Received-SPF: pass (google.com: domain of linux-kernel+bounces-154075-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
Message-ID: <3611ea4d-d714-4ef2-9dd5-d1637e806411@intel.com>
Date: Mon, 22 Apr 2024 15:13:06 -0700
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH 15/14] x86/gds: Lock GDS mitigation when keylocker feature
 is present
To: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
CC: <linux-kernel@vger.kernel.org>, <x86@kernel.org>,
	<dan.j.williams@intel.com>, <bernie.keany@intel.com>,
	<charishma1.gairuboyina@intel.com>, Josh Poimboeuf <jpoimboe@kernel.org>,
	<daniel.sneddon@linux.intel.com>, <antonio.gomez.iglesias@linux.intel.com>
References: <20240407230432.912290-1-chang.seok.bae@intel.com>
 <20240419-gds-lock-v1-1-adcbef6ce24b@linux.intel.com>
 <142380d5-27bd-4ddc-8c33-03a2f8701fa2@intel.com>
 <20240422213213.7og6adib7zcbpnys@desk>
Content-Language: en-US
From: "Chang S. Bae" <chang.seok.bae@intel.com>
In-Reply-To: <20240422213213.7og6adib7zcbpnys@desk>
Content-Type: text/plain; charset="UTF-8"; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?b3VueU9QWTdkczBrdGtsZmphUlJzVHpjZVBsTE5pWEJtYThub29EdzFzVm84?=
 =?utf-8?B?ZHRGSGxVeXVCZHhwUWw5UVBLdFRCVjA3L1U2SXFUVElqS21WUkg2UW1ZWDU3?=
 =?utf-8?B?S2t4Z2JNcnZ3TmRBTHBjMUNwbnFVSVhQc3BmU2hEd2ZLWjdFYm14Ujl1RGFC?=
 =?utf-8?B?cVJqV1ZQRHVxWi8yM3FaVVY2OWQyRURwTmhldXdqeFdvaUQyRU02NG5sSWdH?=
 =?utf-8?B?M3FHWEUzd0hiUWpEcXBGT0lXcG44TmxMRkwrT0NLYUZZY0FpclhrbzBnREY3?=
 =?utf-8?B?ZElRN2p0WFM5TFVPMnRQTjl1YmdMdUR2bFUyOHFSaDJ5cW1SUnRsUFprYk1Z?=
 =?utf-8?B?MjBrcnh0S29VTlJLOFUyUEY0YnZVbzVwWFluUXo0azNONFI3L2RQNVlDQ3pY?=
 =?utf-8?B?TzNoY2lzYUUxSTd0WVhoKzFXd2RFUzQyRzErQXM0V21vUUJEdmc0ellkcEV1?=
 =?utf-8?B?VUpEdkVsZG5pbUxjaWpPQkl5ZlFpSGU3c052SWdKaFBvMzNYVVpydzFhbFNi?=
 =?utf-8?B?WThSa2lOSEZ5STJCbjRmelNsblNadnNraGFDdGNxaGlPYXNZVjNDYW1mQ2RW?=
 =?utf-8?B?bHV5QURiMjM5bzNtODVpVkhJNVFFekRWckhsQ0s1R0M0eS9nN0tCcnRHSmxW?=
 =?utf-8?B?UFJwb0VRNG9Rc0tuUDZFWktqd0x1NENaQmtSZU9FVEtFdVJQTnZXZ1RCeEEx?=
 =?utf-8?B?TWMwcHM3QlhrNmRpQWJVN1ZrWmNSeFNCdU9LMDVVVEYrMVFjRC9zaTlaSkZr?=
 =?utf-8?B?c3BiMmlzajAxdU5FN1lCaWdHa1NkSzJGNmt3T3BkdzJUWG1MM0Y5QnZMRUZ1?=
 =?utf-8?B?Vmd3ekkyTkZ4aXV0S2hwR2dUZkhrSU0vbDBraGpzb3creWRGbVJiWXh2ZzVu?=
 =?utf-8?B?WUhBVEpBYUY2V2xrYXBjNWI2L2JMMm0rSW0zamJMNWVPMm1jQ1N1bTFodDJO?=
 =?utf-8?B?QUhNSGJPNGZDVGYyZ25IVUE3ZUlGMVhTbHZ1OUg4Snhpa1p1V1N5U0dyN0JW?=
 =?utf-8?B?cW1UQit5TkFFNHp6aDFoUEtBd1A4SllzNVFDUGJodFhOQUVJYXhDOXVpSTF3?=
 =?utf-8?B?SXpGZzl0dHVuYUdYQlNkWnBheVdKbTJTOG9iNWxPNnlML1kvdWpiSzB0Qk1j?=
