1 // SPDX-License-Identifier: GPL-2.0
3  * Copyright 2020-2021 Amazon.com, Inc. or its affiliates. All Rights Reserved.
11  * -----
19  * https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html#cpu-lists
26  *	echo <cpu-list> > /sys/module/nitro_enclaves/parameters/ne_cpus
43  * Setup hugetlbfs huge pages. The memory needs to be from the same NUMA node as
46  * https://www.kernel.org/doc/html/latest/admin-guide/mm/hugetlbpage.html
52  *	/sys/devices/system/node/node<X>/hugepages/hugepages-2048kB/nr_hugepages
53  *	/sys/devices/system/node/node<X>/hugepages/hugepages-1048576kB/nr_hugepages
58  *	/sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages
59  *	/sys/kernel/mm/hugepages/hugepages-1048576kB/nr_hugepages
65  *	make -C samples/nitro_enclaves clean
66  *	make -C samples/nitro_enclaves
96  * NE_DEV_NAME - Nitro Enclaves (NE) misc device that provides the ioctl interface.
101  * NE_POLL_WAIT_TIME - Timeout in seconds for each poll event.
105  * NE_POLL_WAIT_TIME_MS - Timeout in milliseconds for each poll event.
110  * NE_SLEEP_TIME - Amount of time in seconds for the process to keep the enclave alive.
115  * NE_DEFAULT_NR_VCPUS - Default number of vCPUs set for an enclave.
120  * NE_MIN_MEM_REGION_SIZE - Minimum size of a memory region - 2 MiB.
125  * NE_DEFAULT_NR_MEM_REGIONS - Default number of memory regions of 2 MiB set for
131  * NE_IMAGE_LOAD_HEARTBEAT_CID - Vsock CID for enclave image loading heartbeat logic.
135  * NE_IMAGE_LOAD_HEARTBEAT_PORT - Vsock port for enclave image loading heartbeat logic.
139  * NE_IMAGE_LOAD_HEARTBEAT_VALUE - Heartbeat value for enclave image loading.
144  * struct ne_user_mem_region - User space memory region set for an enclave.
145  * @userspace_addr:	Address of the user space memory region.
146  * @memory_size:	Size of the user space memory region.
154  * ne_create_vm() - Create a slot for the enclave VM.
166 	int rc = -EINVAL;  in ne_create_vm()
189  * ne_poll_enclave_fd() - Thread function for polling the enclave fd.
201 	int rc = -EINVAL;  in ne_poll_enclave_fd()
247  * ne_alloc_user_mem_region() - Allocate a user space memory region for an enclave.
248  * @ne_user_mem_region:	User space memory region allocated using hugetlbfs.
261 	ne_user_mem_region->userspace_addr = mmap(NULL, ne_user_mem_region->memory_size,  in ne_alloc_user_mem_region()
264 						  MAP_HUGETLB | MAP_HUGE_2MB, -1, 0);  in ne_alloc_user_mem_region()
265 	if (ne_user_mem_region->userspace_addr == MAP_FAILED) {  in ne_alloc_user_mem_region()
266 		printf("Error in mmap memory [%m]\n");  in ne_alloc_user_mem_region()
268 		return -1;  in ne_alloc_user_mem_region()
275  * ne_load_enclave_image() - Place the enclave image in the enclave memory.
277  * @ne_user_mem_regions:	User space memory regions allocated for the enclave.
289 	int enclave_image_fd = -1;  in ne_load_enclave_image()
298 	int rc = -EINVAL;  in ne_load_enclave_image()
314 		printf("The enclave memory is smaller than the enclave image size\n");  in ne_load_enclave_image()
316 		return -ENOMEM;  in ne_load_enclave_image()
341 	printf("Enclave image offset in enclave memory is %lld\n",  in ne_load_enclave_image()
356 		return -1;  in ne_load_enclave_image()
369 			temp_image_offset -= memory_size;  in ne_load_enclave_image()
374 			memory_size -= temp_image_offset;  in ne_load_enclave_image()
378 		remaining_bytes = enclave_image_size - image_written_bytes;  in ne_load_enclave_image()
399  * ne_set_user_mem_region() - Set a user space memory region for the given enclave.
401  * @ne_user_mem_region :	User space memory region to be set for the enclave.
415 	int rc = -EINVAL;  in ne_set_user_mem_region()
421 			printf("Error in set user memory region, enclave not in init state\n");  in ne_set_user_mem_region()
427 			printf("Error in set user memory region, mem size not multiple of 2 MiB\n");  in ne_set_user_mem_region()
433 			printf("Error in set user memory region, invalid user space address\n");  in ne_set_user_mem_region()
439 			printf("Error in set user memory region, unaligned user space address\n");  in ne_set_user_mem_region()
445 			printf("Error in set user memory region, memory region already used\n");  in ne_set_user_mem_region()
451 			printf("Error in set user memory region, not backed by huge pages\n");  in ne_set_user_mem_region()
457 			printf("Error in set user memory region, different NUMA node than CPUs\n");  in ne_set_user_mem_region()
463 			printf("Error in set user memory region, max memory regions reached\n");  in ne_set_user_mem_region()
469 			printf("Error in set user memory region, has page not multiple of 2 MiB\n");  in ne_set_user_mem_region()
475 			printf("Error in set user memory region, provided invalid flag\n");  in ne_set_user_mem_region()
481 			printf("Error in set user memory region [%m]\n");  in ne_set_user_mem_region()
491  * ne_free_mem_regions() - Unmap all the user space memory regions that were set
493  * @ne_user_mem_regions:	The user space memory regions associated with an enclave.
507  * ne_add_vcpu() - Add a vCPU to the given enclave.
510  *			auto-generated (if provided vCPU id is 0).
519 	int rc = -EINVAL;  in ne_add_vcpu()
571  * ne_start_enclave() - Start the given enclave.
582 	int rc = -EINVAL;  in ne_start_enclave()
594 			printf("Error in start enclave, no memory regions have been added\n");  in ne_start_enclave()
612 			printf("Error in start enclave, enclave memory is less than min size\n");  in ne_start_enclave()
640  * ne_start_enclave_check_booted() - Start the enclave and wait for a heartbeat
653 	int client_vsock_fd = -1;  in ne_start_enclave_check_booted()
657 	int rc = -EINVAL;  in ne_start_enclave_check_booted()
664 	int server_vsock_fd = -1;  in ne_start_enclave_check_booted()
709 		rc = -ETIMEDOUT;  in ne_start_enclave_check_booted()
717 		rc = -EINVAL;  in ne_start_enclave_check_booted()
768 	int enclave_fd = -1;  in main()
770 	int ne_dev_fd = -1;  in main()
773 	int rc = -EINVAL;  in main()
821 			printf("Error in alloc userspace memory region, iter %d\n", i);  in main()
834 			printf("Error in set memory region, iter %d\n", i);  in main()
840 	printf("Enclave memory regions were added\n");  in main()