[RFC PATCH v3 25/27] KVM: SVM: Do not inject exceptions for Secure AVIC

From: Naveen N Rao (AMD)

Date: Wed Jul 08 2026 - 02:43:15 EST


From: Kishon Vijay Abraham I <kvijayab@xxxxxxx>

In Secure AVIC mode, EVENTINJ in the VMCB is ignored which means
there is no way to inject exceptions from KVM. Return early from
svm_inject_exception() for a Secure AVIC enabled guest.

Note that exceptions generated within the guest themselves are still
handled properly if intercepted (e.g., INTR just before a guest
exception), since those are saved in the VMSA EVENTINJ field and
processed by the hardware.

Signed-off-by: Kishon Vijay Abraham I <kvijayab@xxxxxxx>
Co-developed-by: Neeraj Upadhyay <Neeraj.Upadhyay@xxxxxxx>
Signed-off-by: Neeraj Upadhyay <Neeraj.Upadhyay@xxxxxxx>
Co-developed-by: Naveen N Rao (AMD) <naveen@xxxxxxxxxx>
Signed-off-by: Naveen N Rao (AMD) <naveen@xxxxxxxxxx>
---
arch/x86/kvm/svm/svm.c | 4 ++++
1 file changed, 4 insertions(+)

diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index 2cb38953c0cf..2e32670ff957 100644
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -391,6 +391,10 @@ static void svm_inject_exception(struct kvm_vcpu *vcpu)
struct kvm_queued_exception *ex = &vcpu->arch.exception;
struct vcpu_svm *svm = to_svm(vcpu);

+ /* Secure AVIC does not support EVENTINJ */
+ if (snp_is_secure_avic_enabled(vcpu->kvm))
+ return;
+
kvm_deliver_exception_payload(vcpu, ex);

if (kvm_exception_is_soft(ex->vector) &&
--
2.54.0