[PATCH 35/40] nitro_enclaves: Add NE_ENCLAVE_DIRECT_MODE

[Alexander Graf <graf@amazon.com>]

Nitro Sandboxes introduce a mode called direct mode, in which the parent
keeps access to most of the memory it donates to the sandbox. This mode
disables any attestation, but enables guest kernels that are not aware
of the Device Memory Buffer (DMB) to work. A DMB-aware guest kernel
places its virtqueues and buffers in memory the device provides, so the
parent needs access to that memory only.

Add NE_ENCLAVE_DIRECT_MODE, which asks the hypervisor for a direct-mode
slot. Remember the flags a slot was allocated with in
ne_enclave->launch_flags. Allow NE_ADD_MEMORY_REGION to use an
NE_MEMORY_SHARED allocation for a slot that carries this flag.

Signed-off-by: Alexander Graf <graf@amazon.com>
---
 Documentation/virt/ne_overview.rst        |  4 +++-
 drivers/virt/nitro_enclaves/ne_misc_dev.c |  9 +++++++--
 drivers/virt/nitro_enclaves/ne_misc_dev.h |  7 ++++++-
 include/uapi/linux/nitro_enclaves.h       | 19 +++++++++++++++++--
 4 files changed, 33 insertions(+), 6 deletions(-)

diff --git a/Documentation/virt/ne_overview.rst b/Documentation/virt/ne_overview.rst
index 012fcb394a2ef..5984fd32ec07a 100644
--- a/Documentation/virt/ne_overview.rst
+++ b/Documentation/virt/ne_overview.rst
@@ -183,7 +183,9 @@ memory region per contiguous run it is made of, or fewer where runs turn out
 to be physically adjacent. It also ends writing: the memory is the enclave's
 from that point, so an image goes in first. It takes private allocations
 only, since memory the parent can still reach is not memory the enclave has
-to itself.
+to itself. A slot allocated with NE_ENCLAVE_DIRECT_MODE asks for an enclave
+whose memory the parent keeps access to, and takes a shared allocation as a
+memory region.
 
 An enclave's memory is laid out in the order its allocations are given to it,
 and the offset NE_GET_IMAGE_LOAD_INFO returns is an offset into that layout.
diff --git a/drivers/virt/nitro_enclaves/ne_misc_dev.c b/drivers/virt/nitro_enclaves/ne_misc_dev.c
index 961b821d6038b..cccfceeb575cc 100644
--- a/drivers/virt/nitro_enclaves/ne_misc_dev.c
+++ b/drivers/virt/nitro_enclaves/ne_misc_dev.c
@@ -3447,6 +3447,8 @@ static int ne_create_vm_ioctl(struct ne_pci_dev *ne_pci_dev, u64 flags,
 	if (!ne_enclave)
 		return -ENOMEM;
 
+	ne_enclave->launch_flags = flags;
+
 	mutex_lock(&ne_cpu_pool.mutex);
 
 	ne_enclave->nr_parent_vm_cores = ne_cpu_pool.nr_parent_vm_cores;
@@ -4603,9 +4605,12 @@ static int ne_add_memory_region_ioctl(struct ne_enclave *ne_enclave,
 	/*
 	 * The parent may map a shared allocation and keeps any mapping it has
 	 * for as long as the allocation lives. Memory a region is made of is
-	 * the enclave's alone.
+	 * the enclave's alone, unless the slot was allocated for an enclave
+	 * whose memory the parent keeps access to, which is what
+	 * NE_ENCLAVE_DIRECT_MODE asks for.
 	 */
-	if (mem->shared) {
+	if (mem->shared &&
+	    !(ne_enclave->launch_flags & NE_ENCLAVE_DIRECT_MODE)) {
 		dev_err_ratelimited(ne_misc_dev.this_device,
 				    "The memory region allocation is shared\n");
 
