On Thu, Apr 24, 2025, Elena Reshetova wrote:
> > On Thu, Apr 24, 2025, Elena Reshetova wrote:
> > +void sgx_dec_usage_count(void)
> > +{
> > + if (atomic_dec_return(&sgx_usage_count))
> > + return;
> > +
> > + guard(mutex)(&sgx_svn_lock);
> > +
> > + if (atomic_read(&sgx_usage_count))
> > + return;
> > +
> > + sgx_update_svn();
>
> Why do we want to try to execute this on release also? I would think that
> doing this in sgx_inc_usage_count() is enough.
I assume an actual SVN update takes some amount of time?
If that's correct, then doing the work upon destroying the last enclave is
desirable,
as it's less likely to introduce delay that negatively affects userspace.
Userspace
generally won't care about a 10us delay when destroying a process, but a 10us
delay
to launch an enclave could be quite problematic, e.g. in the TDX use case where
enclaves may be launched on-demand in response to a guest attestation request.
If the update time is tiny, then I agree that hooking release would probably do
more harm than good.
