[PATCH] riscv/kvm: Only context-switch senvcfg where it exists

[Anup Patel]

On Thu, Aug 27, 2026 at 11:12 PM Davidlohr Bueso <dave at stgolabs.net> wrote:
>
> senvcfg arrived in privileged spec 1.12, but H-capable cores on a
> 1.11 base exist, ie: sifive P500 (ESWIN EIC7700X) implements the
> hypervisor extension yet has no senvcfg. KVM swaps the CSR
> unconditionally on every vCPU entry, panicing the host upon a guest
> executing its first instruction:
>
>   Oops - illegal instruction [#1]
>   Modules linked in: kvm
>   CPU: 2 UID: 0 PID: 127 Comm: qemu-system-ris Not tainted 7.2.0-kvm73bug+ #4 PREEMPTLAZY
>   Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2024.01 01/01/2024
>   epc : kvm_riscv_vcpu_enter_exit+0x26/0xcf8 [kvm]
>    ra : kvm_arch_vcpu_ioctl_run+0x4ce/0x5a6 [kvm]
>   status: 0000000200000100 badaddr: 0000000010a797f3 cause: 0000000000000002
>   [<ffffffff01df432e>] kvm_riscv_vcpu_enter_exit+0x26/0xcf8 [kvm]
>   [<ffffffff01deb3b0>] kvm_arch_vcpu_ioctl_run+0x4ce/0x5a6 [kvm]
>   [<ffffffff01dd7914>] kvm_vcpu_ioctl+0x180/0x5e4 [kvm]
>   [<ffffffff8025702e>] __riscv_sys_ioctl+0x84/0x9a
>   [<ffffffff80dfdc72>] do_trap_ecall_u+0x1d8/0x38a
>   [<ffffffff80e08644>] handle_exception+0x168/0x174
>   Code: 84aa 892e b703 8887 1773 1067 3023 16e5 b783 8907 (97f3) 10a7
>
> Touch the CSR only when RISCV_ISA_EXT_XLINUXENVCFG is set, similar
> to __switch_to_envcfg() as well as other swaps conditional on
> their extentions.
>
> Fixes: db3c01c7a308 ("RISCV: KVM: Add senvcfg context save/restore")
> Signed-off-by: Davidlohr Bueso <dave at stgolabs.net>

Your patch is only checking RISCV_ISA_EXT_XLINUXENVCFG when
saving/restoring senvcfg but not checking RISCV_ISA_EXT_XLINUXENVCFG
when accessing henvcfg. This tells me that P500 somehow manages to
implement henvcfg but forgot to implement senvcfg. Clearly, checking
RISCV_ISA_EXT_XLINUXENVCFG is not the right approach.

Instead, I suggest introducing static-key kvm_riscv_no_senvcfg and set
it only for P500 (ESWIN EIC7700X) in kvm_riscv_setup_vendor_features().
Also, don't save/restore senvcfg CSR only when kvm_riscv_no_senvcfg is
set.

Regards,
Anup

> ---
>  arch/riscv/kvm/vcpu.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/arch/riscv/kvm/vcpu.c b/arch/riscv/kvm/vcpu.c
> index e062ca19f9d8..0c2d58db13ab 100644
> --- a/arch/riscv/kvm/vcpu.c
> +++ b/arch/riscv/kvm/vcpu.c
> @@ -773,7 +773,8 @@ static __always_inline void kvm_riscv_vcpu_swap_in_guest_state(struct kvm_vcpu *
>         struct kvm_vcpu_csr *csr = &vcpu->arch.guest_csr;
>
>         vcpu->arch.host_scounteren = csr_swap(CSR_SCOUNTEREN, csr->scounteren);
> -       vcpu->arch.host_senvcfg = csr_swap(CSR_SENVCFG, csr->senvcfg);
> +       if (riscv_has_extension_unlikely(RISCV_ISA_EXT_XLINUXENVCFG))
> +               vcpu->arch.host_senvcfg = csr_swap(CSR_SENVCFG, csr->senvcfg);
>         if (riscv_has_extension_unlikely(RISCV_ISA_EXT_SMSTATEEN))
>                 vcpu->arch.host_sstateen0 = csr_swap(CSR_SSTATEEN0, smcsr->sstateen0);
>         if (riscv_has_extension_unlikely(RISCV_ISA_EXT_ZICFISS))
> @@ -787,7 +788,8 @@ static __always_inline void kvm_riscv_vcpu_swap_in_host_state(struct kvm_vcpu *v
>         struct kvm_vcpu_csr *csr = &vcpu->arch.guest_csr;
>
>         csr->scounteren = csr_swap(CSR_SCOUNTEREN, vcpu->arch.host_scounteren);
> -       csr->senvcfg = csr_swap(CSR_SENVCFG, vcpu->arch.host_senvcfg);
> +       if (riscv_has_extension_unlikely(RISCV_ISA_EXT_XLINUXENVCFG))
> +               csr->senvcfg = csr_swap(CSR_SENVCFG, vcpu->arch.host_senvcfg);
>         if (riscv_has_extension_unlikely(RISCV_ISA_EXT_SMSTATEEN))
>                 smcsr->sstateen0 = csr_swap(CSR_SSTATEEN0, vcpu->arch.host_sstateen0);
>         if (riscv_has_extension_unlikely(RISCV_ISA_EXT_ZICFISS))
> --
> 2.39.5
>