On Thu, Mar 03, 2022 at 01:44:14PM -0800, Dave Hansen wrote: > On 3/3/22 13:23, Reinette Chatre wrote: > > Unfortunately MAP_POPULATE is not supported by SGX VMAs because of their > > VM_IO and VM_PFNMAP flags. When VMAs with such flags obtain this capability > > then I believe that SGX would benefit. > > Some Intel folks asked for this quite a while ago. I think it's > entirely doable: add a new vm_ops->populate() function that will allow > ignoring VM_IO|VM_PFNMAP if present. > > Or, if nobody wants to waste all of the vm_ops space, just add an > arch_vma_populate() or something which can call over into SGX. > > I'll happily review the patches if anyone can put such a beast together. Everyone would be better off, if EAUG's were done unconditionally for mmap() after initialization. Nice property is that this needs no core mm changes. The resource saving argument is at least a bit weak because you might use EMODPR for the address range anyway. So you end up doing things just slower. And to have good confidentiality, you actually probably want to clear also dynamically added pages with EACCEPTCOPY (and zero page) when you take them into use. I find it also a bit worrying that enclave has direct access to allocate kernel resources and trigger ring-0 opcode. I don't like that part at all. syscall/ioctl sets the correct barrier, as the host side should be and is the resource manager, not the enclave. BR, Jarkko
