From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f175.google.com (mail-pf1-f175.google.com [209.85.210.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4E9D4431498 for ; Fri, 7 Aug 2026 05:32:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.175 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786080776; cv=none; b=VYWiexEE0EaX2iE7kCE6ghZcbo0QBniyGPmRO82b53uPzxEEvrmseHaIt+7wB2MqFjUc1gAMptKUrht0ELHZZrPJAJCen+U5upXqvwTNyYXtHbrh5UbK/Ix7tu5P2bY+8wW5Jy4MLS39avYX1CH28+42zYLl5XO+8Qvx1a3QIP8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786080776; c=relaxed/simple; bh=WTgtCBbzxa7tjxkXGh9oWCGFMnuvuWmw8cQGqIT0GMo=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=t+dmTva+bgk0wkGfUg+5NMJgmg/XgOKd1UI3+oUCPUXQTPh6FmmSFoGPvHprnIDD7hHBLFVWdo5CO/S3N8Az6SJ6/kcmfzX1kj+hspqEcrtz5X2G7k+9699VQnvN+oxUxLkcc3WS7UGT/70oNEFz06Y6qIazRKTcP1XxBUdp1rI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=BkyiP8qg; arc=none smtp.client-ip=209.85.210.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="BkyiP8qg" Received: by mail-pf1-f175.google.com with SMTP id d2e1a72fcca58-8487214ad2bso4623700b3a.1 for ; Thu, 06 Aug 2026 22:32:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786080771; x=1786685571; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=t4URKGYUdKxYgKTjeOoH/uROuHrVlAZjzUU1uImLcd0=; b=BkyiP8qgzX2hZ1bdcP8/rBBKbsm/d1g06XJ9YtwYa8OQI2eQYhdKf9/OvpGFjwAnrs DSMsrQx0eV5SX5OarlaMZrPmk6lojknU4Ffz5w9lIa1cC3XxDOZBIbs0nwPNZkblHjUX +3SeCATsHpJgePDnDvCb3Mg25Z/Re6nCw26usCccoXzmwsQSD8zrmkOQzWPJXk1ld7jm ROhUkzMI06Wo3q02LEd/DFLN0e1AZvKxfjJSHeWEIACET3hJGkb/8HFdwnBpFXPQirGz aLir5jO5id7EdbuJMyK8b4F8AlVuyEEklHV+yVLHEMdMYojJnFeSiE+FB1Gx7v1AbWMk VN1A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786080771; x=1786685571; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=t4URKGYUdKxYgKTjeOoH/uROuHrVlAZjzUU1uImLcd0=; b=O+cWMqcO+RfPkAQaD5YYHJ4UVTtOOJYBYQsrYobAPIQJVKIQ4+zMnQqdS6B69BCoVs 2IJg4R/C/jc7pi8XDttTi+JlV+3ztqwHL1RdIEyNbAdnBcYlsKzkXgt8Bjsw+G+IYiC3 4FGsaYKSGPdC7FKw3v05Y4NoHmJIm+2bmc0yXRmxvoBfYHCExi5WWuxmbj136vytvFNl zZE66RKKe0FN1pXbh2MKESo9cfbSk7LBGnA70DGdoj01MXUVAS8LQ2/Uh8Zk9bMwHyMW AsCDC2TJQ+W8v9VuuocZylPi4sENl+BZANk8JKs9d9fPN8fVnSQ2cHtPpfxCuVpo1fhz cuLQ== X-Forwarded-Encrypted: i=1; AHgh+RpMCkaNI2R58sSu8f2X/W8xzXR92afvb6juf/yetfP8P25AgtcM1+h+cipoSONtkMx2nPYdikMFmLgBU+0=@vger.kernel.org X-Gm-Message-State: AOJu0YyvzsHEbM0oCgpMzXQzgpFeEovIssFSwSnIw4Eis1AvlCTXzOsR VEF7JdyuvwR3Z7hCKqdwvQqWl0nHze5whUb/McHiViwxmWPBuVNBkbMn X-Gm-Gg: AR+sD124qFNBvH0JVL8E82oA5pPhtjJVYAWRkuBM/57Nft+u4ZARtMRSUUKSfkkkuZF OAcsDisovBUrjRwza/4Vo0/BYCa1C1oRrV6F52juAlXL1zwltglWiMAvN5eAxFl9Q8HwlPLg04U dtY5UyCzogbXg2noe+dn3IpWG9M/uR3wwlj2c+k1VQIS753auV9LwzTV4HXdu3IWEK8Uf39KgNx /cgjOOI6+ovJpIqyHUbrTFL+0UcKicw1lux0O2U5BcwtRwrXV/rHurwwRciDBHuDxzNVYU3fJhz HfI8CinQ2RbTHeMo5BVCbk5pHD0YK+q+cK5tQYPZEIcVqTY4n9S4FGJ/yb5Xrxg8EnuEyJsPYFv 21wVlaJfnsXuECsAZ+uSVzK3AxYqX2GfXkJKlfRpfkjJjS/UIl0bRpA7nK7pYGu+vzwOazCEoBP lDnsaJSr9LJcCPegG7fvYAfR8JTlfZg0sqh3Bhm2ljn0fJdi1B36uVRurezSUfITpaVXirIgA30 +xLRwM= X-Received: by 2002:a05:6a00:3021:b0:848:8715:c2d9 with SMTP id d2e1a72fcca58-84f5df36a04mr1309064b3a.2.1786080771542; Thu, 06 Aug 2026 22:32:51 -0700 (PDT) Received: from cyh-System-Product-Name.. ([129.227.183.200]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cbe8f19634dsm108940a12.7.2026.08.06.22.32.