Re: [PATCH v4 07/11] KVM: VMX: Add SGX ENCLS[ECREATE] handler to enforce CPUID restrictions

[Kai Huang <kai.huang@intel.com>]

On Wed, 7 Apr 2021 22:10:36 +0000 Sean Christopherson wrote:
> On Thu, Apr 08, 2021, Kai Huang wrote:
> > +	/*
> > +	 * sgx_virt_ecreate() returns:
> > +	 *  1) 0:	ECREATE was successful
> > +	 *  2) -EFAULT:	ECREATE was run but faulted, and trapnr was set to the
> > +	 *  		exception number.
> > +	 *  3) -EINVAL:	access_ok() on @secs_hva fails. It's a kernel bug and
> > +	 *  		sgx_virt_ecreate() aleady gave a warning.
> 
> Eh, I don't love "kernel bug", all we know is that access_ok() failed.  It's
> also not all that helpful since it doesn't guide the debugger to any particular
> code that would prevent access_ok() from failing.
> 
> What if this comment simply states the rules/expectations and lets the debugger
> figure out what's wrong?  E.g.
> 
> 	 *  3) -EINVAL: access_ok() on @secs_hva failed.  This should never
> 	 *              happen as KVM checks host addresses at memslot creation.
> 	 *              sgx_virt_create() has already warned in this case.
> 
> Same goes for sgx_virt_einit() in the next patch.

Sure. Will update in next version.

> 
> > +	 */
> > +	ret = sgx_virt_ecreate(pageinfo, (void __user *)secs_hva, &trapnr);
> > +	if (!ret)
> > +		return kvm_skip_emulated_instruction(vcpu);
> > +	if (ret == -EFAULT)
> > +		return sgx_inject_fault(vcpu, secs_gva, trapnr);
> > +
> > +	return ret;
> > +}