From nobody Thu Sep 24 21:17:21 2026 Received: from SN4PR2101CU001.outbound.protection.outlook.com (mail-southcentralusazon11012006.outbound.protection.outlook.com [40.93.195.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 256CB3C7696; Sun, 20 Sep 2026 18:12:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.93.195.6 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789927974; cv=fail; b=Weo9zXFkFwSHnpxkmH3ebkik7/h2lHjBsuq/Ycrgy4iA4Uf3zi3Nctt0LML/dm85I2V0T+8Qhl9wFEiI1ERRC5iu0aYqQPpirOBP2ihNAVW9SjDFD0fW5Px2wG8rUMWWGtr0h40MKmDR7greUpO8xP9FYzNGIYG6cJA6jrY4Uq0= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789927974; c=relaxed/simple; bh=tWfP2theVb+FGi6Df/pDgswTIV8hFpXpyLeYFndKyFg=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=pg24HIFS9dYaKpNUWMkxgKrpFkU2wWwQfFMoKvFbHFxOEW+MmlZG00RREzeJ8kJXNMVoEnZdGzA8pDKkuPrhbhVrPPt5/4yW8vVBslEAXvMPzJhxEgE3ZFTKHpmI0n2flx2yPAb55sI7SmonrQmuyldC2zBqzFF0nZLX/Ym4Nbc= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amd.com; spf=fail smtp.mailfrom=amd.com; dkim=pass (1024-bit key) header.d=amd.com header.i=@amd.com header.b=vrbE1oxy; arc=fail smtp.client-ip=40.93.195.6 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amd.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=amd.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=amd.com header.i=@amd.com header.b="vrbE1oxy" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=OzlN0p2+qUbm7+21qocjecaZd72xQCru04DyD1dcVaVklUJa4Zu3ymImgPP3UF3HdfiulC90uGZ3U3tQUtiRiRhmSRTpAWJjWbxstxcRnuHU0GaVim3gfsfNQ+F8BbvtVlz+8rnJ+WO7veeyruOyHDAnjllt5pJY1xUy8snTGCpF1NDTVYPj6fXRpT8UsngAAMmH3jvNpLiz0uaeGO0w09zTcQnPHnidmzVsA2eG/OWuhW8TWZRBZ5ODFvJkqJ71b7TWv4iV0cuxDXG7NDT1BQ44Jxx1eqzGwbGVspCXU9lJepcoqgQiF8ALkkir2aAYwhBdY8lYOnwbTgCddwV4JQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Qey5GmSRMu7vCCFht38ElMGD+BbJq2EZTN5l9fXytiE=; b=aL4JcbhS1+i3b4zUMZYHglKOfKXTm134MXpoHLrAY4lJA+lcNOso7nOy4DVUPFENUFRMQfPgMN9B2utlrwIZGIthkuRvn510Dzs8Qlu3jg2nlZYbRGg9U4YSwYvByA09Ba93bj1hLM65lBCJYDUoLozYN1cDCplNHPSHV5DevcELYugtBZzk+MyrFXNGLE3n+b50BAOPiYCYjAMGhhxnop7rfBtt7CmewBXx22P6QhxSw8ZEMg/2dF/WZYhE8pHZqbxaG+SGGZuBTTdk0ITzayzjGRONwClaGjmKAZiw4vGU2hQBHfXgO7U22r/7F5PaO78HA1dFDyHC3Bs/XnryoA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=kernel.org smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Qey5GmSRMu7vCCFht38ElMGD+BbJq2EZTN5l9fXytiE=; b=vrbE1oxymsC6jg3z0INPLBTqqEB7qrXk0+gxeInPHvXEHqI8HxSbGDio8kR/cUi1iWqnfWwMvBJeHwYzir7xndvbyUIRzX2aJfu+SELs93WBfTbtaJ/hOaCykNv7arXSOtgjiNrgD9sctIUxd78JoMqPTK70mkPKO2scynu4aew= Received: from BL1PR13CA0196.namprd13.prod.outlook.com (2603:10b6:208:2be::21) by CY5PR12MB6225.namprd12.prod.outlook.com (2603:10b6:930:23::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.428.13; Sun, 20 Sep 2026 18:12:49 +0000 Received: from BL02EPF0002992A.namprd02.prod.outlook.com (2603:10b6:208:2be:cafe::14) by BL1PR13CA0196.outlook.office365.com (2603:10b6:208:2be::21) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.360.6 via Frontend Transport; Sun, 20 Sep 2026 18:12:48 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=amd.com; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=satlexmb07.amd.com; pr=C Received: from satlexmb07.amd.com (165.204.84.17) by BL02EPF0002992A.mail.protection.outlook.com (10.167.249.55) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.8 via Frontend Transport; Sun, 20 Sep 2026 18:12:47 +0000 Received: from purico-9dcchost.amd.com (10.180.168.240) by satlexmb07.amd.com (10.181.42.216) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.49; Sun, 20 Sep 2026 13:12:47 -0500 From: Melody Wang To: CC: LKML , Tom Lendacky , Melody Wang , Subject: [PATCH v3 1/8] x86/sev: Make SVSM calls preemption-safe Date: Sun, 20 Sep 2026 18:12:10 +0000 Message-ID: <252b622d9df5835a929f7cf8e34acbf0fea6b334.1789927246.git.huibo.wang@amd.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: satlexmb07.amd.com (10.181.42.216) To satlexmb07.amd.com (10.181.42.216) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BL02EPF0002992A:EE_|CY5PR12MB6225:EE_ X-MS-Office365-Filtering-Correlation-Id: 0e1dc557-95c5-4e71-c49b-08df1742c6ca X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|82310400026|36860700016|23010399003|1800799024|376014|10067099003|11063799006|6133799003|3023799007|22082099003|18002099003|56012099006; X-Microsoft-Antispam-Message-Info: 2V7HljYqrDoikypL/YAECdrryRyy+jHAv3jvd+/CJJtrBgoK0HzIh0LqtKEt3qZjBmYMmZ2EU0Qwbpff6uWk4OIfOGdZrcKQ3pAP7yiQXnd4aArJLswocGYvk8ltZnOF9XEHaJzx4NGVxIKEoHB54UBrTDf4v0Nkoqu2FmZiVYpPrEFPFPa+G358RJN57WMjr3CeszYTX+LxtAax5thWiaLugqf5pootQNlVr69BlwN0HZe/5/k/iEKMJar2yitSOca4Y2/HVhMcraTXEuSJWcs2oyEQlT4MUuxqR0mK7Y8gJ5x/QG1U8md3XxV1trLQg4Cj0/M5VYZpnPifsaHDhALmcL3S5fbcV7mGOgo8V+Vv0amWQQowwyppzU3CsudQNevKBXhxGL80FQsquigzXRwfJRigCV0NuyZF45rUFHXGe/UTN3Vc/omqrd7zU+oYWGnbVYNg1GiYhIOBk4QF4eEpBxCE/d9rUUvcE+vMGDFd1S1dN6msuvBDag8F4MYRMKFodB8kCWEI/eImnC6t4o2Qz30+1VuWYH2Weh2JUkM3aWvTypoCiRbfyYMvloUvyPg3OLUTJTgQEKsYuHCIqgD/XwUlrl8n9WCfxdxXNnifri9GyC+e4AXnnFKiIGV9Avwfh0zADhlqzVVsP6NrpA/UU2csVr1kCwaJowWVQKGTDapXTp7Hju3Ih9xj7A62mktTHa7BKi1PejG7M9ubZg== X-Forefront-Antispam-Report: CIP:165.204.84.17;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:satlexmb07.amd.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230040)(82310400026)(36860700016)(23010399003)(1800799024)(376014)(10067099003)(11063799006)(6133799003)(3023799007)(22082099003)(18002099003)(56012099006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: Bcl3N72oiA9KA2Tp0uOTYT2yQzpbzAOzsZYEjrJR2KRED7qo82RrU8AmxroOdtOian+Xpj2QVUADMJOwhaA9RgyuCprqLapy9pMKVmnhGp1Lg7uDOI8+bU2om2L5iqzIMz0I7SonolSPRu9boG9EOOC/u8OZHhDeTvhDMHc0gGTgh5eJrB14iNwulLrPYYk5p/9iUJheA3DeRUwjNc3RU+NFR3q472IMUxD5H7dvhxNdyNrCr9F3ksgWcMYELywQuRql4Iu6ZfA7qWNeLcBW/rcO4X2IbSwWrHYpF+vAU0PqHt7kOsr+H9iOes8i4dRf9wtS/E/wuDTd3Jx7bG8QrILGQMpAft/ywzYH3gHTt1oLF6kYse6QuvLgxnB1epXfDYYM5zNyrnNhtQjnqdjkvpM7g7S66WlxcUb5XcUm6Z7/WJ/GHpABEjWr+M6voFYR X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Sep 2026 18:12:47.9928 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 0e1dc557-95c5-4e71-c49b-08df1742c6ca X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d;Ip=[165.204.84.17];Helo=[satlexmb07.amd.com] X-MS-Exchange-CrossTenant-AuthSource: BL02EPF0002992A.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY5PR12MB6225 Content-Type: text/plain; charset="utf-8" Two functions in the the SVSM vTPM guest implementation do not disable preemption when fetching the SVSM Calling Area Address (CAA). The SVSM CAA is a per-CPU structure. When a thread is preempted and migrated to a different CPU after fetching the per-CPU CAA, the SVSM call will execute on the new CPU with the original CPU's CAA. Which is wrong. Move the CAA fetching operation inside svsm_perform_call_protocol() which disables interrupts around the SVSM call and thus runs preemption-safe. Fixes: 770de678bc28 ("x86/sev: Add SVSM vTPM probe/send_command functions") Signed-off-by: Melody Wang Cc: stable@vger.kernel.org --- arch/x86/coco/sev/svsm.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/arch/x86/coco/sev/svsm.c b/arch/x86/coco/sev/svsm.c index 916d62cd17dc..2d493d55ff2e 100644 --- a/arch/x86/coco/sev/svsm.c +++ b/arch/x86/coco/sev/svsm.c @@ -74,6 +74,14 @@ int svsm_perform_call_protocol(struct svsm_call *call) =20 flags =3D native_local_irq_save(); =20 + /* + * 'caa' is a per-CPU variable. To avoid using a stale or incorrect + * 'caa' if the task is preempted or migrated to another CPU after it + * is fetched, always fetch 'caa' and then issue the SVSM call with + * interrupts disabled. This ensures the correct 'caa' is used. + */ + call->caa =3D svsm_get_caa(); + ghcb =3D __sev_get_ghcb(&state); =20 do { @@ -321,7 +329,6 @@ int snp_svsm_vtpm_send_command(u8 *buffer) { struct svsm_call call =3D {}; =20 - call.caa =3D svsm_get_caa(); call.rax =3D SVSM_VTPM_CALL(SVSM_VTPM_CMD); call.rcx =3D __pa(buffer); =20 @@ -345,7 +352,6 @@ bool snp_svsm_vtpm_probe(void) if (!snp_vmpl) return false; =20 - call.caa =3D svsm_get_caa(); call.rax =3D SVSM_VTPM_CALL(SVSM_VTPM_QUERY); =20 if (svsm_perform_call_protocol(&call)) --=20 2.43.0 From nobody Thu Sep 24 21:17:21 2026 Received: from BL0PR03CU003.outbound.protection.outlook.com (mail-eastusazon11012071.outbound.protection.outlook.com [52.101.53.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EEF903C7696 for ; Sun, 20 Sep 2026 18:13:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.53.71 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789927989; cv=fail; b=G+hUCwfPS4NokXx8fAempRfej0gql7+c1TnBG5uSBsYARYQXid9ukshOFk/0mtKedGwGxizftNVsoYPwcb+4a+uO/Fa610b7HI7X52AHiMeKdywGPVxJfbjz5KgMfZBaLkQ7VX0ZAKefwZyl51NnrrSY6Z8p8Az+GqBCpzy5sNY= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789927989; c=relaxed/simple; bh=BG09JZIIbBetqTJBcI+aMtI2R1MROzajIXtuDopScuE=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=r6k6NAIsQ5V921MOMhmL8sp7gFTmNNOsO0jYXrDnflbZfs1vz0fAhDcl8TGjTEziuqCdDDv3utNw2SiXHwKGvsdL2i8xwNW30X0zWHgJaOg2jk491aII2ynXv3MNOa6LGG0GOOWR4LFolE1hDheplguwNj7s77i44Yf4MsXEzso= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amd.com; spf=fail smtp.mailfrom=amd.com; dkim=pass (1024-bit key) header.d=amd.com header.i=@amd.com header.b=20UjcTHT; arc=fail smtp.client-ip=52.101.53.71 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amd.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=amd.