KVM: arm64: pkvm: Don't reprobe for ICH_VTR_EL2.TDS on CPU hotplug

PATCH Applied Marc Zyngier 3 participants 6 messages Mar 10

Subsystems (3)

Stable branch arm64 KVM arm64

lore

Share & tools

lore

Marc Zyngier

author maintainer

2026-03-10 08:54 UTC #0 lore raw

PATCH 1/1 KVM: arm64: pkvm: Don't reprobe for ICH_VTR_EL2.TDS on CPU hotplug

Hotplugging a CPU off and back on fails with pKVM, as we try to probe for ICH_VTR_EL2.TDS. In a non-VHE setup, this is achieved by using an EL2 stub helper. However, the stubs are out of reach once pKVM has deprivileged the kernel. The CPU never boots.

Since pKVM doesn't allow late onlining of CPUs, we can detect that protected mode is enforced early on, and return the current state of the capability.

Fixes 2a28810cbb8b2 ("KVM: arm64: GICv3: Detect and work around the lack of ICV_DIR_EL1 trapping")

Reported-by Vincent Donnefort <[email protected]>

Signed-off-by Marc Zyngier <[email protected]>

Cc [email protected]

---
 arch/arm64/kernel/cpufeature.c | 3 +++
 1 file changed, 3 insertions(+)

arch/arm64/kernel/cpufeature.c +3 -0

index c31f8e17732a3..947ff71b3b66b 100644
@@ -2345,6 +2345,9 @@ static bool can_trap_icv_dir_el1(const struct arm64_cpu_capabilities *entry,
 	    !is_midr_in_range_list(has_vgic_v3))
 		return false;
 
+	if (system_capabilities_finalized() && is_protected_kvm_enabled())
+		return cpus_have_final_cap(ARM64_HAS_ICH_HCR_EL2_TDIR);
+
 	if (is_kernel_in_hyp_mode())
 		res.a1 = read_sysreg_s(SYS_ICH_VTR_EL2);
 	else

Signature · 1 line

2.47.3

Suzuki K Poulose

reviewer Reviewed-by on v1 1/1

2026-03-10 09:18 UTC #1 lore raw

Quoted 22 lines · Marc Zyngier

Hotplugging a CPU off and back on fails with pKVM, as we try to probe for ICH_VTR_EL2.TDS. In a non-VHE setup, this is achieved by using an EL2 stub helper. However, the stubs are out of reach once pKVM has deprivileged the kernel. The CPU never boots.
Since pKVM doesn't allow late onlining of CPUs, we can detect that protected mode is enforced early on, and return the current state of the capability.
Fixes 2a28810cbb8b2 ("KVM: arm64: GICv3: Detect and work around the lack of ICV_DIR_EL1 trapping")
Reported-by Vincent Donnefort <[email protected]>
Signed-off-by Marc Zyngier <[email protected]>
Cc [email protected]
---
  arch/arm64/kernel/cpufeature.c | 3 +++
  1 file changed, 3 insertions(+)
arch/arm64/kernel/cpufeature.c +0 -0
index c31f8e17732a3..947ff71b3b66b 100644

arch/arm64/kernel/cpufeature.c static bool can_trap_icv_dir_el1(const struct arm64_cpu_capabilities *entry, · line 2349

Quoted 5 lines

arch/arm64/kernel/cpufeature.c +2 -0

@@ -2345,6 +2345,9 @@ static bool can_trap_icv_dir_el1(const struct arm64_cpu_capabilities *entry,
  	    !is_midr_in_range_list(has_vgic_v3))
  		return false;
 
+	if (system_capabilities_finalized() && is_protected_kvm_enabled())
+		return cpus_have_final_cap(ARM64_HAS_ICH_HCR_EL2_TDIR);

Is it a worth adding a comment here ? Otherwise this looks very odd - Returning the system state of a capability for a "hotplugged" CPU.

