KVM flushes the TLB on nested VM-Enter and nested VM-Exit, but not when forcefully leaving nested. In this case, L2 TLB entries can leak into L1. Flush the TLB after forcefully exiting L2, similar to nested VM-Exits. Note that vmx_leave_nested() handles this correctly, as it reuses nested_vmx_vmexit(), which handles the necessary TLB flushes on an L2 -> L1 transition. Cc: stable@vger.kernel.org Signed-off-by: Yosry Ahmed --- arch/x86/kvm/svm/nested.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index 5e3e280cd483e..75378feddb349 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -1553,6 +1553,8 @@ void svm_leave_nested(struct kvm_vcpu *vcpu) svm_switch_vmcb(svm, &svm->vmcb01); + nested_svm_transition_tlb_flush(vcpu); + nested_svm_uninit_mmu_context(vcpu); vmcb_mark_all_dirty(svm->vmcb); -- 2.55.0.229.g6434b31f56-goog