From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A1B18470459; Tue, 21 Jul 2026 20:13:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784664831; cv=none; b=MWxqu8UDHdhVeZr/W9ExWtV8fyFLMesiOoEZcPQCi3foS9LvHB0IxzEceStfSjBsAxduqhYHvkPYO7tbuR4yF3j0SalORUgLPlx21RY2j7uu7hVxyuWW9Q+xmdCLNj5qDYuT3inAwjNof2yrtWQbnIQRYy8akyy6pPecrOpCvDg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784664831; c=relaxed/simple; bh=2NfUNU2tX+OpBG2hddOn95swerFtbqveqTBhCmQZrJ8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=dC5OgGB+vOch+BUWfmNK8EAvoiVftkID6ClwjkkP3Zo7WFpPWsnAMrsET1pkoI29cwDyA1eJzEPv3OEMaIzcB9Yp/n80fbsGQlFTShpzbZo4gd9ATe2MjJQBsI2oit4lImlVVJBPP8o4r2JUIuHu9djaCd8JMWxyU58qywyX6vM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=thYmI4eb; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="thYmI4eb" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1968D1F000E9; Tue, 21 Jul 2026 20:13:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784664830; bh=LxGJMaZ//TAgegOpiAC5bbNmj6/KLeQkiZkn0SiO06Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=thYmI4ebDWIXaCTY6ET0zt4/S7DF5/V0C0bOSS2IahKllcEPBJxJH02kZnkQJqQ2o BcLMeN2CM8o9Od/TZKxWM9OMrm8WWcGVI3u7RpoDkcAubRT5+ljQGJcfGLPaMgiWl8 Nw/pRmsBqEEzyzmuKvvq7Upkx4UK/FuzCQpyDmTc= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Leo Yan , Ahmed Genidi , Mark Rutland , Ben Horgan , Catalin Marinas , Marc Zyngier , Oliver Upton , Will Deacon , Colton Lewis , Sasha Levin Subject: [PATCH 6.6 0074/1266] KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu() Date: Tue, 21 Jul 2026 17:08:31 +0200 Message-ID: <20260721152443.457676577@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260721152441.786066624@linuxfoundation.org> References: <20260721152441.786066624@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Ahmed Genidi [ Upstream commit 3855a7b91d42ebf3513b7ccffc44807274978b3d ] When KVM is in protected mode, host calls to PSCI are proxied via EL2, and cold entries from CPU_ON, CPU_SUSPEND, and SYSTEM_SUSPEND bounce through __kvm_hyp_init_cpu() at EL2 before entering the host kernel's entry point at EL1. While __kvm_hyp_init_cpu() initializes SPSR_EL2 for the exception return to EL1, it does not initialize SCTLR_EL1. Due to this, it's possible to enter EL1 with SCTLR_EL1 in an UNKNOWN state. In practice this has been seen to result in kernel crashes after CPU_ON as a result of SCTLR_EL1.M being 1 in violation of the initial core configuration specified by PSCI. Fix this by initializing SCTLR_EL1 for cold entry to the host kernel. As it's necessary to write to SCTLR_EL12 in VHE mode, this initialization is moved into __kvm_host_psci_cpu_entry() where we can use write_sysreg_el1(). The remnants of the '__init_el2_nvhe_prepare_eret' macro are folded into its only caller, as this is clearer than having the macro. Fixes: cdf367192766ad11 ("KVM: arm64: Intercept host's CPU_ON SMCs") Reported-by: Leo Yan Signed-off-by: Ahmed Genidi [ Mark: clarify commit message, handle E2H, move to C, remove macro ] Signed-off-by: Mark Rutland Cc: Ahmed Genidi Cc: Ben Horgan Cc: Catalin Marinas Cc: Leo Yan Cc: Marc Zyngier Cc: Oliver Upton Cc: Will Deacon Reviewed-by: Leo Yan Link: https://lore.kernel.org/r/20250227180526.1204723-3-mark.rutland@arm.com Signed-off-by: Marc Zyngier [ Backport: Resolved context conflicts when removing the __init_el2_nvhe_prepare_eret macro and invocation: - arch/arm64/include/asm/el2_setup.h: conflicted because 6.6.y lacks later GCS/MPAM macros (__init_el2_gcs / __init_el2_mpam) surrounding the definition. - arch/arm64/kvm/hyp/nvhe/hyp-init.S: conflicted because __kvm_init_el2_state does not exist in 6.6.y (EL2 state is initialized inline). ] Signed-off-by: Colton Lewis Signed-off-by: Sasha Levin --- arch/arm64/include/asm/el2_setup.h | 4 ---- arch/arm64/kernel/head.S | 3 ++- arch/arm64/kvm/hyp/nvhe/hyp-init.S | 1 - arch/arm64/kvm/hyp/nvhe/psci-relay.c | 3 +++ 4 files changed, 5 insertions(+), 6 deletions(-) diff --git a/arch/arm64/include/asm/el2_setup.h b/arch/arm64/include/asm/el2_setup.h index 3498dc5d02c188..76b0d50d286d59 100644 --- a/arch/arm64/include/asm/el2_setup.h +++ b/arch/arm64/include/asm/el2_setup.h @@ -229,10 +229,6 @@ .Lskip_fgt_\@: .endm -.macro __init_el2_nvhe_prepare_eret - mov x0, #INIT_PSTATE_EL1 - msr spsr_el2, x0 -.endm /** * Initialize EL2 registers to sane values. This should be called early on all diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S index ff7769821166a4..9996029853d236 100644 --- a/arch/arm64/kernel/head.S +++ b/arch/arm64/kernel/head.S @@ -601,7 +601,8 @@ SYM_INNER_LABEL(init_el2, SYM_L_LOCAL) msr sctlr_el1, x1 mov x2, xzr 3: - __init_el2_nvhe_prepare_eret + mov x0, #INIT_PSTATE_EL1 + msr spsr_el2, x0 mov w0, #BOOT_CPU_MODE_EL2 orr x0, x0, x2 diff --git a/arch/arm64/kvm/hyp/nvhe/hyp-init.S b/arch/arm64/kvm/hyp/nvhe/hyp-init.S index 3efa9cfaa9d48d..9b2ada54be5384 100644 --- a/arch/arm64/kvm/hyp/nvhe/hyp-init.S +++ b/arch/arm64/kvm/hyp/nvhe/hyp-init.S @@ -207,7 +207,6 @@ SYM_CODE_START_LOCAL(__kvm_hyp_init_cpu) /* Initialize EL2 CPU state to sane values. */ init_el2_state // Clobbers x0..x2 finalise_el2_state - __init_el2_nvhe_prepare_eret /* Enable MMU, set vectors and stack. */ mov x0, x28 diff --git a/arch/arm64/kvm/hyp/nvhe/psci-relay.c b/arch/arm64/kvm/hyp/nvhe/psci-relay.c index d57bcb6ab94d25..5688a16e2ea75d 100644 --- a/arch/arm64/kvm/hyp/nvhe/psci-relay.c +++ b/arch/arm64/kvm/hyp/nvhe/psci-relay.c @@ -218,6 +218,9 @@ asmlinkage void __noreturn __kvm_host_psci_cpu_entry(bool is_cpu_on) if (is_cpu_on) release_boot_args(boot_args); + write_sysreg_el1(INIT_SCTLR_EL1_MMU_OFF, SYS_SCTLR); + write_sysreg(INIT_PSTATE_EL1, SPSR_EL2); + __host_enter(host_ctxt); } -- 2.53.0