Some applications use the CPUID call instead of /proc/cpuinfo to get
CPU capabilities. In this case, they will still try to use non-functional
RDRAND/RDSEED implementations.

Disables visibility of RDRAND and RDSEED on AMD platforms.

Signed-off-by: Mikhail Paulyshka <me@mixaill.net>
---
 arch/x86/include/asm/msr-index.h       | 1 +
 arch/x86/kernel/cpu/rdrand.c           | 5 +++++
 tools/arch/x86/include/asm/msr-index.h | 1 +
 3 files changed, 7 insertions(+)

diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
index 72765b2fe0d8..bc5ef95cf0cb 100644
--- a/arch/x86/include/asm/msr-index.h
+++ b/arch/x86/include/asm/msr-index.h
@@ -614,6 +614,7 @@
 #define MSR_AMD64_OSVW_STATUS		0xc0010141
 #define MSR_AMD_PPIN_CTL		0xc00102f0
 #define MSR_AMD_PPIN			0xc00102f1
+#define MSR_AMD64_CPUID_FN_7		0xc0011002
 #define MSR_AMD64_CPUID_FN_1		0xc0011004
 #define MSR_AMD64_LS_CFG		0xc0011020
 #define MSR_AMD64_DC_CFG		0xc0011022
diff --git a/arch/x86/kernel/cpu/rdrand.c b/arch/x86/kernel/cpu/rdrand.c
index e9f7ef5dfe25..031c4297a54a 100644
--- a/arch/x86/kernel/cpu/rdrand.c
+++ b/arch/x86/kernel/cpu/rdrand.c
@@ -11,6 +11,7 @@
 #include <asm/processor.h>
 #include <asm/archrandom.h>
 #include <asm/sections.h>
+#include <asm/msr.h>
 
 
 enum { SAMPLES = 8, MIN_CHANGE = 5 };
@@ -46,6 +47,8 @@ void x86_init_rdrand(struct cpuinfo_x86 *c)
 
 	if (failure) {
 		clear_cpu_cap(c, X86_FEATURE_RDRAND);
+		if (c->x86_vendor == X86_VENDOR_AMD || c->x86_vendor == X86_VENDOR_HYGON)
+			msr_clear_bit(MSR_AMD64_CPUID_FN_1, 62);
 		pr_emerg("RDRAND is not reliable on this platform; disabling.\n");
 	}
 }
@@ -82,6 +85,8 @@ void x86_init_rdseed(struct cpuinfo_x86 *c)
 
 	if (failure) {
 		clear_cpu_cap(c, X86_FEATURE_RDSEED);
+		if (c->x86_vendor == X86_VENDOR_AMD || c->x86_vendor == X86_VENDOR_HYGON)
+			msr_clear_bit(MSR_AMD64_CPUID_FN_7, 18);
 		pr_emerg("RDSEED is not reliable on this platform; disabling.\n");
 	}
 }
diff --git a/tools/arch/x86/include/asm/msr-index.h b/tools/arch/x86/include/asm/msr-index.h
index 3ae84c3b8e6d..3deb6c11f134 100644
--- a/tools/arch/x86/include/asm/msr-index.h
+++ b/tools/arch/x86/include/asm/msr-index.h
@@ -612,6 +612,7 @@
 #define MSR_AMD64_OSVW_STATUS		0xc0010141
 #define MSR_AMD_PPIN_CTL		0xc00102f0
 #define MSR_AMD_PPIN			0xc00102f1
+#define MSR_AMD64_CPUID_FN_7		0xc0011002
 #define MSR_AMD64_CPUID_FN_1		0xc0011004
 #define MSR_AMD64_LS_CFG		0xc0011020
 #define MSR_AMD64_DC_CFG		0xc0011022
-- 
2.48.1

On Wed, Mar 12, 2025 at 03:31:30PM +0300, Mikhail Paulyshka wrote:
> @@ -46,6 +47,8 @@ void x86_init_rdrand(struct cpuinfo_x86 *c)
>  
>  	if (failure) {
>  		clear_cpu_cap(c, X86_FEATURE_RDRAND);
> +		if (c->x86_vendor == X86_VENDOR_AMD || c->x86_vendor == X86_VENDOR_HYGON)

Hygon is family 0x18. Have you tested it there?

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette

On 3/12/25 3:45 PM, Borislav Petkov wrote:
> On Wed, Mar 12, 2025 at 03:31:30PM +0300, Mikhail Paulyshka wrote:
>> @@ -46,6 +47,8 @@ void x86_init_rdrand(struct cpuinfo_x86 *c)
>>   
>>   	if (failure) {
>>   		clear_cpu_cap(c, X86_FEATURE_RDRAND);
>> +		if (c->x86_vendor == X86_VENDOR_AMD || c->x86_vendor == X86_VENDOR_HYGON)
> Hygon is family 0x18. Have you tested it there?

My bad, I thought Hygon is backwards compatible with AMD Zen1/2. Then it 
can be removed in case Hygon's MSRs are different.