Re: Re: [PATCH v1] x86/nSVM: Expose the FlushByASID CPU Capability to L1 guests

[Abdelkareem Abdelsaamad <abdelkareem.abdelsaamad@xxxxxxxxxx>]

On 13.08.2026 17:29, Jan Beulich wrote:
>On 13.08.2026 16:56, Abdelkareem Abdelsaamad wrote:
>> On the AMD platforms, the Xen hypervisor requires the FlushByASID CPU
>> capability to support HVM nested virtualization (see start_nested_svm).
>> Consequently, the L1 hypervisor must report FlushByASID CPU capability 
>> support
>> when intercepting CPUID instruction for the CPU feature from the L2 guest to
>> support nested virtualization levels beyond L1. Extend the exposed HVM CPU
>> policy to surface this CPU feature support for the guests.
>
>While the change makes sense, I have to admit that I consider it a stretch
>to justify changes by multi-level nesting, when a single level of nesting
>is in need of a lot of work to actually behave sensibly. Further, "to
>support nested virtualization levels beyond L1" looks pretty Xen-centric:
>Other hypervisors may permit this without the feature.
I believe the change is actually necessary for the single-level nesting
support. Xen was meant only as an example of an L1 hypervisor requiring this
feature from L0; VMware has the same requirement (see Launchpad Bug #2008583).
I will update the commit message in v2 to clarify this and remove the
Xen-centric phrasing. Just to ensure we are aligned—did you have any concerns
that exposing this feature can cause incorrect behavior?
>
>> While at it remove the dangling `exitinfo1 = ns_vmcb->exitinfo1;` assignment
>> inside the nested exit handling of svm_vmexit_handler().
>
>Unrelated adjustments to somewhat nearby or related code are generally
>okay, but here you're touching a different file and entirely unrelated
>code. I think the two changes want splitting.
I agree. I will drop in v2. I just came across it while verifying the VMExit
for the CPUID intercept is properly injected into the L2.
>
>And the CPUID test that XTF has wasn't suitable?
I tried with the CPUID test from the XTF, it does require nestedhvm=1 in the
configuration but it gave the same results. I will update the testing
section accordingly in v2.
>Finally: Can you please drop Roger's old email address that you still
>had on Cc?
I will correct it.
>
>Jan