[PATCH 0/2] KVM: arm64: Fix HCRX_EL2.GCSEn handling

[PATCH 0/2] KVM: arm64: Fix HCRX_EL2.GCSEn handling

[Marc Zyngier]

Will points out[1] that GCS is completely busted on the host if we
ever run a guest, as HCRX_EL2 gets set to a fixed value on vcpu exit,
value that doesn't include the GCSEn bit. This is likely to kaboom on
a nVHE/hVHE setup.

Obviously, nobody ever tested this.

This series moves the handling of HCRX_EL2 to being correctly
saved/restored, which should address the problem. I say "should", as
in keeping with the tradition, I haven't tested it either. Or at least
not with GCS, as I don't have the correct SW setup (I don't even know
what you need to enable GCS).

I'd very much appreciate some help in testing this.

Marc Zyngier (2):
  KVM: arm64: Properly save/restore HCRX_EL2
  KVM: arm64: Kill HCRX_HOST_FLAGS

 arch/arm64/include/asm/el2_setup.h      |  2 +-
 arch/arm64/include/asm/kvm_arm.h        |  1 -
 arch/arm64/kvm/hyp/include/hyp/switch.h | 13 ++++++-------
 3 files changed, 7 insertions(+), 9 deletions(-)

-- 
2.39.2

[PATCH 1/2] KVM: arm64: Properly save/restore HCRX_EL2

[Marc Zyngier]

Rather than restoring HCRX_EL2 to a fixed value on vcpu exit,
perform a full save/restore of the register, ensuring that
we don't lose bits that would have been set at some point in
the host kernel lifetime, such as the GCSEn bit.

Fixes: ff5181d8a2a82 ("arm64/gcs: Provide basic EL2 setup to allow GCS usage at EL0 and EL1")
Signed-off-by: Marc Zyngier <maz@kernel.org>
---
 arch/arm64/kvm/hyp/include/hyp/switch.h | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/arch/arm64/kvm/hyp/include/hyp/switch.h b/arch/arm64/kvm/hyp/include/hyp/switch.h
index b741ea6aefa58..96f625dc72566 100644
--- a/arch/arm64/kvm/hyp/include/hyp/switch.h
+++ b/arch/arm64/kvm/hyp/include/hyp/switch.h
@@ -235,6 +235,8 @@ static inline void __deactivate_traps_mpam(void)
 
 static inline void __activate_traps_common(struct kvm_vcpu *vcpu)
 {
+	struct kvm_cpu_context *hctxt = host_data_ptr(host_ctxt);
+
 	/* Trap on AArch32 cp15 c15 (impdef sysregs) accesses (EL1 or EL0) */
 	write_sysreg(1 << 15, hstr_el2);
 
@@ -245,11 +247,8 @@ static inline void __activate_traps_common(struct kvm_vcpu *vcpu)
 	 * EL1 instead of being trapped to EL2.
 	 */
 	if (system_supports_pmuv3()) {
-		struct kvm_cpu_context *hctxt;
-
 		write_sysreg(0, pmselr_el0);
 
-		hctxt = host_data_ptr(host_ctxt);
 		ctxt_sys_reg(hctxt, PMUSERENR_EL0) = read_sysreg(pmuserenr_el0);
 		write_sysreg(ARMV8_PMU_USERENR_MASK, pmuserenr_el0);
 		vcpu_set_flag(vcpu, PMUSERENR_ON_CPU);
@@ -269,6 +268,7 @@ static inline void __activate_traps_common(struct kvm_vcpu *vcpu)
 			hcrx &= ~clr;
 		}
 
+		ctxt_sys_reg(hctxt, HCRX_EL2) = read_sysreg_s(SYS_HCRX_EL2);
 		write_sysreg_s(hcrx, SYS_HCRX_EL2);
 	}
 
