hyperv_is_synic_enabled() is a global flag that returns true after the
first CPU initializes SynIC. With -smp N, all subsequent CPUs skip
hyperv_x86_synic_add() in hyperv_enable_synic(), leaving them without
a synic object. This causes get_synic() to return NULL, making
hyperv_sint_route_new() fail and triggering an assertion crash in
hyperv_testdev.

Fix by introducing hyperv_is_synic_present() which checks per-CPU
whether a synic object is already attached instead of using the global
flag.

Fixes: c4cf32fc63f1 ("kvm/hyperv: add synic feature to CPU only if its not enabled")
Reported-by: Xudong Hao
Signed-off-by: Sourav Poddar <souravpoddar93042@gmail.com>
---
 hw/hyperv/hyperv.c         | 5 +++++
 include/hw/hyperv/hyperv.h | 1 +
 target/i386/kvm/hyperv.c   | 2 +-
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/hw/hyperv/hyperv.c b/hw/hyperv/hyperv.c
index 27e323a819..ff53cbc699 100644
--- a/hw/hyperv/hyperv.c
+++ b/hw/hyperv/hyperv.c
@@ -60,6 +60,11 @@ static SynICState *get_synic(CPUState *cs)
     return SYNIC(object_resolve_path_component(OBJECT(cs), "synic"));
 }
 
+bool hyperv_is_synic_present(CPUState *cs)
+{
+    return get_synic(cs) != NULL;
+}
+
 static void synic_update(SynICState *synic, bool sctl_enable,
                          hwaddr msg_page_addr, hwaddr event_page_addr)
 {
diff --git a/include/hw/hyperv/hyperv.h b/include/hw/hyperv/hyperv.h
index 63a8b65278..23091301d0 100644
--- a/include/hw/hyperv/hyperv.h
+++ b/include/hw/hyperv/hyperv.h
@@ -81,6 +81,7 @@ void hyperv_synic_reset(CPUState *cs);
 void hyperv_synic_update(CPUState *cs, bool enable,
                          hwaddr msg_page_addr, hwaddr event_page_addr);
 bool hyperv_is_synic_enabled(void);
+bool hyperv_is_synic_present(CPUState *cs);
 
 /*
  * Process HVCALL_RESET_DEBUG_SESSION hypercall.
diff --git a/target/i386/kvm/hyperv.c b/target/i386/kvm/hyperv.c
index bd3c26d02b..420c76b5ff 100644
--- a/target/i386/kvm/hyperv.c
+++ b/target/i386/kvm/hyperv.c
@@ -27,7 +27,7 @@ int hyperv_x86_synic_add(X86CPU *cpu)
 int hyperv_enable_synic(X86CPU *cpu)
 {
     int ret = 0;
-    if (!hyperv_is_synic_enabled()) {
+    if (!hyperv_is_synic_present(CPU(cpu))) {
         ret = hyperv_x86_synic_add(cpu);
     }
     return ret;
-- 
2.53.0

> On 21 Mar 2026, at 11:50 AM, Sourav Poddar <souravpoddar93042@gmail.com> wrote:
> 
> hyperv_is_synic_enabled() is a global flag that returns true after the
> first CPU initializes SynIC. With -smp N, all subsequent CPUs skip
> hyperv_x86_synic_add() in hyperv_enable_synic(), leaving them without
> a synic object. This causes get_synic() to return NULL, making
> hyperv_sint_route_new() fail and triggering an assertion crash in
> hyperv_testdev.
> 
> Fix by introducing hyperv_is_synic_present() which checks per-CPU
> whether a synic object is already attached instead of using the global
> flag.


I have sent this here https://lists.nongnu.org/archive/html/qemu-devel/2026-03/msg06300.html


> 
> Fixes: c4cf32fc63f1 ("kvm/hyperv: add synic feature to CPU only if its not enabled")
> Reported-by: Xudong Hao
> Signed-off-by: Sourav Poddar <souravpoddar93042@gmail.com>
> ---
> hw/hyperv/hyperv.c         | 5 +++++
> include/hw/hyperv/hyperv.h | 1 +
> target/i386/kvm/hyperv.c   | 2 +-
> 3 files changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/hw/hyperv/hyperv.c b/hw/hyperv/hyperv.c
> index 27e323a819..ff53cbc699 100644
> --- a/hw/hyperv/hyperv.c
> +++ b/hw/hyperv/hyperv.c
> @@ -60,6 +60,11 @@ static SynICState *get_synic(CPUState *cs)
>     return SYNIC(object_resolve_path_component(OBJECT(cs), "synic"));
> }
> 
> +bool hyperv_is_synic_present(CPUState *cs)
> +{
> +    return get_synic(cs) != NULL;
> +}
> +
> static void synic_update(SynICState *synic, bool sctl_enable,
>                          hwaddr msg_page_addr, hwaddr event_page_addr)
> {
> diff --git a/include/hw/hyperv/hyperv.h b/include/hw/hyperv/hyperv.h
> index 63a8b65278..23091301d0 100644
> --- a/include/hw/hyperv/hyperv.h
> +++ b/include/hw/hyperv/hyperv.h
> @@ -81,6 +81,7 @@ void hyperv_synic_reset(CPUState *cs);
> void hyperv_synic_update(CPUState *cs, bool enable,
>                          hwaddr msg_page_addr, hwaddr event_page_addr);
> bool hyperv_is_synic_enabled(void);
> +bool hyperv_is_synic_present(CPUState *cs);
> 
> /*
>  * Process HVCALL_RESET_DEBUG_SESSION hypercall.
> diff --git a/target/i386/kvm/hyperv.c b/target/i386/kvm/hyperv.c
> index bd3c26d02b..420c76b5ff 100644
> --- a/target/i386/kvm/hyperv.c
> +++ b/target/i386/kvm/hyperv.c
> @@ -27,7 +27,7 @@ int hyperv_x86_synic_add(X86CPU *cpu)
> int hyperv_enable_synic(X86CPU *cpu)
> {
>     int ret = 0;
> -    if (!hyperv_is_synic_enabled()) {
> +    if (!hyperv_is_synic_present(CPU(cpu))) {
>         ret = hyperv_x86_synic_add(cpu);
>     }
>     return ret;
> -- 
> 2.53.0
>