Re: [PATCH v2 13/17] KVM: arm64: Pend a protected guest's SError with HCR_EL2.VSE only

[Fuad Tabba]

Hi Marc,

On Fri, 11 Sept 2026 at 11:29, Marc Zyngier <maz@xxxxxxxxxx> wrote:
...
> > diff --git a/arch/arm64/kvm/inject_fault.c b/arch/arm64/kvm/inject_fault.c
> > index d6c4fc16f8795..b88098a7e756c 100644
> > --- a/arch/arm64/kvm/inject_fault.c
> > +++ b/arch/arm64/kvm/inject_fault.c
> > @@ -378,8 +378,11 @@ int kvm_inject_serror_esr(struct kvm_vcpu *vcpu, u64 esr)
> >        *
> >        * As we're emulating the SError injection we need to explicitly populate
> >        * ESR_ELx.EC because hardware will not do it on our behalf.
> > +      *
> > +      * The host does not see a protected guest's PSTATE.A: leave the
> > +      * vSError to HCR_EL2.VSE below, which the guest masks itself.
> >        */
> > -     if (!serror_is_masked(vcpu)) {
> > +     if (!vcpu_is_protected(vcpu) && !serror_is_masked(vcpu)) {
> >               pend_serror_exception(vcpu);
> >               esr |= FIELD_PREP(ESR_ELx_EC_MASK, ESR_ELx_EC_SERROR) | ESR_ELx_IL;
> >               vcpu_write_sys_reg(vcpu, esr, exception_esr_elx(vcpu));
>
> I can't say I like this very much.
>
> The fundamental premise is that as far as the host is concerned,
> PSTATE.A is always set. So why can't we give the illusion of this at
> all times?
>
> That'd be a much cleaner approach.

I'll have EL2 copy PSTATE out to the host with A set instead, and drop
this patch in v3.

Cheers,
/fuad


>
> Thanks,
>
>         M.
>
> --
> Without deviation from the norm, progress is not possible.