On Tue, Jun 3, 2025 at 10:09 PM Jiaqi Yan jiaqiyan@google.com wrote:

When APEI fails to handle a stage-2 synchronous external abort (SEA), today KVM directly injects an async SError to the VCPU then resumes it, which usually results in unpleasant guest kernel panic.

One major situation of guest SEA is when vCPU consumes recoverable uncorrected memory error (UER). Although SError and guest kernel panic effectively stops the propagation of corrupted memory, there is room to recover from an UER in a more graceful manner.

Alternatively KVM can redirect the synchronous SEA event to VMM to

• Reduce blast radius if possible. VMM can inject a SEA to VCPU via KVM's existing KVM_SET_VCPU_EVENTS API. If the memory poison consumption or fault is not from guest kernel, blast radius can be limited to the triggering thread in guest userspace, so VM can keep running.
• VMM can protect from future memory poison consumption by unmapping the page from stage-2, or interrupt guest of the poisoned guest page so guest kernel can unmap it from stage-1.
• VMM can also track SEA events that VM customers care about, restart VM when certain number of distinct poison events have happened, provide observability to customers in log management UI.

Introduce an userspace-visible feature to enable VMM to handle SEA:

• KVM_CAP_ARM_SEA_TO_USER. As the alternative fallback behavior when host APEI fails to claim a SEA, userspace can opt in this new capability to let KVM exit to userspace during SEA if it is not caused by access on memory of stage-2 translation table.
• KVM_EXIT_ARM_SEA. A new exit reason is introduced for this. KVM fills kvm_run.arm_sea with as much as possible information about the SEA, enabling VMM to emulate SEA to guest by itself.
  • Sanitized ESR_EL2. The general rule is to keep only the bits useful for userspace and relevant to guest memory. See code comments for why bits are hidden/reported.
  • If faulting guest virtual and physical addresses are available.
  • Faulting guest virtual address if available.
  • Faulting guest physical address if available.

Signed-off-by: Jiaqi Yan jiaqiyan@google.com

arch/arm64/include/asm/kvm_emulate.h | 67 ++++++++++++++++++++++++++++ arch/arm64/include/asm/kvm_host.h | 8 ++++ arch/arm64/include/asm/kvm_ras.h | 2 +- arch/arm64/kvm/arm.c | 5 +++ arch/arm64/kvm/mmu.c | 59 +++++++++++++++++++----- include/uapi/linux/kvm.h | 11 +++++ 6 files changed, 141 insertions(+), 11 deletions(-)

diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h index bd020fc28aa9c..ac602f8503622 100644 --- a/arch/arm64/include/asm/kvm_emulate.h +++ b/arch/arm64/include/asm/kvm_emulate.h @@ -429,6 +429,73 @@ static __always_inline bool kvm_vcpu_abt_issea(const struct kvm_vcpu *vcpu) } }

+/*

• • Return true if SEA is on an access made for stage-2 translation table walk.
• */

+static inline bool kvm_vcpu_sea_iss2ttw(const struct kvm_vcpu *vcpu) +{

•   u64 esr = kvm_vcpu_get_esr(vcpu);
  

•   if (!esr_fsc_is_sea_ttw(esr) && !esr_fsc_is_secc_ttw(esr))
  

•           return false;
  

•   return !(esr & ESR_ELx_S1PTW);
  

+}

+/*

• • Sanitize ESR_EL2 before KVM_EXIT_ARM_SEA. The general rule is to keep
• • only the SEA-relevant bits that are useful for userspace and relevant to
• • guest memory.
• */

+static inline u64 kvm_vcpu_sea_esr_sanitized(const struct kvm_vcpu *vcpu) +{

•   u64 esr = kvm_vcpu_get_esr(vcpu);
  

•   /*
  

•    * Starting with zero to hide the following bits:
  

•    * - HDBSSF: hardware dirty state is not guest memory.
  

•    * - TnD, TagAccess, AssuredOnly, Overlay, DirtyBit: they are
  

•    *   for permission fault.
  

•    * - GCS: not guest memory.
  

•    * - Xs: it is for translation/access flag/permission fault.
  

•    * - ISV: it is 1 mostly for Translation fault, Access flag fault,
  

•    *        or Permission fault. Only when FEAT_RAS is not implemented,
  

•    *        it may be set to 1 (implementation defined) for S2PTW,
  

•    *        which not worthy to return to userspace anyway.
  

•    * - ISS[23:14]: because ISV is already hidden.
  

•    * - VNCR: VNCR_EL2 is not guest memory.
  

•    */
  

•   u64 sanitized = 0ULL;
  

•   /*
  

•    * Reasons to make these bits visible to userspace:
  

•    * - EC: tell if abort on instruction or data.
  

•    * - IL: useful if userspace decides to retire the instruction.
  

•    * - FSC: tell if abort on translation table walk.
  

•    * - SET: tell if abort is recoverable, uncontainable, or
  

•    *        restartable.
  

•    * - S1PTW: userspace can tell guest its stage-1 has problem.
  

•    * - FnV: userspace should avoid writing FAR_EL1 if FnV=1.
  

•    * - CM and WnR: make ESR "authentic" in general.
  

