On 1/5/21 5:55 PM, Kai Huang wrote:
> --- a/arch/x86/kernel/cpu/feat_ctl.c
> +++ b/arch/x86/kernel/cpu/feat_ctl.c
> @@ -97,6 +97,8 @@ static void clear_sgx_caps(void)
> {
> setup_clear_cpu_cap(X86_FEATURE_SGX);
> setup_clear_cpu_cap(X86_FEATURE_SGX_LC);
> + setup_clear_cpu_cap(X86_FEATURE_SGX1);
> + setup_clear_cpu_cap(X86_FEATURE_SGX2);
> }
Logically, I think you want this *after* the "Allow SGX virtualization
without Launch Control support" patch. As it stands, this will totally
disable SGX (including virtualization) if launch control is unavailable.
