x86/sgx: Add SGX_IOC_ENCLAVE_INIT

Browse source

Enclaves have two basic states. They are either being built and are
malleable and can be modified by doing things like adding pages. Or,
they are locked down and not accepting changes. They can only be run
after they have been locked down. The ENCLS[EINIT] function induces the
transition from being malleable to locked-down.

Add an ioctl() that performs ENCLS[EINIT]. After this, new pages can
no longer be added with ENCLS[EADD]. This is also the time where the
enclave can be measured to verify its integrity.

Co-developed-by: Sean Christopherson <sean.j.christopherson@intel.com>
Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Borislav Petkov <bp@suse.de>
Tested-by: Jethro Beekman <jethro@fortanix.com>
Link: https://lkml.kernel.org/r/20201112220135.165028-15-jarkko@kernel.org

...

This commit is contained in:

Jarkko Sakkinen 2020-11-13 00:01:25 +02:00 • committed by Borislav Petkov

parent c6d26d3707

commit 9d0c151b41

5 changed files with 241 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

11

arch/x86/include/uapi/asm/sgx.h

View file

27

arch/x86/kernel/cpu/sgx/driver.c

View file

8

arch/x86/kernel/cpu/sgx/driver.h

View file

3

arch/x86/kernel/cpu/sgx/encl.h

View file

193

arch/x86/kernel/cpu/sgx/ioctl.c

View file