[PATCH 0/2] KVM: arm64: Fixes for NV+SVE

[PATCH 0/2] KVM: arm64: Fixes for NV+SVE

[Oliver Upton]

After staring at the ZCR_EL2 handling for the issue Jan reported I
also spotted an ugly preemption bug because ZCR_EL2 residence is *very*
different from the other sysregs.

We could definitely get away with loading ZCR_ELx on the CPU at
vcpu_load() but I'd rather not given the amount of special treatment
that we need to do for it already.

In addition to that, I've taken the liberty of forging Marc's authorship
and SOB on the SVE exception fix, figured he wont mind :-)

Applies to kvmarm-6.18, tested with QEMU-TCG (only implementation >128
bit) with L0: VL=512, L1: VL=256, and L2: VL=128.

Marc Zyngier (1):
  KVM: arm64: nv: Don't advance PC when pending an SVE exception

Oliver Upton (1):
  KVM: arm64: nv: Don't treat ZCR_EL2 as a 'mapped' register

 arch/arm64/kvm/sys_regs.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)


base-commit: 10fd0285305d0b48e8a3bf15d4f17fc4f3d68cb6
-- 
2.39.5

[PATCH 1/2] KVM: arm64: nv: Don't treat ZCR_EL2 as a 'mapped' register

[Oliver Upton]

Unlike the other mapped EL2 sysregs ZCR_EL2 isn't guaranteed to be
resident when a vCPU is loaded as it actually follows the SVE
context. As such, the contents of ZCR_EL1 may belong to another guest if
the vCPU has been preempted before reaching sysreg emulation.

Unconditionally use the in-memory value of ZCR_EL2 and switch to the
memory-only accessors. The in-memory value is guaranteed to be valid as
fpsimd_lazy_switch_to_{guest,host}() will restore/save the register
appropriately.

Signed-off-by: Oliver Upton <oliver.upton@linux.dev>
---
 arch/arm64/kvm/sys_regs.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
index 91053aa832d0..4a75e5f0c259 100644
--- a/arch/arm64/kvm/sys_regs.c
+++ b/arch/arm64/kvm/sys_regs.c
@@ -203,7 +203,6 @@ static void locate_register(const struct kvm_vcpu *vcpu, enum vcpu_sysreg reg,
 		MAPPED_EL2_SYSREG(AMAIR_EL2,   AMAIR_EL1,   NULL	     );
 		MAPPED_EL2_SYSREG(ELR_EL2,     ELR_EL1,	    NULL	     );
 		MAPPED_EL2_SYSREG(SPSR_EL2,    SPSR_EL1,    NULL	     );
-		MAPPED_EL2_SYSREG(ZCR_EL2,     ZCR_EL1,     NULL	     );
 		MAPPED_EL2_SYSREG(CONTEXTIDR_EL2, CONTEXTIDR_EL1, NULL	     );
 		MAPPED_EL2_SYSREG(SCTLR2_EL2,  SCTLR2_EL1,  NULL	     );
 	case CNTHCTL_EL2:
@@ -2709,14 +2708,13 @@ static bool access_zcr_el2(struct kvm_vcpu *vcpu,
 	}
 
 	if (!p->is_write) {
-		p->regval = vcpu_read_sys_reg(vcpu, ZCR_EL2);
+		p->regval = __vcpu_sys_reg(vcpu, ZCR_EL2);
 		return true;
 	}
 
 	vq = SYS_FIELD_GET(ZCR_ELx, LEN, p->regval) + 1;
 	vq = min(vq, vcpu_sve_max_vq(vcpu));
-	vcpu_write_sys_reg(vcpu, vq - 1, ZCR_EL2);
-
+	__vcpu_assign_sys_reg(vcpu, ZCR_EL2, vq - 1);
 	return true;
 }
 
-- 
2.39.5

[PATCH 2/2] KVM: arm64: nv: Don't advance PC when pending an SVE exception

[Oliver Upton]

From: Marc Zyngier <maz@kernel.org>

Jan reports that running a nested guest on Neoverse-V2 leads to a WARN
in the host due to simultaneously pending an exception and PC increment
after an access to ZCR_EL2.

Returning true from a sysreg accessor is an indication that the sysreg
instruction has been retired. Of course this isn't the case when we've
pended a synchronous SVE exception for the guest. Fix the return value
and let the exception propagate to the guest as usual.

Reported-by: Jan Kotas <jank@cadence.com>
Closes: https://lore.kernel.org/kvmarm/865xd61tt5.wl-maz@kernel.org/
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Oliver Upton <oliver.upton@linux.dev>
---
 arch/arm64/kvm/sys_regs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
index 4a75e5f0c259..ee8a7033c85b 100644
--- a/arch/arm64/kvm/sys_regs.c
+++ b/arch/arm64/kvm/sys_regs.c
@@ -2704,7 +2704,7 @@ static bool access_zcr_el2(struct kvm_vcpu *vcpu,
 
 	if (guest_hyp_sve_traps_enabled(vcpu)) {
 		kvm_inject_nested_sve_trap(vcpu);
-		return true;
+		return false;
 	}
 
 	if (!p->is_write) {
-- 
2.39.5

Re: [PATCH 0/2] KVM: arm64: Fixes for NV+SVE

[Marc Zyngier]

On Fri, 26 Sep 2025 12:41:06 -0700, Oliver Upton wrote:
> After staring at the ZCR_EL2 handling for the issue Jan reported I
> also spotted an ugly preemption bug because ZCR_EL2 residence is *very*
> different from the other sysregs.
> 
> We could definitely get away with loading ZCR_ELx on the CPU at
> vcpu_load() but I'd rather not given the amount of special treatment
> that we need to do for it already.
> 
> [...]

Applied to fixes, thanks!

[1/2] KVM: arm64: nv: Don't treat ZCR_EL2 as a 'mapped' register
      commit: eea94a0ea55d7c65fca192927481f9c5cb90efd9
[2/2] KVM: arm64: nv: Don't advance PC when pending an SVE exception
      commit: 5bd5d7d43a921ffee7dedae1b3ad5dea28fed385

Cheers,

	M.
-- 
Without deviation from the norm, progress is not possible.