linux-kernel - Re: Re: [PATCH v12 00/18] Enable FSGSBASE instructions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 27 May 2020 14:42:15 +0200
From:   Wojtek Porczyk <woju@...isiblethingslab.com>
To:     Jarkko Sakkinen <jarkko.sakkinen@...ux.intel.com>
Cc:     Don Porter <porter@...unc.edu>,
        Thomas Gleixner <tglx@...utronix.de>,
        Andi Kleen <ak@...ux.intel.com>,
        Sasha Levin <sashal@...nel.org>, linux-kernel@...r.kernel.org,
        bp@...en8.de, luto@...nel.org, hpa@...or.com,
        dave.hansen@...el.com, tony.luck@...el.com,
        ravi.v.shankar@...el.com, chang.seok.bae@...el.com
Subject: Re: Re: [PATCH v12 00/18] Enable FSGSBASE instructions

On Wed, May 27, 2020 at 11:20:08AM +0300, Jarkko Sakkinen wrote:
> On Fri, 2020-05-22 at 16:14 -0400, Don Porter wrote:
> > legacy code in SGX.  We have been following LKML discussions on this 
> > instruction for years, and hoping this feature would be supported by 
> > Linux, so that we can retire this module.  To our knowledge, every SGX 
> 
> Why have you followed this for years and never tried the patches?

For all the reasons stated before (we preferred a module, not a patchset, and
we didn't really care about implications), and because the general situation
about kernel drivers is a mess: Intel made three, mutually incompatible linux
drivers [1] and we used SDK driver, which incidentally is also how people
learn SGX programming in general.

With three different drivers and unclear future directions, we chose to wait
and see how the situation settles, so we stuck to the driver that was already
working.

Also, we're no kernel developers and there were/still are more urgent things
to fix in the graphene proper. For example we only recently have support for
running non-debug enclaves using DCAP LE [2].

[1] Here are my notes from when I was figuring out:
    https://graphene.rtfd.io/en/latest/sgx-intro.html#linux-kernel-drivers

[2] https://github.com/oscarlab/graphene/issues/881
    https://github.com/oscarlab/graphene/pull/978

-- 
pozdrawiam / best regards
Wojtek Porczyk
Graphene / Invisible Things Lab

 I do not fear computers,
 I fear lack of them.
    -- Isaac Asimov

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)