Re: x86/sgx: uapi change proposal
From: Jarkko Sakkinen
Date: Sat Dec 22 2018 - 11:55:24 EST
On Fri, Dec 21, 2018 at 09:12:46AM -0800, Andy Lutomirski wrote:
> /dev/sgx/enclave: Each instance is an enclave.
> /dev/sgx/epc: Used to get raw EPC for KVM. Might have different
> permissions, perhaps 0660 and group kvm.
> /dev/sgx/something_else: For when SGX v3 adds something else :)
Responding again to this anyway now that I have had time think about
Here is now I see it:
1. /dev/sgx/enclave should be /dev/sgx as it is now.
2. /dev/sgx/epc should be something that you'd reach through /dev/kvm.
This essentially a circular dependency. KVM uapi should provide
KVM services. Now you sprinkle KVM uapi to two subsystems.
3. "something else" is securityfs (e.g. provisioning). That is kind of
stuff that it is meant for.
I'm sorry but from my perspective this does not look too good no
matter what glasses I put on...