Re: [PATCH 3/3] KVM: arm64: Disable host PMU counters for protected guests

[Marc Zyngier]

On Tue, 27 Oct 2026 08:11:47 +0000,
Fuad Tabba <fuad.tabba@xxxxxxxxx> wrote:
> 
> A protected guest has no PMU, and EL2 clears MDCR_EL2.HPME for it.
> However, HPME has no effect, since __pkvm_vcpu_load() sets HPMN to cover
> every event counter, and HPME never covers the cycle or instruction
> counter. The counters the host has enabled therefore keep counting the
> guest.
> 
> Stop them in the world switch while a protected guest runs, reading
> PMCNTENSET_EL0 rather than trusting the host-controlled events mask.
> Gate this on a new per-CPU HAS_PMUV3 flag, since system_supports_pmuv3()
> is false when the CPUs implement different PMU versions.
> 
> Side channels are outside pKVM's threat model, so this is hardening
> rather than a fix.
> 
> Reported-by: Oculytic <oculytic@xxxxxxxxx>
> Signed-off-by: Fuad Tabba <fuad.tabba@xxxxxxxxx>
> ---
>  arch/arm64/include/asm/kvm_host.h |  1 +
>  arch/arm64/kvm/debug.c            |  4 +++-
>  arch/arm64/kvm/hyp/nvhe/switch.c  | 24 ++++++++++++++++++++++++
>  3 files changed, 28 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
> index 1c6632216e327..7ecb55e5018eb 100644
> --- a/arch/arm64/include/asm/kvm_host.h
> +++ b/arch/arm64/include/asm/kvm_host.h
> @@ -834,6 +834,7 @@ struct kvm_host_data {
>  #define KVM_HOST_DATA_FLAG_VCPU_IN_HYP_CONTEXT		4
>  #define KVM_HOST_DATA_FLAG_L1_VNCR_MAPPED		5
>  #define KVM_HOST_DATA_FLAG_HAS_BRBE			6
> +#define KVM_HOST_DATA_FLAG_HAS_PMUV3			7
>  	unsigned long flags;
>  
>  	struct kvm_cpu_context host_ctxt;
> diff --git a/arch/arm64/kvm/debug.c b/arch/arm64/kvm/debug.c
> index f4d7b12045e8f..3c74b076b5278 100644
> --- a/arch/arm64/kvm/debug.c
> +++ b/arch/arm64/kvm/debug.c
> @@ -79,9 +79,11 @@ void kvm_init_host_debug_data(void)
>  	unsigned int pmuver = cpuid_feature_extract_unsigned_field(dfr0,
>  								   ID_AA64DFR0_EL1_PMUVer_SHIFT);
>  
> -	if (pmuv3_implemented(pmuver))
> +	if (pmuv3_implemented(pmuver)) {
>  		*host_data_ptr(nr_event_counters) = FIELD_GET(ARMV8_PMU_PMCR_N,
>  							      read_sysreg(pmcr_el0));
> +		host_data_set_flag(HAS_PMUV3);

Honestly, I don't think we need to work out which CPUs have PMUv3 and
which don't. I'd be perfectly happy to disable KVM on asymmetric
systems, simply because they don't exist.

	M.

-- 
Without deviation from the norm, progress is not possible.