Re: [PATCH v3 26/27] KVM: nSVM: Use different ASIDs for L1 and L2

[Jim Mattson]

On Mon, Oct 12, 2026 at 4:37 PM Yosry Ahmed <yosry@xxxxxxxxxx> wrote:
>
> Now that TLB flushes are properly handled and tracked for L1 vs L2
> ASIDs, allocate a separate new ASID for L2 for each vCPU, similar to how
> VMX handles VPIDs. Drop the unconditional flushes and syncs on nested
> transitions.
>
> L1 and L2 can now only share an ASID in two cases:
> - KVM runs out of ASIDs and uses the fallback ASID for both L1 and L2.
> - SEV VMs always use the same ASID for SEV-specific requirements.
>
> WARN if the ASID is shared otherwise.
>
> Initialize last_asid to 0, such that the L2 ASID is always flushed on
> first nested VM-Enter after it's allocated.
>
> On SEV VM migration, free the L2 ASID on the destination vCPU (if nested
> was already initialized) before overwriting it with the SEV ASID.
>
> On a Turin CPU, this results in 8-15% performance boost in CPUID rate
> microbenchmark [1] and netperf TCP_RR latency/throughput.
>
> [1] https://lore.kernel.org/kvm/20231109180646.2963718-1-khorenko@xxxxxxxxxxxxx/
>
> Signed-off-by: Yosry Ahmed <yosry@xxxxxxxxxx>
> ---
>  arch/x86/kvm/svm/nested.c | 32 +++++++++++++++++++++++---------
>  arch/x86/kvm/svm/sev.c    |  6 ++++--
>  2 files changed, 27 insertions(+), 11 deletions(-)
>
> diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
> index 4ffc10bf9232e..6fe68f2ae282d 100644
> --- a/arch/x86/kvm/svm/nested.c
> +++ b/arch/x86/kvm/svm/nested.c
> @@ -711,6 +711,10 @@ static void nested_svm_entry_tlb_flush(struct kvm_vcpu *vcpu)
>          * context is not tagged by the ASID, so the shadow NPTs cannot be
>          * reused across different L2 ASIDs.
>          *
> +        * Note, last_asid is initialized as 0, so the first nested VM-Enter
> +        * after setting EFER.SVME will always flush the TLB to avoid using
> +        * stale entries.
> +        *
>          * If L1 requested a full TLB flush for all ASIDs (including its own),
>          * L1's own ASID is also flushed on nested VM-Exit, before running L1.
>          *
> @@ -727,12 +731,10 @@ static void nested_svm_entry_tlb_flush(struct kvm_vcpu *vcpu)
>          * If L1 and L2 share the same ASID in hardware (when using the fallback
>          * ASID for both, or for SEV guests), flush it on nested transitions.
>          */
> -       if (svm->asid == svm->nested.asid02)
> +       if (svm->asid == svm->nested.asid02) {
> +               WARN_ON_ONCE(svm->asid != fallback_asid && !is_sev_guest(vcpu));
>                 kvm_make_request(KVM_REQ_TLB_FLUSH_CURRENT, vcpu);
> -
> -       /* TODO: optimize unconditional TLB flush/MMU sync */
> -       kvm_make_request(KVM_REQ_MMU_SYNC, vcpu);
> -       kvm_make_request(KVM_REQ_TLB_FLUSH_CURRENT, vcpu);
> +       }

Per the APM, volume 2, Section 15.16.1, "TLB Flush":

> All TLB entries belonging to all ASIDs are flushed by SMI, RSM, MTRR modifications, IORR modifications, and access to other system MSRs that affect address translation.

With two separate ASIDs and the unconditional flush removed, do we
flush both ASIDs in the above instances?

Moreover, does this change the semantics of PV TLB flush? In
record_steal_time(), we have:

if (st_preempted & KVM_VCPU_FLUSH_TLB)
        kvm_vcpu_flush_tlb_guest(vcpu);

IIUC, an idle vCPU that wakes into L2 will flush only L2's ASID. In
the past, with a shared ASID, L1's ASID was always flushed on emulated
VM-exit anyway. Now, L1's ASID will be unaffected. Though I can't find
any real documentation on PV TLB flush, it *seems* like the remote
vCPU would want L1's ASID to be flushed. OTOH, this change makes nSVM
behave just like nVMX.


Nit: with this change, the following stale comment in
svm_flush_tlb_asid() needs to be updated:

/*
* Flush only the current ASID even if the TLB flush was invoked via
* kvm_flush_remote_tlbs(). Although flushing remote TLBs requires all
* ASIDs to be flushed, KVM uses a single ASID for L1 and L2, and
* unconditionally does a TLB flush on both nested VM-Enter and nested
* VM-Exit (via kvm_mmu_reset_context()).
*/