Re: [PATCH kvmtool v6 6/6] arm64: Handle virtio endianness reset when running nested

[Marc Zyngier <maz@kernel.org>]

On Wed, 11 Feb 2026 13:12:49 +0000,
Andre Przywara <andre.przywara@arm.com> wrote:
> 
> From: Marc Zyngier <maz@kernel.org>
> 
> When running an EL2 guest, we need to make sure we don't sample
> SCTLR_EL1 to work out the virtio endianness, as this is likely
> to be a bit random.
> 
> Signed-off-by: Marc Zyngier <maz@kernel.org>
> Signed-off-by: Andre Przywara <andre.przywara@arm.com>
> ---
>  arm64/include/kvm/kvm-cpu-arch.h |  5 ++--
>  arm64/kvm-cpu.c                  | 47 +++++++++++++++++++++++++-------
>  2 files changed, 40 insertions(+), 12 deletions(-)
> 
> diff --git a/arm64/include/kvm/kvm-cpu-arch.h b/arm64/include/kvm/kvm-cpu-arch.h
> index 1af394a..85646ad 100644
> --- a/arm64/include/kvm/kvm-cpu-arch.h
> +++ b/arm64/include/kvm/kvm-cpu-arch.h
> @@ -10,8 +10,9 @@
>  #define ARM_MPIDR_HWID_BITMASK	0xFF00FFFFFFUL
>  #define ARM_CPU_ID		3, 0, 0, 0
>  #define ARM_CPU_ID_MPIDR	5
> -#define ARM_CPU_CTRL		3, 0, 1, 0
> -#define ARM_CPU_CTRL_SCTLR_EL1	0
> +#define SYS_SCTLR_EL1		3, 4, 1, 0, 0
> +#define SYS_SCTLR_EL2		3, 4, 1, 0, 0

Sascha pointed out this howler of a bug last time: SCTLR_EL1 and EL2
have the same encoding here, which is obviously wrong.

This is definitely introducing a regression on EL1 guests.

> +#define SYS_HCR_EL2		3, 4, 1, 1, 0
>  
>  struct kvm_cpu {
>  	pthread_t	thread;
> diff --git a/arm64/kvm-cpu.c b/arm64/kvm-cpu.c
> index 5e4f3a7..35e1c63 100644
> --- a/arm64/kvm-cpu.c
> +++ b/arm64/kvm-cpu.c
> @@ -12,6 +12,7 @@
>  
>  #define SCTLR_EL1_E0E_MASK	(1 << 24)
>  #define SCTLR_EL1_EE_MASK	(1 << 25)
> +#define HCR_EL2_TGE		(1 << 27)
>  
>  static int debug_fd;
>  
> @@ -408,7 +409,8 @@ int kvm_cpu__get_endianness(struct kvm_cpu *vcpu)
>  {
>  	struct kvm_one_reg reg;
>  	u64 psr;
> -	u64 sctlr;
> +	u64 sctlr, bit;
> +	u64 hcr = 0;
>  
>  	/*
>  	 * Quoting the definition given by Peter Maydell:
> @@ -419,8 +421,9 @@ int kvm_cpu__get_endianness(struct kvm_cpu *vcpu)
>  	 * We first check for an AArch32 guest: its endianness can
>  	 * change when using SETEND, which affects the CPSR.E bit.
>  	 *
> -	 * If we're AArch64, use SCTLR_EL1.E0E if access comes from
> -	 * EL0, and SCTLR_EL1.EE if access comes from EL1.
> +	 * If we're AArch64, determine which SCTLR register to use,
> +	 * depending on NV being used or not. Then use either the E0E
> +	 * bit for EL0, or the EE bit for EL1/EL2.
>  	 */
>  	reg.id = ARM64_CORE_REG(regs.pstate);
>  	reg.addr = (u64)&psr;
> @@ -430,16 +433,40 @@ int kvm_cpu__get_endianness(struct kvm_cpu *vcpu)
>  	if (psr & PSR_MODE32_BIT)
>  		return (psr & COMPAT_PSR_E_BIT) ? VIRTIO_ENDIAN_BE : VIRTIO_ENDIAN_LE;
>  
> -	reg.id = ARM64_SYS_REG(ARM_CPU_CTRL, ARM_CPU_CTRL_SCTLR_EL1);
> +	if (vcpu->kvm->cfg.arch.nested_virt) {
> +		reg.id = ARM64_SYS_REG(SYS_HCR_EL2);
> +		reg.addr = (u64)&hcr;
> +		if (ioctl(vcpu->vcpu_fd, KVM_GET_ONE_REG, &reg) < 0)
> +			die("KVM_GET_ONE_REG failed (HCR_EL2)");
> +	}
> +
> +	switch (psr & PSR_MODE_MASK) {
> +	case PSR_MODE_EL0t:
> +		if (hcr & HCR_EL2_TGE)
> +			reg.id = ARM64_SYS_REG(SYS_SCTLR_EL2);
> +		else
> +			reg.id = ARM64_SYS_REG(SYS_SCTLR_EL1);
> +		bit = SCTLR_EL1_E0E_MASK;
> +		break;

And this is also buggy, as I pointed out in my review of v5 -- I even
provided a fix for it [1].

	M.

[1] https://lore.kernel.org/all/86jyx8b9l2.wl-maz@kernel.org/

-- 
Without deviation from the norm, progress is not possible.