Misc cleanups, a pile of fixes related to SNP's AP Creation hypercall, and support for Idle HLT interception. Note, Manali wrote a selftest for Idle HLT, but unfortunately it can't be merged at this time as the test has no way to know if _KVM_ support Idle HLT; the CPUID feature bit enumerates KVM emulation of Idle HLT for nested VMs, and there was no strong reason to expose a module param, let alone a capability. The following changes since commit a64dcfb451e254085a7daee5fe51bf22959d52d3: Linux 6.14-rc2 (2025-02-09 12:45:03 -0800) are available in the Git repository at: https://github.com/kvm-x86/linux.git tags/kvm-x86-svm-6.15 for you to fetch changes up to 4e96f010afb2815e33c9b15a695e0e0b4cb3cea6: KVM: SVM: Invalidate "next" SNP VMSA GPA even on failure (2025-03-03 07:34:56 -0800) ---------------------------------------------------------------- KVM SVM changes for 6.15 - Ensure the PSP driver is initialized when both the PSP and KVM modules are built-in (the initcall framework doesn't handle dependencies). - Use long-term pins when registering encrypted memory regions, so that the pages are migrated out of MIGRATE_CMA/ZONE_MOVABLE and don't lead to excessive fragmentation. - Add macros and helpers for setting GHCB return/error codes. - Add support for Idle HLT interception, which elides interception if the vCPU has a pending, unmasked virtual IRQ when HLT is executed. - Fix a bug in INVPCID emulation where KVM fails to check for a non-canonical address. - Don't attempt VMRUN for SEV-ES+ guests if the vCPU's VMSA is invalid, e.g. because the vCPU was "destroyed" via SNP's AP Creation hypercall. - Reject SNP AP Creation if the requested SEV features for the vCPU don't match the VM's configured set of features. - Misc cleanups ---------------------------------------------------------------- Ge Yang (1): KVM: SEV: Use long-term pin when registering encrypted memory regions Manali Shukla (2): x86/cpufeatures: Add CPUID feature bit for Idle HLT intercept KVM: SVM: Add Idle HLT intercept support Melody Wang (2): KVM: SVM: Convert plain error code numbers to defines KVM: SVM: Provide helpers to set the error code Nikunj A Dadhania (1): KVM: SEV: Use to_kvm_sev_info() for fetching kvm_sev_info struct Sean Christopherson (11): crypto: ccp: Add external API interface for PSP module initialization KVM: SVM: Ensure PSP module is initialized if KVM module is built-in KVM: SVM: Inject #GP if memory operand for INVPCID is non-canonical KVM: SVM: Refuse to attempt VRMUN if an SEV-ES+ guest has an invalid VMSA KVM: SVM: Don't change target vCPU state on AP Creation VMGEXIT error KVM: SVM: Require AP's "requested" SEV_FEATURES to match KVM's view KVM: SVM: Simplify request+kick logic in SNP AP Creation handling KVM: SVM: Use guard(mutex) to simplify SNP AP Creation error handling KVM: SVM: Mark VMCB dirty before processing incoming snp_vmsa_gpa KVM: SVM: Use guard(mutex) to simplify SNP vCPU state updates KVM: SVM: Invalidate "next" SNP VMSA GPA even on failure arch/x86/include/asm/cpufeatures.h | 1 + arch/x86/include/asm/sev-common.h | 12 +- arch/x86/include/asm/svm.h | 5 +- arch/x86/include/uapi/asm/svm.h | 2 + arch/x86/kvm/svm/sev.c | 380 +++++++++++++++++-------------------- arch/x86/kvm/svm/svm.c | 39 +++- arch/x86/kvm/svm/svm.h | 39 +++- drivers/crypto/ccp/sp-dev.c | 14 ++ include/linux/psp-sev.h | 9 + 9 files changed, 269 insertions(+), 232 deletions(-)
