Re: [PATCH v2 4/5] KVM: arm64: vgic: Do not access the GICv5 CPU interface from EL1

[Marc Zyngier <maz@kernel.org>]

On Sun, 11 Oct 2026 15:36:47 +0100,
Fuad Tabba <fuad.tabba@linux.dev> wrote:
> 
> can_access_vgic_from_kernel() excludes only the GICv3 system register
> interface, so on a native GICv5 system without FEAT_GCIE_LEGACY it
> returns true under nVHE. The kernel then saves and restores the CPU
> interface from EL1, where ICH_VMCR_EL2 and the ICH_PPI_* registers are
> UNDEFINED, so running a vCPU oopses the host. The nVHE world switch
> already does that work at EL2.
> 
> Require VHE for GICv5 as for GICv3.
> 
> Fixes: 9b8e3d4ca0e73 ("KVM: arm64: gic-v5: Implement GICv5 load/put and save/restore")
> Reviewed-by: Sascha Bischoff <sascha.bischoff@arm.com>
> Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
> ---
>  arch/arm64/kvm/vgic/vgic.c | 12 ++++++++----
>  1 file changed, 8 insertions(+), 4 deletions(-)
> 
> diff --git a/arch/arm64/kvm/vgic/vgic.c b/arch/arm64/kvm/vgic/vgic.c
> index b25303d9919fd..da72779d3b3ee 100644
> --- a/arch/arm64/kvm/vgic/vgic.c
> +++ b/arch/arm64/kvm/vgic/vgic.c
> @@ -1045,11 +1045,15 @@ static void vgic_flush_lr_state(struct kvm_vcpu *vcpu)
>  static inline bool can_access_vgic_from_kernel(void)
>  {
>  	/*
> -	 * GICv2 can always be accessed from the kernel because it is
> -	 * memory-mapped, and VHE systems can access GICv3 EL2 system
> -	 * registers.
> +	 * GICv3 and GICv5 drive the CPU interface through EL2 system
> +	 * registers, so only VHE reaches them from the kernel. GICv2 is
> +	 * memory-mapped and always reachable.
>  	 */
> -	return !static_branch_unlikely(&kvm_vgic_global_state.gicv3_cpuif) || has_vhe();
> +	if (static_branch_unlikely(&kvm_vgic_global_state.gicv3_cpuif) ||
> +	    kvm_vgic_global_state.type == VGIC_V5)
> +		return has_vhe();
> +
> +	return true;

This really is perpetuating the wrong model. The rule is simple:
anything that requires system instructions or system registers cannot
be accessed from EL1, and therefore GICv2 is the only one that can be
accessed from EL1. So the whole thing should read:

	 return has_vhe() || kvm_vgic_global_state.type == VGIC_V2;

Ultimately, we should static keys for all of the vgic types.

	M.

-- 
Jazz isn't dead. It just smells funny.