Re: [PATCH v1 08/28] KVM: SEV: Do ASID initialization at VMCB initialization

[Yosry Ahmed]

On Mon, Jul 27, 2026 at 5:36 PM Yosry Ahmed <yosry@xxxxxxxxxx> wrote:
>
> The per-vCPU ASID does not change for SEV guests, so move the per-vCPU
> (and per-VMCB) ASID initialization to sev_init_vmcb() to do it once,
> instead of checking before every VMRUN.
>
> No functional change intended.
>
> Signed-off-by: Yosry Ahmed <yosry@xxxxxxxxxx>
> ---
>  arch/x86/kvm/svm/sev.c | 12 ++++--------
>  1 file changed, 4 insertions(+), 8 deletions(-)
>
> diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
> index 0e5046a12a970..8717da0e9fe8a 100644
> --- a/arch/x86/kvm/svm/sev.c
> +++ b/arch/x86/kvm/svm/sev.c
> @@ -3580,14 +3580,6 @@ int pre_sev_run(struct vcpu_svm *svm, int cpu)
>         if (!cpumask_test_cpu(cpu, to_kvm_sev_info(kvm)->have_run_cpus))
>                 cpumask_set_cpu(cpu, to_kvm_sev_info(kvm)->have_run_cpus);
>
> -       /* Assign the asid allocated with this SEV guest */
> -       svm->asid = asid;
> -
> -       if (unlikely(svm->asid != svm->vmcb->control.asid)) {
> -               svm->vmcb->control.asid = asid;
> -               vmcb_mark_dirty(svm->vmcb, VMCB_ASID);
> -       }
> -

>From internal Sashiko:
---
Does removing this dynamic ASID assignment break nested virtualization for
SEV guests?

If a guest is configured with both SEV and nested virtualization, KVM
switches svm->vmcb to the dynamically allocated vmcb02 when intercepting
VMRUN.

Since vmcb02 is zero-allocated during svm_allocate_nested(), and
sev_init_vmcb() is only called for vmcb01 during initial vCPU creation, won't
vmcb02->control.asid remain 0?

When KVM then executes VMRUN to enter the nested guest, it seems the hardware
would reject the invalid ASID (0) and immediately crash the guest via a
hypervisor entry failure (SVM_EXIT_ERR).

---

Yeah I think this is correct, but it gets fixed in patch 12 when we
explicitly initialize the ASID in vmcb02. I can fix it if I re-spin,
but I am not sure how much we care about breaking bisection for nested
on SEV.

>         /*
>          * Flush guest TLB:
>          *
> @@ -4829,6 +4821,10 @@ void sev_init_vmcb(struct vcpu_svm *svm, bool init_event)
>         svm->vmcb->control.misc_ctl |= SVM_MISC_ENABLE_SEV;
>         clr_exception_intercept(svm, UD_VECTOR);
>
> +       svm->asid = sev_get_asid(vcpu->kvm);
> +       svm->vmcb->control.asid = svm->asid;
> +       vmcb_mark_dirty(svm->vmcb, VMCB_ASID);
> +
>         /*
>          * Don't intercept #GP for SEV guests, e.g. for the VMware backdoor, as
>          * KVM can't decrypt guest memory to decode the faulting instruction.
> --
> 2.55.0.229.g6434b31f56-goog
>