Skip to content

arm64: T6050 at EL2: broken vGIC SEIS, WFxT treated as absent (K116s, KVM) - #1724

Merged
RyanTheTide merged 2 commits into
aurora-silicon:integration/aurorafrom
sithglan:thomas/t6050-el2-errata
Nov 13, 2026
Merged

RyanTheTide merged 2 commits into
aurora-silicon:integration/aurorafrom
sithglan:thomas/t6050-el2-errata

Conversation

@sithglan

Copy link
Copy Markdown
Contributor

Base: integration/aurora (6ea76a5). Two commits for the M5 Pro and M5 Max cores (parts 0x064 and 0x065) when Linux runs at EL2.

  • vGIC SEIS. At EL2, ICH_VTR_EL2 on the K116s reads 0x90580007: eight list registers and SEIS set, as on T6040 and T8140. The T6050 parts join apple_broken_seis_cpus, so KVM doesn't trust the locally generated SError the vGIC claims.
  • WFxT. ID_AA64ISAR2_EL1.WFxT reads 2 at EL2. Under the boot loader's EL1 monitor it read 0. The parts join has_wfxt()'s list, as T8142 and T8152 did. This is a precaution: the WFIT state loss itself was not measured on T6050.

Tested by Jens on the K116s, running Linux at EL2 on all 18 CPUs from a padded Stage 1 (CTXR window) on the 27.2 stub. The kernel was integration/aurora 2b4523c plus his series:

  • dmesg: "CPU: All CPU(s) started at EL2", "Known broken GICv3 SEIS implementation", "kvm [1]: VHE mode initialized successfully".
  • qemu -accel kvm -M virt,gic-version=3 -cpu host guests with 1, 2, 6 and 18 vCPUs boot and exit cleanly.
  • A sha256 loop under schedutil on all cores ran 67k times, with no wrong result. The kernel was not run at EL2 without the WFxT entries.

Build: arm64, LLVM 22, Image.gz modules dtbs with Jens's K116s config, in a test merge with the three other K116s branches sent today. Every commit builds on its own, and the test merge passes the host tests (tools/asahi/run-host-tests.py, 292 of 292).

Authorship. Jens Axboe wrote both commits and runs them on his K116s (16-inch MacBook Pro, M5 Pro, OLED; Mac17,12; stub macOS 27.2 26B8125). They come from his K116s bundle of 2026-11-12. I cherry-picked them onto integration/aurora 6ea76a5. I also updated the paragraphs that still described the machine at EL1 ("KVM itself has not yet run on this machine", "runs at EL1 under the boot loader's monitor"), using the EL2 results from his status mail of 2026-11-12. The code is unchanged. The commits carry his Signed-off-by.

cc @Acelogic @DjDeveloperr @RyanTheTide @LiamRay10

@DjDeveloperr DjDeveloperr left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@RyanTheTide RyanTheTide left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Both lists only gain the two T6050 parts, and the EL2 KVM results cover the SEIS entry. Looks good.

@RyanTheTide

Copy link
Copy Markdown
Contributor

@sithglan this no longer merges cleanly into integration/aurora (cpu_errata.c/cpufeature.c moved under it). Please rebase it and we'll merge it.

ICH_VTR_EL2 on the K116s (MacBook Pro 16-inch, M5 Pro, firmware 27.2)
reads 0x90580007 at EL2: eight list registers and SEIS set, on the boot
CPU, part 0x064. The other Apple cores with this value are listed in
apple_broken_seis_cpus so that KVM does not trust the locally generated
SError the vGIC claims to support; without the entry SMP guests livelock.
Add the two T6050 core parts.

The register was read through the boot loader's proxy at EL2 before
Linux ran. The K116s now runs Linux at EL2 on every CPU (padded Stage 1,
27.2) with this entry, which logs "Known broken GICv3 SEIS
implementation", and KVM works: qemu -accel kvm -M virt,gic-version=3
-cpu host guests with 1, 2, 6 and 18 vCPUs boot and exit cleanly.

Signed-off-by: Jens Axboe <axboe@kernel.dk>
has_wfxt() hides WFxT on the T8142 and T8152 cores, which clear
architectural state across WFIT. Add the T6050 (M5 Pro and Max) core
parts, 0x064 and 0x065.

This is a precaution, not a measured fix: the T6050 was not measured for
the WFIT state loss. Under the boot loader's EL1 monitor
ID_AA64ISAR2_EL1.WFxT read 0. The K116s now runs Linux at EL2 on every
CPU (padded Stage 1, 27.2), where the field reads 2, so ARM64_HAS_WFXT
would be set without these entries. With them, a sha256 loop under
schedutil on all 18 cores ran 67k times without a wrong result, and KVM
guests run. The kernel was not run at EL2 without them. __delay()
already skips WFIT on these cores by MIDR; the entries keep the
capability clear for its other users as well.

The HWCAP2_WFXT bit userspace sees comes from the ID register field, not
from this capability, and is not changed.

Signed-off-by: Jens Axboe <axboe@kernel.dk>
@sithglan
sithglan force-pushed the thomas/t6050-el2-errata branch from d751204 to af0dcdf Compare November 13, 2026 06:14
@sithglan

Copy link
Copy Markdown
Contributor Author

@RyanTheTide rebased onto integration 17903f5, now af0dcdf. The only conflict was in apple_broken_seis_cpus, where #1728 had added the T8142 parts; the list now has both pairs, T8142 then T6050. The WFxT commit applied unchanged. Both commits build (Image.gz, modules, dtbs with CONFIG_KVM=y).

@RyanTheTide
RyanTheTide merged commit 2b7d391 into aurora-silicon:integration/aurora Nov 13, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants