RE: [RFC PATCH v5 05/26] x86/sgx: Introduce virtual EPC for use by KVM guests

Huang, Kai
2021-02-16T21:34:30Z

>
> On Tue, Feb 16, 2021, Dave Hansen wrote:
> > > Having separate device nodes for SGX driver and KVM virtual EPC also
> > > allows separate permission control for running host SGX enclaves and
> > > KVM SGX guests.
> >
> > Specifically, 'sgx_vepc' is a less restrictive interface. It would
> > make a lot of sense to more tightly control access compared to 'sgx_enclave'.
>
> The opposite is just as likely, i.e. exposing SGX to a guest but not allowing
> enclaves in the host. Not from a "sgx_enclave is easier to abuse" perspective,
> but from a "enclaves should never be runnable in the host in our environment".

Agreed. CSP may want to provide SGX service in VMs, but not to run SGX app in host.