linux-kernel - Re: [PATCH] x86/apic: Don't disable x2APIC if locked

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 10 Aug 2022 16:09:02 -0700
From:   Dave Hansen <dave.hansen@...el.com>
To:     Daniel Sneddon <daniel.sneddon@...ux.intel.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
        Dave Hansen <dave.hansen@...ux.intel.com>, x86@...nel.org,
        "Shutemov, Kirill" <kirill.shutemov@...el.com>,
        "Huang, Kai" <kai.huang@...el.com>
Cc:     "H. Peter Anvin" <hpa@...or.com>, linux-kernel@...r.kernel.org,
        "Gomez Iglesias, Antonio" <antonio.gomez.iglesias@...el.com>,
        Pawan Gupta <pawan.kumar.gupta@...ux.intel.com>
Subject: Re: [PATCH] x86/apic: Don't disable x2APIC if locked

On 8/10/22 16:03, Daniel Sneddon wrote:
> On 8/10/22 15:06, Thomas Gleixner wrote:
>> So this affects already deployed systems and we have to
>>
>>   - backport the x2apic lock changes
>>
>>   - provide proper diagnostics
>>
>>   - make SGX and TDX depend on X2APIC support
> I'll add the comments Dave mentioned earlier, and will make SGX and TDX depend
> on X2APIC since that makes sense regardless of what hw ends up with this change.
>  Unless we want to get rid of CONFIG_X86_X2APIC like Dave mentioned?

The TDX guest support in the kernel isn't _actually_ related to this*.
It's the host-side support that matters and that isn't merged yet.  I've
cc'd Kai so he doesn't forget to do this.

I agree on the SGX side, though.

* TDX guest support already has this dependency, but it's for unrelated
  reasons:

config INTEL_TDX_GUEST
        bool "Intel TDX (Trust Domain Extensions) - Guest Support"
        depends on X86_64 && CPU_SUP_INTEL
        depends on X86_X2APIC