Re: [PATCH v2 23/28] KVM: arm64: Add NVHCR_EL2 context switching

[Marc Zyngier <maz@kernel.org>]

On Tue, 14 Jul 2026 11:03:21 +0100,
sashiko-bot@kernel.org wrote:
> 
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] A guest can leak the SYS_NVHCR_EL2 hardware register state of a previous vCPU by configuring E2H=0 and NVTGE=1.
> --
> 
> --- Patch [23]: [PATCH v2 23/28] KVM: arm64: Add NVHCR_EL2 context switching ---
> commit d9946edce781237514b1a1fe42315834ea75838a
> Author: Marc Zyngier <maz@kernel.org>
> 
> KVM: arm64: Add NVHCR_EL2 context switching
> 
> This commit introduces context switching for the NVHCR_EL2 register to
> support nested virtualization. For an L1 guest in hyp context, the register
> is eagerly synced with HCR_EL2 emulation. For an L2 guest, it is context
> switched as an EL1 register if NV3 is in use.
> 
> > diff --git a/arch/arm64/kvm/hyp/include/hyp/sysreg-sr.h b/arch/arm64/kvm/hyp/include/hyp/sysreg-sr.h
> > index a17cbe7582de9..c382848d31947 100644
> > --- a/arch/arm64/kvm/hyp/include/hyp/sysreg-sr.h
> > +++ b/arch/arm64/kvm/hyp/include/hyp/sysreg-sr.h
> > @@ -172,6 +172,10 @@ static inline void __sysreg_save_el1_state(struct kvm_cpu_context *ctxt)
> >  
> >  	if (ctxt_has_sctlr2(ctxt))
> >  		ctxt_sys_reg(ctxt, SCTLR2_EL1) = read_sysreg_el1(SYS_SCTLR2);
> > +
> > +	/* Retrieve L2's HCR_EL2, and save it for future use */
> > +	if (is_nested_nv3_ctxt(ctxt_to_vcpu(ctxt)))
> > +		ctxt_sys_reg(ctxt, NVHCR_EL2) = read_sysreg_s(SYS_NVHCR_EL2);
> 
> [Severity: High]
> Does this create an asymmetry with how __compute_hcr() initializes the
> register?
> 
> In __compute_hcr(), the write to SYS_NVHCR_EL2 is gated by an E2H check:
> 
> 	if (cpus_have_final_cap(ARM64_HAS_NV3) && vcpu_el2_e2h_is_set(vcpu))
> 		write_sysreg_s(__vcpu_sys_reg(vcpu, HCR_EL2), SYS_NVHCR_EL2);
>

This is a host setting.

> However, this save path relies on is_nested_nv3_ctxt(), which checks NV and
> NVTGE but does not verify E2H:
> 
> static inline bool is_nested_nv3_ctxt(struct kvm_vcpu *vcpu)
> {
> 	return (has_vhe() && kvm_has_nv3(vcpu->kvm) && is_nested_ctxt(vcpu) &&
> 		(__vcpu_sys_reg(vcpu, HCR_EL2) & HCR_EL2_NV) &&
> 		(__vcpu_sys_reg(vcpu, HCRX_EL2) & HCRX_EL2_NVTGE));
> }

This is a guest setting.

> 
> If an L1 guest sets HCR_EL2.E2H = 0, HCR_EL2.NV = 1, and HCRX_EL2.NVTGE = 1,
> could __compute_hcr() skip writing SYS_NVHCR_EL2 on L1 entry, leaving the
> hardware register uninitialized (holding a previous vCPU's state)?

host != guest.

	M.

-- 
Without deviation from the norm, progress is not possible.