From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from SJ2PR03CU001.outbound.protection.outlook.com (mail-westusazon11012008.outbound.protection.outlook.com [52.101.43.8]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6D471269D18 for ; Thu, 30 Jul 2026 01:49:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.43.8 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785376148; cv=fail; b=QvJgm/ggq36lJoGVULl5pxBgWjLD4+NK3zibfl5HFkPzjnIymmDBbsA3VKevayY9F0EWJeAwoNouxNx/WoMJhrihJV08w36PqquwsTrS/rm4nkjcYb+8vpzI8Bckl3eF3cEFshFaEAmM/rmGYPM2gGIbnRarHT1YAXlmu3dkXr8= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785376148; c=relaxed/simple; bh=TIShK+srYK6u8k3JRZpCzbXgNjDJKWac136BlG+RiyU=; h=From:To:CC:Subject:Date:Message-ID:MIME-Version:Content-Type; b=RMr17hU33jCHNf/JCKPfpXQ1kLC3FRp9P8mB3yKD+0kJbTydsro9kUfNyNkI43aGcBTSMlSiLq9sRVYbhTZR51Ttz+IYqdblwYncwjlcPme1T4YFdWkzmKi9JYy8MvPX5aC5iMYfQZ/1K6YTYqTFN/J9m7LVeK/wn5/3udL+hiA= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amd.com; spf=fail smtp.mailfrom=amd.com; dkim=pass (1024-bit key) header.d=amd.com header.i=@amd.com header.b=LtyYj6Dr; arc=fail smtp.client-ip=52.101.43.8 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amd.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=amd.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=amd.com header.i=@amd.com header.b="LtyYj6Dr" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=H8AIXgDhETbYdIIcQ5g6VgYZz8oz8/jopLAXyHelLDziLxOSwWTdKUDV3Ldg4jv7wpdhnqBi4Njcu5IjQ1RaXhC68c4eUuQkFZkYRBASzGrr/9vrYfU+Cpk/RuRZhykXrjQk572cxvZT3i8M6+pfuEqqsjFOmQZjeQeZAKbskYBc/OOESfGxHcy+F7q7aJynUFhkHjsSq+T3XYSuYNos6a+kHHhi67uEE1v/oSkDO++OAjBdUkyB26dxanqxN99LAcHIyRbdB37n1qxC35GMhZZyK7d38C0bu/Tn/d0T84B/h2ITwcBi7uhNya4jSWoIbdot54ca6Fj1tUO1BN6AQg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=1qmHtvZfMHyyKlhwoiH8rSwiTfY6S8tM1z4XxwTMB8U=; b=gOeXQ4u05Gfjtd+3fsyfGNhDSR6gKPc7bVAX0N474NTHvicNXlPbZiTnXtogHWg9FETP50A6mRRnoz/HY1AwCkZOZL0rnBiZmb3eIqlMRS+2aP4kkcsS2+Onv3lRq7yJxIl1NbfdWJ0LjMPF0gXt0HggtqvQm0iRdrIjSh4fibzbA2II0H6SmPwhok87FOZbJsvCKr8nJh2JO7KNIiOOzazAoCJYlu52KySdoGbgpVUiMCcVfwfS82cWayGN7D6ayN2OYm6xSekRqIzzUigfZTv2NJ620PcnMt4bkbLQbYQFlGNPyOKpK7YI3PeMRHDXAS8UECa5ii7+dZ5azz5Bng== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=kernel.org smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=1qmHtvZfMHyyKlhwoiH8rSwiTfY6S8tM1z4XxwTMB8U=; b=LtyYj6DrXNafpA7+iFYFZUnsL3GGxF3zViTaUERqLkkCMhPBn82GuGOAaqg9LxGhTXUhea7+Bc7/QE82KV2t1kKFcDEGK8oa/9TqEXIZWbU/QQRZaEJ4htkPjk1oamvsMAKWor/NG0++10NwcTpVA0RMkod8xavFuJAsCBS9cUw= Received: from CH0PR04CA0053.namprd04.prod.outlook.com (2603:10b6:610:77::28) by IA5PR12MB999326.namprd12.prod.outlook.com (2603:10b6:208:608::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.14; Thu, 30 Jul 2026 01:49:04 +0000 Received: from CH2PEPF0000013D.namprd02.prod.outlook.com (2603:10b6:610:77:cafe::19) by CH0PR04CA0053.outlook.office365.com (2603:10b6:610:77::28) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.13 via Frontend Transport; Thu, 30 Jul 2026 01:49:04 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=amd.com; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=satlexmb07.amd.com; pr=C Received: from satlexmb07.amd.com (165.204.84.17) by CH2PEPF0000013D.mail.protection.outlook.com (10.167.244.69) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.292.8 via Frontend Transport; Thu, 30 Jul 2026 01:49:03 +0000 Received: from purico-9dcchost.amd.com (10.180.168.240) by satlexmb07.amd.com (10.181.42.216) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.41; Wed, 29 Jul 2026 20:49:02 -0500 From: Melody Wang To: CC: LKML , Tom Lendacky , Melody Wang Subject: [PATCH 0/7] Alternate Injection: Secure Interrupt Delivery for SEV-SNP Guests - Guest Support Date: Thu, 30 Jul 2026 01:48:40 +0000 Message-ID: X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain X-ClientProxiedBy: satlexmb08.amd.com (10.181.42.217) To satlexmb07.amd.com (10.181.42.216) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CH2PEPF0000013D:EE_|IA5PR12MB999326:EE_ X-MS-Office365-Filtering-Correlation-Id: 6e7516e7-459e-4d9d-40cf-08deeddcbbeb X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|1800799024|82310400026|23010399003|36860700016|18002099003|3023799007|10067099003|56012099006|11063799006; X-Microsoft-Antispam-Message-Info: SH1xu5rBlZwqGpAlYdRhxWfU4/O/cQuOzzLHYFnuOo9n9pm69ewBYyg+M2rCht5cvlRitaJOcacf7MxvSGX1NU8rIpkDcCkLh43QMkoQKtiJo1Xs3BHTiFzBPFy88f5VcQkGQELwF/4MSVMH4TNaKG6u6W91KRQ6VZ8kKdkaXg4g1MkA1wb0IEb1rK/COE76fRFvCEpLx+Ux2qRPcjIxOr/MD+qwxRfTmoY31puQRlN0XUoGNsNI/E9ay9J9gDarMSXWGo/kBmxaBFJ08sx00sJOFnK9cRx1YADTKncasoOrbTu1799djxGYSqHBNKBB6+TuW0M8Z2Y1VLfMAnB73GglavN0pU9DKVLEcgUArmEbColyaU9tXBaml21QCqi74pLCKZrka1NwgbQKzI+YiDBSlkLXc6QFXbcq0/fbjTaTGpkJaKpzrR4/N9iTz+lQAMYEZ2M3qRnQ/oOY+KSg5jU3JoIfzgIf1AkCNKQamxoBKtgL0ohvjU2KkUNSzMJX8KBw0eCpswZZ+Pn03ZDIFHjVMqh/vMrYhkOjoXVylUrY0AqCAH+MDytR/ABqUh3q3Sfm7whUBNtEfz5AN4n1bm2RSP/If//AOFZn2r+VxO71kUj8XPRVdSOjfl1MadtEINsUtEXVsKQGAT+0AsT0OFMGtA0YLY+jZNHha5xn0kkNiTQNyAPIqxQTNqIfj8BtgvZME3k2i86czsm08t0Kog== X-Forefront-Antispam-Report: CIP:165.204.84.17;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:satlexmb07.amd.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230040)(376014)(1800799024)(82310400026)(23010399003)(36860700016)(18002099003)(3023799007)(10067099003)(56012099006)(11063799006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: FlrW8yHbWx09Pme82k+Z3Y0ZEbHT/fL751HQryj+lkVZHyDvt3APVtCjlCIxxah0D9o1g5SU6kug70/GN3uhS+96Z0ve4yM3WcLuYgMfIZx6SXB9O6PNADwnKGN7GKyDEgG78B5MLIqYkZIOJmifleUQoJctbzzjyckzsHGfLnTRw+vp2mbqAopELdhlQPoC8GA8JeparR7Sfvp+5uteiPpT66JXbAdYl8vT6qqdBFJG4MFSMK8ZZuev0D/0wOUsrRcws7mhO91uh3ZvJ5IIDcmI8UwGRj+mLSCICofClVQyYeMIxUbTAdjfk0JYk6jVQV6yusaTLgugOzEDsFxN5vxxFe9C3amZ6oMg8p1V76G1uC4Kf1qEZDQfjkK/U9nr7lzCXXbQwflirhilrr2Eldfc/t1bDByV/oy1zs6afEb2Priz+fuYmyqGoYq9mac+ X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 Jul 2026 01:49:03.3971 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 6e7516e7-459e-4d9d-40cf-08deeddcbbeb X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d;Ip=[165.204.84.17];Helo=[satlexmb07.amd.com] X-MS-Exchange-CrossTenant-AuthSource: CH2PEPF0000013D.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA5PR12MB999326 Alternate Injection is a method to provide secure interrupt delivery for SEV-SNP guests against malicious injection attacks. By handing over the control of the interrupt injection to the guest itself, the security is applied. Alternate Injection use Secure VM Service Module (SVSM), and APIC emulation in the SVSM to secure interrupt delivery. This is the guest side patches. The patch set includes the following: 1. Add support for enabling Alternate Injection. 2. Add support for the SVSM APIC protocol which uses a subset of the X2APIC MSRs. 3. Add support to allow the guest OS to request Alternate Injection. Thanks, Melody Melody Wang (7): x86/sev: Add support for Alternate Injection x86/apic: Add an SVSM APIC driver x86/sev: Allow the guest to configure interrupt vectors for the hypervisor x86/sev: Route unsupported APIC register accesses to the hypervisor APIC emulation x86/sev: Add a function to contain all SEV-specific setup operations x86/sev: Register the guest with the SVSM APIC protocol x86/sev: Indicate that Alternate Injection is supported in the guest arch/x86/Kconfig | 14 ++ arch/x86/boot/compressed/sev.c | 37 +++- arch/x86/boot/compressed/sev.h | 6 + arch/x86/boot/startup/sev-startup.c | 15 ++ arch/x86/boot/startup/sme.c | 3 + arch/x86/coco/core.c | 3 + arch/x86/coco/sev/core.c | 14 +- arch/x86/coco/sev/svsm.c | 6 + arch/x86/include/asm/cpufeatures.h | 1 + arch/x86/include/asm/msr-index.h | 4 +- arch/x86/include/asm/sev-common.h | 1 + arch/x86/include/asm/sev.h | 29 ++- arch/x86/kernel/apic/Makefile | 1 + arch/x86/kernel/apic/svsm_apic.c | 255 ++++++++++++++++++++++++ arch/x86/kernel/apic/x2apic_savic.c | 8 +- drivers/firmware/efi/libstub/x86-stub.c | 20 +- include/linux/cc_platform.h | 8 + 17 files changed, 392 insertions(+), 33 deletions(-) create mode 100644 arch/x86/kernel/apic/svsm_apic.c -- 2.43.0