KVM: arm64: Clear VM-wide state when kvm_setup_vcpu() fails

KVM_ARM_VCPU_INIT records the requested features in the VM-wide bitmap before kvm_setup_vcpu() runs, and leaves them there when setup fails (e.g., HAS_EL2_E2H0 on a host without FEAT_NV1). The PMU attributes read that bitmap before the vCPU is initialized, so after such a failure with PMU_V3 requested, KVM_SET_DEVICE_ATTR on the PMU group no longer returns -ENODEV.

Until an INIT has succeeded, every INIT that gets past the feature checks rewrites the bitmap. After that, kvm_vcpu_init_changed() requires the requested features to match it, so the copy is a no-op. Clear the bitmap on failure while KVM_ARCH_FLAG_VCPU_FEATURES_CONFIGURED is clear.

Fixes 427733579744e ("KVM: arm64: Select default PMU in KVM_ARM_VCPU_INIT handler")

Suggested-by Oliver Upton <[email protected]>

Reviewed-by Lorenzo Stoakes (ARM) <[email protected]>

Signed-off-by Fuad Tabba <[email protected]>

---
  arch/arm64/kvm/arm.c | 7 ++++++-
  1 file changed, 6 insertions(+), 1 deletion(-)

arch/arm64/kvm/arm.c +0 -0

index 157bf4b812020..3e91e01b032c4 100644

arch/arm64/kvm/arm.c +3 -0

+			bitmap_zero(kvm->arch.vcpu_features, KVM_VCPU_MAX_FEATURES);
+
  		goto out_unlock;
+	}
 
  	/* Now we know what it is, we can reset it. */
  	kvm_reset_vcpu(vcpu);

Quoted 1 line

arch/arm64/kvm/arm.c +0 -0

arch/arm64/kvm/arm.c static int __kvm_vcpu_set_target(struct kvm_vcpu *vcpu, · line 1861

Quoted 8 lines

arch/arm64/kvm/arm.c +3 -1

@@ -1856,8 +1856,13 @@ static int __kvm_vcpu_set_target(struct kvm_vcpu *vcpu,
         bitmap_copy(kvm->arch.vcpu_features, &features, KVM_VCPU_MAX_FEATURES);
 
         ret = kvm_setup_vcpu(vcpu);
-        if (ret)
+        if (ret) {
+                /* Clear the bitmap if setup fails on the first vCPU to be initialized. */
+                if (!test_bit(KVM_ARCH_FLAG_VCPU_FEATURES_CONFIGURED, &kvm->arch.flags))

Is this check necessary ? We go into kvm_setup_vcpu() only if the bit is cleared and we do this under the config_lock mutex. The flag is only set after we have finished the kvm_setup_vcpu() successfully, later down.

Hi Suzuki,

On Mon, 02 Nov 2026 09:24:15 +0000, Suzuki K Poulose <[email protected]> wrote:
[...]

Quoted 1 line

Quoted 1 line

arch/arm64/kvm/arm.c +0 -0

[...]

Quoted 12 lines

arch/arm64/kvm/arm.c static int __kvm_vcpu_set_target(struct kvm_vcpu *vcpu, · line 1861

Quoted 8 lines

arch/arm64/kvm/arm.c +3 -1

@@ -1856,8 +1856,13 @@ static int __kvm_vcpu_set_target(struct kvm_vcpu *vcpu,
          bitmap_copy(kvm->arch.vcpu_features, &features, KVM_VCPU_MAX_FEATURES);
 
          ret = kvm_setup_vcpu(vcpu);
-        if (ret)
+        if (ret) {
+                /* Clear the bitmap if setup fails on the first vCPU to be initialized. */
+                if (!test_bit(KVM_ARCH_FLAG_VCPU_FEATURES_CONFIGURED, &kvm->arch.flags))

Is this check necessary ? We go into kvm_setup_vcpu() only if the bit is cleared and we do this under the config_lock mutex. The flag is only set after we have finished the kvm_setup_vcpu() successfully, later down.

It is. An INIT on a second vCPU with the same features also calls kvm_setup_vcpu(), with the flag already set, and kvm_vcpu_init_nested() can return -ENOMEM there.

Thanks,
/fuad

Under KVM_ARM_VCPU_PMU_V3_STRICT, the VM has no PMU until userspace selects one, and initializing the PMU fails with -ENXIO until then. However, without STRICT, kvm_setup_vcpu() selects the default PMU before it prepares the vCPU for nested virtualization, and leaves it set when that preparation fails. After a retry with STRICT, initializing the PMU succeeds and the guest gets the PMU of the CPU the failed INIT ran on.

Drop the PMU and its number of counters along with the VM's feature bitmap. While KVM_ARCH_FLAG_VCPU_FEATURES_CONFIGURED is clear, no vCPU has been initialized and the PMU attributes return -ENODEV, so only such a failure can have set them. Once the flag is set, every INIT has the features of the first one that succeeded, which either selected a PMU or had none to select, so kvm_setup_vcpu() doesn't select another.

Fixes ad220e275c398 ("KVM: arm64: Add KVM_ARM_VCPU_PMU_V3_STRICT vCPU feature")

Signed-off-by Fuad Tabba <[email protected]>

---
  arch/arm64/kvm/arm.c | 7 +++++--
  1 file changed, 5 insertions(+), 2 deletions(-)

arch/arm64/kvm/arm.c +0 -0

index 3e91e01b032c4..65194e02cdbc2 100644
@@ -1857,9 +1857,12 @@ static int __kvm_vcpu_set_target(struct kvm_vcpu *vcpu,
 

Changes since v3 [1]:
- New patch 2, clearing the default PMU left set by a failed INIT.
- Reworded patch 1's commit message.
- Rebased on 7.4-rc1.

A KVM_ARM_VCPU_INIT whose kvm_setup_vcpu() fails doesn't undo its changes to VM-wide state. Patch 1 clears the feature bitmap, which the PMU attributes read before the vCPU is initialized. Patch 2 clears the default PMU, which a retry with KVM_ARM_VCPU_PMU_V3_STRICT would otherwise inherit.

[...]