Explain why mstatus.TVM doesn't affect vsatp, HFENCE.VVMA (#779)

1 files changed, 29 insertions, 0 deletions

diff --git a/src/hypervisor.tex b/src/hypervisor.tex
index 5a9be40..27a0b4c 100644
--- a/src/hypervisor.tex
+++ b/src/hypervisor.tex
@@ -2181,6 +2181,35 @@ Setting TVM=1 prevents HS-mode from accessing {\tt hgatp} or executing
 HFENCE.GVMA or HINVAL.GVMA, but has no effect on accesses to {\tt vsatp} or
 instructions HFENCE.VVMA or HINVAL.VVMA.
 
+\begin{commentary}
+TVM exists in {\tt mstatus} to allow machine-level software to modify
+the address translations managed by a supervisor-level OS, usually for
+the purpose of inserting another stage of address translation below
+that controlled by the OS.
+The instruction traps enabled by TVM=1 permit machine level
+to co-opt both {\tt satp} and {\tt hgatp} and substitute
+\emph{shadow page tables} that merge the OS's chosen page translations
+with M-level's lower-stage translations, all without the OS being
+aware.
+M-level software needs this ability not only to emulate the hypervisor
+extension if not already supported, but also to emulate any future
+\mbox{RISC-V} extensions that may modify or add address translation
+stages, perhaps, for example, to improve support for nested
+hypervisors, i.e., running hypervisors atop other hypervisors.
+
+However, setting TVM=1 does not cause traps for accesses to {\tt vsatp}
+or instructions HFENCE.VVMA or HINVAL.VVMA, or for any actions taken
+in VS-mode, because M-level software is not expected to need to involve
+itself in VS-stage address translation.
+For virtual machines, it should be sufficient, and in all likelihood
+faster as well, to leave VS-stage address translation alone and merge
+all other translation stages into G-stage shadow page tables controlled
+by {\tt hgatp}.
+This assumption does place some constraints on possible future
+\mbox{RISC-V} extensions that current machines will be able to emulate
+efficiently.
+\end{commentary}
+
 The hypervisor extension changes the behavior of the the Modify Privilege
 field, MPRV, of {\tt mstatus}.
 When MPRV=0, translation and protection behave as normal.