On Mon, May 20, 2019 at 02:41:05PM +0300, Jarkko Sakkinen wrote: > On Thu, May 16, 2019 at 05:26:15PM -0700, Andy Lutomirski wrote: > > Is userspace actually requred to mmap() the enclave prior to EADDing things? > > Nope, not since v20. Here is what I wrote about API to the kernel > documentation: > > "The enclave life-cycle starts by opening `/dev/sgx/enclave`. After this > there is already a data structure inside kernel tracking the enclave > that is initially uncreated. After this a set of ioctl's can be used to > create, populate and initialize the enclave. > > You can close (if you want) the fd after you've mmap()'d. As long as the > file is open the enclave stays alive so you might want to do that after > you don't need it anymore. Even munmap() won't destruct the enclave if > the file is open. Neither will closing the fd as long as you have > mmap() done over the fd (even if it does not across the range defined in > SECS)." > > Enclave can be created and initialized without doing a single mmap() > call. We could even disallow mmap() before EINIT done. The way enclave management internally works right now is quite robust and completely detached from requiring process address space for anything. /Jarkko
