Re: [PATCH v3 0/8] Alternate Injection: Secure Interrupt Delivery for SEV-SNP Guests - Guest Support

[Melody Wang]

Hi Ard,

On 9/23/26 1:56 PM, Ard Biesheuvel wrote:
> This may be a bit of a 'back to the drawing board' remark, but if opting
> in to this alternate injection scheme can only be done from the EFI firmware
> before ExitBootServices(), couldn't we wrap all this logic into an OVMF
> protocol instead? That way, the EFI stub can just invoke it if it exists,
> and what happens under the hood as a result is entirely under the control of
> the firmware.

Let me try to explain and please ask if anything's not clear because 
this is a complex topic:

When a SEV-SNP guest starts, a Secure VM Service Module running at VMPL0 
(higher privilege level than the guest's) is executed first. That's a 
paravisor, see here for a possible explanation: 
https://ksayid.github.io/confidential-computing-notes/docs/core/paravisor/.

That paravisor will boot OVMF, and then OVMF will boot the guest kernel.

The SVSM must know the Alternate Injection choice of the first component 
which is the OVMF, so it will be able to enable Alternate Injection in 
the guest VMSA and record OVMF's registration.

The guest kernel should be able to make its own independent decision 
about whether to use Alternate Injection or not. If the kernel wants it, 
the kernel must register itself — this registration is performed in 
guest kernel code so that it remains under the guest kernel's control.

The guest kernel needs to register Alternate Injection before 
ExitBootServices() so the SVSM registration counter always reflects the 
correct, current state of Alternate Injection across the OVMF-to-kernel 
hand-off.

But if we leave the OVMF to decide for the guest kernel, that is 
violating the confidential computing principles of the guest being in 
control.

I hope this makes more sense.

Thanks,
Melody.