Commit 30c2b98a authored by Neeraj Upadhyay's avatar Neeraj Upadhyay Committed by Borislav Petkov (AMD)
Browse files

x86/apic: Add new driver for Secure AVIC 



The Secure AVIC feature provides SEV-SNP guests hardware acceleration for
performance sensitive APIC accesses while securely managing the guest-owned
APIC state through the use of a private APIC backing page. 

This helps prevent the hypervisor from generating unexpected interrupts for
a vCPU or otherwise violate architectural assumptions around the APIC
behavior.

Add a new x2APIC driver that will serve as the base of the Secure AVIC
support. It is initially the same as the x2APIC physical driver (without IPI
callbacks), but will be modified as features are implemented.

As the new driver does not implement Secure AVIC features yet, if the
hypervisor sets the Secure AVIC bit in SEV_STATUS, maintain the existing
behavior to enforce the guest termination.

  [ bp: Massage commit message. ]

Co-developed-by: default avatarKishon Vijay Abraham I <kvijayab@amd.com>
Signed-off-by: default avatarKishon Vijay Abraham I <kvijayab@amd.com>
Signed-off-by: default avatarNeeraj Upadhyay <Neeraj.Upadhyay@amd.com>
Signed-off-by: default avatarBorislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: default avatarTianyu Lan <tiala@microsoft.com>
Link: https://lore.kernel.org/20250828070334.208401-2-Neeraj.Upadhyay@amd.com
parent 1b558e14

arch/x86/Kconfig

+13 −0
Original line number Diff line number Diff line
@@ -483,6 +483,19 @@ config X86_X2APIC 


	  If in doubt, say Y.



config AMD_SECURE_AVIC

	bool "AMD Secure AVIC"

	depends on AMD_MEM_ENCRYPT && X86_X2APIC

	help

	  Enable this to get AMD Secure AVIC support on guests that have this feature.



	  AMD Secure AVIC provides hardware acceleration for performance sensitive

	  APIC accesses and support for managing guest owned APIC state for SEV-SNP

	  guests. Secure AVIC does not support xAPIC mode. It has functional

	  dependency on x2apic being enabled in the guest.



	  If you don't know what to do here, say N.



config X86_POSTED_MSI

	bool "Enable MSI and MSI-x delivery by posted interrupts"

	depends on X86_64 && IRQ_REMAP

arch/x86/boot/compressed/sev.c

+1 −0
Original line number Diff line number Diff line
@@ -235,6 +235,7 @@ bool sev_es_check_ghcb_fault(unsigned long address) 
				 MSR_AMD64_SNP_VMSA_REG_PROT |		\

				 MSR_AMD64_SNP_RESERVED_BIT13 |		\

				 MSR_AMD64_SNP_RESERVED_BIT15 |		\

				 MSR_AMD64_SNP_SECURE_AVIC |		\

				 MSR_AMD64_SNP_RESERVED_MASK)



/*

arch/x86/coco/core.c

+3 −0
Original line number Diff line number Diff line
@@ -104,6 +104,9 @@ static bool noinstr amd_cc_platform_has(enum cc_attr attr) 
	case CC_ATTR_HOST_SEV_SNP:

		return cc_flags.host_sev_snp;



	case CC_ATTR_SNP_SECURE_AVIC:

		return sev_status & MSR_AMD64_SNP_SECURE_AVIC;



	default:

		return false;

	}

arch/x86/coco/sev/core.c

+1 −0
Original line number Diff line number Diff line
@@ -79,6 +79,7 @@ static const char * const sev_status_feat_names[] = { 
	[MSR_AMD64_SNP_IBS_VIRT_BIT]		= "IBSVirt",

	[MSR_AMD64_SNP_VMSA_REG_PROT_BIT]	= "VMSARegProt",

	[MSR_AMD64_SNP_SMT_PROT_BIT]		= "SMTProt",

	[MSR_AMD64_SNP_SECURE_AVIC_BIT]		= "SecureAVIC",

};



/*

arch/x86/include/asm/msr-index.h

+3 −1
Original line number Diff line number Diff line
@@ -699,7 +699,9 @@ 
#define MSR_AMD64_SNP_VMSA_REG_PROT	BIT_ULL(MSR_AMD64_SNP_VMSA_REG_PROT_BIT)

#define MSR_AMD64_SNP_SMT_PROT_BIT	17

#define MSR_AMD64_SNP_SMT_PROT		BIT_ULL(MSR_AMD64_SNP_SMT_PROT_BIT)

#define MSR_AMD64_SNP_RESV_BIT		18

#define MSR_AMD64_SNP_SECURE_AVIC_BIT	18

#define MSR_AMD64_SNP_SECURE_AVIC	BIT_ULL(MSR_AMD64_SNP_SECURE_AVIC_BIT)

#define MSR_AMD64_SNP_RESV_BIT		19

#define MSR_AMD64_SNP_RESERVED_MASK	GENMASK_ULL(63, MSR_AMD64_SNP_RESV_BIT)

#define MSR_AMD64_RMP_BASE		0xc0010132

#define MSR_AMD64_RMP_END		0xc0010133