Re: [RFC 01/14] x86/apic: Add new driver for Secure AVIC
From: Melody (Huibo) Wang
Date: Mon Nov 18 2024 - 16:45:47 EST
Hi Neeraj,
On 9/13/2024 4:36 AM, Neeraj Upadhyay wrote:
> From: Kishon Vijay Abraham I <kvijayab@xxxxxxx>
>
> The Secure AVIC feature provides SEV-SNP guests hardware acceleration
> for performance sensitive APIC accesses while securely managing the
> guest-owned APIC state through the use of a private APIC backing page.
> This helps prevent malicious hypervisor from generating unexpected
> interrupts for a vCPU or otherwise violate architectural assumptions
> around APIC behavior.
>
> Add a new x2APIC driver that will serve as the base of the Secure AVIC
> support. It is initially the same as the x2APIC phys driver, but will be
> modified as features of Secure AVIC are implemented.
>
> Signed-off-by: Kishon Vijay Abraham I <kvijayab@xxxxxxx>
> Co-developed-by: Neeraj Upadhyay <Neeraj.Upadhyay@xxxxxxx>
> Signed-off-by: Neeraj Upadhyay <Neeraj.Upadhyay@xxxxxxx>
> ---
> arch/x86/Kconfig | 12 +++
> arch/x86/boot/compressed/sev.c | 1 +
> arch/x86/coco/core.c | 3 +
> arch/x86/include/asm/msr-index.h | 4 +-
> arch/x86/kernel/apic/Makefile | 1 +
> arch/x86/kernel/apic/x2apic_savic.c | 112 ++++++++++++++++++++++++++++
> include/linux/cc_platform.h | 8 ++
> 7 files changed, 140 insertions(+), 1 deletion(-)
> create mode 100644 arch/x86/kernel/apic/x2apic_savic.c
>
> diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
> index 007bab9f2a0e..b05b4e9d2e49 100644
> --- a/arch/x86/Kconfig
> +++ b/arch/x86/Kconfig
> @@ -469,6 +469,18 @@ config X86_X2APIC
>
> If you don't know what to do here, say N.
>
> +config AMD_SECURE_AVIC
> + bool "AMD Secure AVIC"
> + depends on X86_X2APIC && AMD_MEM_ENCRYPT
If we remove the dependency on X2APIC, there are only 3 X2APIC functions which you call from this driver. Can we just expose them in the header, and then simply remove the dependency on X2APIC?
Thanks
Melody