[PATCH v2 0/1] target/arm/kvm: handle KVM_EXIT_ARM_SEA

[Deepak Gupta <deepagupta@nvidia.com>]

Hi,

Linux 6.19 added KVM_CAP_ARM_SEA_TO_USER [1]: with the capability
enabled, KVM returns a guest synchronous external abort that the host
could not claim through APEI to userspace as KVM_EXIT_ARM_SEA, instead
of injecting a virtual SError. QEMU does not consume the exit yet, so on
a host whose HEST has no SEA-notified GHES source every guest-consumed
memory error still ends in a guest "Asynchronous SError Interrupt"
panic.

This patch enables the capability, handles the exit by recording a GHES
memory error (when the exit carries an address backed by guest RAM) and
injecting a synchronous external abort that mirrors the original one,
and wires up the BUS_MCEERR_AO SIGBUS case so the guest learns about the
poisoned page asynchronously when the exit itself carried no address.

Changes in v2 (review feedback received internally):
 * Do not enable the capability for VMs that expose EL2 (nested
   virtualization): the injection always targets EL1, which is wrong
   for a guest at EL2 or with HCR_EL2.TGE set. Such VMs keep KVM's
   SError. The enable moved from kvm_arch_init() to
   kvm_arch_init_vcpu(), where has_el2 is known; the cap is per VM and
   enabling it repeatedly is harmless.
 * The GED-notified GHES source exists for virt machine versions after
   10.1, not 10.0 (hw_compat_10_1 clears x-has-hest-addr). Comment and
   commit message corrected, virt-10.1 added to the tests.
 * Document that BUS_MCEERR_AO delivery is best effort: a record is
   dropped with a warning while the guest has not acknowledged the
   previous one.
 * Clarify the kvm_inject_arm_sea() comment on the EC variant choice.

Testing: arm64 host whose HEST has only GSIV/SDEI-notified sources,
EINJ uncorrectable memory error into a page mapped by a guest, consumed
by a guest process (-machine virt,ras=on). Before: guest panic. After:
SIGBUS to the process, GHES record and hwpoison in the guest, guest
stays up. Also checked: the pre-existing BUS_MCEERR_AR SIGBUS path still
works (it is taken when the host's memory_failure() wins the race),
ras=off (bare external abort to the guest, no record), -machine
virt-10.1 (the AR path still delivers the synchronous record, the AO
record is dropped with the warning), check-unit on the host. The EL2
skip is compile-tested only: the test host has no KVM nested support.

[1] https://lore.kernel.org/r/20251013185903.1372553-1-jiaqiyan@google.com

v1: https://lore.kernel.org/qemu-devel/cover.1792191544.git.deepagupta@nvidia.com/

Deepak Gupta (1):
  target/arm/kvm: handle KVM_EXIT_ARM_SEA and report BUS_MCEERR_AO

 target/arm/kvm.c        | 176 +++++++++++++++++++++++++++++++++++-----
 target/arm/trace-events |   1 +
 2 files changed, 158 insertions(+), 19 deletions(-)

-- 
2.53.0