Re: [PATCH v9 05/16] KVM: arm64: PMU: Keep implemented counter mask EL-independent

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] State loss of EL2-reserved PMU counters during live migration.
--

--- Patch [5]: [PATCH v9 05/16] KVM: arm64: PMU: Keep implemented counter mask EL-independent ---
commit 0e1ed9d5217011f901071c9f1da4dcee65204dd7
Author: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>

KVM: arm64: PMU: Keep implemented counter mask EL-independent
    
This commit changes kvm_pmu_implemented_counter_mask() to build the
implemented counter mask from nr_pmu_counters instead of PMCR_EL0.N. This
prevents EL2 counter state from being lost during PMU reloads when the
saved context is outside EL2.

> diff --git a/arch/arm64/kvm/pmu-emul.c b/arch/arm64/kvm/pmu-emul.c
> index b4b877f31097f..5281d37634a06 100644
> --- a/arch/arm64/kvm/pmu-emul.c
> +++ b/arch/arm64/kvm/pmu-emul.c
> @@ -317,12 +317,12 @@ u64 kvm_pmu_accessible_counter_mask(struct kvm_vcpu *vcpu)
>  
>  u64 kvm_pmu_implemented_counter_mask(struct kvm_vcpu *vcpu)
>  {
> -	u64 val = FIELD_GET(ARMV8_PMU_PMCR_N, kvm_vcpu_read_pmcr(vcpu));
> +	u64 n = vcpu->kvm->arch.nr_pmu_counters;
>  
> -	if (val == 0)
> +	if (n == 0)
>  		return BIT(ARMV8_PMU_CYCLE_IDX);
>  	else
> -		return GENMASK(val - 1, 0) | BIT(ARMV8_PMU_CYCLE_IDX);
> +		return GENMASK(n - 1, 0) | BIT(ARMV8_PMU_CYCLE_IDX);
>  }

[Severity: High]
This is a pre-existing issue, but does restricting guest access via
kvm_pmu_accessible_counter_mask() also inadvertently drop EL2 state during
live migration?

Looking at get_pmreg() in arch/arm64/kvm/sys_regs.c, when userspace invokes
KVM_GET_ONE_REG to save PMU registers like PMCNTENSET_EL0:

arch/arm64/kvm/sys_regs.c:get_pmreg() {
    ...
    u64 mask = kvm_pmu_accessible_counter_mask(vcpu);

    *val = __vcpu_sys_reg(vcpu, r->reg) & mask;
    ...
}

And similarly when restoring in set_pmreg():

arch/arm64/kvm/sys_regs.c:set_pmreg() {
    ...
    u64 mask = kvm_pmu_accessible_counter_mask(vcpu);

    __vcpu_assign_sys_reg(vcpu, r->reg, val & mask);
    ...
}

If a nested VM is migrated while its vCPU is executing in EL1/EL0,
kvm_pmu_accessible_counter_mask() strips out the EL2 counters because
vcpu_is_el2() is false. Could this cause KVM to silently discard the
EL2-reserved counter state on the source and fail to restore it on the
target?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260720-hybrid-v9-0-2b713ca1b5dc@rsg.ci.i.u-tokyo.ac.jp?part=5