Re: [PATCH v1 24/28] x86/hvm: avic: ensure SVM AVIC is disabled with nested guest

[Ross Lagerwall <ross.lagerwall@xxxxxxxxxx>]

> From: Xen-devel <xen-devel-bounces@xxxxxxxxxxxxxxxxxxxx> on behalf of 
> dmukhin@xxxxxxxx <dmukhin@xxxxxxxx>
> Sent: Thursday, November 05, 2026 01:33
> To: xen-devel@xxxxxxxxxxxxxxxxxxxx <xen-devel@xxxxxxxxxxxxxxxxxxxx>
> Cc: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>; jason.andryuk@xxxxxxx 
> <jason.andryuk@xxxxxxx>; jbeulich@xxxxxxxx <jbeulich@xxxxxxxx>; 
> roger@xxxxxxxxxxxxxx <roger@xxxxxxxxxxxxxx>; teddy.astie@xxxxxxxxxx 
> <teddy.astie@xxxxxxxxxx>; dmukhin@xxxxxxx <dmukhin@xxxxxxx>; Denis Mukhin 
> <dmukhin@xxxxxxxx>
> Subject: [PATCH v1 24/28] x86/hvm: avic: ensure SVM AVIC is disabled with 
> nested guest
>
>
> From: Denis Mukhin <dmukhin@xxxxxxxx>
>
> AVIC in nested virtualization environment is not supported as of yet.
>
> Ensure there will be no problems in any production environments if AVIC
> got enabled in nested guest by short-circuiting logic in
> svm_avic_create_vmcb().
>
> Signed-off-by: Denis Mukhin <dmukhin@xxxxxxxx>
> ---
>  xen/arch/x86/hvm/svm/avic.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
>
> diff --git a/xen/arch/x86/hvm/svm/avic.c b/xen/arch/x86/hvm/svm/avic.c
> index 37a857f28d14..e19489bd485c 100644
> --- a/xen/arch/x86/hvm/svm/avic.c
> +++ b/xen/arch/x86/hvm/svm/avic.c
> @@ -4,6 +4,7 @@
>   */
>  
>  #include <asm/hvm/emulate.h>
> +#include <asm/hvm/nestedhvm.h>
>  #include <asm/msr.h>
>  #include <asm/p2m.h>
>  #include <xen/param.h>
> @@ -170,6 +171,14 @@ static bool avic_vcpu_supported(struct vcpu *v)
>          return false;
>      }
>  
> +    if ( nestedhvm_enabled(d) && nestedhvm_vcpu_in_guestmode(v) )
> +    {
> +        gprintk(XENLOG_WARNING,
> +                "%pv: AVIC: nested guest is not supported\n",
> +                v);
> +        return false;
> +    }
> +
>      id = GET_xAPIC_ID(vlapic_reg_read(v, APIC_ID));
>      if ( id > AVIC_MAX_PHYSICAL_ID )
>      {

Does this actually work? This function is mostly called from
svm_vcpu_initialise() and the vCPU is never in guest mode there (i.e. L2).

You could probably just drop the second part of the if condition.

Ross