linux-kernel - Re: [PATCH 1/3] x86/x2apic: disable x2apic on resume if the kernel expects so

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <722b53a7-7560-4a1b-ab26-73eeed3dffa5@intel.com>
Date: Wed, 4 Feb 2026 10:53:28 -0800
From: Sohil Mehta <sohil.mehta@...el.com>
To: Shashank Balaji <shashank.mahadasyam@...y.com>
CC: Thomas Gleixner <tglx@...nel.org>, Ingo Molnar <mingo@...hat.com>,
	Borislav Petkov <bp@...en8.de>, Dave Hansen <dave.hansen@...ux.intel.com>,
	<x86@...nel.org>, "H. Peter Anvin" <hpa@...or.com>, Suresh Siddha
	<suresh.b.siddha@...el.com>, "K. Y. Srinivasan" <kys@...rosoft.com>, "Haiyang
 Zhang" <haiyangz@...rosoft.com>, Wei Liu <wei.liu@...nel.org>, Dexuan Cui
	<decui@...rosoft.com>, Long Li <longli@...rosoft.com>, Ajay Kaher
	<ajay.kaher@...adcom.com>, Alexey Makhalov <alexey.makhalov@...adcom.com>,
	Broadcom internal kernel review list <bcm-kernel-feedback-list@...adcom.com>,
	Jan Kiszka <jan.kiszka@...mens.com>, Paolo Bonzini <pbonzini@...hat.com>,
	Vitaly Kuznetsov <vkuznets@...hat.com>, Juergen Gross <jgross@...e.com>,
	Boris Ostrovsky <boris.ostrovsky@...cle.com>, Ingo Molnar <mingo@...e.hu>,
	<linux-kernel@...r.kernel.org>, <linux-hyperv@...r.kernel.org>,
	<virtualization@...ts.linux.dev>, <jailhouse-dev@...glegroups.com>,
	<kvm@...r.kernel.org>, <xen-devel@...ts.xenproject.org>, Rahul Bukte
	<rahul.bukte@...y.com>, Daniel Palmer <daniel.palmer@...y.com>, Tim Bird
	<tim.bird@...y.com>, <stable@...r.kernel.org>
Subject: Re: [PATCH 1/3] x86/x2apic: disable x2apic on resume if the kernel
 expects so

On 2/4/2026 1:17 AM, Shashank Balaji wrote:

> __x2apic_disable disables x2apic only if boot_cpu_has(X86_FEATURE_APIC)
> and x2apic is already enabled. 

I meant the X86_FEATURE_X2APIC and not X86_FEATURE_APIC. But, thinking
about it more, checking that the CPU is really in X2APIC mode by reading
the MSR is good enough.

> x2apic_enabled also does the same checks,
> the only difference being, it uses rdmsrq_safe instead of just rdmsrq,
> which is what __x2apic_disable uses. The safe version is because of
> Boris' suggestion [1]. If that's applicable here as well, then rdmsrq in
> __x2apic_disable should be changed to rdmsrq_safe.

I don't know if there is a strong justification for changing to
rdmsrq_safe() over here. Also, that would be beyond the scope of this
patch. In general, it's better to avoid such changes unless an actual
issue pops up.

> 
>> I considered if an error message should be printed along with this. But,
>> I am not sure if it can really be called a firmware issue. It's probably
>> just that newer CPUs might have started defaulting to x2apic on.
>>
>> Can you specify what platform you are encountering this?
> 
> 
> I'm not sure it's the CPU defaulting to x2apic on. As per Section
> 12.12.5.1 of the Intel SDM:
> 
> 	On coming out of reset, the local APIC unit is enabled and is in
> 	the xAPIC mode: IA32_APIC_BASE[EN]=1 and IA32_APIC_BASE[EXTD]=0.
> 
> So, the CPU should be turning on in xapic mode. In fact, when x2apic is
> disabled in the firmware, this problem doesn't happen.
> 

It's a bit odd then that the firmware chooses to enable x2apic without
the OS requesting it.

Linux maintains a concept of X2APIC_ON_LOCKED in x2apic_state which is
based on the hardware preference to keep the apic in X2APIC mode.

When you have x2apic enabled in firmware, but the system is in XAPIC
mode, can you read the values in MSR_IA32_ARCH_CAPABILITIES and
MSR_IA32_XAPIC_DISABLE_STATUS?

XAPIC shouldn't be disabled because you are running in that mode. But,
it would be good to confirm.


> Either way, a pr_warn maybe helpful. How about "x2apic re-enabled by the
> firmware during resume. Disabling\n"?

I mainly want to make sure the firmware is really at fault before we add
such a print. But it seems likely now that the firmware messed up.