Otherwise

Reviewed-by Suzuki K Poulose <[email protected]>

Quoted 4 lines

arch/arm64/kernel/cpufeature.c +1 -0

+
  	if (is_kernel_in_hyp_mode())
  		res.a1 = read_sysreg_s(SYS_ICH_VTR_EL2);
  	else

Vincent Donnefort

Tested-by

2026-03-10 09:27 UTC #2 lore raw

Quoted 31 lines · Suzuki K Poulose

Quoted 22 lines · Marc Zyngier
Hotplugging a CPU off and back on fails with pKVM, as we try to probe for ICH_VTR_EL2.TDS. In a non-VHE setup, this is achieved by using an EL2 stub helper. However, the stubs are out of reach once pKVM has deprivileged the kernel. The CPU never boots.
Since pKVM doesn't allow late onlining of CPUs, we can detect that protected mode is enforced early on, and return the current state of the capability.
Fixes 2a28810cbb8b2 ("KVM: arm64: GICv3: Detect and work around the lack of ICV_DIR_EL1 trapping")
Reported-by Vincent Donnefort <[email protected]>
Signed-off-by Marc Zyngier <[email protected]>
Cc [email protected]
---
  arch/arm64/kernel/cpufeature.c | 3 +++
  1 file changed, 3 insertions(+)
arch/arm64/kernel/cpufeature.c +0 -0
index c31f8e17732a3..947ff71b3b66b 100644
arch/arm64/kernel/cpufeature.c static bool can_trap_icv_dir_el1(const struct arm64_cpu_capabilities *entry, · line 2348
Quoted 4 lines
arch/arm64/kernel/cpufeature.c +2 -0
@@ -2345,6 +2345,9 @@ static bool can_trap_icv_dir_el1(const struct arm64_cpu_capabilities *entry,
  	    !is_midr_in_range_list(has_vgic_v3))
  		return false;
+	if (system_capabilities_finalized() && is_protected_kvm_enabled())
+		return cpus_have_final_cap(ARM64_HAS_ICH_HCR_EL2_TDIR);
Is it a worth adding a comment here ? Otherwise this looks very odd - Returning the system state of a capability for a "hotplugged" CPU.

Quoted 3 lines

Otherwise
Reviewed-by Suzuki K Poulose <[email protected]>

Tested-by Vincent Donnefort <[email protected]>

Quoted 7 lines

Quoted 6 lines

arch/arm64/kernel/cpufeature.c +1 -0

+
  	if (is_kernel_in_hyp_mode())
  		res.a1 = read_sysreg_s(SYS_ICH_VTR_EL2);
  	else

Marc Zyngier

author maintainer

2026-03-10 09:43 UTC #3 lore raw

In reply to Suzuki K Poulose

Quoted 19 lines · Suzuki K Poulose

Quoted 17 lines · Marc Zyngier
Hotplugging a CPU off and back on fails with pKVM, as we try to probe for ICH_VTR_EL2.TDS. In a non-VHE setup, this is achieved by using an EL2 stub helper. However, the stubs are out of reach once pKVM has deprivileged the kernel. The CPU never boots.
Since pKVM doesn't allow late onlining of CPUs, we can detect that protected mode is enforced early on, and return the current state of the capability.
Fixes 2a28810cbb8b2 ("KVM: arm64: GICv3: Detect and work around the lack of ICV_DIR_EL1 trapping")
Reported-by Vincent Donnefort <[email protected]>
Signed-off-by Marc Zyngier <[email protected]>
Cc [email protected]
---
  arch/arm64/kernel/cpufeature.c | 3 +++
  1 file changed, 3 insertions(+)

Quoted 13 lines

arch/arm64/kernel/cpufeature.c static bool can_trap_icv_dir_el1(const struct arm64_cpu_capabilities *entry, · line 2349
Quoted 10 lines
arch/arm64/kernel/cpufeature.c +1 -0
index c31f8e17732a3..947ff71b3b66b 100644
@@ -2345,6 +2345,9 @@ static bool can_trap_icv_dir_el1(const struct arm64_cpu_capabilities *entry,
  	    !is_midr_in_range_list(has_vgic_v3))
  		return false;
  +	if (system_capabilities_finalized() &&
 is_protected_kvm_enabled())
+		return cpus_have_final_cap(ARM64_HAS_ICH_HCR_EL2_TDIR);
Is it a worth adding a comment here ? Otherwise this looks very odd - Returning the system state of a capability for a "hotplugged" CPU.

How about this?

arch/arm64/kernel/cpufeature.c +6 -0

index 947ff71b3b66b..32c2dbcc0c641 100644
@@ -2345,6 +2345,12 @@ static bool can_trap_icv_dir_el1(const struct arm64_cpu_capabilities *entry,
 	    !is_midr_in_range_list(has_vgic_v3))
 		return false;
 
+	/*
+	 * pKVM prevents late onlining of CPUs. This means that whatever
+	 * state the capability is in after deprivilege cannot be affected
+	 * by a new CPU booting -- this is garanteed to be a CPU we have
+	 * already seen, and the cap is therefore unchanged.
+	 */
 	if (system_capabilities_finalized() && is_protected_kvm_enabled())
 		return cpus_have_final_cap(ARM64_HAS_ICH_HCR_EL2_TDIR);

Quoted 4 lines

Otherwise
Reviewed-by Suzuki K Poulose <[email protected]>

Thanks!

