Re: [PATCH] x86/np2m: flush the np2m on an SVM nested TLB flush

[Ross Lagerwall <ross.lagerwall@xxxxxxxxxx>]

On 10/20/26 10:34 AM, Stephen Cheng wrote:
> On SVM, L1 flushes what is cached from its nested page tables by setting
> TLB_CONTROL or using a new ASID on VMRUN.  Either sets nv_flushp2m, which
> p2m_get_nestedp2m_locked() handles by only dropping nv_p2m.  Since np2ms
> are shared between vCPUs, the lookup then finds the np2m for the same
> N_CR3 and reuses it as is, so L2 keeps the mappings from before L1 changed
> its NPT.
>
> Flush that np2m before reusing it, as nested VMX does via
> np2m_flush_base() on INVEPT.
>
> Fixes: 6df4b481b0c5 ("x86/np2m: implement sharing of np2m between vCPUs")
> Signed-off-by: Stephen Cheng <stephen.cheng@xxxxxxxxxx>
> Assisted-by: Claude:claude-opus-5-5
> ---
> Ross Lagerwall has a partial fix for this in the XenServer internal patch
> queue, which was also part of v1 of Chunjie Zhu's "x86/nestedsvm: rework
> nested VMRUN/VMEXIT handling" series (patch 5/5, dropped in v2):
> https://lore.kernel.org/xen-devel/20260924091605.344577-1-chunjie.zhu@xxxxxxxxxx/
>
> It flushes nv_p2m, the np2m this vCPU used last, before dropping it:
>
>           if ( nv->nv_flushp2m && nv->nv_p2m )
>      +    {
>      +        p2m = nv->nv_p2m;
>      +        if ( p2m )
>      +            p2m_flush_table(p2m);
>               nv->nv_p2m = NULL;
>      +    }
>
> That covers a vCPU re-entering the same N_CR3, but not one entering an
> N_CR3 whose np2m another vCPU filled: on its first VMRUN (nv_p2m is NULL),
> with an ASID new to it, or when switching N_CR3.  This patch flushes the
> np2m for the incoming N_CR3 instead, which covers all of these.
I think this is useful information and should be in the commit message.

> Tested with an XTF test that is not yet upstream: L1 repoints an NPT
> entry, then enters L2 on another vCPU or N_CR3 under a new ASID.  L2 saw
> the old frame before this patch and sees the new one with it.
>
>   xen/arch/x86/mm/p2m.c | 4 ++++
>   1 file changed, 4 insertions(+)
>
> diff --git a/xen/arch/x86/mm/p2m.c b/xen/arch/x86/mm/p2m.c
> index 027b9ae69b..52cadd9b25 100644
> --- a/xen/arch/x86/mm/p2m.c
> +++ b/xen/arch/x86/mm/p2m.c
> @@ -1547,7 +1547,11 @@ p2m_get_nestedp2m_locked(struct vcpu *v)
>           p2m_lock(p2m);
>   
>           if ( p2m->np2m_base == np2m_base )
> +        {
> +            if ( nv->nv_flushp2m )
> +                p2m_flush_table_locked(p2m);
>               goto found;
> +        }
>   
>           p2m_unlock(p2m);
>       }
With the above commit message tweak,

Reviewed-by: Ross Lagerwall <ross.lagerwall@xxxxxxxxxx>