[PATCH v2 0/3] KVM: SVM: Advertise TCE to userspace

[PATCH v2 0/3] KVM: SVM: Advertise TCE to userspace

[Yosry Ahmed]

Advertise TCE to userspace, allowing guests to set EFER.TCE, potentially
gaining some performance. Patchees 1 & 2 are prep work suggested by
Sean.

v1: https://lore.kernel.org/kvm/20260306002327.1225504-1-yosry@kernel.org/

Venkatesh Srinivas (1):
  KVM: SVM: Advertise Translation Cache Extensions to userspace

Yosry Ahmed (2):
  KVM: x86: Move some EFER bits enablement to common code
  KVM: x86: Use kvm_cpu_cap_has() for EFER bits enablement checks

 arch/x86/kvm/cpuid.c   |  1 +
 arch/x86/kvm/svm/svm.c |  7 -------
 arch/x86/kvm/vmx/vmx.c |  4 ----
 arch/x86/kvm/x86.c     | 20 ++++++++++++++++++++
 4 files changed, 21 insertions(+), 11 deletions(-)


base-commit: 5128b972fb2801ad9aca54d990a75611ab5283a9
-- 
2.53.0.473.g4a7958ca14-goog

[PATCH v2 1/3] KVM: x86: Move some EFER bits enablement to common code

[Yosry Ahmed]

Move EFER bits enablement that only depend on CPU support to common
code, as there is no reason to do it in vendor code. Leave EFER.SVME and
EFER.LMSLE enablement in SVM code as they depend on vendor module
parameters.

Having the enablement in common code ensures that if a vendor starts
supporting an existing feature, KVM doesn't end up advertising to
userspace but not allowing the EFER bit to be set.

No functional change intended.

Suggested-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Yosry Ahmed <yosry@kernel.org>
---
 arch/x86/kvm/svm/svm.c |  7 -------
 arch/x86/kvm/vmx/vmx.c |  4 ----
 arch/x86/kvm/x86.c     | 14 ++++++++++++++
 3 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index 3407deac90bd6..5362443f4bbce 100644
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -5556,14 +5556,10 @@ static __init int svm_hardware_setup(void)
 		pr_err_ratelimited("NX (Execute Disable) not supported\n");
 		return -EOPNOTSUPP;
 	}
-	kvm_enable_efer_bits(EFER_NX);
 
 	kvm_caps.supported_xcr0 &= ~(XFEATURE_MASK_BNDREGS |
 				     XFEATURE_MASK_BNDCSR);
 
-	if (boot_cpu_has(X86_FEATURE_FXSR_OPT))
-		kvm_enable_efer_bits(EFER_FFXSR);
-
 	if (tsc_scaling) {
 		if (!boot_cpu_has(X86_FEATURE_TSCRATEMSR)) {
 			tsc_scaling = false;
@@ -5577,9 +5573,6 @@ static __init int svm_hardware_setup(void)
 
 	tsc_aux_uret_slot = kvm_add_user_return_msr(MSR_TSC_AUX);
 
-	if (boot_cpu_has(X86_FEATURE_AUTOIBRS))
-		kvm_enable_efer_bits(EFER_AUTOIBRS);
-
 	/* Check for pause filtering support */
 	if (!boot_cpu_has(X86_FEATURE_PAUSEFILTER)) {
 		pause_filter_count = 0;
diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index 9302c16571cdc..2b8a7456039c7 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -8583,10 +8583,6 @@ __init int vmx_hardware_setup(void)
 
 	vmx_setup_user_return_msrs();
 
-
-	if (boot_cpu_has(X86_FEATURE_NX))
-		kvm_enable_efer_bits(EFER_NX);
-
 	if (boot_cpu_has(X86_FEATURE_MPX)) {
 		rdmsrq(MSR_IA32_BNDCFGS, host_bndcfgs);
 		WARN_ONCE(host_bndcfgs, "BNDCFGS in host will be lost");
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 879cdeb6adde2..1aae2bc380d1b 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -10025,6 +10025,18 @@ void kvm_setup_xss_caps(void)
 }
 EXPORT_SYMBOL_FOR_KVM_INTERNAL(kvm_setup_xss_caps);
 