•    */
  

•   sanitized |= esr & (ESR_ELx_EC_MASK | ESR_ELx_IL | ESR_ELx_FSC |
  

•                       ESR_ELx_SET_MASK | ESR_ELx_S1PTW | ESR_ELx_FnV |
  

•                       ESR_ELx_CM | ESR_ELx_WNR);
  

•   return sanitized;
  

+}

+/* Return true if faulting guest virtual address during SEA is valid. */ +static inline bool kvm_vcpu_sea_far_valid(const struct kvm_vcpu *vcpu) +{

•   return !(kvm_vcpu_get_esr(vcpu) & ESR_ELx_FnV);
  

+}

+/* Return true if faulting guest physical address during SEA is valid. */ +static inline bool kvm_vcpu_sea_ipa_valid(const struct kvm_vcpu *vcpu) +{

•   return vcpu->arch.fault.hpfar_el2 & HPFAR_EL2_NS;
  

+}

static __always_inline int kvm_vcpu_sys_get_rt(struct kvm_vcpu *vcpu) { u64 esr = kvm_vcpu_get_esr(vcpu); diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h index d941abc6b5eef..4b27e988ec768 100644 --- a/arch/arm64/include/asm/kvm_host.h +++ b/arch/arm64/include/asm/kvm_host.h @@ -349,6 +349,14 @@ struct kvm_arch { #define KVM_ARCH_FLAG_GUEST_HAS_SVE 9 /* MIDR_EL1, REVIDR_EL1, and AIDR_EL1 are writable from userspace */ #define KVM_ARCH_FLAG_WRITABLE_IMP_ID_REGS 10

•   /*
  

•    * When APEI failed to claim stage-2 synchronous external abort
  

•    * (SEA) return to userspace with fault information. Userspace
  

•    * can opt in this feature if KVM_CAP_ARM_SEA_TO_USER is
  

•    * supported. Userspace is encouraged to handle this VM exit
  

•    * by injecting a SEA to VCPU before resume the VCPU.
  

•    */
  

+#define KVM_ARCH_FLAG_RETURN_SEA_TO_USER 11 unsigned long flags;

    /* VM-wide vCPU feature set */

diff --git a/arch/arm64/include/asm/kvm_ras.h b/arch/arm64/include/asm/kvm_ras.h index 9398ade632aaf..760a5e34489b1 100644 --- a/arch/arm64/include/asm/kvm_ras.h +++ b/arch/arm64/include/asm/kvm_ras.h @@ -14,7 +14,7 @@

• Was this synchronous external abort a RAS notification?
• Returns '0' for errors handled by some RAS subsystem, or -ENOENT.

*/ -static inline int kvm_handle_guest_sea(void) +static inline int kvm_delegate_guest_sea(void) { /* apei_claim_sea(NULL) expects to mask interrupts itself */ lockdep_assert_irqs_enabled(); diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c index 505d504b52b53..99e0c6c16e437 100644 --- a/arch/arm64/kvm/arm.c +++ b/arch/arm64/kvm/arm.c @@ -133,6 +133,10 @@ int kvm_vm_ioctl_enable_cap(struct kvm *kvm, } mutex_unlock(&kvm->lock); break;

•   case KVM_CAP_ARM_SEA_TO_USER:
  

•           r = 0;
  

•           set_bit(KVM_ARCH_FLAG_RETURN_SEA_TO_USER, &kvm->arch.flags);
  

•           break;
    default:
            break;
    }
  

@@ -322,6 +326,7 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext) case KVM_CAP_IRQFD_RESAMPLE: case KVM_CAP_COUNTER_OFFSET: case KVM_CAP_ARM_WRITABLE_IMP_ID_REGS:

•   case KVM_CAP_ARM_SEA_TO_USER:
            r = 1;
            break;
    case KVM_CAP_SET_GUEST_DEBUG2:
  

diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c index e445db2cb4a43..5a50d0ed76a68 100644 --- a/arch/arm64/kvm/mmu.c +++ b/arch/arm64/kvm/mmu.c @@ -1775,6 +1775,53 @@ static void handle_access_fault(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa) read_unlock(&vcpu->kvm->mmu_lock); }

+/* Handle stage-2 synchronous external abort (SEA). */ +static int kvm_handle_guest_sea(struct kvm_vcpu *vcpu) +{

•   struct kvm_run *run = vcpu->run;
  

•   /* Delegate to APEI for RAS and if it can claim SEA, resume guest. */
  

•   if (kvm_delegate_guest_sea() == 0)
  

•           return 1;
  

•   /*
  

•    * In addition to userspace opt out KVM_ARCH_FLAG_RETURN_SEA_TO_USER,
  

•    * when the SEA is caused on memory for stage-2 page table, returning
  

•    * to userspace doesn't bring any benefit: eventually a EL2 exception
  

•    * will crash the host kernel.
  

•    */
  

•   if (!test_bit(KVM_ARCH_FLAG_RETURN_SEA_TO_USER,
  

•                 &vcpu->kvm->arch.flags) ||
  

•       kvm_vcpu_sea_iss2ttw(vcpu)) {
  

•           /* Fallback behavior prior to KVM_EXIT_ARM_SEA. */
  

•           kvm_inject_vabt(vcpu);
  

•           return 1;
  

•   }
  

•   /*
  

•    * Exit to userspace, and provide faulting guest virtual and physical
  

•    * addresses in case userspace wants to emulate SEA to guest by
  

•    * writing to FAR_EL1 and HPFAR_EL1 registers.
  

