From: "Huang, Kai" <kai.huang@intel.com>
To: "linux-sgx@vger.kernel.org" <linux-sgx@vger.kernel.org>,
"dave.hansen@linux.intel.com" <dave.hansen@linux.intel.com>
Cc: "pbonzini@redhat.com" <pbonzini@redhat.com>,
"jarkko@kernel.org" <jarkko@kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"Christopherson,, Sean" <seanjc@google.com>,
"haitao.huang@linux.intel.com" <haitao.huang@linux.intel.com>
Subject: Re: [PATCH] x86/sgx: Allow exposing EDECCSSA user leaf function to KVM guest
Date: Wed, 17 Aug 2022 09:49:25 +0000 [thread overview]
Message-ID: <5efaad269ff8dfcbecff311dd42b019530995049.camel@intel.com> (raw)
In-Reply-To: <20220727115442.464380-1-kai.huang@intel.com>
On Wed, 2022-07-27 at 23:54 +1200, Kai Huang wrote:
> Coupled with the new SGX attribute to allow one enclave to receive the
> AEX notification, SGX also adds a new EDECCSSA user leaf function to
> facilitate the AEX notification handling. The new EDECCSSA is
> enumerated via CPUID(EAX=0x12,ECX=0x0):EAX[11].
>
> Besides Allowing reporting the new AEX-notify attribute to KVM guests,
> also allow reporting the new EDECCSSA user leaf function to KVM guests
> so the guest can fully utilize the AEX-notify mechanism.
>
> Introduce a new X86 CPU feature flag for the new EDECCSSA, and report it
> in KVM's supported CPUIDs so the userspace hypervisor (i.e. Qemu) can
> enable it for the guest.
>
> Note there's no additional enabling work required to allow guest to use
> the new EDECCSSA. KVM is not able to trap ENCLU anyway.
>
> More background about how do AEX-notify and EDECCSSA work:
>
> The new Asynchronous Exit (AEX) notification mechanism (AEX-notify)
> allows one enclave to receive a notification in the ERESUME after the
> enclave exit due to an AEX. EDECCSSA is a new SGX user leaf function
> (ENCLU[EDECCSSA]) to facilitate the AEX notification handling.
>
> SGX maintains a Current State Save Area Frame (CSSA) for each enclave
> thread. When AEX happens, the enclave thread context is saved to the
> CSSA and the CSSA is increased by 1. For a normal ERESUME which doesn't
> deliver AEX notification, it restores the saved thread context from the
> previously saved SSA and decreases the CSSA. If AEX-notify is enabled
> for one enclave, the ERESUME acts differently. Instead of restoring the
> saved thread context and decreasing the CSSA, it acts like EENTER which
> doesn't decrease the CSSA but establishes a clean slate thread context
> at the CSSA for the enclave to handle the notification. After some
> handling, the enclave must discard the "new-established" SSA and switch
> back to the previous saved SSA (upon AEX). Otherwise, the enclave will
> run out of SSA space upon further AEXs and eventually fail to run.
>
> To solve this problem, the new EDECCSSA essentially decreases the CSSA.
> It can be used by the enclave notification handler to switch back to the
> previous saved SSA when needed, i.e. after it handles the notification.
>
> Signed-off-by: Kai Huang <kai.huang@intel.com>
> ---
> Hi Dave,
>
> This is the patch you requested. Feel free to merge.
>
> This patch isn't tested and needs KVM maintainers' review.
Sorry this patch has bugs. I forgot to handle the new X86_FEATURE_SGX_EDECCSSA
bit in scattered CPUID handling (and forgot to add it to the CPUID dependency
table). Will send v2 after testing.
--
Thanks,
-Kai
prev parent reply other threads:[~2022-08-17 9:50 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-07-27 11:54 [PATCH] x86/sgx: Allow exposing EDECCSSA user leaf function to KVM guest Kai Huang
2022-08-17 9:49 ` Huang, Kai [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5efaad269ff8dfcbecff311dd42b019530995049.camel@intel.com \
--to=kai.huang@intel.com \
--cc=dave.hansen@linux.intel.com \
--cc=haitao.huang@linux.intel.com \
--cc=jarkko@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-sgx@vger.kernel.org \
--cc=pbonzini@redhat.com \
--cc=seanjc@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).