[PATCH v3 1/5] KVM: arm64: nv: Don't advertise FEAT_LPA2 for guest stage-1

[PATCH v3 1/5] KVM: arm64: nv: Don't advertise FEAT_LPA2 for guest stage-1

[Oliver Upton]

From: Wei-Lin Chang <weilin.chang@arm.com>

There is no FEAT_LPA2 support for NV guests as of now, but we missed
limiting it for the non-stage-2 granule size fields (TGRAN4, TGRAN16) in
ID_AA64MMFR0_EL1. Add the sanitisation.

Fixes: 9f75b6d447d7 ("KVM: arm64: nv: Filter out unsupported features from ID regs")
Signed-off-by: Wei-Lin Chang <weilin.chang@arm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Oliver Upton <oupton@kernel.org>
---
 arch/arm64/kvm/nested.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/arch/arm64/kvm/nested.c b/arch/arm64/kvm/nested.c
index 4d83281a7a28..cd0dabcf3f81 100644
--- a/arch/arm64/kvm/nested.c
+++ b/arch/arm64/kvm/nested.c
@@ -1875,6 +1875,17 @@ u64 limit_nv_id_reg(struct kvm *kvm, u32 reg, u64 val)
 		/* Hide CNTPOFF if present */
 		val = ID_REG_LIMIT_FIELD_ENUM(val, ID_AA64MMFR0_EL1, ECV, IMP);
 
+		/* NV does not support FEAT_LPA2. */
+		if (SYS_FIELD_GET(ID_AA64MMFR0_EL1, TGRAN4, val) == ID_AA64MMFR0_EL1_TGRAN4_52_BIT) {
+			val &= ~ID_AA64MMFR0_EL1_TGRAN4;
+			val |= SYS_FIELD_PREP_ENUM(ID_AA64MMFR0_EL1, TGRAN4, IMP);
+		}
+
+		if (SYS_FIELD_GET(ID_AA64MMFR0_EL1, TGRAN16, val) == ID_AA64MMFR0_EL1_TGRAN16_52_BIT) {
+			val &= ~ID_AA64MMFR0_EL1_TGRAN16;
+			val |= SYS_FIELD_PREP_ENUM(ID_AA64MMFR0_EL1, TGRAN16, IMP);
+		}
+
 		/* Disallow unsupported S2 page sizes */
 		switch (PAGE_SIZE) {
 		case SZ_64K:
-- 
2.47.3

[PATCH v3 5/5] KVM: arm64: nv: Correctly compute the effective TCR_EL1 for nVHE TCR_EL2

[Oliver Upton]

It would appear that nVHE hypervisor support has a few warts which
shouldn't come as a surprise. Several fields in TCR_EL2 for features
supported in the VM (TCR_EL2.HA for example) are not correctly
propagated to the effective value of TCR_EL1.

Forward fields in bulk from nVHE TCR_EL2 to the effective TCR_EL1,
relying on config-based sanitisation to enforce the RESx behavior of
unsupported features. Deal with the slightly annoying case where the
E2H==0 bitfield names are not annotated by TTBR like they are in E2H==1.

Cc: stable@vger.kernel.org # v6.18+
Fixes: d5bbb76f4474 ("KVM: arm64: nv: Expose hardware access flag management to NV guests")
Fixes: 3606e0b2e462 ("KVM: arm64: nv: Add non-VHE-EL2->EL1 translation helpers")
Signed-off-by: Oliver Upton <oupton@kernel.org>
---
 arch/arm64/include/asm/kvm_nested.h | 38 ++++++++++++++++++++++-------
 1 file changed, 29 insertions(+), 9 deletions(-)

diff --git a/arch/arm64/include/asm/kvm_nested.h b/arch/arm64/include/asm/kvm_nested.h
index 0f899addafa8..27ec73da02c6 100644
--- a/arch/arm64/include/asm/kvm_nested.h
+++ b/arch/arm64/include/asm/kvm_nested.h
@@ -20,16 +20,36 @@ static inline u64 tcr_el2_ps_to_tcr_el1_ips(u64 tcr_el2)
 	return (u64)FIELD_GET(TCR_EL2_PS_MASK, tcr_el2) << TCR_IPS_SHIFT;
 }
 
