> On Dec 19, 2018, at 6:45 AM, Sean Christopherson > <sean.j.christopher...@intel.com> wrote: > >> On Wed, Dec 19, 2018 at 09:36:16AM +0000, Jethro Beekman wrote:
> I agree with Jethro, passing the enclave_fd as a param is obnoxious. > And it means the user needs to open /dev/sgx to do anything with an > enclave fd, e.g. the enclave fd might be passed to a builder thread, > it shouldn't also need the device fd. > > E.g.: > > sgx_fd = open("/dev/sgx", O_RDWR); > BUG_ON(sgx_fd < 0); > > enclave_fd = ioctl(sgx_fd, SGX_ENCLAVE_CREATE, &ecreate); > BUG_ON(enclave_fd < 0); > > ret = ioctl(enclave_fd, SGX_ENCLAVE_ADD_PAGE, &eadd); > BUG_ON(ret); > > ... > > ret = ioctl(enclave_fd, SGX_ENCLAVE_INIT, &einit); > BUG_ON(ret); > > ... > > close(enclave_fd); > close(sgx_fd); > > > Take a look at virt/kvm/kvm_main.c to see how KVM manages anon inodes > and ioctls for VMs and vCPUs. Can one of you explain why SGX_ENCLAVE_CREATE is better than just opening a new instance of /dev/sgx for each encalve?