[PATCH v3 2/3] KVM: arm64: Pass the PMU events to the hyp vCPU of non-protected guests

From: Fuad Tabba

Date: Wed Oct 28 2026 - 11:35:03 EST


From: Oliver Upton <oliver.upton@xxxxxxxxx>

Before every run, the host records in vcpu->arch.pmu.events which perf
counters to disable and enable around guest entry, and
__pmu_switch_to_guest() applies them at EL2. Since commit be66e67f1750
("KVM: arm64: Use the pKVM hyp vCPU structure in handle___kvm_vcpu_run()"),
protected mode runs the hyp vCPU instead, and flush_hyp_vcpu() never
copies the events into it. So the counters backing a non-protected
guest's PMU are never enabled, and every counter the guest reads stays
at 0, the cycle counter included. The host's counters that exclude
guests keep counting the guest as well.

Copy the events into the hyp vCPU of a non-protected guest on every run.
The events only exist with CONFIG_HW_PERF_EVENTS, so the copy is built
under it. Like mdcr_el2, they're host-controlled and never reach a
protected guest.

Fixes: be66e67f1750 ("KVM: arm64: Use the pKVM hyp vCPU structure in handle___kvm_vcpu_run()")
Link: https://lore.kernel.org/all/20240305184840.636212-2-oliver.upton@xxxxxxxxx/
Signed-off-by: Oliver Upton <oliver.upton@xxxxxxxxx>
[Fuad: non-protected copy only, tested on the hyp vCPU, under
CONFIG_HW_PERF_EVENTS, new message]
Tested-by: Vincent Donnefort <vdonnefort@xxxxxxxxxx>
Reviewed-by: Vincent Donnefort <vdonnefort@xxxxxxxxxx>
Co-developed-by: Fuad Tabba <fuad.tabba@xxxxxxxxx>
Signed-off-by: Fuad Tabba <fuad.tabba@xxxxxxxxx>
---
arch/arm64/kvm/hyp/nvhe/hyp-main.c | 11 +++++++++++
1 file changed, 11 insertions(+)

diff --git a/arch/arm64/kvm/hyp/nvhe/hyp-main.c b/arch/arm64/kvm/hyp/nvhe/hyp-main.c
index d715aa942577e..28a292deecb64 100644
--- a/arch/arm64/kvm/hyp/nvhe/hyp-main.c
+++ b/arch/arm64/kvm/hyp/nvhe/hyp-main.c
@@ -690,6 +690,16 @@ static void sync_debug_state(struct pkvm_hyp_vcpu *hyp_vcpu)
host_vcpu->arch.external_debug_state = hyp_vcpu->vcpu.arch.external_debug_state;
}

+#ifdef CONFIG_HW_PERF_EVENTS
+static void flush_pmu_state(struct pkvm_hyp_vcpu *hyp_vcpu)
+{
+ if (!pkvm_hyp_vcpu_is_protected(hyp_vcpu))
+ hyp_vcpu->vcpu.arch.pmu.events = hyp_vcpu->host_vcpu->arch.pmu.events;
+}
+#else
+static void flush_pmu_state(struct pkvm_hyp_vcpu *hyp_vcpu) {}
+#endif
+
static void flush_hyp_vcpu(struct pkvm_hyp_vcpu *hyp_vcpu)
{
struct kvm_vcpu *host_vcpu = hyp_vcpu->host_vcpu;
@@ -698,6 +708,7 @@ static void flush_hyp_vcpu(struct pkvm_hyp_vcpu *hyp_vcpu)

fpsimd_sve_flush();
flush_debug_state(hyp_vcpu);
+ flush_pmu_state(hyp_vcpu);

/*
* If we deal with a non-protected guest and the state is potentially
--
2.47.3