Do not support in-kernel KVM IOAPIC if Secure AVIC is enabled. There are two primary reasons (besides aligning with TDX): 1. KVM IOAPIC brings in PIC with no way to disable that. We can't support the PIC since there is no way to inject ExtINT. 2. KVM PIT in its default reinject mode can't be supported due to EOI acceleration (just like AVIC), but Secure AVIC can't be inhibited. The latter is not an issue with userspace IOAPIC/PIT (reinject mode is unique to the KVM PIT). For the former, it is up to the VMM to ensure PIC is not advertised if Secure AVIC is enabled. Signed-off-by: Naveen N Rao (AMD) --- arch/x86/kvm/svm/avic.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/arch/x86/kvm/svm/avic.c b/arch/x86/kvm/svm/avic.c index e3758c054783..525fa8834277 100644 --- a/arch/x86/kvm/svm/avic.c +++ b/arch/x86/kvm/svm/avic.c @@ -938,8 +938,17 @@ int avic_init_vcpu(struct vcpu_svm *svm) if (!enable_apicv || !irqchip_in_kernel(vcpu->kvm)) return 0; - if (snp_is_secure_avic_enabled(vcpu->kvm)) + if (snp_is_secure_avic_enabled(vcpu->kvm)) { + /* + * Secure AVIC can't work with the legacy PIC since there is no + * way to inject ExtINT. Besides, we can't inhibit Secure AVIC, + * so we can't really support KVM PIT in reinject mode. + */ + if (!irqchip_split(vcpu->kvm)) + return -EINVAL; + vcpu->arch.apic->guest_apic_protected = true; + } ret = avic_init_backing_page(vcpu); if (ret) -- 2.54.0