Re: [PATCH v3 1/1] KVM: x86: Introduce has_protected_pmu state for TDX VMs

[Vishal Annapurve]

On Thu, May 7, 2026 at 1:11 PM Sean Christopherson <seanjc@xxxxxxxxxx> wrote:
>
> On Thu, May 07, 2026, Vishal Annapurve wrote:
> > diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> > index 0a1b63c63d1a..99a383455d46 100644
> > --- a/arch/x86/kvm/x86.c
> > +++ b/arch/x86/kvm/x86.c
> > @@ -6910,7 +6910,8 @@ int kvm_vm_ioctl_enable_cap(struct kvm *kvm,
> >                       break;
> >
> >               mutex_lock(&kvm->lock);
> > -             if (!kvm->created_vcpus && !kvm->arch.created_mediated_pmu) {
> > +             if (!kvm->created_vcpus && !kvm->arch.created_mediated_pmu &&
> > +                 !kvm->arch.has_protected_pmu) {
>
> An offlist Sashiko review pointed out that this will prevent doing
> KVM_PMU_CAP_DISABLE on a TDX VM, which could prove problematic if userspace is
> already explicitly disabling vPMU support for TDX.  I was thinking that wouldn't
> be a problem since KVM already disallows KVM_PMU_CAP_DISABLE if enable_pmu=false,
> but in that case KVM doesn't advertise KVM_CAP_PMU_VALID_MASK:
>
>         r = enable_pmu ? KVM_CAP_PMU_VALID_MASK : 0;
>
> And unless I'm misreading QEMU code, this will indeed be a problem.
>
> Argh.  I was going to suggest something sightly fancier, but we rather stupidly
> didn't provide a flag for ENABLE, and so we can't feed has_protected_pmu into the
> valid mask.  Lame.
>
> The other super minor detail is that kvm->arch.has_protected_pmu isn't guarded by
> kvm->lock, and I really hope we never get to that point (e.g. for SNP).
>
> So instead of disallowing KVM_CAP_PMU_CAPABILITY entirely, this?
>
> diff --git arch/x86/kvm/x86.c arch/x86/kvm/x86.c
> index dc69b8cebe0b..b833a2596430 100644
> --- arch/x86/kvm/x86.c
> +++ arch/x86/kvm/x86.c
> @@ -6911,6 +6911,13 @@ int kvm_vm_ioctl_enable_cap(struct kvm *kvm,
>                 if (!enable_pmu || (cap->args[0] & ~KVM_CAP_PMU_VALID_MASK))
>                         break;
>
> +               if (kvm->arch.has_protected_pmu) {
> +                       WARN_ON_ONCE(kvm->arch.enable_pmu);
> +                       if (cap->args[0] == KVM_PMU_CAP_DISABLE)
> +                               r = 0;
> +                       break;
> +               }
> +
>                 mutex_lock(&kvm->lock);
>                 if (!kvm->created_vcpus && !kvm->arch.created_mediated_pmu) {
>                         kvm->arch.enable_pmu = !(cap->args[0] & KVM_PMU_CAP_DISABLE);
>

Incorporated this in v4 [1].

[1] https://lore.kernel.org/kvm/20260507212957.2629561-1-vannapurve@xxxxxxxxxx/.

>
> >                       kvm->arch.enable_pmu = !(cap->args[0] & KVM_PMU_CAP_DISABLE);
> >                       r = 0;
> >               }
> > @@ -13375,7 +13376,10 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
> >       kvm->arch.default_tsc_khz = max_tsc_khz ? : tsc_khz;
> >       kvm->arch.apic_bus_cycle_ns = APIC_BUS_CYCLE_NS_DEFAULT;
> >       kvm->arch.guest_can_read_msr_platform_info = true;
> > -     kvm->arch.enable_pmu = enable_pmu;
> > +     if (kvm->arch.has_protected_pmu)
> > +             kvm->arch.enable_pmu = false;
> > +     else
> > +             kvm->arch.enable_pmu = enable_pmu;
> >
> >  #if IS_ENABLED(CONFIG_HYPERV)
> >       spin_lock_init(&kvm->arch.hv_root_tdp_lock);
> > --
> > 2.54.0.563.g4f69b47b94-goog
> >