From nobody Tue Sep 29 07:39:12 2026 Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 6AED01A262D; Tue, 11 Aug 2026 00:31:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=13.77.154.182 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786408293; cv=none; b=Dnn35AVuSMhdBmgxUpuTd9xGaGEWRDCXb99das5w6Wpg8BqEeXwza3PnHEsdWEuEAocApCT7igNSkFI6Z6dBLgNHNrOGkXIQg0xUxSSUjuBbfkDS5RS5BPSqeKXBVyvWd9UZoiuxZH+BsAXmqLymeiwiMov/NiEARLFA0d8rObs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786408293; c=relaxed/simple; bh=vD/1xyD4x0O+SOaF7e3FAXKzc62XgRJ2Pm15YNdeUDg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ns3h3wGaPD49NaQIMXl6Ha1Gi8eqxuWcoO7tPVL33qWUx6vWx763fkwcmqPWLe/QpVl5dTvw6e6LdqPKCplhnrDpBbHmWCYKb1rvfhVvD/FcZ9jF4fnXXVfGsEGNcd/0EBvESHUxVNteMeawh6UhOOjzFEY/PGqoGklxNJ3n4SE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.microsoft.com; spf=pass smtp.mailfrom=linux.microsoft.com; dkim=pass (1024-bit key) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.b=LAPelJQ7; arc=none smtp.client-ip=13.77.154.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.microsoft.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.microsoft.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.b="LAPelJQ7" Received: from fedora (unknown [20.191.74.188]) by linux.microsoft.com (Postfix) with ESMTPSA id 5704D20B7168; Mon, 10 Aug 2026 17:31:08 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 5704D20B7168 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1786408268; bh=RjeJfiki2yJGR4FsvTJyiKdSy893l2hl2iMbxJm+DTY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LAPelJQ7ZiUtnLa/gRYc9ydIaH57mkjhHjT+tO1gmQKTpJJr11REbSSoxEntXDomq K7MAJlCQzdxQfcv+gbTlxoM2PeDWckWlxU0Xf3j6Senl6YqAbx+6OHQneFZSNePjAj VtYj86lvbCqtXskFWCjZlAV5T0549Z5dvDNrJ1MA= From: Sriram Nambakam To: kvm@vger.kernel.org Cc: linux-kernel@vger.kernel.org Subject: [RFC PATCH v2 1/4] kvm: uapi: reserve VM-plane and VBS hypercall numbers Date: Mon, 10 Aug 2026 17:31:11 -0700 Message-ID: <20260811003114.30107-2-snambakam@linux.microsoft.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260811003114.30107-1-snambakam@linux.microsoft.com> References: <20260811003114.30107-1-snambakam@linux.microsoft.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Reserve the paravirt hypercall numbers used by the KVM VM-planes and VBS (Virtualization-Based Security) host support: 13 KVM_HC_VM_PLANES_CONFIG configure plane memory (serviced by the VM= M) 14 KVM_HC_VM_PLANES_ACTIVATE create+activate a plane vCPU (serviced by = VMM) 15 KVM_HC_VBS_VTL_CALL normal plane -> secure plane 16 KVM_HC_VBS_VTL_RETURN secure plane -> normal plane This patch only reserves the numbers; the handlers are added separately. --- include/uapi/linux/kvm_para.h | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/include/uapi/linux/kvm_para.h b/include/uapi/linux/kvm_para.h index 960c7e93d1a9..08b52d25ca17 100644 --- a/include/uapi/linux/kvm_para.h +++ b/include/uapi/linux/kvm_para.h @@ -30,6 +30,10 @@ #define KVM_HC_SEND_IPI 10 #define KVM_HC_SCHED_YIELD 11 #define KVM_HC_MAP_GPA_RANGE 12 +#define KVM_HC_VM_PLANES_CONFIG 13 +#define KVM_HC_VM_PLANES_ACTIVATE 14 +#define KVM_HC_VBS_VTL_CALL 15 +#define KVM_HC_VBS_VTL_RETURN 16 =20 /* * hypercalls use architecture specific --=20 2.55.0 From nobody Tue Sep 29 07:39:12 2026 Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 6877823909F; Tue, 11 Aug 2026 00:31:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=13.77.154.182 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786408294; cv=none; b=VQgwUCqnKjTv4xMIH6Y0LIsbl7TUYWab+Fs2ABAOHTQV9TcA+RlvfpuQJkqc62yZbOIdI0K4mvSVKUPGz/BHMVcx4/Mzw24kQ/XIZLJtKhRHtQYhU0PkcArhQjtoJpthzJ44phM9pDD9KY/lU/Krmdfdt9Eztv7pYN49wE0ep9I= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786408294; c=relaxed/simple; bh=PlML28fPHIWbjfqA+93921gTEAnis92hqz5OxNfAAfk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=BHRIPyFtWjDNrl0qHS5m3vdAm3XJ5X0bRyQ9/BWhrqJvty0puR6b8l2O+zcGBxb44mVyS1CO6MtIAlLMh68QIwzj7FABH12k6tawvEIORkCx4BwyVjlwt1JsJCTlTFevEe86eQY2FrabGUsDRfxInswotOAywPfU466Jy9S6ckM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.microsoft.com; spf=pass smtp.mailfrom=linux.microsoft.com; dkim=pass (1024-bit key) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.b=FfVFF13r; arc=none smtp.client-ip=13.77.154.