From: Sean Christopherson <sean.j.christopherson@intel.com> To: Nathaniel McCallum <npmccallum@redhat.com> Cc: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>, linux-kernel@vger.kernel.org, x86@kernel.org, linux-sgx@vger.kernel.org, akpm@linux-foundation.org, dave.hansen@intel.com, Neil Horman <nhorman@redhat.com>, "Huang, Haitao" <haitao.huang@intel.com>, andriy.shevchenko@linux.intel.com, tglx@linutronix.de, "Svahn, Kai" <kai.svahn@intel.com>, bp@alien8.de, Josh Triplett <josh@joshtriplett.org>, luto@kernel.org, kai.huang@intel.com, David Rientjes <rientjes@google.com>, cedric.xing@intel.com, Patrick Uiterwijk <puiterwijk@redhat.com>, Andy Lutomirski <luto@amacapital.net>, Jethro Beekman <jethro@fortanix.com> Subject: Re: [PATCH v28 21/22] x86/vdso: Implement a vDSO for Intel SGX enclave call Date: Thu, 12 Mar 2020 17:52:53 -0700 Message-ID: <20200313005252.GA1292@linux.intel.com> (raw) In-Reply-To: <CAOASepO2=KCzT+wdXWz2tUNvi6NyzNJ3KwvBMtH_P1TO8Yr_mQ@mail.gmail.com> On Wed, Mar 11, 2020 at 03:30:44PM -0400, Nathaniel McCallum wrote: > On Tue, Mar 3, 2020 at 6:40 PM Jarkko Sakkinen > <jarkko.sakkinen@linux.intel.com> wrote: > > + * The exit handler's return value is interpreted as follows: > > + * >0: continue, restart __vdso_sgx_enter_enclave() with @ret as @leaf > > + * 0: success, return @ret to the caller > > + * <0: error, return @ret to the caller > > + * > > + * The userspace exit handler is responsible for unwinding the stack, e.g. to > > + * pop @e, u_rsp and @tcs, prior to returning to __vdso_sgx_enter_enclave(). > > Unless I misunderstand, this documentation... Hrm, that does appear wrong. I'm guessing that was leftover from a previous incarnation of the code. Or I botched the description, which is just as likely. > > + * The exit handler may also transfer control, e.g. via longjmp() or a C++ > > + * exception, without returning to __vdso_sgx_enter_enclave(). > > + * > > + * Return: > > + * 0 on success, > > + * -EINVAL if ENCLU leaf is not allowed, > > + * -EFAULT if an exception occurs on ENCLU or within the enclave > > + * -errno for all other negative values returned by the userspace exit handler > > + */ ... > > + /* Load the callback pointer to %rax and invoke it via retpoline. */ > > + mov 0x20(%rbp), %rax > > + call .Lretpoline > > + > > + /* Restore %rsp to its post-exit value. */ > > + mov %rbx, %rsp > > ... doesn't seem to match this code. > > If the handler pops from the stack and then we restore the stack here, > the handler had no effect. > > Also, one difference between this interface and a raw ENCLU[EENTER] is > that we can't pass arguments on the untrusted stack during EEXIT. If > we want to support that workflow, then we need to allow the ability > for the handler to pop "additional" values without restoring the stack > pointer to the exact value here. > Also, one difference between this interface and a raw ENCLU[EENTER] is > that we can't pass arguments on the untrusted stack during EEXIT. If > we want to support that workflow, then we need to allow the ability > for the handler to pop "additional" values without restoring the stack > pointer to the exact value here. The callback shenanigans exist precisely to allow passing arguments on the untrusted stack. The vDSO is very careful to preserve the stack memory above RSP, and to snapshot RSP at the time of exit, e.g. the arguments in memory and their addresses relative to u_rsp live across EEXIT. It's the same basic concept as regular function calls, e.g. the callee doesn't pop params off the stack, it just knows what addresses relative to RSP hold the data it wants. The enclave, being the caller, is responsible for cleaning up u_rsp. FWIW, if the handler reaaaly wanted to pop off the stack, it