[PATCH v2] KVM: arm64: Sync SCTLR_EL1 when injecting an exception into a pVM

[PATCH v2] KVM: arm64: Sync SCTLR_EL1 when injecting an exception into a pVM

[Fuad Tabba]

When pKVM injects a synchronous exception into a protected guest,
enter_exception64() reads SCTLR_EL1 to set the new PSTATE's PAN and
SSBS bits. pKVM refreshes VBAR_EL1 from the live value before injecting
but not SCTLR_EL1, which is untrapped for protected guests, so a guest
that updates it and then traps takes the exception with stale PAN/SSBS.

Sync SCTLR_EL1 alongside VBAR_EL1.

Fixes: 798eb5978700 ("KVM: arm64: Sync protected guest VBAR_EL1 on injecting an undef exception")
Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
---
Changes since v1 [1]:
 - Rebased onto v7.2-rc4; no functional change.

[1] https://lore.kernel.org/all/20260612102347.914994-1-tabba@google.com/

 arch/arm64/kvm/hyp/nvhe/sys_regs.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/kvm/hyp/nvhe/sys_regs.c b/arch/arm64/kvm/hyp/nvhe/sys_regs.c
index b1411fb541397..8758c68017765 100644
--- a/arch/arm64/kvm/hyp/nvhe/sys_regs.c
+++ b/arch/arm64/kvm/hyp/nvhe/sys_regs.c
@@ -257,10 +257,11 @@ static void inject_sync64(struct kvm_vcpu *vcpu, u64 esr)
 	*vcpu_cpsr(vcpu) = read_sysreg_el2(SYS_SPSR);
 
 	/*
-	 * Make sure we have the latest update to VBAR_EL1, as pKVM
-	 * handles traps very early, before sysregs are resync'ed
+	 * Sync VBAR_EL1 and SCTLR_EL1, both read by enter_exception64(),
+	 * as pKVM handles traps before sysregs are resync'ed.
 	 */
 	__vcpu_assign_sys_reg(vcpu, VBAR_EL1, read_sysreg_el1(SYS_VBAR));
+	__vcpu_assign_sys_reg(vcpu, SCTLR_EL1, read_sysreg_el1(SYS_SCTLR));
 
 	kvm_pend_exception(vcpu, EXCEPT_AA64_EL1_SYNC);
 

base-commit: 1590cf0329716306e948a8fc29f1d3ee87d3989f
-- 
2.39.5

Re: [PATCH v2] KVM: arm64: Sync SCTLR_EL1 when injecting an exception into a pVM

[Oliver Upton]

On Tue, 21 Jul 2026 17:16:24 +0100, Fuad Tabba wrote:
> When pKVM injects a synchronous exception into a protected guest,
> enter_exception64() reads SCTLR_EL1 to set the new PSTATE's PAN and
> SSBS bits. pKVM refreshes VBAR_EL1 from the live value before injecting
> but not SCTLR_EL1, which is untrapped for protected guests, so a guest
> that updates it and then traps takes the exception with stale PAN/SSBS.
> 
> Sync SCTLR_EL1 alongside VBAR_EL1.
> 
> [...]

Applied to next, thanks!

[1/1] KVM: arm64: Sync SCTLR_EL1 when injecting an exception into a pVM
      https://git.kernel.org/kvmarm/kvmarm/c/596289fe4836

--
Best,
Oliver