+static void kvm_setup_efer_caps(void)
+{
+	if (boot_cpu_has(X86_FEATURE_NX))
+		kvm_enable_efer_bits(EFER_NX);
+
+	if (boot_cpu_has(X86_FEATURE_FXSR_OPT))
+		kvm_enable_efer_bits(EFER_FFXSR);
+
+	if (boot_cpu_has(X86_FEATURE_AUTOIBRS))
+		kvm_enable_efer_bits(EFER_AUTOIBRS);
+}
+
 static inline void kvm_ops_update(struct kvm_x86_init_ops *ops)
 {
 	memcpy(&kvm_x86_ops, ops->runtime_ops, sizeof(kvm_x86_ops));
@@ -10161,6 +10173,8 @@ int kvm_x86_vendor_init(struct kvm_x86_init_ops *ops)
 	if (r != 0)
 		goto out_mmu_exit;
 
+	kvm_setup_efer_caps();
+
 	enable_device_posted_irqs &= enable_apicv &&
 				     irq_remapping_cap(IRQ_POSTING_CAP);
 
-- 
2.53.0.473.g4a7958ca14-goog

[PATCH v2 2/3] KVM: x86: Use kvm_cpu_cap_has() for EFER bits enablement checks

[Yosry Ahmed]

Instead of checking that the hardware supports underlying features for
EFER bits, check if KVM supports them. It is practically the same, but
this removes a subtle dependency on kvm_set_cpu_caps() enabling the
relevant CPUID features.

No functional change intended.

Suggested-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Yosry Ahmed <yosry@kernel.org>
---
 arch/x86/kvm/x86.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 1aae2bc380d1b..0b5d48e75b657 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -10027,13 +10027,13 @@ EXPORT_SYMBOL_FOR_KVM_INTERNAL(kvm_setup_xss_caps);
 
 static void kvm_setup_efer_caps(void)
 {
-	if (boot_cpu_has(X86_FEATURE_NX))
+	if (kvm_cpu_cap_has(X86_FEATURE_NX))
 		kvm_enable_efer_bits(EFER_NX);
 
-	if (boot_cpu_has(X86_FEATURE_FXSR_OPT))
+	if (kvm_cpu_cap_has(X86_FEATURE_FXSR_OPT))
 		kvm_enable_efer_bits(EFER_FFXSR);
 
-	if (boot_cpu_has(X86_FEATURE_AUTOIBRS))
+	if (kvm_cpu_cap_has(X86_FEATURE_AUTOIBRS))
 		kvm_enable_efer_bits(EFER_AUTOIBRS);
 }
 
-- 
2.53.0.473.g4a7958ca14-goog

[PATCH v2 3/3] KVM: SVM: Advertise Translation Cache Extensions to userspace

[Yosry Ahmed]

From: Venkatesh Srinivas <venkateshs@chromium.org>

TCE augments the behavior of TLB invalidating instructions (INVLPG,
INVLPGB, and INVPCID) to only invalidate translations for relevant
intermediate mappings to the address range, rather than ALL intermdiate
translations.

The Linux kernel has been setting EFER.TCE if supported by the CPU since
commit 440a65b7d25f ("x86/mm: Enable AMD translation cache extensions"),
as it may improve performance.

KVM does not need to do anything to virtualize the feature, only
advertise it and allow setting EFER.TCE. If a TLB invalidating
instruction is not intercepted, it will behave according to the guest's
setting of EFER.TCE as the value will be loaded on VM-Enter. Otherwise,
KVM's emulation may invalidate more TLB entries, which is perfectly fine
as the CPU is allowed to invalidate more TLB entries that it strictly
needs to.

Advertise X86_FEATURE_TCE to userspace, and allow the guest to set
EFER.TCE if available.

