From: "Ard Biesheuvel" <ardb@kernel.org>
To: "Borislav Petkov" <bp@alien8.de>
Cc: "Melody Wang" <huibo.wang@amd.com>,
x86@kernel.org, LKML <linux-kernel@vger.kernel.org>,
"Tom Lendacky" <thomas.lendacky@amd.com>
Subject: Re: [PATCH v3 0/8] Alternate Injection: Secure Interrupt Delivery for SEV-SNP Guests - Guest Support
Date: Fri, 25 Sep 2026 08:44:00 +0300 [thread overview]
Message-ID: <e4cb78e0-06fb-4498-a933-e790999a602c@app.fastmail.com> (raw)
In-Reply-To: <20260925044713.GEarX80eZzKR-DKfzJ@fat_crate.local>
On Fri, 25 Sep 2026, at 07:47, Borislav Petkov wrote:
> On Thu, Sep 24, 2026 at 09:06:00PM +0200, Ard Biesheuvel wrote:
>> What I would like to see is an abstraction implemented in OVMF that encapsulates
>> the logic that you are adding here. All the EFI stub would have to do is call
>> the protocol, nothing more.
>
> Out of pure curiosity, why?
>
> Is the answer something along the lines of, before ExitBootServices(), the
> firmware owns the machine, the kernel should not poke at anything but should
> call the fw and latter is supposed to do the init and synchronization and
> setup of resources, yadda yadda...
>
Essentially. It is a layering violation.
Before ExitBootServices(), the firmware runs with the timer interrupt enabled.
So poking at MSRs to reconfigure this behind the back of the firmware while
it thinks it is still in full control is not a great idea.
Instead, the EFI stub should inform the firmware that it wants alternate
injection, and the firmware can take care of that at EBS() time.
next prev parent reply other threads:[~2026-09-25 5:44 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-20 18:12 Melody Wang
2026-09-20 18:12 ` [PATCH v3 1/8] x86/sev: Make SVSM calls preemption-safe Melody Wang
2026-09-20 18:16 ` Melody Wang
2026-09-20 18:12 ` [PATCH v3 2/8] x86/sev: Add support for Alternate Injection Melody Wang
2026-09-20 18:16 ` Melody Wang
2026-09-20 18:16 ` [PATCH v3 0/8] Alternate Injection: Secure Interrupt Delivery for SEV-SNP Guests - Guest Support Melody Wang
2026-09-20 18:16 ` [PATCH v3 3/8] x86/apic: Add an SVSM APIC driver Melody Wang
2026-09-22 1:31 ` Melody Wang
2026-09-23 20:31 ` Borislav Petkov
2026-09-20 18:16 ` [PATCH v3 4/8] x86/sev: Route unsupported APIC register accesses to the hypervisor APIC emulation Melody Wang
2026-09-20 18:16 ` [PATCH v3 5/8] x86/sev: Add a function to contain all SEV-specific setup operations Melody Wang
2026-09-20 18:16 ` [PATCH v3 6/8] x86/sev: Register the guest with the SVSM APIC protocol Melody Wang
2026-09-23 20:46 ` Melody Wang
2026-09-20 18:16 ` [PATCH v3 7/8] x86/sev: Allow the guest to configure interrupt vectors for the hypervisor Melody Wang
2026-09-23 20:46 ` Melody Wang
2026-09-20 18:17 ` [PATCH v3 8/8] x86/sev: Indicate that Alternate Injection is supported in the guest Melody Wang
2026-09-23 20:56 ` [PATCH v3 0/8] Alternate Injection: Secure Interrupt Delivery for SEV-SNP Guests - Guest Support Ard Biesheuvel
2026-09-24 18:34 ` Melody Wang
2026-09-24 19:06 ` Ard Biesheuvel
2026-09-25 4:47 ` Borislav Petkov
2026-09-25 5:44 ` Ard Biesheuvel [this message]
2026-09-25 5:47 ` Borislav Petkov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=e4cb78e0-06fb-4498-a933-e790999a602c@app.fastmail.com \
--to=ardb@kernel.org \
--cc=bp@alien8.de \
--cc=huibo.wang@amd.com \
--cc=linux-kernel@vger.kernel.org \
--cc=thomas.lendacky@amd.com \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®