RE: [PATCH V2 16/32] x86/sgx: Support restricting of enclave page permissions

[Dhanraj, Vijay]

> On 2/28/22 04:24, Jarkko Sakkinen wrote:
> >> Regarding the recent update of splitting the page permissions change
> >> request into two IOCTLS (RELAX and RESTRICT), can we combine them
> >> into one? That is, revert to how it was done in the v1 version?
> > They are logically separate complex functionalities:
> >
> > 1. "restrict" calls EMODPR and requires EACCEPT 2. "relax" increases
> > permissions up to vetted ("EADD") and could be
> >     combined with EMODPE called inside enclave.
> 
> It would be great to have a _slightly_ better justification than that.
> Existing permission interfaces like chmod or mprotect() don't have this
> asymmetry.
> 
> I think you're saying that the underlying hardware implementation is
> asymmetric, so the interface should be too.  I don't find that argument very
> convincing.  If the hardware interface is arcane and we can make it look more
> sane in the ioctl() layer, we should that, asymmetry or not.
> 

Very nice analogy with `mprotect` and agree to this. It would be simpler from
user space point of view if we can abstract this and maintain a single interface
to relax or restrict permission. But if committee feels having two IOCTLS is the way,
then will modify Gramine to adopt this approach.