 =?utf-8?B?V1RxTFA5bHduZkdPVTZyUTJpclhVZjNTaE5WT0N5V0tTUnRUVmRMbWx1QXUw?=
 =?utf-8?B?UjhROUtKNkRBL3ZoRURZT0JFOUlpTkNXR0lhdXYxbUcyZ0xwc1kvYnU4MmRp?=
 =?utf-8?B?YVNzZEI2aGZrLzN1QlJhY0dReTFSYUJZM1F5K3BCV3VMdHhObzljK3QySUZn?=
 =?utf-8?B?WFFKRDhrVDZNdStickxjdWl3Z2JSMWpTNEZVUE1qTXFoNitrSU4yV3daMStG?=
 =?utf-8?B?U0RoazkreXhIYkhsSXIxbURVSzBLWGhWdGRzOFdnOG9Xam8rcEhTYVlpYXhr?=
 =?utf-8?B?RkwzTVZBUis5RTdTVlc4T3dLM3BncmozRWlIcDFXdm1vbCt4NGM5SzZZbHJk?=
 =?utf-8?B?emRxTmQ0T1QwNi9wS3BMdWg4QUlpMmI3Q0lLSFBPeHdZc1hub3o5UXpGQ0FW?=
 =?utf-8?B?UXZ2Vmp3N1ZXeDB4NEhiN053cG0vbHY0WnZvQW12dzZhc0dpL3c0M0hMSFR5?=
 =?utf-8?B?Y0FuSm9yYnZycFZmTTQ5WktReWRWcDBicmZMZkM4NTIzc3JxUS9Rc25YcEZm?=
 =?utf-8?B?dzdyRi9pYUc0SmVkbk1rUHkyWGxNcHFianpEQnBzUnMyenczUHRrRzVZZFdm?=
 =?utf-8?B?cWhWL0NHM3dTY0VSR3A0QjhsUlo1WTlNR21xc3AxNWFEb0ZsampzWTFTWDVE?=
 =?utf-8?B?clpUK2xYSkNKekRtSGUzNXBuM0xubk5HaFZmZFo3Qk9iZDRVWEF4RmZKREtG?=
 =?utf-8?B?VjJMaC84b2JMRjVMaW83dXVxcnhpTktyY0YzcGRSTXdIWkZKQnFQcWJrLzFQ?=
 =?utf-8?B?cnZUd1ZiUlkwUFVqUkhVQ2hWS2JJS0VZK08zTmQ4RFdCWEkyd1Uvd1R1MDZO?=
 =?utf-8?B?WmlCKzFEUWpOakZEckREaFVJMHduc2hoMUNubWsvcWp6STV1Q3IvZzRnMXFm?=
 =?utf-8?B?Tjd3V3QxTmh1UnNoNHpqRUtHbUwycTFxa3UzUXhncTBSY3BsL0pQR2JFcTdZ?=
 =?utf-8?B?eER2RDBnb0Fnb0lTVVNpK3o3d3F5NG51d0xyN2toVGdscm1aMWtjcGlDZWp5?=
 =?utf-8?B?cVE9PQ==?=
X-MS-Exchange-CrossTenant-Network-Message-Id: ca18f1d4-d70b-48b0-a37b-08dc63196436
X-MS-Exchange-CrossTenant-AuthSource: MW4PR11MB7164.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Apr 2024 22:13:08.7691
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: YqapTMqEDflL/og8Uf9rPQgePsRh7RYz44eFhmV6uGCSCPrr7NDC1uXWMxmTd8P9zjckiSajFC/lxG4goHQvbI0DnRMyl9Xm2gFvG2D96pc=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CO1PR11MB4835
X-OriginatorOrg: intel.com

On 4/22/2024 2:32 PM, Pawan Gupta wrote:
> 
> To enable Key Locker feature, "proper mitigation" is microcode mitigation
> enabled and the GDS_MITG_LOCK bit set in MSR_IA32_MCU_OPT_CTRL. Do you
> agree?
> > If not via this patch, how is GDS_MITG_LOCK going to be set?

The lock bit seems to be set by microcode when SGX is available. 
However, if the lock bit is not set for Key Locker, it does seem odd. 
Introducing kernel code to override this situation might be seen as a 
workaround rather than a proper solution, potentially leading to more 
confusion.

I'd rather investigate the behavior of the microcode further, verify its 
consistency, and gain a clearer understanding of the requirement for 
this lock bit.

Thanks,
Chang