could do so, fixup the stack, and then re-call __vdso_sgx_enter_enclave() instead of returning (to the original __vdso_sgx_enter_enclave()). > > + /* > > + * If the return from callback is zero or negative, return immediately, > > + * else re-execute ENCLU with the postive return value interpreted as > > + * the requested ENCLU leaf. > > + */ > > + cmp $0, %eax > > + jle .Lout > > + jmp .Lenter_enclave > > + > > +.Lretpoline: > > + call 2f > > +1: pause > > + lfence > > + jmp 1b > > +2: mov %rax, (%rsp) > > + ret > > + .cfi_endproc > > + > > +_ASM_VDSO_EXTABLE_HANDLE(.Lenclu_eenter_eresume, .Lhandle_exception)
next prev parent reply index Thread overview: 109+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-03-03 23:35 [PATCH v28 00/22] Intel SGX foundations Jarkko Sakkinen 2020-03-03 23:35 ` [PATCH v28 01/22] x86/sgx: Update MAINTAINERS Jarkko Sakkinen 2020-03-03 23:35 ` [PATCH v28 02/22] x86/cpufeatures: x86/msr: Add Intel SGX hardware bits Jarkko Sakkinen 2020-03-03 23:35 ` [PATCH v28 03/22] x86/cpufeatures: x86/msr: Intel SGX Launch Control " Jarkko Sakkinen 2020-03-03 23:35 ` [PATCH v28 04/22] x86/mm: x86/sgx: Signal SIGSEGV with PF_SGX Jarkko Sakkinen 2020-03-03 23:35 ` [PATCH v28 05/22] x86/sgx: Add SGX microarchitectural data structures Jarkko Sakkinen 2020-03-03 23:35 ` [PATCH v28 06/22] x86/sgx: Add wrappers for ENCLS leaf functions Jarkko Sakkinen 2020-03-09 21:14 ` Sean Christopherson 2020-03-03 23:35 ` [PATCH v28 07/22] x86/cpu/intel: Detect SGX supprt Jarkko Sakkinen 2020-03-09 21:56 ` Sean Christopherson 2020-03-11 17:03 ` Jarkko Sakkinen 2020-03-03 23:35 ` [PATCH v28 08/22] x86/sgx: Enumerate and track EPC sections Jarkko Sakkinen 2020-03-03 23:35 ` [PATCH v28 09/22] x86/sgx: Add functions to allocate and free EPC pages Jarkko Sakkinen 2020-03-03 23:35 ` [PATCH v28 10/22] mm: Introduce vm_ops->may_mprotect() Jarkko Sakkinen 2020-03-03 23:35 ` [PATCH v28 11/22] x86/sgx: Linux Enclave Driver Jarkko Sakkinen 2020-03-05 17:40 ` Sean Christopherson 2020-03-05 18:24 ` Jethro Beekman 2020-03-05 19:04 ` Sean Christopherson 2020-03-06 19:00 ` Jarkko Sakkinen 2020-03-19 18:22 ` Dr. Greg 2020-03-06 18:58 ` Jarkko Sakkinen 2020-03-03 23:35 ` [PATCH v28 12/22] docs: x86/sgx: Document SGX micro architecture and kernel internals Jarkko Sakkinen 2020-03-03 23:36 ` [PATCH v28 13/22] selftests/x86: Recurse into subdirectories Jarkko Sakkinen 2020-03-03 23:36 ` [PATCH v28 14/22] selftests/x86: Add a selftest for SGX Jarkko Sakkinen 2020-03-04 19:27 ` Nathaniel McCallum 2020-03-05 11:33 ` Jarkko Sakkinen 2020-03-06 15:42 ` Dr. Greg 2020-03-06 19:07 ` Jarkko Sakkinen 2020-03-07 17:42 ` Dr. Greg 2020-03-10 13:08 ` Jarkko Sakkinen 2020-03-11 13:28 ` Jarkko Sakkinen [not found] ` <20200311164047.GG21852@linux.intel.com> 2020-03-13 19:24 ` Jarkko Sakkinen 2020-03-04 19:44 ` Nathaniel McCallum 2020-03-04 19:51 ` Nathaniel McCallum 2020-03-06 5:32 ` Dr. Greg 2020-03-06 19:04 ` Jarkko Sakkinen 2020-03-10 19:29 ` Haitao Huang 2020-03-11 9:13 ` Dr. Greg 2020-03-11 17:15 ` Haitao Huang 2020-03-17 1:07 ` Dr. Greg 2020-03-03 23:36 ` [PATCH v28 15/22] x86/sgx: Add provisioning Jarkko Sakkinen 2020-03-03 23:36 ` [PATCH v28 16/22] x86/sgx: Add a page reclaimer Jarkko Sakkinen 2020-03-05 19:03 ` Sean Christopherson 2020-03-06 18:47 ` Jarkko Sakkinen 2020-03-12 18:38 ` Sean Christopherson 2020-03-15 0:27 ` Jarkko Sakkinen 2020-03-15 1:17 ` Jarkko Sakkinen 2020-03-09 21:16 ` Sean Christopherson 2020-03-03 23:36 ` [PATCH v28 17/22] x86/sgx: ptrace() support for the SGX driver Jarkko Sakkinen 2020-03-03 23:36 ` [PATCH v28 18/22] x86/vdso: Add support for exception fixup in vDSO functions Jarkko Sakkinen 2020-03-03 23:36 ` [PATCH v28 19/22] x86/fault: Add helper function to sanitize error code Jarkko