* Re: [PATCH v1] arm64/boot: Disable trapping of PMZR_EL0 writes to EL2
2026-09-22 18:14 [PATCH v1] arm64/boot: Disable trapping of PMZR_EL0 writes to EL2 Fuad Tabba
@ 2026-09-22 19:47 ` Oliver Upton
2026-09-22 21:09 ` Fuad Tabba
2026-09-23 6:37 ` Anshuman Khandual
2026-09-23 13:00 ` Will Deacon
2 siblings, 1 reply; 6+ messages in thread
From: Oliver Upton @ 2026-09-22 19:47 UTC (permalink / raw)
To: Fuad Tabba
Cc: Catalin Marinas, Will Deacon, Marc Zyngier, Mark Rutland,
Anshuman Khandual, Rob Herring, James Clark, Jonathan Corbet,
Randy Dunlap, Shuah Khan, Fuad Tabba, linux-arm-kernel, kvmarm,
linux-doc, linux-kernel
Hi Fuad,
On Tue, Sep 22, 2026 at 07:14:30PM +0100, Fuad Tabba wrote:
> @@ -426,6 +427,11 @@
> orr x0, x0, #HDFGRTR2_EL2_nPMICNTR_EL0
> orr x0, x0, #HDFGRTR2_EL2_nPMICFILTR_EL0
> orr x0, x0, #HDFGRTR2_EL2_nPMUACR_EL1
> + orr x2, x2, #HDFGWTR2_EL2_nPMICNTR_EL0
> + orr x2, x2, #HDFGWTR2_EL2_nPMICFILTR_EL0
> + orr x2, x2, #HDFGWTR2_EL2_nPMUACR_EL1
> + /* PMZR_EL0 is write-only, so it has no read trap to disable */
> + orr x2, x2, #HDFGWTR2_EL2_nPMZR_EL0
We can trim 3 instructions from this by using the read-trap bits as the
starting point for the write-trap bits, like below. It also makes clear
the point that most of our trap bits are symmetrical for read and write.
Thanks,
Oliver
diff --git a/arch/arm64/include/asm/el2_setup.h b/arch/arm64/include/asm/el2_setup.h
index aa8ec9df8024..6c5d2cc4e6fa 100644
--- a/arch/arm64/include/asm/el2_setup.h
+++ b/arch/arm64/include/asm/el2_setup.h
@@ -418,6 +418,7 @@
b.lt .Lskip_fgt2_\@
mov x0, xzr
+ mov x2, xzr
mrs x1, id_aa64dfr0_el1
ubfx x1, x1, #ID_AA64DFR0_EL1_PMUVer_SHIFT, #4
cmp x1, #ID_AA64DFR0_EL1_PMUVer_V3P9
@@ -426,6 +427,9 @@
orr x0, x0, #HDFGRTR2_EL2_nPMICNTR_EL0
orr x0, x0, #HDFGRTR2_EL2_nPMICFILTR_EL0
orr x0, x0, #HDFGRTR2_EL2_nPMUACR_EL1
+
+ /* PMZR_EL0 is write-only, so it has no read trap to disable */
+ orr x2, x0, #HDFGWTR2_EL2_nPMZR_EL0
.Lskip_pmuv3p9_\@:
/* If SPE is implemented, */
__spe_vers_imp .Lskip_spefds_\@, ID_AA64DFR0_EL1_PMSVer_IMP, x1
@@ -439,7 +443,7 @@
.Lskip_spefds_\@:
msr_s SYS_HDFGRTR2_EL2, x0
- msr_s SYS_HDFGWTR2_EL2, x0
+ msr_s SYS_HDFGWTR2_EL2, x2
msr_s SYS_HFGRTR2_EL2, xzr
msr_s SYS_HFGWTR2_EL2, xzr
msr_s SYS_HFGITR2_EL2, xzr
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v1] arm64/boot: Disable trapping of PMZR_EL0 writes to EL2
2026-09-22 19:47 ` Oliver Upton
@ 2026-09-22 21:09 ` Fuad Tabba
2026-09-22 22:31 ` Oliver Upton
0 siblings, 1 reply; 6+ messages in thread
From: Fuad Tabba @ 2026-09-22 21:09 UTC (permalink / raw)
To: Oliver Upton
Cc: Catalin Marinas, Will Deacon, Marc Zyngier, Mark Rutland,
Anshuman Khandual, Rob Herring, James Clark, Jonathan Corbet,
Randy Dunlap, Shuah Khan, linux-arm-kernel, kvmarm, linux-doc,
linux-kernel
Hi Oliver,
On Tue, 22 Sep 2026 20:47:58 +0100, Oliver Upton <oupton@kernel.org> wrote:
[...]
> We can trim 3 instructions from this by using the read-trap bits as the
> starting point for the write-trap bits, like below. It also makes clear
> the point that most of our trap bits are symmetrical for read and write.
I did consider that, and went the other way for two reasons.
The read side has three bits with no write-side counterpart
(nPMSSDATA, nSPMDEVAFF_EL1, nSPMID), so copying x0 into x2 writes ones
into three RES0 bits of HDFGWTR2_EL2. Harmless today, but it's this
bug in reverse: the first revision that defines one of those positions
in the write register turns the copy into a silent behaviour change.
