From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from CH5PR02CU005.outbound.protection.outlook.com (mail-northcentralusazon11012005.outbound.protection.outlook.com [40.107.200.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5408C3446C5 for ; Thu, 30 Jul 2026 01:50:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.200.5 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785376209; cv=fail; b=CnY48kuP6v49yDlM39rUcDs+o/P8yVAwWPxGmhRjXO5ltuvWiAk3oln0Crj+Y67FlVD0c7COP4rQD3SzxJANOXVp17FwwzEfACgfTQf1HMEnyn08byWf77ZB4Qg4EwBn6tOLTyIwB7VdmIFJ6fWGsWyV1lNRP/LOZpXmY1VpDeU= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785376209; c=relaxed/simple; bh=i7lUu9zuVHgaDrwiGIlIvYyVT7daqToa+7s/50f2RUU=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=L6CbvlUafmIPylgs3aabdDw4qvNhsQu/8+9ccRXVXHjiBSYoI0ZKMEKB5tOufsv34VHCxxfQellc4n7wyC1peaTN5Qhh5xj+XY/VI1g5cJN2GSjEo9NPHDcFHWmXd21tnUh/0YlA2WaL+sYJWaJtXWu1TXRJFFBIP0b8EkYBXho= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amd.com; spf=fail smtp.mailfrom=amd.com; dkim=pass (1024-bit key) header.d=amd.com header.i=@amd.com header.b=dcu0cf9D; arc=fail smtp.client-ip=40.107.200.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amd.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=amd.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=amd.com header.i=@amd.com header.b="dcu0cf9D" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=O9NA6T/rd5cdp58Zqolq5heC+LaK6k6UZG0Lx/Vam2b/YLUO5o7kGLtO89D8uDaF/C2JWBYyS3g8ZPAOVWbhggVIWqK2d8VKo+fh4EszMGxR5RYN4iRbffnD/zOtSgvHTqAsETAjDEU68tL5Vt0pNn6C+6wNRtukXIKVcZr9obFBjzB9xFERWeA7Vc2XSgCI1Cg+usxUwsx4ToELMhaTJ9/4pwcdirHEv1jdlBh2+nLsjWp/5/ElBnEfOvfoo06wYzN25gN9MKdeG5ZLEeOvCoShmXio/+gCnBP7TK6+VEZ2wF60JghP79Rc9oQU53FdQcmgRmS9UC0UbDoUZdPwiw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=tRuHviogmtw16YZrYtE5Q/jY13sHL8LCu6SzoeB4LsM=; b=V7yo040aQuDCK9LtHCNNNkByQFM74ztoisVUX0+kU9JtdXkEhrExuFb3squJusVNTGO6P5K4RFOnNMKq6W/dH2Q9mV6W/wAYJNWH2wsSHo0Vv8DMRcxrZ0VpXhjrK6N0uKTAkEqjwiAOH5M1WuPhYZ6lXSZqkizLYC/jIgthcBtltKA1T9I4+8MmFry205Vk3qVLsSY6oufhlcHB8Gnu7jE2hz7RHYpVojCQIR7MQeZkqr0TJNTg+QBEytTLxWYK/NutkGpBR4Rcj2DeMnX2OK8062VeRuEaS+FxNam9r6YtwX3jbpMpzi+WsPpgh5fkvOrMaKKndEkFeC0aKudj2Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=kernel.org smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=tRuHviogmtw16YZrYtE5Q/jY13sHL8LCu6SzoeB4LsM=; b=dcu0cf9DmC62+kQDljIS5UE5Im5JLn1s4whWHacPj9VF7Afgf+6ghskgVfCKL6SJWRP0knJXBIAcyaHBCWUPwMQZPuxQWEcQU2PaWwxaxfojrv/LaTBnIAOFZInwOCuNj2JQm07Gb3oz/Rfibftbnw8fmt8eQqy/tcbyOTFAF+w= Received: from CH2PR14CA0035.namprd14.prod.outlook.com (2603:10b6:610:56::15) by SJ2PR12MB7944.namprd12.prod.outlook.com (2603:10b6:a03:4c5::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.12; Thu, 30 Jul 2026 01:50:02 +0000 Received: from CH2PEPF00000141.namprd02.prod.outlook.com (2603:10b6:610:56:cafe::35) by CH2PR14CA0035.outlook.office365.com (2603:10b6:610:56::15) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.13 via Frontend Transport; Thu, 30 Jul 2026 01:50:02 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=amd.com; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=satlexmb07.amd.com; pr=C