Hi all,

This revision addresses all review comments from version 2.

The changes include:

1. Moved sev_prepare() from decompressor to EFI stub.

2. Changed "Register Alternate Injection" and "configure all interrupt
   vectors" as two APIs located in compressed/sev.c since they are
   self-contained, avoiding exporting functions. 

3. Added more comments for better understanding.

Thanks,
Melody

Changelog:
v2
--

This revision fixes all the review comments from version 1.

The changes include:

1. Changed a few comments for better understanding, deleted some unnecessary
   code, corrected some typos, and some minor code fixes from the review
   comments by Sashiko and Boris.

2. Unified sev_apic_ghcb_msr_write() and sev_apic_ghcb_msr_read(). 

3. Move x2apic_svsm.o after x2apic_savic.o so that the secure AVIC gets
   preferred on machines supporting it.

4. Reworked svsm_apic_probe() as Boris suggested.

5. Updated tools with renamed MSR_AMD64_SNP_ALTERNATE_INJ_BIT and
   MSR_AMD64_SNP_ALT_INJ for completeness' sake.

6. Changed svsm_apic_send_IPI_self() with writing to the dedicated
   APIC_SELF_IPI instead of writing to APIC_ICR.

v1
--

The revision fixes all of the review comments from version 0.
 
The changes include:
 
1. Changed a few commit messages, new file names, variables name and order,
   function names and more comments for better understanding.
 
2. Added a pre-patch to fix the problem that in two functions in the the SVSM
   vTPM guest implementation do not disable preemption when fetching CAA. It
   is moving the CAA fetching operation inside svsm_perform_call_protocol().

   This series relies on this fix too.


3. Removed svsm_do_call() helper function and some intermediary layer
   functions in SVSM APIC driver.

4. Removed the Secure AVIC check in SVSM APIC driver since it will never be
   touched. 

5. Terminate boot when Alternate Injection is enabled in vmpl0.

6. Added a common function for SVSM APIC read and write.

7. Added a new SEV_TERM_SET_LINUX value for Alternate Injection and APIC ghcb
   msr read/write.

8. Reworked sev_prepare() to reflect the error conditions correctly. 

9. Moved allowing all of interrupts right after registering the SVSM APIC
   protocol.

v0
--

Alternate Injection is a method to provide secure interrupt delivery for
SEV-SNP guests against malicious injection attacks. By handing over the
control of the interrupt injection to the guest itself, the security is
applied. Alternate Injection use Secure VM Service Module (SVSM), and APIC
emulation in the SVSM to secure interrupt delivery.

This is the guest side patches. The patch set includes the following:
1. Add support for enabling Alternate Injection.
2. Add support for the SVSM APIC protocol which uses a subset of the
   X2APIC MSRs.
3. Add support to allow the guest OS to request Alternate
   Injection.

Melody Wang (8):
  x86/sev: Make SVSM calls preemption-safe
  x86/sev: Add support for Alternate Injection
  x86/apic: Add an SVSM APIC driver
  x86/sev: Route unsupported APIC register accesses to the hypervisor
    APIC emulation
  x86/sev: Add a function to contain all SEV-specific setup operations
  x86/sev: Register the guest with the SVSM APIC protocol
  x86/sev: Allow the guest to configure interrupt vectors for the
    hypervisor
  x86/sev: Indicate that Alternate Injection is supported in the guest

 arch/x86/Kconfig                        |  14 ++
 arch/x86/boot/compressed/sev.c          |  58 +++++-
 arch/x86/boot/compressed/sev.h          |  13 ++
 arch/x86/coco/core.c                    |   3 +
 arch/x86/coco/sev/core.c                |  48 ++---
 arch/x86/coco/sev/svsm.c                |  10 +-
 arch/x86/include/asm/msr-index.h        |   4 +-
 arch/x86/include/asm/sev-common.h       |   2 +
 arch/x86/include/asm/sev.h              |  21 +-
 arch/x86/kernel/apic/Makefile           |   1 +
 arch/x86/kernel/apic/x2apic_savic.c     |   8 +-
 arch/x86/kernel/apic/x2apic_svsm.c      | 243 ++++++++++++++++++++++++
 drivers/firmware/efi/libstub/x86-stub.c |   9 +-
 include/linux/cc_platform.h             |   8 +
 tools/arch/x86/include/asm/msr-index.h  |   4 +-
 15 files changed, 398 insertions(+), 48 deletions(-)
 create mode 100644 arch/x86/kernel/apic/x2apic_svsm.c