Building each mask from its own register's names can't do that.
It also matches __init_el2_fgt, which already keeps x0 and x2 apart
for HDFGRTR_EL2 and HDFGWTR_EL2. And even in that form the copy would
have to sit just before the msr_s, after the SPE block, or
nPMSDSFR_EL1 only lands in x0.
Cheers,
/fuad
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v1] arm64/boot: Disable trapping of PMZR_EL0 writes to EL2
2026-09-22 21:09 ` Fuad Tabba
@ 2026-09-22 22:31 ` Oliver Upton
0 siblings, 0 replies; 6+ messages in thread
From: Oliver Upton @ 2026-09-22 22:31 UTC (permalink / raw)
To: Fuad Tabba
Cc: Catalin Marinas, Will Deacon, Marc Zyngier, Mark Rutland,
Anshuman Khandual, Rob Herring, James Clark, Jonathan Corbet,
Randy Dunlap, Shuah Khan, linux-arm-kernel, kvmarm, linux-doc,
linux-kernel
On Tue, Sep 22, 2026 at 10:09:37PM +0100, Fuad Tabba wrote:
> Hi Oliver,
>
> On Tue, 22 Sep 2026 20:47:58 +0100, Oliver Upton <oupton@kernel.org> wrote:
> [...]
> > We can trim 3 instructions from this by using the read-trap bits as the
> > starting point for the write-trap bits, like below. It also makes clear
> > the point that most of our trap bits are symmetrical for read and write.
>
> I did consider that, and went the other way for two reasons.
>
> The read side has three bits with no write-side counterpart
> (nPMSSDATA, nSPMDEVAFF_EL1, nSPMID), so copying x0 into x2 writes ones
> into three RES0 bits of HDFGWTR2_EL2. Harmless today, but it's this
> bug in reverse: the first revision that defines one of those positions
> in the write register turns the copy into a silent behaviour change.
> Building each mask from its own register's names can't do that.
My thinking was that we could have a third block, but...
> It also matches __init_el2_fgt, which already keeps x0 and x2 apart
> for HDFGRTR_EL2 and HDFGWTR_EL2. And even in that form the copy would
> have to sit just before the msr_s, after the SPE block, or
> nPMSDSFR_EL1 only lands in x0.
new feature-specific initialization blocks will make this an absolute
mess. So I agree, this is the right fix.
Reviewed-by: Oliver Upton <oupton@kernel.org>
Best,
Oliver
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v1] arm64/boot: Disable trapping of PMZR_EL0 writes to EL2
2026-09-22 18:14 [PATCH v1] arm64/boot: Disable trapping of PMZR_EL0 writes to EL2 Fuad Tabba
2026-09-22 19:47 ` Oliver Upton
@ 2026-09-23 6:37 ` Anshuman Khandual
2026-09-23 13:00 ` Will Deacon
2 siblings, 0 replies; 6+ messages in thread
From: Anshuman Khandual @ 2026-09-23 6:37 UTC (permalink / raw)
To: Fuad Tabba
Cc: Catalin Marinas, Will Deacon, Marc Zyngier, Mark Rutland,
Rob Herring, James Clark, Jonathan Corbet, Randy Dunlap,
Shuah Khan, Fuad Tabba, linux-arm-kernel, kvmarm, linux-doc,
linux-kernel
On Tue, Sep 22, 2026 at 07:14:30PM +0100, Fuad Tabba wrote:
> __init_el2_fgt2() writes one mask to both HDFGRTR2_EL2 and HDFGWTR2_EL2.
> PMZR_EL0 is write-only, so its trap bit, nPMZR_EL0, exists only in
> HDFGWTR2_EL2 and is therefore never set: a PMZR_EL0 write from the host
> traps to EL2, where the nVHE hypervisor has no handler and BUG()s. The
> kernel never writes PMZR_EL0, but kernel.perf_user_access=1 has the PMU
> driver set PMUSERENR_EL0.UEN for a task with a user-read event, so a
> write from EL0 reaches the trap and takes the host down without a panic
> message.
>
> Accumulate the HDFGWTR2_EL2 bits separately, as __init_el2_fgt() already
> does for HDFGWTR_EL2, and set nPMZR_EL0 with the other FEAT_PMUv3p9
> bits.
>
> Fixes: 858c7bfcb35e1 ("arm64/boot: Enable EL2 requirements for FEAT_PMUv3p9")
> Cc: stable@vger.kernel.org
> Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
> ---
> Based on Linux 7.3-rc4 (93f51579e7df2).
>
> Documentation/arch/arm64/booting.rst | 1 +
> arch/arm64/include/asm/el2_setup.h | 9 ++++++++-
> 2 files changed, 9 insertions(+), 1 deletion(-)
>
> diff --git a/Documentation/arch/arm64/booting.rst b/Documentation/arch/arm64/booting.rst
> index 13ef311dace83..3fea4b14ef7c2 100644
> --- a/Documentation/arch/arm64/booting.rst
> +++ b/Documentation/arch/arm64/booting.rst
> @@ -465,6 +465,7 @@ Before jumping into the kernel, the following conditions must be met:
> - HDFGWTR2_EL2.nPMICNTR_EL0 (bit 2) must be initialised to 0b1.
