Re: [PATCH v2 18/28] KVM: arm64: nv: Emulate CMOs via writable-clean translations as NOPs

[Leonardo Bras <leo.bras@arm.com>]

On Fri, Oct 23, 2026 at 01:56:00PM -0700, Oliver Upton wrote:
> Virtualizing FEAT_HAFDBS for an L1 hypervisor has a pretty large
> architectural deficiency by way of cache maintenance instructions.
> CMOs (e.g. DC IVAC) require write permission but do not set the dirty
> state on the descriptor.
> 
> There's no way to shadow a writable-clean translation in such a way that
> these CMOs pass the permission check and subsequent writes generate a
> permission fault. Worse yet, data aborts taken on CMOs do not have
> sufficient syndrome information to perform instruction emulation and
> trapping all CMOs is unpalatable.
> 
> So what do we do? Absolutely nothing. Treat CMOs to writable-clean
> translations as NOPs in anticipation of KVM only exposing FEAT_HAFDBS
> when the VM is fully coherent (FEAT_S2FWB, CTR_EL0.{DIC,IDC}={1,1}, no
> noncoherent DMA).
> 
> Signed-off-by: Oliver Upton <oupton@kernel.org>
> ---
>  arch/arm64/kvm/mmu.c    |  4 ++++
>  arch/arm64/kvm/nested.c | 20 ++++++++++++++++++++
>  2 files changed, 24 insertions(+)
> 
> diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
> index 7b29be33a1ea..a21b674a1981 100644
> --- a/arch/arm64/kvm/mmu.c
> +++ b/arch/arm64/kvm/mmu.c
> @@ -2548,6 +2548,10 @@ int kvm_handle_guest_abort(struct kvm_vcpu *vcpu)
>  		}
>  
>  		ret = kvm_s2_handle_perm_fault(vcpu, &nested_trans);
> +		if (ret == -EAGAIN) {
> +			ret = 1;
> +			goto out_unlock;
> +		}
>  		if (ret) {
>  			esr = nested_trans.esr;
>  			kvm_inject_s2_fault(vcpu, esr);
> diff --git a/arch/arm64/kvm/nested.c b/arch/arm64/kvm/nested.c
> index 7dda95d37925..46fcc75f4c20 100644
> --- a/arch/arm64/kvm/nested.c
> +++ b/arch/arm64/kvm/nested.c
> @@ -1150,6 +1150,26 @@ int kvm_s2_handle_perm_fault(struct kvm_vcpu *vcpu, struct kvm_s2_trans *trans)
>  	} else {
>  		bool write_fault = kvm_is_write_fault(vcpu);
>  
> +		/*
> +		 * Plug your nose for a moment.
> +		 *
> +		 * Writable-clean translations are shadowed using a read-only
> +		 * mapping so KVM can set the dirty state on the L1 descriptor
> +		 * before installing a writable mapping.
> +		 *
> +		 * Certain cache maintenance instructions require a write
> +		 * permission check but leave the translation in a writable-clean
> +		 * state, meaning KVM is on the hook to emulate CMOs that use a
> +		 * writable-clean translation.
> +		 *
> +		 * "Emulate" the CMO as a NOP, as KVM only exposes FEAT_HAFDBS
> +		 * when FEAT_S2FWB is present and the I-cache is coherent.
> +		 */
> +		if (kvm_vcpu_dabt_is_cm(vcpu) && trans->writable && !trans->dirty) {
> +			kvm_incr_pc(vcpu);
> +			return -EAGAIN;
> +		}
> +
>  		forward_fault = ((write_fault && !trans->writable) ||
>  				 (!write_fault && !trans->readable));
>  	}

Maybe it's just to messy or plain wrong, but could we make the descriptor 
WC, then run the said DC instruction, then make it RO again?

I mean, maybe I got it wrong, but if we can't enable HAFDBS for the 
nested guest, as updating a shadow PTE from WC->WD would require us to 
take a fault to update the PTE inside the guest hypervisor, we could have 
the PTE as WC without risking it to be promoted to WD by hardware.

I am probably missing something.

Thanks!
Leo