-- 
2.43.0

Hi all,

On Sun, 20 Sep 2026, at 20:16, Melody Wang wrote:
> Hi all,
>
> This revision addresses all review comments from version 2.
>
> The changes include:
>
> 1. Moved sev_prepare() from decompressor to EFI stub.
>

This may be a bit of a 'back to the drawing board' remark, but if opting
in to this alternate injection scheme can only be done from the EFI firmware
before ExitBootServices(), couldn't we wrap all this logic into an OVMF
protocol instead? That way, the EFI stub can just invoke it if it exists,
and what happens under the hood as a result is entirely under the control of
the firmware.



> 2. Changed "Register Alternate Injection" and "configure all interrupt
>    vectors" as two APIs located in compressed/sev.c since they are
>    self-contained, avoiding exporting functions. 
>
> 3. Added more comments for better understanding.
>
> Thanks,
> Melody
>
> Changelog:
> v2
> --
>
> This revision fixes all the review comments from version 1.
>
> The changes include:
>
> 1. Changed a few comments for better understanding, deleted some unnecessary
>    code, corrected some typos, and some minor code fixes from the review
>    comments by Sashiko and Boris.
>
> 2. Unified sev_apic_ghcb_msr_write() and sev_apic_ghcb_msr_read(). 
>
> 3. Move x2apic_svsm.o after x2apic_savic.o so that the secure AVIC gets
>    preferred on machines supporting it.
>
> 4. Reworked svsm_apic_probe() as Boris suggested.
>
> 5. Updated tools with renamed MSR_AMD64_SNP_ALTERNATE_INJ_BIT and
>    MSR_AMD64_SNP_ALT_INJ for completeness' sake.
>
> 6. Changed svsm_apic_send_IPI_self() with writing to the dedicated
>    APIC_SELF_IPI instead of writing to APIC_ICR.
>
> v1
> --
>
> The revision fixes all of the review comments from version 0.
> 
> The changes include:
> 
> 1. Changed a few commit messages, new file names, variables name and order,
>    function names and more comments for better understanding.
> 
> 2. Added a pre-patch to fix the problem that in two functions in the the SVSM
>    vTPM guest implementation do not disable preemption when fetching CAA. It
>    is moving the CAA fetching operation inside svsm_perform_call_protocol().
>
>    This series relies on this fix too.
>
>
> 3. Removed svsm_do_call() helper function and some intermediary layer
>    functions in SVSM APIC driver.
>
> 4. Removed the Secure AVIC check in SVSM APIC driver since it will never be
>    touched. 
>
> 5. Terminate boot when Alternate Injection is enabled in vmpl0.
>
> 6. Added a common function for SVSM APIC read and write.
>
> 7. Added a new SEV_TERM_SET_LINUX value for Alternate Injection and APIC ghcb
>    msr read/write.
>
> 8. Reworked sev_prepare() to reflect the error conditions correctly. 
>
> 9. Moved allowing all of interrupts right after registering the SVSM APIC
>    protocol.
>
> v0
> --
>
> Alternate Injection is a method to provide secure interrupt delivery for
> SEV-SNP guests against malicious injection attacks. By handing over the
> control of the interrupt injection to the guest itself, the security is
> applied. Alternate Injection use Secure VM Service Module (SVSM), and APIC
> emulation in the SVSM to secure interrupt delivery.
>
> This is the guest side patches. The patch set includes the following:
> 1. Add support for enabling Alternate Injection.
> 2. Add support for the SVSM APIC protocol which uses a subset of the
>    X2APIC MSRs.
> 3. Add support to allow the guest OS to request Alternate
>    Injection.
>
> Melody Wang (8):
>   x86/sev: Make SVSM calls preemption-safe
>   x86/sev: Add support for Alternate Injection
>   x86/apic: Add an SVSM APIC driver
>   x86/sev: Route unsupported APIC register accesses to the hypervisor
>     APIC emulation
>   x86/sev: Add a function to contain all SEV-specific setup operations
>   x86/sev: Register the guest with the SVSM APIC protocol
>   x86/sev: Allow the guest to configure interrupt vectors for the
>     hypervisor
>   x86/sev: Indicate that Alternate Injection is supported in the guest
>
>  arch/x86/Kconfig                        |  14 ++
>  arch/x86/boot/compressed/sev.c          |  58 +++++-
>  arch/x86/boot/compressed/sev.h          |  13 ++
>  arch/x86/coco/core.c                    |   3 +
>  arch/x86/coco/sev/core.c                |  48 ++---
>  arch/x86/coco/sev/svsm.c                |  10 +-
>  arch/x86/include/asm/msr-index.h        |   4 +-
>  arch/x86/include/asm/sev-common.h       |   2 +
>  arch/x86/include/asm/sev.h              |  21 +-
>  arch/x86/kernel/apic/Makefile           |   1 +
>  arch/x86/kernel/apic/x2apic_savic.c     |   8 +-
>  arch/x86/kernel/apic/x2apic_svsm.c      | 243 ++++++++++++++++++++++++
>  drivers/firmware/efi/libstub/x86-stub.c |   9 +-
>  include/linux/cc_platform.h             |   8 +
>  tools/arch/x86/include/asm/msr-index.h  |   4 +-
>  15 files changed, 398 insertions(+), 48 deletions(-)
>  create mode 100644 arch/x86/kernel/apic/x2apic_svsm.c
>
> -- 
> 2.43.0

