The DBM (Dirty Bit Modifier) attribute, introduced in ARMv8.1, enables hardware to automatically promote write-clean pages to write-dirty. This prevents the guest from being trapped in EL2 due to missing write permissions. In this design, DBM is controlled by the page-table level flag KVM_PGTABLE_S2_DBM rather than per-PTE software flags. DBM is automatically set for writable non-device pages when the page-table has KVM_PGTABLE_S2_DBM flag, which is determined at MMU init time based on hardware capability. The DBM bit is set in stage2_set_prot_attr() for initial mappings and hugepage splitting, and directly manipulated in kvm_pgtable_stage2_relax_perms() when removing write-protection. On W->RO downgrade, DBM is cleared to prevent hardware from silently upgrading RO+DBM back to W+dirty, which would bypass KVM's write tracking. kvm_pgtable_stage2_pte_prot() does not extract the DBM bit back into enum kvm_pgtable_prot because DBM is a page-table policy determined by pgt->flags, not a per-PTE property. Callers should check pgt->flags & KVM_PGTABLE_S2_DBM instead. This ensures DBM is consistently applied across all PTEs, including during hugepage splitting where child PTEs inherit DBM from the parent block entry via the pgt->flags mechanism. Safety: DBM bit is only interpreted by hardware when VTCR_EL2.HD=1. When HDBSS is not enabled (HD=0), ARM architecture guarantees hardware completely ignores DBM bit in PTEs. Co-developed-by: Eillon Signed-off-by: Eillon Co-developed-by: Leonardo Bras Signed-off-by: Leonardo Bras Signed-off-by: Tian Zheng --- arch/arm64/include/asm/kvm_pgtable.h | 4 ++++ arch/arm64/kvm/hyp/pgtable.c | 35 ++++++++++++++++++++++++++-- arch/arm64/kvm/mmu.c | 3 +++ 3 files changed, 40 insertions(+), 2 deletions(-) diff --git a/arch/arm64/include/asm/kvm_pgtable.h b/arch/arm64/include/asm/kvm_pgtable.h index 41a8687938eb..5e0fac4bfa53 100644 --- a/arch/arm64/include/asm/kvm_pgtable.h +++ b/arch/arm64/include/asm/kvm_pgtable.h @@ -93,6 +93,8 @@ typedef u64 kvm_pte_t; #define KVM_PTE_LEAF_ATTR_HI_S2_XN GENMASK(54, 53) +#define KVM_PTE_LEAF_ATTR_HI_S2_DBM BIT(51) + #define KVM_PTE_LEAF_ATTR_HI_S1_GP BIT(50) #define KVM_PTE_LEAF_ATTR_S2_PERMS (KVM_PTE_LEAF_ATTR_LO_S2_S2AP_R | \ @@ -249,10 +251,12 @@ struct kvm_pgtable_mm_ops { * enum kvm_pgtable_stage2_flags - Stage-2 page-table flags. * @KVM_PGTABLE_S2_IDMAP: Only use identity mappings. * @KVM_PGTABLE_S2_AS_S1: Final memory attributes are that of Stage-1. + * @KVM_PGTABLE_S2_DBM: Hardware-managed DBM for writable pages. */ enum kvm_pgtable_stage2_flags { KVM_PGTABLE_S2_IDMAP = BIT(0), KVM_PGTABLE_S2_AS_S1 = BIT(1), + KVM_PGTABLE_S2_DBM = BIT(2), }; /** diff --git a/arch/arm64/kvm/hyp/pgtable.c b/arch/arm64/kvm/hyp/pgtable.c index 91a7dfad6686..21ec456ecc41 100644 --- a/arch/arm64/kvm/hyp/pgtable.c +++ b/arch/arm64/kvm/hyp/pgtable.c @@ -731,9 +731,23 @@ static int stage2_set_prot_attr(struct kvm_pgtable *pgt, enum kvm_pgtable_prot p if (prot & KVM_PGTABLE_PROT_R) attr |= KVM_PTE_LEAF_ATTR_LO_S2_S2AP_R; - if (prot & KVM_PGTABLE_PROT_W) + if (prot & KVM_PGTABLE_PROT_W) { attr |= KVM_PTE_LEAF_ATTR_LO_S2_S2AP_W; + /* + * Set DBM bit for writable non-device pages if the page-table + * has KVM_PGTABLE_S2_DBM flag (system supports HDBSS). + * + * For stage 2 translations using Indirect permissions, if the + * Effective value of VTCR_EL2.HD is 0, then dirty state is + * managed by software. Hardware only updates the dirty state + * when VTCR_EL2.HD=1 (HDBSS enabled). + */ + if ((pgt->flags & KVM_PGTABLE_S2_DBM) && + !(prot & KVM_PGTABLE_PROT_DEVICE)) + attr |= KVM_PTE_LEAF_ATTR_HI_S2_DBM; + } + if (!kvm_lpa2_is_enabled()) attr |= FIELD_PREP(KVM_PTE_LEAF_ATTR_LO_S2_SH, sh); @@ -1367,9 +1381,26 @@ int kvm_pgtable_stage2_relax_perms(struct kvm_pgtable *pgt, u64 addr, if (prot & KVM_PGTABLE_PROT_R) set |= KVM_PTE_LEAF_ATTR_LO_S2_S2AP_R; - if (prot & KVM_PGTABLE_PROT_W) + if (prot & KVM_PGTABLE_PROT_W) { set |= KVM_PTE_LEAF_ATTR_LO_S2_S2AP_W; + /* + * No DEVICE filter needed here: relax_perms is only called + * on FSC_PERM faults. Device pages always get full RW from + * initial mapping and are never write-protected during + * migration, so they never trigger a permission fault. + */ + if (pgt->flags & KVM_PGTABLE_S2_DBM) + set |= KVM_PTE_LEAF_ATTR_HI_S2_DBM; + } else { + /* + * Clear DBM on W→RO downgrade to prevent hardware from + * silently upgrading RO+DBM back to W+dirty, which would + * bypass KVM's write tracking and cause data corruption. + */ + clr |= KVM_PTE_LEAF_ATTR_HI_S2_DBM; + } + ret = stage2_set_xn_attr(prot, &xn); if (ret) return ret; diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c index e086c01a9325..346efed6e605 100644 --- a/arch/arm64/kvm/mmu.c +++ b/arch/arm64/kvm/mmu.c @@ -1014,6 +1014,9 @@ int kvm_init_stage2_mmu(struct kvm *kvm, struct kvm_s2_mmu *mmu, unsigned long t if (err) goto out_free_pgtable; + if (system_supports_hdbss()) + pgt->flags |= KVM_PGTABLE_S2_DBM; + mmu->pgt = pgt; if (is_protected_kvm_enabled()) return 0; -- 2.33.0