From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 20AADC43217 for ; Mon, 21 Nov 2022 23:46:44 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 51CFB6B0071; Mon, 21 Nov 2022 18:46:43 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 4A67B6B0073; Mon, 21 Nov 2022 18:46:43 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 346E88E0001; Mon, 21 Nov 2022 18:46:43 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id 21F896B0071 for ; Mon, 21 Nov 2022 18:46:43 -0500 (EST) Received: from smtpin02.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay02.hostedemail.com (Postfix) with ESMTP id DD4CD120A7F for ; Mon, 21 Nov 2022 23:46:42 +0000 (UTC) X-FDA: 80159086644.02.3E2A195 Received: from mga03.intel.com (mga03.intel.com [134.134.136.65]) by imf01.hostedemail.com (Postfix) with ESMTP id B2EFE40008 for ; Mon, 21 Nov 2022 23:46:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1669074399; x=1700610399; h=message-id:date:mime-version:subject:to:cc:references: from:in-reply-to:content-transfer-encoding; bh=ChUK9z0fO3txURJegQq1Ot4LtVL2rrlg1GScs2p04DM=; b=iS/hwFUaKLgyruDqKWzqHOdXSputqjWHzKeC6GpTTPpfoqupCYLMfiUn i0NV7PmYkMy1jDrJlk5wQsnoWOJHm9u8vWJ+DzwuOLiWWqieDyK8k5JUM yOqDrCFLOgxwb8aWYLn5Dex6qoMghI52OFQsIwdwiXWUHtmuL/1PLMIgh C9Rnn8dquzVX/MQlx+6X6/tKtq+jXrajCEFBbCKbQNuAr4yQcf56plsW5 M2m3u1+lGfYy0omhStuR1c2gfxVG1jUKV+kQPNWMgsIYfk4kx/Qz/3HlD 7Dg8my0MtgrkH4q440owC3tYMzvucNY16uyH51AtXIMQ2sQ1IfLnvmKdu Q==; X-IronPort-AV: E=McAfee;i="6500,9779,10538"; a="315508941" X-IronPort-AV: E=Sophos;i="5.96,182,1665471600"; d="scan'208";a="315508941" Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by orsmga103.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 21 Nov 2022 15:46:38 -0800 X-IronPort-AV: E=McAfee;i="6500,9779,10538"; a="747109361" X-IronPort-AV: E=Sophos;i="5.96,182,1665471600"; d="scan'208";a="747109361" Received: from ticela-or-327.amr.corp.intel.com (HELO [10.209.6.63]) ([10.209.6.63]) by fmsmga002-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 21 Nov 2022 15:46:36 -0800 Message-ID: <87e17024-755d-e195-d9ea-ef62a4de6aa8@intel.com> Date: Mon, 21 Nov 2022 15:46:35 -0800 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.2.2 Subject: Re: [PATCH v7 03/20] x86/virt/tdx: Disable TDX if X2APIC is not enabled Content-Language: en-US To: Kai Huang , linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: linux-mm@kvack.org, seanjc@google.com, pbonzini@redhat.com, dan.j.williams@intel.com, rafael.j.wysocki@intel.com, kirill.shutemov@linux.intel.com, ying.huang@intel.com, reinette.chatre@intel.com, len.brown@intel.com, tony.luck@intel.com, peterz@infradead.org, ak@linux.intel.com, isaku.yamahata@intel.com, chao.gao@intel.com, sathyanarayanan.kuppuswamy@linux.intel.com, bagasdotme@gmail.com, sagis@google.com, imammedo@redhat.com References: From: Dave Hansen In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1669074399; a=rsa-sha256; cv=none; b=libYkjODeP3rlDgwmhSI/KHJFOJFNtNkj6WwcWDg2c9TbcntQGZ9E8N+TnB3GoSdUqVuvS 1m911w1t7kHTr3CVMdWJdKeRYup9EI0b21UffEy6YmkGspwjiXq7eiCLpPzRhMKEIZOdsJ fi1V+Y1AOt1hvCDi8G3Y6SYoETIiJLs= ARC-Authentication-Results: i=1; imf01.hostedemail.com; dkim=none ("invalid DKIM record") header.d=intel.com header.s=Intel header.b="iS/hwFUa"; spf=pass (imf01.hostedemail.com: domain of dave.hansen@intel.com designates 134.134.136.65 as permitted sender) smtp.mailfrom=dave.hansen@intel.com; dmarc=pass (policy=none) header.from=intel.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1669074399; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=6NgcnEdWVpMVpFNJphKSPqtM1NZ0GDraTUl2o9PylJg=; b=PjpHT8hGvApnBHY6EFmdWto3gX0valYRxt2BDlkSUAEoivCFeEwAeriZvf9LDQ4p0ncp/W NaN+zEoKoaRzMuPsqiPdBg3RhxHEVZhhtpyTegZbZBnBibadIN7s0VzbBH6Yum2JNwukvR 1mCb/KFgYmzrYHx6iGjpXj34otcgvkc= X-Stat-Signature: nffiycp39x7wndaa41kkup3ddnqdwe6m X-Rspamd-Queue-Id: B2EFE40008 X-Rspam-User: Authentication-Results: imf01.hostedemail.com; dkim=none ("invalid DKIM record") header.d=intel.com header.s=Intel header.b="iS/hwFUa"; spf=pass (imf01.hostedemail.com: domain of dave.hansen@intel.com designates 134.134.136.65 as permitted sender) smtp.mailfrom=dave.hansen@intel.com; dmarc=pass (policy=none) header.from=intel.com X-Rspamd-Server: rspam02 X-HE-Tag: 1669074399-621184 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000300, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On 11/20/22 16:26, Kai Huang wrote: > The MMIO/xAPIC interface has some problems, most notably the APIC LEAK > [1]. This bug allows an attacker to use the APIC MMIO interface to > extract data from the SGX enclave. > > TDX is not immune from this either. Early check X2APIC and disable TDX > if X2APIC is not enabled, and make INTEL_TDX_HOST depend on X86_X2APIC. This makes no sense. This is TDX host code. TDX hosts are untrusted. Zero of the TDX security guarantees are provided by the host. What is the benefit of disabling TDX from the host if x2APIC is not enabled? It can't be for security reasons since the host does not help provide TDX security guarantees. It also can't be for SGX because SGX doesn't depend on the OS doing anything in order to be secure. So, this boils down to the most fundamental of questions you need to answer about every patch: What does this code do? What end-user-visible effect is there if this code is not present?