Re: [RFC PATCH v3 06/10] x86/sgx: Forced EPC page zapping for EUPDATESVN

[Jarkko Sakkinen <jarkko@kernel.org>]

On Fri, Apr 01, 2022 at 10:24:05PM +0800, Cathy Zhang wrote:
> Before an EUPDATESVN instruction can be successful, all enclave
> pages (EPC) must be marked as unused in the SGX hardware
> metadata (EPCM).
> 
> A page becomes unused when an issued EREMOVE instruction succeeds.
> To prepare for EUPDATESVN, loop over all SGX pages and attempt
> to EREMOVE them. This is fatal to running enclaves and destroys
> all enclave state and memory contents. This destruction is by
> design and mitigates any compromise of enclaves or the SGX
> hardware itself which occurred before the microcode update.
> 
> An EREMOVE operation on a page may fail for a few reasons. Each
> has its own mitigations.
> 
> First, EREMOVE will fail if an enclave that uses the page is
> executing. Send an IPI to all CPUs that might be running the
> enclave to force it out of the enclave long enough to EREMOVE
> the page. Other CPUs might enter the enclave in the meantime,
> so this is not a rock-solid guarantee.
> 
> Second, EREMOVE can fail on special SGX metadata pages, such as
> SECS and VA. EREMOVE will work on them only after the normal SGX

Ignoring concurrency rules that apply to any type of EPC page, VA page can
be removed at any point of time, i.e. the first sentence in this paragraph
is not factually true.

BR, Jarkko