Re: [PATCH v2 18/28] KVM: arm64: nv: Emulate CMOs via writable-clean translations as NOPs

[Oliver Upton <oupton@kernel.org>]

On Wed, Nov 04, 2026 at 05:28:24PM +0000, Leonardo Bras wrote:
> > The writable-clean state is nonexistent when VTCR_EL2.HD=0 in the direct
> > permission model. So we have no way to construct a translation in the
> > stage-2 that satisfies our requirements.
> 
> Since other vcpus will have VTCR_EL2.HD=0, couldn't we enable it just for 
> the sake of processing this CMO?
> 
> I guess it would need to either decode the instruction or single-step this 
> vcpu just to make sure it does not write to the same page we just did mark 
> WC.
> 
> > 
> > The other way to do this would likely involve halting all vCPUs in the
> > VM and attempting to single-step which has a near 100% chance of blowing
> > up in our face.
> 
> Sorry, why all vCPUs?
> 
> I know for all vCPUs it would be terrible for performance, what else 
> do you mean by "blowing up in our face"? 

In order to make this work, you need to guarantee that there's no
concurrent updates to either the instruction itself of the stage-1
translation.

The operations would be, approximately:

 - Take a stage-2 permission fault on the cache maintenance instruction.
   Walk the guest's stage-2 and find a translation in writable-clean
   state.

 - Pause the VM, re-enter the guest and single-step the instruction. If
   we take the debug exception then the guest must've changed the
   instruction. Go back to base state.

 - If we take another stage-2 permission fault for a cache maintenance
   instruction, temporarily promote the translation to RW in the shadow
   stage-2 and re-enter with single-step enabled.

 - Take the debug exception, invalidate the shadow stage-2 translation,
   disarm single-step, restart the VM.

The transient RW mappings seems ripe for pretty nasty bugs.

Thanks,
Oliver