•    */
  

•   run->exit_reason = KVM_EXIT_ARM_SEA;
  

•   run->arm_sea.esr = kvm_vcpu_sea_esr_sanitized(vcpu);
  

•   run->arm_sea.flags = 0ULL;
  

•   run->arm_sea.gva = 0ULL;
  

•   run->arm_sea.gpa = 0ULL;
  

•   if (kvm_vcpu_sea_far_valid(vcpu)) {
  

•           run->arm_sea.flags |= KVM_EXIT_ARM_SEA_FLAG_GVA_VALID;
  

•           run->arm_sea.gva = kvm_vcpu_get_hfar(vcpu);
  

•   }
  

•   if (kvm_vcpu_sea_ipa_valid(vcpu)) {
  

•           run->arm_sea.flags |= KVM_EXIT_ARM_SEA_FLAG_GPA_VALID;
  

•           run->arm_sea.gpa = kvm_vcpu_get_fault_ipa(vcpu);
  

•   }
  

•   return 0;
  

+}

/**

• kvm_handle_guest_abort - handles all 2nd stage aborts
• @vcpu: the VCPU pointer

@@ -1799,16 +1846,8 @@ int kvm_handle_guest_abort(struct kvm_vcpu *vcpu) int ret, idx;

    /* Synchronous External Abort? */

•   if (kvm_vcpu_abt_issea(vcpu)) {
  

•           /*
  

•            * For RAS the host kernel may handle this abort.
  

•            * There is no need to pass the error into the guest.
  

•            */
  

•           if (kvm_handle_guest_sea())
  

•                   kvm_inject_vabt(vcpu);
  

•           return 1;
  

•   }
  

•   if (kvm_vcpu_abt_issea(vcpu))
  

•           return kvm_handle_guest_sea(vcpu);
  
    esr = kvm_vcpu_get_esr(vcpu);
  
  

diff --git a/include/uapi/linux/kvm.h b/include/uapi/linux/kvm.h index c9d4a908976e8..4fed3fdfb13d6 100644 --- a/include/uapi/linux/kvm.h +++ b/include/uapi/linux/kvm.h @@ -178,6 +178,7 @@ struct kvm_xen_exit { #define KVM_EXIT_NOTIFY 37 #define KVM_EXIT_LOONGARCH_IOCSR 38 #define KVM_EXIT_MEMORY_FAULT 39 +#define KVM_EXIT_ARM_SEA 40

/* For KVM_EXIT_INTERNAL_ERROR */ /* Emulate instruction failed. */ @@ -446,6 +447,15 @@ struct kvm_run { __u64 gpa; __u64 size; } memory_fault;

•           /* KVM_EXIT_ARM_SEA */
  

•           struct {
  

•                   __u64 esr;
  

+#define KVM_EXIT_ARM_SEA_FLAG_GVA_VALID (1ULL << 0) +#define KVM_EXIT_ARM_SEA_FLAG_GPA_VALID (1ULL << 1)

•                   __u64 flags;
  

•                   __u64 gva;
  

•                   __u64 gpa;
  

•           } arm_sea;
            /* Fix the size of the union. */
            char padding[256];
    };
  

@@ -932,6 +942,7 @@ struct kvm_enable_cap { #define KVM_CAP_ARM_WRITABLE_IMP_ID_REGS 239 #define KVM_CAP_ARM_EL2 240 #define KVM_CAP_ARM_EL2_E2H0 241 +#define KVM_CAP_ARM_SEA_TO_USER 242

struct kvm_irq_routing_irqchip { __u32 irqchip; -- 2.49.0.1266.g31b7d2e469-goog

Humbly ping for reviews / comments

On Fri, Jul 11, 2025 at 12:40 PM Oliver Upton oliver.upton@linux.dev wrote:

Hi Jiaqi,

On Wed, Jun 04, 2025 at 05:08:56AM +0000, Jiaqi Yan wrote:

...

When APEI fails to handle a stage-2 synchronous external abort (SEA), today KVM directly injects an async SError to the VCPU then resumes it, which usually results in unpleasant guest kernel panic.

One major situation of guest SEA is when vCPU consumes recoverable uncorrected memory error (UER). Although SError and guest kernel panic effectively stops the propagation of corrupted memory, there is room to recover from an UER in a more graceful manner.

Alternatively KVM can redirect the synchronous SEA event to VMM to

• Reduce blast radius if possible. VMM can inject a SEA to VCPU via KVM's existing KVM_SET_VCPU_EVENTS API. If the memory poison consumption or fault is not from guest kernel, blast radius can be limited to the triggering thread in guest userspace, so VM can keep running.
• VMM can protect from future memory poison consumption by unmapping the page from stage-2, or interrupt guest of the poisoned guest page so guest kernel can unmap it from stage-1.
• VMM can also track SEA events that VM customers care about, restart VM when certain number of distinct poison events have happened, provide observability to customers in log management UI.

Introduce an userspace-visible feature to enable VMM to handle SEA:

• KVM_CAP_ARM_SEA_TO_USER. As the alternative fallback behavior when host APEI fails to claim a SEA, userspace can opt in this new capability to let KVM exit to userspace during SEA if it is not caused by access on memory of stage-2 translation table.
• KVM_EXIT_ARM_SEA. A new exit reason is introduced for this. KVM fills kvm_run.arm_sea with as much as possible information about the SEA, enabling VMM to emulate SEA to guest by itself.
  • Sanitized ESR_EL2. The general rule is to keep only the bits useful for userspace and relevant to guest memory. See code comments for why bits are hidden/reported.
  • If faulting guest virtual and physical addresses are available.
  • Faulting guest virtual address if available.
  • Faulting guest physical address if available.

Signed-off-by: Jiaqi Yan jiaqiyan@google.com

I was reviewing this locally and wound up making enough changes where it just made more sense to share the diff. General comments:

Thanks for the diff, Oliver! I will work on a v3 based on it.

• Avoid adding helpers to headers when they're used in a single callsite / compilation unit

• Add some detail about FEAT_RAS where we may still exit to userspace for host-controlled memory, as we cannot differentiate between a stage-1 or stage-2 TTW SEA when taken on the descriptor PA

Ah, IIUC, you are saying even if the FSC code tells fault is on TTW (esr_fsc_is_secc_ttw or esr_fsc_is_sea_ttw), it can either be guest stage-1's or stage-2's descriptor PA, and we can tell which from which.

