Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <e0a95ff9-4567-aa2f-fdef-20793ba48c6a@linux.intel.com>
Date:   Wed, 10 Aug 2022 15:56:36 -0700
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.9.1
Content-Language: en-US
To:     Thomas Gleixner <tglx@linutronix.de>,
        Dave Hansen <dave.hansen@intel.com>,
        Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
        Dave Hansen <dave.hansen@linux.intel.com>, x86@kernel.org,
        "Shutemov, Kirill" <kirill.shutemov@intel.com>
Cc:     "H. Peter Anvin" <hpa@zytor.com>, linux-kernel@vger.kernel.org,
        "Gomez Iglesias, Antonio" <antonio.gomez.iglesias@intel.com>,
        Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
References: <20220809234000.783284-1-daniel.sneddon@linux.intel.com>
 <d6ffb489-7024-ff74-bd2f-d1e06573bb82@intel.com>
 <238ea612-5a25-9323-b31f-0a14493db2f7@linux.intel.com>
 <d4bcb22e-224c-d256-cb93-3ff6ed89a7d0@intel.com>
 <341ea6e9-d8f3-ee7a-6794-67408abbf047@linux.intel.com> <87r11nu52l.ffs@tglx>
From:   Daniel Sneddon <daniel.sneddon@linux.intel.com>
Subject: Re: [PATCH] x86/apic: Don't disable x2APIC if locked
In-Reply-To: <87r11nu52l.ffs@tglx>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 8/10/22 15:06, Thomas Gleixner wrote:
> On Wed, Aug 10 2022 at 12:40, Daniel Sneddon wrote:
>> On 8/10/22 11:52, Dave Hansen wrote:
>>> On 8/10/22 11:30, Daniel Sneddon wrote:
>>>>> If it's going to be on one server CPU that's coming out in ten years,
>>>>> then we can hold off.
>>>> SPR will certainly be sooner than 10 years, and with distros running on LTS
>>>> kernels, it is probably worth backporting.  Since this isn't a bug fix (not a sw
>>>> bug anyway), is this something I can just CC stable or is there a better way to
>>>> say "Yes, this is a new feature, BUT, you really want it anyway"?
>>>
>>> It it going to be *forced* on those SPR system?  In other words, is it a
>>> little BIOS switch that users can flip?  Is there any non-kernel
>>> workaround if a user hits this, or is the entire burden of this going to
>>> be foisted on the kernel?
>> It won't be forced, BUT, certain features won't be available if the APIC isn't
>> locked.  According to the documentation SGX and TDX won't be available if you
>> don't lock the APIC.  So, yes, you don't have to fix it in the kernel, but you
>> may lose access to features if you don't.
>>>
>>> The worst case scenario would be if a user has managed to compile a
>>> CONFIG_X86_X2APIC=n kernel and is happily running along until they get a
>>> microcode update, reboot and can't boot any more.
>> That _shouldn't_ happen as it is only on new hardware, so a ucode update
>> _shouldn't_ cause a crash.
> 
> Only on new hardware? The lock mechanism has to be available on _all_
> affected systems which support SGX. See
> 
>  https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/resources/intel-sgx-software-and-tcb-recovery-guidance.html

I asked the architect and security team that came up with that new MSR if it was
going to be backported via ucode updates and I was told no.

"Only SPR and newer. See the IA32_XAPIC_DISABLE_STATUS documentation at
https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/cpuid-enumeration-and-architectural-msrs.html."

So, it appears we have a war between which documentation do we believe!

I do have a few follow up questions I'm waiting on being answered to help
clarify all this.

Thanks,
Dan