linux-kernel - Re: [RFC PATCH 6/6] x86/x2apic-savic: Not set APIC backing page if Secure AVIC is not enabled.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <d1dbeac3-42d1-4ca7-a8cf-8d3b27176a98@amd.com>
Date: Wed, 7 May 2025 09:33:40 +0530
From: Neeraj Upadhyay <Neeraj.Upadhyay@....com>
To: Tianyu Lan <ltykernel@...il.com>, kys@...rosoft.com,
 haiyangz@...rosoft.com, wei.liu@...nel.org, decui@...rosoft.com,
 tglx@...utronix.de, mingo@...hat.com, bp@...en8.de,
 dave.hansen@...ux.intel.com, x86@...nel.org, hpa@...or.com,
 yuehaibing@...wei.com, jacob.jun.pan@...ux.intel.com, jpoimboe@...nel.org,
 tiala@...rosoft.com
Cc: linux-hyperv@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [RFC PATCH 6/6] x86/x2apic-savic: Not set APIC backing page if
 Secure AVIC is not enabled.

On 5/6/2025 6:37 PM, Tianyu Lan wrote:
> From: Tianyu Lan <tiala@...rosoft.com>
> 
> When Secure AVIC is not enabled, init_apic_page()
> should return directly.
> 
> Signed-off-by: Tianyu Lan <tiala@...rosoft.com>
> ---
>  arch/x86/kernel/apic/x2apic_savic.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/arch/x86/kernel/apic/x2apic_savic.c b/arch/x86/kernel/apic/x2apic_savic.c
> index 0dd7e39931b0..fb09c0f9e276 100644
> --- a/arch/x86/kernel/apic/x2apic_savic.c
> +++ b/arch/x86/kernel/apic/x2apic_savic.c
> @@ -333,6 +333,9 @@ static void init_apic_page(void)
>  {
>  	u32 apic_id;
>  
> +	if (!cc_platform_has(CC_ATTR_SNP_SECURE_AVIC))
> +		return;
> +
>  	/*

Why is this change needed? init_apic_page() is only called from Secure AVIC driver's
setup() callback. savic_probe() already does this check. So, if this check fails during
savic_probe(), Secure AVIC apic driver won't be selected as apic driver and it's setup
callback will never get invoked.

- Neeraj

>  	 * Before Secure AVIC is enabled, APIC msr reads are intercepted.
>  	 * APIC_ID msr read returns the value from the Hypervisor.