Re: [PATCH v3 21/27] KVM: nSVM: Handle nested TLB flush requests through TLB_CONTROL

[Jim Mattson <jmattson@google.com>]

On Mon, Oct 12, 2026 at 4:36 PM Yosry Ahmed <yosry@kernel.org> wrote:
>
> Handle L1's requests to flush L2's TLB through the TLB_CONTROL field of
> VMCB12. According to the APM, TLB_CONTROL is not modified by VMRUN, so
> only read the field from VMCB12 but do not clear it.
>
> On nested VM-Enter, flush L2's ASID if any flush is specified in
> TLB_CONTROL. This handles TLB_CONTROL_FLUSH_ASID and
> TLB_CONTROL_FLUSH_ASID_LOCAL equally for simplicity.
>
> On nested VM-Exit, flush L1's own ASID if L1 requested a *full* TLB
> flush (i.e. TLB_CONTROL_FLUSH_ALL_ASID).
>
> Essentially, TLB_CONTROL_FLUSH_ASID[_LOCAL] cause a TLB flush on nested
> VM-Enter only, while TLB_CONTROL_FLUSH_ALL_ASID causes a TLB flush on
> both nested VM-Enter and nested VM-Exit.
>
> Additionally, sync the nested NPTs on nested VM-Enter on an ASID flush,
> as ASID flushes also invalidate guest-physical translations on SVM
> (unlike VMX, which has separate VPID-based and EPT-based flushing). Sync
> all roots, as shadow mappings are not tagged with an ASID, and there
> could be translations belonging to the outgoing or flushed ASID in
> previous roots.
>
> All TLB_CONTROL values can be handled by KVM regardless of FLUSHBYASID
> support on the underlying CPU, so keep advertising FLUSHBYASID to the
> guest unconditionally.
>
> Note, TLB_CONTROL_FLUSH_ALL_ASID is never propagated from the vmcb12 to
> the vmcb02 (unless FLUSHBYASID is not available), as this gives the
> guest the power to flush the entire physical TLB (including translations
> for the host and other VMs).
>
> Signed-off-by: Yosry Ahmed <yosry@kernel.org>
Reviewed-by: Jim Mattson <jmattson@google.com>