Re: [PATCH] KVM: arm64: Fix ICV_DIR_EL1 trapping detection for pKVM

Marc Zyngier
2026-03-10T08:56:51Z

On Mon, 09 Mar 2026 18:07:45 +0000,
Vincent Donnefort <vdonnefort@google.com> wrote:
>
> [...]
>
> > > diff --git a/arch/arm64/kvm/hyp/nvhe/hyp-main.c b/arch/arm64/kvm/hyp/nvhe/hyp-main.c
> > > index e7790097db93..0432852228f9 100644
> > > --- a/arch/arm64/kvm/hyp/nvhe/hyp-main.c
> > > +++ b/arch/arm64/kvm/hyp/nvhe/hyp-main.c
> > > @@ -463,6 +463,11 @@ static void handle___vgic_v3_get_gic_config(struct kvm_cpu_context *host_ctxt)
> > > cpu_reg(host_ctxt, 1) = __vgic_v3_get_gic_config();
> > > }
> > >
> > > +static void handle___vgic_v3_get_ich_vtr_el2(struct kvm_cpu_context *host_ctxt)
> > > +{
> > > + cpu_reg(host_ctxt, 1) = read_sysreg_s(SYS_ICH_VTR_EL2);
> > > +}
> > > +
> > > static void handle___vgic_v3_init_lrs(struct kvm_cpu_context *host_ctxt)
> > > {
> > > __vgic_v3_init_lrs();
> > > @@ -622,6 +627,7 @@ static const hcall_t host_hcall[] = {
> > > HANDLE_FUNC(__kvm_timer_set_cntvoff),
> > > HANDLE_FUNC(__vgic_v3_save_aprs),
> > > HANDLE_FUNC(__vgic_v3_restore_vmcr_aprs),
> > > + HANDLE_FUNC(__vgic_v3_get_ich_vtr_el2),
> > > HANDLE_FUNC(__pkvm_reserve_vm),
> > > HANDLE_FUNC(__pkvm_unreserve_vm),
> > > HANDLE_FUNC(__pkvm_init_vm),
> > >
> >
> > This looks incredibly complicated. Since pKVM forbids late onlining of
> > CPUs, you are absolutely sure that you have already seen the CPU being
> > hot-plugged on.
> >
> > So it would make a lot more sense to just return the current value of
> > the property you are trying to re-evaluate: you know for sure it
> > cannot change under your feet.
> >
> > I have quickly tested the following hack:
> >
> > diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
> > index c31f8e17732a3..947ff71b3b66b 100644
> > --- a/arch/arm64/kernel/cpufeature.c
> > +++ b/arch/arm64/kernel/cpufeature.c
> > @@ -2345,6 +2345,9 @@ static bool can_trap_icv_dir_el1(const struct arm64_cpu_capabilities *entry,
> > !is_midr_in_range_list(has_vgic_v3))
> > return false;
> >
> > + if (system_capabilities_finalized() && is_protected_kvm_enabled())
> > + return cpus_have_final_cap(ARM64_HAS_ICH_HCR_EL2_TDIR);
> > +
> > if (is_kernel_in_hyp_mode())
> > res.a1 = read_sysreg_s(SYS_ICH_VTR_EL2);
> > else
> >
> > which works for me. Could you please give it a go?
>
> That works! I can spin a V2 with that if you want.

I've sent what I had written yesterday. Tested-by appreciated!

Thanks,

M.

--
Without deviation from the norm, progress is not possible.