[PATCH 0/2] KVM: arm64: Reenable MTE on VHE guest exit

[PATCH 0/2] KVM: arm64: Reenable MTE on VHE guest exit

[Marc Zyngier]

Upton taking an exception, the CPU sets PSTATE.TCO to ensure that no
tag fault can be taken while handling the exception. It is SW's job to
eventually clear it when it is safe to do so.

It appears that when MTE is enabled and that the kernel is running
VHE, nothing eventually clears TCO when we come back from the guest,
so things such as KASAN_HW_TAGS will not work until the next exit to
userspace.

This series aims at fixing this. This is not a stable candidate, as
KASAN is only a debug option.

Marc Zyngier (2):
  arm64: Add return value to mte_disable_tco_entry()
  KVM: arm64: Reenable MTE tag checking on exit from guest when running
    VHE

 arch/arm64/include/asm/mte.h    | 10 +++++++---
 arch/arm64/kvm/hyp/vhe/switch.c |  7 +++++++
 2 files changed, 14 insertions(+), 3 deletions(-)

-- 
2.47.3

[PATCH 1/2] arm64: Add return value to mte_disable_tco_entry()

[Marc Zyngier]

In order to provide adequate levels of synchronisation when clearing
TCO, update mte_disable_tco_entry() to indicate whether it has actually
done something.

Signed-off-by: Marc Zyngier <maz@kernel.org>
---
 arch/arm64/include/asm/mte.h | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/arch/arm64/include/asm/mte.h b/arch/arm64/include/asm/mte.h
index 7f7b97e099968..411e5a6f6d94c 100644
--- a/arch/arm64/include/asm/mte.h
+++ b/arch/arm64/include/asm/mte.h
@@ -224,10 +224,10 @@ static inline bool folio_try_hugetlb_mte_tagging(struct folio *folio)
 }
 #endif
 
-static inline void mte_disable_tco_entry(struct task_struct *task)
+static inline bool mte_disable_tco_entry(struct task_struct *task)
 {
 	if (!system_supports_mte())
-		return;
+		return false;
 
 	/*
 	 * Re-enable tag checking (TCO set on exception entry). This is only
@@ -240,8 +240,12 @@ static inline void mte_disable_tco_entry(struct task_struct *task)
 	 * expensive.
 	 */
 	if (kasan_hw_tags_enabled() ||
-	    (task->thread.sctlr_user & (1UL << SCTLR_EL1_TCF0_SHIFT)))
+	    (task->thread.sctlr_user & (1UL << SCTLR_EL1_TCF0_SHIFT))) {
 		asm volatile(SET_PSTATE_TCO(0));
+		return true;
+	}
+
+	return false;
 }
 
 #ifdef CONFIG_KASAN_HW_TAGS
-- 
2.47.3

[PATCH 2/2] KVM: arm64: Reenable MTE tag checking on exit from guest when running VHE

[Marc Zyngier]

Once we're back from running a guest, it is important to set TCO to
zero so that MTE is functional again.

Signed-off-by: Marc Zyngier <maz@kernel.org>
---
 arch/arm64/kvm/hyp/vhe/switch.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/arch/arm64/kvm/hyp/vhe/switch.c b/arch/arm64/kvm/hyp/vhe/switch.c
index 4c965f9b1e1de..73c2dd61e6c69 100644
--- a/arch/arm64/kvm/hyp/vhe/switch.c
+++ b/arch/arm64/kvm/hyp/vhe/switch.c
@@ -193,6 +193,13 @@ static void __deactivate_traps(struct kvm_vcpu *vcpu)
 	if (!arm64_kernel_unmapped_at_el0())
 		host_vectors = __this_cpu_read(this_cpu_vector);
 	write_sysreg(host_vectors, vbar_el1);
+
+	/*
+	 * We're now able to take MTE exceptions, make sure the VBAR_EL2 is
+	 * set to the correct value.
+	 */
+	if (mte_disable_tco_entry(current))
+		isb();
 }
 NOKPROBE_SYMBOL(__deactivate_traps);
 
-- 
2.47.3

Re: [PATCH 0/2] KVM: arm64: Reenable MTE on VHE guest exit

[Fuad Tabba]

Hi Marc,

On Mon, 26 Oct 2026 08:23:03 +0000, Marc Zyngier <maz@kernel.org> wrote:
[...]

Tested on QEMU with MTE, on a VHE host with KASAN_HW_TAGS: a debug
print right after the guest run returns shows TCO set without the
series and clear with it. Guests also boot on nVHE and pKVM hosts (as
normal).

For the series:

Reviewed-by: Fuad Tabba <fuad.tabba@linux.dev>
Tested-by: Fuad Tabba <fuad.tabba@linux.dev>


Cheers,
/fuad

Re: [PATCH 0/2] KVM: arm64: Reenable MTE on VHE guest exit

[Catalin Marinas]

On Mon, Oct 26, 2026 at 08:23:03AM +0000, Marc Zyngier wrote:
> Upton taking an exception, the CPU sets PSTATE.TCO to ensure that no
> tag fault can be taken while handling the exception. It is SW's job to
> eventually clear it when it is safe to do so.
> 
> It appears that when MTE is enabled and that the kernel is running
> VHE, nothing eventually clears TCO when we come back from the guest,
> so things such as KASAN_HW_TAGS will not work until the next exit to
> userspace.
> 
> This series aims at fixing this. This is not a stable candidate, as
> KASAN is only a debug option.
> 
> Marc Zyngier (2):
>   arm64: Add return value to mte_disable_tco_entry()
>   KVM: arm64: Reenable MTE tag checking on exit from guest when running
>     VHE
> 
>  arch/arm64/include/asm/mte.h    | 10 +++++++---
>  arch/arm64/kvm/hyp/vhe/switch.c |  7 +++++++
>  2 files changed, 14 insertions(+), 3 deletions(-)

For both patches:

Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>