However, if ESR_ELx_S1PTW is set, we can tell this is a sub-case of stage-2 descriptor PA, their usage is for stage-1 PTW but they are stage-2 memory.

Is my current understanding right?

• Explicitly handle SEAs due to VNCR (I have a separate prereq patch)

From aac0bb8f90c43b5b17c3b4e50379cb8ca828812c Mon Sep 17 00:00:00 2001 From: Jiaqi Yan jiaqiyan@google.com Date: Wed, 4 Jun 2025 05:08:56 +0000 Subject: [PATCH] KVM: arm64: VM exit to userspace to handle SEA

When APEI fails to handle a stage-2 synchronous external abort (SEA), today KVM directly injects an async SError to the VCPU then resumes it, which usually results in unpleasant guest kernel panic.

One major situation of guest SEA is when vCPU consumes recoverable uncorrected memory error (UER). Although SError and guest kernel panic effectively stops the propagation of corrupted memory, there is room to recover from an UER in a more graceful manner.

Alternatively KVM can redirect the synchronous SEA event to VMM to

• Reduce blast radius if possible. VMM can inject a SEA to VCPU via KVM's existing KVM_SET_VCPU_EVENTS API. If the memory poison consumption or fault is not from guest kernel, blast radius can be limited to the triggering thread in guest userspace, so VM can keep running.
• VMM can protect from future memory poison consumption by unmapping the page from stage-2, or interrupt guest of the poisoned guest page so guest kernel can unmap it from stage-1.
• VMM can also track SEA events that VM customers care about, restart VM when certain number of distinct poison events have happened, provide observability to customers in log management UI.

Introduce an userspace-visible feature to enable VMM to handle SEA:

• KVM_CAP_ARM_SEA_TO_USER. As the alternative fallback behavior when host APEI fails to claim a SEA, userspace can opt in this new capability to let KVM exit to userspace during SEA if it is not caused by access on memory of stage-2 translation table.
• KVM_EXIT_ARM_SEA. A new exit reason is introduced for this. KVM fills kvm_run.arm_sea with as much as possible information about the SEA, enabling VMM to emulate SEA to guest by itself.
  • Sanitized ESR_EL2. The general rule is to keep only the bits useful for userspace and relevant to guest memory. See code comments for why bits are hidden/reported.
  • If faulting guest virtual and physical addresses are available.
  • Faulting guest virtual address if available.
  • Faulting guest physical address if available.

Signed-off-by: Jiaqi Yan jiaqiyan@google.com Link: https://lore.kernel.org/r/20250604050902.3944054-2-jiaqiyan@google.com Signed-off-by: Oliver Upton oliver.upton@linux.dev

---

arch/arm64/include/asm/kvm_host.h | 2 + arch/arm64/kvm/arm.c | 5 +++ arch/arm64/kvm/mmu.c | 67 ++++++++++++++++++++++++++++++- include/uapi/linux/kvm.h | 10 +++++ 4 files changed, 83 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h index e54d29feb469..98ce2d58ac8d 100644 --- a/arch/arm64/include/asm/kvm_host.h +++ b/arch/arm64/include/asm/kvm_host.h @@ -349,6 +349,8 @@ struct kvm_arch { #define KVM_ARCH_FLAG_GUEST_HAS_SVE 9 /* MIDR_EL1, REVIDR_EL1, and AIDR_EL1 are writable from userspace */ #define KVM_ARCH_FLAG_WRITABLE_IMP_ID_REGS 10

•   /* Unhandled SEAs are taken to userspace */
  

+#define KVM_ARCH_FLAG_EXIT_SEA 11 unsigned long flags;

    /* VM-wide vCPU feature set */

diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c index 7a1a8210ff91..aec6034db1e7 100644 --- a/arch/arm64/kvm/arm.c +++ b/arch/arm64/kvm/arm.c @@ -133,6 +133,10 @@ int kvm_vm_ioctl_enable_cap(struct kvm *kvm, } mutex_unlock(&kvm->lock); break;

•   case KVM_CAP_ARM_SEA_TO_USER:
  

•           r = 0;
  

•           set_bit(KVM_ARCH_FLAG_EXIT_SEA, &kvm->arch.flags);
  

•           break;
    default:
            break;
    }
  

@@ -322,6 +326,7 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext) case KVM_CAP_IRQFD_RESAMPLE: case KVM_CAP_COUNTER_OFFSET: case KVM_CAP_ARM_WRITABLE_IMP_ID_REGS:

•   case KVM_CAP_ARM_SEA_TO_USER:
            r = 1;
            break;
    case KVM_CAP_SET_GUEST_DEBUG2:
  

diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c index a34924d75069..26b2e71994be 100644 --- a/arch/arm64/kvm/mmu.c +++ b/arch/arm64/kvm/mmu.c @@ -1813,8 +1813,48 @@ static void handle_access_fault(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa) read_unlock(&vcpu->kvm->mmu_lock); }

+/*

• • Returns true if the SEA should be handled locally within KVM if the abort is
• • caused by a kernel memory allocation (e.g. stage-2 table memory).
• */

+static bool host_owns_sea(struct kvm_vcpu *vcpu, u64 esr) +{

•   /*
  

•    * Without FEAT_RAS HCR_EL2.TEA is RES0, meaning any external abort
  

•    * taken from a guest EL to EL2 is due to a host-imposed access (e.g.
  

