Linux-Sgx Archive on lore.kernel.org
 help / color / Atom feed
From: Sean Christopherson <sean.j.christopherson@intel.com>
To: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Cc: Nathaniel McCallum <npmccallum@redhat.com>,
	Cedric Xing <cedric.xing@intel.com>,
	Jethro Beekman <jethro@fortanix.com>,
	Andy Lutomirski <luto@amacapital.net>,
	linux-sgx@vger.kernel.org
Subject: Re: [PATCH for_v29 0/8] x86/sgx: Make vDSO callable from C
Date: Sat, 21 Mar 2020 13:11:26 -0700
Message-ID: <20200321201126.GF13851@linux.intel.com> (raw)
In-Reply-To: <20200321005528.GA7166@linux.intel.com>

On Sat, Mar 21, 2020 at 02:55:28AM +0200, Jarkko Sakkinen wrote:
> On Fri, Mar 20, 2020 at 04:25:12PM -0700, Sean Christopherson wrote:
> > On Fri, Mar 20, 2020 at 02:57:24AM +0200, Jarkko Sakkinen wrote:
> > > On Wed, Mar 18, 2020 at 06:11:22PM -0700, Sean Christopherson wrote:
> > > > Sean Christopherson (8):
> > > >   x86/sgx: vdso: Remove an incorrect statement the enter enclave comment
> > > >   x86/sgx: vdso: Make the %rsp fixup on return from handler relative
> > > >   x86/sgx: vdso: Make __vdso_sgx_enter_enclave() callable from C code
> > > >   x86/sgx: vdso: Define a typedef for __vdso_sgx_enter_enclave
> > > >   selftests/x86: sgx: Zero out @result before invoking vDSO sub-test
> > > >   selftests/x86: sgx: Pass EENTER to vDSO wrapper instead of hardcoding
> > > >   selftests/x86: sgx: Stop clobbering non-volatile registers
> > > >   selftests/x86: Add selftest to invoke __vsgx_enter_enclave() from C
> > > > 
> > > >  arch/x86/entry/vdso/vsgx_enter_enclave.S      | 72 ++-----------------
> > > >  arch/x86/include/uapi/asm/sgx.h               | 61 ++++++++++++++++
> > > >  .../selftests/x86/sgx/encl_bootstrap.S        |  6 +-
> > > >  tools/testing/selftests/x86/sgx/main.c        | 17 ++++-
> > > >  tools/testing/selftests/x86/sgx/sgx_call.S    |  1 -
> > > >  tools/testing/selftests/x86/sgx/sgx_call.h    |  2 +-
> > > >  6 files changed, 85 insertions(+), 74 deletions(-)
> > > > 
> > > > -- 
> > > > 2.24.1
> > > > 
> > > 
> > > Might be a grazy idea but better to go through this anyway.
> > > 
> > > Given the premise that we need the carry the callback anyway in all
> > > cases, why won't just have the callback.
> > > 
> > > Why we absolutely need the code path that fills exception info given
> > > that we no matter what need to have a callback route?
> > > 
> > > Would simplify considerably to have only clear flow.
> > 
> > Invoking the callback uses a retpoline, which is non-trivial overhead.
> > For runtimes that need an assembly wrapper for other reasons, and aren't
> > using the untrusted stack, forcing them to implement a handler would be
> > painful.
> 
> The non-callback route only exists because we did not know that we have
> to do the callback route. It does not make sense to add something for
> any other reason than absolute necessity.

The non-callback route exists because it's simpler for the runtime to use
if it already has an asm wrapper and doesn't do stack shenanigans, e.g. the
runtime doesn't need to play games to get context information when handling
an exit.

And using a callback in conjunction with calling the vDSO from C is by no
means necessary, e.g. if the runtime is happy to die on exceptions, or if
it's doing clever clobbering, function annotation, longjump(), etc... to
avoid consuming corrupted state on an exception.

> Things would simplify in the vDSO implementation considerably. Now it is
> overwhelmingly complex for no good reason.

No it wouldn't, it literally saves zero instructions (unless the vDSO
wanted to crash the caller on a NULL pointer exception). It'd do nothing
more than move this code:

	/* Invoke userspace's exit handler if one was provided. */
.Lhandle_exit:
	cmp	$0, 0x20(%rbp)
	jne	.Linvoke_userspace_handler

up to the beginning of the code as

	/* Return -EINVAL if there's no userspace exit handler. */
	cmp	$0, 0x20(%rbp)
	je	.Linvalid_input

and the exit handler invocation would get inlined.  Unless I'm missing some
clever massaging of code, that's it.

At best the above could be dropped, but that's a whopping two instructions
and a single uop.

      reply index

Thread overview: 21+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-03-19  1:11 Sean Christopherson
2020-03-19  1:11 ` [PATCH for_v29 1/8] x86/sgx: vdso: Remove an incorrect statement the enter enclave comment Sean Christopherson
2020-03-19 20:49   ` Jarkko Sakkinen
2020-03-19  1:11 ` [PATCH for_v29 2/8] x86/sgx: vdso: Make the %rsp fixup on return from handler relative Sean Christopherson
2020-03-20  2:39   ` Jarkko Sakkinen
2020-03-20  2:42     ` Jarkko Sakkinen
2020-03-19  1:11 ` [PATCH for_v29 3/8] x86/sgx: vdso: Make __vdso_sgx_enter_enclave() callable from C code Sean Christopherson
2020-03-19 20:03   ` Xing, Cedric
2020-03-19 20:11     ` Sean Christopherson
2020-03-20  3:07       ` Jarkko Sakkinen
2020-03-20 23:26         ` Sean Christopherson
2020-03-21  0:57           ` Jarkko Sakkinen
2020-03-19  1:11 ` [PATCH for_v29 4/8] x86/sgx: vdso: Define a typedef for __vdso_sgx_enter_enclave Sean Christopherson
2020-03-19  1:11 ` [PATCH for_v29 5/8] selftests/x86: sgx: Zero out @result before invoking vDSO sub-test Sean Christopherson
2020-03-19  1:11 ` [PATCH for_v29 6/8] selftests/x86: sgx: Pass EENTER to vDSO wrapper instead of hardcoding Sean Christopherson
2020-03-19  1:11 ` [PATCH for_v29 7/8] selftests/x86: sgx: Stop clobbering non-volatile registers Sean Christopherson
2020-03-19  1:11 ` [PATCH for_v29 8/8] selftests/x86: Add selftest to invoke __vsgx_enter_enclave() from C Sean Christopherson
2020-03-20  0:57 ` [PATCH for_v29 0/8] x86/sgx: Make vDSO callable " Jarkko Sakkinen
2020-03-20 23:25   ` Sean Christopherson
2020-03-21  0:55     ` Jarkko Sakkinen
2020-03-21 20:11       ` Sean Christopherson [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200321201126.GF13851@linux.intel.com \
    --to=sean.j.christopherson@intel.com \
    --cc=cedric.xing@intel.com \
    --cc=jarkko.sakkinen@linux.intel.com \
    --cc=jethro@fortanix.com \
    --cc=linux-sgx@vger.kernel.org \
    --cc=luto@amacapital.net \
    --cc=npmccallum@redhat.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Linux-Sgx Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-sgx/0 linux-sgx/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-sgx linux-sgx/ https://lore.kernel.org/linux-sgx \
		linux-sgx@vger.kernel.org
	public-inbox-index linux-sgx

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-sgx


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git