[PATCH 0/1] target/arm/kvm: handle KVM_EXIT_ARM_SEA

[Deepak Gupta <deepagupta@nvidia.com>]

Hi,

Linux 6.19 added KVM_CAP_ARM_SEA_TO_USER [1]: with the capability
enabled, KVM returns a guest synchronous external abort that the host
could not claim through APEI to userspace as KVM_EXIT_ARM_SEA, instead
of injecting a virtual SError. QEMU does not consume the exit yet, so on
a host whose HEST has no SEA-notified GHES source every guest-consumed
memory error still ends in a guest "Asynchronous SError Interrupt"
panic.

This patch enables the capability, handles the exit by recording a GHES
memory error (when the exit carries an address backed by guest RAM) and
injecting a synchronous external abort that mirrors the original one,
and wires up the BUS_MCEERR_AO SIGBUS case so the guest learns about the
poisoned page asynchronously when the exit itself carried no address.

Points I would like feedback on:

 * Injection: I reuse the existing kvm_inject_arm_sea() route
   (arm_cpu_do_interrupt() after kvm_cpu_synchronize_state()) and let it
   pass the sanitised ESR fields (EC, IL, FnV, EA, CM, WnR, xFSC, SET)
   and the FAR through to the guest. KVM_SET_VCPU_EVENTS with
   ext_dabt_pending can only produce a data abort with FAR taken from
   the last exit, and the documentation restricts it to MMIO/NISV/
   LDST64B exits, so it did not seem a good fit; happy to switch if that
   is preferred.

 * The BUS_MCEERR_AO record goes on ACPI_HEST_SRC_ID_QMP, which ghes.h
   documents as being for QMP-injected errors, because it is the only
   GED-notified source the virt machine has. If a dedicated source id
   for host-originated asynchronous records is preferred I can add one.

 * With the pre-10.1 single-block HEST layout (no GED-notified source)
   the AO record is dropped with a warning rather than written into the
   synchronous source's block.

Testing: arm64 host whose HEST has only GSIV/SDEI-notified sources,
EINJ uncorrectable memory error into a page mapped by a guest, consumed
by a guest process (-machine virt,ras=on). Before: guest panic. After:
SIGBUS to the process, GHES record and hwpoison in the guest, guest
stays up. Also checked: the pre-existing BUS_MCEERR_AR SIGBUS path still
works (it is taken when the host's memory_failure() wins the race),
ras=off (bare external abort to the guest, no record), -machine
virt-10.0 (the AR path still delivers the synchronous record, the AO
record is dropped with the warning),
check-unit and check-qtest-aarch64 on the host.

[1] https://lore.kernel.org/r/20251013185903.1372553-1-jiaqiyan@google.com


Deepak Gupta (1):
  target/arm/kvm: handle KVM_EXIT_ARM_SEA and report BUS_MCEERR_AO

 target/arm/kvm.c        | 164 +++++++++++++++++++++++++++++++++++-----
 target/arm/trace-events |   1 +
 2 files changed, 146 insertions(+), 19 deletions(-)

-- 
2.53.0