Hi Ard,

On 9/23/26 1:56 PM, Ard Biesheuvel wrote:
> This may be a bit of a 'back to the drawing board' remark, but if opting
> in to this alternate injection scheme can only be done from the EFI firmware
> before ExitBootServices(), couldn't we wrap all this logic into an OVMF
> protocol instead? That way, the EFI stub can just invoke it if it exists,
> and what happens under the hood as a result is entirely under the control of
> the firmware.

Let me try to explain and please ask if anything's not clear because 
this is a complex topic:

When a SEV-SNP guest starts, a Secure VM Service Module running at VMPL0 
(higher privilege level than the guest's) is executed first. That's a 
paravisor, see here for a possible explanation: 
https://ksayid.github.io/confidential-computing-notes/docs/core/paravisor/.

That paravisor will boot OVMF, and then OVMF will boot the guest kernel.

The SVSM must know the Alternate Injection choice of the first component 
which is the OVMF, so it will be able to enable Alternate Injection in 
the guest VMSA and record OVMF's registration.

The guest kernel should be able to make its own independent decision 
about whether to use Alternate Injection or not. If the kernel wants it, 
the kernel must register itself — this registration is performed in 
guest kernel code so that it remains under the guest kernel's control.

The guest kernel needs to register Alternate Injection before 
ExitBootServices() so the SVSM registration counter always reflects the 
correct, current state of Alternate Injection across the OVMF-to-kernel 
hand-off.

But if we leave the OVMF to decide for the guest kernel, that is 
violating the confidential computing principles of the guest being in 
control.

I hope this makes more sense.

Thanks,
Melody.

On Thu, 24 Sep 2026, at 20:34, Melody Wang wrote:
> Hi Ard,
>
> On 9/23/26 1:56 PM, Ard Biesheuvel wrote:
>> This may be a bit of a 'back to the drawing board' remark, but if opting
>> in to this alternate injection scheme can only be done from the EFI firmware
>> before ExitBootServices(), couldn't we wrap all this logic into an OVMF
>> protocol instead? That way, the EFI stub can just invoke it if it exists,
>> and what happens under the hood as a result is entirely under the control of
>> the firmware.
>
...
>
> But if we leave the OVMF to decide for the guest kernel, that is 
> violating the confidential computing principles of the guest being in 
> control.
>

That is not what I am suggesting.

What I would like to see is an abstraction implemented in OVMF that encapsulates
the logic that you are adding here. All the EFI stub would have to do is call
the protocol, nothing more.

After ExitBootServices() is a different matter, and actually, I think doing
the memory acceptance at that point was a mistake, and I'd like to fix that
but that is a separate discussion.

Before ExitBootServices(), we should not be poking MSRs directly. We should
be relying on the abstractions exposed by the firmware.