Re: [PATCH v2 21/28] KVM: arm64: Add NVHCR_EL2 handling to the sysreg array

[Marc Zyngier <maz@kernel.org>]

On Tue, 14 Jul 2026 11:24:21 +0100,
sashiko-bot@kernel.org wrote:
> 
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Medium] Userspace writes to NVHCR_EL2 via KVM_SET_ONE_REG are silently discarded upon L1 guest entry.
> --
> 
> --- Patch [21]: [PATCH v2 21/28] KVM: arm64: Add NVHCR_EL2 handling to the sysreg array ---
> commit 40ce0e0627839603da739968567e9f3998f1ed15
> Author: Marc Zyngier <maz@kernel.org>
> 
> KVM: arm64: Add NVHCR_EL2 handling to the sysreg array
> 
> Expose NVHCR_EL2 to userspace, and treat the direct access as UNDEF,
> as that would only outline a bug in our exception routing.
> 
> > diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
> > index 9439c5b2b1fe8..0aeb2e736fde3 100644
> > --- a/arch/arm64/kvm/sys_regs.c
> > +++ b/arch/arm64/kvm/sys_regs.c
> 
> [ ... ]
> 
> > @@ -3774,6 +3800,8 @@ static const struct sys_reg_desc sys_reg_descs[] = {
> >  			 sve_el2_visibility),
> >  
> >  	EL2_REG_VNCR(HCRX_EL2, reset_val, 0),
> > +	EL2_REG_FILTERED(NVHCR_EL2, undef_access, reset_val, 0,
> > +			 nvhcr_el2_visibility),
> 
> [Severity: Medium]
> Will userspace writes to NVHCR_EL2 be silently discarded upon L1 guest entry?

Short answer: no. Longer answer follows.

> Because NVHCR_EL2 is exposed without a custom .set_user handler, writes via
> KVM_SET_ONE_REG will update vcpu->arch.ctxt.sys_regs[NVHCR_EL2] using the
> default behavior. However, upon running the VCPU in hyp_ctxt (L1 hypervisor),
> __compute_hcr() unconditionally executes:
> 
>   __vcpu_assign_sys_reg(vcpu, NVHCR_EL2, __vcpu_sys_reg(vcpu, HCR_EL2));

If userspace can write to NVHCR_EL2, that's because the guest has NV3
exposed to it. And if so, then the host also has NV3 and is using it.
Then the code looks like this:

	/* Publish the guest's view of HCR_EL2 to the HW */
	if (cpus_have_final_cap(ARM64_HAS_NV3) && vcpu_el2_e2h_is_set(vcpu))
		write_sysreg_s(__vcpu_sys_reg(vcpu, HCR_EL2), SYS_NVHCR_EL2);
	else
		__vcpu_assign_sys_reg(vcpu, NVHCR_EL2, __vcpu_sys_reg(vcpu, HCR_EL2));

and the value of HCR_EL2 is written into the NVHCR_EL2 *register*.

>
> This seems to clobber the userspace write, causing UAPI state loss and a KVM
> ABI violation where KVM_SET_ONE_REG writes are expected to be preserved.

See above?

>
> Does this require a custom .set_user handler to maintain alias synchronization
> between NVHCR_EL2 and HCR_EL2?

No.

	M.

-- 
Without deviation from the norm, progress is not possible.