On Thu, Jan 16, 2025 at 7:14 PM Michael Kelley <mhklinux@xxxxxxxxxxx> wrote: > We had an earlier thread about INVLPGB/TLBSYNC in a VM [1]. It > turns out that Hyper-V in the Azure public cloud enables > INVLPGB/TLBSYNC in Confidential VMs (CVMs, which conform to the > Linux concept of a CoCo VM) running on AMD processors using SEV-SNP. > The CPUID instruction in a such a VM reports the enablement as > expected. The instructions are *not* enabled in general purpose VMs > running on the same AMD processors. The enablement is a natural > outgrowth of CoCo VM's wanting to be able to avoid a dependency on > the untrusted hypervisor to perform TLB flushes. What is this current dependency on the untrusted hypervisor? Is it just the PV TLB flushing optimization for preempted vCPUs? The normal x86 TLB flushing machinery waits for confirmation from the other vCPUs in smp_call_function_many_cond(), and the hypervisor shouldn't be able to fake that confirmation, right? Can you avoid this issue by disabling the PV TLB flushing optimization?
