On Wed, Jan 08, 2025, Tony Lindgren wrote: > On Tue, Jan 07, 2025 at 02:41:51PM +0200, Nikolay Borisov wrote: > > On 7.01.25 г. 9:37 ч., Tony Lindgren wrote: > > > --- a/arch/x86/kvm/lapic.c > > > +++ b/arch/x86/kvm/lapic.c > > > @@ -139,6 +139,8 @@ __read_mostly DEFINE_STATIC_KEY_FALSE(kvm_has_noapic_vcpu); > > > EXPORT_SYMBOL_GPL(kvm_has_noapic_vcpu); > > > __read_mostly DEFINE_STATIC_KEY_DEFERRED_FALSE(apic_hw_disabled, HZ); > > > +EXPORT_SYMBOL_GPL(apic_hw_disabled); > > > > Is it really required to expose this symbol? apic_hw_disabled is defined as > > static inline in the header? No, apic_hw_disabled can't be "static inline", because it's a variable, not a function. > For loadable modules yes, otherwise we'll get: > > ERROR: modpost: "apic_hw_disabled" [arch/x86/kvm/kvm-intel.ko] undefined! > > This is similar to the EXPORT_SYMBOL_GPL(kvm_has_noapic_vcpu) already > there. Heh, which is a hint that you're using the wrong helper. TDX should check lapic_in_kernel(), not kvm_apic_present(). The former verifies that local APIC emulation/virtualization is handed in-kernel, i.e. by KVM. The latter checks that the local APIC is in-kernel *and* that the vCPU's local APIC is hardware enabled, and checking that the local APIC is hardware enabled is unnecessary and only works by sheer dumb luck. The only reason kvm_create_lapic() stuffs the enable bit is to avoid toggling the static key, which incurs costly IPIs to patch kernel text. If apic_hw_disabled were to be removed (which is somewhat seriously being considered), this code would be deleted and TDX would break. /* * Stuff the APIC ENABLE bit in lieu of temporarily incrementing * apic_hw_disabled; the full RESET value is set by kvm_lapic_reset(). */ vcpu->arch.apic_base = MSR_IA32_APICBASE_ENABLE;
