Re: [RFC PATCH v2 09/17] KVM: SVM: Do not intercept exceptions for Secure AVIC guests

[Tom Lendacky <thomas.lendacky@amd.com>]

On 9/23/25 00:03, Neeraj Upadhyay wrote:
> Exceptions cannot be explicitly injected from the hypervisor to
> Secure AVIC enabled guests. So, KVM cannot inject exceptions into
> a Secure AVIC guest. If KVM were to intercept an exception (e.g., #PF
> or #GP), it would be unable to deliver it back to the guest, effectively
> dropping the event and leading to guest misbehavior or hangs. So,
> clear exception intercepts so that all exceptions are handled directly by
> the guest without KVM intervention.
> 
> Signed-off-by: Neeraj Upadhyay <Neeraj.Upadhyay@amd.com>
> ---
>  arch/x86/kvm/svm/sev.c | 11 ++++++++++-
>  1 file changed, 10 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
> index a64fcc7637c7..837ab55a3330 100644
> --- a/arch/x86/kvm/svm/sev.c
> +++ b/arch/x86/kvm/svm/sev.c
> @@ -4761,8 +4761,17 @@ static void sev_es_init_vmcb(struct vcpu_svm *svm)
>  	/* Can't intercept XSETBV, HV can't modify XCR0 directly */
>  	svm_clr_intercept(svm, INTERCEPT_XSETBV);
>  
> -	if (sev_savic_active(vcpu->kvm))
> +	if (sev_savic_active(vcpu->kvm)) {
>  		svm_set_intercept_for_msr(vcpu, MSR_AMD64_SAVIC_CONTROL, MSR_TYPE_RW, false);
> +
> +		/* Clear all exception intercepts. */
> +		clr_exception_intercept(svm, PF_VECTOR);
> +		clr_exception_intercept(svm, UD_VECTOR);
> +		clr_exception_intercept(svm, MC_VECTOR);
> +		clr_exception_intercept(svm, AC_VECTOR);
> +		clr_exception_intercept(svm, DB_VECTOR);
> +		clr_exception_intercept(svm, GP_VECTOR);

Some of these are cleared no matter what prior to here. For example,
PF_VECTOR is cleared if npt_enabled is true (which is required for SEV),
UD_VECTOR and GP_VECTOR are cleared in sev_init_vmcb().

For the MC_VECTOR interception, the SVM code just ignores it today by
returning 1 immediately, so clearing the interception looks like a NOP,
but I might be missing something.

Thanks,
Tom

> +	}
>  }
>  
>  void sev_init_vmcb(struct vcpu_svm *svm)