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.microsoft.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.microsoft.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.b="FfVFF13r" Received: from fedora (unknown [20.191.74.188]) by linux.microsoft.com (Postfix) with ESMTPSA id D398620B710C; Mon, 10 Aug 2026 17:31:08 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com D398620B710C DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1786408268; bh=9B9wUG3AQFjgftpZouiNukd3GodNGyEPx12NsN8Y0tI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=FfVFF13rxdF+zfxmxqV0FvaSOktrcN9ZpA4phd/N+TFtYNU4+S2UTAXlGjb9Hqqqm F4egS5PZeFNdLPJLLdMbPSG6/PkRq/viku3mftNwSlMUVUyFc33BlUdVEso86hCGSn fqc1HS/dDT7w9TP/so9pQJ/Nz+HyHVkKp8pXl1og= From: Sriram Nambakam To: kvm@vger.kernel.org Cc: linux-kernel@vger.kernel.org Subject: [RFC PATCH v2 2/4] KVM: x86: exit VM-plane config/activate hypercalls to userspace Date: Mon, 10 Aug 2026 17:31:12 -0700 Message-ID: <20260811003114.30107-3-snambakam@linux.microsoft.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260811003114.30107-1-snambakam@linux.microsoft.com> References: <20260811003114.30107-1-snambakam@linux.microsoft.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Handle the guest's plane-setup hypercalls by exiting to the VMM: KVM_HC_VM_PLANES_CONFIG - allocate plane memory KVM_HC_VM_PLANES_ACTIVATE - create and activate the plane vCPU Both exit via KVM_EXIT_HYPERCALL (gated by KVM_CAP_EXIT_HYPERCALL, hence added to KVM_EXIT_HYPERCALL_VALID_MASK) and are completed by userspace. This is what brings a secure plane and its vCPU into existence; the in-kernel VBS plane-switch handlers are added separately. --- arch/x86/kvm/x86.c | 29 ++++++++++++++++++++++++++++- 1 file changed, 28 insertions(+), 1 deletion(-) diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 0ace79c957bb..3b21c72fc9e0 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -119,7 +119,10 @@ u64 __read_mostly efer_reserved_bits =3D ~((u64)(EFER_= SCE | EFER_LME | EFER_LMA)); static u64 __read_mostly efer_reserved_bits =3D ~((u64)EFER_SCE); #endif =20 -#define KVM_EXIT_HYPERCALL_VALID_MASK (1 << KVM_HC_MAP_GPA_RANGE) +#define KVM_EXIT_HYPERCALL_VALID_MASK \ + ((1 << KVM_HC_MAP_GPA_RANGE) | \ + (1 << KVM_HC_VM_PLANES_CONFIG) | \ + (1 << KVM_HC_VM_PLANES_ACTIVATE)) =20 #define KVM_CAP_PMU_VALID_MASK KVM_PMU_CAP_DISABLE =20 @@ -10559,6 +10562,30 @@ int ____kvm_emulate_hypercall(struct kvm_vcpu *vcp= u, int cpl, vcpu->arch.complete_userspace_io =3D complete_hypercall; return 0; } + case KVM_HC_VM_PLANES_CONFIG: + case KVM_HC_VM_PLANES_ACTIVATE: + /* + * VM plane setup: hand off to the VMM, which allocates plane + * memory (CONFIG) and creates + activates the plane vCPU + * (ACTIVATE). Serviced entirely in userspace. + */ + if (!user_exit_on_hypercall(vcpu->kvm, nr)) + break; + + vcpu->run->exit_reason =3D KVM_EXIT_HYPERCALL; + vcpu->run->hypercall.nr =3D nr; + vcpu->run->hypercall.ret =3D 0; + vcpu->run->hypercall.args[0] =3D a0; + vcpu->run->hypercall.args[1] =3D a1; + vcpu->run->hypercall.args[2] =3D a2; + vcpu->run->hypercall.args[3] =3D a3; + vcpu->run->hypercall.flags =3D 0; + if (op_64_bit) + vcpu->run->hypercall.flags |=3D KVM_EXIT_HYPERCALL_LONG_MODE; + + WARN_ON_ONCE(vcpu->run->hypercall.flags & KVM_EXIT_HYPERCALL_MBZ); + vcpu->arch.complete_userspace_io =3D complete_hypercall; + return 0; default: ret =3D -KVM_ENOSYS; break; --=20 2.55.0 From nobody Tue Sep 29 07:39:12 2026 Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by smtp.subspace.kernel.org (Postfix) with ESMTP id C394229D26E; Tue, 