linux-kernel - Re: [RFC 01/14] x86/apic: Add new driver for Secure AVIC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6f6c1a11-40bd-48dc-8e11-4a1f67eaa43b@amd.com>
Date: Mon, 18 Nov 2024 13:45:13 -0800
From: "Melody (Huibo) Wang" <huibo.wang@....com>
To: Neeraj Upadhyay <Neeraj.Upadhyay@....com>, <linux-kernel@...r.kernel.org>
CC: <tglx@...utronix.de>, <mingo@...hat.com>, <dave.hansen@...ux.intel.com>,
	<Thomas.Lendacky@....com>, <nikunj@....com>, <Santosh.Shukla@....com>,
	<Vasant.Hegde@....com>, <Suravee.Suthikulpanit@....com>, <bp@...en8.de>,
	<David.Kaplan@....com>, <x86@...nel.org>, <hpa@...or.com>,
	<peterz@...radead.org>, <seanjc@...gle.com>, <pbonzini@...hat.com>,
	<kvm@...r.kernel.org>
Subject: Re: [RFC 01/14] x86/apic: Add new driver for Secure AVIC

Hi Neeraj,

On 9/13/2024 4:36 AM, Neeraj Upadhyay wrote:
> From: Kishon Vijay Abraham I <kvijayab@....com>
> 
> The Secure AVIC feature provides SEV-SNP guests hardware acceleration
> for performance sensitive APIC accesses while securely managing the
> guest-owned APIC state through the use of a private APIC backing page.
> This helps prevent malicious hypervisor from generating unexpected
> interrupts for a vCPU or otherwise violate architectural assumptions
> around APIC behavior.
> 
> Add a new x2APIC driver that will serve as the base of the Secure AVIC
> support. It is initially the same as the x2APIC phys driver, but will be
> modified as features of Secure AVIC are implemented.
> 
> Signed-off-by: Kishon Vijay Abraham I <kvijayab@....com>
> Co-developed-by: Neeraj Upadhyay <Neeraj.Upadhyay@....com>
> Signed-off-by: Neeraj Upadhyay <Neeraj.Upadhyay@....com>
> ---
>  arch/x86/Kconfig                    |  12 +++
>  arch/x86/boot/compressed/sev.c      |   1 +
>  arch/x86/coco/core.c                |   3 +
>  arch/x86/include/asm/msr-index.h    |   4 +-
>  arch/x86/kernel/apic/Makefile       |   1 +
>  arch/x86/kernel/apic/x2apic_savic.c | 112 ++++++++++++++++++++++++++++
>  include/linux/cc_platform.h         |   8 ++
>  7 files changed, 140 insertions(+), 1 deletion(-)
>  create mode 100644 arch/x86/kernel/apic/x2apic_savic.c
> 
> diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
> index 007bab9f2a0e..b05b4e9d2e49 100644
> --- a/arch/x86/Kconfig
> +++ b/arch/x86/Kconfig
> @@ -469,6 +469,18 @@ config X86_X2APIC
>  
>  	  If you don't know what to do here, say N.
>  
> +config AMD_SECURE_AVIC
> +	bool "AMD Secure AVIC"
> +	depends on X86_X2APIC && AMD_MEM_ENCRYPT

If we remove the dependency on X2APIC, there are only 3 X2APIC functions which you call from this driver. Can we just expose them in the header, and then simply remove the dependency on X2APIC? 

Thanks
Melody