Re: [PATCH v8 04/11] arm64: errata: Require Apple IMPDEF PMUv3 traps on all CPUs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Hardware/Arch: CPU Capability Constraint Violation for Erratum Workaround
--

--- Patch [4]: [PATCH v8 04/11] arm64: errata: Require Apple IMPDEF PMUv3 traps on all CPUs ---
commit 050c419823146065deb90e25a8ad6df622e115c7
Author: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>

arm64: errata: Require Apple IMPDEF PMUv3 traps on all CPUs

This commit changes the capability type of the Apple IMPDEF PMUv3 workaround
from a local CPU erratum to an early local CPU feature. It aims to require
the workaround system-wide and reject late CPUs that miss the workaround
once it is enabled.

> diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
> index 5377e4c2eba2b..01bc990b2200f 100644
> --- a/arch/arm64/kernel/cpu_errata.c
> +++ b/arch/arm64/kernel/cpu_errata.c
> @@ -964,7 +964,7 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
>  	{
>  		.desc = "Apple IMPDEF PMUv3 Traps",
>  		.capability = ARM64_WORKAROUND_PMUV3_IMPDEF_TRAPS,
> -		.type = ARM64_CPUCAP_LOCAL_CPU_ERRATUM,
> +		.type = ARM64_CPUCAP_EARLY_LOCAL_CPU_FEATURE,

[Severity: High]
Does changing this capability type inadvertently permit an unmitigated late
CPU to boot?

The ARM64_CPUCAP_EARLY_LOCAL_CPU_FEATURE type includes the
ARM64_CPUCAP_PERMITTED_FOR_LATE_CPU flag. If the system does not enable the
workaround initially (for example, if early CPUs do not all match), this
flag explicitly allows a late CPU that does require the erratum to boot
without triggering a panic.

Because the capability was not enabled system-wide, the .cpu_enable callback
is bypassed for that late CPU, meaning SYS_HACR_EL2 bit 56 is never set.

Could a guest executing on this unmitigated late CPU then directly access
the hardware PMU, leading to guest-to-host privilege escalation or an
information leak?

>  		.matches = has_impdef_pmuv3,
>  		.cpu_enable = cpu_enable_impdef_pmuv3_traps,
>  	},

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260710-hybrid-v8-0-621409f3a592@rsg.ci.i.u-tokyo.ac.jp?part=4