•    * stage-2 PTW).
  

•    */
  

•   if (!cpus_have_final_cap(ARM64_HAS_RAS_EXTN))
  

•           return true;
  

•   /* KVM owns the VNCR when the vCPU isn't in a nested context. */
  

•   if (is_hyp_ctxt(vcpu) && (esr & ESR_ELx_VNCR))
  

•           return true;
  

•   /*
  

•    * Determining if an external abort during a table walk happened at
  

•    * stage-2 is only possible with S1PTW is set. Otherwise, since KVM
  

•    * sets HCR_EL2.TEA, SEAs due to a stage-1 walk (i.e. accessing the PA
  

•    * of the stage-1 descriptor) can reach here and are reported with a
  

•    * TTW ESR value.
  

•    */
  

•   return esr_fsc_is_sea_ttw(esr) && (esr & ESR_ELx_S1PTW);
  

Should we include esr_fsc_is_secc_ttw? like (esr_fsc_is_sea_ttw(esr) || esr_fsc_is_secc_ttw(esr)) && (esr & ESR_ELx_S1PTW)

+}

int kvm_handle_guest_sea(struct kvm_vcpu *vcpu) {

•   u64 esr = kvm_vcpu_get_esr(vcpu);
  

•   struct kvm_run *run = vcpu->run;
  

•   struct kvm *kvm = vcpu->kvm;
  

•   u64 esr_mask = ESR_ELx_EC_MASK  |
  

•                  ESR_ELx_FnV      |
  

•                  ESR_ELx_EA       |
  

•                  ESR_ELx_CM       |
  

•                  ESR_ELx_WNR      |
  

•                  ESR_ELx_FSC;
  

Do you (and why) exclude ESR_ELx_IL on purpose?

BTW, if my previous statement about TTW SEA is correct, then I also understand why we need to explicitly exclude ESR_ELx_S1PTW.

•   u64 ipa;
  

•   /*
     * Give APEI the opportunity to claim the abort before handling it
     * within KVM. apei_claim_sea() expects to be called with IRQs
  

@@ -1824,7 +1864,32 @@ int kvm_handle_guest_sea(struct kvm_vcpu *vcpu) if (apei_claim_sea(NULL) == 0)

I assume kvm should still lockdep_assert_irqs_enabled(), right? That is, a WARN_ON_ONCE is still useful in case?

            return 1;

•   return kvm_inject_serror(vcpu);
  

•   if (host_owns_sea(vcpu, esr) || !test_bit(KVM_ARCH_FLAG_EXIT_SEA, &kvm->arch.flags))
  

•           return kvm_inject_serror(vcpu);
  

•   /* ESR_ELx.SET is RES0 when FEAT_RAS isn't implemented. */
  

•   if (kvm_has_ras(kvm))
  

•           esr_mask |= ESR_ELx_SET_MASK;
  

•   /*
  

•    * Exit to userspace, and provide faulting guest virtual and physical
  

•    * addresses in case userspace wants to emulate SEA to guest by
  

•    * writing to FAR_EL1 and HPFAR_EL1 registers.
  

•    */
  

•   memset(&run->arm_sea, 0, sizeof(run->arm_sea));
  

•   run->exit_reason = KVM_EXIT_ARM_SEA;
  

•   run->arm_sea.esr = esr & esr_mask;
  

•   if (!(esr & ESR_ELx_FnV))
  

•           run->arm_sea.gva = kvm_vcpu_get_hfar(vcpu);
  

•   ipa = kvm_vcpu_get_fault_ipa(vcpu);
  

•   if (ipa != INVALID_GPA) {
  

•           run->arm_sea.flags |= KVM_EXIT_ARM_SEA_FLAG_GPA_VALID;
  

•           run->arm_sea.gpa = ipa;
  

•   }
  

•   return 0;
  

}

/** diff --git a/include/uapi/linux/kvm.h b/include/uapi/linux/kvm.h index e4e566ff348b..b2cc3d74d769 100644 --- a/include/uapi/linux/kvm.h +++ b/include/uapi/linux/kvm.h @@ -179,6 +179,7 @@ struct kvm_xen_exit { #define KVM_EXIT_LOONGARCH_IOCSR 38 #define KVM_EXIT_MEMORY_FAULT 39 #define KVM_EXIT_TDX 40 +#define KVM_EXIT_ARM_SEA 41

/* For KVM_EXIT_INTERNAL_ERROR */ /* Emulate instruction failed. */ @@ -469,6 +470,14 @@ struct kvm_run { } get_tdvmcall_info; }; } tdx;

•           /* KVM_EXIT_ARM_SEA */
  

•           struct {
  

+#define KVM_EXIT_ARM_SEA_FLAG_GPA_VALID (1ULL << 0)

•                   __u64 flags;
  

•                   __u64 esr;
  

•                   __u64 gva;
  

•                   __u64 gpa;
  

•           } arm_sea;
            /* Fix the size of the union. */
            char padding[256];
    };
  

@@ -957,6 +966,7 @@ struct kvm_enable_cap { #define KVM_CAP_ARM_EL2_E2H0 241 #define KVM_CAP_RISCV_MP_STATE_RESET 242 #define KVM_CAP_ARM_CACHEABLE_PFNMAP_SUPPORTED 243 +#define KVM_CAP_ARM_SEA_TO_USER 244

struct kvm_irq_routing_irqchip { __u32 irqchip; -- 2.39.5

On Sat, Jul 12, 2025 at 12:57 PM Oliver Upton oliver.upton@linux.dev wrote:

On Fri, Jul 11, 2025 at 04:59:11PM -0700, Jiaqi Yan wrote:

...

