On Fri, Jan 14, 2022 at 04:01:33PM -0800, Reinette Chatre wrote: > Hi Jarkko, > > On 1/14/2022 3:15 PM, Jarkko Sakkinen wrote: > > On Fri, Jan 14, 2022 at 03:05:21PM -0800, Reinette Chatre wrote: > >> Hi Jarkko, > > > > How enclave can check a page range that EPCM has the expected permissions? > > Only way to change EPCM permissions from outside enclave is to run ENCLS[EMODPR] > that needs to be accepted from within the enclave via ENCLU[EACCEPT]. At that > time the enclave provides the expected permissions and that will fail > if there is a mismatch with the EPCM permissions (SGX_PAGE_ATTRIBUTES_MISMATCH). This is a very valid point but that does make the introspection possible only at the time of EACCEPT. It does not give tools for enclave to make sure that EMODPR-ETRACK dance was ever exercised. /Jarkko
