On Tue, Feb 16, 2021, Dave Hansen wrote: > > Having separate device nodes for SGX driver and KVM virtual EPC also > > allows separate permission control for running host SGX enclaves and > > KVM SGX guests. > > Specifically, 'sgx_vepc' is a less restrictive interface. It would make > a lot of sense to more tightly control access compared to 'sgx_enclave'. The opposite is just as likely, i.e. exposing SGX to a guest but not allowing enclaves in the host. Not from a "sgx_enclave is easier to abuse" perspective, but from a "enclaves should never be runnable in the host in our environment".
