SGX EPC pages go through the following life cycle:
DIRTY ---> FREE ---> IN-USE --\
^ |
\-----------------/
Recovery action for poison for a DIRTY or FREE page is simple. Just
make sure never to allocate the page. IN-USE pages need some extra
handling.
It would be good to use the sgx_epc_page->owner field as an indicator
of where an EPC page is currently in that cycle (owner != NULL means
the EPC page is IN-USE). But there is one caller, sgx_alloc_va_page(),
that calls with NULL.
Make the following changes:
1) Change the type of "owner" to "void *" (it can have other types
besides "struct sgx_encl_page *).
2) Update sgx_alloc_va_page() to pass in a dummy non-NULL value in
this case.
3) Add a check to sgx_free_epc_page() to prevent calling with NULL.
4) Reset owner to NULL in sgx_free_epc_page().
Signed-off-by: Tony Luck <[email protected]>
---
arch/x86/kernel/cpu/sgx/encl.c | 2 +-
arch/x86/kernel/cpu/sgx/main.c | 6 ++++++
arch/x86/kernel/cpu/sgx/sgx.h | 2 +-
3 files changed, 8 insertions(+), 2 deletions(-)
diff --git a/arch/x86/kernel/cpu/sgx/encl.c b/arch/x86/kernel/cpu/sgx/encl.c
index 001808e3901c..ca328d56d230 100644
--- a/arch/x86/kernel/cpu/sgx/encl.c
+++ b/arch/x86/kernel/cpu/sgx/encl.c
@@ -679,7 +679,7 @@ struct sgx_epc_page *sgx_alloc_va_page(void)
struct sgx_epc_page *epc_page;
int ret;
- epc_page = sgx_alloc_epc_page(NULL, true);
+ epc_page = sgx_alloc_epc_page("Not NULL!", true);
if (IS_ERR(epc_page))
return ERR_CAST(epc_page);
diff --git a/arch/x86/kernel/cpu/sgx/main.c b/arch/x86/kernel/cpu/sgx/main.c
index 63d3de02bbcc..d61bc1f635a1 100644
--- a/arch/x86/kernel/cpu/sgx/main.c
+++ b/arch/x86/kernel/cpu/sgx/main.c
@@ -578,6 +578,11 @@ struct sgx_epc_page *sgx_alloc_epc_page(void *owner, bool reclaim)
{
struct sgx_epc_page *page;
+ if (!owner) {
+ WARN_ON_ONCE(1);
+ return NULL;
+ }
+
for ( ; ; ) {
page = __sgx_alloc_epc_page();
if (!IS_ERR(page)) {
@@ -624,6 +629,7 @@ void sgx_free_epc_page(struct sgx_epc_page *page)
spin_lock(&node->lock);
+ page->owner = NULL;
list_add_tail(&page->list, &node->free_page_list);
sgx_nr_free_pages++;
diff --git a/arch/x86/kernel/cpu/sgx/sgx.h b/arch/x86/kernel/cpu/sgx/sgx.h
index 4628acec0009..4e1a410b8a62 100644
--- a/arch/x86/kernel/cpu/sgx/sgx.h
+++ b/arch/x86/kernel/cpu/sgx/sgx.h
@@ -29,7 +29,7 @@
struct sgx_epc_page {
unsigned int section;
unsigned int flags;
- struct sgx_encl_page *owner;
+ void *owner;
struct list_head list;
};
--
2.29.2
On 7/19/21 11:20 AM, Tony Luck wrote:
> 1) Change the type of "owner" to "void *" (it can have other types
> besides "struct sgx_encl_page *).
I see:
static int __sgx_vepc_fault(struct sgx_vepc *vepc,
{
...
epc_page = sgx_alloc_epc_page(vepc, false);
where sgx_alloc_epc_page() sets page->owner=vepc. But, I don't see a
*reader* anywhere. Do we actually use that vepc anywhere?
On Mon, 2021-07-19 at 11:20 -0700, Tony Luck wrote:
> SGX EPC pages go through the following life cycle:
>
> DIRTY ---> FREE ---> IN-USE --\
> ^ |
> \-----------------/
>
> Recovery action for poison for a DIRTY or FREE page is simple. Just
> make sure never to allocate the page. IN-USE pages need some extra
> handling.
>
> It would be good to use the sgx_epc_page->owner field as an indicator
> of where an EPC page is currently in that cycle (owner != NULL means
> the EPC page is IN-USE). But there is one caller, sgx_alloc_va_page(),
> that calls with NULL.
>
> Make the following changes:
>
> 1) Change the type of "owner" to "void *" (it can have other types
> besides "struct sgx_encl_page *).
> 2) Update sgx_alloc_va_page() to pass in a dummy non-NULL value in
> this case.
> 3) Add a check to sgx_free_epc_page() to prevent calling with NULL.
> 4) Reset owner to NULL in sgx_free_epc_page().
>
> Signed-off-by: Tony Luck <[email protected]>
> ---
> arch/x86/kernel/cpu/sgx/encl.c | 2 +-
> arch/x86/kernel/cpu/sgx/main.c | 6 ++++++
> arch/x86/kernel/cpu/sgx/sgx.h | 2 +-
> 3 files changed, 8 insertions(+), 2 deletions(-)
>
> diff --git a/arch/x86/kernel/cpu/sgx/encl.c b/arch/x86/kernel/cpu/sgx/encl.c
> index 001808e3901c..ca328d56d230 100644
> --- a/arch/x86/kernel/cpu/sgx/encl.c
> +++ b/arch/x86/kernel/cpu/sgx/encl.c
> @@ -679,7 +679,7 @@ struct sgx_epc_page *sgx_alloc_va_page(void)
> struct sgx_epc_page *epc_page;
> int ret;
>
> - epc_page = sgx_alloc_epc_page(NULL, true);
> + epc_page = sgx_alloc_epc_page("Not NULL!", true);
I would instead set owner to epc_page inside sgx_alloc_epc_page(),
when NULL is passed to owner. That would be semantically sound.
/Jarkko