Re: [PATCH v8 09/11] KVM: arm64: PMU: Implement fixed-counters-only emulation

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Host-userspace-reachable WARN_ON_ONCE(!arm_pmu) when a VCPU is migrated to a physical CPU without an ARM PMU.
--

--- Patch [9]: [PATCH v8 09/11] KVM: arm64: PMU: Implement fixed-counters-only emulation ---
commit 9fc8926767402baf798832c66340a34d9fea3673
Author: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>

KVM: arm64: PMU: Implement fixed-counters-only emulation

This patch implements fixed-counters-only mode for PMUv3 emulation. It
restricts KVM to reporting only the cycle counter, and introduces a reload
mechanism if the vCPU migrates to a different physical CPU.

> diff --git a/arch/arm64/kvm/pmu-emul.c b/arch/arm64/kvm/pmu-emul.c
> index 2e7a0a427ddde..477852e8ddfe7 100644
> --- a/arch/arm64/kvm/pmu-emul.c
> +++ b/arch/arm64/kvm/pmu-emul.c

[ ... ]

> @@ -767,6 +773,29 @@ static void kvm_pmu_create_perf_event(struct kvm_pmc *pmc)
>  	pmc->perf_event = event;
>  }
>  
> +/**
> + * kvm_pmu_create_perf_event - create a perf event for a counter
> + * @pmc: Counter context
> + */
> +static void kvm_pmu_create_perf_event(struct kvm_pmc *pmc)
> +{
> +	struct kvm_vcpu *vcpu = kvm_pmc_to_vcpu(pmc);
> +	struct arm_pmu *arm_pmu = vcpu->kvm->arch.arm_pmu;
> +
> +	if (kvm_pmu_fixed_counters_only(vcpu->kvm)) {
> +		do {
> +			arm_pmu = kvm_pmu_probe_armpmu(READ_ONCE(vcpu->cpu));
> +
> +			if (WARN_ON_ONCE(!arm_pmu))

[Severity: High]
Can host userspace trigger this warning by migrating a VCPU thread to a
physical CPU that does not have a registered ARM PMU?

If host userspace uses sched_setaffinity to migrate a VCPU thread,
kvm_vcpu_load_pmu() detects the change and requests KVM_REQ_RELOAD_PMU.
When this request is handled before guest entry, it calls
kvm_pmu_create_perf_event(). In fixed-counters-only mode,
kvm_pmu_probe_armpmu() would return NULL, immediately hitting this
assertion.

This allows an unprivileged host userspace process to trigger a kernel
warning, which leads to a host kernel panic if panic_on_warn is enabled.

> +				return;
> +
> +			kvm_pmu_create_perf_event_with_pmu(pmc, arm_pmu);
> +		} while (!cpumask_test_cpu(READ_ONCE(vcpu->cpu), &arm_pmu->supported_cpus));
> +	} else {
> +		kvm_pmu_create_perf_event_with_pmu(pmc, arm_pmu);
> +	}
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260710-hybrid-v8-0-621409f3a592@rsg.ci.i.u-tokyo.ac.jp?part=9