1 files changed, 12 insertions, 0 deletions

diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index e2ee264740c7..8233b86c778c 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -62,6 +62,7 @@ static int npt = 1;
 module_param(npt, int, S_IRUGO);
 
 static void kvm_reput_irq(struct vcpu_svm *svm);
+static void svm_flush_tlb(struct kvm_vcpu *vcpu);
 
 static inline struct vcpu_svm *to_svm(struct kvm_vcpu *vcpu)
 {
@@ -878,6 +879,10 @@ set:
 static void svm_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
 {
         unsigned long host_cr4_mce = read_cr4() & X86_CR4_MCE;
+        unsigned long old_cr4 = to_svm(vcpu)->vmcb->save.cr4;
+
+        if (npt_enabled && ((old_cr4 ^ cr4) & X86_CR4_PGE))
+                force_new_asid(vcpu);
 
         vcpu->arch.cr4 = cr4;
         if (!npt_enabled)
@@ -1027,6 +1032,13 @@ static int pf_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
                 KVMTRACE_3D(TDP_FAULT, &svm->vcpu, error_code,
                             (u32)fault_address, (u32)(fault_address >> 32),
                             handler);
+        /*
+         * FIXME: Tis shouldn't be necessary here, but there is a flush
+         * missing in the MMU code. Until we find this bug, flush the
+         * complete TLB here on an NPF
+         */
+        if (npt_enabled)
+                svm_flush_tlb(&svm->vcpu);
 
         if (event_injection)
                 kvm_mmu_unprotect_page_virt(&svm->vcpu, fault_address);