-static inline u64 translate_tcr_el2_to_tcr_el1(u64 tcr)
+#define __xlate_tcr_nvhe_to_vhe(nfld, vfld, nvhe, vhe)				\
+	FIELD_MODIFY(VHE_TCR_EL2_##vfld, vhe, FIELD_GET(TCR_EL2_##nfld, *(nvhe)))
+
+#define __xlate_tcr_nvhe_to_vhe_field(fld, nvhe, vhe)				\
+	__xlate_tcr_nvhe_to_vhe(fld, fld, nvhe, vhe)
+
+static inline u64 translate_tcr_el2_to_tcr_el1(u64 nvhe)
 {
-	return TCR_EPD1_MASK |				/* disable TTBR1_EL1 */
-	       ((tcr & TCR_EL2_DS) ? TCR_DS : 0) |
-	       ((tcr & TCR_EL2_TBI) ? TCR_TBI0 : 0) |
-	       tcr_el2_ps_to_tcr_el1_ips(tcr) |
-	       (tcr & TCR_EL2_TG0_MASK) |
-	       (tcr & TCR_EL2_ORGN0_MASK) |
-	       (tcr & TCR_EL2_IRGN0_MASK) |
-	       (tcr & TCR_EL2_T0SZ_MASK);
+	u64 vhe = VHE_TCR_EL2_EPD1 |			/* disable TTBR1_EL1 */
+		  tcr_el2_ps_to_tcr_el1_ips(nvhe);
+
+	__xlate_tcr_nvhe_to_vhe(MTX,	MTX0,	&nvhe,	&vhe);
+	__xlate_tcr_nvhe_to_vhe(TCMA,	TCMA0,	&nvhe,	&vhe);
+	__xlate_tcr_nvhe_to_vhe(TBID,	TBID0,	&nvhe,	&vhe);
+	__xlate_tcr_nvhe_to_vhe(HWU62,	HWU062,	&nvhe,	&vhe);
+	__xlate_tcr_nvhe_to_vhe(HWU61,	HWU061,	&nvhe,	&vhe);
+	__xlate_tcr_nvhe_to_vhe(HWU60,	HWU060,	&nvhe,	&vhe);
+	__xlate_tcr_nvhe_to_vhe(HWU59,	HWU059,	&nvhe,	&vhe);
+	__xlate_tcr_nvhe_to_vhe(HPD,	HPD0,	&nvhe,	&vhe);
+	__xlate_tcr_nvhe_to_vhe(TBI,	TBI0,	&nvhe,	&vhe);
+	__xlate_tcr_nvhe_to_vhe_field(	DS,	&nvhe,	&vhe);
+	__xlate_tcr_nvhe_to_vhe_field(	HA,	&nvhe,	&vhe);
+	__xlate_tcr_nvhe_to_vhe_field(	HD,	&nvhe,	&vhe);
+	__xlate_tcr_nvhe_to_vhe_field(	TG0,	&nvhe,	&vhe);
+	__xlate_tcr_nvhe_to_vhe_field(	SH0,	&nvhe,	&vhe);
+	__xlate_tcr_nvhe_to_vhe_field(	ORGN0,	&nvhe,	&vhe);
+	__xlate_tcr_nvhe_to_vhe_field(	IRGN0,	&nvhe,	&vhe);
+	__xlate_tcr_nvhe_to_vhe_field(	T0SZ,	&nvhe,	&vhe);
+
+	return vhe;
 }
 
 static inline u64 translate_cptr_el2_to_cpacr_el1(u64 cptr_el2)
-- 
2.47.3

Re: [PATCH v3 5/5] KVM: arm64: nv: Correctly compute the effective TCR_EL1 for nVHE TCR_EL2

[Wei-Lin Chang]

On Thu, Oct 29, 2026 at 03:37:32PM -0700, Oliver Upton wrote:
> It would appear that nVHE hypervisor support has a few warts which
> shouldn't come as a surprise. Several fields in TCR_EL2 for features
> supported in the VM (TCR_EL2.HA for example) are not correctly
> propagated to the effective value of TCR_EL1.
> 
> Forward fields in bulk from nVHE TCR_EL2 to the effective TCR_EL1,
> relying on config-based sanitisation to enforce the RESx behavior of
> unsupported features. Deal with the slightly annoying case where the
> E2H==0 bitfield names are not annotated by TTBR like they are in E2H==1.
> 
> Cc: stable@vger.kernel.org # v6.18+
> Fixes: d5bbb76f4474 ("KVM: arm64: nv: Expose hardware access flag management to NV guests")
> Fixes: 3606e0b2e462 ("KVM: arm64: nv: Add non-VHE-EL2->EL1 translation helpers")
> Signed-off-by: Oliver Upton <oupton@kernel.org>

