[PATCH 06/28] KVM: arm64: Classify CPTR_EL2 as a SR_LOC_SPECIAL register

[Joey Gouly]

On Thu, Jul 02, 2026 at 05:02:26PM +0100, Marc Zyngier wrote:
> It may not be obvious unless you look at it closely, but CPTR_EL2
> is treated very differently from other registers. It is one the
> registers that, despite looking very similar between EL1 and EL2
> when E2H==1, have RES0 bits that get in the way.
> 
> Make it clear that CPTR_EL2 is odd by classifying it as SR_LOC_SPECIAL,
> just like CNTHCTL_EL2 (and for the same reasons). This makes it
> possible to use vcpu_read_sys_reg() with it, and will be necessary
> once we support FEAT_NV2P1.
> 
> Signed-off-by: Marc Zyngier <maz at kernel.org>

Reviewed-by: Joey Gouly <joey.gouly at arm.com>

> ---
>  arch/arm64/include/asm/kvm_emulate.h |  2 +-
>  arch/arm64/kvm/sys_regs.c            | 20 ++++++++++++++++++--
>  2 files changed, 19 insertions(+), 3 deletions(-)
> 
> diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h
> index 5bf3d7e1d92c7..9831166695186 100644
> --- a/arch/arm64/include/asm/kvm_emulate.h
> +++ b/arch/arm64/include/asm/kvm_emulate.h
> @@ -617,7 +617,7 @@ static __always_inline void kvm_incr_pc(struct kvm_vcpu *vcpu)
>   */
>  static inline u64 vcpu_sanitised_cptr_el2(const struct kvm_vcpu *vcpu)
>  {
> -	u64 cptr = __vcpu_sys_reg(vcpu, CPTR_EL2);
> +	u64 cptr = vcpu_read_sys_reg(vcpu, CPTR_EL2);
>  
>  	if (!vcpu_el2_e2h_is_set(vcpu))
>  		cptr = translate_cptr_el2_to_cpacr_el1(cptr);
> diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
> index 5d5c579d45790..6b47d936efb32 100644
> --- a/arch/arm64/kvm/sys_regs.c
> +++ b/arch/arm64/kvm/sys_regs.c
> @@ -183,8 +183,6 @@ static void locate_register(const struct kvm_vcpu *vcpu, enum vcpu_sysreg reg,
>  	switch (reg) {
>  		MAPPED_EL2_SYSREG(SCTLR_EL2,   SCTLR_EL1,
>  				  translate_sctlr_el2_to_sctlr_el1	     );
> -		MAPPED_EL2_SYSREG(CPTR_EL2,    CPACR_EL1,
> -				  translate_cptr_el2_to_cpacr_el1	     );
>  		MAPPED_EL2_SYSREG(TTBR0_EL2,   TTBR0_EL1,
>  				  translate_ttbr0_el2_to_ttbr0_el1	     );
>  		MAPPED_EL2_SYSREG(TTBR1_EL2,   TTBR1_EL1,   NULL	     );
> @@ -210,6 +208,19 @@ static void locate_register(const struct kvm_vcpu *vcpu, enum vcpu_sysreg reg,
>  		loc->loc = ((is_hyp_ctxt(vcpu) && vcpu_el2_e2h_is_set(vcpu)) ?
>  			    SR_LOC_SPECIAL : SR_LOC_MEMORY);
>  		break;
> +	case CPTR_EL2:
> +		/*
> +		 * CPTR_EL2 is just as special, and needs a certain amount
> +		 * of handholding. It always lives in memory, due to being
> +		 * heavily trapped thanks to CPACR_EL1.TCPAC being RES0.
> +		 * FEAT_NV2p1 fixes this.
> +		 */
> +		locate_mapped_el2_register(vcpu, CPTR_EL2, CPACR_EL1,
> +					   translate_cptr_el2_to_cpacr_el1,
> +					   loc);
> +		if (is_hyp_ctxt(vcpu) && vcpu_el2_e2h_is_set(vcpu))
> +			loc->loc = SR_LOC_SPECIAL;

Very Minor thing here (feel free to ignore) is that this deviates from
CNTHCTL_EL2 slightly in that it does: `loc->loc = .. ? SR_LOC : SR_LOC`..

> +		break;
>  	default:
>  		loc->loc = locate_direct_register(vcpu, reg);
>  	}
> @@ -314,6 +325,8 @@ u64 vcpu_read_sys_reg(const struct kvm_vcpu *vcpu, enum vcpu_sysreg reg)
>  			val &= CNTKCTL_VALID_BITS;
>  			val |= __vcpu_sys_reg(vcpu, reg) & ~CNTKCTL_VALID_BITS;
>  			return val;
> +		case CPTR_EL2:
> +			return __vcpu_sys_reg(vcpu, reg);
>  		default:
>  			WARN_ON_ONCE(1);
>  		}
> @@ -359,6 +372,9 @@ void vcpu_write_sys_reg(struct kvm_vcpu *vcpu, u64 val, enum vcpu_sysreg reg)
>  			 */
>  			write_sysreg_el1(val, SYS_CNTKCTL);
>  			break;
> +		case CPTR_EL2:
> +			write_sysreg_el1(val, SYS_CPACR);
> +			break;
>  		default:
>  			WARN_ON_ONCE(1);
>  		}
> -- 
> 2.47.3
> 

Thanks,
Joey