Sakkinen 2020-03-03 23:36 ` [PATCH v28 20/22] x86/traps: Attempt to fixup exceptions in vDSO before signaling Jarkko Sakkinen 2020-03-03 23:36 ` [PATCH v28 21/22] x86/vdso: Implement a vDSO for Intel SGX enclave call Jarkko Sakkinen 2020-03-11 17:30 ` Nathaniel McCallum 2020-03-11 17:38 ` Jethro Beekman 2020-03-11 19:15 ` Nathaniel McCallum 2020-03-13 15:48 ` Nathaniel McCallum 2020-03-13 16:46 ` Sean Christopherson 2020-03-13 18:32 ` Nathaniel McCallum 2020-03-13 18:44 ` Sean Christopherson 2020-03-13 20:14 ` Nathaniel McCallum 2020-03-13 22:08 ` Sean Christopherson 2020-03-14 14:10 ` Nathaniel McCallum 2020-03-18 23:40 ` Sean Christopherson 2020-03-19 0:38 ` Xing, Cedric 2020-03-19 1:03 ` Sean Christopherson 2020-03-20 13:55 ` Nathaniel McCallum 2020-03-15 1:25 ` Jarkko Sakkinen 2020-03-15 17:53 ` Nathaniel McCallum 2020-03-16 13:31 ` Jethro Beekman 2020-03-16 13:57 ` Nathaniel McCallum 2020-03-16 13:59 ` Jethro Beekman 2020-03-16 14:03 ` Nathaniel McCallum 2020-03-16 17:17 ` Sean Christopherson 2020-03-16 21:27 ` Jarkko Sakkinen 2020-03-16 21:29 ` Jarkko Sakkinen 2020-03-16 22:55 ` Sean Christopherson 2020-03-16 23:56 ` Xing, Cedric 2020-03-18 22:01 ` Jarkko Sakkinen 2020-03-18 22:18 ` Jarkko Sakkinen 2020-03-16 13:56 ` Jarkko Sakkinen 2020-03-16 14:01 ` Nathaniel McCallum 2020-03-16 21:38 ` Jarkko Sakkinen 2020-03-16 22:53 ` Sean Christopherson 2020-03-16 23:50 ` Xing, Cedric 2020-03-16 23:59 ` Sean Christopherson 2020-03-17 0:18 ` Xing, Cedric 2020-03-17 0:27 ` Sean Christopherson 2020-03-17 16:37 ` Nathaniel McCallum 2020-03-17 16:50 ` Nathaniel McCallum 2020-03-17 21:40 ` Xing, Cedric 2020-03-17 22:09 ` Sean Christopherson 2020-03-17 22:36 ` Xing, Cedric 2020-03-17 23:57 ` Sean Christopherson 2020-03-17 22:23 ` Xing, Cedric 2020-03-18 13:01 ` Nathaniel McCallum 2020-03-20 15:53 ` Nathaniel McCallum 2020-03-17 16:28 ` Nathaniel McCallum 2020-03-18 22:58 ` Jarkko Sakkinen 2020-03-18 22:39 ` Jarkko Sakkinen 2020-03-11 19:30 ` Nathaniel McCallum 2020-03-13 0:52 ` Sean Christopherson [this message] 2020-03-13 16:07 ` Nathaniel McCallum 2020-03-13 16:33 ` Sean Christopherson 2020-03-03 23:36 ` [PATCH v28 22/22] selftests/x86: Add vDSO selftest for SGX Jarkko Sakkinen 2020-03-04 19:24 ` [PATCH v28 00/22] Intel SGX foundations Nathaniel McCallum 2020-03-17 16:00 ` Jordan Hand 2020-03-18 21:56 ` Jarkko Sakkinen 2020-03-19 17:16 ` Dr. Greg
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20200313005252.GA1292@linux.intel.com \ --to=sean.j.christopherson@intel.com \ --cc=akpm@linux-foundation.org \ --cc=andriy.shevchenko@linux.intel.com \ --cc=bp@alien8.de \ --cc=cedric.xing@intel.com \ --cc=dave.hansen@intel.com \ --cc=haitao.huang@intel.com \ --cc=jarkko.sakkinen@linux.intel.com \ --cc=jethro@fortanix.com \ --cc=josh@joshtriplett.org \ --cc=kai.huang@intel.com \ --cc=kai.svahn@intel.com \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-sgx@vger.kernel.org \ --cc=luto@amacapital.net \ --cc=luto@kernel.org \ --cc=nhorman@redhat.com \ --cc=npmccallum@redhat.com \ --cc=puiterwijk@redhat.com \ --cc=rientjes@google.com \ --cc=tglx@linutronix.de \ --cc=x86@kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
Linux-Sgx Archive on lore.kernel.org Archives are clonable: git clone --mirror https://lore.kernel.org/linux-sgx/0 linux-sgx/git/0.git # If you have public-inbox 1.1+ installed, you may # initialize and index your mirror using the following commands: public-inbox-init -V2 linux-sgx linux-sgx/ https://lore.kernel.org/linux-sgx \ linux-sgx@vger.kernel.org public-inbox-index linux-sgx Example config snippet for mirrors Newsgroup available over NNTP: nntp://nntp.lore.kernel.org/org.kernel.vger.linux-sgx AGPL code for this site: git clone https://public-inbox.org/public-inbox.git