Re: [PATCH v2 18/27] KVM: arm64: nv: Handle effects of HCRX_EL2.TMEA on SError injection

[Marc Zyngier <maz@kernel.org>]

On Tue, 17 Jun 2025 00:02:59 +0100,
Oliver Upton <oliver.upton@linux.dev> wrote:
> 
> HCRX_EL2.TMEA further modifies the physical SError behavior where
> unmasked SErrors are taken to EL1 and masked SErrors are taken to EL2.
> This gets a bit hairy when considering the fact that TMEA also enables
> vSErrors, i.e. KVM has delegated the HW vSError context to the guest
> hypervisor.
> 
> We can keep the vSError context ownership by taking advantage of a
> couple properties:
> 
>  - If SErrors are unmasked, the 'physical' SError can be taken
>    in-context immediately. In other words, KVM can emulate the EL1
>    SError while preserving vEL2's ownership of the vSError context.
> 
>  - If SErrors are masked, the 'physical' SError is taken to EL2 and
>    needs the usual nested exception entry.
> 
> Note that the new in-context handling has the benign effect where
> unmasked SError injections are emulated even for non-nested VMs.

This patch isn't *just* about HCRX_EL2.TMEA, right? Clearly,
SCTLR2_ELx.NMEA plays a role. One is about routing, while the other is
about bypassing PSTATE.A (NM stands for Non-Maskable). Also, TMEA
affects both SEA and SError, while NMEA is SError only.

For the sake of making things a bit clearer, it might be worth either
describing the effects of NMEA here, or split the NMEA handling to
another patch.

> 
> Signed-off-by: Oliver Upton <oliver.upton@linux.dev>
> ---
>  arch/arm64/kvm/inject_fault.c | 36 +++++++++++++++++++++++++++++++++--
>  1 file changed, 34 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/arm64/kvm/inject_fault.c b/arch/arm64/kvm/inject_fault.c
> index cab14a926bc6..e689002f10b6 100644
> --- a/arch/arm64/kvm/inject_fault.c
> +++ b/arch/arm64/kvm/inject_fault.c
> @@ -97,6 +97,11 @@ static bool effective_sctlr2_ease(struct kvm_vcpu *vcpu)
>  	return __effective_sctlr2_bit(vcpu, SCTLR2_EL1_EASE_SHIFT);
>  }
>  
> +static bool effective_sctlr2_nmea(struct kvm_vcpu *vcpu)
> +{
> +	return __effective_sctlr2_bit(vcpu, SCTLR2_EL1_NMEA_SHIFT);
> +}
> +
>  static void inject_abt64(struct kvm_vcpu *vcpu, bool is_iabt, unsigned long addr)
>  {
>  	unsigned long cpsr = *vcpu_cpsr(vcpu);
> @@ -258,14 +263,29 @@ void kvm_inject_undefined(struct kvm_vcpu *vcpu)
>  		inject_undef64(vcpu);
>  }
>  
> +static bool serror_is_masked(struct kvm_vcpu *vcpu)
> +{
> +	bool masked = *vcpu_cpsr(vcpu) & PSR_A_BIT;
> +
> +	if (!vcpu_mode_priv(vcpu))
> +		masked |= effective_sctlr2_nmea(vcpu);
> +
> +	return masked;
> +}
> +
>  static bool kvm_serror_target_is_el2(struct kvm_vcpu *vcpu)
>  {
> -	return is_hyp_ctxt(vcpu) || vcpu_el2_amo_is_set(vcpu);
> +	if (is_hyp_ctxt(vcpu) || vcpu_el2_amo_is_set(vcpu))
> +		return true;
> +
> +	return serror_is_masked(vcpu) &&
> +	       (__vcpu_sys_reg(vcpu, HCRX_EL2) & HCRX_EL2_TMEA);
>  }
>  
>  static bool kvm_serror_undeliverable_at_el2(struct kvm_vcpu *vcpu)
>  {
> -	return !(vcpu_el2_tge_is_set(vcpu) || vcpu_el2_amo_is_set(vcpu));
> +	return !(vcpu_el2_tge_is_set(vcpu) || vcpu_el2_amo_is_set(vcpu) ||
> +		 effective_sctlr2_nmea(vcpu));
>  }
>  
>  int kvm_inject_serror_esr(struct kvm_vcpu *vcpu, u64 esr)
> @@ -281,6 +301,18 @@ int kvm_inject_serror_esr(struct kvm_vcpu *vcpu, u64 esr)
>  		return 1;
>  	}
>  
> +	/*
> +	 * Emulate the exception entry if SErrors are unmasked. This is useful if
> +	 * the vCPU is in a nested context w/ vSErrors enabled then we've already
> +	 * delegated he hardware vSError context (i.e. HCR_EL2.VSE, VSESR_EL2,
> +	 * VDISR_EL2) to the guest hypervisor.
> +	 */
> +	if (!serror_is_masked(vcpu)) {
> +		pend_serror_exception(vcpu);
> +		vcpu_write_sys_reg(vcpu, esr, exception_esr_elx(vcpu));
> +		return 1;
> +	}
> +
>  	vcpu_set_vsesr(vcpu, esr & ESR_ELx_ISS_MASK);
>  	*vcpu_hcr(vcpu) |= HCR_VSE;
>  	return 1;

I see that the handling of TMEA affecting the routing of SEAs is in a
follow-up patch, but it'd be good to either call out the split in the
commit message, or have a single patch addressing all of the TMEA
effects.

None of that affects the code, which seems correct (well, I think -- I
can sense a headache coming!).

Thanks,

	M.

-- 
Jazz isn't dead. It just smells funny.