On 22/10/19 02:08, Sean Christopherson wrote: > Remove the code to initialize IA32_FEATURE_CONTROL MSR when KVM is > loaded now that the MSR is initialized during boot on all CPUs that > support VMX, i.e. can possibly load kvm_intel. > > Reviewed-by: Jim Mattson <[email protected]> > Signed-off-by: Sean Christopherson <[email protected]> > --- > arch/x86/kvm/vmx/vmx.c | 48 +++++++++++++++++------------------------- > 1 file changed, 19 insertions(+), 29 deletions(-)
I am still not sure about this... Enabling VMX is adding a possible attack vector for the kernel, we should not do it unless we plan to do a VMXON. Why is it so important to operate with locked IA32_FEATURE_CONTROL (so that KVM can enable VMX and the kernel can still enable SGX if desired). Paolo