M.

Signature · 1 line

Without deviation from the norm, progress is not possible.

Suzuki K Poulose

reviewer

2026-03-10 10:14 UTC #4 lore raw

Quoted 42 lines · Marc Zyngier

Quoted 19 lines · Suzuki K Poulose
Quoted 17 lines · Marc Zyngier
Hotplugging a CPU off and back on fails with pKVM, as we try to probe for ICH_VTR_EL2.TDS. In a non-VHE setup, this is achieved by using an EL2 stub helper. However, the stubs are out of reach once pKVM has deprivileged the kernel. The CPU never boots.
Since pKVM doesn't allow late onlining of CPUs, we can detect that protected mode is enforced early on, and return the current state of the capability.
Fixes 2a28810cbb8b2 ("KVM: arm64: GICv3: Detect and work around the lack of ICV_DIR_EL1 trapping")
Reported-by Vincent Donnefort <[email protected]>
Signed-off-by Marc Zyngier <[email protected]>
Cc [email protected]
---
   arch/arm64/kernel/cpufeature.c | 3 +++
   1 file changed, 3 insertions(+)
Quoted 13 lines
arch/arm64/kernel/cpufeature.c static bool can_trap_icv_dir_el1(const struct arm64_cpu_capabilities *entry, · line 2349
Quoted 10 lines
arch/arm64/kernel/cpufeature.c +1 -0
index c31f8e17732a3..947ff71b3b66b 100644
@@ -2345,6 +2345,9 @@ static bool can_trap_icv_dir_el1(const struct arm64_cpu_capabilities *entry,
   	    !is_midr_in_range_list(has_vgic_v3))
   		return false;
   +	if (system_capabilities_finalized() &&
 is_protected_kvm_enabled())
+		return cpus_have_final_cap(ARM64_HAS_ICH_HCR_EL2_TDIR);
Is it a worth adding a comment here ? Otherwise this looks very odd - Returning the system state of a capability for a "hotplugged" CPU.
How about this?
arch/arm64/kernel/cpufeature.c +0 -0
index 947ff71b3b66b..32c2dbcc0c641 100644

arch/arm64/kernel/cpufeature.c static bool can_trap_icv_dir_el1(const struct arm64_cpu_capabilities *entry, · line 2353

Quoted 9 lines

arch/arm64/kernel/cpufeature.c +6 -0

@@ -2345,6 +2345,12 @@ static bool can_trap_icv_dir_el1(const struct arm64_cpu_capabilities *entry,
  	    !is_midr_in_range_list(has_vgic_v3))
  		return false;
 
+	/*
+	 * pKVM prevents late onlining of CPUs. This means that whatever
+	 * state the capability is in after deprivilege cannot be affected
+	 * by a new CPU booting -- this is garanteed to be a CPU we have
+	 * already seen, and the cap is therefore unchanged.
+	 */

Thanks, that looks good.

Quoted 7 lines

arch/arm64/kernel/cpufeature.c +0 -0
  	if (system_capabilities_finalized() && is_protected_kvm_enabled())
  		return cpus_have_final_cap(ARM64_HAS_ICH_HCR_EL2_TDIR);
 
Quoted 4 lines
Otherwise
Reviewed-by Suzuki K Poulose <[email protected]>

Cheers
Suzuki

Quoted 5 lines

Thanks!
	M.

Marc Zyngier

author maintainer Applied

2026-03-10 10:17 UTC #5 lore raw

In reply to Marc Zyngier

Quoted 10 lines · Marc Zyngier

Hotplugging a CPU off and back on fails with pKVM, as we try to probe for ICH_VTR_EL2.TDS. In a non-VHE setup, this is achieved by using an EL2 stub helper. However, the stubs are out of reach once pKVM has deprivileged the kernel. The CPU never boots.
Since pKVM doesn't allow late onlining of CPUs, we can detect that protected mode is enforced early on, and return the current state of the capability.
[...]

Applied to fixes, thanks!

[1/1] KVM: arm64: pkvm: Don't reprobe for ICH_VTR_EL2.TDS on CPU hotplug

      commit: a79f7b4aeb8e7562cd6dbf9c223e2c2a04b1a85f

Cheers,

M.

Signature · 1 line

Without deviation from the norm, progress is not possible.