Subject: [PATCH] arm64: KVM: Take S1 walks into account when determining S2 write faults

From: [email-masked] (Christoffer Dall)
Date: Thu, 29 Sep 2016 21:14:32 +0200

On Thu, Sep 29, 2016 at 12:37:01PM +0100, Will Deacon wrote:
> The WnR bit in the HSR/ESR_EL2 indicates whether a data abort was
> generated by a read or a write instruction. For stage 2 data aborts
> generated by a stage 1 translation table walk (i.e. the actual page
> table access faults at EL2), the WnR bit therefore reports whether the
> instruction generating the walk was a load or a store, *not* whether the
> page table walker was reading or writing the entry.
> 
> For page tables marked as read-only at stage 2 (e.g. due to KSM merging
> them with the tables from another guest), this could result in livelock,
> where a page table walk generated by a load instruction attempts to
> set the access flag in the stage 1 descriptor, but fails to trigger
> CoW in the host since only a read fault is reported.
> 
> This patch modifies the arm64 kvm_vcpu_dabt_iswrite function to
> take into account stage 2 faults in stage 1 walks. Since DBM cannot be
> disabled at EL2 for CPUs that implement it, we assume that these faults
> are always causes by writes, avoiding the livelock situation at the
> expense of occasional, spurious CoWs.
> 
> We could, in theory, do a bit better by checking the guest TCR
> configuration and inspecting the page table to see why the PTE faulted.
> However, I doubt this is measurable in practice, and the threat of
> livelock is real.
> 
> Cc: Marc Zyngier <[email-masked]>
> Cc: Christoffer Dall <[email-masked]>
> Cc: Julien Grall <[email-masked]>
> Signed-off-by: Will Deacon <[email-masked]>

Reviewed-by: Christoffer Dall <[email-masked]>

Applied,
-Christoffer