linux-kernel - Re: [PATCH v6 4/5] x86/sgx: Implement ENCLS[EUPDATESVN]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5f952f793473bb0685c3315b1d93f7ae42c4a2a4.camel@intel.com>
Date: Fri, 23 May 2025 00:08:37 +0000
From: "Huang, Kai" <kai.huang@...el.com>
To: "Reshetova, Elena" <elena.reshetova@...el.com>, "Hansen, Dave"
	<dave.hansen@...el.com>
CC: "Raynor, Scott" <scott.raynor@...el.com>, "seanjc@...gle.com"
	<seanjc@...gle.com>, "mingo@...nel.org" <mingo@...nel.org>, "Scarlata,
 Vincent R" <vincent.r.scarlata@...el.com>, "x86@...nel.org" <x86@...nel.org>,
	"jarkko@...nel.org" <jarkko@...nel.org>, "Annapurve, Vishal"
	<vannapurve@...gle.com>, "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>, "Mallick, Asit K" <asit.k.mallick@...el.com>,
	"Aktas, Erdem" <erdemaktas@...gle.com>, "Cai, Chong" <chongc@...gle.com>,
	"bondarn@...gle.com" <bondarn@...gle.com>, "linux-sgx@...r.kernel.org"
	<linux-sgx@...r.kernel.org>, "dionnaglaze@...gle.com"
	<dionnaglaze@...gle.com>
Subject: Re: [PATCH v6 4/5] x86/sgx: Implement ENCLS[EUPDATESVN]


>  
> +/**
> + * sgx_updatesvn() - Attempt to call ENCLS[EUPDATESVN].

sgx_updatesvn() -> sgx_update_svn():

arch/x86/kernel/cpu/sgx/main.c:941: warning: expecting prototype for
sgx_updatesvn(). Prototype was for sgx_update_svn() instead


> + * This instruction attempts to update CPUSVN to the
> + * currently loaded microcode update SVN and generate new
> + * cryptographic assets. Must be called when EPC is empty.
> + * Most of the time, there will be no update and that's OK.
> + * If the failure is due to SGX_INSUFFICIENT_ENTROPY, the
> + * operation can be safely retried. In other failure cases,
> + * the retry should not be attempted.
> + *
> + * Return:
> + * 0: Success or not supported
> + * -EAGAIN: Can be safely retried, failure is due to lack of
> + *  entropy in RNG.
> + * -EIO: Unexpected error, retries are not advisable.
> + */
> +static int sgx_update_svn(void)
> +{
> +	int ret;
> +
> +	/*
> +	 * If EUPDATESVN is not available, it is ok to
> +	 * silently skip it to comply with legacy behavior.
> +	 */
> +	if (!cpu_feature_enabled(X86_FEATURE_SGX_EUPDATESVN))
> +		return 0;
> +
> +	for (int i = 0; i < RDRAND_RETRY_LOOPS; i++) {
> +		ret = __eupdatesvn();
> +
> +		/* Stop on success or unexpected errors: */
> +		if (ret != SGX_INSUFFICIENT_ENTROPY)
> +			break;
> +	}
> +
> +	/*
> +	 * SVN was already up-to-date. This is the most
> +	 * common case.
> +	 */
> +	if (ret == SGX_NO_UPDATE)
> +		return 0;
> +
> +	/*
> +	 * SVN update failed due to lack of entropy in DRNG.
> +	 * Indicate to userspace that it should retry.
> +	 */
> +	if (ret == SGX_INSUFFICIENT_ENTROPY)
> +		return -EAGAIN;
> +
> +	if (!ret) {
> +		/*
> +		 * SVN successfully updated.
> +		 * Let users know when the update was successful.
> +		 */
> +		pr_info("SVN updated successfully\n");
> +		return 0;
> +	}
> +
> +	/*
> +	 * EUPDATESVN was called when EPC is empty, all other error
> +	 * codes are unexpected.
> +	 */
> +	ENCLS_WARN(ret, "EUPDATESVN");
> +	return -EIO;
> +}
> +

This patch alone generates below build warning (both w/ and w/o 'W=1'):

khuang2@...ang2-desk:~/work/enabling/src/tip$ make arch/x86/kernel/cpu/sgx/ W=1
  DESCEND objtool
  CALL    scripts/checksyscalls.sh
  INSTALL libsubcmd_headers
  CC      arch/x86/kernel/cpu/sgx/main.o
arch/x86/kernel/cpu/sgx/main.c:940:12: warning: ‘sgx_update_svn’ defined but not
used [-Wunused-function]
  940 | static int sgx_update_svn(void)
      |            ^~~~~~~~~~~~~~

Regardless of whether this warning is reasonable or not, it is a warning during
build process which may impact bisect.

You can silence it by annotating __maybe_unused attribute to sgx_update_svn() in
this patch, and then remove it in the next one.

But I am not sure whether it is necessary, though.  We can merge the last two
patches together.  The ending patch won't be too big to review IMHO.

We can even merge patch 3 together too.  The reason is current changelog of that
patch doesn't explain why we only define that two error codes (or return values)
but not others, which makes that patch *ALONE* un-reviewable without looking at
further patches.  That being said, it's fine to me we keep patch 3 alone, but
it's better to do some clarification in changelog.

But just my 2 cents.  Since Dave/Ingo/Jarkko are all on this thread, I'll leave
this to them.