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=amd.com header.i=@amd.com header.b="20UjcTHT" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=ZNEfOruuW0iodqDgUGafCkCCxFz4UpQGaMb+rHKHWHUXyOrzHQLKaeAENSg2Xqz2Ec5odTGBoiPTR+iR9svaIH74TkUB/KeCtohdIjJHMoxHgWUNJcURw6p0WNLS5RvwESjfEXXGysxBI+y/N7u26jQwOSy6ufQfRzrvVJX5187LWeU6dHTxtM9SnlviJURnvZ46i8yDiVLFUOWDi8Zt6dkDx5JpqY3/FKzpKJjrmrdiYKcD+1bUSzO2a+19HfBpD0gf3mVe9xLuCyw0Nx+y5FqRkgG4gXdE5gDemo1J3fqUWSDvKnidJTxmipGENWlRJyIIbdV4WZa5YuHth1hA8A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=pbbXdWdkIWLt257qHN9QSYT+vatWU5Z6dSlGF2hC1A4=; b=DJUwMN1ddVV7nJt4M/zvjckCXH0puOZEtr14nIsj2bUtEiQPf6m2utT2l2yZkp3HUM+ghL6rxeoeZqcfKEsY/j96VFSaUpkkdR+ekvOF9+17g0W8rQ6pjIq+zs5er0Tv1oqqMjkkX8GcPHC5V8nKcCgxKzS0qAnQtyERB3rto4CLGnWHYHHB5on263LlQc70qVfL1HVW9TPOI2PaSRuadAEyDwGmy6ywveUx95Isg5JYiuJ709PsHgFVnnZkRLzoCZ9TrzEg+huFkuODLaBRi4MY6FiTKgUb3UOCRNu4Z7wPsNQ+SbsrvxO2nSDSNxtGXa4b5UmEhYbcOwO8eQJZFQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=kernel.org smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=pbbXdWdkIWLt257qHN9QSYT+vatWU5Z6dSlGF2hC1A4=; b=20UjcTHTzxoYAC75dO2H99gYI8ItE5vvwPRbRebiR7m2zXTlQ2d7B92xFAjGmIP6rFD5TZl6hq2fNvtPPAMOn3ffnvudweiUKHruQhkOEZT/WXvjURreuW5M1nsrw+7YW+3hrOADqI4FFGg76/COeAV1+jPgwT0ux8KtTi+nYA0= Received: from BL1PR13CA0183.namprd13.prod.outlook.com (2603:10b6:208:2be::8) by CH3PR12MB9097.namprd12.prod.outlook.com (2603:10b6:610:1a6::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.16; Sun, 20 Sep 2026 18:13:04 +0000 Received: from BL02EPF0002992A.namprd02.prod.outlook.com (2603:10b6:208:2be:cafe::36) by BL1PR13CA0183.outlook.office365.com (2603:10b6:208:2be::8) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.360.6 via Frontend Transport; Sun, 20 Sep 2026 18:13:04 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=amd.com; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=satlexmb07.amd.com; pr=C Received: from satlexmb07.amd.com (165.204.84.17) by BL02EPF0002992A.mail.protection.outlook.com (10.167.249.55) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.8 via Frontend Transport; Sun, 20 Sep 2026 18:13:04 +0000 Received: from purico-9dcchost.amd.com (10.180.168.240) by satlexmb07.amd.com (10.181.42.216) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.49; Sun, 20 Sep 2026 13:13:03 -0500 From: Melody Wang To: CC: LKML , Tom Lendacky , Melody Wang Subject: [PATCH v3 2/8] x86/sev: Add support for Alternate Injection Date: Sun, 20 Sep 2026 18:12:11 +0000 Message-ID: <665c16b5ec7fc020ec9605c89baa9371d9e01b5e.1789927246.git.huibo.wang@amd.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: satlexmb07.amd.com (10.181.42.216) To satlexmb07.amd.com (10.181.42.216) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BL02EPF0002992A:EE_|CH3PR12MB9097:EE_ X-MS-Office365-Filtering-Correlation-Id: cd12956f-70da-499f-7eb3-08df1742d073 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|36860700016|82310400026|23010399003|1800799024|376014|11063799006|6133799003|10067099003|56012099006|22082099003|18002099003; X-Microsoft-Antispam-Message-Info: Tp/Qbm+oXGNvl+ioMszY469pY8SHhDjBTbasu288MG0W56eD/Qgx7dZXr8ylw8aRJy3PJqnnaFWcVcVPVcbxzYqJO2zAGRd/FRrrtjS+nPvQRcqsWqxo2FlFtxTWr4hOzbEUdoYLNjweA/0pTZuH5RvfqKnU3+tranjp5oOWaV5yQgY9jNn7NKFVXTjKUb5hYbY5TPIUuxj2HVGtFTpScdDaFD+bi6hBqwQbwb+Jo35paHMqpgsnBGIiv0L/WNrv/wRGYNlE+m2HtjxFEHAo0ol/Y+s6sfKRSs3lJt1of+mOF1J2LidKexRYDpaKFRdGb03kahQ4H/Q4wop39YDQY+534autYNUB7AaG1LW0RzqQQsSrlwlytN33AQnJOu555l8Qbsb8Gct0zj1bFynFnk+5sOoguhC5ogVbfbQQJl3nMnF37heIKj2o1gySaClK3qQpcyZhQcTplWe2f9h+mkOBLlTX+Ett88eQTwtNA/EgvetuuGrxRDkt7YDUsW7YmAoJZM02RsKtMbL9Eq3VvO4/H/adbPfTA0/guo1fD6fgZ6jXZNYrAcBZVTMinAy+q4CPFmZIR3Gwepa6GUj63jmGvPFt3vcW3XmNfXVRf9WkXFjpymAHqYTYN2fOw7ZS5KSvQmLn1UGeDaqdTeaePf1tAbZ/oHDm7b0jtfXKdHoM0DhF7Os31oRiPWmpv7/TkuUCQMfffUfk7+GUu2di7g== X-Forefront-Antispam-Report: CIP:165.204.84.17;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:satlexmb07.amd.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230040)(36860700016)(82310400026)(23010399003)(1800799024)(376014)(11063799006)(6133799003)(10067099003)(56012099006)(22082099003)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: SNXzlnpSqr4ZR6pVq+2xYqFLZ1Ib9BQ6+y7LnPfET6jhNWGnP9KszrTHVzVKWZnfV8ejFPtYpyLZsji7WGZpfLRPFiGZmN31egewiQJrZ/JRa+hy9GvQ75vEgtBHoj8xupVTN2lTfE8XWjyOlR7fnCPExn54wfk2IqNOs+mWN5UtT5L03PUSrYlKa3hCIDCPWncPYZhLHa1g69acmigETsp4o4GGqBvxMN55q296c0T8/NG8uwB9b7oK+zYx9KX/ed6G7Vnz7ewummSbqI7OUq5imbmSsSv8SO040Z9ULf1aZwL10HMaG7wwW8tqXP4S7EGc7BWEsHjjtR8zW/SSTjCy4TkuS1AakwRew13s+Y0i6H7UYsybDKyF42TcG42cUYJN+jkYF13yd2k4k2v43IzV8SWhb+zpCf1MGqBOvT5x2CnTvKnalc1KP54p4pqH X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Sep 2026 18:13:04.2069 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: cd12956f-70da-499f-7eb3-08df1742d073 X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d;Ip=[165.204.84.17];Helo=[satlexmb07.amd.com] X-MS-Exchange-CrossTenant-AuthSource: BL02EPF0002992A.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH3PR12MB9097 Content-Type: text/plain; charset="utf-8" The Alternate Injection feature is a method to protect a SNP guest from malicious injection attacks. It allows the guest to control the interrupt injection. When this feature is enabled, interrupts are injected with the help of an agent called a Secure VM Service Module (SVSM) which executes in the security realm of the guest and uses Restricted Injection as the sole method to receive interrupts from the hypervisor. Add support for Alternate Injection. Signed-off-by: Melody Wang --- arch/x86/Kconfig | 14 ++++++++++++++ arch/x86/boot/compressed/sev.c | 2 +- arch/x86/coco/core.c | 3 +++ arch/x86/coco/sev/core.c | 2 +- arch/x86/include/asm/msr-index.h | 4 ++-- include/linux/cc_platform.h | 8 ++++++++ tools/arch/x86/include/asm/msr-index.h | 4 ++-- 7 files changed, 31 insertions(+), 6 deletions(-) diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index 5a84998b6021..330cf9245342 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -496,6 +496,20 @@ config AMD_SECURE_AVIC =20 If you don't know what to do here, say N. =20 +config AMD_ALTERNATE_INJ + bool "Support Alternate Injection" + depends on X86_X2APIC && AMD_MEM_ENCRYPT + help + Enable AMD Alternate Injection support for SNP guests. + + The Alternate Injection feature of SEV-SNP enhances the security of + a confidential VM by preventing the untrusted host from presenting + unexpected interrupts or exceptions, while still preserving the + standard interrupt dispatch semantics inherent to the x86 + architecture. + + If you don't know what to do here, say N. + config X86_POSTED_MSI bool "Enable MSI and MSI-x delivery by posted interrupts" depends on X86_64 && IRQ_REMAP diff --git a/arch/x86/boot/compressed/sev.c b/arch/x86/boot/compressed/sev.c index c6512f2ea31e..fc2029746c50 100644 --- a/arch/x86/boot/compressed/sev.c +++ b/arch/x86/boot/compressed/sev.c @@ -179,7 +179,7 @@ bool sev_es_check_ghcb_fault(unsigned long address) #define SNP_FEATURES_IMPL_REQ (MSR_AMD64_SNP_VTOM | \ MSR_AMD64_SNP_REFLECT_VC | \ MSR_AMD64_SNP_RESTRICTED_INJ | \ - MSR_AMD64_SNP_ALT_INJ | \ + MSR_AMD64_SNP_ALTERNATE_INJ | \ MSR_AMD64_SNP_DEBUG_SWAP | \ MSR_AMD64_SNP_VMPL_SSS | \ MSR_AMD64_SNP_SECURE_TSC | \ diff --git a/arch/x86/coco/core.c b/arch/x86/coco/core.c index 989ca9f72ba3..aabda3ddc0e2 100644 --- a/arch/x86/coco/core.c +++ b/arch/x86/coco/core.c @@ -107,6 +107,9 @@ static bool noinstr amd_cc_platform_has(enum cc_attr at= tr) case CC_ATTR_SNP_SECURE_AVIC: return sev_status & MSR_AMD64_SNP_SECURE_AVIC; =20 + case CC_ATTR_SNP_ALTERNATE_INJECTION: + return sev_status & MSR_AMD64_SNP_ALTERNATE_INJ; + default: return false; } diff --git a/arch/x86/coco/sev/core.c b/arch/x86/coco/sev/core.c index cc292d7c6fd1..c54269366278 100644 --- a/arch/x86/coco/sev/core.c +++ b/arch/x86/coco/sev/core.c @@ -78,7 +78,7 @@ static const char * const sev_status_feat_names[] =3D { [MSR_AMD64_SNP_VTOM_BIT] =3D "vTom", [MSR_AMD64_SNP_REFLECT_VC_BIT] =3D "ReflectVC", [MSR_AMD64_SNP_RESTRICTED_INJ_BIT] =3D "RI", - [MSR_AMD64_SNP_ALT_INJ_BIT] =3D "AI", + [MSR_AMD64_SNP_ALTERNATE_INJ_BIT] =3D "AI", [MSR_AMD64_SNP_DEBUG_SWAP_BIT] =3D "DebugSwap", [MSR_AMD64_SNP_PREVENT_HOST_IBS_BIT] =3D "NoHostIBS", [MSR_AMD64_SNP_BTB_ISOLATION_BIT] =3D "BTBIsol", diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-in= dex.h index 428eb44106a9..bedc9a62d0b4 100644 --- a/arch/x86/include/asm/msr-index.h +++ b/arch/x86/include/asm/msr-index.h @@ -728,8 +728,8 @@ #define MSR_AMD64_SNP_REFLECT_VC BIT_ULL(MSR_AMD64_SNP_REFLECT_VC_BIT) #define MSR_AMD64_SNP_RESTRICTED_INJ_BIT 5 #define MSR_AMD64_SNP_RESTRICTED_INJ BIT_ULL(MSR_AMD64_SNP_RESTRICTED_INJ_= BIT) -#define MSR_AMD64_SNP_ALT_INJ_BIT 6 -#define MSR_AMD64_SNP_ALT_INJ BIT_ULL(MSR_AMD64_SNP_ALT_INJ_BIT) +#define MSR_AMD64_SNP_ALTERNATE_INJ_BIT 6 +#define MSR_AMD64_SNP_ALTERNATE_INJ BIT_ULL(MSR_AMD64_SNP_ALTERNATE_INJ_BI= T) #define MSR_AMD64_SNP_DEBUG_SWAP_BIT 7 #define MSR_AMD64_SNP_DEBUG_SWAP BIT_ULL(MSR_AMD64_SNP_DEBUG_SWAP_BIT) #define MSR_AMD64_SNP_PREVENT_HOST_IBS_BIT 8 diff --git a/include/linux/cc_platform.h b/include/linux/cc_platform.h index 559353ad64ac..80d9f1de2ae8 100644 --- a/include/linux/cc_platform.h +++ b/include/linux/cc_platform.h @@ -104,6 +104,14 @@ enum cc_attr { * to run SEV-SNP guests with full Secure AVIC capabilities. */ CC_ATTR_SNP_SECURE_AVIC, + + /** + * @CC_ATTR_SNP_ALTERNATE_INJECTION: AMD Alternate Injection enabled. + * + * A Secure VM Service Module (SVSM) has started the guest with + * Alternate Injection enabled. + */ + CC_ATTR_SNP_ALTERNATE_INJECTION, }; =20 #ifdef CONFIG_ARCH_HAS_CC_PLATFORM diff --git a/tools/arch/x86/include/asm/msr-index.h b/tools/arch/x86/includ= e/asm/msr-index.h index 18c4be75e927..e4eab2210518 100644 --- a/tools/arch/x86/include/asm/msr-index.h +++ b/tools/arch/x86/include/asm/msr-index.h @@ -721,8 +721,8 @@ #define MSR_AMD64_SNP_REFLECT_VC BIT_ULL(MSR_AMD64_SNP_REFLECT_VC_BIT) #define MSR_AMD64_SNP_RESTRICTED_INJ_BIT 5 #define MSR_AMD64_SNP_RESTRICTED_INJ BIT_ULL(MSR_AMD64_SNP_RESTRICTED_INJ_= BIT) -#define MSR_AMD64_SNP_ALT_INJ_BIT 6 -#define MSR_AMD64_SNP_ALT_INJ BIT_ULL(MSR_AMD64_SNP_ALT_INJ_BIT) +#define MSR_AMD64_SNP_ALTERNATE_INJ_BIT 6 +#define MSR_AMD64_SNP_ALTERNATE_INJ BIT_ULL(MSR_AMD64_SNP_ALTERNATE_INJ_BI= T) #define MSR_AMD64_SNP_DEBUG_SWAP_BIT 7 #define MSR_AMD64_SNP_DEBUG_SWAP BIT_ULL(MSR_AMD64_SNP_DEBUG_SWAP_BIT) #define MSR_AMD64_SNP_PREVENT_HOST_IBS_BIT 8 --=20 2.43.0 From nobody Thu Sep 24 21:17:21 2026 Received: from MW6PR02CU001.outbound.protection.outlook.com (mail-westus2azon11012011.outbound.protection.outlook.com [52.101.48.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 318592BE034 for ; Sun, 20 Sep 2026 18:17:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.48.11 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789928273; cv=fail; b=GS1xyjNZ60yKbf1EmDuh+mm/EIuIiID3VV5rVXCdKS3qXxsrLzborALp9HX+5ASLqYEKI1/2upGafBDtU0iUvUlgu8YOz2igoNU/CM/+G0mkcT82YQrH6Gv3ER4mmxncx2mjx533G8Cge1cR5rm22IUk9PYcPNHF5LuPcZzuceU= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789928273; c=relaxed/simple; bh=fn/kUNnmjN8qIz80EIBuve2hYiOxonhtEqm/bKtT5m0=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=QJiWK9RoIPRXaKv5ZxNn4JANmDo7IhKlpp+Dvusw+wXorO06YPOY94AbQ20aKCs+pK7f6yEL6CZqGeD78363HMEUw9FbQyDsLJraTGpJErK53OD+XJEKPnf9y2nbNFUan1Q8f/G58rpe0bYvTlmiRwyBOUEP9qT0c1WwdK7aUjQ= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amd.com; spf=fail smtp.mailfrom=amd.com; dkim=pass (1024-bit key) header.d=amd.com header.i=@amd.com header.b=fqkIS4LV; arc=fail smtp.client-ip=52.101.48.11 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amd.