Skip to content
Snippets Groups Projects
  • Sean Christopherson's avatar
    c6c02320
    hostmem: Add hostmem-epc as a backend for SGX EPC · c6c02320
    Sean Christopherson authored
    
    EPC (Enclave Page Cahe) is a specialized type of memory used by Intel
    SGX (Software Guard Extensions).  The SDM desribes EPC as:
    
        The Enclave Page Cache (EPC) is the secure storage used to store
        enclave pages when they are a part of an executing enclave. For an
        EPC page, hardware performs additional access control checks to
        restrict access to the page. After the current page access checks
        and translations are performed, the hardware checks that the EPC
        page is accessible to the program currently executing. Generally an
        EPC page is only accessed by the owner of the executing enclave or
        an instruction which is setting up an EPC page.
    
    Because of its unique requirements, Linux manages EPC separately from
    normal memory.  Similar to memfd, the device /dev/sgx_vepc can be
    opened to obtain a file descriptor which can in turn be used to mmap()
    EPC memory.
    
    Signed-off-by: default avatarSean Christopherson <sean.j.christopherson@intel.com>
    Signed-off-by: default avatarYang Zhong <yang.zhong@intel.com>
    Message-Id: <20210719112136.57018-3-yang.zhong@intel.com>
    Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
    c6c02320
    History
    hostmem: Add hostmem-epc as a backend for SGX EPC
    Sean Christopherson authored
    
    EPC (Enclave Page Cahe) is a specialized type of memory used by Intel
    SGX (Software Guard Extensions).  The SDM desribes EPC as:
    
        The Enclave Page Cache (EPC) is the secure storage used to store
        enclave pages when they are a part of an executing enclave. For an
        EPC page, hardware performs additional access control checks to
        restrict access to the page. After the current page access checks
        and translations are performed, the hardware checks that the EPC
        page is accessible to the program currently executing. Generally an
        EPC page is only accessed by the owner of the executing enclave or
        an instruction which is setting up an EPC page.
    
    Because of its unique requirements, Linux manages EPC separately from
    normal memory.  Similar to memfd, the device /dev/sgx_vepc can be
    opened to obtain a file descriptor which can in turn be used to mmap()
    EPC memory.
    
    Signed-off-by: default avatarSean Christopherson <sean.j.christopherson@intel.com>
    Signed-off-by: default avatarYang Zhong <yang.zhong@intel.com>
    Message-Id: <20210719112136.57018-3-yang.zhong@intel.com>
    Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>