diff mbox series

[v2] x86/intel: Clear SGX feature bit if both SGX driver and KVM SGX are not enabled

Message ID 20220909111331.558936-1-kai.huang@intel.com (mailing list archive)
State New, archived
Headers show
Series [v2] x86/intel: Clear SGX feature bit if both SGX driver and KVM SGX are not enabled | expand

Commit Message

Huang, Kai Sept. 9, 2022, 11:13 a.m. UTC 
Currently on platform which has SGX enabled, if CONFIG_X86_SGX is not
enabled, the X86_FEATURE_SGX bit is not cleared in init_ia32_feat_ctl().
This results in /proc/cpuinfo still showing "sgx" feature when the
kernel doesn't support SGX at all, which is not desired.

Clear SGX feature bit if both SGX driver and KVM SGX are not enabled in
init_ia32_feat_ctl().

Signed-off-by: Kai Huang <kai.huang@intel.com>
---

Hi Dave, Sean, Jarkko,

Could you help to review?  Tested on SGX (BIOS) enabled machine with
CONFIG_X86_SGX unset.

This patch is generated on latest tip/master, but it applies to
tip/x86/sgx cleanly as well.

v1 -> v2:

 - Move the check down after checking X86_FEATURE_VMX which may set
   enable_sgx_kvm to false.
 - Slightly improve changelog.
 - Change "Clear SGX bit" to "Clear SGX feature bit" in patch title.

---
 arch/x86/kernel/cpu/feat_ctl.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)


base-commit: b8b09110cf290fdab4006b717da7a776ffb0cb73
diff mbox series

Patch

diff --git a/arch/x86/kernel/cpu/feat_ctl.c b/arch/x86/kernel/cpu/feat_ctl.c
index 993697e71854..79d18caebff1 100644
--- a/arch/x86/kernel/cpu/feat_ctl.c
+++ b/arch/x86/kernel/cpu/feat_ctl.c
@@ -200,6 +200,19 @@  void init_ia32_feat_ctl(struct cpuinfo_x86 *c)
 		enable_sgx_kvm = 0;
 	}
 
+	/*
+	 * By reaching here, it is certain that:
+	 *  - CPU supports SGX.
+	 *  - SGX is enabled by BIOS.
+	 *
+	 * However if both SGX driver and KVM SGX are not enabled, just
+	 * need to clear SGX feature bit.
+	 */
+	if (!enable_sgx_driver && !enable_sgx_kvm) {
+		clear_cpu_cap(c, X86_FEATURE_SGX);
+		return;
+	}
+
 	if (!(msr & FEAT_CTL_SGX_LC_ENABLED) && enable_sgx_driver) {
 		if (!enable_sgx_kvm) {
 			pr_err_once("SGX Launch Control is locked. Disable SGX.\n");