Re: [PATCH v9 02/16] KVM: arm64: PMU: Stop updating MDCR_EL2.HPMN

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The KVM_ARM_VCPU_PMU_V3_SET_NR_COUNTERS attribute handler allows post-run reconfiguration of VM-wide PMU state, violating finalization requirements.
--

--- Patch [2]: [PATCH v9 02/16] KVM: arm64: PMU: Stop updating MDCR_EL2.HPMN ---
commit 3727863e040affba175d6ddaaa4d17f6dbc0e769
Author: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>

KVM: arm64: PMU: Stop updating MDCR_EL2.HPMN

This commit stops KVM from rewriting MDCR_EL2.HPMN for every vCPU
whenever userspace changes the PMU or its counter count. Instead, it
updates nr_pmu_counters directly and relies on reset_mdcr() to initialize
HPMN at VCPU init time.

Closes: https://sashiko.dev/#/patchset/20260706-hybrid-v8-0-de459617b59d%40rsg.ci.i.u-tokyo.ac.jp?part=6

> diff --git a/arch/arm64/kvm/pmu-emul.c b/arch/arm64/kvm/pmu-emul.c
> index 98305bbfc095a..b5df6843dbcd5 100644
> --- a/arch/arm64/kvm/pmu-emul.c
> +++ b/arch/arm64/kvm/pmu-emul.c

[ ... ]

> @@ -1111,7 +1093,7 @@ static int kvm_arm_pmu_v3_set_nr_counters(struct kvm_vcpu *vcpu, unsigned int n)
>  	if (n > kvm_arm_pmu_get_max_counters(kvm))
>  		return -EINVAL;
>  
> -	kvm_arm_set_nr_counters(kvm, n);
> +	kvm->arch.nr_pmu_counters = n;

[Severity: High]
This is a pre-existing issue, but does this assignment allow post-run
reconfiguration of VM-wide PMU state?

The caller kvm_arm_pmu_v3_set_attr() gates this update using only the
local VCPU state:

	if (vcpu->arch.pmu.created)
		return -EBUSY;

If VCPU 0 has already run, and userspace configures a new VCPU 1 (where
vcpu->arch.pmu.created is false), couldn't a call to KVM_SET_DEVICE_ATTR
reduce the number of counters and overwrite the VM-wide
kvm->arch.nr_pmu_counters here?

When the running VCPU 0 accesses a previously valid counter, KVM's
pmu_counter_idx_valid() would read the newly reduced nr_pmu_counters and
could inject an Undefined Exception. Does this need to be gated by
checking if any VCPU has run?

>  	return 0;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260720-hybrid-v9-0-2b713ca1b5dc@rsg.ci.i.u-tokyo.ac.jp?part=2