linux-kernel - Re: [PATCH v2] x86, vt-d: enable x2apic opt out

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 11 May 2011 18:21:13 +0100
From:	"Woodhouse, David" <david.woodhouse@...el.com>
To:	"Song, Youquan" <youquan.song@...el.com>
CC:	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"akpm@...ux-foundation.org" <akpm@...ux-foundation.org>,
	"mingo@...e.hu" <mingo@...e.hu>,
	"tglx@...utronix.de" <tglx@...utronix.de>,
	"hpa@...or.com" <hpa@...or.com>,
	"hpa@...ux.intel.com" <hpa@...ux.intel.com>,
	"Kay, Allen M" <allen.m.kay@...el.com>,
	"Siddha, Suresh B" <suresh.b.siddha@...el.com>,
	"Liu, Kent" <kent.liu@...el.com>,
	Youquan Song <youquan.song@...ux.intel.com>
Subject: Re: [PATCH v2] x86, vt-d: enable x2apic opt out

On Thu, 2011-04-14 at 08:06 +0100, Song, Youquan wrote:
> +               pr_info("Not enabling x2apic, firmware requests OS opt-out "
> +                         "x2apic.\n"); 

This output is far too innocuous. At the very least, it should have a
clear statement that this should leave you vulnerable to IRQ injection
attacks that intr-remapping + x2apic would have protected against.

It should probably look more like:

 WARN (1, "Your BIOS is broken and requested that x2apic be disabled\n"
    "This will leave your machine vulnerable to irq-injection attacks\n"
    "Use 'intel_iommu=no_x2apic_optout' to override BIOS request\n");


-- 
David Woodhouse                            Open Source Technology Centre
David.Woodhouse@...el.com                              Intel Corporation

Download attachment "smime.p7s" of type "application/x-pkcs7-signature" (6242 bytes)