Received: from satlexmb07.amd.com (165.204.84.17) by CH2PEPF00000141.mail.protection.outlook.com (10.167.244.74) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.5 via Frontend Transport; Thu, 30 Jul 2026 01:50:02 +0000 Received: from purico-9dcchost.amd.com (10.180.168.240) by satlexmb07.amd.com (10.181.42.216) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.41; Wed, 29 Jul 2026 20:50:01 -0500 From: Melody Wang To: CC: LKML , Tom Lendacky , Melody Wang Subject: [PATCH 4/7] x86/sev: Route unsupported APIC register accesses to the hypervisor APIC emulation Date: Thu, 30 Jul 2026 01:48:44 +0000 Message-ID: <081659b1aaa293d9bfda3554790526a9a4040a90.1785375271.git.huibo.wang@amd.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain X-ClientProxiedBy: satlexmb08.amd.com (10.181.42.217) To satlexmb07.amd.com (10.181.42.216) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CH2PEPF00000141:EE_|SJ2PR12MB7944:EE_ X-MS-Office365-Filtering-Correlation-Id: 52ee6771-9b92-40ab-a3dc-08deeddcdf0f X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|82310400026|376014|36860700016|1800799024|23010399003|6133799003|18002099003|22082099003|3023799007|56012099006|11063799006|10067099003; X-Microsoft-Antispam-Message-Info: Kj0kEC6myU7F94NXQAN6rKoJ3nYxVBbwIVN5g4UE2kFpZsEUnAU5zt0w/5hg+6Cfws4KriU9JEaQFKwF/wuSPy6eGWXCr5paaDRXFZff1jEOQIXWDqkaadBCPUdU7uEFDVvkTQwxesckMrKd6XbKY9m8W0b1itVVBnzxz9DL0iMkDKIaPqz6VXHwXLqDXcHUOkWNheML9ee9hsw9a62PIJlr6RJn0D7noXMWNCXOstw2xGwcHjXEeylpzoIbz1E+kMBeEkNggM/JP9oUr0d6kU6bt7CA89T1QF4NvJfgjXuSZ4Bk5F8VbyeT+jevWujCNtFBNkvsyAv/nsoGUyaPLpJshbXrH38IIjxnCmbBy3SAHZaEJOXJegAOGPCCj9SjOcgnXDoUo3TOxgyvdQJ1YK5qhvkLdXAJeSeFn0fUvMUnmuSLHwnjNKS193lioTNcOP407CWiwsqjjXFM/VQAHAnihS+Dh1O7J45WXII1fc2VdJ1PmYFjeNJ1A7sReLl4XGvhbqJsO1zc7Xn1rt02lhz0k0UK23xrZGVqQ7HLHs2FSL6qYMyH6BNGLWb6kjzNfUn6n4rfX8im5w3RlDkKaVxX3ncQtCR2ikA8I4SM8KAum8mrmuWXJhAcw6pEaC4jw6TKKtvBTwemvsU8l7OJBNUzHlolTfwfuaqoWqau0jOAUa2KZ9yKlNSmX+FQrfQHjQuz9rNryDP8c8xo6E/GqA== X-Forefront-Antispam-Report: CIP:165.204.84.17;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:satlexmb07.amd.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230040)(82310400026)(376014)(36860700016)(1800799024)(23010399003)(6133799003)(18002099003)(22082099003)(3023799007)(56012099006)(11063799006)(10067099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: ZY5jV3k77KxVw7KWKWkxT7KBKgqgI5jbnXANg7KF5FObWBQGnho1jPpuxzIOFbcPZzRGDTsThljzAK79If5DQxUQgs1Wtam10NW4DEC2wOVnM8os194Op63bDQVGEMQTgMpN8EtEcNHW5ejRmdrnuXvRaoMiPzDGDFkKKETk7u+2iR1rJpv6It3J2KW2h2X4nbtTqZnyq+ql9sHkjZR4YqGH739O4CT+eaV0aB7Vw1TVQL6YItRFUufcTXwsEz8iuIlJ2YsVk3fYZ85Bx5rjupAL5ZSQjcGXj8Ild40e1Pr6J/R9VChLbdYW/+9BgQUfZ4I3GwlDj0xH5LW9lTZS45nhPzYmh7bpMHBz3aWYHz99f7xHbZDfXSvYGa792DgSIy9ydLFbx72t7AGZ5uCMMJA7i/PEkPHdkPRMqv4TTzOiGLnlVEg+yFL1ABHDcY/U X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 Jul 2026 01:50:02.3825 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 52ee6771-9b92-40ab-a3dc-08deeddcdf0f X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d;Ip=[165.204.84.17];Helo=[satlexmb07.amd.com] X-MS-Exchange-CrossTenant-AuthSource: CH2PEPF00000141.