Re: [PATCH 1/1] KVM: arm64: PMU: Avoid inappropriate use of host's PMUVer

[Oliver Upton <oliver.upton@linux.dev>]

Hi Reiji,

On Sat, Jun 10, 2023 at 12:45:10PM -0700, Reiji Watanabe wrote:
> @@ -735,7 +736,7 @@ u64 kvm_pmu_get_pmceid(struct kvm_vcpu *vcpu, bool pmceid1)
>  		 * Don't advertise STALL_SLOT, as PMMIR_EL0 is handled
>  		 * as RAZ
>  		 */
> -		if (vcpu->kvm->arch.arm_pmu->pmuver >= ID_AA64DFR0_EL1_PMUVer_V3P4)
> +		if (vcpu->kvm->arch.dfr0_pmuver.imp >= ID_AA64DFR0_EL1_PMUVer_V3P4)
>  			val &= ~BIT_ULL(ARMV8_PMUV3_PERFCTR_STALL_SLOT - 32);

I don't think this conditional masking is correct in the first place,
and this change would only make it worse.

We emulate reads of PMCEID1_EL0 using the literal value of the CPU. The
_advertised_ PMU version has no bearing on the core PMU version. So,
assuming we hit this on a v3p5+ part with userspace (stupidly)
advertising an older implementation level, we never clear the bit for
STALL_SLOT.

So let's just fix the issue by unconditionally masking the bit.

>  		base = 32;
>  	}
> @@ -932,11 +933,17 @@ int kvm_arm_pmu_v3_set_attr(struct kvm_vcpu *vcpu, struct kvm_device_attr *attr)
>  		return 0;
>  	}
>  	case KVM_ARM_VCPU_PMU_V3_FILTER: {
> +		u8 pmuver = kvm_arm_pmu_get_pmuver_limit();
>  		struct kvm_pmu_event_filter __user *uaddr;
>  		struct kvm_pmu_event_filter filter;
>  		int nr_events;
>  
> -		nr_events = kvm_pmu_event_mask(kvm) + 1;
> +		/*
> +		 * Allow userspace to specify an event filter for the entire
> +		 * event range supported by PMUVer of the hardware, rather
> +		 * than the guest's PMUVer for KVM backward compatibility.
> +		 */
> +		nr_events = __kvm_pmu_event_mask(pmuver) + 1;

This is a rather signifcant change from the existing behavior though,
no?

The 'raw' PMU version of the selected instance has been used as the
basis of the maximum event list, but this uses the sanitised value. I'd
rather we consistently use the selected PMU instance as the basis for
all guest-facing PMU emulation.

I get that asymmetry in this deparment is exceedingly rare in the wild,
but I'd rather keep a consistent model in the PMU emulation code where
all our logic is based on the selected PMU instance.

--
Thanks,
Oliver