On 10/19/20 10:53 AM, Sean Christopherson wrote: >>> SGX1 CPUs take an erratum on the #PF behavior, e.g. "KBW90 Violation of Intel >>> SGX Access-Control Requirements Produce #GP Instead of #PF". >>> >>> https://www.intel.com/content/dam/www/public/us/en/documents/specification-updates/xeon-e3-1200v6-spec-update.pdf >> OK, but that's only for "Intel ® Xeon ® E3-1200 v6 Processor Family", >> specifically stepping B-0. That's far from a broad erratum. I *see* it >> in other errata lists, but I still think this is too broad. >> >> Also, what if a hypervisor masks the SGX2 cpuid bit on SGX2-capable >> hardware? Won't the hardware still exhibit the erratum? >> >> I don't think we can control model-specific errata behavior with an >> architectural CPUID bit. > Hmm, true. Checking for #PF _or_ #GP on SGX1 CPUs would be my first choice. > ENCLS #GPs for other reasons, most of which would indicate a kernel bug. It'd > be nice to limit the "#GP is expected, sort of" behavior to CPUs that might be > affected by an erratum. Yes, agreed. We need a model/family/stepping list of all the affected CPUs, and a normal old match_cpu() or whatever. If a hypervisor lies about model/family/stepping, then the fallout is on them, not the guest.