Signed-off-by: Venkatesh Srinivas <venkateshs@chromium.org>
Co-developed-by: Yosry Ahmed <yosry@kernel.org>
Signed-off-by: Yosry Ahmed <yosry@kernel.org>
---
 arch/x86/kvm/cpuid.c | 1 +
 arch/x86/kvm/x86.c   | 6 ++++++
 2 files changed, 7 insertions(+)

diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
index fffbf087937d4..4f810f23b1d9b 100644
--- a/arch/x86/kvm/cpuid.c
+++ b/arch/x86/kvm/cpuid.c
@@ -1112,6 +1112,7 @@ void kvm_initialize_cpu_caps(void)
 		F(XOP),
 		/* SKINIT, WDT, LWP */
 		F(FMA4),
+		F(TCE),
 		F(TBM),
 		F(TOPOEXT),
 		VENDOR_F(PERFCTR_CORE),
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 0b5d48e75b657..f12da9e92475e 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -1743,6 +1743,9 @@ static bool __kvm_valid_efer(struct kvm_vcpu *vcpu, u64 efer)
 	if (efer & EFER_NX && !guest_cpu_cap_has(vcpu, X86_FEATURE_NX))
 		return false;
 
+	if (efer & EFER_TCE && !guest_cpu_cap_has(vcpu, X86_FEATURE_TCE))
+		return false;
+
 	return true;
 
 }
@@ -10035,6 +10038,9 @@ static void kvm_setup_efer_caps(void)
 
 	if (kvm_cpu_cap_has(X86_FEATURE_AUTOIBRS))
 		kvm_enable_efer_bits(EFER_AUTOIBRS);
+
+	if (kvm_cpu_cap_has(X86_FEATURE_TCE))
+		kvm_enable_efer_bits(EFER_TCE);
 }
 
 static inline void kvm_ops_update(struct kvm_x86_init_ops *ops)
-- 
2.53.0.473.g4a7958ca14-goog

Re: [PATCH v2 3/3] KVM: SVM: Advertise Translation Cache Extensions to userspace

[Andrew Cooper]

> From: Venkatesh Srinivas <venkateshs@chromium.org>
>
> TCE augments the behavior of TLB invalidating instructions (INVLPG,
> INVLPGB, and INVPCID) to only invalidate translations for relevant
> intermediate mappings to the address range, rather than ALL intermdiate
> translations.
>
> The Linux kernel has been setting EFER.TCE if supported by the CPU since
> commit 440a65b7d25f ("x86/mm: Enable AMD translation cache extensions"),
> as it may improve performance.
>
> KVM does not need to do anything to virtualize the feature, only
> advertise it and allow setting EFER.TCE. If a TLB invalidating
> instruction is not intercepted, it will behave according to the guest's
> setting of EFER.TCE as the value will be loaded on VM-Enter. Otherwise,
> KVM's emulation may invalidate more TLB entries, which is perfectly fine
> as the CPU is allowed to invalidate more TLB entries that it strictly
> needs to.
>
> Advertise X86_FEATURE_TCE to userspace, and allow the guest to set
> EFER.TCE if available.
>
> Signed-off-by: Venkatesh Srinivas <venkateshs@chromium.org>
> Co-developed-by: Yosry Ahmed <yosry@kernel.org>
> Signed-off-by: Yosry Ahmed <yosry@kernel.org>

I'll repeat what I said on that referenced patch.

What's the point?  AMD have said that TCE doesn't exist any more; it's a
bit that's no longer wired into anything.

You've got to get to pre-Zen hardware before this has any behavioural
effect, at which point the breath of testing is almost 0.

