Consider rejecting CPUs vulnerable to MMIO stale data and AEPIC leak

[DemiMarie]

Description of the feature

Drop support for CPUs vulnerable to MMIO stale data and AEPIC leak.

Why Gramine should implement it?

This would allow removing workarounds for hardware vulnerabilities and make the exitless feature secure again.

[kailun-qin]

Thanks for this request! I have a few questions:

... CPUs vulnerable to MMIO stale data and AEPIC leak

Just wanted to confirm, are we referring to CPUs vulnerable to the issues described in INTEL-SA-00657 and INTEL-SA-00615?

Drop support for CPUs ...

In SGX, I don't think we can reliably detect the processor family model (e.g., via CPUID). How do you propose we implement this "dropping"? Specifically, do you mean we should update Gramine doc to explicitly state which processors are not supported, remove the software workarounds/mitigations, and then safely (re-)mark the exitless feature as secure?

According to this affected processors table, taking Xeon CPUs as an example, only 6th gen are marked as "Not Affected" for both SAs, while 4th and 5th gens require "Hardware + Software" for INTEL-SA-00657. Are you suggesting that we drop support for all Xeon CPUs before the 6th gen, or just those before the 4th gen, or even consider those older gens but patched?

[DemiMarie]

Drop support for CPUs ...

In SGX, I don't think we can reliably detect the processor family model (e.g., via CPUID). How do you propose we implement this "dropping"? Specifically, do you mean we should update Gramine doc to explicitly state which processors are not supported, remove the software workarounds/mitigations, and then safely (re-)mark the exitless feature as secure?

Another option would be to enable exitless only when those two have been mitigated in hardware.