Re: [PATCH RESEND 0/3] x86/sgx: eextend ioctl

[Jethro Beekman]

On 2021-04-02 21:50, Dave Hansen wrote:
> 
> On 4/2/21 12:38 PM, Jethro Beekman wrote:
>> On 2021-04-02 20:42, Dave Hansen wrote:
>>> On 4/2/21 11:31 AM, Jethro Beekman wrote:
>>>> On 2021-04-02 17:53, Dave Hansen wrote:
>>>>> But, why would an enclave loader application ever do this?
>>>>
>>>> e.g. to save space
>>>
>>> How does this save space, exactly?  What space does it save?
>>
>> With the current driver interface, if you want to communicate an 
>> application binary that has pages that are at least partially
>> measured, you need to communicate the entire page (to ensure the same
>> measurement for the entire page), even though most of  that page's contents
>> are irrelevant to the application.
> 
> Again, how does this save space?
> 
> Are you literally talking about the temporary cost of allocating *one* page?

No I'm talking about the amount of disk space/network traffic needed to distribute the application.

> 
>>> We don't blindly support CPU features in Linux.  They need to do
>>> something *useful*.  I'm still missing what this does which is
>>> useful.
>>
>> Enclaves can only be loaded exactly as specified by the developer,
> this is the whole point of the measurement architecture. By not
> supporting arbitrary EADD/EEXTEND flows, the SGX application ecosystem
> is effectively split into two: SGX applications that run everywhere and
> SGX applications that run everywhere except on Linux. So, the "something
> useful" is being compatible. Linux has plenty of features that exist
> solely for compatibility with other systems, such as binfmt_misc.
> 
> That's a mildly compelling argument.  Is it theoretical or practical?
> Are folks *practically* going to run the same enclave binaries on Linux
> and Windows?

This is certainly practical. As you mention below, enclaves don't interact with the OS, so this should really be the default. It's quite puzzling to me that the Intel SGX SDK /doesn't/ let you do this (easily, it's possible with https://github.com/fortanix/rust-sgx/blob/master/sgxs-tools/src/bin/isgx-pe2sgx.rs). The x86_64-fortanix-unknown-sgx target that's part of Rust is fully designed to be OS-agnostic.

> 
> I guess the enclave never interacts with the OS directly, so this is
> _possible_.  But, are enclaves really that divorced from the "runtimes"
> which *are* OS-specific?
> 
>>> Does any actual, real-world enclave want this functionality?  Why?
> 
> I didn't see an answer on this one.

Yes, we have enclaves that use this functionality. They already exist so they can't be changed (without changing the measurement) and we'd like to stop using the out of tree driver as soon as possible. However, we are not able to load the enclaves.

> 
>>> P.S. There are plenty of things you can do with the SGX
>>> architecture that we probably won't ever implement in Linux.
>>
>> How so? 
> 
> For example, the architecture allows swapping VA pages and guest enclave
> pages.  But, we may never do either of those.
> 

This is not an application-visible part of the architecture.* Resource management is squarely in the kernel's purview.

(* I suppose you could argue that without VA paging the practical enclave size is limited to 512× the EPC size, so ~46GiB for systems with 128MiB PRM Considering the overhead of EPC paging in general, that really seems more of a theoretical limitations)

--
Jethro Beekman | Fortanix

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature