On Fri, Dec 21, 2018 at 09:12:46AM -0800, Andy Lutomirski wrote: > /dev/sgx/enclave: Each instance is an enclave. > > /dev/sgx/epc: Used to get raw EPC for KVM. Might have different > permissions, perhaps 0660 and group kvm. > > /dev/sgx/something_else: For when SGX v3 adds something else :) Responding again to this anyway now that I have had time think about it. Here is now I see it: 1. /dev/sgx/enclave should be /dev/sgx as it is now. 2. /dev/sgx/epc should be something that you'd reach through /dev/kvm. This essentially a circular dependency. KVM uapi should provide KVM services. Now you sprinkle KVM uapi to two subsystems. 3. "something else" is securityfs (e.g. provisioning). That is kind of stuff that it is meant for. I'm sorry but from my perspective this does not look too good no matter what glasses I put on... /Jarkko