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 06 Aug 2026 22:32:51 -0700 (PDT) From: "Yuhang.chen" To: anup@brainfault.org Cc: atish.patra@linux.dev, palmer@dabbelt.com, pjw@kernel.org, aou@eecs.berkeley.edu, alex@ghiti.fr, pbonzini@redhat.com, shuah@kernel.org, kvm@vger.kernel.org, kvm-riscv@lists.infradead.org, linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, zhouquan@iscas.ac.cn, "Yuhang.chen" Subject: [PATCH v2 1/2] RISC-V: KVM: Add PMU event filter support Date: Fri, 7 Aug 2026 13:32:26 +0800 Message-Id: <20260807053227.341700-2-yhchen312@gmail.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260807053227.341700-1-yhchen312@gmail.com> References: <20260807053227.341700-1-yhchen312@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Allow userspace to restrict which SBI PMU events a guest is permitted to program via the new VM ioctl KVM_SET_PMU_EVENT_FILTER. It takes a struct kvm_pmu_event_filter whose events[] array holds SBI PMU event indices encoded as (type << 16) | code. The action field selects ALLOW (only listed events may be programmed) or DENY (listed events are rejected); nevents == 0 clears any active filter. The filter is enforced in kvm_riscv_vcpu_pmu_ctr_cfg_match(), where a disallowed event fails configuration with SBI_ERR_NOT_SUPPORTED. It governs new counter configuration only and is not retroactive. The filter lives in struct kvm_arch, read via SRCU on the vCPU run path and replaced under kvm->lock with synchronize_srcu_expedited(). Event indices are masked to their valid bits before comparison, so reserved high bits cannot bypass a DENY filter. Advertise the feature with KVM_CAP_PMU_EVENT_FILTER. Assisted-by: YuanSheng:deepseek-v4-pro Co-developed-by: Quan Zhou Signed-off-by: Quan Zhou Signed-off-by: Yuhang.chen --- arch/riscv/include/asm/kvm_host.h | 3 ++ arch/riscv/include/uapi/asm/kvm.h | 20 +++++++++ arch/riscv/kvm/vcpu_pmu.c | 31 ++++++++++++++ arch/riscv/kvm/vm.c | 69 ++++++++++++++++++++++++++++++- 4 files changed, 122 insertions(+), 1 deletion(-) diff --git a/arch/riscv/include/asm/kvm_host.h b/arch/riscv/include/asm/kvm_host.h index 60017ceec9d2..1cd3d6a11057 100644 --- a/arch/riscv/include/asm/kvm_host.h +++ b/arch/riscv/include/asm/kvm_host.h @@ -95,6 +95,9 @@ struct kvm_arch { /* KVM_CAP_RISCV_MP_STATE_RESET */ bool mp_state_reset; + + /* KVM_SET_PMU_EVENT_FILTER */ + struct kvm_pmu_event_filter __rcu *pmu_event_filter; }; struct kvm_cpu_trap { diff --git a/arch/riscv/include/uapi/asm/kvm.h b/arch/riscv/include/uapi/asm/kvm.h index 504e73305343..da4f639fa89f 100644 --- a/arch/riscv/include/uapi/asm/kvm.h +++ b/arch/riscv/include/uapi/asm/kvm.h @@ -12,6 +12,7 @@ #ifndef __ASSEMBLER__ #include +#include #include #include @@ -396,6 +397,25 @@ struct kvm_riscv_sbi_fwft { /* One single KVM irqchip, ie. the AIA */ #define KVM_NR_IRQCHIPS 1 +/* for KVM_CAP_PMU_EVENT_FILTER */ +#define KVM_PMU_EVENT_ALLOW 0 +#define KVM_PMU_EVENT_DENY 1 + +/* + * For KVM_SET_PMU_EVENT_FILTER: restrict which SBI PMU events a guest may + * configure. Each @events entry is a SBI PMU event index (type in bits + * 19:16, code in bits 15:0). %KVM_PMU_EVENT_ALLOW permits only listed + * events; %KVM_PMU_EVENT_DENY rejects them. Enforced at counter + * configuration (SBI PMU COUNTER_CFG_MATCH), not retroactively. + */ +struct kvm_pmu_event_filter { + __u32 action; + __u32 nevents; + __u32 flags; + __u32 pad; + __DECLARE_FLEX_ARRAY(__u64, events); +}; + #endif #endif /* __LINUX_KVM_RISCV_H */ diff --git a/arch/riscv/kvm/vcpu_pmu.c b/arch/riscv/kvm/vcpu_pmu.c index bb46dcbfb24d..756040913468 100644 --- a/arch/riscv/kvm/vcpu_pmu.c +++ b/arch/riscv/kvm/vcpu_pmu.c @@ -733,6 +733,32 @@ int kvm_riscv_vcpu_pmu_ctr_stop(struct kvm_vcpu *vcpu, unsigned long ctr_base, return 0; } +static bool kvm_riscv_pmu_event_allowed(struct kvm *kvm, unsigned long eidx) +{ + struct kvm_pmu_event_filter *filter; + bool in_list = false; + unsigned int i; + + /* Reserved high bits must not bypass the filter. */ + eidx &= SBI_PMU_EVENT_IDX_MASK; + + filter = srcu_dereference(kvm->arch.pmu_event_filter, &kvm->srcu); + if (!filter) + return true; + + for (i = 0; i < filter->nevents; i++) { + if ((unsigned long)filter->events[i] == eidx) { + in_list = true; + break; + } + } + + /* ALLOW: permit only listed events; DENY: reject them. */ + if (filter->action == KVM_PMU_EVENT_ALLOW) + return in_list; + return !in_list; +} + int kvm_riscv_vcpu_pmu_ctr_cfg_match(struct kvm_vcpu *vcpu, unsigned long ctr_base, unsigned long ctr_mask, unsigned long flags, unsigned long eidx, u64 evtdata, @@ -773,6 +799,11 @@ int kvm_riscv_vcpu_pmu_ctr_cfg_match(struct kvm_vcpu *vcpu, unsigned long ctr_ba goto out; } + if (!kvm_riscv_pmu_event_allowed(vcpu->kvm, eidx)) { + sbiret = SBI_ERR_NOT_SUPPORTED; + goto out; + } + /* * SKIP_MATCH flag indicates the caller is aware of the assigned counter * for this event. Just do a sanity check if it already marked used. diff --git a/arch/riscv/kvm/vm.c b/arch/riscv/kvm/vm.c index a9f083feeb76..a5a3a2182d1e 100644 --- a/arch/riscv/kvm/vm.c +++ b/arch/riscv/kvm/vm.c @@ -53,6 +53,8 @@ void kvm_arch_destroy_vm(struct kvm *kvm) { kvm_destroy_vcpus(kvm); + kfree(srcu_dereference_check(kvm->arch.pmu_event_filter, &kvm->srcu, 1)); + kvm_riscv_aia_destroy_vm(kvm); } @@ -187,6 +189,7 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext) case KVM_CAP_MP_STATE: case KVM_CAP_IMMEDIATE_EXIT: case KVM_CAP_SET_GUEST_DEBUG: + case KVM_CAP_PMU_EVENT_FILTER: r = 1; break; case KVM_CAP_NR_VCPUS: @@ -265,7 +268,71 @@ int kvm_vm_ioctl_enable_cap(struct kvm *kvm, struct kvm_enable_cap *cap) } } +#define KVM_PMU_EVENT_FILTER_MAX_EVENTS 256 + +static int kvm_riscv_vm_ioctl_set_pmu_event_filter(struct kvm *kvm, + void __user *argp) +{ + struct kvm_pmu_event_filter __user *user_filter = argp; + struct kvm_pmu_event_filter *filter, tmp; + size_t size; + int r = 0; + + if (copy_from_user(&tmp, user_filter, sizeof(tmp))) + return -EFAULT; + + if (tmp.action != KVM_PMU_EVENT_ALLOW && + tmp.action != KVM_PMU_EVENT_DENY) + return -EINVAL; + + if (tmp.flags) + return -EINVAL; + + if (tmp.pad) + return -EINVAL; + + if (tmp.nevents > KVM_PMU_EVENT_FILTER_MAX_EVENTS) + return -E2BIG; + + size = struct_size(filter, events, tmp.nevents); + filter = kzalloc(size, GFP_KERNEL_ACCOUNT); + if (!filter) + return -ENOMEM; + + filter->action = tmp.action; + filter->nevents = tmp.nevents; + filter->flags = tmp.flags; + + if (copy_from_user(filter->events, user_filter->events, + flex_array_size(filter, events, filter->nevents))) { + r = -EFAULT; + goto cleanup; + } + + mutex_lock(&kvm->lock); + filter = rcu_replace_pointer(kvm->arch.pmu_event_filter, filter, + mutex_is_locked(&kvm->lock)); + mutex_unlock(&kvm->lock); + synchronize_srcu_expedited(&kvm->srcu); + +cleanup: + kfree(filter); + return r; +} + int kvm_arch_vm_ioctl(struct file *filp, unsigned int ioctl, unsigned long arg) { - return -EINVAL; + struct kvm *kvm = filp->private_data; + void __user *argp = (void __user *)arg; + int r; + + switch (ioctl) { + case KVM_SET_PMU_EVENT_FILTER: + r = kvm_riscv_vm_ioctl_set_pmu_event_filter(kvm, argp); + break; + default: + r = -EINVAL; + } + + return r; } -- 2.34.1