On Thu, Feb 04, 2021, Kai Huang wrote: > On Wed, 2021-02-03 at 09:46 -0800, Dave Hansen wrote: > > On 2/3/21 9:43 AM, Paolo Bonzini wrote: > > > On 03/02/21 18:36, Sean Christopherson wrote: > > > > I'm not at all opposed to preventing KVM from accessing EPC, but I > > > > really don't want to add a special check in KVM to avoid reading EPC. > > > > KVM generally isn't aware of physical backings, and the relevant KVM > > > > code is shared between all architectures. > > > > > > Yeah, special casing KVM is almost always the wrong thing to do. > > > Anything that KVM can do, other subsystems will do as well. > > > > Agreed. Thwarting ioremap itself seems like the right way to go. > > This sounds irrelevant to KVM SGX, thus I won't include it to KVM SGX series. I would say it's relevant, but a pre-existing bug. Same net effect on what's needed for this series.. I say it's a pre-existing bug, because I'm pretty sure KVM can be coerced into accessing the EPC by handing KVM a memslot that's backed by an enclave that was created by host userspace (via /dev/sgx_enclave).
