linux-kernel - Re: [PATCH] [v2] x86/sgx: Allow enclaves to use Asynchrounous Exit Notification

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 26 Jul 2022 00:10:06 -0500
From:   "Haitao Huang" <haitao.huang@...ux.intel.com>
To:     "Dave Hansen" <dave.hansen@...el.com>,
        "Dave Hansen" <dave.hansen@...ux.intel.com>,
        "Kai Huang" <kai.huang@...el.com>
Cc:     "Jarkko Sakkinen" <jarkko@...nel.org>,
        "Andy Lutomirski" <luto@...nel.org>,
        "Thomas Gleixner" <tglx@...utronix.de>,
        "Ingo Molnar" <mingo@...hat.com>, "Borislav Petkov" <bp@...en8.de>,
        "H. Peter Anvin" <hpa@...or.com>,
        "Sean Christopherson" <seanjc@...gle.com>, x86@...nel.org,
        linux-sgx@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] [v2] x86/sgx: Allow enclaves to use Asynchrounous Exit
 Notification

On Mon, 25 Jul 2022 05:36:17 -0500, Kai Huang <kai.huang@...el.com> wrote:

> On Fri, 2022-07-22 at 08:21 -0700, Dave Hansen wrote:
>> On 7/22/22 06:26, Kai Huang wrote:
>> > Did a quick look at the spec.  It appears ENCLU[EDECCSSA] should be  
>> used
>> > together with AEX-notify.  So besides advertising the new
>> > SGX_ATTR_ASYNC_EXIT_NOTIFY bit to the KVM guest, I think we should  
>> also
>> > advertise the ENCLU[EDECCSSA] support in guest's CPUID, like below  
>> (untested)?
>>
>> Sounds like a great follow-on patch!  It doesn't seem truly functionally
>> required from the spec:
>>
>> > EDECCSSA is a new Intel SGX user leaf function
>> > (ENCLU[EDECCSSA]) that can facilitate AEX notification handling...
>>
>> If that's wrong or imprecise, I'd love to hear more about it and also
>> about how the spec will be updated.
>>
>
> They are enumerated separately, but looks in practice the notify handler  
> will
> use it to switch back to the correct/targeted CSSA to continue to run  
> normally
> after handling the exit notify.  This is my understanding of the  
> "facilitate"
> mean in the spec.
>
> Btw, in real hardware I think the two should come together, meaning no  
> real
> hardware will only support one.
>
> Haitao, could you give us more information?
>
You are right. They are enumerated separately and HW should come with both  
or neither.
My understanding it is also possible for enclaves choose not to receive  
AEX notify
but still use EDECCSSA.

Thanks
Haitao