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=amd.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=amd.com header.i=@amd.com header.b="fqkIS4LV" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=AWZ+8FDUkMvZev6iGtault5+weA1tNofzefot/dgKaQhiXzgNClF1e4GyxdrK8gxXuXB5aQS5QLNOzDearHqQH13qdH1r9a32UukB2ICLsr2XUNriirOcjKfMeBVYAD/aWvxVD8Oj01qDmYG3jVJ6r4EeyQCQXdAL0j3ybLI2Z0+ElheS6FjwcKzIjtHSHD+k7idyJEqwyaZPYAf/XsXOeWojehb02vdYSQmObRD5vqoxQUK7p7CFN/+ggJDWNZnSfwND7u/Kk59QmyUX6M1w3wfM63OMu5KsHvRa8OsAfUckDbeETVmimC0VLtPrW6i3AkvBjGGSQT+MhYex2EOqg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=qP62/6xKTEUU+x9ckrsir0if25ODKxvtTU0wV+EnzSQ=; b=wPj/Z85iOP9VNxp/quSvZpMM2LTKlx08zQqeIzu14h5g9y7qA6ThLCGCXqRlbvUYYVr/CdCO26vDgvS64hqGAub4Bau/vGf6m/Oa+yDv/Qw1hdyNROj8aCxjr2tqnWNLG6vukh5UXhDJQyhLAvxKjuAvcTxFIHdgjxaREOsz/xyVeHJl+6dvOlwjqCLK0fTmRVFpJAlgqADgmrODRGbkJgQ5nTtOdGcbj/S4r6NXHoXJRHRiJ8OB+P/jJVNuFph/AVtdYujsKvEodtlI/TDm0+OCa4INj7V9GuQBRvUzq84Ayo93xNHdxniwFJ8sYzFYCMFASotPAD+Ipm138EHfxA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=kernel.org smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=qP62/6xKTEUU+x9ckrsir0if25ODKxvtTU0wV+EnzSQ=; b=fqkIS4LVVQoPwRvrqStoYTySFNLB3EpUKudmOuOfNx57HOgL6KF+dWnqJ7BRXjRloOdzan+S9uKazgPMuOz6ktlUFXi7zF5mZkkdC6CIYzTgmpLYhllxE0LLFMPGk9XpKGF3NU7SUFzOB7nx6OG3K8sTJxguZKlYobNIp1cexaU= Received: from BN0PR03CA0001.namprd03.prod.outlook.com (2603:10b6:408:e6::6) by LV1PR12MB999281.namprd12.prod.outlook.com (2603:10b6:408:3bd::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.428.16; Sun, 20 Sep 2026 18:17:48 +0000 Received: from BN7PEPF0000009F.namprd04.prod.outlook.com (2603:10b6:408:e6:cafe::6f) by BN0PR03CA0001.outlook.office365.com (2603:10b6:408:e6::6) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.428.16 via Frontend Transport; Sun, 20 Sep 2026 18:17:48 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=amd.com; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=satlexmb07.amd.com; pr=C Received: from satlexmb07.amd.com (165.204.84.17) by BN7PEPF0000009F.mail.protection.outlook.com (10.167.248.151) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.8 via Frontend Transport; Sun, 20 Sep 2026 18:17:48 +0000 Received: from purico-9dcchost.amd.com (10.180.168.240) by satlexmb07.amd.com (10.181.42.216) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.49; Sun, 20 Sep 2026 13:17:47 -0500 From: Melody Wang To: CC: LKML , Tom Lendacky , , Melody Wang Subject: [PATCH v3 3/8] x86/apic: Add an SVSM APIC driver Date: Sun, 20 Sep 2026 18:16:55 +0000 Message-ID: <69bd40ce677aeac56cf53b10910c602d60604393.1789927246.git.huibo.wang@amd.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: satlexmb08.amd.com (10.181.42.217) To satlexmb07.amd.com (10.181.42.216) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN7PEPF0000009F:EE_|LV1PR12MB999281:EE_ X-MS-Office365-Filtering-Correlation-Id: ca4dd86e-4790-4369-be9a-08df174379f0 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|36860700016|1800799024|376014|23010399003|82310400026|11063799006|56012099006|10067099003|3023799007|6133799003|22082099003|18002099003; X-Microsoft-Antispam-Message-Info: NzL8C0FlxVYPvkJ1SIisZ2i08KbvQrIBP/Bj0wUi8DhhF61HhXEhzF+dOe4BGYxmG32CqCyeb9ziDev1E9PS5iryNMB+D4UjMOXCnuZhIVn7fpmxNDcNc85giWNDjBs8GDUHBHsi83Lw0/0bVF8NbFPW7exgu+b9DsYwowTaNAuOw7vF0JYq7pGd0STw4H92jwFDu2wP0ZTXXAQ8hLbJk+LIrqG9o5LCC6m4IuuA7mSXDJQ7q+voD7AI5wwsw16+5ApAhO8szP0cO80u/rlOKBgjhItb52JGa+kW3+mgMLL/PPvFQZhieuqlbyevJFc/DeoZhf9jlLp/1+wCe2Fs9bBl4d+HwdaOMrFn4EDPCbQP08gKa392w0H9CmStK405C5fv9gYm27pvXdVGopEipukBI6WRcdwiAIXrcvteK5CFZF2Sl2j9AeRaRx3219FHQqdUvYDReRbbgHZ7NnwvmBLXFhDFuoucs4lbjeV5CmTjG/nCzT/3bhXOpmBsDJFbcRUGJEIkvaL/jrpehJdZnVlwBkv1BVzFXWNE2Yn7wGrLQp4y6HqOctEx/Hy0nWML5d/4qLFQT8TyHZiQqf4Ced4ZmxqdxUJtcVGrRkm776cJ4tNfFfCrcJs4XFsNBnt5WHXt5eD8eIhZ0S2FoMOWNwHvinBK1vOBF8chTT4qe2MbfuXdDK1cU7Ez0gdhxvECKy1hfJbGTaqADckXrLBdxA== X-Forefront-Antispam-Report: CIP:165.204.84.17;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:satlexmb07.amd.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230040)(36860700016)(1800799024)(376014)(23010399003)(82310400026)(11063799006)(56012099006)(10067099003)(3023799007)(6133799003)(22082099003)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 2TtmChsevnn7ibSke26EDhOEn+MnAggygXAS3YOdFDyEbCnGsqS2yzI42I1FQR661v/mL8fwgTzCeP0jQ65xf3XDM5unXLJ2E75pbsS9utis+5PQT7t01ZkCClWhavwfuyf9a63vw2W70PYeJP+yP7X/WVweToWGt5rwG5ZvDhm0oaVM86d75K/l/XQFhpVDSRUbq4Swk4uWioFcPQ0f3DwoHO4RNwmYkyuwQ7p1nLDSGakyFw/aOgyzjnKYWE8JdY9HiFEAYnI6+GelGQFdBrQ8adoO1UBFRkjXUwc8VS6ZfIb+NuPE6ydcZ9mL3UBBT5mR6GXurJ+PnIlqTChhkU/5dRwjllkzR8z1BEno8P99Oz4QuE/dx6ae8g04E5h5V6alJChFC6dWdalYX9c3c/2524ksv/Cv12aJ/pxCSYt7b4H3W6SykF2a5XLIpEKX X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Sep 2026 18:17:48.5542 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: ca4dd86e-4790-4369-be9a-08df174379f0 X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d;Ip=[165.204.84.17];Helo=[satlexmb07.amd.com] X-MS-Exchange-CrossTenant-AuthSource: BN7PEPF0000009F.namprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: LV1PR12MB999281 Content-Type: text/plain; charset="utf-8" Alternate Injection replaces hypervisor-based interrupt queuing and event injection, requiring guest-controlled queuing and injection. In order to perform this guest-controlled queuing and injection, an SVSM is used to update the guest VMSA to perform the required actions. The guest uses the SVSM APIC protocol to communicate with the SVSM to perform selected APIC related operations instead of using standard APIC MSR access. Add such a SVSM APIC driver (which implements a subset of an X2APIC), for the APIC emulation supported by the SVSM. Signed-off-by: Melody Wang --- arch/x86/include/asm/sev-common.h | 1 + arch/x86/include/asm/sev.h | 9 ++ arch/x86/kernel/apic/Makefile | 1 + arch/x86/kernel/apic/x2apic_svsm.c | 236 +++++++++++++++++++++++++++++ 4 files changed, 247 insertions(+) create mode 100644 arch/x86/kernel/apic/x2apic_svsm.c diff --git a/arch/x86/include/asm/sev-common.h b/arch/x86/include/asm/sev-c= ommon.h index 01a6e4dbe423..095fbafe8a2c 100644 --- a/arch/x86/include/asm/sev-common.h +++ b/arch/x86/include/asm/sev-common.h @@ -209,6 +209,7 @@ struct snp_psc_desc { #define GHCB_TERM_SECURE_TSC 10 /* Secure TSC initialization failed */ #define GHCB_TERM_SVSM_CA_REMAP_FAIL 11 /* SVSM is present but CA could no= t be remapped */ #define GHCB_TERM_SAVIC_FAIL 12 /* Secure AVIC-specific failure */ +#define GHCB_TERM_ALT_INJ_FAIL 13 /* Alternate Injection-specific failure= */ =20 #define GHCB_RESP_CODE(v) ((v) & GHCB_MSR_INFO_MASK) =20 diff --git a/arch/x86/include/asm/sev.h b/arch/x86/include/asm/sev.h index 9e7a077c445d..557c4d1ef4be 100644 --- a/arch/x86/include/asm/sev.h +++ b/arch/x86/include/asm/sev.h @@ -435,6 +435,13 @@ struct svsm_call { #define SVSM_VTPM_QUERY 0 #define SVSM_VTPM_CMD 1 =20 +#define SVSM_APIC_CALL(x) ((3ULL << 32) | (x)) +#define SVSM_APIC_QUERY_FEATURES 0 +#define SVSM_APIC_CONFIG_EMULATION 1 +#define SVSM_APIC_READ_REGISTER 2 +#define SVSM_APIC_WRITE_REGISTER 3 +#define SVSM_APIC_CONFIG_VECTOR 4 + #ifdef CONFIG_AMD_MEM_ENCRYPT =20 extern u8 snp_vmpl; @@ -528,6 +535,7 @@ void snp_msg_free(struct snp_msg_desc *mdesc); int snp_send_guest_request(struct snp_msg_desc *mdesc, struct snp_guest_re= q *req); =20 int snp_svsm_vtpm_send_command(u8 *buffer); +int svsm_perform_call_protocol(struct svsm_call *call); =20 void __init snp_secure_tsc_prepare(void); void __init snp_secure_tsc_init(void); @@ -636,6 +644,7 @@ static inline void snp_msg_free(struct snp_msg_desc *md= esc) { } static inline int snp_send_guest_request(struct snp_msg_desc *mdesc, struct snp_guest_req *req) { return -ENODEV; } static inline int snp_svsm_vtpm_send_command(u8 *buffer) { return -ENODEV;= } +static inline int svsm_perform_call_protocol(struct svsm_call *call) { ret= urn -ENODEV; } static inline void __init snp_secure_tsc_prepare(void) { } static inline void __init snp_secure_tsc_init(void) { } static inline void sev_evict_cache(void *va, int npages) {} diff --git a/arch/x86/kernel/apic/Makefile b/arch/x86/kernel/apic/Makefile index 581db89477f9..fef51024025b 100644 --- a/arch/x86/kernel/apic/Makefile +++ b/arch/x86/kernel/apic/Makefile @@ -19,6 +19,7 @@ ifeq ($(CONFIG_X86_64),y) obj-$(CONFIG_X86_NUMACHIP) +=3D apic_numachip.o obj-$(CONFIG_X86_UV) +=3D x2apic_uv_x.o obj-$(CONFIG_AMD_SECURE_AVIC) +=3D x2apic_savic.o +obj-$(CONFIG_AMD_ALTERNATE_INJ) +=3D x2apic_svsm.o obj-$(CONFIG_X86_X2APIC) +=3D x2apic_phys.o obj-$(CONFIG_X86_X2APIC) +=3D x2apic_cluster.o obj-y +=3D apic_flat_64.o diff --git a/arch/x86/kernel/apic/x2apic_svsm.c b/arch/x86/kernel/apic/x2ap= ic_svsm.c new file mode 100644 index 000000000000..d72bc7962a66 --- /dev/null +++ b/arch/x86/kernel/apic/x2apic_svsm.c @@ -0,0 +1,236 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * AMD Alternate Injection Support (SEV-SNP Guests) + * + * Copyright (C) 2026 Advanced Micro Devices, Inc. + * + * Author: Melody Wang + */ + +#include +#include + +#include +#include + +#include "local.h" + +static int svsm_apic_probe(void) +{ + if (!cc_platform_has(CC_ATTR_SNP_ALTERNATE_INJECTION)) { + return 0; + } else { + if (!snp_vmpl) { + pr_err("Alternate Injection in VMPL0 impossible. Terminating.\n"); + goto terminate; + } + } + + if (!x2apic_mode) { + pr_err("Alternate Injection in non x2APIC mode impossible. Terminating.