[PATCH 0/2] KVM: arm64: Fix + test for SError ESR

[PATCH 0/2] KVM: arm64: Fix + test for SError ESR

[Oliver Upton]

VSESR_EL2 only provides an ESR_EL1.ISS value for the SError, not a
complete ESR. Namely, hardware sets the EC field to indicate an SError
(0x2F), meaning we need to do the same for our software-emulated SError
injection.

Note that this behavior already exists for nested SError injection in
kvm_inject_nested_serror(). I also extended the external_aborts test to
assert the guest sees an expected ESR value for an SError.

Oliver Upton (2):
  KVM: arm64: Populate ESR_ELx.EC for emulated SError injection
  KVM: arm64: selftests: Test ESR propagation for vSError injection

 arch/arm64/kvm/inject_fault.c                 |  4 +++
 .../selftests/kvm/arm64/external_aborts.c     | 32 +++++++++++++++++--
 2 files changed, 34 insertions(+), 2 deletions(-)


base-commit: 3c5832f03f2ecd2b881f5bfbae06feeead432c16
-- 
2.39.5

[PATCH 1/2] KVM: arm64: Populate ESR_ELx.EC for emulated SError injection

[Oliver Upton]

The hardware vSError injection mechanism populates ESR_ELx.EC as part of
ESR propagation and the contents of VSESR_EL2 populate the ISS field. Of
course, this means our emulated injection needs to set up the EC
correctly for an SError too.

Fixes: ce66109cec86 ("KVM: arm64: nv: Take "masked" aborts to EL2 when HCRX_EL2.TMEA is set")
Signed-off-by: Oliver Upton <oliver.upton@linux.dev>
---
 arch/arm64/kvm/inject_fault.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/arch/arm64/kvm/inject_fault.c b/arch/arm64/kvm/inject_fault.c
index 37f45461e32c..6745f38b64f9 100644
--- a/arch/arm64/kvm/inject_fault.c
+++ b/arch/arm64/kvm/inject_fault.c
@@ -322,9 +322,13 @@ int kvm_inject_serror_esr(struct kvm_vcpu *vcpu, u64 esr)
 	 * the vCPU is in a nested context w/ vSErrors enabled then we've already
 	 * delegated he hardware vSError context (i.e. HCR_EL2.VSE, VSESR_EL2,
 	 * VDISR_EL2) to the guest hypervisor.
+	 *
+	 * As we're emulating the SError injection we need to explicitly populate
+	 * ESR_ELx.EC because hardware will not do it on our behalf.
 	 */
 	if (!serror_is_masked(vcpu)) {
 		pend_serror_exception(vcpu);
+		esr |= FIELD_PREP(ESR_ELx_EC_MASK, ESR_ELx_EC_SERROR);
 		vcpu_write_sys_reg(vcpu, esr, exception_esr_elx(vcpu));
 		return 1;
 	}
-- 
2.39.5

[PATCH 2/2] KVM: arm64: selftests: Test ESR propagation for vSError injection

[Oliver Upton]

Ensure that vSErrors taken in the guest have an appropriate ESR_ELx
value for the expected exception. Additionally, switch the EASE test to
install the SEA handler at the SError offset, as the ESR is still
expected to match an SEA in that case.

Signed-off-by: Oliver Upton <oliver.upton@linux.dev>
---
 .../selftests/kvm/arm64/external_aborts.c     | 32 +++++++++++++++++--
 1 file changed, 30 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/kvm/arm64/external_aborts.c b/tools/testing/selftests/kvm/arm64/external_aborts.c
index ec7e30776a0e..062bf84cced1 100644
--- a/tools/testing/selftests/kvm/arm64/external_aborts.c
+++ b/tools/testing/selftests/kvm/arm64/external_aborts.c
@@ -7,7 +7,8 @@
 #include "processor.h"
 #include "test_util.h"
 
-#define MMIO_ADDR	0x8000000ULL
+#define MMIO_ADDR		0x8000000ULL
+#define EXPECTED_SERROR_ISS	(ESR_ELx_ISV | 0x1d1ed)
 
 static u64 expected_abort_pc;
 
@@ -49,11 +50,28 @@ static void vcpu_inject_sea(struct kvm_vcpu *vcpu)
 	vcpu_events_set(vcpu, &events);
 }
 
+static bool vcpu_has_ras(struct kvm_vcpu *vcpu)
+{
+	u64 pfr0 = vcpu_get_reg(vcpu, KVM_ARM64_SYS_REG(SYS_ID_AA64PFR0_EL1));
+
+	return SYS_FIELD_GET(ID_AA64PFR0_EL1, RAS, pfr0);
+}
+
+static bool guest_has_ras(void)
+{
+	return SYS_FIELD_GET(ID_AA64PFR0_EL1, RAS, read_sysreg(id_aa64pfr0_el1));
+}
+
 static void vcpu_inject_serror(struct kvm_vcpu *vcpu)
 {
 	struct kvm_vcpu_events events = {};
 
 	events.exception.serror_pending = true;
+	if (vcpu_has_ras(vcpu)) {
+		events.exception.serror_has_esr = true;
+		events.exception.serror_esr = EXPECTED_SERROR_ISS;
+	}
+
 	vcpu_events_set(vcpu, &events);
 }
 
@@ -199,6 +217,12 @@ static void test_serror_masked(void)
 
 static void expect_serror_handler(struct ex_regs *regs)
 {
+	u64 esr = read_sysreg(esr_el1);
+
+	GUEST_ASSERT_EQ(ESR_ELx_EC(esr), ESR_ELx_EC_SERROR);
+	if (guest_has_ras())
+		GUEST_ASSERT_EQ(ESR_ELx_ISS(esr), EXPECTED_SERROR_ISS);
+
 	GUEST_DONE();
 }
 
@@ -277,7 +301,11 @@ static void test_mmio_ease(void)
 		return;
 	}
 
-	vm_install_exception_handler(vm, VECTOR_ERROR_CURRENT, expect_serror_handler);
+	/*
+	 * SCTLR2_ELx.EASE changes the exception vector to the SError vector but
+	 * doesn't further modify the exception context (e.g. ESR_ELx, FAR_ELx).
+	 */
+	vm_install_exception_handler(vm, VECTOR_ERROR_CURRENT, expect_sea_handler);
 
 	vcpu_run(vcpu);
 	TEST_ASSERT_KVM_EXIT_REASON(vcpu, KVM_EXIT_MMIO);
-- 
2.39.5

Re: [PATCH 0/2] KVM: arm64: Fix + test for SError ESR

[Oliver Upton]

On Tue, 08 Jul 2025 16:06:30 -0700, Oliver Upton wrote:
> VSESR_EL2 only provides an ESR_EL1.ISS value for the SError, not a
> complete ESR. Namely, hardware sets the EC field to indicate an SError
> (0x2F), meaning we need to do the same for our software-emulated SError
> injection.
> 
> Note that this behavior already exists for nested SError injection in
> kvm_inject_nested_serror(). I also extended the external_aborts test to
> assert the guest sees an expected ESR value for an SError.
> 
> [...]

Applied to next, thanks!

[1/2] KVM: arm64: Populate ESR_ELx.EC for emulated SError injection
      https://git.kernel.org/kvmarm/kvmarm/c/f6e2262dfa1a
[2/2] KVM: arm64: selftests: Test ESR propagation for vSError injection
      https://git.kernel.org/kvmarm/kvmarm/c/f9e4e0a663d2

--
Best,
Oliver