Re: [PATCH v7 7/9] KVM: x86/pmu: Restrict RDPMC passthrough to known CPUs

[Mi, Dapeng]

On 7/30/2026 11:05 PM, Chen, Zide wrote:
>
> On 7/29/2026 9:51 PM, Mi, Dapeng wrote:
>> On 7/28/2026 3:21 AM, Zide Chen wrote:
>>> RDPMC type encodings are vendor-defined and could theoretically be
>>> extended on future CPUs. An unknown RDPMC type could leak host
>>> PMU information to the guest through RDPMC passthrough.
>>>
>>> Rather than assuming future CPUs are safe, explicitly permit only
>>> reviewed CPU models and require RDPMC interception everywhere else.
>>> This ensures RDPMC passthrough is enabled only on CPUs whose RDPMC
>>> encodings are audited and supported by KVM.
>>>
>>> Suggested-by: Dapeng Mi <dapeng1.mi@xxxxxxxxxxxxxxx>
>>> Suggested-by: Jim Mattson <jmattson@xxxxxxxxxx>
>>> Signed-off-by: Zide Chen <zide.chen@xxxxxxxxx>
>>> ---
>>> v7: new patch.
>>> ---
>>>  arch/x86/kvm/pmu.c | 32 ++++++++++++++++++++++++++++++++
>>>  1 file changed, 32 insertions(+)
>>>
>>> diff --git a/arch/x86/kvm/pmu.c b/arch/x86/kvm/pmu.c
>>> index 51c6d00a485f..092809bd757d 100644
>>> --- a/arch/x86/kvm/pmu.c
>>> +++ b/arch/x86/kvm/pmu.c
>>> @@ -77,6 +77,21 @@ static const struct x86_cpu_id vmx_pebs_pdist_cpu[] = {
>>>  	{}
>>>  };
>>>  
>>> +/*
>>> + * CPUs whose RDPMC encodings have been audited for KVM RDPMC
>>> + * passthrough support.
>>> + */
>>> +static const struct x86_cpu_id kvm_rdpmc_known_cpus[] = {
>>> +	X86_MATCH_VFM(INTEL_ATOM_DARKMONT_X, NULL),
>>> +	X86_MATCH_VFM(INTEL_LUNARLAKE_M, NULL),
>>> +	X86_MATCH_VFM(INTEL_NOVALAKE, NULL),
>>> +	X86_MATCH_VFM(INTEL_NOVALAKE_L, NULL),
>>> +	X86_MATCH_VFM(INTEL_PANTHERLAKE_L, NULL),
>>> +	X86_MATCH_VFM(INTEL_PANTHERLAKE_R, NULL),
>>> +	X86_MATCH_VFM(INTEL_WILDCATLAKE_L, NULL),
>>> +	{}
>>> +};
>>> +
>>>  /* NOTE:
>>>   * - Each perf counter is defined as "struct kvm_pmc";
>>>   * - There are two types of perf counters: general purpose (gp) and fixed.
>>> @@ -807,6 +822,20 @@ bool kvm_need_perf_global_ctrl_intercept(struct kvm_vcpu *vcpu)
>>>  }
>>>  EXPORT_SYMBOL_FOR_KVM_INTERNAL(kvm_need_perf_global_ctrl_intercept);
>>>  
>>> +static bool kvm_rdpmc_encoding_supported(void)
>>> +{
>>> +	/* KVM understands all RDPMC encodings prior to PMU v6. */
>>> +	if (kvm_host_pmu.version < 6)
>> I'm not sure if this works for AMD platforms. Jim said current AMD
>> platforms already have security holes and I believe the PMU version of AMD
>> platforms are less than 6.
>>
>> Need AMD guys to confirm. @Sandipan, @Manali.
>>
>>
>>> +		return true;
>>> +
>>> +	/*
>>> +	 * Future PMU v6 implementations and future PMU versions require RDPMC
>>> +	 * interception until their RDPMC encodings are audited and supported
>>> +	 * by KVM.
>>> +	 */
>>> +	return x86_match_cpu(kvm_rdpmc_known_cpus);
>> x86_match_cpu() returns structure x86_cpu_id pointer or NULL instead of a
>> boolean variable. Better explicitly covert it to a boolean variable.
>>
>> return x86_match_cpu(kvm_rdpmc_known_cpus) != NULL;
> I think the implicit conversion is valid here. In C99, implicit
> conversion from a pointer to bool is well-defined, and is commonly used,
> e.g. if (x86_match_cpu(...)).
>
> bool is a typedef of _Bool.
>
> C99 6.3.1.2 "Boolean type":
>
> When any scalar value is converted to _Bool, the result is 0 if the
> value compares equal to 0; otherwise the result is 1.

Yeah, the implicit conversion is fine in theory. But the explicit
conversion seems more intuitionistic for me. Anyway, you can decide which
way you want. :)


>
>
>>> +}
>>> +
>>>  bool kvm_need_rdpmc_intercept(struct kvm_vcpu *vcpu)
>>>  {
>>>  	struct kvm_pmu *pmu = vcpu_to_pmu(vcpu);
>>> @@ -818,6 +847,9 @@ bool kvm_need_rdpmc_intercept(struct kvm_vcpu *vcpu)
>>>  	if (enable_vmware_backdoor)
>>>  		return true;
>>>  
>>> +	if (!kvm_rdpmc_encoding_supported())
>>> +		return true;
>>> +
>>>  	return kvm_need_any_pmc_intercept(vcpu) ||
>>>  	       pmu->counter_bitmask[KVM_PMC_GP] != (BIT_ULL(kvm_host_pmu.bit_width_gp) - 1) ||
>>>  	       pmu->counter_bitmask[KVM_PMC_FIXED] != (BIT_ULL(kvm_host_pmu.bit_width_fixed) - 1);
>