On 22/10/19 02:08, Sean Christopherson wrote: > Remove the code to initialize IA32_FEATURE_CONTROL MSR when KVM is > loaded now that the MSR is initialized during boot on all CPUs that > support VMX, i.e. can possibly load kvm_intel. > > Reviewed-by: Jim Mattson <jmattson@xxxxxxxxxx> > Signed-off-by: Sean Christopherson <sean.j.christopherson@xxxxxxxxx> > --- > arch/x86/kvm/vmx/vmx.c | 48 +++++++++++++++++------------------------- > 1 file changed, 19 insertions(+), 29 deletions(-) I am still not sure about this... Enabling VMX is adding a possible attack vector for the kernel, we should not do it unless we plan to do a VMXON. Why is it so important to operate with locked IA32_FEATURE_CONTROL (so that KVM can enable VMX and the kernel can still enable SGX if desired). Paolo
