Re: [PATCH v8 5/7] KVM: arm64: PMU: Implement fixed-counters-only emulation

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Time-of-check to time-of-use (TOCTOU) race condition in `kvm_pmu_create_perf_event()` allows the PMU cycle counter event to be created against the wrong physical CPU's PMU if the vCPU thread migrates during event creation, silently breaking the guest cycle counter.
--

commit 20c92d3c8fbdbec7346087339db116c12fe2ba15
Author: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>

KVM: arm64: PMU: Implement fixed-counters-only emulation

This commit adds internal state for PMUv3 emulation without programmable
event counters. When fixed-counters-only mode is active, it reports no
programmable counters, hides PMCEID, and manages per-load PMU reloading
for the cycle counter across asymmetric PMUs.

> diff --git a/arch/arm64/kvm/pmu-emul.c b/arch/arm64/kvm/pmu-emul.c
> index 465e40bd7353e..de4daaab3ae5e 100644
> --- a/arch/arm64/kvm/pmu-emul.c
> +++ b/arch/arm64/kvm/pmu-emul.c
> @@ -707,6 +716,12 @@ static void kvm_pmu_create_perf_event(struct kvm_pmc *pmc)
>  	int eventsel;
>  	u64 evtreg;
>  
> +	if (kvm_pmu_fixed_counters_only(vcpu->kvm)) {
> +		arm_pmu = kvm_pmu_probe_armpmu(vcpu->cpu);
> +		if (WARN_ON_ONCE(!arm_pmu))
> +			return;
> +	}
> +
>  	evtreg = kvm_pmc_read_evtreg(pmc);
>  
>  	kvm_pmu_stop_counter(pmc);

[ ... ]

> @@ -892,6 +910,24 @@ u64 kvm_pmu_get_pmceid(struct kvm_vcpu *vcpu, bool pmceid1)
>  	return val & mask;
>  }
>  
> +void kvm_vcpu_load_pmu(struct kvm_vcpu *vcpu)
> +{
> +	/*
> +	 * ARMV8_PMU_INSTR_IDX will need the same check once
> +	 * FEAT_PMUv3_ICNTR is supported.
> +	 */
> +	struct kvm_pmc *pmc = kvm_vcpu_idx_to_pmc(vcpu, ARMV8_PMU_CYCLE_IDX);
> +	struct arm_pmu *cpu_pmu;
> +
> +	if (!kvm_pmu_fixed_counters_only(vcpu->kvm) ||
> +	    !kvm_pmu_counter_is_enabled(pmc) || !pmc->perf_event)
> +		return;

[Severity: Medium]
Is there a TOCTOU race condition if the vCPU thread migrates during event
creation?

In kvm_pmu_create_perf_event(), arm_pmu is cached based on vcpu->cpu, and
then pmc->perf_event is cleared by kvm_pmu_stop_counter():

	if (kvm_pmu_fixed_counters_only(vcpu->kvm)) {
		arm_pmu = kvm_pmu_probe_armpmu(vcpu->cpu);
		...
	}
	...
	kvm_pmu_stop_counter(pmc);

If the thread is preempted and migrates to a different physical CPU before
the new event is assigned, the preempt notifier calls kvm_arch_vcpu_load(),
updating vcpu->cpu and calling kvm_vcpu_load_pmu().

Because pmc->perf_event is temporarily NULL during this window, this check
returns early and skips setting KVM_REQ_RELOAD_PMU.

When the thread resumes, it completes event creation using the originally
cached arm_pmu. On asymmetric systems, could this result in the cycle
counter being instantiated against the wrong hardware PMU and silently
failing to count?

> +
> +	cpu_pmu = to_arm_pmu(pmc->perf_event->pmu);
> +	if (!cpumask_test_cpu(vcpu->cpu, &cpu_pmu->supported_cpus))
> +		kvm_make_request(KVM_REQ_RELOAD_PMU, vcpu);
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260706-hybrid-v8-0-de459617b59d@rsg.ci.i.u-tokyo.ac.jp?part=5