\= n"); + goto terminate; + } + + pr_info("Alternate Injection SVSM APIC enabled\n"); + + return 1; + +terminate: + sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_ALT_INJ_FAIL); + return -EINVAL; + +} + +static int svsm_acpi_madt_oem_check(char *oem_id, char *oem_table_id) +{ + return x2apic_enabled() && cc_platform_has(CC_ATTR_SNP_ALTERNATE_INJECTIO= N) && snp_vmpl; +} + +static u32 __svsm_apic_msr_rw(u32 reg, u32 v, bool write) +{ + u32 msr =3D APIC_BASE_MSR + (reg >> 4); + struct svsm_call call =3D {}; + const char *call_reg_str; + unsigned int call_reg; + int ret; + + call_reg =3D write ? SVSM_APIC_WRITE_REGISTER + : SVSM_APIC_READ_REGISTER; + + call_reg_str =3D write ? "SVSM_APIC_WRITE_REGISTER" + : "SVSM_APIC_READ_REGISTER"; + + switch (reg) { + case APIC_ID: + case APIC_TASKPRI: + case APIC_PROCPRI: + case APIC_EOI: + case APIC_ISR ... APIC_ISR + 0x70: + case APIC_TMR ... APIC_TMR + 0x70: + case APIC_IRR ... APIC_IRR + 0x70: + case APIC_ICR: + case APIC_SELF_IPI: + call.rax =3D SVSM_APIC_CALL(call_reg); + call.rcx =3D msr; + call.rdx =3D v; + + ret =3D svsm_perform_call_protocol(&call); + if (ret) { + pr_err("%s: 0x%x, error: %d\n", call_reg_str, reg, ret); + sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_ALT_INJ_FAIL); + } + break; + default: + pr_err("%s 0x%x not supported\n", call_reg_str, reg); + return 0; + } + + return call.rdx_out; +} + +static void svsm_apic_msr_write(u32 reg, u32 v) +{ + __svsm_apic_msr_rw(reg, v, true); +} + + +static u32 svsm_apic_msr_read(u32 reg) +{ + return __svsm_apic_msr_rw(reg, 0, false); +} + +static inline void svsm_apic_msr_eoi(void) +{ + svsm_apic_msr_write(APIC_EOI, APIC_EOI_ACK); +} + +static inline u64 svsm_apic_icr_read(void) +{ + struct svsm_call call =3D {}; + u32 reg; + int ret; + + reg =3D APIC_ICR; + + call.rax =3D SVSM_APIC_CALL(SVSM_APIC_READ_REGISTER); + call.rcx =3D APIC_BASE_MSR + (reg >> 4); + + ret =3D svsm_perform_call_protocol(&call); + if (ret) { + pr_err("%s: error: %d\n", __func__, ret); + sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_ALT_INJ_FAIL); + } + + return call.rdx_out; +} + +static void svsm_apic_icr_write(u32 low, u32 id) +{ + struct svsm_call call =3D {}; + u32 reg; + int ret; + + reg =3D APIC_ICR; + + call.rax =3D SVSM_APIC_CALL(SVSM_APIC_WRITE_REGISTER); + call.rcx =3D APIC_BASE_MSR + (reg >> 4); + call.rdx =3D ((u64)id) << 32 | low; + + ret =3D svsm_perform_call_protocol(&call); + if (ret) { + pr_err("%s: error: %d\n", __func__, ret); + sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_ALT_INJ_FAIL); + } +} + +static void svsm_apic_send_IPI(int cpu, int vector) +{ + u32 dest =3D per_cpu(x86_cpu_to_apicid, cpu); + + svsm_apic_icr_write(__prepare_ICR(0, vector, APIC_DEST_PHYSICAL), dest); +} + +static void __svsm_apic_send_IPI_mask(const struct cpumask *mask, int vect= or, int apic_dest) +{ + unsigned long query_cpu, this_cpu; + + guard(irqsave)(); + + this_cpu =3D smp_processor_id(); + for_each_cpu(query_cpu, mask) { + if (apic_dest =3D=3D APIC_DEST_ALLBUT && this_cpu =3D=3D query_cpu) + continue; + + svsm_apic_send_IPI(query_cpu, vector); + } +} + +static void svsm_apic_send_IPI_mask(const struct cpumask *mask, int vector) +{ + __svsm_apic_send_IPI_mask(mask, vector, APIC_DEST_ALLINC); +} + +static void svsm_apic_send_IPI_mask_allbutself(const struct cpumask *mask,= int vector) +{ + __svsm_apic_send_IPI_mask(mask, vector, APIC_DEST_ALLBUT); +} + +static void __svsm_apic_send_IPI_shorthand(int vector, u32 which) +{ + svsm_apic_icr_write(__prepare_ICR(which, vector, 0), 0); +} + +static void svsm_apic_send_IPI_allbutself(int vector) +{ + __svsm_apic_send_IPI_shorthand(vector, APIC_DEST_ALLBUT); +} + +static void svsm_apic_send_IPI_all(int vector) +{ + __svsm_apic_send_IPI_shorthand(vector, APIC_DEST_ALLINC); +} + +static void svsm_apic_send_IPI_self(int vector) +{ + svsm_apic_msr_write(APIC_SELF_IPI, vector); +} + +static u32 svsm_apic_get_apic_id(u32 id) +{ + return id; +} + +static struct apic svsm_apic __ro_after_init =3D { + + .name =3D "svsm apic", + .probe =3D svsm_apic_probe, + .acpi_madt_oem_check =3D svsm_acpi_madt_oem_check, + + .dest_mode_logical =3D false, + + .disable_esr =3D 0, + + .cpu_present_to_apicid =3D default_cpu_present_to_apicid, + + .max_apic_id =3D UINT_MAX, + .x2apic_set_max_apicid =3D true, + .get_apic_id =3D svsm_apic_get_apic_id, + + .calc_dest_apicid =3D apic_default_calc_apicid, + + .send_IPI =3D svsm_apic_send_IPI, + .send_IPI_mask =3D svsm_apic_send_IPI_mask, + .send_IPI_mask_allbutself =3D svsm_apic_send_IPI_mask_allbutself, + .send_IPI_allbutself =3D svsm_apic_send_IPI_allbutself, + .send_IPI_all =3D svsm_apic_send_IPI_all, + .send_IPI_self =3D svsm_apic_send_IPI_self, + .nmi_to_offline_cpu =3D true, + + .read =3D svsm_apic_msr_read, + .write =3D svsm_apic_msr_write, + .eoi =3D svsm_apic_msr_eoi, + .icr_read =3D svsm_apic_icr_read, + .icr_write =3D svsm_apic_icr_write, + +}; +apic_driver(svsm_apic); --=20 2.43.0 From nobody Thu Sep 24 21:17:21 2026 Received: from BN1PR04CU002.outbound.protection.outlook.com (mail-eastus2azon11010059.outbound.protection.outlook.com [52.101.56.59]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B1CBC23E334 for ; Sun, 20 Sep 2026 18:18:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.56.59 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789928285; cv=fail; b=HdNpB6XkJw5KpafU+Uc3Dm9XDDvPmVk12O2GZS5NdXgdFXGFPVFIK7w76fCgo/j3XTQ1GuZ+e/14F/SzERqNmf4v/uXBwWfNLwtr607dmsZCfbjKEHSMOHLqAnkNIza/aVB1tA0SEaWoONNkmgN6uThIrXpPDIVZeYkxgHydkCo= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789928285; c=relaxed/simple; bh=ZKJKM1GnPJYuonmX/ZloPqAO4ckum6u2L8uUPUsMCVQ=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=X3cX9vilDhVk795Fh9ha6fCUoDs1zLa6U6lRBeDbCplwhpyE2runzCivptloNEnVkyZCPumffqpB+P7uTgqVxmmmnp/7zJyviuco6qu8XLRX6AQ/6mg6dV5u+ZbQKf1uQtnGHy0641tre0NMkPkEpKZgGDceZuJzW1fPyZAxZTs= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amd.com; spf=fail smtp.mailfrom=amd.com; dkim=pass (1024-bit key) header.d=amd.com header.i=@amd.com header.b=aGAV3MTj; arc=fail smtp.client-ip=52.101.56.59 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amd.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=amd.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=amd.com header.i=@amd.com header.b="aGAV3MTj" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Cfp2AKGIZHRCCq0dclSdMiHYqJb38Wm2RibdUvEjJP4RNGClTUPs1AvTMqobYwVPTMPlbmtJ8vfO53B7sy00jrd4CRTsKP3aY33no/nNP94QB4bn2crEhmUVoLgUmry8mPJlic05TDLgab5v3f9WH9XW9TK9SAFBPDiM+bHu6WfYa3WOrIPjbISimrw9ueqTU9+2D+ColbA9l/U60FD5mwF8xBCe8RXZaBXlIjr/qqLx/dmRHNisQozTSr4zQlBj89/Kx4C656N8zVUkPovt0WJGUURXQumQCfipR1dnu0pgBULEa6BmBrAQxLfY6EbXyMgqrXYh7YcPrXEx4676Ew== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=oe9UZ+O2CyUw4JuZDq8CKzcjqMNGc997tn/tDSbys3k=; b=ODMkHeXL2gDUmgOqXKqOQb572ascowasoUE6fk5TGve2PLls+Y+tmn63OWXtaZYMejc2XRBx4vnOheB/R7RH4butnB27cdCY5eEQpRC3OBZr4+5qNKkFP3Bo++ijbh5E236VaRWEpbeILekbOGAX9UItzZQ2dtHd/qDfDKmrEnHfLuS4ynm7Zw6+XHIDGP8oOzb5HXvSeYIVELzwXmq4VjLWr4PCEKFohHZwolAJPpoMX1rf7eMFQfPXwSuwgKMxyhcRy2evtPrDWrplsPo9brX3pw4/6W6PaIrgdXbmEoVyfze1FcU8GcvN76ibhMRFkLyBw78OBf1xkvmc/v2iNw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=kernel.org smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=oe9UZ+O2CyUw4JuZDq8CKzcjqMNGc997tn/tDSbys3k=; b=aGAV3MTjaYBnfEsDRK+YB3Oy8i69sSVmKdbfhTi9GvvozBixL/2ZrznrRkd3Q38wz32Y8DprcUgg+x1oS4/04UyZtJnaWWY8459EdY/vqIcbSbb0eLqhtuydYyR6Lm+Az9AaQoyP5gCm30MHRj1Z/pTQQN7Pp1Jip92FxZ195TM= Received: from BN0PR03CA0008.namprd03.prod.outlook.com (2603:10b6:408:e6::13) by SJ0PR12MB8614.namprd12.prod.outlook.com (2603:10b6:a03:47d::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.428.16; Sun, 20 Sep 2026 18:17:59 +0000 Received: from BN7PEPF0000009F.namprd04.prod.outlook.com (2603:10b6:408:e6:cafe::9c) by BN0PR03CA0008.outlook.office365.com (2603:10b6:408:e6::13) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.428.16 via Frontend Transport; Sun, 20 Sep 2026 18:17:59 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=amd.com; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=satlexmb07.amd.com; pr=C Received: from satlexmb07.amd.com (165.204.84.17) by BN7PEPF0000009F.mail.protection.outlook.com (10.167.248.151) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.8 via Frontend Transport; Sun, 20 Sep 2026 18:17:59 +0000 Received: from purico-9dcchost.amd.com (10.180.168.240) by satlexmb07.amd.com (10.181.42.216) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.49; Sun, 20 Sep 2026 13:17:58 -0500 From: Melody Wang To: CC: LKML , Tom Lendacky , , Melody Wang Subject: [PATCH v3 4/8] x86/sev: Route unsupported APIC register accesses to the hypervisor APIC emulation Date: Sun, 20 Sep 2026 18:16:56 +0000 Message-ID: <3fb71214cab745b8c71166aac347854dfb85a4d0.1789927246.git.huibo.wang@amd.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: satlexmb08.amd.com (10.181.42.217) To satlexmb07.amd.com (10.181.42.216) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN7PEPF0000009F:EE_|SJ0PR12MB8614:EE_ X-MS-Office365-Filtering-Correlation-Id: cb4682e0-ab9d-417b-c9c9-08df17438030 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|82310400026|36860700016|376014|1800799024|10067099003|56012099006|3023799007|18002099003|22082099003|11063799006; X-Microsoft-Antispam-Message-Info: 8p0mX3oeZtipVIN3dl2N/drmmi0NEWDxSqtq0EE3cfJLeOud7gWbTWwuUaMyraYGNByAitK9tc6CmPusukC/ziGIdx26+ROlCsOEw8Y65BaeUbQvWxNnsa4n+LPAXf5jngm3t1s7kOkZnGXvhAg6keQtAkgxNWh4I7H99U55H0cj1TFYebj2A9BpWzm+WhrZ0B2KijgE3EQtwtMWcLnXbczMqOI4//qxtmhie01rs74tKbf5sXLhjE3C7BQ+DUDu1CIX8D1NVi3Mc8FxZuPjbchSSpBp938BYWzePNI/7WbW7DfN6CJAq1Db7Ikw+ybSYGLlMkBWNRVAqVIvASbyIg9sd0yqtXrZrwcUXQkDyyd2hMKsaBQlMbLWbA763dekFi9FKQaLtebeyjlrLdCBCgENDIbTdrEXMNi8xB2zCeM3eV6Utv1O+aOkjDZi0PaLmMdSZqum8zCRhCMC3TDQc+WW9KNuWizqcco+1OU94QvlH4DkD+olls8hlyQrFy0g0Iam5eqmmIBMoO4bmTB1mE6oKXJEeJ+dDEDyUQxR52WjgICCROf0NNtD9g7ARr96MM0NZelf0HtwAHCYrCyr14Z8hAbigeF+/+BKMJUcQRO6yjSJcHhZKiHRssd5dMOH1wLs/VGQ34/KTBcxJqj537MyeMmugAi81zuw4gcDPlzB48UrZhgA35lRtCFoZOgdCvnkHw//AXX7Ss5rh++dtw== X-Forefront-Antispam-Report: CIP:165.204.84.17;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:satlexmb07.amd.