Re: [PATCH v5] sgx.7: New page with overview of Software Guard eXtensions (SGX)

[Jarkko Sakkinen <jarkko@kernel.org>]

On Tue, May 11, 2021 at 01:22:10PM -0700, Reinette Chatre wrote:
> Hi Jarkko,
> 
> On 5/10/2021 7:52 AM, Jarkko Sakkinen wrote:
> 
> ...
> 
> > +There is a hardware constraint that the enclave size must be a power of two,
> > +and the base address must be a multiple of the size.
> > +This can lead to reserving a large region than required by the payload,
> 
> a large region than required -> a larger region than required ?
> 
> > +but the address space can be obviously trimmed after the enclave has been
> 
> can be obviously trimmed -> can be trimmed ?
> 
> > +constructed on,
> 
> constructed on -> constructed ?
> 
> > +with a sequence of
> > +.BR mmap(MAP_FIXED)
> > +calls.
> > +.PP
> > +A process can access enclave by entering into its address space through
> > +a set of entry points,
> > +which must be defined during the construction process.
> > +This requires a complex sequence of CPU instructions,
> > +and kernel assisted exception handling,
> > +encapsulated into
> > +.BR vsgx_enter_enclave
> > +vDSO interface,
> > +provided and documented by
> > +.IR <asm/sgx.h>.
> 
> This is not clear to me. This is written as though vsgx_enter_enclave is
> something very specific that is documented in <asm/sgx.h>. Should it perhaps
> be vdso_sgx_enter_enclave_t instead? Am I missing where vsgx_enter_enclave
> is defined? I expect a reader of this man page may want to search for the
> term "vsgx_enter_enclave" after reading the above.

Yeah, it's now incorrect. I'll fix this. Thanks for pointing out.

> 
> > +.SS Permissions
> > +In order to build an enclave, a process must be able to call
> > +.IR mmap (2)
> > +with
> > +.IR PROT_EXEC
> > +set.
> > +Like for any other type of executable,
> > +the page permissions must be set appropriately.
> > +For this reason,
> > +.I /dev/sgx_enclave
> > +must reside in a partition,
> > +which is not mounted as no-exec,
> > +in order to be usable,
> > +as
> > +.IR mmap(2)
> > +denies
> > +.IR PROT_EXEC
> > +otherwise.
> > +.SH VERSIONS
> > +The SGX feature was added in Linux 5.11.
> > +.SH SEE ALSO
> > +.BR ioctl (2),
> > +.BR mmap() (2),
> 
> mmap() (2) -> mmap (2) ?
> 
> > +.BR mprotect (2)
> > 
> 
> Reinette

Also, other remarks make sense to me, thanks.

/Jarkko