[RFC PATCH 8/9] KVM: SVM: Clear AVIC Enable when Alternate Injection is enabled

[Melody Wang]

VMRUN fails with VMEXIT_INVALID if the AVIC Enable bit is set while the
guest uses Alternate Injection. Historically, the AVIC Enable bit wasn’t
set during AVIC VMCB initialization under SEV because AVIC is inhibited.

Commit 3989a6d036c8 ("KVM: SVM: Initialize AVIC VMCB fields if AVIC is
enabled with in-kernel APIC") changed this by populating AVIC VMCB
fields even when AVIC is inhibited under SEV. As a result, the AVIC
Enable bit may remain set and trigger VMEXIT_INVALID with Alternate
Injection.

Rather than altering the AVIC VMCB initialization, explicitly clear the
AVIC Enable bit only when Alternate Injection is enabled.

Signed-off-by: Melody Wang <huibo.wang@xxxxxxx>
---
 arch/x86/kvm/svm/sev.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
index 019412173062..7846d4ebb278 100644
--- a/arch/x86/kvm/svm/sev.c
+++ b/arch/x86/kvm/svm/sev.c
@@ -5089,9 +5089,15 @@ static void sev_snp_init_vmcb(struct vcpu_svm *svm)
 {
 	struct kvm_sev_info_plane *sev_plane = &to_kvm_svm_plane(svm->vcpu.plane)->sev_info_plane;
 
-	/* V_NMI is not supported when Restricted Injection is enabled */
-	if (sev_plane->vmsa_features & SVM_SEV_FEAT_RESTRICTED_INJECTION)
+	/*
+	 * V_NMI and AVIC are not supported when Restricted Injection or Alternate
+	 * Injection is enabled.
+	 */
+	if (sev_plane->vmsa_features & (SVM_SEV_FEAT_RESTRICTED_INJECTION |
+					SVM_SEV_FEAT_ALTERNATE_INJECTION)) {
 		svm->vmcb->control.int_ctl &= ~V_NMI_ENABLE_MASK;
+		svm->vmcb->control.int_ctl &= ~AVIC_ENABLE_MASK;
+	}
 }
 
 static void sev_es_init_vmcb(struct vcpu_svm *svm, bool init_event)
-- 
2.43.0