Re: [RFC PATCH v2 17/25] KVM: nSVM: Service local TLB flushes before nested transitions

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Context mismatch in `svm_switch_vmcb()` incorrectly applies global TLB flushes to the outgoing VMCB and clears the request bit, causing the incoming VMCB to miss the flush. Furthermore, on nested VM-Exit, `leave_guest_mode()` is called before `svm_switch_vmcb()`, causing `kvm_hv_purge_tlb_flush_fifo()` to incorrectly reset L1's Hyper-V TLB flush FIFO while hardware flushes are applied to L2's `vmcb02`.
--

commit 5fb35fcca4bb6e1756cc67fdc65ffe16ab6c194f
Author: Yosry Ahmed <yosry@kernel.org>

KVM: nSVM: Service local TLB flushes before nested transitions

This patch updates nSVM to service local TLB flush requests before
switching VMCBs during nested transitions. It aims to ensure flushes are
applied to the correct context, similar to how nVMX handles them.

> diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
> index 234724d8b4c54..7b19191e0e43f 100644
> --- a/arch/x86/kvm/svm/nested.c
> +++ b/arch/x86/kvm/svm/nested.c
> @@ -717,9 +717,16 @@ static void svm_switch_vmcb(struct vcpu_svm *svm, struct kvm_vmcb_info *target_v
>  {
>  	struct kvm_vcpu *vcpu = &svm->vcpu;
>  
> +	/*
> +	 * TLB flushes are applied to the VMCB, so apply any pending TLB flushes
> +	 * on the current VMCB before switching to a new one..
> +	 */
> +	kvm_service_local_tlb_flush_requests(vcpu);

[Severity: High]
Does this clear global TLB flush requests (like KVM_REQ_TLB_FLUSH_GUEST)
while applying them only to the outgoing VMCB?

If a host-initiated flush occurs (e.g., from page reclaim), the request
bit will be consumed and applied to the outgoing VMCB, leaving the incoming
VMCB to miss the flush and run with a stale TLB.

Also, is there a context mismatch here during nested VM-Exit?

In nested_svm_vmexit(), leave_guest_mode(vcpu) is called before
svm_switch_vmcb(svm, &svm->vmcb01). 

Because of this, kvm_service_local_tlb_flush_requests() will see
is_guest_mode(vcpu) as false. If Hyper-V is enabled, this means
kvm_hv_purge_tlb_flush_fifo() will incorrectly target L1's FIFO while the
hardware flushes are actually being applied to L2's vmcb02.

> +
>  	svm->current_vmcb = target_vmcb;
>  	svm->vmcb = target_vmcb->ptr;

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260616004155.1435766-1-yosry@kernel.org?part=17