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ2PR12MB7944 The SVSM APIC emulation supports only a subset of the X2APIC MSRs. Therefore, route the unsupported ones to the hypervisor's X2APIC emulation. Signed-off-by: Melody Wang --- arch/x86/coco/sev/core.c | 12 ++++++------ arch/x86/include/asm/sev-common.h | 1 + arch/x86/include/asm/sev.h | 8 ++++---- arch/x86/kernel/apic/svsm_apic.c | 11 +++++++---- arch/x86/kernel/apic/x2apic_savic.c | 8 ++++---- 5 files changed, 22 insertions(+), 18 deletions(-) diff --git a/arch/x86/coco/sev/core.c b/arch/x86/coco/sev/core.c index 197119807230..b293a36c3594 100644 --- a/arch/x86/coco/sev/core.c +++ b/arch/x86/coco/sev/core.c @@ -972,7 +972,7 @@ int __init sev_es_efi_map_ghcbs_cas(pgd_t *pgd) return 0; } -u64 savic_ghcb_msr_read(u32 reg) +u64 hvs_ghcb_msr_read(u32 reg) { u64 msr = APIC_BASE_MSR + (reg >> 4); struct pt_regs regs = { .cx = msr }; @@ -988,9 +988,9 @@ u64 savic_ghcb_msr_read(u32 reg) res = __vc_handle_msr(ghcb, &ctxt, false); if (res != ES_OK) { - pr_err("Secure AVIC MSR (0x%llx) read returned error (%d)\n", msr, res); + pr_err("Hypervisor MSR (0x%llx) read returned error (%d)\n", msr, res); /* MSR read failures are treated as fatal errors */ - sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_SAVIC_FAIL); + sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_APIC_MSR_FAIL); } __sev_put_ghcb(&state); @@ -998,7 +998,7 @@ u64 savic_ghcb_msr_read(u32 reg) return regs.ax | regs.dx << 32; } -void savic_ghcb_msr_write(u32 reg, u64 value) +void hvs_ghcb_msr_write(u32 reg, u64 value) { u64 msr = APIC_BASE_MSR + (reg >> 4); struct pt_regs regs = { @@ -1018,9 +1018,9 @@ void savic_ghcb_msr_write(u32 reg, u64 value) res = __vc_handle_msr(ghcb, &ctxt, true); if (res != ES_OK) { - pr_err("Secure AVIC MSR (0x%llx) write returned error (%d)\n", msr, res); + pr_err("Hypervisor MSR (0x%llx) write returned error (%d)\n", msr, res); /* MSR writes should never fail. Any failure is fatal error for SNP guest */ - sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_SAVIC_FAIL); + sev_es_terminate(SEV_TERM_SET_LINUX, GHCB_TERM_APIC_MSR_FAIL); } __sev_put_ghcb(&state); diff --git a/arch/x86/include/asm/sev-common.h b/arch/x86/include/asm/sev-common.h index 01a6e4dbe423..a41c52a16e31 100644 --- a/arch/x86/include/asm/sev-common.h +++ b/arch/x86/include/asm/sev-common.h @@ -209,6 +209,7 @@ struct snp_psc_desc { #define GHCB_TERM_SECURE_TSC 10 /* Secure TSC initialization failed */ #define GHCB_TERM_SVSM_CA_REMAP_FAIL 11 /* SVSM is present but CA could not be remapped */ #define GHCB_TERM_SAVIC_FAIL 12 /* Secure AVIC-specific failure */ +#define GHCB_TERM_APIC_MSR_FAIL 13 /* APIC MSR failure */ #define GHCB_RESP_CODE(v) ((v) & GHCB_MSR_INFO_MASK) diff --git a/arch/x86/include/asm/sev.h b/arch/x86/include/asm/sev.h index f8a5b5cf939a..491a891a7694 100644 --- a/arch/x86/include/asm/sev.h +++ b/arch/x86/include/asm/sev.h @@ -549,8 +549,8 @@ void __init snp_secure_tsc_prepare(void); void __init snp_secure_tsc_init(void); enum es_result savic_register_gpa(u64 gpa); enum es_result savic_unregister_gpa(u64 *gpa); -u64 savic_ghcb_msr_read(u32 reg); -void savic_ghcb_msr_write(u32 reg, u64 value); +u64 