linux-kernel - Re: [PATCH v10 5/6] x86/sgx: Implement ENCLS[EUPDATESVN]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <96866c15-2eb1-4df4-9e63-dfd5e40ecb91@intel.com>
Date: Fri, 1 Aug 2025 10:12:58 -0700
From: Dave Hansen <dave.hansen@...el.com>
To: Elena Reshetova <elena.reshetova@...el.com>
Cc: jarkko@...nel.org, seanjc@...gle.com, kai.huang@...el.com,
 mingo@...nel.org, linux-sgx@...r.kernel.org, linux-kernel@...r.kernel.org,
 x86@...nel.org, asit.k.mallick@...el.com, vincent.r.scarlata@...el.com,
 chongc@...gle.com, erdemaktas@...gle.com, vannapurve@...gle.com,
 bondarn@...gle.com, scott.raynor@...el.com
Subject: Re: [PATCH v10 5/6] x86/sgx: Implement ENCLS[EUPDATESVN]

The changelog is missing a tidbit about the fact that this is still dead
code until sgx_inc_usage_count() gets a real implementation.

On 8/1/25 04:25, Elena Reshetova wrote:
...
> +/**
> + * sgx_update_svn() - Attempt to call ENCLS[EUPDATESVN].
> + * This instruction attempts to update CPUSVN to the
> + * currently loaded microcode update SVN and generate new
> + * cryptographic assets. Must be called when EPC is empty.

As a general rule, I'd much rather have the "Must be $FOO" rules written
in code than in a comment, or along with a comment:

	/* EPC is guaranteed to be empty when there are no users: */
	WARN(count, "Elevated usage count...");

> + * Most of the time, there will be no update and that's OK.

This should go with the check for SGX_NO_UPDATE, not here.

> + * If the failure is due to SGX_INSUFFICIENT_ENTROPY, the
> + * operation can be safely retried. In other failure cases,
> + * the retry should not be attempted.

Ditto. This is rewriting the code in comments.

> + * Return:
> + * 0: Success or not supported
> + * -EAGAIN: Can be safely retried, failure is due to lack of
> + *  entropy in RNG.
> + * -EIO: Unexpected error, retries are not advisable.
> + */
> +static int __maybe_unused sgx_update_svn(void)
> +{
> +	int ret;
> +
> +	/*
> +	 * If EUPDATESVN is not available, it is ok to
> +	 * silently skip it to comply with legacy behavior.
> +	 */
> +	if (!cpu_feature_enabled(X86_FEATURE_SGX_EUPDATESVN))
> +		return 0;
> +
> +	for (int i = 0; i < RDRAND_RETRY_LOOPS; i++) {
> +		ret = __eupdatesvn();
> +
> +		/* Stop on success or unexpected errors: */
> +		if (ret != SGX_INSUFFICIENT_ENTROPY)
> +			break;
> +	}
> +
> +	/*
> +	 * SVN successfully updated.
> +	 * Let users know when the update was successful.
> +	 */
> +	if (!ret)
> +		pr_info("SVN updated successfully\n");
> +
> +	if (!ret || ret == SGX_NO_UPDATE)
> +		return 0;
> +
> +	/*
> +	 * SVN update failed due to lack of entropy in DRNG.
> +	 * Indicate to userspace that it should retry.
> +	 */
> +	if (ret == SGX_INSUFFICIENT_ENTROPY)
> +		return -EAGAIN;

There are four cases to handle. Doesn't it make sense to just write it
as four literal "case"s?

	switch (ret) {
	case 0:
		pr_info("...");
		return 0;
	case SGX_NO_UPDATE:
		return 0;
	case SGX_INSUFFICIENT_ENTROPY:
		return -EAGAIN;
	default:
		break;
	}


> +	ENCLS_WARN(ret, "EUPDATESVN");
> +	return -EIO;
> +}
> +
>  int sgx_inc_usage_count(void)
>  {
>  	return 0;