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230040)(23010399003)(82310400026)(36860700016)(376014)(1800799024)(10067099003)(56012099006)(3023799007)(18002099003)(22082099003)(11063799006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: crZ9uwOkxjg+C9hBCBVNu2tqbF1RiCxG3auHDgJj/FCTJVamPkVYr3UOmT02c6UJejIBXjjR4H5ss3/IWz6bzdyexZu/+5/b/AKWC9y9eF8iZAqkG6gyqIUgN4FjYwKl2F7sOiVkd461PQ5+U0PGODp2SQBKcSGVec/1bXPp79euyHiJv90c73MhOKjy2GOiARW+0UNi0hWDllMSZnadrgjYl002iI5IYzgGxP8/ZxaPO4cL1t/bviRbJEZBrCcG4WeuXpi3zoiPCmqlthKM6WwcM6oU5K4FAREkBQaYkm3lP7/LM7m54iGrksJSXSdQZEVsRzjt0l+1gZYe4wCTzBB7Vd3h4217uQAXdsMlc0irknRB9ySRNBzAjXNsEmB3kuMN6g/S22TFQV3I4K+gX9AK6x8T7iSNY6m9jg1u7zEQQan2wjhk2BmAXkn+HT2k X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Sep 2026 18:17:59.0403 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: cb4682e0-ab9d-417b-c9c9-08df17438030 X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d;Ip=[165.204.84.17];Helo=[satlexmb07.amd.com] X-MS-Exchange-CrossTenant-AuthSource: BN7PEPF0000009F.namprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR12MB8614 Content-Type: text/plain; charset="utf-8" The SVSM APIC emulation supports only a subset of the X2APIC MSRs. Right now only basic APIC functionality related to interrupt delivery is supported. Therefore, route the unsupported ones to the hypervisor's X2APIC emulation. Signed-off-by: Melody Wang --- arch/x86/coco/sev/core.c | 46 +++++++++++------------------ arch/x86/include/asm/sev-common.h | 1 + arch/x86/include/asm/sev.h | 8 ++--- arch/x86/kernel/apic/x2apic_savic.c | 8 ++--- arch/x86/kernel/apic/x2apic_svsm.c | 11 +++++-- 5 files changed, 35 insertions(+), 39 deletions(-) diff --git a/arch/x86/coco/sev/core.c b/arch/x86/coco/sev/core.c index c54269366278..22956fab1581 100644 --- a/arch/x86/coco/sev/core.c +++ b/arch/x86/coco/sev/core.c @@ -972,7 +972,7 @@ int __init sev_es_efi_map_ghcbs_cas(pgd_t *pgd) return 0; } =20 -u64 savic_ghcb_msr_read(u32 reg) +static u64 __sev_apic_ghcb_msr_rw(u32 reg, u64 value, bool write) { u64 msr =3D APIC_BASE_MSR + (reg >> 4); struct pt_regs regs =3D { .cx =3D msr }; @@ -981,49 +981,37 @@ u64 savic_ghcb_msr_read(u32 reg) enum es_result res; struct ghcb *ghcb; =20 + if (write) { + regs.ax =3D lower_32_bits(value); + regs.dx =3D upper_32_bits(value); + } + guard(irqsave)(); =20 ghcb =3D __sev_get_ghcb(&state); vc_ghcb_invalidate(ghcb); =20 - res =3D __vc_handle_msr(ghcb, &ctxt, false); + res =3D __vc_handle_msr(ghcb, &ctxt, write); if (res !=3D ES_OK) { - pr_err("Secure AVIC MSR (0x%llx) read returned error (%d)\n", msr, res); - /* MSR read failures are treated as fatal errors */ - sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_SAVIC_FAIL); + pr_err("APIC MSR via GHCB (0x%llx) %s returned error (%d)\n", msr, write= ? "write" : "read", res); + /* MSR read/write failures are treated as fatal errors */ + sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_APIC_MSR_FAIL); } =20 __sev_put_ghcb(&state); =20 + /* The return value will be ignored by the caller for a write */ return regs.ax | regs.dx << 32; } =20 -void savic_ghcb_msr_write(u32 reg, u64 value) +u64 sev_apic_ghcb_msr_read(u32 reg) { - u64 msr =3D APIC_BASE_MSR + (reg >> 4); - struct pt_regs regs =3D { - .cx =3D msr, - .ax =3D lower_32_bits(value), - .dx =3D upper_32_bits(value) - }; - struct es_em_ctxt ctxt =3D { .regs =3D ®s }; - struct ghcb_state state; - enum es_result res; - struct ghcb *ghcb; - - guard(irqsave)(); - - ghcb =3D __sev_get_ghcb(&state); - vc_ghcb_invalidate(ghcb); - - res =3D __vc_handle_msr(ghcb, &ctxt, true); - if (res !=3D ES_OK) { - pr_err("Secure AVIC MSR (0x%llx) write returned error (%d)\n", msr, res); - /* MSR writes should never fail. Any failure is fatal error for SNP gues= t */ - sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_SAVIC_FAIL); - } + return __sev_apic_ghcb_msr_rw(reg, 0, false); +} =20 - __sev_put_ghcb(&state); +void sev_apic_ghcb_msr_write(u32 reg, u64 value) +{ + __sev_apic_ghcb_msr_rw(reg, value, true); } =20 enum es_result savic_register_gpa(u64 gpa) diff --git a/arch/x86/include/asm/sev-common.h b/arch/x86/include/asm/sev-c= ommon.h index 095fbafe8a2c..585ddc44b6b4 100644 --- a/arch/x86/include/asm/sev-common.h +++ b/arch/x86/include/asm/sev-common.h @@ -210,6 +210,7 @@ struct snp_psc_desc { #define GHCB_TERM_SVSM_CA_REMAP_FAIL 11 /* SVSM is present but CA could no= t be remapped */ #define GHCB_TERM_SAVIC_FAIL 12 /* Secure AVIC-specific failure */ #define GHCB_TERM_ALT_INJ_FAIL 13 /* Alternate Injection-specific failure= */ +#define GHCB_TERM_APIC_MSR_FAIL 14 /* APIC MSR failure */ =20 #define GHCB_RESP_CODE(v) ((v) & GHCB_MSR_INFO_MASK) =20 diff --git a/arch/x86/include/asm/sev.h b/arch/x86/include/asm/sev.h index 557c4d1ef4be..3cb6c5d6a6e0 100644 --- a/arch/x86/include/asm/sev.h +++ b/arch/x86/include/asm/sev.h @@ -541,8 +541,8 @@ void __init snp_secure_tsc_prepare(void); void __init snp_secure_tsc_init(void); enum es_result savic_register_gpa(u64 gpa); enum es_result savic_unregister_gpa(u64 *gpa); -u64 savic_ghcb_msr_read(u32 reg); -void savic_ghcb_msr_write(u32 reg, u64 value); +u64 sev_apic_ghcb_msr_read(u32 reg); +void sev_apic_ghcb_msr_write(u32 reg, u64 value); =20 static __always_inline void vc_ghcb_invalidate(struct ghcb *ghcb) { @@ -650,8 +650,8 @@ static inline void __init snp_secure_tsc_init(void) { } static inline void sev_evict_cache(void *va, int npages) {} static inline enum es_result savic_register_gpa(u64 gpa) { return ES_UNSUP= PORTED; } static inline enum es_result savic_unregister_gpa(u64 *gpa) { return ES_UN= SUPPORTED; } -static inline void savic_ghcb_msr_write(u32 reg, u64 value) { } -static inline u64 savic_ghcb_msr_read(u32 reg) { return 0; } +static inline void sev_apic_ghcb_msr_write(u32 reg, u64 value) { } +static inline u64 sev_apic_ghcb_msr_read(u32 reg) { return 0; } =20 #endif /* CONFIG_AMD_MEM_ENCRYPT */ =20 diff --git a/arch/x86/kernel/apic/x2apic_savic.c b/arch/x86/kernel/apic/x2a= pic_savic.c index 4bc6d7e018a5..990e4a379e07 100644 --- a/arch/x86/kernel/apic/x2apic_savic.c +++ b/arch/x86/kernel/apic/x2apic_savic.c @@ -72,7 +72,7 @@ static u32 savic_read(u32 reg) case APIC_LVT0: case APIC_LVT1: case APIC_LVTERR: - return savic_ghcb_msr_read(reg); + return sev_apic_ghcb_msr_read(reg); case APIC_ID: case APIC_LVR: case APIC_TASKPRI: @@ -193,7 +193,7 @@ static void savic_icr_write(u32 icr_low, u32 icr_high) =20 icr_data =3D ((u64)icr_high) << 32 | icr_low; if (dsh !=3D APIC_DEST_SELF) - savic_ghcb_msr_write(APIC_ICR, icr_data); + sev_apic_ghcb_msr_write(APIC_ICR, icr_data); apic_set_reg64(this_cpu_ptr(savic_page), APIC_ICR, icr_data); } =20 @@ -210,7 +210,7 @@ static void savic_write(u32 reg, u32 data) case APIC_LVTTHMR: case APIC_LVTPC: case APIC_LVTERR: - savic_ghcb_msr_write(reg, data); + sev_apic_ghcb_msr_write(reg, data); break; case APIC_TASKPRI: case APIC_EOI: @@ -316,7 +316,7 @@ static void savic_eoi(void) * interrupts. Return to the guest from GHCB protocol event takes * care of re-evaluating interrupt state. */ - savic_ghcb_msr_write(APIC_EOI, 0); + sev_apic_ghcb_msr_write(APIC_EOI, 0); } else { /* * Hardware clears APIC_ISR and re-evaluates the interrupt state diff --git a/arch/x86/kernel/apic/x2apic_svsm.c b/arch/x86/kernel/apic/x2ap= ic_svsm.c index d72bc7962a66..9ab49d360219 100644 --- a/arch/x86/kernel/apic/x2apic_svsm.c +++ b/arch/x86/kernel/apic/x2apic_svsm.c @@ -81,8 +81,15 @@ static u32 __svsm_apic_msr_rw(u32 reg, u32 v, bool write) } break; default: - pr_err("%s 0x%x not supported\n", call_reg_str, reg); - return 0; + if (write) { + /* + * Even if this will end up returning call.rdx_out, + * that is being ignored by the caller for a write. + */ + sev_apic_ghcb_msr_write(reg, v); + } else { + return sev_apic_ghcb_msr_read(reg); + } } =20 return call.rdx_out; --=20 2.43.0 From nobody Thu Sep 24 21:17:21 2026 Received: from CH4PR04CU002.outbound.protection.outlook.com (mail-northcentralusazon11013053.outbound.protection.outlook.com [40.107.201.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CEA8B38736F for ; Sun, 20 Sep 2026 18:18:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.201.53 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789928297; cv=fail; b=ey90Rlu/DKkKNI/7GKcM5x+xPjg9Vmjb/ZMoQNghcOtkJA802JK4plocndK94anUVbE+4EA/Bk9aN9c8dIVgIbvujiNA8I9xTGugLIB+9uKGNVP29bhDAsYOUBdSu/C/wxd0+Cy9Y2wb44teNefoPnmLaaz1jWPM0JZU8UXo1y0= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789928297; c=relaxed/simple; bh=JpZQr4rQ5aBBWX6vatPmpDx2eAHfo5G729GfeexYazk=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=W5SYf6Iw17OyR4IqPQQ5zPdVCo4ZcQT2vENj5bEcQqZCdVSH6VWbdidRIIxgFZ2kacXUH7B1udX8Jg6WSKZOfcIgJzqI+6ui82CvZ8FDqukdbT0gWxaug4Q4N9L0M784VqvW376z9CMOiqllQIKdsFVaPMFPU2AvE4+PQB6PhME= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amd.com; spf=fail smtp.mailfrom=amd.com; dkim=pass (1024-bit key) header.d=amd.com header.i=@amd.com header.b=tpIGLFd+; arc=fail smtp.client-ip=40.107.201.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amd.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=amd.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=amd.com header.i=@amd.com header.b="tpIGLFd+" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=mQU2tIhFZkiq6D4qimPYdKb5YcM6HuGckZ0tvQyBjDD8Sy1DGZRR5/H0w6Y5SyMlfas8meOEEVpnYIPO4YRwnp6YtBI154KfEU1Vnz3dXQxak3Kr/P9Ce64E9Bqfl9qOgTof7IQ8wmlAf4KptTsB4RL/E1JAU1n7xOmL3Be6CbZwPbtPDhapo0k/IOxS4s8I7iqbX3GIPJimx2Jgg1sAc5MOmDItD/Ablolz2bBzL1z1fTNt4zQ3UqHa1L7t5TTEPxE0Ff5ZAKx/4KKZrsujkAqlxVaFhzvBET/yg2XCfF6iRJFXatP/Wucgf3FSCtU+V6Gm/HU+HfQW44WnM0IYVA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=tOLgYwGo2mHOTT6dlmLIvEYxYMN5F9UA2Wsy6fk55Dg=; b=nWu/YO3jRVTYRm+1IpeDSYW2cbnJdAtPyqi3Hw2VtU2ppitWhnURW5XOACY6RtTK/wLFthsY4SQUvfBczEK08n8Z5AC/R4tlUVwE9XIhsbsrGwGqnp63LwQCTogL7h9YZgUgcQSYFNJJctyac8nx5dRoWRIFUMTzt0NMLjhrSXVzUDyZQxVfhaqW5s9Hhgz7AqNMo2SJeC1mffDlcpL5Bj0fb6qNxpDSlCN1Xg2Ky2lM8IS4JHghmcf7k1m6auIePiwPD3zYZxyQEnSJXd9qmXiZPb5KfkrGnsxxLhoFblYZxXWtROslpXTpdDWnU1NKWyPmMJOnHTYCaMLue6p6Mw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=kernel.org smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=tOLgYwGo2mHOTT6dlmLIvEYxYMN5F9UA2Wsy6fk55Dg=; b=tpIGLFd+ImwGJhvQObCp/ICzccq7IPQuOmQ2qNYQ+Els30bpfA1PZx84NZfwa9PL1U4zUMqLwSsAyO0RpZwEaLeUisPJMMKEi/K6pvw4Z56cMdmmx2+03Amon3HWx6/ISq0E7GV/FiQjLFA6aPRK1CR8EHVihU2zJD8NQh6fqOo= Received: from BN0PR03CA0009.namprd03.prod.outlook.com (2603:10b6:408:e6::14) by SJ0PR12MB6783.namprd12.prod.outlook.com (2603:10b6:a03:44e::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.428.16; Sun, 20 Sep 2026 18:18:11 +0000 Received: from BN7PEPF0000009F.namprd04.prod.outlook.com (2603:10b6:408:e6:cafe::a6) by BN0PR03CA0009.outlook.office365.com (2603:10b6:408:e6::14) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.428.16 via Frontend Transport; Sun, 20 Sep 2026 18:18:09 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=amd.com; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=satlexmb07.amd.com; pr=C Received: from satlexmb07.amd.com (165.204.84.17) by BN7PEPF0000009F.mail.protection.outlook.com (10.167.248.151) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.8 via Frontend Transport; Sun, 20 Sep 2026 18:18:09 +0000 Received: from purico-9dcchost.amd.com (10.180.168.240) by satlexmb07.amd.com (10.181.42.216) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.49; Sun, 20 Sep 2026 13:18:09 -0500 From: Melody Wang To: CC: LKML , Tom Lendacky , , Melody Wang Subject: [PATCH v3 5/8] x86/sev: Add a function to contain all SEV-specific setup operations Date: Sun, 20 Sep 2026 18:16:57 +0000 Message-ID: <8d0e7aaeb41a09bf30cabd1d6e36f43fdd0edc9c.1789927246.git.huibo.wang@amd.