@@ -278,19 +278,18 @@ static inline void __activate_traps_common(struct kvm_vcpu *vcpu)
 
 static inline void __deactivate_traps_common(struct kvm_vcpu *vcpu)
 {
+	struct kvm_cpu_context *hctxt = host_data_ptr(host_ctxt);
+
 	write_sysreg(*host_data_ptr(host_debug_state.mdcr_el2), mdcr_el2);
 
 	write_sysreg(0, hstr_el2);
 	if (system_supports_pmuv3()) {
-		struct kvm_cpu_context *hctxt;
-
-		hctxt = host_data_ptr(host_ctxt);
 		write_sysreg(ctxt_sys_reg(hctxt, PMUSERENR_EL0), pmuserenr_el0);
 		vcpu_clear_flag(vcpu, PMUSERENR_ON_CPU);
 	}
 
 	if (cpus_have_final_cap(ARM64_HAS_HCX))
-		write_sysreg_s(HCRX_HOST_FLAGS, SYS_HCRX_EL2);
+		write_sysreg_s(ctxt_sys_reg(hctxt, HCRX_EL2), SYS_HCRX_EL2);
 
 	__deactivate_traps_hfgxtr(vcpu);
 	__deactivate_traps_mpam();
-- 
2.39.2

[PATCH 2/2] KVM: arm64: Kill HCRX_HOST_FLAGS

[Marc Zyngier]

HCRX_HOST_FLAGS, like most of these hardcoded setups, are not
a good match for options that can be selectively enabled or
disabled.

Nothing but the early setup is relying on it now, so kill the
macro and move the bag of bits where they belong.

Signed-off-by: Marc Zyngier <maz@kernel.org>
---
 arch/arm64/include/asm/el2_setup.h | 2 +-
 arch/arm64/include/asm/kvm_arm.h   | 1 -
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/arch/arm64/include/asm/el2_setup.h b/arch/arm64/include/asm/el2_setup.h
index ebceaae3c749b..d40e427ddad94 100644
--- a/arch/arm64/include/asm/el2_setup.h
+++ b/arch/arm64/include/asm/el2_setup.h
@@ -52,7 +52,7 @@
 	mrs	x0, id_aa64mmfr1_el1
 	ubfx	x0, x0, #ID_AA64MMFR1_EL1_HCX_SHIFT, #4
 	cbz	x0, .Lskip_hcrx_\@
-	mov_q	x0, HCRX_HOST_FLAGS
+	mov_q	x0, (HCRX_EL2_MSCEn | HCRX_EL2_TCR2En | HCRX_EL2_EnFPM)
 
         /* Enable GCS if supported */
 	mrs_s	x1, SYS_ID_AA64PFR1_EL1
diff --git a/arch/arm64/include/asm/kvm_arm.h b/arch/arm64/include/asm/kvm_arm.h
index 974d72b5905b8..3eb722a7ad7f3 100644
--- a/arch/arm64/include/asm/kvm_arm.h
+++ b/arch/arm64/include/asm/kvm_arm.h
@@ -102,7 +102,6 @@
 #define HCR_HOST_NVHE_PROTECTED_FLAGS (HCR_HOST_NVHE_FLAGS | HCR_TSC)
 #define HCR_HOST_VHE_FLAGS (HCR_RW | HCR_TGE | HCR_E2H)
 
-#define HCRX_HOST_FLAGS (HCRX_EL2_MSCEn | HCRX_EL2_TCR2En | HCRX_EL2_EnFPM)
 #define MPAMHCR_HOST_FLAGS	0
 
 /* TCR_EL2 Registers bits */
-- 
2.39.2

Re: [PATCH 0/2] KVM: arm64: Fix HCRX_EL2.GCSEn handling

[Oliver Upton]

On Wed, 30 Apr 2025 11:59:14 +0100, Marc Zyngier wrote:
> Will points out[1] that GCS is completely busted on the host if we
> ever run a guest, as HCRX_EL2 gets set to a fixed value on vcpu exit,
> value that doesn't include the GCSEn bit. This is likely to kaboom on
> a nVHE/hVHE setup.
> 
> Obviously, nobody ever tested this.
> 
> [...]

Applied to fixes, thanks!

[1/2] KVM: arm64: Properly save/restore HCRX_EL2
      https://git.kernel.org/kvmarm/kvmarm/c/ffea7c73d181
[2/2] KVM: arm64: Kill HCRX_HOST_FLAGS
      https://git.kernel.org/kvmarm/kvmarm/c/ef296ee98bb1

--
Best,
Oliver