hvs_ghcb_msr_read(u32 reg); +void hvs_ghcb_msr_write(u32 reg, u64 value); static __always_inline void vc_ghcb_invalidate(struct ghcb *ghcb) { @@ -659,8 +659,8 @@ static inline void __init snp_secure_tsc_init(void) { } static inline void sev_evict_cache(void *va, int npages) {} static inline enum es_result savic_register_gpa(u64 gpa) { return ES_UNSUPPORTED; } static inline enum es_result savic_unregister_gpa(u64 *gpa) { return ES_UNSUPPORTED; } -static inline void savic_ghcb_msr_write(u32 reg, u64 value) { } -static inline u64 savic_ghcb_msr_read(u32 reg) { return 0; } +static inline void hvs_ghcb_msr_write(u32 reg, u64 value) { } +static inline u64 hvs_ghcb_msr_read(u32 reg) { return 0; } #endif /* CONFIG_AMD_MEM_ENCRYPT */ diff --git a/arch/x86/kernel/apic/svsm_apic.c b/arch/x86/kernel/apic/svsm_apic.c index 7040a1ca8b55..a4e7ba7e9985 100644 --- a/arch/x86/kernel/apic/svsm_apic.c +++ b/arch/x86/kernel/apic/svsm_apic.c @@ -68,7 +68,8 @@ static void svsm_apic_msr_write(u32 reg, u32 v) } break; default: - pr_err("SVSM_APIC_WRITE_REGISTER 0x%x not supported\n", reg); + pr_debug("SVSM_APIC_WRITE_REGISTER to HV (0x%x, val:0x%x)\n", reg, v); + hvs_ghcb_msr_write(reg, v); break; } } @@ -77,6 +78,7 @@ static u32 svsm_apic_msr_read(u32 reg) { u32 msr = APIC_BASE_MSR + (reg >> 4); struct svsm_call call = {}; + u64 val; int ret; switch (reg) { @@ -93,17 +95,18 @@ static u32 svsm_apic_msr_read(u32 reg) call.rcx = msr; ret = svsm_do_call(&call); + val = call.rdx_out; if (ret) { pr_err("SVSM_APIC_READ_REGISTER: 0x%x, error: %d\n", reg, ret); sev_es_terminate(SEV_TERM_SET_GEN, GHCB_SNP_UNSUPPORTED); } break; default: - pr_err("SVSM_APIC_READ_REGISTER: 0x%x not supported\n", reg); - return 0; + val = hvs_ghcb_msr_read(reg); + pr_debug("SVSM_APIC_READ_REGISTER from HV 0x%x, val: 0x%llx\n", reg, val); } - return call.rdx_out; + return val; } static inline void svsm_apic_msr_eoi(void) diff --git a/arch/x86/kernel/apic/x2apic_savic.c b/arch/x86/kernel/apic/x2apic_savic.c index 4bc6d7e018a5..71040f77dfaf 100644 --- a/arch/x86/kernel/apic/x2apic_savic.c +++ b/arch/x86/kernel/apic/x2apic_savic.c @@ -72,7 +72,7 @@ static u32 savic_read(u32 reg) case APIC_LVT0: case APIC_LVT1: case APIC_LVTERR: - return savic_ghcb_msr_read(reg); + return hvs_ghcb_msr_read(reg); case APIC_ID: case APIC_LVR: case APIC_TASKPRI: @@ -193,7 +193,7 @@ static void savic_icr_write(u32 icr_low, u32 icr_high) icr_data = ((u64)icr_high) << 32 | icr_low; if (dsh != APIC_DEST_SELF) - savic_ghcb_msr_write(APIC_ICR, icr_data); + hvs_ghcb_msr_write(APIC_ICR, icr_data); apic_set_reg64(this_cpu_ptr(savic_page), APIC_ICR, icr_data); } @@ -210,7 +210,7 @@ static void savic_write(u32 reg, u32 data) case APIC_LVTTHMR: case APIC_LVTPC: case APIC_LVTERR: - savic_ghcb_msr_write(reg, data); + hvs_ghcb_msr_write(reg, data); break; case APIC_TASKPRI: case APIC_EOI: @@ -316,7 +316,7 @@ static void savic_eoi(void) * interrupts. Return to the guest from GHCB protocol event takes * care of re-evaluating interrupt state. */ - savic_ghcb_msr_write(APIC_EOI, 0); + hvs_ghcb_msr_write(APIC_EOI, 0); } else { /* * Hardware clears APIC_ISR and re-evaluates the interrupt state -- 2.43.0