...

• Add some detail about FEAT_RAS where we may still exit to userspace for host-controlled memory, as we cannot differentiate between a stage-1 or stage-2 TTW SEA when taken on the descriptor PA

Ah, IIUC, you are saying even if the FSC code tells fault is on TTW (esr_fsc_is_secc_ttw or esr_fsc_is_sea_ttw), it can either be guest stage-1's or stage-2's descriptor PA, and we can tell which from which.

However, if ESR_ELx_S1PTW is set, we can tell this is a sub-case of stage-2 descriptor PA, their usage is for stage-1 PTW but they are stage-2 memory.

Is my current understanding right?

Yep, that's exactly what I'm getting at. As you note, stage-2 aborts during a stage-1 walk are sufficiently described, but not much else.

Got it, thanks!

...

...

+/*

• • Returns true if the SEA should be handled locally within KVM if the abort is
• • caused by a kernel memory allocation (e.g. stage-2 table memory).
• */

+static bool host_owns_sea(struct kvm_vcpu *vcpu, u64 esr) +{

•   /*
  

•    * Without FEAT_RAS HCR_EL2.TEA is RES0, meaning any external abort
  

•    * taken from a guest EL to EL2 is due to a host-imposed access (e.g.
  

•    * stage-2 PTW).
  

•    */
  

•   if (!cpus_have_final_cap(ARM64_HAS_RAS_EXTN))
  

•           return true;
  

•   /* KVM owns the VNCR when the vCPU isn't in a nested context. */
  

•   if (is_hyp_ctxt(vcpu) && (esr & ESR_ELx_VNCR))
  

•           return true;
  

•   /*
  

•    * Determining if an external abort during a table walk happened at
  

•    * stage-2 is only possible with S1PTW is set. Otherwise, since KVM
  

•    * sets HCR_EL2.TEA, SEAs due to a stage-1 walk (i.e. accessing the PA
  

•    * of the stage-1 descriptor) can reach here and are reported with a
  

•    * TTW ESR value.
  

•    */
  

•   return esr_fsc_is_sea_ttw(esr) && (esr & ESR_ELx_S1PTW);
  

Should we include esr_fsc_is_secc_ttw? like (esr_fsc_is_sea_ttw(esr) || esr_fsc_is_secc_ttw(esr)) && (esr & ESR_ELx_S1PTW)

Parity / ECC errors are not permitted if FEAT_RAS is implemented (which is tested for up front).

Ah, thanks for pointing this out.

...

...

+}

int kvm_handle_guest_sea(struct kvm_vcpu *vcpu) {

•   u64 esr = kvm_vcpu_get_esr(vcpu);
  

•   struct kvm_run *run = vcpu->run;
  

•   struct kvm *kvm = vcpu->kvm;
  

•   u64 esr_mask = ESR_ELx_EC_MASK  |
  

•                  ESR_ELx_FnV      |
  

•                  ESR_ELx_EA       |
  

•                  ESR_ELx_CM       |
  

•                  ESR_ELx_WNR      |
  

•                  ESR_ELx_FSC;
  

Do you (and why) exclude ESR_ELx_IL on purpose?

Unintended :)

Will add into my patch.

...

BTW, if my previous statement about TTW SEA is correct, then I also understand why we need to explicitly exclude ESR_ELx_S1PTW.

Right, we shouldn't be exposing genuine stage-2 external aborts to userspace.

...

...

•   u64 ipa;
  

•   /*
     * Give APEI the opportunity to claim the abort before handling it
     * within KVM. apei_claim_sea() expects to be called with IRQs
  

@@ -1824,7 +1864,32 @@ int kvm_handle_guest_sea(struct kvm_vcpu *vcpu) if (apei_claim_sea(NULL) == 0)

I assume kvm should still lockdep_assert_irqs_enabled(), right? That is, a WARN_ON_ONCE is still useful in case?

Ah, this is diffed against my VNCR prefix which has this context. Yes, I want to preserve the lockdep assertion.

Thanks for sharing the patch! Should I wait for you to send and queue to kvmarm/next and rebase my v3 to it? Or should I insert it into my v3 patch series with you as the commit author, and Signed-off-by you?

BTW, while I am working on v3, I think it is probably better to decouple the current patchset into two. The first one for KVM_EXIT_ARM_SEA, and the second one for injecting (D|I)ABT with user-supplemented esr. This way may help KVM_EXIT_ARM_SEA, the more important feature, get reviewed and accepted sooner. I will send out a separate patchset for enhancing the guest SEA injection.

From eb63dbf07b3d1f42b059f5c94abd147d195299c8 Mon Sep 17 00:00:00 2001 From: Oliver Upton oliver.upton@linux.dev Date: Thu, 10 Jul 2025 17:14:51 -0700 Subject: [PATCH] KVM: arm64: nv: Handle SEAs due to VNCR redirection

Signed-off-by: Oliver Upton oliver.upton@linux.dev

arch/arm64/include/asm/kvm_mmu.h | 1 + arch/arm64/include/asm/kvm_ras.h | 25 ------------------------- arch/arm64/kvm/mmu.c | 30 ++++++++++++++++++------------ arch/arm64/kvm/nested.c | 3 +++ 4 files changed, 22 insertions(+), 37 deletions(-) delete mode 100644 arch/arm64/include/asm/kvm_ras.h

diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h index ae563ebd6aee..e4069f2ce642 100644 --- a/arch/arm64/include/asm/kvm_mmu.h +++ b/arch/arm64/include/asm/kvm_mmu.h @@ -180,6 +180,7 @@ void kvm_free_stage2_pgd(struct kvm_s2_mmu *mmu); int kvm_phys_addr_ioremap(struct kvm *kvm, phys_addr_t guest_ipa, phys_addr_t pa, unsigned long size, bool writable);

