linux-kernel - Re: [PATCH] x86/apic: Don't disable x2APIC if locked

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 10 Aug 2022 13:06:50 -0700
From:   Daniel Sneddon <daniel.sneddon@...ux.intel.com>
To:     Dave Hansen <dave.hansen@...el.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
        Dave Hansen <dave.hansen@...ux.intel.com>, x86@...nel.org,
        "Shutemov, Kirill" <kirill.shutemov@...el.com>
Cc:     "H. Peter Anvin" <hpa@...or.com>, linux-kernel@...r.kernel.org,
        "Gomez Iglesias, Antonio" <antonio.gomez.iglesias@...el.com>,
        Pawan Gupta <pawan.kumar.gupta@...ux.intel.com>
Subject: Re: [PATCH] x86/apic: Don't disable x2APIC if locked

On 8/10/22 12:59, Dave Hansen wrote:
> On 8/10/22 12:40, Daniel Sneddon wrote:
>>> It it going to be *forced* on those SPR system?  In other words, is it a
>>> little BIOS switch that users can flip?  Is there any non-kernel
>>> workaround if a user hits this, or is the entire burden of this going to
>>> be foisted on the kernel?
>> It won't be forced, BUT, certain features won't be available if the APIC isn't
>> locked.  According to the documentation SGX and TDX won't be available if you
>> don't lock the APIC.  So, yes, you don't have to fix it in the kernel, but you
>> may lose access to features if you don't.
> 
> Let's get some of this in the changelog and _possibly_ Documentation/ so
> that users know we're depending on the BIOS to play nice.  Let's put
> ourselves in the place of our users for a moment at least and try to
> figure out how we play our part to help get them from seeing "can't
> disable x2apic mode" or whatever to them flipping knobs in the BIOS.

I will certainly add this to the changelog.  I could add a blurb to the
documentation where nox2apic is defined as a parameter as well.  If there is a
better place to document that please let me know.

> 
> I also dearly hope that Intel has told BIOS writers that the onus is on
> them *and* those nice BIOS folks listen to Intel. :)
You and me both!  I know this has gone out to our BIOS partners and they are
aware of it.  Beyond that, well, I guess we'll find out when SPR is released!

> 
> In any case, I don't think backports are warranted here at the moment.
> We can always do it in the future if the need arises.