[3/4] KVM: nVMX: Don't flush TLB when vmcs12 uses VPID

Commit Message

Liran Alon May 22, 2018, 2:16 p.m. UTC

Since commit 5c614b3583e7 ("KVM: nVMX: nested VPID emulation"),
vmcs01 and vmcs02 don't share the same VPID. vmcs01 uses vmx->vpid
while vmcs02 uses vmx->nested.vpid02. This was done such that TLB
flush could be avoided when switching between L1 and L2.

However, the above mentioned commit only changed L2 VMEntry logic to
not flush TLB when switching from L1 to L2. It forgot to also remove
the TLB flush which is done when simulating a VMExit from L2 to L1.

To fix this issue, on VMExit from L2 to L1 we flush TLB only in case
vmcs01 enables VPID and vmcs01->vpid==vmcs02->vpid. This happens when
vmcs01 enables VPID and vmcs12 does not.

Fixes: 5c614b3583e7 ("KVM: nVMX: nested VPID emulation")

Reviewed-by: Liam Merwick <[e-mail]>
Reviewed-by: Krish Sadhukhan <[e-mail]>
Signed-off-by: Liran Alon <[e-mail]>
---
 arch/x86/kvm/vmx.c | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

Comments

Jim Mattson May 22, 2018, 4:09 p.m. UTC | #1

On Tue, May 22, 2018 at 7:16 AM, Liran Alon <[e-mail]> wrote:

> +       /*
> +        * If vmcs01 don't use VPID, CPU flushes TLB on every
> +        * VMEntry/VMExit. Thus, no need to flush TLB.
> +        *
> +        * If vmcs12 uses VPID, TLB entries populated by L2 are
> +        * tagged with vmx->nested.vpid02 while L1 entries are tagged
> +        * with vmx->vpid. Thus, no need to flush TLB.
> +        *

Furthermore, If vmcs12 uses EPT, TLB entries populated by L2 are
tagged with the vmcs02 EP4TA while L1 entries are tagged with the
vmcs01 EP4TA. Thus, no need to flush the TLB.

Patch

diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 33fb512539a3..f35a16e3b849 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -11919,12 +11919,20 @@  static void load_vmcs12_host_state(struct kvm_vcpu *vcpu,
 
 	load_vmcs12_mmu_host_state(vcpu, vmcs12);
 
-	if (enable_vpid) {
-		/*
-		 * Trivially support vpid by letting L2s share their parent
-		 * L1's vpid. TODO: move to a more elaborate solution, giving
-		 * each L2 its own vpid and exposing the vpid feature to L1.
-		 */
+	/*
+	 * If vmcs01 don't use VPID, CPU flushes TLB on every
+	 * VMEntry/VMExit. Thus, no need to flush TLB.
+	 *
+	 * If vmcs12 uses VPID, TLB entries populated by L2 are
+	 * tagged with vmx->nested.vpid02 while L1 entries are tagged
+	 * with vmx->vpid. Thus, no need to flush TLB.
+	 *
+	 * Therefore, flush TLB only in case vmcs01 uses VPID and
+	 * vmcs12 don't use VPID as in this case L1 & L2 TLB entries
+	 * are both tagged with vmx->vpid.
+	 */
+	if (enable_vpid &&
+	    !(nested_cpu_has_vpid(vmcs12) && to_vmx(vcpu)->nested.vpid02)) {
 		vmx_flush_tlb(vcpu, true);
 	}