[PATCH] KVM: SVM: Clear dummy V_IRQ in vmcb01 when deactivating AVIC

[PATCH] KVM: SVM: Clear dummy V_IRQ in vmcb01 when deactivating AVIC

[xin guo]

When KVM requests an IRQ window via svm_set_vintr(), it programs a
dummy VINTR with int_vector=0 and V_IRQ=1 into the current VMCB.
These int_ctl fields are documented to be ignored while AVIC is
enabled, so the dummy VINTR is harmless during AVIC operation.

However, avic_deactivate_vmcb() only clears AVIC_ENABLE_MASK and
X2APIC_MODE_MASK, and does not clear the VINTR injection state. Once
AVIC is disabled, hardware honors V_IRQ again and injects vector 0
into the guest on the next VMRUN. Windows guests observe this as a
spurious interrupt and crash, e.g. with STATUS_INTEGER_DIVIDE_BY_ZERO.

Fix this by also clearing V_IRQ_INJECTION_BITS_MASK from vmcb01's
int_ctl in avic_deactivate_vmcb(), so that no stale dummy VINTR is
left behind when AVIC transitions from enabled to disabled.

Signed-off-by: xin guo <m18700951735@163.com>
---
 arch/x86/kvm/svm/avic.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/arch/x86/kvm/svm/avic.c b/arch/x86/kvm/svm/avic.c
index cdd5a6dc646f..b042c3f5f90e 100644
--- a/arch/x86/kvm/svm/avic.c
+++ b/arch/x86/kvm/svm/avic.c
@@ -257,7 +257,9 @@ static void avic_deactivate_vmcb(struct vcpu_svm *svm)
 {
 	struct vmcb *vmcb = svm->vmcb01.ptr;
 
-	vmcb->control.int_ctl &= ~(AVIC_ENABLE_MASK | X2APIC_MODE_MASK);
+	vmcb->control.int_ctl &= ~(AVIC_ENABLE_MASK | X2APIC_MODE_MASK |
+				V_IRQ_INJECTION_BITS_MASK);
+
 	vmcb->control.avic_physical_id &= ~AVIC_PHYSICAL_MAX_INDEX_MASK;
 
 	if (!is_sev_es_guest(&svm->vcpu))
-- 
2.27.0

Re: [PATCH] KVM: SVM: Clear dummy V_IRQ in vmcb01 when deactivating AVIC

[Sean Christopherson]

On Wed, Jun 10, 2026, xin guo wrote:
> When KVM requests an IRQ window via svm_set_vintr(), it programs a
> dummy VINTR with int_vector=0 and V_IRQ=1 into the current VMCB.
> These int_ctl fields are documented to be ignored while AVIC is
> enabled, so the dummy VINTR is harmless during AVIC operation.
> 
> However, avic_deactivate_vmcb() only clears AVIC_ENABLE_MASK and
> X2APIC_MODE_MASK, and does not clear the VINTR injection state. Once
> AVIC is disabled, hardware honors V_IRQ again and injects vector 0
> into the guest on the next VMRUN. Windows guests observe this as a
> spurious interrupt and crash, e.g. with STATUS_INTEGER_DIVIDE_BY_ZERO.

Can you provide a reproducer, or at least instructions to reproduce?  This feels
like we're treating a symptom, not the underlying bug.  And while I can definitely
see KVM leaving a stale V_IRQ_MASK in vmcb01, I don't see how that can happen
while also clearing INTERCEPT_VINTR, as the only place INTERCEPT_VINTR is cleared
in vmcb01 is svm_clear_vintr(), which also purges V_IRQ_MASK.

	svm_clr_intercept(svm, INTERCEPT_VINTR);

	/* Drop int_ctl fields related to VINTR injection.  */
	svm->vmcb->control.int_ctl &= ~V_IRQ_INJECTION_BITS_MASK;

> Fix this by also clearing V_IRQ_INJECTION_BITS_MASK from vmcb01's
> int_ctl in avic_deactivate_vmcb(), so that no stale dummy VINTR is
> left behind when AVIC transitions from enabled to disabled.
> 
> Signed-off-by: xin guo <m18700951735@163.com>
> ---
>  arch/x86/kvm/svm/avic.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/x86/kvm/svm/avic.c b/arch/x86/kvm/svm/avic.c
> index cdd5a6dc646f..b042c3f5f90e 100644
> --- a/arch/x86/kvm/svm/avic.c
> +++ b/arch/x86/kvm/svm/avic.c
> @@ -257,7 +257,9 @@ static void avic_deactivate_vmcb(struct vcpu_svm *svm)
>  {
>  	struct vmcb *vmcb = svm->vmcb01.ptr;
>  
> -	vmcb->control.int_ctl &= ~(AVIC_ENABLE_MASK | X2APIC_MODE_MASK);
> +	vmcb->control.int_ctl &= ~(AVIC_ENABLE_MASK | X2APIC_MODE_MASK |
> +				V_IRQ_INJECTION_BITS_MASK);
> +
>  	vmcb->control.avic_physical_id &= ~AVIC_PHYSICAL_MAX_INDEX_MASK;
>  
>  	if (!is_sev_es_guest(&svm->vcpu))
> -- 
> 2.27.0
>