Re: [RFC PATCH v5 05/26] x86/sgx: Introduce virtual EPC for use by KVM guests

Sean Christopherson
2021-02-16T19:26:21Z

On Tue, Feb 16, 2021, Dave Hansen wrote:
> > Having separate device nodes for SGX driver and KVM virtual EPC also
> > allows separate permission control for running host SGX enclaves and
> > KVM SGX guests.
>
> Specifically, 'sgx_vepc' is a less restrictive interface. It would make
> a lot of sense to more tightly control access compared to 'sgx_enclave'.

The opposite is just as likely, i.e. exposing SGX to a guest but not allowing
enclaves in the host. Not from a "sgx_enclave is easier to abuse" perspective,
but from a "enclaves should never be runnable in the host in our environment".