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: satlexmb08.amd.com (10.181.42.217) To satlexmb07.amd.com (10.181.42.216) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN7PEPF0000009F:EE_|SJ0PR12MB6783:EE_ X-MS-Office365-Filtering-Correlation-Id: 7715969e-3ddd-4da3-bb14-08df174386a6 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|82310400026|23010399003|1800799024|36860700016|22082099003|18002099003|56012099006|11063799006|10067099003; X-Microsoft-Antispam-Message-Info: DzQNXtb7i77Lph9MHH6zL41Y47mBomGjxBdpgE2LFKLCQ268kp3DT92Avc3z8Jf8RfdhFBpRyGcQw9p7xuoWqPivhUuwfCfIXVjN9ruNTPn8GJj3SWp4QsA0X+y5XkOhy7e/25NWkwoYfL4Gw9tUTyHQo+eowyvNxTbEkobphO20XSOR/exORGfggpWwMD3UXKaegW7C/qpGShxbdALnaWKDniaJcVTZRDROwlIkffElUJ4HugCdZ58+a9LoHi0gLYIL4ve3U5W2vlbQOSXYd0abibGFhPuMj2flBOc5VoFmEwZazMYNaONtlNHXr9K4RjGiAgIImB/Yb2Qy4T+4xgxNqEHpTF1Tgi5MmAKisHA/WbXKSxSBFUXIoKiWSI8Jdf6BxmOSOBq0q0KwYsX5Ai//LP0grAqXJb0jBVh95oqNV/bak+26l1oT4XGY8u2h5ZlD7j3uacKKSI7KoO88wysXfAoo+EKeCwW8GZs6YoSee8CzehIWDkSfmEC0RqbqltcYcANvDyHM+ZyQhXJOaGhBxIv5qP6Eo3oM0a9vl2LJ2CjumO++zGE/wM8oADg3fWGVgsK0QL5hbFjNEKqLmKQz/rjuuTGOXYtT533s/v0mKGNAGzrxCp7MCMy+nmMzt88bW1oNqh4m+sOnVLM6j8zVTNBggQPqEdjYGePzAVmADqvcJfXAy7wqtqR7Obbx8rBbiGkGid/kQC7hcOxv5Q== X-Forefront-Antispam-Report: CIP:165.204.84.17;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:satlexmb07.amd.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230040)(376014)(82310400026)(23010399003)(1800799024)(36860700016)(22082099003)(18002099003)(56012099006)(11063799006)(10067099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: RUQNLMzX9iuUHaoOiG0ziNfPB48632TL+WTAkF9VheJeWsbjPjCTXD6I4Yi9yZc3/3zoY15p9jxOVqqcABAwvPG7c3rY5MLslRmCeyY0rdGsyl2Y8vslPK6cQar6uHKW0+qn1UtuN12tfOJm12xr9KD1a1TiXmiDcs6b8ofJc5FAcVYxN8AjGy8534YbbS/nkllMEdUVYPoFCZcGAU5vXXtXJXcxUbuXmV2Ev9i0lxY6USGtTp3c9zQGleJapvY+NbSneMTTIvIKkjfl+SbgjMnSJ3WjetR2LeDUHKpa+stnYrCht06QUZjMbthd633jjDlFKyYPP2qotXn+WVxe24Wc0qppI6V2Nvz91r5WPwNr2dGYa2DURnizGHkNrUkGAeO+w+V48JkjZTvjwPKxxonGI2F3Cx3crVh1pr1LUd/TnA0Vr71wrhRAZ58oomNs X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Sep 2026 18:18:09.8798 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 7715969e-3ddd-4da3-bb14-08df174386a6 X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d;Ip=[165.204.84.17];Helo=[satlexmb07.amd.com] X-MS-Exchange-CrossTenant-AuthSource: BN7PEPF0000009F.namprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR12MB6783 Content-Type: text/plain; charset="utf-8" To make the code clean in the boot phase, add a sev_prepare() wrapper which contains early SEV-specific checks in order to have all that code in a single place. No functional changes. Signed-off-by: Melody Wang --- drivers/firmware/efi/libstub/x86-stub.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/firmware/efi/libstub/x86-stub.c b/drivers/firmware/efi= /libstub/x86-stub.c index cef32e2c82d8..49388524a61f 100644 --- a/drivers/firmware/efi/libstub/x86-stub.c +++ b/drivers/firmware/efi/libstub/x86-stub.c @@ -783,7 +783,7 @@ static efi_status_t exit_boot(struct boot_params *boot_= params, void *handle) return EFI_SUCCESS; } =20 -static bool have_unsupported_snp_features(void) +static bool sev_prepare(void) { u64 unsupported; =20 @@ -933,7 +933,7 @@ void __noreturn efi_stub_entry(efi_handle_t handle, =20 hdr =3D &boot_params->hdr; =20 - if (have_unsupported_snp_features()) + if (sev_prepare()) efi_exit(handle, EFI_UNSUPPORTED); =20 if (IS_ENABLED(CONFIG_EFI_DXE_MEM_ATTRIBUTES)) { --=20 2.43.0 From nobody Thu Sep 24 21:17:21 2026 Received: from SA9PR02CU001.outbound.protection.outlook.com (mail-southcentralusazon11013063.outbound.protection.outlook.com [40.93.196.63]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AB05823E334 for ; Sun, 20 Sep 2026 18:18:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.93.196.63 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789928307; cv=fail; b=eLnvIqa1pvdWwjWnVpfaSdCenSi7qA+QK1aoOfACbbDsOqxR/CbvSZb8QVZkzX7PlHybAsZkvWvALIBow+GttoYPOjc28Hf+mzygKpjjEwS35SyIIDxwp8UB4BdjQYIAEI0DXcdObCnkyWrcyMw83kKeRATJX9VRTrcn79WnaDo= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789928307; c=relaxed/simple; bh=2dUfN3XJKQjXyiXMGXLXxUZVRtrVHbnHa08Tm5dknfw=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=jLm8L3C8vH6d3v4XmANK4Q3+bVxHRpr/7yCQfv3ZKuqFd72VAaHYpxGHVpOMGRNJrEru+6N63HQSED3tQxDw6NTYSSym2wwqaKpfTz9S42tsEyY0qUckaIN/VqyI9Qm22r8DZcy4bfJJGKoK+EjJY70vWhvus2N4JGKxspKxxUM= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amd.com; spf=fail smtp.mailfrom=amd.com; dkim=pass (1024-bit key) header.d=amd.com header.i=@amd.com header.b=lq2DoZUu; arc=fail smtp.client-ip=40.93.196.63 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amd.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=amd.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=amd.com header.i=@amd.com header.b="lq2DoZUu" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Zyz7hbt6hwTKXivdFouUA47XWadrLQSZbkIgqGZiJHtNN7meix8b7NkMnXhh5tntwCtHDsllR606bU3NwVWEun9FeSa3HfoSdhfuNvL1xplrvriqDC3D+Z/ceYj9TVFCA05DJCPkrse1EQXtDBy+iFlSsZn8e9btJXnzSmdWbVbA7lyxe0qjpMqwbKqTORVMt3yHXG7gz8HeSiVo1xRxpGocJgaSngoVKV9tlBvnT81iLLDsCwh9r75aK5ZM1n+NVfq5YRSY9QWbPKQDVLX6C9HZLz+BmlmtosUxCiwuLVxIlXbqtHgSP+liDtP1naWHJ/ZKJ2dJKkYJ/Ctpn+23/w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=XMqj8syPMkgPq2bSlIWExWed5I/gcyrrMslAwabJlGE=; b=RNCCIT8N8m4ZIfK6tf873phfuzJ5MkbmMs8l+/oUNfV6KKB47V1IsEmwrrgI/zw3N4MU0pTNVmWmSMHTZfeac8oTRTWolBLAG2qIS0Mq1pttwhDAgcGuYZbNHCXwkELO6nSkA4IghymIJiy+35iFUTu7T5Q/hONdpHXnA4sm5jmuzVt9Cf3X5trDeXnQwPyNTGRNBtDClTjct6v2l0z0E/ytEBekJQlOnvpMYwThKCH+WUAkPnT5njTFcKCXGi+dfttBniBgLJX17lU36BF9SZiGMzHSwgT+e0jYyZqvtlhs5CyxNMRZ3aQNq81bsdWdrZEw1Q87wqzM5G10XPhm5A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=kernel.org smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=XMqj8syPMkgPq2bSlIWExWed5I/gcyrrMslAwabJlGE=; b=lq2DoZUuu4bwJF0SRr7TuqAIT/IY2gIuHQ9ANrHFx2uNfN1V8zuGxWiWYFm/+DC/ChAi2aBD6MW00EDmtA0B+yNf5QFdBEf5rhI8A2Xw8Gme0vunaK99PaImsFx+XPkHAZEyPwZ7SMsA7vScvobslYptnBDHF5j2mBRZkHYtcIY= Received: from BN9PR03CA0380.namprd03.prod.outlook.com (2603:10b6:408:f7::25) by DM4PR12MB6350.namprd12.prod.outlook.com (2603:10b6:8:a3::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.428.16; Sun, 20 Sep 2026 18:18:21 +0000 Received: from BN7PEPF0000009E.namprd04.prod.outlook.com (2603:10b6:408:f7:cafe::98) by BN9PR03CA0380.outlook.office365.com (2603:10b6:408:f7::25) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.428.16 via Frontend Transport; Sun, 20 Sep 2026 18:18:21 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=amd.com; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=satlexmb07.amd.com; pr=C Received: from satlexmb07.amd.com (165.204.84.17) by BN7PEPF0000009E.mail.protection.outlook.com (10.167.248.150) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.8 via Frontend Transport; Sun, 20 Sep 2026 18:18:21 +0000 Received: from purico-9dcchost.amd.com (10.180.168.240) by satlexmb07.amd.com (10.181.42.216) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.49; Sun, 20 Sep 2026 13:18:20 -0500 From: Melody Wang To: CC: LKML , Tom Lendacky , , Melody Wang Subject: [PATCH v3 6/8] x86/sev: Register the guest with the SVSM APIC protocol Date: Sun, 20 Sep 2026 18:16:58 +0000 Message-ID: <656edc5467df7d8c33676f0a80c3042885d95f9b.1789927246.git.huibo.wang@amd.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: satlexmb08.amd.com (10.181.42.217) To satlexmb07.amd.com (10.181.42.216) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN7PEPF0000009E:EE_|DM4PR12MB6350:EE_ X-MS-Office365-Filtering-Correlation-Id: cd24b47f-84bf-47cb-b6d2-08df17438d8b X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|82310400026|36860700016|376014|1800799024|10067099003|56012099006|3023799007|18002099003|22082099003|11063799006; X-Microsoft-Antispam-Message-Info: umEjH07tirT6td2dDgbwSYUkyphQ5sOPzgP29zpBjawRlZktfvMgCjvcNWTj/G7347c7YoGor0ZtqFSBqU8V9G1LkKPjVaIDG4thBr4IO/0Itb9dfr8iMFyo8jmaxNUSuBQ0EKSr3Nh9zY/AA8AUf27VkG/Ut5hIvvMEs3RwcVCgxG+lGdbf6nzNRCqeUT51YgStfQTsmev2auodpKySZ91J504FzGRG179F+2VRclPRHUGTJj7BCzZsR4stgL0JKYpV59vdhRBzU69kkdKG3EhPk62oAAXOmnP+yvsxvgCm1L1FhL41SLw16yxYZN7GGnR/MK+P9K5iLRpP9ldDczdkgGIjh+40WgBn06RN622O2HZwBzBSWNpe/fOC+siVQV2m5nljo2Wqc5T60J8ckg9C5htSLA0e/pSBlN89rBkhKGh6k/BIzsF/0ACveYYNgohCYYXxAKqlY/0k0puW80673Q634ySXkoWqzvKjxouIrgQpklAk3QAWTfLJRWm1t9wOndlA1mA8TH94oW1hwIaxkRh6DJHLN2SsVbyS0MOjX1MGn8xOUiR592jJS19WmLZLuO+cxZxmfsCBIihfIJQZqqgj9wLU5FalLaDv9XK3hUzjn7LFWd68ZS/EAAXaq0WWr1F25AqDYtrB998M7LiQ84+3ccospl0kfTE6tsiBjGw7jeaKRdLj7JSEbcLByLjzZrw2Ph3mERzWsSN8MA== X-Forefront-Antispam-Report: CIP:165.204.84.17;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:satlexmb07.amd.