~Andrew

Re: [PATCH v2 3/3] KVM: SVM: Advertise Translation Cache Extensions to userspace

[Yosry Ahmed]

On Fri, Mar 6, 2026 at 5:54 PM Andrew Cooper <andrew.cooper3@citrix.com> wrote:
>
> > From: Venkatesh Srinivas <venkateshs@chromium.org>
> >
> > TCE augments the behavior of TLB invalidating instructions (INVLPG,
> > INVLPGB, and INVPCID) to only invalidate translations for relevant
> > intermediate mappings to the address range, rather than ALL intermdiate
> > translations.
> >
> > The Linux kernel has been setting EFER.TCE if supported by the CPU since
> > commit 440a65b7d25f ("x86/mm: Enable AMD translation cache extensions"),
> > as it may improve performance.
> >
> > KVM does not need to do anything to virtualize the feature, only
> > advertise it and allow setting EFER.TCE. If a TLB invalidating
> > instruction is not intercepted, it will behave according to the guest's
> > setting of EFER.TCE as the value will be loaded on VM-Enter. Otherwise,
> > KVM's emulation may invalidate more TLB entries, which is perfectly fine
> > as the CPU is allowed to invalidate more TLB entries that it strictly
> > needs to.
> >
> > Advertise X86_FEATURE_TCE to userspace, and allow the guest to set
> > EFER.TCE if available.
> >
> > Signed-off-by: Venkatesh Srinivas <venkateshs@chromium.org>
> > Co-developed-by: Yosry Ahmed <yosry@kernel.org>
> > Signed-off-by: Yosry Ahmed <yosry@kernel.org>
>
> I'll repeat what I said on that referenced patch.
>
> What's the point?  AMD have said that TCE doesn't exist any more; it's a
> bit that's no longer wired into anything.
>
> You've got to get to pre-Zen hardware before this has any behavioural
> effect, at which point the breath of testing is almost 0.

Oh, I did not know that, thanks for pointing it out.

I'll leave it up to Sean whether to pick this up (because Linux guests
still set the bit), just pick up patches 1-2 as cleanups, or drop this
entirely.

Re: [PATCH v2 3/3] KVM: SVM: Advertise Translation Cache Extensions to userspace

[Sean Christopherson]

On Mon, Mar 09, 2026, Yosry Ahmed wrote:
> On Fri, Mar 6, 2026 at 5:54 PM Andrew Cooper <andrew.cooper3@citrix.com> wrote:
> >
> > > From: Venkatesh Srinivas <venkateshs@chromium.org>
> > >
> > > TCE augments the behavior of TLB invalidating instructions (INVLPG,
> > > INVLPGB, and INVPCID) to only invalidate translations for relevant
> > > intermediate mappings to the address range, rather than ALL intermdiate
> > > translations.
> > >
> > > The Linux kernel has been setting EFER.TCE if supported by the CPU since
> > > commit 440a65b7d25f ("x86/mm: Enable AMD translation cache extensions"),
> > > as it may improve performance.
> > >
> > > KVM does not need to do anything to virtualize the feature, only
> > > advertise it and allow setting EFER.TCE. If a TLB invalidating
> > > instruction is not intercepted, it will behave according to the guest's
> > > setting of EFER.TCE as the value will be loaded on VM-Enter. Otherwise,
> > > KVM's emulation may invalidate more TLB entries, which is perfectly fine
> > > as the CPU is allowed to invalidate more TLB entries that it strictly
> > > needs to.
> > >
> > > Advertise X86_FEATURE_TCE to userspace, and allow the guest to set
> > > EFER.TCE if available.
> > >
> > > Signed-off-by: Venkatesh Srinivas <venkateshs@chromium.org>
> > > Co-developed-by: Yosry Ahmed <yosry@kernel.org>
> > > Signed-off-by: Yosry Ahmed <yosry@kernel.org>
> >
> > I'll repeat what I said on that referenced patch.
> >
> > What's the point?  AMD have said that TCE doesn't exist any more; it's a
> > bit that's no longer wired into anything.
> >
> > You've got to get to pre-Zen hardware before this has any behavioural
> > effect, at which point the breath of testing is almost 0.
> 
> Oh, I did not know that, thanks for pointing it out.
> 
> I'll leave it up to Sean whether to pick this up (because Linux guests
> still set the bit), just pick up patches 1-2 as cleanups, or drop this
> entirely.

I'll grab 1-2 and leave 3 alone, at least for now.  It _should_ do no harm, but
it would really suck to discover that pre-Zen hardware has a TLB bug that affects
TCE, or worse, affects TCE but only for ASID!=0 translations or something.

