Re: [PATCH v11 19/21] KVM: arm64: PMU: Implement fixed-counters-only emulation

[Oliver Upton <oupton@kernel.org>]

On Tue, Sep 22, 2026 at 02:59:04PM +0900, Akihiko Odaki wrote:
> On 2026/09/20 20:40, sashiko-bot@kernel.org wrote:
> > Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> > - [High] kvm: arm64: PMU: host DoS via unprivileged user triggering TAINT_CPU_OUT_OF_SPEC
> > --
> > 
> > commit d0f716fd067877dc7eca2170bb877659746aae89
> > Author: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
> > KVM: arm64: PMU: Implement fixed-counters-only emulation
> > 
> > This commit adds a PMUv3 emulation mode that exposes only fixed event
> > counters to the guest. It recreates the underlying host perf event dynamically
> > if the vCPU thread migrates to a different physical CPU. If the destination
> > CPU lacks a registered PMU implementation, it warns and adds a kernel taint.
> > 
> > > diff --git a/arch/arm64/kvm/pmu-emul.c b/arch/arm64/kvm/pmu-emul.c
> > > --- a/arch/arm64/kvm/pmu-emul.c
> > > +++ b/arch/arm64/kvm/pmu-emul.c
> > [ ... ]
> > > @@ -811,6 +812,32 @@ static void kvm_pmu_create_perf_event(struct kvm_pmc *pmc)
> > >   	pmc->perf_event = event;
> > >   }
> > > +/**
> > > + * kvm_pmu_create_perf_event - create a perf event for a counter
> > > + * @pmc: Counter context
> > > + */
> > > +static void kvm_pmu_create_perf_event(struct kvm_pmc *pmc)
> > > +{
> > > +	struct kvm_vcpu *vcpu = kvm_pmc_to_vcpu(pmc);
> > > +	struct arm_pmu *arm_pmu = vcpu->kvm->arch.arm_pmu;
> > > +
> > > +	if (kvm_pmu_fixed_counters_only(vcpu->kvm)) {
> > > +		do {
> > > +			arm_pmu = kvm_pmu_probe_armpmu(READ_ONCE(vcpu->cpu));
> > > +
> > > +			if (!arm_pmu) {
> > > +				pr_warn_once("kvm: Unsupported PMU variation detected.\n");
> > > +				add_taint(TAINT_CPU_OUT_OF_SPEC, LOCKDEP_STILL_OK);
> > 
> > [Severity: High]
> > Can this allow an unprivileged user to intentionally crash the host?
> > 
> > An unprivileged user could create a VM with fixed-counters-only enabled,
> > and then use sched_setaffinity to force the vCPU thread to migrate
> > to a physical CPU that does not have a probed PMU (like an asymmetric core or
> > late-added CPU).
> > 
> > When the vCPU runs, kvm_pmu_create_perf_event() will detect the missing
> > PMU and call add_taint(TAINT_CPU_OUT_OF_SPEC, LOCKDEP_STILL_OK). If the host
> > is configured with panic_on_taint enabled, this triggers a direct kernel
> > panic.
> > 
> > Is there a way to return an error to userspace instead of adding a taint
> > based on user-controlled thread affinity?
> 
> The commit message currently says:
> 
> > Registered pPMUs must cover every CPU on which fixed-counters-only
> > emulation runs.
> 
> This wording may suggest that partial PMU coverage is supported, with
> userspace responsible for keeping vCPUs on covered CPUs. Under that
> interpretation, returning an error so userspace can adjust affinity
> would make sense.
> 
> The intended requirement, however, is that registered pPMUs cover every
> CPU. We do not intend to add complexity to either KVM or userspace to
> support partial coverage. The taint indicates an unsupported host
> configuration.
> 
> If another revision is needed, I will remove "on which
> fixed-counters-only emulation runs" to make that requirement explicit.
> 
> I believe all other concerns raised by reviewers and Sashiko have now
> been addressed.

Yeah, folks that use panic_on_warn and panic_on_taint get to suffer the
consequences. So please ignore the Sashiko feedback here.

Thanks,
Oliver