Reviewed-by: Wei-Lin Chang <weilin.chang@arm.com>

> ---
>  arch/arm64/include/asm/kvm_nested.h | 38 ++++++++++++++++++++++-------
>  1 file changed, 29 insertions(+), 9 deletions(-)
> 
> diff --git a/arch/arm64/include/asm/kvm_nested.h b/arch/arm64/include/asm/kvm_nested.h
> index 0f899addafa8..27ec73da02c6 100644
> --- a/arch/arm64/include/asm/kvm_nested.h
> +++ b/arch/arm64/include/asm/kvm_nested.h
> @@ -20,16 +20,36 @@ static inline u64 tcr_el2_ps_to_tcr_el1_ips(u64 tcr_el2)
>  	return (u64)FIELD_GET(TCR_EL2_PS_MASK, tcr_el2) << TCR_IPS_SHIFT;
>  }
>  
> -static inline u64 translate_tcr_el2_to_tcr_el1(u64 tcr)
> +#define __xlate_tcr_nvhe_to_vhe(nfld, vfld, nvhe, vhe)				\
> +	FIELD_MODIFY(VHE_TCR_EL2_##vfld, vhe, FIELD_GET(TCR_EL2_##nfld, *(nvhe)))
> +
> +#define __xlate_tcr_nvhe_to_vhe_field(fld, nvhe, vhe)				\
> +	__xlate_tcr_nvhe_to_vhe(fld, fld, nvhe, vhe)
> +
> +static inline u64 translate_tcr_el2_to_tcr_el1(u64 nvhe)
>  {
> -	return TCR_EPD1_MASK |				/* disable TTBR1_EL1 */
> -	       ((tcr & TCR_EL2_DS) ? TCR_DS : 0) |
> -	       ((tcr & TCR_EL2_TBI) ? TCR_TBI0 : 0) |
> -	       tcr_el2_ps_to_tcr_el1_ips(tcr) |
> -	       (tcr & TCR_EL2_TG0_MASK) |
> -	       (tcr & TCR_EL2_ORGN0_MASK) |
> -	       (tcr & TCR_EL2_IRGN0_MASK) |
> -	       (tcr & TCR_EL2_T0SZ_MASK);
> +	u64 vhe = VHE_TCR_EL2_EPD1 |			/* disable TTBR1_EL1 */
> +		  tcr_el2_ps_to_tcr_el1_ips(nvhe);
> +
> +	__xlate_tcr_nvhe_to_vhe(MTX,	MTX0,	&nvhe,	&vhe);
> +	__xlate_tcr_nvhe_to_vhe(TCMA,	TCMA0,	&nvhe,	&vhe);
> +	__xlate_tcr_nvhe_to_vhe(TBID,	TBID0,	&nvhe,	&vhe);
> +	__xlate_tcr_nvhe_to_vhe(HWU62,	HWU062,	&nvhe,	&vhe);
> +	__xlate_tcr_nvhe_to_vhe(HWU61,	HWU061,	&nvhe,	&vhe);
> +	__xlate_tcr_nvhe_to_vhe(HWU60,	HWU060,	&nvhe,	&vhe);
> +	__xlate_tcr_nvhe_to_vhe(HWU59,	HWU059,	&nvhe,	&vhe);
> +	__xlate_tcr_nvhe_to_vhe(HPD,	HPD0,	&nvhe,	&vhe);
> +	__xlate_tcr_nvhe_to_vhe(TBI,	TBI0,	&nvhe,	&vhe);
> +	__xlate_tcr_nvhe_to_vhe_field(	DS,	&nvhe,	&vhe);
> +	__xlate_tcr_nvhe_to_vhe_field(	HA,	&nvhe,	&vhe);
> +	__xlate_tcr_nvhe_to_vhe_field(	HD,	&nvhe,	&vhe);
> +	__xlate_tcr_nvhe_to_vhe_field(	TG0,	&nvhe,	&vhe);
> +	__xlate_tcr_nvhe_to_vhe_field(	SH0,	&nvhe,	&vhe);
> +	__xlate_tcr_nvhe_to_vhe_field(	ORGN0,	&nvhe,	&vhe);
> +	__xlate_tcr_nvhe_to_vhe_field(	IRGN0,	&nvhe,	&vhe);
> +	__xlate_tcr_nvhe_to_vhe_field(	T0SZ,	&nvhe,	&vhe);
> +
> +	return vhe;
>  }
>  
>  static inline u64 translate_cptr_el2_to_cpacr_el1(u64 cptr_el2)
> -- 
> 2.47.3
>