Re: [PATCH] KVM: SVM: Clear AVIC Physical ID table entry if vCPU creation fails

[Naveen N Rao <naveen@kernel.org>]

On Tue, Sep 22, 2026 at 12:08:16PM -0700, Sean Christopherson wrote:
> On Tue, Sep 22, 2026, Naveen N Rao wrote:
> > On Fri, Sep 11, 2026 at 11:55:07AM -0700, Sean Christopherson wrote:
> > > On Thu, Sep 03, 2026, Naveen N Rao (AMD) wrote:
> > > > diff --git a/arch/x86/kvm/svm/avic.c b/arch/x86/kvm/svm/avic.c
> > > > index 3b037e385523..bc2c699380b3 100644
> > > > --- a/arch/x86/kvm/svm/avic.c
> > > > +++ b/arch/x86/kvm/svm/avic.c
> > > > @@ -885,6 +885,16 @@ int avic_init_vcpu(struct vcpu_svm *svm)
> > > >  	return ret;
> > > >  }
> > > >  
> > > > +void avic_vcpu_free(struct kvm_vcpu *vcpu)
> > > > +{
> > > > +	u32 max_id = x2avic_enabled ? x2avic_max_physical_id : AVIC_MAX_PHYSICAL_ID;
> > > 
> > > I don't love the duplicate (triplicate?) code, and looking at the usage in
> > > avic_init_backing_page() with fresh eyes sketched me out.  It's "fine", because
> > > KVM will reject vCPU creation if vcpu_id >= kvm->arch.max_vcpu_ids, i.e. checking
> > > only the architectural max won't exceed this max:
> > > 
> > > 	return min(kvm->arch.max_vcpu_ids - 1, arch_max);
> > > 
> > > But it's hard to see that, and I can't think of any reason why being paranoid
> > > during vCPU creation/destruction would be a bad thing.
> > 
> > Agreed.
> > 
> > > 
> > > Assuming it actually works (haven't tested yet), I'll send a v2 with a prep patch
> > > to add:
> > > 
> > >   static bool avic_is_addressable_vcpu(struct kvm_vcpu *vcpu)
> > >   {
> > > 	return (vcpu->vcpu_id * sizeof(u64)) <
> > > 	       PAGE_SIZE << avic_get_physical_id_table_order(vcpu->kvm);
> > >   }
> > 
> > Unless you are planning to replace similar checks in __avic_vcpu_load() 
> > and __avic_vcpu_put(), 
> 
> Heh, I had coded up exactly that (and then completely forgot that I was going to
> send a v2, *sigh*).
> 
> > I think it will be simpler to just check the id 
> > itself and avoid dealing with the table size:
> > 	return vcpu->vcpu_id <= __avic_get_max_physical_id(kvm, NULL);
> > 
> > This helper can then also be used in avic_init_backing_page().
> 
> Eww, I missed that wrinkle.   Keying off the table order could get a false negative
> in avic_init_backing_page(), at least in theory.
> 
> What if we do both, sort of?  Convert load/put, and add a sanity check in
> avic_init_vmcb() as well?

Shouldn't hurt. Though to be entirely honest, it looks a bit redundant 
in avic_init_vmcb(). And we will still have max_id key'ed off the AVIC 
max APIC ID there, which I thought was one of your original issues.

> 
> diff --git arch/x86/kvm/svm/avic.c arch/x86/kvm/svm/avic.c
> index 3b037e385523..3725c033f8e9 100644
> --- arch/x86/kvm/svm/avic.c
> +++ arch/x86/kvm/svm/avic.c
> @@ -395,6 +395,12 @@ static phys_addr_t avic_get_backing_page_address(struct vcpu_svm *svm)
>         return __sme_set(__pa(svm->vcpu.arch.apic->regs));
>  }
>  
> +static bool avic_is_addressable_vcpu(struct kvm_vcpu *vcpu)
> +{
> +       return (vcpu->vcpu_id * sizeof(u64)) <
> +              PAGE_SIZE << avic_get_physical_id_table_order(vcpu->kvm);
> +}
> +
>  void avic_init_vmcb(struct vcpu_svm *svm, struct vmcb *vmcb)
>  {
>         struct kvm_svm *kvm_svm = to_kvm_svm(svm->vcpu.kvm);
> @@ -425,7 +431,7 @@ static int avic_init_backing_page(struct kvm_vcpu *vcpu)
>          * avic_vcpu_load() expects to be called if and only if the vCPU has
>          * fully initialized AVIC.
>          */
> -       if (id > max_id) {
> +       if (id > max_id || WARN_ON_ONCE(!avic_is_addressable_vcpu(vcpu))) {

I still think it is reasonable to use __avic_get_max_physical_id() here, 
which makes the intent clear:
	if (id > __avic_get_max_physical_id(vcpu->kvm, NULL))

If the __ name is a concern, perhaps a new wrapper can help, seeing as 
this would now be used in two places.


- Naveen