If new CPUs ever use TCE, it'll be trivial to enable at that time.

Re: [PATCH v2 3/3] KVM: SVM: Advertise Translation Cache Extensions to userspace

[Yosry Ahmed]

> > I'll leave it up to Sean whether to pick this up (because Linux guests
> > still set the bit), just pick up patches 1-2 as cleanups, or drop this
> > entirely.
>
> I'll grab 1-2 and leave 3 alone, at least for now.  It _should_ do no harm, but
> it would really suck to discover that pre-Zen hardware has a TLB bug that affects
> TCE, or worse, affects TCE but only for ASID!=0 translations or something.

Sounds good to me, thanks.

Re: [PATCH v2 3/3] KVM: SVM: Advertise Translation Cache Extensions to userspace

[Venkatesh Srinivas]

On Fri, Mar 6, 2026 at 5:54 PM Andrew Cooper <andrew.cooper3@citrix.com> wrote:
>
> > From: Venkatesh Srinivas <venkateshs@chromium.org>
> >
> > TCE augments the behavior of TLB invalidating instructions (INVLPG,
> > INVLPGB, and INVPCID) to only invalidate translations for relevant
> > intermediate mappings to the address range, rather than ALL intermdiate
> > translations.
> >
> > The Linux kernel has been setting EFER.TCE if supported by the CPU since
> > commit 440a65b7d25f ("x86/mm: Enable AMD translation cache extensions"),
> > as it may improve performance.
> >
> > KVM does not need to do anything to virtualize the feature, only
> > advertise it and allow setting EFER.TCE. If a TLB invalidating
> > instruction is not intercepted, it will behave according to the guest's
> > setting of EFER.TCE as the value will be loaded on VM-Enter. Otherwise,
> > KVM's emulation may invalidate more TLB entries, which is perfectly fine
> > as the CPU is allowed to invalidate more TLB entries that it strictly
> > needs to.
> >
> > Advertise X86_FEATURE_TCE to userspace, and allow the guest to set
> > EFER.TCE if available.
> >
> > Signed-off-by: Venkatesh Srinivas <venkateshs@chromium.org>
> > Co-developed-by: Yosry Ahmed <yosry@kernel.org>
> > Signed-off-by: Yosry Ahmed <yosry@kernel.org>
>
> I'll repeat what I said on that referenced patch.
>
> What's the point?  AMD have said that TCE doesn't exist any more; it's a
> bit that's no longer wired into anything.
>
> You've got to get to pre-Zen hardware before this has any behavioural
> effect, at which point the breath of testing is almost 0.

Interesting, I missed that. Do you know where AMD said that?
(If so, why did we take 440a65b7d25f ("x86/mm: Enable AMD translation
cache extensions")?)

Thanks,
-- vs;

Re: [PATCH v2 0/3] KVM: SVM: Advertise TCE to userspace

[Sean Christopherson]

On Sat, 07 Mar 2026 01:16:16 +0000, Yosry Ahmed wrote:
> Advertise TCE to userspace, allowing guests to set EFER.TCE, potentially
> gaining some performance. Patchees 1 & 2 are prep work suggested by
> Sean.
> 
> v1: https://lore.kernel.org/kvm/20260306002327.1225504-1-yosry@kernel.org/
> 
> Venkatesh Srinivas (1):
>   KVM: SVM: Advertise Translation Cache Extensions to userspace
> 
> [...]

Applied 1-2 to kvm-x86 misc (several weeks ago, I forgot to send emails before
disappearing).  Thanks!

[1/2] KVM: x86: Move some EFER bits enablement to common code
      https://github.com/kvm-x86/linux/commit/3b27c82ba2f3
[2/2] KVM: x86: Use kvm_cpu_cap_has() for EFER bits enablement checks
      https://github.com/kvm-x86/linux/commit/d216449f253c
[3/3] KVM: SVM: Advertise Translation Cache Extensions to userspace
      DROP

--
https://github.com/kvm-x86/linux/tree/next