Subject: [PATCH] KVM: arm64: Expose PMMIR_EL1.SLOTS to guests

From: Congkai Tan <[email-masked]>
Date: Mon, 1 Jun 2026 19:39:54 +0000

Commit 46081078feb4 ("KVM: arm64: Upgrade PMU support to ARMv8.4")
trapped PMMIR_EL1 as RAZ/WI and masked STALL_SLOT* from PMCEID1 to
discourage guests from relying on a register they could not read.

Forward the SLOTS field of PMMIR_EL1 so that the perf userspace tool
can read the correct value from
/sys/bus/event_source/devices/armv8_pmuv3_0/caps/slots. Today, perf
stat fails with message "Failure to read '#slots'" because it can
only read 0x0 from the sysfs location, causing the parsing failure
of the default metrics.

Fix this by:
1. Adding an access_pmmir() handler that reads arm_pmu->reg_pmmir
   and returns a masked value containing only the SLOTS field [7:0]
   to the guest. Other PMMIR_EL1 fields are kept as RAZ to limit
   the extra information that this change exposes; individual
   fields can be unmasked as KVM gains support for each feature.
2. Removing the STALL_SLOT, STALL_SLOT_FRONTEND and STALL_SLOT_BACKEND
   mask in PMCEID1. The mask existed to hide these events under the
   sysfs events/ directory when PMMIR_EL1 was RAZ; with SLOTS now
   readable they should be correctly exposed.

Tested on Graviton 2 (Neoverse N1, pre-PMUv3p4), Graviton 3
(Neoverse V1) and Graviton 4 (Neoverse V2) metal hosts with QEMU:
caps/slots reads 0x00000008 in guests on Graviton 3/4 and 0x00000000
on Graviton 2 (correct for pre-PMUv3p4). perf stat correctly
evaluates the default metrics.

Fixes: 46081078feb4 ("KVM: arm64: Upgrade PMU support to ARMv8.4")
Cc: [email-masked]
Signed-off-by: Congkai Tan <[email-masked]>
Reviewed-by: Haris Okanovic <[email-masked]>
Reviewed-by: Geoff Blake <[email-masked]>
---
 arch/arm64/kvm/pmu-emul.c | 11 +----------
 arch/arm64/kvm/sys_regs.c | 26 ++++++++++++++++++++++++--
 2 files changed, 25 insertions(+), 12 deletions(-)

diff --git a/arch/arm64/kvm/pmu-emul.c b/arch/arm64/kvm/pmu-emul.c
index e1860acae641..bafd5a258927 100644
--- a/arch/arm64/kvm/pmu-emul.c
+++ b/arch/arm64/kvm/pmu-emul.c
@@ -864,16 +864,7 @@ static u64 compute_pmceid0(struct arm_pmu *pmu)
 
 static u64 compute_pmceid1(struct arm_pmu *pmu)
 {
-	u64 val = __compute_pmceid(pmu, 1);
-
-	/*
-	 * Don't advertise STALL_SLOT*, as PMMIR_EL0 is handled
-	 * as RAZ
-	 */
-	val &= ~(BIT_ULL(ARMV8_PMUV3_PERFCTR_STALL_SLOT - 32) |
-		 BIT_ULL(ARMV8_PMUV3_PERFCTR_STALL_SLOT_FRONTEND - 32) |
-		 BIT_ULL(ARMV8_PMUV3_PERFCTR_STALL_SLOT_BACKEND - 32));
-	return val;
+	return __compute_pmceid(pmu, 1);
 }
 
 u64 kvm_pmu_get_pmceid(struct kvm_vcpu *vcpu, bool pmceid1)
diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
index 148fc3400ea8..7da7566dfd9f 100644
--- a/arch/arm64/kvm/sys_regs.c
+++ b/arch/arm64/kvm/sys_regs.c
@@ -18,6 +18,7 @@
 #include <linux/printk.h>
 #include <linux/uaccess.h>
 #include <linux/irqchip/arm-gic-v3.h>
+#include <linux/perf/arm_pmu.h>
 
 #include <asm/arm_pmuv3.h>
 #include <asm/cacheflush.h>
@@ -1370,6 +1371,27 @@ static bool access_pminten(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
 	return true;
 }
 
+/*
+ * Expose only PMMIR_EL1.SLOTS to the guest, which is consumed by perf in its
+ * topdown default metric group. Other PMMIR_EL1 fields remain RAZ. Future
+ * patches can extend the exposed mask incrementally as KVM gains support for
+ * those features.
+ */
+static bool access_pmmir(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
+			 const struct sys_reg_desc *r)
+{
+	struct arm_pmu *cpu_pmu = vcpu->kvm->arch.arm_pmu;
+
+	if (p->is_write)
+		return write_to_read_only(vcpu, p, r);
+
+	if (check_pmu_access_disabled(vcpu, 0))
+		return false;
+
+	p->regval = cpu_pmu->reg_pmmir & ARMV8_PMU_SLOTS;
+	return true;
+}
+
 static bool access_pmovs(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
 			 const struct sys_reg_desc *r)
 {
@@ -3456,7 +3478,7 @@ static const struct sys_reg_desc sys_reg_descs[] = {
 	{ PMU_SYS_REG(PMINTENCLR_EL1),
 	  .access = access_pminten, .reg = PMINTENSET_EL1,
 	  .get_user = get_pmreg, .set_user = set_pmreg },
-	{ SYS_DESC(SYS_PMMIR_EL1), trap_raz_wi },
+	{ PMU_SYS_REG(PMMIR_EL1), .access = access_pmmir, .reset = NULL },
 
 	{ SYS_DESC(SYS_MAIR_EL1), access_vm_reg, reset_unknown, MAIR_EL1 },
 	{ SYS_DESC(SYS_PIRE0_EL1), NULL, reset_unknown, PIRE0_EL1,
@@ -4600,7 +4622,7 @@ static const struct sys_reg_desc cp15_regs[] = {
 	{ CP15_PMU_SYS_REG(HI,     0, 9, 14, 4), .access = access_pmceid },
 	{ CP15_PMU_SYS_REG(HI,     0, 9, 14, 5), .access = access_pmceid },
 	/* PMMIR */
-	{ CP15_PMU_SYS_REG(DIRECT, 0, 9, 14, 6), .access = trap_raz_wi },
+	{ CP15_PMU_SYS_REG(DIRECT, 0, 9, 14, 6), .access = access_pmmir },
 
 	/* PRRR/MAIR0 */
 	{ AA32(LO), Op1( 0), CRn(10), CRm( 2), Op2( 0), access_vm_reg, NULL, MAIR_EL1 },

base-commit: 1702da76e017ae0fbe1a92b07bc332972c293e89
-- 
2.50.1