linux-kernel - Re: [PATCH] x86/sgx: Add SGX_PAGE_REPEAT flag for SGX_IOC_ENCLAVE_ADD

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <a5d4b6e4-7caa-06b3-a73b-b3869a92dbb5@intel.com>
Date:   Thu, 10 Jun 2021 07:11:53 -0700
From:   Dave Hansen <dave.hansen@...el.com>
To:     Jarkko Sakkinen <jarkko@...nel.org>, linux-sgx@...r.kernel.org
Cc:     Dave Hansen <dave.hansen@...ux.intel.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
        x86@...nel.org, "H. Peter Anvin" <hpa@...or.com>,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] x86/sgx: Add SGX_PAGE_REPEAT flag for
 SGX_IOC_ENCLAVE_ADD_PAGES

On 6/10/21 2:01 AM, Jarkko Sakkinen wrote:
> On Thu, Jun 10, 2021 at 10:21:17AM +0300, Jarkko Sakkinen wrote:
>> For uninitialized data, there's a need to add the same page multiple times,
>> e.g. a zero page, instead of traversing the source memory forward. With the
>> current API, this requires to call SGX_IOC_ENCLAVE_ADD_PAGES multiple
>> times, once per page, which is not very efficient.
>>
>> Add a new SGX_PAGE_REPEAT flag to resolve the issue. When this flag is set
>> to the 'flags' field of struct sgx_enclave_pages, the ioctl will apply the
>> page at 'src' multiple times, instead of moving forward in the address
>> space.
>>
>> Signed-off-by: Jarkko Sakkinen <jarkko@...nel.org>
> After sending this, I started to think that maybe it would actually better
> to just add SGX_PAGE_ZERO flag, i.e. add zero pages and ignore src. That's
> the main use case right now, and saves the user space from extra trouble of
> having to do such page by hand.
> 
> That neither does prevent adding SGX_PAGE_REPEAT later on. I just see no
> point of that generic functionality right now. It only makes simple use
> case more complex.

Is the main argument behind this new ABI that it increases efficiency?

Let's say I want to add 1MB of 0'd pages to an enclave.  Won't this do it?

	zeros = mmap(NULL, size, PROT_READ, MAP_ANONYMOUS|MAP_PRIVATE,
		     -1, 0);
	ioctl(SGX_IOC_ENCLAVE_ADD_PAGES, zeros, size);

Sure, you'll pay the cost of faulting in the zero page size/PAGE_SIZE
times.  But, that's pretty minuscule.  This zeros buffer can also be
reused without faulting again.  It can be as big or small as you want.
Heck, it could even be 2MB in size and use the transparent huge page.

I agree that there's definitely some optimization work to do.  But, I'm
a bit hesitant to turn to new ABI to do it.