Re: [PATCH v2 6/8] x86/sev: Register the guest with the SVSM APIC protocol

["Ard Biesheuvel" <ardb@kernel.org>]

On Tue, 15 Sep 2026, at 04:04, Melody Wang wrote:
> Hi Ard,
>
> On 9/14/26 1:06 PM, Ard Biesheuvel wrote:
>> On Mon, 14 Sep 2026, at 02:57, Melody Wang wrote:
>>> The SVSM APIC protocol supports 5 calls. SVSM_APIC_CONFIGURE_EMULATION
>>> (shortened to SVSM_APIC_CONFIG_EMULATION for brevity), call 1, provides
>>> the controls whether the guest can make use of the SVSM APIC protocol.
>>>
>>> Implement this call, and register Alternate Injection for the guest
>>> by default.
>>>
>>> Signed-off-by: Melody Wang <huibo.wang@amd.com>
>>> ---
>>>   arch/x86/boot/compressed/sev.c | 17 +++++++++++++++++
>>>   arch/x86/boot/compressed/sev.h |  6 ++++++
>>>   2 files changed, 23 insertions(+)
>>>
>> 
>> Does this need to happen in the EFI stub and/or decompressor? We have swathes
>> of early SEV-SNP boot code in the kernel proper; could it be done there?
>
> Let me answer the question directly first:
>
> Alternate Injection is used by both the guest firmware and the guest 
> kernel. Before we run the guest kernel, guest firmware - OVMF - is using 
> Alternate Injection for interrupts, etc.
>
> So ExitBootServices() is a handoff boundary. When it is called, the 
> firmware's use of Alternate Injection ends. It must deregister its use 
> of Alternate Injection at this point since it can not assume anything 
> about the guest kernel that follows.
>
> At this moment, if the guest kernel has not registered the use of 
> Alternate Injection, latter is disabled and can not be re-enabled.
>
> So if the guest kernel wants Alternate Injection, it has to happen 
> before ExitBootServices().
>

OK, so this means that this code will only be called from the EFI stub
running under EFI boot services, and never from the decompressor when
doing traditional boot.

So please add it to the EFI stub, and code it against the boot services
(efi_err() for error messages, efi_exit() when aborting and returning to
the firmware, etc). Implementing this in a hybrid manner seems entirely
unnecessary.