Re: [PATCH v2 2/3] KVM: SVM: Dirty ERAPS register on all ASID TLB flushes

[Sean Christopherson <seanjc@google.com>]

On Fri, Jul 17, 2026, Jim Mattson wrote:
> Per the AMD APM, ERAPS clears the Return Address Predictor (RAP/RSB) on all
> implicit TLB invalidations (e.g. modifying certain CR[04] bits).
> 
> Move kvm_register_mark_dirty(vcpu, VCPU_REG_ERAPS) into
> svm_flush_tlb_asid() so that any ASID-level TLB flush marks ERAPS dirty.

NAK, the whole point of KVM_REQ_TLB_FLUSH_GUEST is emulate TLB invalidations in
the guest's domain.  If we're missing KVM_REQ_TLB_FLUSH_GUEST requests, fix those.

I think we're missing a clear on the MOV CR3 flush when TDP is disabled?  Beyond
that, nothing jumps out.

diff --git arch/x86/kvm/x86.c arch/x86/kvm/x86.c
index 11017f49b94a..39b1e79df6c9 100644
--- arch/x86/kvm/x86.c
+++ arch/x86/kvm/x86.c
@@ -755,10 +755,16 @@ void kvm_invalidate_pcid(struct kvm_vcpu *vcpu, unsigned long pcid)
         * also via the emulator.  KVM's TDP page tables are not in the scope of
         * the invalidation, but the guest's TLB entries need to be flushed as
         * the CPU may have cached entries in its TLB for the target PCID.
+        *
+        * When ERAPS is supported, invalidating a specific PCID clears the RAP
+        * (Return Address Predicator).  KVM flushes the RAP when emulating a
+        * full guest TLB flush, so only the !TDP case needs to be handled here.
         */
        if (unlikely(tdp_enabled)) {
                kvm_make_request(KVM_REQ_TLB_FLUSH_GUEST, vcpu);
                return;
+       } else if (guest_cpu_cap_has(vcpu, X86_FEATURE_ERAPS)) {
+               kvm_register_mark_dirty(vcpu, VCPU_REG_ERAPS);
        }
 
        /*
@@ -10740,13 +10746,6 @@ int kvm_handle_invpcid(struct kvm_vcpu *vcpu, unsigned long type, gva_t gva)
                        return 1;
                }
 
-               /*
-                * When ERAPS is supported, invalidating a specific PCID clears
-                * the RAP (Return Address Predicator).
-                */
-               if (guest_cpu_cap_has(vcpu, X86_FEATURE_ERAPS))
-                       kvm_register_mark_dirty(vcpu, VCPU_REG_ERAPS);
-
                kvm_invalidate_pcid(vcpu, operand.pcid);
                return kvm_skip_emulated_instruction(vcpu);
 
@@ -10760,11 +10759,6 @@ int kvm_handle_invpcid(struct kvm_vcpu *vcpu, unsigned long type, gva_t gva)
 
                fallthrough;
        case INVPCID_TYPE_ALL_INCL_GLOBAL:
-               /*
-                * Don't bother marking VCPU_REG_ERAPS dirty, SVM will take
-                * care of doing so when emulating the full guest TLB flush
-                * (the RAP is cleared on all implicit TLB flushes).
-                */
                kvm_make_request(KVM_REQ_TLB_FLUSH_GUEST, vcpu);
                return kvm_skip_emulated_instruction(vcpu);
 


> Centralizing the ERAPS dirty call in svm_flush_tlb_asid() ensures that all
> ASID flushes (flush_tlb_current, flush_tlb_all, flush_tlb_guest) properly
> set ERAP_CONTROL_CLEAR_RAP on the next VMRUN.
> 
> Remove the now redundant svm_flush_tlb_guest() wrapper.
> 
> Fixes: db5e82496492 ("KVM: SVM: Virtualize and advertise support for ERAPS")
> Assisted-by: Gemini:Gemini-Next
> Signed-off-by: Jim Mattson <jmattson@google.com>
> ---
>  arch/x86/kvm/svm/svm.c | 11 +++--------
>  1 file changed, 3 insertions(+), 8 deletions(-)
> 
> diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
> index bf868da14cd2..f2fdca341dac 100644
> --- a/arch/x86/kvm/svm/svm.c
> +++ b/arch/x86/kvm/svm/svm.c
> @@ -4171,6 +4171,8 @@ static void svm_flush_tlb_asid(struct kvm_vcpu *vcpu)
>  {
>  	struct vcpu_svm *svm = to_svm(vcpu);
>  
> +	kvm_register_mark_dirty(vcpu, VCPU_REG_ERAPS);
> +
>  	/*
>  	 * Unlike VMX, SVM doesn't provide a way to flush only NPT TLB entries.
>  	 * A TLB flush for the current ASID flushes both "host" and "guest" TLB
> @@ -4229,13 +4231,6 @@ static void svm_flush_tlb_gva(struct kvm_vcpu *vcpu, gva_t gva)
>  	invlpga(gva, svm->vmcb->control.asid);
>  }
>  
> -static void svm_flush_tlb_guest(struct kvm_vcpu *vcpu)
> -{
> -	kvm_register_mark_dirty(vcpu, VCPU_REG_ERAPS);
> -
> -	svm_flush_tlb_asid(vcpu);
> -}
> -
>  static inline void sync_cr8_to_lapic(struct kvm_vcpu *vcpu)
>  {
>  	struct vcpu_svm *svm = to_svm(vcpu);
> @@ -5383,7 +5378,7 @@ struct kvm_x86_ops svm_x86_ops __initdata = {
>  	.flush_tlb_all = svm_flush_tlb_all,
>  	.flush_tlb_current = svm_flush_tlb_current,
>  	.flush_tlb_gva = svm_flush_tlb_gva,
> -	.flush_tlb_guest = svm_flush_tlb_guest,
> +	.flush_tlb_guest = svm_flush_tlb_asid,
>  
>  	.vcpu_pre_run = svm_vcpu_pre_run,
>  	.vcpu_run = svm_vcpu_run,
> -- 
> 2.55.0.229.g6434b31f56-goog
>