Question about the "TLBs and I-cache are private to each vCPU" guarantee with VTTBR_EL2.CnP

[Wei-Lin Chang]

Hi,

Let me try to answer this:

On Sat, Jul 04, 2026 at 03:45:56PM +0800, Tangnianyao wrote:
> Hi, all
> 
> I'm trying to understand the TLB and I-cache invalidation in
> `kvm_arch_vcpu_load()` that is intended to "guarantee that both TLBs and
> I-cache are private to each vCPU".
> 
> As I understand it, when `VTTBR_EL2.CnP == 1`, `__kvm_flush_cpu_context()`
> only performs a local TLB and I-cache invalidation, which does not seem
> sufficient to guarantee that property.
> 
> In fact, even if the invalidation were extended to the Inner Shareable
> domain, it still seems difficult to guarantee “TLBs and I-cache are
> private to each vCPU”, when `VTTBR_EL2.CnP == 1`, as long as multiple
> vCPUs from the same VM may be running concurrently on different PEs.

I think you have missed that when 2 stages are involved, both stages
have to set CnP == 1 in order to share TLB entries (Arm ARM R_ZVRZW).
So if TLB entry sharing happens, the guest kernel must have allowed it
in the first place (by setting TTBR0/1_EL1.CnP == 1), hence accidental
sharing that you are worried about won't happen.

__kvm_flush_cpu_context() is solving problems that occur when multiple
vCPUs of a VM are multiplexed on a single physical CPU.

> 
> So I have two questions:
> 
> 1. What is the rationale behind the comment that "guarantee that both TLBs
> and I-cache are private to each vCPU"?

I assume you are asking why keeping both TLBs and I-cache private per
each vCPU is required. The fundamental answer is that each physical CPU
is expected to have its own TLB and I-cache, so we must uphold that
property for vCPUs as well. vCPUs can be scheduled on the same physical
CPU, and use the same physical TLB/I-cache, obviously, so extra
invalidations need to be done.

As for how this can go wrong without __kvm_flush_cpu_context(), you can
look at commit 94d0e5980d67 ("arm/arm64: KVM: Perform local TLB
invalidation when multiplexing vcpus on a single CPU") and commit
01dc9262ff57 ("VM: arm64: Ensure I-cache isolation between vcpus of a
same VM"). The commit messages and the linked thread explained the
problems pretty well for me.

> 2. Should the effect of `VTTBR_EL2.CnP` be taken into account when
> reasoning about this guarantee?

Please see the first part of the answer.

Hope this helps!

Thanks,
Wei-Lin Chang

> 
> Thanks
> Nianyao Tang
>