+int kvm_handle_guest_sea(struct kvm_vcpu *vcpu); int kvm_handle_guest_abort(struct kvm_vcpu *vcpu);

phys_addr_t kvm_mmu_get_httbr(void); diff --git a/arch/arm64/include/asm/kvm_ras.h b/arch/arm64/include/asm/kvm_ras.h deleted file mode 100644 index 9398ade632aa..000000000000 --- a/arch/arm64/include/asm/kvm_ras.h +++ /dev/null @@ -1,25 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ -/* Copyright (C) 2018 - Arm Ltd */

-#ifndef __ARM64_KVM_RAS_H__ -#define __ARM64_KVM_RAS_H__

-#include <linux/acpi.h> -#include <linux/errno.h> -#include <linux/types.h>

-#include <asm/acpi.h>

-/*

• • Was this synchronous external abort a RAS notification?
• • Returns '0' for errors handled by some RAS subsystem, or -ENOENT.
• */

-static inline int kvm_handle_guest_sea(void) -{

•   /* apei_claim_sea(NULL) expects to mask interrupts itself */
  

•   lockdep_assert_irqs_enabled();
  

•   return apei_claim_sea(NULL);
  

-}

-#endif /* __ARM64_KVM_RAS_H__ */ diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c index 1c78864767c5..6934f4acdc45 100644 --- a/arch/arm64/kvm/mmu.c +++ b/arch/arm64/kvm/mmu.c @@ -4,19 +4,20 @@

• Author: Christoffer Dall c.dall@virtualopensystems.com

*/

+#include <linux/acpi.h> #include <linux/mman.h> #include <linux/kvm_host.h> #include <linux/io.h> #include <linux/hugetlb.h> #include <linux/sched/signal.h> #include <trace/events/kvm.h> +#include <asm/acpi.h> #include <asm/pgalloc.h> #include <asm/cacheflush.h> #include <asm/kvm_arm.h> #include <asm/kvm_mmu.h> #include <asm/kvm_pgtable.h> #include <asm/kvm_pkvm.h> -#include <asm/kvm_ras.h> #include <asm/kvm_asm.h> #include <asm/kvm_emulate.h> #include <asm/virt.h> @@ -1811,6 +1812,20 @@ static void handle_access_fault(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa) read_unlock(&vcpu->kvm->mmu_lock); }

+int kvm_handle_guest_sea(struct kvm_vcpu *vcpu) +{

•   /*
  

•    * Give APEI the opportunity to claim the abort before handling it
  

•    * within KVM. apei_claim_sea() expects to be called with IRQs
  

•    * enabled.
  

•    */
  

•   lockdep_assert_irqs_enabled();
  

•   if (apei_claim_sea(NULL) == 0)
  

•           return 1;
  

•   return kvm_inject_serror(vcpu);
  

+}

/**

• kvm_handle_guest_abort - handles all 2nd stage aborts
• @vcpu: the VCPU pointer

@@ -1834,17 +1849,8 @@ int kvm_handle_guest_abort(struct kvm_vcpu *vcpu) gfn_t gfn; int ret, idx;

•   /* Synchronous External Abort? */
  

•   if (kvm_vcpu_abt_issea(vcpu)) {
  

•           /*
  

•            * For RAS the host kernel may handle this abort.
  

•            * There is no need to pass the error into the guest.
  

•            */
  

•           if (kvm_handle_guest_sea())
  

•                   return kvm_inject_serror(vcpu);
  

•           return 1;
  

•   }
  

•   if (kvm_vcpu_abt_issea(vcpu))
  

•           return kvm_handle_guest_sea(vcpu);
  
    esr = kvm_vcpu_get_esr(vcpu);
  
  

diff --git a/arch/arm64/kvm/nested.c b/arch/arm64/kvm/nested.c index 096747a61bf6..38b0e3a9a6db 100644 --- a/arch/arm64/kvm/nested.c +++ b/arch/arm64/kvm/nested.c @@ -1289,6 +1289,9 @@ int kvm_handle_vncr_abort(struct kvm_vcpu *vcpu)

    BUG_ON(!(esr & ESR_ELx_VNCR_SHIFT));

•   if (kvm_vcpu_abt_issea(vcpu))
  

•           return kvm_handle_guest_sea(vcpu);
  

•   if (esr_fsc_is_permission_fault(esr)) {
            inject_vncr_perm(vcpu);
    } else if (esr_fsc_is_translation_fault(esr)) {
  

-- 2.39.5

On Fri, Jul 11, 2025 at 12:45 PM Oliver Upton oliver.upton@linux.dev wrote:

On Wed, Jun 04, 2025 at 05:09:00AM +0000, Jiaqi Yan wrote:

...

Test userspace can use KVM_SET_VCPU_EVENTS to inject an external instruction abort into guest. The test injects instruction abort at an arbitrary time without real SEA happening in the guest VCPU, so only certain ESR_EL1 bits are expected and asserted.

Signed-off-by: Jiaqi Yan jiaqiyan@google.com

I reworked mmio_abort to be a general external abort test, can you add your test cases there in the next spin (arm64/external_aborts.c)?

For sure!

Thanks, Oliver

...

