Re: [PATCH v11 19/21] KVM: arm64: PMU: Implement fixed-counters-only emulation

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] kvm: arm64: PMU: host DoS via unprivileged user triggering TAINT_CPU_OUT_OF_SPEC
--

commit d0f716fd067877dc7eca2170bb877659746aae89
Author: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
KVM: arm64: PMU: Implement fixed-counters-only emulation

This commit adds a PMUv3 emulation mode that exposes only fixed event
counters to the guest. It recreates the underlying host perf event dynamically
if the vCPU thread migrates to a different physical CPU. If the destination
CPU lacks a registered PMU implementation, it warns and adds a kernel taint.

> diff --git a/arch/arm64/kvm/pmu-emul.c b/arch/arm64/kvm/pmu-emul.c
> --- a/arch/arm64/kvm/pmu-emul.c
> +++ b/arch/arm64/kvm/pmu-emul.c
[ ... ]
> @@ -811,6 +812,32 @@ static void kvm_pmu_create_perf_event(struct kvm_pmc *pmc)
>  	pmc->perf_event = event;
>  }
>  
> +/**
> + * kvm_pmu_create_perf_event - create a perf event for a counter
> + * @pmc: Counter context
> + */
> +static void kvm_pmu_create_perf_event(struct kvm_pmc *pmc)
> +{
> +	struct kvm_vcpu *vcpu = kvm_pmc_to_vcpu(pmc);
> +	struct arm_pmu *arm_pmu = vcpu->kvm->arch.arm_pmu;
> +
> +	if (kvm_pmu_fixed_counters_only(vcpu->kvm)) {
> +		do {
> +			arm_pmu = kvm_pmu_probe_armpmu(READ_ONCE(vcpu->cpu));
> +
> +			if (!arm_pmu) {
> +				pr_warn_once("kvm: Unsupported PMU variation detected.\n");
> +				add_taint(TAINT_CPU_OUT_OF_SPEC, LOCKDEP_STILL_OK);

[Severity: High]
Can this allow an unprivileged user to intentionally crash the host?

An unprivileged user could create a VM with fixed-counters-only enabled,
and then use sched_setaffinity to force the vCPU thread to migrate
to a physical CPU that does not have a probed PMU (like an asymmetric core or
late-added CPU).

When the vCPU runs, kvm_pmu_create_perf_event() will detect the missing
PMU and call add_taint(TAINT_CPU_OUT_OF_SPEC, LOCKDEP_STILL_OK). If the host
is configured with panic_on_taint enabled, this triggers a direct kernel
panic.

Is there a way to return an error to userspace instead of adding a taint
based on user-controlled thread affinity?

> +				return;
> +			}
> +
> +			kvm_pmu_create_perf_event_with_pmu(pmc, arm_pmu);
> +		} while (!cpumask_test_cpu(READ_ONCE(vcpu->cpu), &arm_pmu->supported_cpus));
> +	} else {
> +		kvm_pmu_create_perf_event_with_pmu(pmc, arm_pmu);
> +	}
> +}
> +

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260920-hybrid-v11-0-03618771b0e1@rsg.ci.i.u-tokyo.ac.jp?part=19