[PATCH 14/17] KVM: arm64: Pend a protected guest's SError with HCR_EL2.VSE only
From: Fuad Tabba <fuad.tabba@linux.dev>
Date: 2026-08-31 16:35:01
Also in:
kvmarm, lkml
Subsystem:
arm64 port (aarch64 architecture), kernel virtual machine for arm64 (kvm/arm64), the rest · Maintainers:
Catalin Marinas, Will Deacon, Marc Zyngier, Oliver Upton, Linus Torvalds
kvm_inject_serror_esr() emulates the exception entry when serror_is_masked() reads PSTATE.A clear, but the host has no view of a protected guest's PSTATE.A, and an emulated entry never reaches the guest: the SError is lost. Set VSE instead and let the guest's own PSTATE.A mask it. Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev> --- arch/arm64/kvm/inject_fault.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/kvm/inject_fault.c b/arch/arm64/kvm/inject_fault.c
index d6c4fc16f8795..b88098a7e756c 100644
--- a/arch/arm64/kvm/inject_fault.c
+++ b/arch/arm64/kvm/inject_fault.c@@ -378,8 +378,11 @@ int kvm_inject_serror_esr(struct kvm_vcpu *vcpu, u64 esr) * * As we're emulating the SError injection we need to explicitly populate * ESR_ELx.EC because hardware will not do it on our behalf. + * + * The host does not see a protected guest's PSTATE.A: leave the + * vSError to HCR_EL2.VSE below, which the guest masks itself. */ - if (!serror_is_masked(vcpu)) { + if (!vcpu_is_protected(vcpu) && !serror_is_masked(vcpu)) { pend_serror_exception(vcpu); esr |= FIELD_PREP(ESR_ELx_EC_MASK, ESR_ELx_EC_SERROR) | ESR_ELx_IL; vcpu_write_sys_reg(vcpu, esr, exception_esr_elx(vcpu));
--
2.39.5