Ashok,
On Wed, Mar 09 2022 at 12:48, Ashok Raj wrote:
> On Wed, Mar 09, 2022 at 12:32:40PM -0800, Dave Hansen wrote:
>> On 3/9/22 02:40, Cathy Zhang wrote:
>> > This series implements the infrastructure needed to track and tear
>> > down bare-metal enclaves and then run EUPDATESVN. This is expected
>> > to be triggered by administrators via sysfs at some convenient time
>> > after a microcode update, probably by the microcode update tooling
>> > itself.
>>
>> Cathy, if it isn't abundantly clear by now, everyone seems to hate this
>> part of the implementation.
>
> Certainly if there is good information that this ucode brings in SGX fixes
> it absolutely makes sense to do that. Right now this information is only
> communicated via release notes and some other agent like the orchestrator
> decides the kill SGX part.
the point is that the attestation is invalid when you load new
microcode. IOW, the microcode update creates inconsistent state.
Inconsistent state is not subject to discussion. It's wrong independent
of how much handwaving and wishful thinking you apply to it.
If $customer wants to have that then he has the freedom to do so, but we
are not merging any patches which are proliferating the "I want a pony"
mentality.
Thanks,
tglx
