Re: [PATCH v8] x86/sgx: Maintain encl->refcount for each encl->mm_list entry

[Dave Hansen]

On 4/14/21 8:51 AM, Sean Christopherson wrote:
>> Could this access to and kfree of encl_mm possibly be after the
>> kfree(encl_mm) noted above?
> No, the mmu_notifier_unregister() ensures that all in-progress notifiers complete
> before it returns, i.e. SGX's notifier call back is not reachable after it's
> unregistered.
> 
>> Also is there a reason we do kfree(encl_mm) in notifier_free not directly in
>> notifier_release?
> Because encl_mm is the anchor to the enclave reference
> 
> 	/* 'encl_mm' is going away, put encl_mm->encl reference: */
> 	kref_put(&encl_mm->encl->refcount, sgx_encl_release);
> 
> as well as the mmu notifier reference (the mmu_notifier_put(mn) call chain).
> Freeing encl_mm immediately would prevent sgx_mmu_notifier_free() from dropping
> the enclave reference.  And the mmu notifier reference need to be dropped in
> sgx_mmu_notifier_release() because the encl_mm has been taken off encl->mm_list.

Haitao, I think you've highlighted that this locking scheme is woefully
under-documented.  Any patches to beef it up would be very welcome.