[PATCH v1] arm64/boot: Disable trapping of PMZR_EL0 writes to EL2

[Anshuman Khandual]

On Tue, Sep 22, 2026 at 07:14:30PM +0100, Fuad Tabba wrote:
> __init_el2_fgt2() writes one mask to both HDFGRTR2_EL2 and HDFGWTR2_EL2.
> PMZR_EL0 is write-only, so its trap bit, nPMZR_EL0, exists only in
> HDFGWTR2_EL2 and is therefore never set: a PMZR_EL0 write from the host
> traps to EL2, where the nVHE hypervisor has no handler and BUG()s. The
> kernel never writes PMZR_EL0, but kernel.perf_user_access=1 has the PMU
> driver set PMUSERENR_EL0.UEN for a task with a user-read event, so a
> write from EL0 reaches the trap and takes the host down without a panic
> message.
> 
> Accumulate the HDFGWTR2_EL2 bits separately, as __init_el2_fgt() already
> does for HDFGWTR_EL2, and set nPMZR_EL0 with the other FEAT_PMUv3p9
> bits.
> 
> Fixes: 858c7bfcb35e1 ("arm64/boot: Enable EL2 requirements for FEAT_PMUv3p9")
> Cc: stable at vger.kernel.org
> Signed-off-by: Fuad Tabba <fuad.tabba at linux.dev>

Reviewed-by: Anshuman Khandual <anshuman.khandual at arm.com>

> ---
> Based on Linux 7.3-rc4 (93f51579e7df2).
> 
>  Documentation/arch/arm64/booting.rst | 1 +
>  arch/arm64/include/asm/el2_setup.h   | 9 ++++++++-
>  2 files changed, 9 insertions(+), 1 deletion(-)
> 
> diff --git a/Documentation/arch/arm64/booting.rst b/Documentation/arch/arm64/booting.rst
> index 13ef311dace83..3fea4b14ef7c2 100644
> --- a/Documentation/arch/arm64/booting.rst
> +++ b/Documentation/arch/arm64/booting.rst
> @@ -465,6 +465,7 @@ Before jumping into the kernel, the following conditions must be met:
>      - HDFGWTR2_EL2.nPMICNTR_EL0 (bit 2) must be initialised to 0b1.
>      - HDFGWTR2_EL2.nPMICFILTR_EL0 (bit 3) must be initialised to 0b1.
>      - HDFGWTR2_EL2.nPMUACR_EL1 (bit 4) must be initialised to 0b1.
> +    - HDFGWTR2_EL2.nPMZR_EL0 (bit 21) must be initialised to 0b1.
>  
>    For CPUs with SPE data source filtering (FEAT_SPE_FDS):
>  
> diff --git a/arch/arm64/include/asm/el2_setup.h b/arch/arm64/include/asm/el2_setup.h
> index aa8ec9df80243..87560d8b254e6 100644
> --- a/arch/arm64/include/asm/el2_setup.h
> +++ b/arch/arm64/include/asm/el2_setup.h
> @@ -418,6 +418,7 @@
>  	b.lt	.Lskip_fgt2_\@
>  
>  	mov	x0, xzr
> +	mov	x2, xzr
>  	mrs	x1, id_aa64dfr0_el1
>  	ubfx	x1, x1, #ID_AA64DFR0_EL1_PMUVer_SHIFT, #4
>  	cmp	x1, #ID_AA64DFR0_EL1_PMUVer_V3P9
> @@ -426,6 +427,11 @@
>  	orr	x0, x0, #HDFGRTR2_EL2_nPMICNTR_EL0
>  	orr	x0, x0, #HDFGRTR2_EL2_nPMICFILTR_EL0
>  	orr	x0, x0, #HDFGRTR2_EL2_nPMUACR_EL1
> +	orr	x2, x2, #HDFGWTR2_EL2_nPMICNTR_EL0
> +	orr	x2, x2, #HDFGWTR2_EL2_nPMICFILTR_EL0
> +	orr	x2, x2, #HDFGWTR2_EL2_nPMUACR_EL1
> +	/* PMZR_EL0 is write-only, so it has no read trap to disable */
> +	orr	x2, x2, #HDFGWTR2_EL2_nPMZR_EL0
>  .Lskip_pmuv3p9_\@:
>  	/* If SPE is implemented, */
>  	__spe_vers_imp .Lskip_spefds_\@, ID_AA64DFR0_EL1_PMSVer_IMP, x1
> @@ -436,10 +442,11 @@
>  	cbz	x1, .Lskip_spefds_\@
>  	/* disable traps of PMSDSFR to EL2. */
>  	orr	x0, x0, #HDFGRTR2_EL2_nPMSDSFR_EL1
> +	orr	x2, x2, #HDFGWTR2_EL2_nPMSDSFR_EL1
>  
>  .Lskip_spefds_\@:
>  	msr_s   SYS_HDFGRTR2_EL2, x0
> -	msr_s   SYS_HDFGWTR2_EL2, x0
> +	msr_s   SYS_HDFGWTR2_EL2, x2
>  	msr_s   SYS_HFGRTR2_EL2, xzr
>  	msr_s   SYS_HFGWTR2_EL2, xzr
>  	msr_s   SYS_HFGITR2_EL2, xzr
> 
> base-commit: 93f51579e7df248780214094418f205253383cc5
> -- 
> 2.39.5
>