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230040)(23010399003)(82310400026)(36860700016)(376014)(1800799024)(10067099003)(56012099006)(3023799007)(18002099003)(22082099003)(11063799006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: fqmm0O8VjPIkBptNzQdJd291CXlw5lsqPVeAcFSQitgfGVR0adxvqE4d4GtOr8Li/4kX6O7u2AQXST8qXyG+HAYlnJvCirhlrlS/KJC51rYJEnwPd8lOPDupE4ES6G/oBm22Pb2o/ac51mJvjMm4hnPMUTgikB2jCNMyzb1jCBKigTKCerXayP/Wqc3lHbbN59IEtSu5YfvfQ+GaHZkzR1s34GF0j/oa8cItGeLeyURahAIQk5QiU8r/Y8auNEr2jIysyMZZojn4XQ7IAYr/lKJBBtRKJQQF21HfFhfCi0op4dmI7TI06amaL7U5R9JIICiqib3PznM4khzW3u+7vMxVY0FFptArbviRROQ5Mh1tNjIhxJeyyBZm7hbeMKnkYYxHVnB8Zmj/kgHIBOdyMt4/ZrzbP/dDjSIyLB//MqcgpvrUpG5u7jz8oNVwAWYW X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Sep 2026 18:18:21.4344 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: cd24b47f-84bf-47cb-b6d2-08df17438d8b X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d;Ip=[165.204.84.17];Helo=[satlexmb07.amd.com] X-MS-Exchange-CrossTenant-AuthSource: BN7PEPF0000009E.namprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM4PR12MB6350 Content-Type: text/plain; charset="utf-8" The SVSM APIC protocol supports 5 calls. SVSM_APIC_CONFIGURE_EMULATION (shortened to SVSM_APIC_CONFIG_EMULATION for brevity), call 1, provides the controls whether the guest can make use of the SVSM APIC protocol. Implement this call, and register Alternate Injection for the guest by default. Signed-off-by: Melody Wang --- arch/x86/boot/compressed/sev.c | 23 +++++++++++++++++++++++ arch/x86/boot/compressed/sev.h | 6 ++++++ arch/x86/include/asm/sev.h | 2 ++ drivers/firmware/efi/libstub/x86-stub.c | 3 +++ 4 files changed, 34 insertions(+) diff --git a/arch/x86/boot/compressed/sev.c b/arch/x86/boot/compressed/sev.c index fc2029746c50..9f776ba7f123 100644 --- a/arch/x86/boot/compressed/sev.c +++ b/arch/x86/boot/compressed/sev.c @@ -511,3 +511,26 @@ bool early_is_sevsnp_guest(void) } return true; } + +/* + * When the guest is running at VMPL2 with Alternate Injection enabled, + * register Alternate Injection before ExitBootServices(). + */ +void svsm_register_alt_inj(void) +{ + if (early_is_sevsnp_guest() && snp_vmpl) { + struct svsm_call call =3D {}; + int ret; + + if (!(sev_get_status() & MSR_AMD64_SNP_ALTERNATE_INJ)) + return; + + call.caa =3D (struct svsm_ca *)boot_svsm_caa_pa; + call.rax =3D SVSM_APIC_CALL(SVSM_APIC_CONFIG_EMULATION); + call.rcx =3D SVSM_AI_REGISTER; + + ret =3D svsm_call_msr_protocol(&call); + if (ret) + sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_ALT_INJ_FAIL); + } +} diff --git a/arch/x86/boot/compressed/sev.h b/arch/x86/boot/compressed/sev.h index 22637b416b46..dd058af2e7aa 100644 --- a/arch/x86/boot/compressed/sev.h +++ b/arch/x86/boot/compressed/sev.h @@ -12,6 +12,12 @@ =20 #include =20 +enum svsm_ai_ctrl { + SVSM_AI_DISABLE, + SVSM_AI_DEREGISTER, + SVSM_AI_REGISTER, +}; + void snp_accept_memory(phys_addr_t start, phys_addr_t end); u64 sev_get_status(void); bool early_is_sevsnp_guest(void); diff --git a/arch/x86/include/asm/sev.h b/arch/x86/include/asm/sev.h index 3cb6c5d6a6e0..c1e31fc9c918 100644 --- a/arch/x86/include/asm/sev.h +++ b/arch/x86/include/asm/sev.h @@ -543,6 +543,7 @@ enum es_result savic_register_gpa(u64 gpa); enum es_result savic_unregister_gpa(u64 *gpa); u64 sev_apic_ghcb_msr_read(u32 reg); void sev_apic_ghcb_msr_write(u32 reg, u64 value); +void svsm_register_alt_inj(void); =20 static __always_inline void vc_ghcb_invalidate(struct ghcb *ghcb) { @@ -652,6 +653,7 @@ static inline enum es_result savic_register_gpa(u64 gpa= ) { return ES_UNSUPPORTED static inline enum es_result savic_unregister_gpa(u64 *gpa) { return ES_UN= SUPPORTED; } static inline void sev_apic_ghcb_msr_write(u32 reg, u64 value) { } static inline u64 sev_apic_ghcb_msr_read(u32 reg) { return 0; } +static inline void svsm_register_alt_inj(void) { } =20 #endif /* CONFIG_AMD_MEM_ENCRYPT */ =20 diff --git a/drivers/firmware/efi/libstub/x86-stub.c b/drivers/firmware/efi= /libstub/x86-stub.c index 49388524a61f..35b8641119b9 100644 --- a/drivers/firmware/efi/libstub/x86-stub.c +++ b/drivers/firmware/efi/libstub/x86-stub.c @@ -793,6 +793,9 @@ static bool sev_prepare(void) unsupported); return true; } + + svsm_register_alt_inj(); + return false; } =20 --=20 2.43.0 From nobody Thu Sep 24 21:17:21 2026 Received: from SA9PR02CU001.outbound.protection.outlook.com (mail-southcentralusazon11013045.outbound.protection.outlook.com [40.93.196.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EA1C83D646B for ; Sun, 20 Sep 2026 18:18:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.93.196.45 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789928323; cv=fail; b=gYjukAfXYi+kLyKZLg63Ln8kdx06HjFn/ZJwYiBySlMezTfAC3KdWt47e4pBnaEjOcsEpgCKdS0W/RWYGNqGJwtn+0TwsbZ1fh74l9zoUdRI5+HgMQrHucvGZGy8OX2NdjINcErOX3d+N06vE8j+pKHvJZg1Tmw53pMfiZFxXBI= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789928323; c=relaxed/simple; bh=Fxn/z/6fPk27sreV7vP/xK5C7aacD34P9VVLXJ66SV4=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=UpX1gVu35VsrWMl9zG1K5yxR5jOZiG/Bzk4JCvS3PXuJCLD1O4uOAr34ytCc1EI4RBXoRSL2u1k4c8knBqvHlQ/hjvejtXPPz5oy+cBz08NGMKR/5IDu4ckyh/8JcPg/4uRfPSXqTU79qzip/0lTA14P5KXd90uCyjm4uQ6hDf0= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amd.com; spf=fail smtp.mailfrom=amd.com; dkim=pass (1024-bit key) header.d=amd.com header.i=@amd.com header.b=XAxhkJ0X; arc=fail smtp.client-ip=40.93.196.45 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amd.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=amd.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=amd.com header.i=@amd.com header.b="XAxhkJ0X" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=M6dizxjljhMZI7Rdl2FlRXjod+8hraInJhfS/IQtPq+g2BfLvNYm2rbc3ks6qp7yEpUylGU+Be8vSSsDTxNAWzi2YnZ8x+D7wVuFrqo2nGHrZ/RfhMV1Nk3kNPuBsv3rorfExwGMQfuTq20U0PgVlw4L5Mvag8kX1qTjF3Qfw+vtx1TlnEnOJ2h03jAI8P/m+J9g76xD0mezI5kBy3QnPXxQ8xRykiui8JY/ZjvUvECCjQMwS935k7i2ICbJgBwt348QmHjn7VdHqF3EF90Do8piqUJ1EOVhjvOC5wYiRWWBgHZ8kORms6cuIhHnIGqw6YqxGb3oLjAfgCT5VjQ5Aw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Q55FhPOz/tgMc2f+fF50B0EYwFFF9LBjAqRcD6Ccf1M=; b=Isdd3PiIQrQT97Uo3R/82XvKNBwuHis1vTCxNBbxvtxMQxI1yVO9Whe9VWEO3YVGP4O6ExWFLsMgQgSA24fwVdoPjvQxssB+P+7HctxcqAyM8AVt1cZESQ5AVaCw/0fiOlF5US4VvaRe/DRBWVnYv9i/peOwFO5Lztn/PftqvjV9s4L7SyiVySvbF9veMfL1W/PP3X6SSK1lAXgWNV0/fPccVPPOjR+PysXIICkPYU4FFpeGLdMXRvgV58hvSdDZS0Doj8sQpYRDXZG5fdc0kD0UfPZmpDASiKlpVANOf7JyQ6IvUcKxHy8wrdZRU1abkwwt0mrv+D0fZyR9xDsORQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=kernel.org smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Q55FhPOz/tgMc2f+fF50B0EYwFFF9LBjAqRcD6Ccf1M=; b=XAxhkJ0XlLkH2tSgWJ6JQD6PUB/m68qrbvvXu1irWgfcvMgcutrZnKSM6jlaY0HKdPCvyygLn0YkaYFOFj2jO0QgReb+3R5RR/sbtzSYzfjrWmqimLvN/GoKrM55CvzV4MKp75mkgz1CrtZjr70qkNIk5ZR8z1pqLLLkD4MuTiY= Received: from LV3P220CA0019.NAMP220.PROD.OUTLOOK.COM (2603:10b6:408:234::11) by CY5PR12MB6526.namprd12.prod.outlook.com (2603:10b6:930:31::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.428.16; Sun, 20 Sep 2026 18:18:37 +0000 Received: from BN7PEPF0000009C.namprd04.prod.outlook.com (2603:10b6:408:234:cafe::a0) by LV3P220CA0019.outlook.office365.com (2603:10b6:408:234::11) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.406.12 via Frontend Transport; Sun, 20 Sep 2026 18:18:36 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=amd.com; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=satlexmb07.amd.com; pr=C Received: from satlexmb07.amd.com (165.204.84.17) by BN7PEPF0000009C.mail.protection.outlook.com (10.167.248.148) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.8 via Frontend Transport; Sun, 20 Sep 2026 18:18:36 +0000 Received: from purico-9dcchost.amd.com (10.180.168.240) by satlexmb07.amd.com (10.181.42.216) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.49; Sun, 20 Sep 2026 13:18:35 -0500 From: Melody Wang To: CC: LKML , Tom Lendacky , , Melody Wang Subject: [PATCH v3 7/8] x86/sev: Allow the guest to configure interrupt vectors for the hypervisor Date: Sun, 20 Sep 2026 18:16:59 +0000 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: satlexmb08.amd.com (10.181.42.217) To satlexmb07.amd.com (10.181.42.216) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN7PEPF0000009C:EE_|CY5PR12MB6526:EE_ X-MS-Office365-Filtering-Correlation-Id: 89451f97-41c2-4d4a-240c-08df17439697 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|1800799024|82310400026|36860700016|23010399003|11063799006|3023799007|10067099003|56012099006|22082099003|18002099003; X-Microsoft-Antispam-Message-Info: gRXZoeRtuIt2Z+sILhoyVbkKHKtEo+w7SXd/Ja7I4BsBOMDHdeGpJYCfyrToZIOMtH8e9GyAU5ZHNtyUoa5mwOpbmfwCYCc35dsETZBHTh/XCDYLoRBbeHeZcYt7OsQa7J8C/1ka1goU5kPpsGq+MVYaikG8z44r7yK5TQHEixFQZ2vwXm91crthRAKQ1OD87Gu/9h1wAzuFc9sig8gQH2L++tqUPWYSspGNwtGgi2HronO2FZNqXp6PeYmCbNrtJHw11vCRIbAtA9XIQjisttUZdwFbUUrB7U5BCEtydj4ReMF0F0yqDTxRZoqBzzfwE63vcLN7C2MY3CgfVBPJh0u2x2fDdZYoGZo2t72pWREbNNZHsyiGhFzn8h3wq+hIKBsEq1AZqFqOn8PrjqfSLwny1yiB6cC0UWn1aDVW+wMivYPAtjoJsM+j9AZFllvtQW+7hHwtgLh4+dxLQ7aRi09FbPR0mnzH1cnyEKvmvPeUhrx3uD44PQr8qaQnW66csvjUtC9LdNbT9lB2g1sYN27bBvhcJXjSJgygf0WllNTgZxyY8sJBlxUdwZOM6vnSCoi3G57N6wis4TQqK5gkR/RDZHV0b3/ymntc0YZ9sNr1kNMMtmWFMzMmWyiXUxU2WBtwdLZkqizCwaLDP6mQaenhn/bBl2oA0O7frhiYMrN+6y2icFLTyy4Q9Dth/csWND2QjBeBGWtwQ+us3z8HhQ== X-Forefront-Antispam-Report: CIP:165.204.84.17;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:satlexmb07.amd.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230040)(376014)(1800799024)(82310400026)(36860700016)(23010399003)(11063799006)(3023799007)(10067099003)(56012099006)(22082099003)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: n1VniaV8buKoHcOwd3lcLmx6dfPs0CXeXCrkr1qbFRRYySznNXwYfyJH1PW40K49t5RUt/CYhDt8K5uRdpBSf+FTmntmQLYnRZNwzlxVPnJhDjAXHgV7fY0SIy+RCSEBOFyeG3X1oPDv2Fr4yuh/UJ1i7AnjtHGvJetyENL08Jxa+VMyUP4GB3BfyG3aQ071khrcBXZa+kedolhwlecYt5O+/Qh05QgfibthEdjuv4jeZ5N11mKVS5qolTW97uyQwgPvtslcJZ40vhyWkp8koovgx0tfhI73HbDiboXS7pfaUgQ4jbpq7eA/ga9t1/Hx5FKQs0kpLqjq+3XJZJrtuBjTm4kQCXB/4LXQrQpeDg08dEMQk9gC4KnhvrKX1fWy7Dse1XXfe2icGs+bQGFh0gNF1O778pEpvRnIdPjLQii7xQ/FlcVU9rJ/4veYiP96 X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Sep 2026 18:18:36.6202 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 89451f97-41c2-4d4a-240c-08df17439697 X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d;Ip=[165.204.84.17];Helo=[satlexmb07.amd.com] X-MS-Exchange-CrossTenant-AuthSource: BN7PEPF0000009C.namprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY5PR12MB6526 Content-Type: text/plain; charset="utf-8" The SVSM APIC protocol supports 5 API calls. SVSM_APIC_CONFIGURE_VECTOR (shortened to SVSM_APIC_CONFIG_VECTOR for brevity), call 4, provides for the guest to configure an interrupt vector which the guest allows and the hypervisor can use to signal interrupts for it. Implement this call, and make the default interrupt setting permissive to allow all interrupts when detecting an SVSM and Alternate Injection is enabled. Signed-off-by: Melody Wang --- arch/x86/boot/compressed/sev.c | 24 ++++++++++++++++++++++++ arch/x86/boot/compressed/sev.h | 7 +++++++ arch/x86/include/asm/sev.h | 2 ++ drivers/firmware/efi/libstub/x86-stub.c | 2 ++ 4 files changed, 35 insertions(+) diff --git a/arch/x86/boot/compressed/sev.c b/arch/x86/boot/compressed/sev.c index 9f776ba7f123..6ab6276f731f 100644 --- a/arch/x86/boot/compressed/sev.c +++ b/arch/x86/boot/compressed/sev.c @@ -534,3 +534,27 @@ void svsm_register_alt_inj(void) sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_ALT_INJ_FAIL); } } + +/* + * Configure all interrupts as permissive by default for Alternate Injecti= on + * enabled SNP guest. + */ +void svsm_config_alt_inj_vectors(void) +{ + if (early_is_sevsnp_guest() && snp_vmpl) { + struct svsm_call call =3D {}; + int ret; + + if (!