KVM nested SVM drops blanket TLB flushes with per-vCPU L2 ASIDs

KVM is poised to stop flushing the entire TLB on every nested SVM transition. A 28-patch series from Yosry Ahmed assigns each vCPU a dedicated ASID for its L2 guest, the same approach VMX already uses for VPIDs, and drops the unconditional flushes that nested guests have paid on every entry and exit.

Until now, nested SVM shared one ASID between L1 and L2. Sharing forced KVM to invalidate everything whenever control crossed the nested boundary, even when nothing in the TLB needed to change. Ahmed also replaces the old dynamic ASID allocator with a static ASID per vCPU (two when nested). Modern AMD parts from Rome through Turin advertise 32K ASIDs, so the dynamic scheme is no longer justified.

With separate tags, flushes become conditional: KVM invalidates only when L1 requests it, when the L2 ASID changes, or when host-side mapping updates require it. SEV guests remain an exception; hardware constraints keep L1 and L2 on the same ASID, so those paths still flush on nested transitions. On a Turin CPU the change delivered an 8-15% improvement in a CPUID-rate microbenchmark and in netperf TCP_RR latency and throughput.

The series adds a selftest that covers guest-triggered and KVM-triggered flush scenarios for both SVM and VMX, and was stress-tested under multi-level memory and CPU overcommit. SEV and Hyper-V paths received only build testing. Automated review later flagged ASID lifetime issues around SEV live migration that Ahmed said he would fix on a respin.