The changelog is missing a tidbit about the fact that this is still dead
code until sgx_inc_usage_count() gets a real implementation.
On 8/1/25 04:25, Elena Reshetova wrote:
...
> +/**
> + * sgx_update_svn() - Attempt to call ENCLS[EUPDATESVN].
> + * This instruction attempts to update CPUSVN to the
> + * currently loaded microcode update SVN and generate new
> + * cryptographic assets. Must be called when EPC is empty.
As a general rule, I'd much rather have the "Must be $FOO" rules written
in code than in a comment, or along with a comment:
/* EPC is guaranteed to be empty when there are no users: */
WARN(count, "Elevated usage count...");
> + * Most of the time, there will be no update and that's OK.
This should go with the check for SGX_NO_UPDATE, not here.
> + * If the failure is due to SGX_INSUFFICIENT_ENTROPY, the
> + * operation can be safely retried. In other failure cases,
> + * the retry should not be attempted.
Ditto. This is rewriting the code in comments.
> + * Return:
> + * 0: Success or not supported
> + * -EAGAIN: Can be safely retried, failure is due to lack of
> + * entropy in RNG.
> + * -EIO: Unexpected error, retries are not advisable.
> + */
> +static int __maybe_unused sgx_update_svn(void)
> +{
> + int ret;
> +
> + /*
> + * If EUPDATESVN is not available, it is ok to
> + * silently skip it to comply with legacy behavior.
> + */
> + if (!cpu_feature_enabled(X86_FEATURE_SGX_EUPDATESVN))
> + return 0;
> +
> + for (int i = 0; i < RDRAND_RETRY_LOOPS; i++) {
> + ret = __eupdatesvn();
> +
> + /* Stop on success or unexpected errors: */
> + if (ret != SGX_INSUFFICIENT_ENTROPY)
> + break;
> + }
> +
> + /*
> + * SVN successfully updated.
> + * Let users know when the update was successful.
> + */
> + if (!ret)
> + pr_info("SVN updated successfully\n");
> +
> + if (!ret || ret == SGX_NO_UPDATE)
> + return 0;
> +
> + /*
> + * SVN update failed due to lack of entropy in DRNG.
> + * Indicate to userspace that it should retry.
> + */
> + if (ret == SGX_INSUFFICIENT_ENTROPY)
> + return -EAGAIN;
There are four cases to handle. Doesn't it make sense to just write it
as four literal "case"s?
switch (ret) {
case 0:
pr_info("...");
return 0;
case SGX_NO_UPDATE:
return 0;
case SGX_INSUFFICIENT_ENTROPY:
return -EAGAIN;
default:
break;
}
> + ENCLS_WARN(ret, "EUPDATESVN");
> + return -EIO;
> +}
> +
> int sgx_inc_usage_count(void)
> {
> return 0;
