linux-kernel - Re: [PATCH v5 08/11] intel_sgx: in-kernel launch enclave

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.20.1711220033040.2399@nanos>
Date:   Wed, 22 Nov 2017 00:36:25 +0100 (CET)
From:   Thomas Gleixner <tglx@...utronix.de>
To:     Jarkko Sakkinen <jarkko.sakkinen@...ux.intel.com>
cc:     Peter Zijlstra <peterz@...radead.org>,
        platform-driver-x86@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v5 08/11] intel_sgx: in-kernel launch enclave

On Tue, 21 Nov 2017, Jarkko Sakkinen wrote:

> On Tue, Nov 21, 2017 at 12:48:26AM +0100, Thomas Gleixner wrote:
> > The launch enclave is part of the kernel, at least that's what the subject
> > line claims. So why and how would it do a syscall? The kernel has it's
> > internal crypto API.
> 
> It's part of the kernel in the way as lets say code arch/x86/realmode
> is. It's hosted by kernel but it does not run in the same address space
> as the kernel.
> 
> These constraints apply for enclaves:
> 
> 1. They only run in ring-3.
> 2. They can only execute code inside their address range.

Can you please explain the whole thing so people not fully familiar with
the inner workings of your stuff can understand it? You are providing only
tiny bits of cryptic information on each question. That's going to take
ages ...

Thanks,

	tglx