linux-kernel - Re: [PATCH v1 00/15] Add support for Nitro Enclaves

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 23 Apr 2020 22:56:08 +0200
From:   Alexander Graf <graf@...zon.com>
To:     Paolo Bonzini <pbonzini@...hat.com>,
        "Paraschiv, Andra-Irina" <andraprs@...zon.com>,
        <linux-kernel@...r.kernel.org>
CC:     Anthony Liguori <aliguori@...zon.com>,
        Benjamin Herrenschmidt <benh@...zon.com>,
        Colm MacCarthaigh <colmmacc@...zon.com>,
        Bjoern Doebel <doebel@...zon.de>,
        David Woodhouse <dwmw@...zon.co.uk>,
        Frank van der Linden <fllinden@...zon.com>,
        Martin Pohlack <mpohlack@...zon.de>,
        Matt Wilson <msw@...zon.com>, Balbir Singh <sblbir@...zon.com>,
        Stewart Smith <trawets@...zon.com>,
        Uwe Dannowski <uwed@...zon.de>, <kvm@...r.kernel.org>,
        <ne-devel-upstream@...zon.com>
Subject: Re: [PATCH v1 00/15] Add support for Nitro Enclaves



On 23.04.20 19:51, Paolo Bonzini wrote:
> 
> On 23/04/20 19:42, Paraschiv, Andra-Irina wrote:
>>>
>>>>> - the initial CPU state: CPL0 vs. CPL3, initial program counter, etc.
>>
>> The enclave VM has its own kernel and follows the well-known Linux boot
>> protocol, in the end getting to the user application after init finishes
>> its work, so that's CPL3.
> 
> CPL3 is how the user application run, but does the enclave's Linux boot
> process start in real mode at the reset vector (0xfffffff0), in 16-bit
> protected mode at the Linux bzImage entry point, or at the ELF entry point?

There is no "entry point" per se. You prepopulate at target bzImage into 
the enclave memory on boot which then follows the standard boot 
protocol. Everything before that (enclave firmware, etc.) is provided by 
the enclave environment.

Think of it like a mechanism to launch a second QEMU instance on the 
host, but all you can actually control are the -smp, -m, -kernel and 
-initrd parameters. The only I/O channel you have between your VM and 
that new VM is a vsock channel which is configured by the host on your 
behalf.


Alex



Amazon Development Center Germany GmbH
Krausenstr. 38
10117 Berlin
Geschaeftsfuehrung: Christian Schlaeger, Jonathan Weiss
Eingetragen am Amtsgericht Charlottenburg unter HRB 149173 B
Sitz: Berlin
Ust-ID: DE 289 237 879