Merge pull request #600 from msft-jlange/smp_tlb

cpu: restrict IPI-based TLB flush to multi-proc environments

kernel/src/cpu/smp.rs

@@ -12,6 +12,7 @@ use crate::cpu::idt::idt;
 use crate::cpu::percpu::{this_cpu, this_cpu_shared, PerCpu};
 use crate::cpu::shadow_stack::{is_cet_ss_supported, SCetFlags, MODE_64BIT, S_CET};
 use crate::cpu::sse::sse_init;
+use crate::cpu::tlb::set_tlb_flush_smp;
 use crate::enable_shadow_stacks;
 use crate::error::SvsmError;
 use crate::hyperv;
@@ -44,6 +45,13 @@ pub fn start_secondary_cpus(platform: &dyn SvsmPlatform, cpus: &[ACPICPUInfo]) {
     let mut count: usize = 0;
     for c in cpus.iter().filter(|c| c.apic_id != 0 && c.enabled) {
         log::info!("Launching AP with APIC-ID {}", c.apic_id);
+
+        // If this is the first AP being started, then advise the TLB package
+        // that future TLB flushes will have to be done with SMP scope.
+        if count == 0 {
+            set_tlb_flush_smp();
+        }
+
         start_cpu(platform, c.apic_id).expect("Failed to bring CPU online");
         count += 1;
     }

kernel/src/svsm.rs

@@ -27,7 +27,6 @@ use svsm::cpu::shadow_stack::{
 };
 use svsm::cpu::smp::start_secondary_cpus;
 use svsm::cpu::sse::sse_init;
-use svsm::cpu::tlb::set_tlb_flush_smp;
 use svsm::debug::gdbstub::svsm_gdbstub::{debug_break, gdbstub_start};
 use svsm::debug::stacktrace::print_stack;
 use svsm::enable_shadow_stacks;
@@ -308,10 +307,6 @@ pub extern "C" fn svsm_main() {
 
     log::info!("{} CPU(s) present", nr_cpus);
 
-    // Advise the TLB package that future TLB flushes will have to be done with
-    // SMP scope.
-    set_tlb_flush_smp();
-
     start_secondary_cpus(&**SVSM_PLATFORM, &cpus);
 
     invalidate_early_boot_memory(&**SVSM_PLATFORM, &config, launch_info)