Re: [PATCH v9 16/22] KVM: arm64: Apply dynamic guest counter reservations

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] kvm: arm64: guest PMU overflow state lost on partition without FEAT_FGT
--

commit 59a912c6296a832c23a72990ddffa47591b8277e
Author: Colton Lewis <coltonlewis@google.com>

KVM: arm64: Apply dynamic guest counter reservations

Reserve and release guest PMU counters dynamically during vCPU load and
put rather than statically at VM creation.

> diff --git a/arch/arm64/kvm/pmu-direct.c b/arch/arm64/kvm/pmu-direct.c
> index a22c9258c2452..31d5afc44f36e 100644
> --- a/arch/arm64/kvm/pmu-direct.c
> +++ b/arch/arm64/kvm/pmu-direct.c
[ ... ]
> @@ -269,7 +341,9 @@ void kvm_pmu_load(struct kvm_vcpu *vcpu)
>  
>  	preempt_disable();
>  
> +	pmu = vcpu->kvm->arch.arm_pmu;
>  	guest_counters = kvm_vcpu_pmu_guest_counter_mask(vcpu);
> +	kvm_pmu_set_guest_counters(pmu, guest_counters);
>  	kvm_pmu_apply_event_filter(vcpu);
>  
>  	for_each_set_bit(i, &guest_counters, ARMPMU_MAX_HWEVENTS) {

[Severity: High]
Can this result in silently dropped guest overflow interrupts when partitioning
is enabled on hardware without fine-grained traps?

Further down in kvm_pmu_load(), the physical hardware overflow register is
cleared unconditionally:

	/* Clear the hardware overflow flags so there is no chance of
	 * creating spurious interrupts. The hardware here is never
	 * the canonical version anyway.
	 */
	write_sysreg(mask, pmovsclr_el0);

	val = __vcpu_sys_reg(vcpu, PMCNTENSET_EL0);

However, there is no corresponding write to pmovsset_el0 to restore the
guest's accumulated overflow state from
vcpu->arch.ctxt.sys_regs[PMOVSSET_EL0] before entering the guest. 

When trap bits are cleared to allow untrapped guest register accesses, and
fine-grained traps are not available to intercept pmovsset_el0, the guest's
interrupt handler will read this cleared hardware register directly. It will
observe 0 instead of the actual overflow state, causing the interrupt to be
dropped without processing.

Should the guest's saved overflow bits be restored here so the untrapped reads
observe the correct state?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260924172928.2110956-1-coltonlewis@google.com?part=16