Question about the "TLBs and I-cache are private to each vCPU" guarantee with VTTBR_EL2.CnP

[Tangnianyao]

Hi, all

I'm trying to understand the TLB and I-cache invalidation in
`kvm_arch_vcpu_load()` that is intended to "guarantee that both TLBs and
I-cache are private to each vCPU".

As I understand it, when `VTTBR_EL2.CnP == 1`, `__kvm_flush_cpu_context()`
only performs a local TLB and I-cache invalidation, which does not seem
sufficient to guarantee that property.

In fact, even if the invalidation were extended to the Inner Shareable
domain, it still seems difficult to guarantee “TLBs and I-cache are
private to each vCPU”, when `VTTBR_EL2.CnP == 1`, as long as multiple
vCPUs from the same VM may be running concurrently on different PEs.

So I have two questions:

1. What is the rationale behind the comment that "guarantee that both TLBs
and I-cache are private to each vCPU"?
2. Should the effect of `VTTBR_EL2.CnP` be taken into account when
reasoning about this guarantee?

Thanks
Nianyao Tang