| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20190727055214.9282-4-sean.j.christopherson@intel.com>
Date: Fri, 26 Jul 2019 22:51:56 -0700
From: Sean Christopherson <sean.j.christopherson@...el.com>
To: Paolo Bonzini <pbonzini@...hat.com>,
Radim Krčmář <rkrcmar@...hat.com>,
Thomas Gleixner <tglx@...utronix.de>,
Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
x86@...nel.org, Jarkko Sakkinen <jarkko.sakkinen@...ux.intel.com>,
Sean Christopherson <sean.j.christopherson@...el.com>,
Joerg Roedel <joro@...tes.org>
Cc: "H. Peter Anvin" <hpa@...or.com>, kvm@...r.kernel.org,
linux-kernel@...r.kernel.org, linux-sgx@...r.kernel.org,
Andy Lutomirski <luto@...capital.net>
Subject: [RFC PATCH 03/21] x86/sgx: Move provisioning device to common code
Move the provisioning device to common code in preparation for adding
support for SGX virtualization. The provisioning device will need to be
instantiated if the native SGX driver *or* the virtual EPC "driver" is
loaded.
Signed-off-by: Sean Christopherson <sean.j.christopherson@...el.com>
---
arch/x86/kernel/cpu/sgx/driver/ioctl.c | 18 ++---------
arch/x86/kernel/cpu/sgx/driver/main.c | 24 +-------------
arch/x86/kernel/cpu/sgx/main.c | 44 +++++++++++++++++++++++++-
arch/x86/kernel/cpu/sgx/sgx.h | 1 +
4 files changed, 47 insertions(+), 40 deletions(-)
diff --git a/arch/x86/kernel/cpu/sgx/driver/ioctl.c b/arch/x86/kernel/cpu/sgx/driver/ioctl.c
index 89b3fb81c15b..b7aa06920d10 100644
--- a/arch/x86/kernel/cpu/sgx/driver/ioctl.c
+++ b/arch/x86/kernel/cpu/sgx/driver/ioctl.c
@@ -794,26 +794,12 @@ static long sgx_ioc_enclave_set_attribute(struct file *filep, void __user *arg)
{
struct sgx_encl *encl = filep->private_data;
struct sgx_enclave_set_attribute params;
- struct file *attribute_file;
- int ret;
if (copy_from_user(¶ms, arg, sizeof(params)))
return -EFAULT;
- attribute_file = fget(params.attribute_fd);
- if (!attribute_file)
- return -EINVAL;
-
- if (attribute_file->f_op != &sgx_provision_fops) {
- ret = -EINVAL;
- goto out;
- }
-
- encl->allowed_attributes |= SGX_ATTR_PROVISIONKEY;
-
-out:
- fput(attribute_file);
- return ret;
+ return sgx_set_attribute(&encl->allowed_attributes,
+ params.attribute_fd);
}
long sgx_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
diff --git a/arch/x86/kernel/cpu/sgx/driver/main.c b/arch/x86/kernel/cpu/sgx/driver/main.c
index d62bdc7ed4d9..1e107dd0d909 100644
--- a/arch/x86/kernel/cpu/sgx/driver/main.c
+++ b/arch/x86/kernel/cpu/sgx/driver/main.c
@@ -154,14 +154,8 @@ static const struct file_operations sgx_encl_fops = {
.get_unmapped_area = sgx_get_unmapped_area,
};
-const struct file_operations sgx_provision_fops = {
- .owner = THIS_MODULE,
-};
-
static struct device sgx_encl_dev;
static struct cdev sgx_encl_cdev;
-static struct device sgx_provision_dev;
-static struct cdev sgx_provision_cdev;
int __init sgx_drv_init(void)
{
@@ -202,38 +196,22 @@ int __init sgx_drv_init(void)
if (ret)
return ret;
- ret = sgx_dev_init("sgx/provision", &sgx_provision_dev,
