | ||
| e820.c | ||
| early_printk.c | ||
| early-quirks.c | ||
| ebda.c | ||
| eisa.c | ||
| espfix_64.c | ||
| ftrace_32.S | ||
| ftrace_64.S | ||
| ftrace.c | ||
| head32.c | ||
| head64.c | ||
| head_32.S | ||
| head_64.S | ||
| hpet.c | ||
| hw_breakpoint.c | ||
| i8237.c | ||
| i8253.c | ||
| i8259.c | ||
| idt.c | ||
| io_delay.c | ||
| ioport.c | ||
| irq_32.c | ||
| irq_64.c | ||
| irq_work.c | ||
| irq.c | ||
| irqflags.S | ||
| irqinit.c | ||
| itmt.c | ||
| jailhouse.c | ||
| jump_label.c | ||
| kdebugfs.c | ||
| kexec-bzimage64.c | ||
| kgdb.c | ||
| ksysfs.c | ||
| kvm.c | ||
| kvmclock.c | ||
| ldt.c | ||
| machine_kexec_32.c | ||
| machine_kexec_64.c | ||
| Makefile | ||
| mmconf-fam10h_64.c | ||
| module.c | ||
| mpparse.c | ||
| msr.c | ||
| nmi_selftest.c | ||
| nmi.c | ||
| paravirt-spinlocks.c | ||
| paravirt.c | ||
| pci-dma.c | ||
| pci-iommu_table.c | ||
| pci-swiotlb.c | ||
| pcspeaker.c | ||
| perf_regs.c | ||
| platform-quirks.c | ||
| pmem.c | ||
| probe_roms.c | ||
| process_32.c | ||
| process_64.c | ||
| process.c | ||
| process.h | ||
| ptrace.c | ||
| pvclock.c | ||
| quirks.c | ||
| reboot_fixups_32.c | ||
| reboot.c | ||
| relocate_kernel_32.S | ||
| relocate_kernel_64.S | ||
| resource.c | ||
| rethook.c | ||
| rtc.c | ||
| setup_percpu.c | ||
| setup.c | ||
| sev_verify_cbit.S | ||
| sev-shared.c | ||
| sev.c | ||
| signal_compat.c | ||
| signal.c | ||
| smp.c | ||
| smpboot.c | ||
| stacktrace.c | ||
| static_call.c | ||
| step.c | ||
| sys_ia32.c | ||
| sys_x86_64.c | ||
| tboot.c | ||
| time.c | ||
| tls.c | ||
| tls.h | ||
| topology.c | ||
| trace_clock.c | ||
| trace.c | ||
| tracepoint.c | ||
| traps.c | ||
| tsc_msr.c | ||
| tsc_sync.c | ||
| tsc.c | ||
| umip.c | ||
| unwind_frame.c | ||
| unwind_guess.c | ||
| unwind_orc.c | ||
| uprobes.c | ||
| verify_cpu.S | ||
| vm86_32.c | ||
| vmlinux.lds.S | ||
| vsmp_64.c | ||
| x86_init.c | ||