(sev_get_status() & MSR_AMD64_SNP_ALTERNATE_INJ)) + return; + + call.caa =3D (struct svsm_ca *)boot_svsm_caa_pa; + call.rax =3D SVSM_APIC_CALL(SVSM_APIC_CONFIG_VECTOR); + call.rcx =3D SVSM_IRQ_ENABLE_ALL; + + ret =3D svsm_call_msr_protocol(&call); + if (ret) + sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_ALT_INJ_FAIL); + } + +} diff --git a/arch/x86/boot/compressed/sev.h b/arch/x86/boot/compressed/sev.h index dd058af2e7aa..035a7b46085b 100644 --- a/arch/x86/boot/compressed/sev.h +++ b/arch/x86/boot/compressed/sev.h @@ -18,6 +18,13 @@ enum svsm_ai_ctrl { SVSM_AI_REGISTER, }; =20 +enum svsm_vec_enable { + SVSM_IRQ_DISABLE_SINGLE =3D (0u << 8), + SVSM_IRQ_ENABLE_SINGLE =3D (1u << 8), + SVSM_IRQ_DISABLE_ALL =3D (2u << 8), + SVSM_IRQ_ENABLE_ALL =3D (3u << 8), +}; + void snp_accept_memory(phys_addr_t start, phys_addr_t end); u64 sev_get_status(void); bool early_is_sevsnp_guest(void); diff --git a/arch/x86/include/asm/sev.h b/arch/x86/include/asm/sev.h index c1e31fc9c918..a6d4e5ea0913 100644 --- a/arch/x86/include/asm/sev.h +++ b/arch/x86/include/asm/sev.h @@ -544,6 +544,7 @@ enum es_result savic_unregister_gpa(u64 *gpa); u64 sev_apic_ghcb_msr_read(u32 reg); void sev_apic_ghcb_msr_write(u32 reg, u64 value); void svsm_register_alt_inj(void); +void svsm_config_alt_inj_vectors(void); =20 static __always_inline void vc_ghcb_invalidate(struct ghcb *ghcb) { @@ -654,6 +655,7 @@ static inline enum es_result savic_unregister_gpa(u64 *= gpa) { return ES_UNSUPPOR static inline void sev_apic_ghcb_msr_write(u32 reg, u64 value) { } static inline u64 sev_apic_ghcb_msr_read(u32 reg) { return 0; } static inline void svsm_register_alt_inj(void) { } +static inline void svsm_config_alt_inj_vectors(void) { } =20 #endif /* CONFIG_AMD_MEM_ENCRYPT */ =20 diff --git a/drivers/firmware/efi/libstub/x86-stub.c b/drivers/firmware/efi= /libstub/x86-stub.c index 35b8641119b9..7082fa10d5e6 100644 --- a/drivers/firmware/efi/libstub/x86-stub.c +++ b/drivers/firmware/efi/libstub/x86-stub.c @@ -796,6 +796,8 @@ static bool sev_prepare(void) =20 svsm_register_alt_inj(); =20 + svsm_config_alt_inj_vectors(); + return false; } =20 --=20 2.43.0 From nobody Thu Sep 24 21:17:21 2026 Received: from SN4PR0501CU005.outbound.protection.outlook.com (mail-southcentralusazon11011034.outbound.protection.outlook.com [40.93.194.34]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6B6FA23E334 for ; Sun, 20 Sep 2026 18:18:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.93.194.34 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789928334; cv=fail; b=NGh7RnwRsUz79p10SXUpdV2ZZWoRPoF5j4kU6htMQ+I5nXSslmPJeg99WZwMSEOHXlywwySaDgsue143+ayK0mQ0oPnZEk262p9yL9CwSrrDaEQi4YkRcgABvc9y2coSg7ZuQLsBWInnP9FdkNfcVWtRQZfIr8OGPPEf01ggsg4= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789928334; c=relaxed/simple; bh=GflrT3BpyVnsZ3byIV+nqBX83lfAt/C5IlKi75mHafM=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=lwqOsEjol1CDP+QQYPgmO0a8Ee9RRaJXwCRFUfLVhXCMGoQ/g4fHchTLRathnOI66uxYVBRCwffNFE00GMnOeHEU0Og7GcwYJz06bq2gCyE/C09pQDnFwV9E5rsdynWSsHJXhXyHXcEunbJwS8gImhHIJvhdddbgvaRznMkB7Ug= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amd.com; spf=fail smtp.mailfrom=amd.com; dkim=pass (1024-bit key) header.d=amd.com header.i=@amd.com header.b=z4fA3lZS; arc=fail smtp.client-ip=40.93.194.34 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amd.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=amd.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=amd.com header.i=@amd.com header.b="z4fA3lZS" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=wg14Cr1HuvsFK5D4fAihfq9ner/jwGtjrazb5xG+/OnA58IqjxCffckwbdLW/qX7ayvdq4M1tlcVhXfauO/qaZ/mWLdFS3emymS9LkIYjnOLmlU9C4UqFOq4OUVQj6JNuYo2C7ikN/E6IGLlDk4a+2tmIl6V1Z7Y9OgrZBkrPjb44UwzRB5eFJtmFDDapbGS1id5uP0YGYoRj6H0IVMertamA5iiF5dYkpMhmZRTEmcUF4f/Qe0iMcUaj0p3EuVNWYZt70JmXs3n1dWGpCcBMgw5zHFxC3QdWbHcHY6DyPpxboUOqtkE0RQ/RpD6zEeVuJ8/S/x4ezHrO/xxFdkaNw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=EZ5bzfnIiOGHKYesNBO6d0Ekcm5dLvIKXzKAtOxzSjM=; b=VcWyCh0wNOW9ZuPTLaYdjkukoO2X0PFIK6kKdAGLE0N42Rs7zk4LE0RsyGGIz7qmfucWEapQ6cH7YiuKX0Tx/JZlC9FB2oVQbFaY7EYksXtDjYkwpQ7UWYqz5RTdOQWmYE6I25Lxy/i5WzDrQ7kwwPzO0jV/1prvfhlXC4z2WzDo6VMpZ1LfYf1wB/l85zXlmdjgUFp0E3OViYN/CW0JcDld2+05F0aeEfKgbpC2AluVmz77CNUfbBoLL6ZXYyhaZzaxEYtnJgTKRn9EkDTxJRE+4oXxnsHpZxXrLguGmvLK6R1Bth+xWeXzGO5Kb39/C3uco0iK7CTcxiTHRLGMRg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=kernel.org smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=EZ5bzfnIiOGHKYesNBO6d0Ekcm5dLvIKXzKAtOxzSjM=; b=z4fA3lZSoTrRLwKEzAAL8pCku3xECx2g+w8NsO4hRdKypsF1e9Qe4AnXhK1n+5uBrNQ0L1fc9LFrRhdlB2pEDi/IbkObYLA2AtXeSKRcy6X8gWaLpGwgZo3G9Q3REdcmTIzbLEVHATGfBTzEOsFFZKzmMqBFDkcIW32nNWEH3/s= Received: from BN9PR03CA0637.namprd03.prod.outlook.com (2603:10b6:408:13b::12) by DM6PR12MB4186.namprd12.prod.outlook.com (2603:10b6:5:21b::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.428.16; Sun, 20 Sep 2026 18:18:48 +0000 Received: from BN7PEPF0000009D.namprd04.prod.outlook.com (2603:10b6:408:13b:cafe::a4) by BN9PR03CA0637.outlook.office365.com (2603:10b6:408:13b::12) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.428.16 via Frontend Transport; Sun, 20 Sep 2026 18:18:48 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=amd.com; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=satlexmb07.amd.com; pr=C Received: from satlexmb07.amd.com (165.204.84.17) by BN7PEPF0000009D.mail.protection.outlook.com (10.167.248.149) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.8 via Frontend Transport; Sun, 20 Sep 2026 18:18:48 +0000 Received: from purico-9dcchost.amd.com (10.180.168.240) by satlexmb07.amd.com (10.181.42.216) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.49; Sun, 20 Sep 2026 13:18:46 -0500 From: Melody Wang To: CC: LKML , Tom Lendacky , , Melody Wang Subject: [PATCH v3 8/8] x86/sev: Indicate that Alternate Injection is supported in the guest Date: Sun, 20 Sep 2026 18:17:00 +0000 Message-ID: <1f34eadd5c376ea5e16ea37b5c3bf9b5cbc9ac6b.1789927246.git.huibo.wang@amd.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: satlexmb08.amd.com (10.181.42.217) To satlexmb07.amd.com (10.181.42.216) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN7PEPF0000009D:EE_|DM6PR12MB4186:EE_ X-MS-Office365-Filtering-Correlation-Id: e23ebf43-8148-4ca7-2f2b-08df17439d62 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|36860700016|82310400026|1800799024|376014|10067099003|22082099003|18002099003|56012099006|11063799006; X-Microsoft-Antispam-Message-Info: ko6+QotEt6SzJKD64u0IFcm/41gXQKE1onTCgcaQN817IsRtQO5IIl5I8dMxJuYkk3CIMzuUuCUubv2u+fXkb+dUJhh4kfXgTDR1Lf1fgkUvZ7tn9eME3zgA1ttaNPGEZj8AcJYMzy35xOXrdAXJ0xO/VWb8gTAnDcgbA5tHIT48kh3bmIvdeySgqc0xmjcWEzc07CI3NxgJgeIBDz36y95ddz3mrffxtQt5WjT1QZipXpS4IKwWY3/twNxW7KRDEzm/lfDeDFFRY/WND59VSTpZ8Amxqb+oN7HwfYtjIuhw/mvzOo0SKXWrKcpt4u16uLDrUL9t8x8AZhiJazLGZEjXPjjT7nQtWpfcE/LrpbyMhS/rRPun3n37swTVnap7lvJ5KZOpOma++/qdxqxPMkssjPTRzmhdNfqPRDEYyqBb4xyaYL/OMMNpziicJzAMt2V9+JWUkNDzJZqS73Y6IRbMcvC+in3bg2TvgEqC18QnvPWuUnGH/gDl/IC9F0TJed6eI8axrvDhiPJ1Kdy4P+BcIiJsIYJEuy6xF0lmyZx1d3U2WXAEV5ZrpM2VZxNPoDFwtPcxR/IQo0eRezKtWQ/Qzz6/vLE8ueDZGyMT9HiOmKD/xHsgoQtplT4rqGHc9ZqeaUO/nh2fwpnlm0GwW8zxJHmtQdPBW41G1ced5lWv7ZnETqMkKr9rVci8Znxd/UxvKeqgoNCgz2bY+eqi5A== X-Forefront-Antispam-Report: CIP:165.204.84.17;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:satlexmb07.amd.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230040)(23010399003)(36860700016)(82310400026)(1800799024)(376014)(10067099003)(22082099003)(18002099003)(56012099006)(11063799006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: HtBnsqPKHjq7PUUWSQRAhQ3o9kN3abTprpl0VXS27GZMN1PqbOiNyTg/IpkjEOXj/TXXJRVNKi4Er647nkqWjawvAOeJaPSselo7LhuQA9dNoOYoDSgVIoPFwhP8ivni//Pr+04oDnNheb3h+EAbI7/4XeBCLkmG2NrJaBt5Pwi8bSiWI/B+zIHvsU/bSlVcJfmJ3lOKATTf/h+5NOByyrTmRtCH7E6468Wuak1Neub80hGyEzauXX88SytGb5aOo6r8oGCW/rcbGV9TH6SWGtQ2fDU1bGRMJ+FopBHt2d0Un1zVeuFza5M5MNoKgIdov3voQgsfVdtJvGVNeEEzS0SIFJEsapP+JjggDDjhSOUzpXVVvTUvzv6MQ/VoAy+Ny+AKT/LNg7+gnE2PZpNFNwC8DAJM2LwAxfuLdtXzDQPX4hvWi2KohlJ1g9XV+nfR X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Sep 2026 18:18:48.0168 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: e23ebf43-8148-4ca7-2f2b-08df17439d62 X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d;Ip=[165.204.84.17];Helo=[satlexmb07.amd.com] X-MS-Exchange-CrossTenant-AuthSource: BN7PEPF0000009D.namprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR12MB4186 Content-Type: text/plain; charset="utf-8" Now the Alternate Injection support is complete, add it to the present SNP features. Signed-off-by: Melody Wang --- arch/x86/boot/compressed/sev.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/arch/x86/boot/compressed/sev.c b/arch/x86/boot/compressed/sev.c index 6ab6276f731f..62b1e54988ac 100644 --- a/arch/x86/boot/compressed/sev.c +++ b/arch/x86/boot/compressed/sev.c @@ -197,6 +197,12 @@ bool sev_es_check_ghcb_fault(unsigned long address) #define SNP_FEATURE_SECURE_AVIC 0 #endif =20 +#ifdef CONFIG_AMD_ALTERNATE_INJ +#define SNP_FEATURE_ALTERNATE_INJ MSR_AMD64_SNP_ALTERNATE_INJ +#else +#define SNP_FEATURE_ALTERNATE_INJ 0 +#endif + /* * SNP_FEATURES_IMPL is the mask of SNP features that are implemented * by the guest kernel. As and when a new feature is implemented in the @@ -204,7 +210,8 @@ bool sev_es_check_ghcb_fault(unsigned long address) */ #define SNP_FEATURES_IMPL (MSR_AMD64_SNP_DEBUG_SWAP | \ MSR_AMD64_SNP_SECURE_TSC | \ - SNP_FEATURE_SECURE_AVIC) + SNP_FEATURE_SECURE_AVIC | \ + SNP_FEATURE_ALTERNATE_INJ) =20 u64 snp_get_unsupported_features(u64 status) { --=20 2.43.0