806 	struct sev_es_save_area *save = svm->sev_es.vmsa;  in sev_es_sync_vmsa()
812 	/* Check some debug related fields before encrypting the VMSA */  in sev_es_sync_vmsa()
817 	 * SEV-ES will use a VMSA that is pointed to by the VMCB, not  in sev_es_sync_vmsa()
818 	 * the traditional VMSA that is part of the VMCB. Copy the  in sev_es_sync_vmsa()
819 	 * traditional VMSA as it has been built so far (in prep  in sev_es_sync_vmsa()
891 	pr_debug("Virtual Machine Save Area (VMSA):\n");  in sev_es_sync_vmsa()
900 	struct sev_data_launch_update_vmsa vmsa;  in __sev_launch_update_vmsa()  local
909 	/* Perform some pre-encryption checks against the VMSA */  in __sev_launch_update_vmsa()
916 	 * the VMSA memory content (i.e it will write the same memory region  in __sev_launch_update_vmsa()
919 	clflush_cache_range(svm->sev_es.vmsa, PAGE_SIZE);  in __sev_launch_update_vmsa()
921 	vmsa.reserved = 0;  in __sev_launch_update_vmsa()
922 	vmsa.handle = to_kvm_sev_info(kvm)->handle;  in __sev_launch_update_vmsa()
923 	vmsa.address = __sme_pa(svm->sev_es.vmsa);  in __sev_launch_update_vmsa()
924 	vmsa.len = PAGE_SIZE;  in __sev_launch_update_vmsa()
925 	ret = sev_issue_cmd(kvm, SEV_CMD_LAUNCH_UPDATE_VMSA, &vmsa, error);  in __sev_launch_update_vmsa()
2035 		 * Transfer VMSA and GHCB state to the destination.  Nullify and  in sev_migrate_from()
2448 		u64 pfn = __pa(svm->sev_es.vmsa) >> PAGE_SHIFT;  in snp_launch_update_vmsa()
2454 		/* Transition the VMSA page to a firmware state. */  in snp_launch_update_vmsa()
2459 		/* Issue the SNP command to encrypt the VMSA */  in snp_launch_update_vmsa()
2460 		data.address = __sme_pa(svm->sev_es.vmsa);  in snp_launch_update_vmsa()
3175 	 * If it's an SNP guest, then the VMSA was marked in the RMP table as  in sev_free_vcpu()
3180 		u64 pfn = __pa(svm->sev_es.vmsa) >> PAGE_SHIFT;  in sev_free_vcpu()
3187 		sev_flush_encrypted_page(vcpu, svm->sev_es.vmsa);  in sev_free_vcpu()
3189 	__free_page(virt_to_page(svm->sev_es.vmsa));  in sev_free_vcpu()
3860 	/* Clear use of the VMSA */  in __sev_snp_update_protected_guest_state()
3874 		 * The new VMSA will be private memory guest memory, so  in __sev_snp_update_protected_guest_state()
3881 		 * From this point forward, the VMSA will always be a  in __sev_snp_update_protected_guest_state()
3883 		 * by KVM in svm->sev_es.vmsa. In theory, svm->sev_es.vmsa  in __sev_snp_update_protected_guest_state()
3892 		/* Use the new VMSA */  in __sev_snp_update_protected_guest_state()
3904 		 * svm->sev_es.vmsa is pinned through some other means.  in __sev_snp_update_protected_guest_state()
3910 	 * When replacing the VMSA during SEV-SNP AP creation,  in __sev_snp_update_protected_guest_state()
3999 			vcpu_unimpl(vcpu, "vmgexit: invalid AP VMSA address [%#llx] from guest\n",  in sev_snp_ap_creation()
4006 		 * Malicious guest can RMPADJUST a large page into VMSA which  in sev_snp_ap_creation()
4009 		 * of VMSA page, reject the AP CREATE request if VMSA address from  in sev_snp_ap_creation()
4014 				    "vmgexit: AP VMSA address [%llx] from guest is unsafe as it is 2M aligned\n",  in sev_snp_ap_creation()
4508 	 * An SEV-ES guest requires a VMSA area that is a separate from the  in sev_es_init_vmcb()
4509 	 * VMCB page. Do not include the encryption mask on the VMSA physical  in sev_es_init_vmcb()
4511 	 * the VMSA will be NULL if this vCPU is the destination for intrahost  in sev_es_init_vmcb()
4514 	if (svm->sev_es.vmsa && !svm->sev_es.snp_has_guest_vmsa)  in sev_es_init_vmcb()
4515 		svm->vmcb->control.vmsa_pa = __pa(svm->sev_es.vmsa);  in sev_es_init_vmcb()
4621 	 * the guest has actually enabled (or not!) in the VMSA.  in sev_es_prepare_switch_to_guest()
4689 	 * 2MB-aligned VMCB, VMSA, or AVIC backing page.  in snp_safe_alloc_page_node()