---

tools/arch/arm64/include/uapi/asm/kvm.h | 3 +- tools/testing/selftests/kvm/Makefile.kvm | 1 + .../testing/selftests/kvm/arm64/inject_iabt.c | 98 +++++++++++++++++++ 3 files changed, 101 insertions(+), 1 deletion(-) create mode 100644 tools/testing/selftests/kvm/arm64/inject_iabt.c

diff --git a/tools/arch/arm64/include/uapi/asm/kvm.h b/tools/arch/arm64/include/uapi/asm/kvm.h index af9d9acaf9975..d3a4530846311 100644 --- a/tools/arch/arm64/include/uapi/asm/kvm.h +++ b/tools/arch/arm64/include/uapi/asm/kvm.h @@ -184,8 +184,9 @@ struct kvm_vcpu_events { __u8 serror_pending; __u8 serror_has_esr; __u8 ext_dabt_pending;

•         __u8 ext_iabt_pending;
          /* Align it to 8 bytes */
  

•         __u8 pad[5];
  

•         __u8 pad[4];
          __u64 serror_esr;
  } exception;
  __u32 reserved[12];
  

diff --git a/tools/testing/selftests/kvm/Makefile.kvm b/tools/testing/selftests/kvm/Makefile.kvm index 9eecce6b8274f..e6b504ded9c1c 100644 --- a/tools/testing/selftests/kvm/Makefile.kvm +++ b/tools/testing/selftests/kvm/Makefile.kvm @@ -149,6 +149,7 @@ TEST_GEN_PROGS_arm64 += arm64/arch_timer_edge_cases TEST_GEN_PROGS_arm64 += arm64/debug-exceptions TEST_GEN_PROGS_arm64 += arm64/host_sve TEST_GEN_PROGS_arm64 += arm64/hypercalls +TEST_GEN_PROGS_arm64 += arm64/inject_iabt TEST_GEN_PROGS_arm64 += arm64/mmio_abort TEST_GEN_PROGS_arm64 += arm64/page_fault_test TEST_GEN_PROGS_arm64 += arm64/psci_test diff --git a/tools/testing/selftests/kvm/arm64/inject_iabt.c b/tools/testing/selftests/kvm/arm64/inject_iabt.c new file mode 100644 index 0000000000000..0c7999e5ba5b3 --- /dev/null +++ b/tools/testing/selftests/kvm/arm64/inject_iabt.c @@ -0,0 +1,98 @@ +// SPDX-License-Identifier: GPL-2.0-only +/*

• • inject_iabt.c - Tests for injecting instruction aborts into guest.
• */

+#include "processor.h" +#include "test_util.h"

+static void expect_iabt_handler(struct ex_regs *regs) +{

• u64 esr = read_sysreg(esr_el1);
  

• GUEST_PRINTF("Handling Guest SEA\n");
  

• GUEST_PRINTF("  ESR_EL1=%#lx\n", esr);
  

• GUEST_ASSERT_EQ(ESR_ELx_EC(esr), ESR_ELx_EC_IABT_CUR);
  

• GUEST_ASSERT_EQ(esr & ESR_ELx_FSC_TYPE, ESR_ELx_FSC_EXTABT);
  

• GUEST_DONE();
  

+}

+static void guest_code(void) +{

• GUEST_FAIL("Guest should only run SEA handler");
  

+}

+static void vcpu_run_expect_done(struct kvm_vcpu *vcpu) +{

• struct ucall uc;
  

• bool guest_done = false;
  

• do {
  

•         vcpu_run(vcpu);
  

•         switch (get_ucall(vcpu, &uc)) {
  

•         case UCALL_ABORT:
  

•                 REPORT_GUEST_ASSERT(uc);
  

•                 break;
  

•         case UCALL_PRINTF:
  

•                 ksft_print_msg("From guest: %s", uc.buffer);
  

•                 break;
  

•         case UCALL_DONE:
  

•                 ksft_print_msg("Guest done gracefully!\n");
  

•                 guest_done = true;
  

•                 break;
  

•         default:
  

•                 TEST_FAIL("Unexpected ucall: %lu", uc.cmd);
  

•         }
  

• } while (!guest_done);
  

+}

+static void vcpu_inject_ext_iabt(struct kvm_vcpu *vcpu) +{

• struct kvm_vcpu_events events = {};
  

• events.exception.ext_iabt_pending = true;
  

• vcpu_events_set(vcpu, &events);
  

+}

+static void vcpu_inject_invalid_abt(struct kvm_vcpu *vcpu) +{

• struct kvm_vcpu_events events = {};
  

• int r;
  

• events.exception.ext_iabt_pending = true;
  

• events.exception.ext_dabt_pending = true;
  

• ksft_print_msg("Injecting invalid external abort events\n");
  

• r = __vcpu_ioctl(vcpu, KVM_SET_VCPU_EVENTS, &events);
  

• TEST_ASSERT(r && errno == EINVAL,
  

•             KVM_IOCTL_ERROR(KVM_SET_VCPU_EVENTS, r));
  

+}

+static void test_inject_iabt(void) +{

• struct kvm_vcpu *vcpu;
  

• struct kvm_vm *vm;
  

• vm = vm_create_with_one_vcpu(&vcpu, guest_code);
  

• vm_init_descriptor_tables(vm);
  

• vcpu_init_descriptor_tables(vcpu);
  

• vm_install_sync_handler(vm, VECTOR_SYNC_CURRENT,
  

•                         ESR_ELx_EC_IABT_CUR, expect_iabt_handler);
  

• vcpu_inject_invalid_abt(vcpu);
  

• vcpu_inject_ext_iabt(vcpu);
  

• vcpu_run_expect_done(vcpu);
  

• kvm_vm_free(vm);
  

+}

+int main(void) +{

• test_inject_iabt();
  

• return 0;
  

+}

2.49.0.1266.g31b7d2e469-goog