[RFC PATCH 0/9] Alternate Injection: Secure Interrupt Delivery for SEV-SNP Guests

[Melody Wang]

This patchset introduces host-side KVM support for AMD SEV-SNP Alternate
Injection, providing secure interrupt delivery for confidential guests against
malicious or untrusted hypervisor injection attacks.

Background & Motivation
-----------------------
In standard SEV-SNP deployments, retaining hypervisor-controlled interrupt
injection leaves confidential VMs vulnerable to unexpected or malformed
interrupt sequences. Alternate Injection mitigates this by shifting interrupt
injection control into the guest security realm. It builds on top of
Restricted Injection, leveraging the established secure communication channel
to interact with a Secure VM Service Module (SVSM) that handles APIC
emulation.

Series Status & Dependencies
----------------------------
- This is an RFC patchset intended for early architectural feedback.
- Rebased on commit 6efc8ea4653f8bfd4d59ea5fa9589d028e037909
  (joro/kvm-planes-v7.1).
- Tested against:
  * Latest SVSM build
  * SEV-SNP guest kernel (rebased to latest, with Alternate Injection)
  * EDK2 (rebased to latest, with Alternate Injection support)
  * QEMU commit 8db5273ca97f26043f64d1390f906e434c675db2
    (HEAD -> qemu-planes-linux-v7.1, joerg/qemu-planes-linux-v7.1)

Next Steps & Discussion
-----------------------
An alternative design approach has also been explored and will be presented
at KVM Forum 2026 in the talk:
"COCONUT-SVSM, KVM Planes, and Secure Interrupt Injection - Upstream Alignment" [1].

Welcome review and comments on this RFC series.

Plan to refine and update the patches further following feedback gathered at
KVM Forum.

[1] https://pretalx.com/kvm-forum-2026/talk/ZB3GWA/

Thanks,
Melody

Melody Wang (9):
  x86/sev: Define extended #HV doorbell page structure
  KVM: SVM: Add support for Alternate Injection for the  SEV-SNP #HV
    doorbell page NAE event
  KVM: SVM: Add Alternate Injection support
  KVM: SVM: Add Alternate Injection path
  KVM: SVM: Bypass lapic for VMPL1-3 guest with Alternate Injection
    enabled
  KVM: SVM: Inject #HV into VMPL0 with Alternate Injection enabled
  KVM: SVM: Notify the SVSM an intercept happened during interrupt
    delivery
  KVM: SVM: Clear AVIC Enable when Alternate Injection is enabled
  KVM: SVM: Enable Alternate Injection for an SEV-SNP guest

 arch/x86/include/asm/cpufeatures.h |   1 +
 arch/x86/include/asm/kvm-x86-ops.h |   2 +
 arch/x86/include/asm/kvm_host.h    |   2 +
 arch/x86/include/asm/sev-common.h  |   1 +
 arch/x86/include/asm/svm.h         |  60 ++++-
 arch/x86/include/uapi/asm/svm.h    |   2 +
 arch/x86/kvm/irq.c                 |   4 +
 arch/x86/kvm/lapic.c               |  10 +-
 arch/x86/kvm/lapic.h               |   1 +
 arch/x86/kvm/svm/sev.c             | 371 ++++++++++++++++++++++++++++-
 arch/x86/kvm/svm/svm.c             |  66 ++++-
 arch/x86/kvm/svm/svm.h             |  30 +++
 12 files changed, 531 insertions(+), 19 deletions(-)

-- 
2.43.0