diff --git a/drivers/virt/nitro_enclaves/ne_misc_dev.h b/drivers/virt/nitro_enclaves/ne_misc_dev.h
index b0d0438157260..1fd93bddf7766 100644
--- a/drivers/virt/nitro_enclaves/ne_misc_dev.h
+++ b/drivers/virt/nitro_enclaves/ne_misc_dev.h
@@ -22,7 +22,8 @@
 /*
  * NE_ENCLAVE_FLAG_VALID_MASK - Every launch flag this kernel passes on.
  */
-#define NE_ENCLAVE_FLAG_VALID_MASK	(NE_ENCLAVE_PCIE_MODE | \
+#define NE_ENCLAVE_FLAG_VALID_MASK	(NE_ENCLAVE_DIRECT_MODE | \
+					 NE_ENCLAVE_PCIE_MODE | \
 					 NE_ENCLAVE_PCIE_VSOCK_MODE | \
 					 NE_ENCLAVE_PCIE_VIRTIO_MODE | \
 					 NE_ENCLAVE_PCIE_NUMA_MODE)
@@ -203,6 +204,9 @@ struct ne_doorbell_binding {
  *				so that the device keeps the page after user space
  *				has closed the descriptor. NULL until
  *				%NE_SET_INFO_PAGE is called.
+ * @launch_flags:		The launch flag word the slot was allocated with,
+ *				as %NE_CREATE_VM2 received it. Read to answer a
+ *				later call the way the slot was asked for.
  * @notify_bindings:		List of the notifications this enclave has bound
  *				an eventfd to.
  * @devices:			List of struct ne_device_wiring, one for each device
@@ -243,6 +247,7 @@ struct ne_enclave {
 	bool			has_event;
 	u64			id;
 	struct file		*info_file;
+	u64			launch_flags;
 	struct list_head	notify_bindings;
 	struct list_head	devices;
 	u64			max_mem_regions;
diff --git a/include/uapi/linux/nitro_enclaves.h b/include/uapi/linux/nitro_enclaves.h
index 67be5c383c54b..b346e0582c5fa 100644
--- a/include/uapi/linux/nitro_enclaves.h
+++ b/include/uapi/linux/nitro_enclaves.h
@@ -58,6 +58,17 @@
  */
 #define NE_ENCLAVE_PCIE_MODE		(1u << 6)
 
+/**
+ * NE_ENCLAVE_DIRECT_MODE - Allocate a slot whose memory the parent keeps
+ *			    access to. The enclave produces no attestation,
+ *			    since nothing separates its memory from the VM that
+ *			    launched it. An %NE_MEMORY_SHARED allocation can be
+ *			    given to such a slot as a memory region, which a
+ *			    slot without this flag refuses. Requires
+ *			    NE_ENCLAVE_PCIE_MODE.
+ */
+#define NE_ENCLAVE_DIRECT_MODE		(1u << 1)
+
 /**
  * NE_ENCLAVE_PCIE_VSOCK_MODE - Allocate a slot whose PCIe bus holds one
  *				virtio-vsock device, attached before the enclave
@@ -440,7 +451,9 @@ struct ne_add_memory_region_args {
  *			  enclave image goes in before this call. The allocation
  *			  has to be %NE_MEMORY_PRIVATE, since memory the parent
  *			  can still reach is not memory the enclave has to
- *			  itself.
+ *			  itself, unless the slot was allocated with
+ *			  %NE_ENCLAVE_DIRECT_MODE, which asks for an enclave
+ *			  whose memory the parent keeps access to.
  *			  An enclave's memory is laid out in the order its
  *			  allocations are given to it, and the offset from
  *			  %NE_GET_IMAGE_LOAD_INFO is an offset into that layout,
@@ -461,7 +474,9 @@ struct ne_add_memory_region_args {
  * * EINVAL				- The argument is shorter than @flags, or @fd
  *					  is not a descriptor from %NE_ALLOC_MEMORY, or
  *					  the allocation was made for another enclave,
- *					  or the allocation is %NE_MEMORY_SHARED.
+ *					  or the allocation is %NE_MEMORY_SHARED
+ *					  and the slot was not allocated with
+ *					  %NE_ENCLAVE_DIRECT_MODE.
  * * EIO				- Current task mm is not the same as the one
  *					  that created the enclave.
  * * E2BIG				- The argument is longer than this kernel knows
-- 
2.47.1