> - HDFGWTR2_EL2.nPMICFILTR_EL0 (bit 3) must be initialised to 0b1.
> - HDFGWTR2_EL2.nPMUACR_EL1 (bit 4) must be initialised to 0b1.
> + - HDFGWTR2_EL2.nPMZR_EL0 (bit 21) must be initialised to 0b1.
>
> For CPUs with SPE data source filtering (FEAT_SPE_FDS):
>
> diff --git a/arch/arm64/include/asm/el2_setup.h b/arch/arm64/include/asm/el2_setup.h
> index aa8ec9df80243..87560d8b254e6 100644
> --- a/arch/arm64/include/asm/el2_setup.h
> +++ b/arch/arm64/include/asm/el2_setup.h
> @@ -418,6 +418,7 @@
> b.lt .Lskip_fgt2_\@
>
> mov x0, xzr
> + mov x2, xzr
> mrs x1, id_aa64dfr0_el1
> ubfx x1, x1, #ID_AA64DFR0_EL1_PMUVer_SHIFT, #4
> cmp x1, #ID_AA64DFR0_EL1_PMUVer_V3P9
> @@ -426,6 +427,11 @@
> orr x0, x0, #HDFGRTR2_EL2_nPMICNTR_EL0
> orr x0, x0, #HDFGRTR2_EL2_nPMICFILTR_EL0
> orr x0, x0, #HDFGRTR2_EL2_nPMUACR_EL1
> + orr x2, x2, #HDFGWTR2_EL2_nPMICNTR_EL0
> + orr x2, x2, #HDFGWTR2_EL2_nPMICFILTR_EL0
> + orr x2, x2, #HDFGWTR2_EL2_nPMUACR_EL1
> + /* PMZR_EL0 is write-only, so it has no read trap to disable */
> + orr x2, x2, #HDFGWTR2_EL2_nPMZR_EL0
> .Lskip_pmuv3p9_\@:
> /* If SPE is implemented, */
> __spe_vers_imp .Lskip_spefds_\@, ID_AA64DFR0_EL1_PMSVer_IMP, x1
> @@ -436,10 +442,11 @@
> cbz x1, .Lskip_spefds_\@
> /* disable traps of PMSDSFR to EL2. */
> orr x0, x0, #HDFGRTR2_EL2_nPMSDSFR_EL1
> + orr x2, x2, #HDFGWTR2_EL2_nPMSDSFR_EL1
>
> .Lskip_spefds_\@:
> msr_s SYS_HDFGRTR2_EL2, x0
> - msr_s SYS_HDFGWTR2_EL2, x0
> + msr_s SYS_HDFGWTR2_EL2, x2
> msr_s SYS_HFGRTR2_EL2, xzr
> msr_s SYS_HFGWTR2_EL2, xzr
> msr_s SYS_HFGITR2_EL2, xzr
>
> base-commit: 93f51579e7df248780214094418f205253383cc5
> --
> 2.39.5
>
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH v1] arm64/boot: Disable trapping of PMZR_EL0 writes to EL2
2026-09-22 18:14 [PATCH v1] arm64/boot: Disable trapping of PMZR_EL0 writes to EL2 Fuad Tabba
2026-09-22 19:47 ` Oliver Upton
2026-09-23 6:37 ` Anshuman Khandual
@ 2026-09-23 13:00 ` Will Deacon
2 siblings, 0 replies; 6+ messages in thread
From: Will Deacon @ 2026-09-23 13:00 UTC (permalink / raw)
To: Catalin Marinas, Fuad Tabba
Cc: mark.rutland, kernel-team, Will Deacon, Marc Zyngier,
Anshuman Khandual, Rob Herring, James Clark, Jonathan Corbet,
Randy Dunlap, Shuah Khan, linux-arm-kernel, kvmarm, linux-doc,
linux-kernel
On Tue, 22 Sep 2026 19:14:30 +0100, Fuad Tabba wrote:
> __init_el2_fgt2() writes one mask to both HDFGRTR2_EL2 and HDFGWTR2_EL2.
> PMZR_EL0 is write-only, so its trap bit, nPMZR_EL0, exists only in
> HDFGWTR2_EL2 and is therefore never set: a PMZR_EL0 write from the host
> traps to EL2, where the nVHE hypervisor has no handler and BUG()s. The
> kernel never writes PMZR_EL0, but kernel.perf_user_access=1 has the PMU
> driver set PMUSERENR_EL0.UEN for a task with a user-read event, so a
> write from EL0 reaches the trap and takes the host down without a panic
> message.
>
> [...]
Applied to arm64 (for-next/fixes), thanks!
[1/1] arm64/boot: Disable trapping of PMZR_EL0 writes to EL2
https://git.kernel.org/arm64/c/2bc6b218717b
Cheers,
--
Will
https://fixes.arm64.dev
https://next.arm64.dev
https://will.arm64.dev
^ permalink raw reply [flat|nested] 6+ messages in thread