11 Aug 2026 00:31:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=13.77.154.182 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786408294; cv=none; b=a+oo+XrPIu07DRIAkOsHZK0gdtwit3D8rIbDXE05pSpkFhlm5YAvRsH+Pn7WKFjOoF1TBo0QJTgUSxlcheZbJ+BRf0eE1KQ+OVNRvz6GuetTFPB4Z7fcZsS/gTNRVo5RHK2Wx3fxzkXhIg0GT3evSFDZdx2Qx42QjldhvmfWlQs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786408294; c=relaxed/simple; bh=eCAWpeoXSR0PzeZq7R0A1GNgowqXnKT3dZkkK+P7S08=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=SYbAbMgV/RJ+/RYM8A6Bg/+hbIs5qd43UE7ailO8NWw7nYvIVy7R5J1aMyoLmPp6e8SY3cl9f0ByQIIiDg/+X3xNqrsyTZbBoNhe2MajkMJaAxDatpbNifk4gWgtnNufevUmuXIK0q0g1foNHic9YkasPVt5B2HETrMoHpvhUWM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.microsoft.com; spf=pass smtp.mailfrom=linux.microsoft.com; dkim=pass (1024-bit key) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.b=Dg6XwPJo; arc=none smtp.client-ip=13.77.154.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.microsoft.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.microsoft.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.b="Dg6XwPJo" Received: from fedora (unknown [20.191.74.188]) by linux.microsoft.com (Postfix) with ESMTPSA id CD95D20B7167; Mon, 10 Aug 2026 17:31:09 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com CD95D20B7167 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1786408269; bh=lU/xMDy6fjUV7zy8ApdvrxOOcU8WJVR9HODtMyTxJ+M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Dg6XwPJotosaiYBpdURqVWYUyyKMKq3gR/eJM1MgYY0gyo4qy9UwNXrS6LOYpWLbT hdCKNX3zqXhKh7jD3kasEUscT1FS8xx+TxV2QNHyMg9py370v9cbJKCmlU14IGSmHe dV+f2W4vimQUDWP4hXQ219u8r1wDX9uGH1sf1+k8= From: Sriram Nambakam To: kvm@vger.kernel.org Cc: linux-kernel@vger.kernel.org Subject: [RFC PATCH v2 3/4] KVM: x86: add VTL-call state to struct kvm_vcpu_common Date: Mon, 10 Aug 2026 17:31:13 -0700 Message-ID: <20260811003114.30107-4-snambakam@linux.microsoft.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260811003114.30107-1-snambakam@linux.microsoft.com> References: <20260811003114.30107-1-snambakam@linux.microsoft.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Add the shared state used by the in-kernel VBS VTL call/return handlers: vtl_call_ca - guest-physical address of the shared calling area vtl_call_pending - a call arrived while the secure plane was booting vtl_plane_ready - the secure plane has parked in its VTL return The fields live in struct kvm_vcpu_common so they are shared across a logical CPU's plane vCPUs. --- include/linux/kvm_host.h | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h index a61524ab0d94..61bb59c50ae6 100644 --- a/include/linux/kvm_host.h +++ b/include/linux/kvm_host.h @@ -386,6 +386,11 @@ struct kvm_vcpu_common { =20 bool plane_switch; =20 + /* VBS VTL-call state, shared across this CPU's plane vCPUs. */ + gpa_t vtl_call_ca; + bool vtl_call_pending; + bool vtl_plane_ready; + struct kvm_vcpu_arch_common arch; }; =20 --=20 2.55.0 From nobody Tue Sep 29 07:39:12 2026 Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 5E5252C3268; Tue, 11 Aug 2026 00:31:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=13.77.154.182 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786408295; cv=none; b=BwN+K9b9gaxxeONRLSLAHH/e0wD6a7FgRw0k4gVKmeM3mhQIWU9ZljqkqsrMxa/1IxOUfdGkTqvD15dERLrbqYHClny+A6O9KUdSZDeFh5x5lxuMj5YzIRxwK0IFp/a7DMD7eKuFjWvjcom8fFi6UNc/kd0D7x7wxiU4Wx3HVyE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786408295; c=relaxed/simple; bh=X2gDkJrhub4RLPoSLzH2T+AXO5dgvBTFjEv9Xwdg/pE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=F4sJg5I4Iugmw2CsZaqFWSwanXoupYvrgzqoJueobhDoEV7Ft77eQYAdvTPQvqMt9UDz2Gn140Q0N/qGNQDaQBWgx/LDEPz+8z+M9tVZnw2UVq5pli9lUIdSepk2BAbag3wtfOQspdJlF7Gvfa8WNl/n4ivcaUzwTmG4TmF2n/4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.microsoft.com; spf=pass smtp.mailfrom=linux.microsoft.com; dkim=pass (1024-bit key) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.b=TMXIQaY/; arc=none smtp.client-ip=13.77.154.