- &sgx_provision_cdev, &sgx_provision_fops,
- SGX_PROV_DEV_MINOR);
- if (ret)
- goto err_encl_dev;
-
sgx_encl_wq = alloc_workqueue("sgx-encl-wq",
WQ_UNBOUND | WQ_FREEZABLE, 1);
if (!sgx_encl_wq) {
ret = -ENOMEM;
- goto err_provision_dev;
+ goto err_encl_dev;
}
ret = cdev_device_add(&sgx_encl_cdev, &sgx_encl_dev);
if (ret)
goto err_encl_wq;
- ret = cdev_device_add(&sgx_provision_cdev, &sgx_provision_dev);
- if (ret)
- goto err_encl_cdev;
-
return 0;
-err_encl_cdev:
- cdev_device_del(&sgx_encl_cdev, &sgx_encl_dev);
-
err_encl_wq:
destroy_workqueue(sgx_encl_wq);
-err_provision_dev:
- put_device(&sgx_provision_dev);
-
err_encl_dev:
put_device(&sgx_encl_dev);
diff --git a/arch/x86/kernel/cpu/sgx/main.c b/arch/x86/kernel/cpu/sgx/main.c
index edbd465083c7..9f4473597620 100644
--- a/arch/x86/kernel/cpu/sgx/main.c
+++ b/arch/x86/kernel/cpu/sgx/main.c
@@ -2,6 +2,7 @@
// Copyright(c) 2016-17 Intel Corporation.
#include <linux/cdev.h>
+#include <linux/file.h>
#include <linux/freezer.h>
#include <linux/highmem.h>
#include <linux/kthread.h>
@@ -335,6 +336,31 @@ static struct bus_type sgx_bus_type = {
};
static dev_t sgx_devt;
+const struct file_operations sgx_provision_fops = {
+ .owner = THIS_MODULE,
+};
+
+static struct device sgx_provision_dev;
+static struct cdev sgx_provision_cdev;
+
+int sgx_set_attribute(u64 *allowed_attributes, unsigned int attribute_fd)
+{
+ struct file *attribute_file;
+
+ attribute_file = fget(attribute_fd);
+ if (!attribute_file)
+ return -EINVAL;
+
+ if (attribute_file->f_op != &sgx_provision_fops) {
+ fput(attribute_file);
+ return -EINVAL;
+ }
+ fput(attribute_file);
+
+ *allowed_attributes |= SGX_ATTR_PROVISIONKEY;
+ return 0;
+}
+
static void sgx_dev_release(struct device *dev)
{
@@ -386,12 +412,28 @@ static __init int sgx_init(void)
if (ret < 0)
goto err_bus;
- ret = sgx_drv_init();
+ ret = sgx_dev_init("sgx/provision", &sgx_provision_dev,
+ &sgx_provision_cdev, &sgx_provision_fops,
+ SGX_PROV_DEV_MINOR);
if (ret)
goto err_chrdev_region;
+ ret = cdev_device_add(&sgx_provision_cdev, &sgx_provision_dev);
+ if (ret)
+ goto err_provision_dev;
+
+ ret = sgx_drv_init();
+ if (ret)
+ goto err_provision_cdev;
+
return 0;
+err_provision_cdev:
+ cdev_device_del(&sgx_provision_cdev, &sgx_provision_dev);
+
+err_provision_dev:
+ put_device(&sgx_provision_dev);
+
err_chrdev_region:
unregister_chrdev_region(sgx_devt, SGX_MAX_NR_DEVICES);
diff --git a/arch/x86/kernel/cpu/sgx/sgx.h b/arch/x86/kernel/cpu/sgx/sgx.h
index 85b3674e1d43..a0af8849c7c3 100644
--- a/arch/x86/kernel/cpu/sgx/sgx.h
+++ b/arch/x86/kernel/cpu/sgx/sgx.h
@@ -96,5 +96,6 @@ int sgx_einit(struct sgx_sigstruct *sigstruct, struct sgx_einittoken *token,
__init int sgx_dev_init(const char *name, struct device *dev,
struct cdev *cdev, const struct file_operations *fops,
int minor);
+int sgx_set_attribute(u64 *allowed_attributes, unsigned int attribute_fd);
#endif /* _X86_SGX_H */
--
2.22.0
Powered by blists - more mailing lists