With Secure AVIC, all AVIC-related exits are NAE (Non-Automatic Exits) and result in a #VC in the guest rather than a #VMEXIT. The guest can then use GHCB to request specific services from the hypervisor. As such, we should never see AVIC_UNACCELERATED_ACCESS exits in KVM. Add a WARN_ON() so that it is clear that something is wrong. Note that AVIC_INCOMPLETE_IPI is still possible via VMGEXIT. Signed-off-by: Naveen N Rao (AMD) --- arch/x86/kvm/svm/avic.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/x86/kvm/svm/avic.c b/arch/x86/kvm/svm/avic.c index bfd758369b5a..bf701e604a85 100644 --- a/arch/x86/kvm/svm/avic.c +++ b/arch/x86/kvm/svm/avic.c @@ -896,6 +896,10 @@ int avic_unaccelerated_access_interception(struct kvm_vcpu *vcpu) trace_kvm_avic_unaccelerated_access(vcpu->vcpu_id, offset, trap, write, vector); + + if (WARN_ON_ONCE(snp_is_secure_avic_enabled(vcpu->kvm))) + return 1; + if (trap) { /* Handling Trap */ WARN_ONCE(!write, "svm: Handling trap read.\n"); -- 2.54.0