Re: [PATCH v3 1/9] perf/x86/intel: Ensure guest PEBS path doesn't set unwanted PERF_GLOBAL_CTRL bits

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The host PEBS collision check fails to mask non-counter bits, incorrectly disabling guest PEBS for events like Store Latency.
--

Note: The format of this report has been altered due to recitation
restrictions. The original patch code is not quoted directly, and findings are
provided as a free-form summary.

commit 39adc53b360e88595a3be6fc59b18b048d9e9921
Author: Sean Christopherson <seanjc@google.com>

perf/x86/intel: Ensure guest PEBS path doesn't set unwanted PERF_GLOBAL_CTRL bits

This commit masks the pebs counter values being reinstated into the global
control msr for a guest with perf's desired value. This is done to ensure the
hypervisor doesn't unintentionally enable counters.

In intel_guest_get_msrs(), the host pebs collision check evaluates the host
field of the pebs_enable array entry to determine if the host is actively
using pebs. If it is, guest pebs is disabled.

Is it possible for this check to falsely detect a host collision due to
non-counter bits being set?

When a guest configures a store latency pebs event, a backing perf event is
created. In intel_pmu_pebs_enable(), this sets both the counter index bit
and bit 63 in cpuc->pebs_enabled.

Because the host field is calculated as cpuc->pebs_enabled masked against
the inverse of cpuc->intel_ctrl_guest_mask, and the guest mask exclusively
tracks valid counter indices (never including bit 63), bit 63 remains set in
the host field.

Consequently, the check for whether the host is actively using pebs will
evaluate to true even when only the guest is using pebs. This introduces a
regression where guest pebs is completely disabled, silently breaking guest
store latency events.

Should the host pebs usage evaluation also be masked by intel_ctrl to prevent
non-counter bits from triggering a false collision?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260508231353.406465-1-seanjc@google.com?part=1