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.microsoft.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.microsoft.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.b="TMXIQaY/" Received: from fedora (unknown [20.191.74.188]) by linux.microsoft.com (Postfix) with ESMTPSA id 635C520B7168; Mon, 10 Aug 2026 17:31:10 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 635C520B7168 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1786408270; bh=QWonNg9bBg9eBj1ISNDCL4Dgir2Ss9XqWPONSIkrtPo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TMXIQaY/bWOGOMJ6s6GkJIkE06QCXvVSkYwoaqjxp8WL6GmH8YNcxVaebzP3mL6JI /6Ey9GPm7PmwgyiR9cLyc97UaAWcWQJ3scYQRD7OoixxXwspE6JbA5283prXEAW2In k93zaSfYIM2hXIT7Ly9XdkZG6oqm0c4FfyYfHnxY= From: Sriram Nambakam To: kvm@vger.kernel.org Cc: linux-kernel@vger.kernel.org Subject: [RFC PATCH v2 4/4] KVM: x86: handle VBS VTL call/return via in-kernel plane switch Date: Mon, 10 Aug 2026 17:31:14 -0700 Message-ID: <20260811003114.30107-5-snambakam@linux.microsoft.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260811003114.30107-1-snambakam@linux.microsoft.com> References: <20260811003114.30107-1-snambakam@linux.microsoft.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Service the VBS inter-plane hypercalls in-kernel, with no userspace round trip, by switching planes: KVM_HC_VBS_VTL_CALL - the normal plane (0) calls into the secure plane (1). a0 is the guest-physical address of the shared calling area; deliver it to the secure plane's pending VTL return (or mark it pending if the secure plane is still booting) and switch. KVM_HC_VBS_VTL_RETURN - the secure plane (>0) hands control back to plane 0, announcing readiness and delivering any call that arrived while it was booting. The switch reuses the per-plane scheduling (kvm_vcpu_set_plane_runnable/ stopped + KVM_REQ_PLANE_RESCHED). --- arch/x86/kvm/x86.c | 59 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 59 insertions(+) diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 3b21c72fc9e0..35fbe0776a3e 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -10562,6 +10562,65 @@ int ____kvm_emulate_hypercall(struct kvm_vcpu *vcp= u, int cpl, vcpu->arch.complete_userspace_io =3D complete_hypercall; return 0; } + case KVM_HC_VBS_VTL_CALL: { + /* + * Runtime VBS call from the normal plane (0) into the secure + * plane (1), serviced in-kernel by switching planes. a0 is the + * guest-physical address of the shared calling area. If the + * secure plane is parked in its VTL return, deliver the GPA as + * that return's value now; otherwise mark it pending so the + * secure plane picks it up on its first return. + */ + struct kvm_vcpu_common *common =3D vcpu->common; + struct kvm_vcpu *secure; + + if (vcpu->plane_level !=3D 0) + break; + + secure =3D common->vcpus[1]; + if (!secure) + break; + + common->vtl_call_ca =3D a0; + if (common->vtl_plane_ready) { + kvm_rax_write_raw(secure, a0); + common->vtl_call_pending =3D false; + } else { + common->vtl_call_pending =3D true; + } + + kvm_vcpu_set_plane_runnable(secure); + kvm_vcpu_set_plane_stopped(vcpu); + ret =3D 0; + break; + } + case KVM_HC_VBS_VTL_RETURN: { + /* + * The secure plane (>0) hands control back to plane 0. On its + * first return it announces readiness; if a call arrived while + * it was still booting, deliver that calling-area GPA now and + * stay in the secure plane. Otherwise switch back to plane 0. + */ + struct kvm_vcpu_common *common =3D vcpu->common; + + if (vcpu->plane_level =3D=3D 0) { + ret =3D -KVM_EPERM; + break; + } + + common->vtl_plane_ready =3D true; + + if (common->vtl_call_pending) { + common->vtl_call_pending =3D false; + ret =3D common->vtl_call_ca; + break; + } + + kvm_vcpu_set_plane_runnable(common->vcpus[0]); + kvm_vcpu_set_plane_stopped(vcpu); + ret =3D 0; + break; + } case KVM_HC_VM_PLANES_CONFIG: case KVM_HC_VM_PLANES_ACTIVATE: /* --=20 2.55.0