PMU state for TDX VMs is virtualized by TDX Module [1]. Host has following toggles to control the PMU functionality exposed to TDX VMs: 1) Configure TD_PARAMS to allow guests to use performance monitoring. 2) Restrict the TD to a subset of the PEBS counters if supported. 3) Limit the TD to setup a certain perfmon events using basic/enhanced event filtering. KVM will need to be enlightened to support these toggles. Introduce has_protected_pmu state to track the pmu state for such scenarios and explicitly set the has_protected_pmu flag for TDX VMs. If pmu state is protected: 1) Disable KVM's PMU virtualization framework as additional enlightenment is needed within KVM to control/manage the visibility of PMU state to such VMs. 2) Disallow userspace VMM from toggling PMU virtualization state using KVM_CAP_PMU_CAPABILITY. [1] Section 15.2: https://cdrdv2.intel.com/v1/dl/getContent/733575 Suggested-by: Sean Christopherson Signed-off-by: Vishal Annapurve --- v2 -> v3: - Squashed two patches into a single patch as per feedback from Sean. - Dropped the cover letter. v2: https://lore.kernel.org/kvm/20260507003613.1784851-1-vannapurve@google.com/#t arch/x86/include/asm/kvm_host.h | 1 + arch/x86/kvm/vmx/tdx.c | 6 ++++++ arch/x86/kvm/x86.c | 8 ++++++-- 3 files changed, 13 insertions(+), 2 deletions(-) diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h index c470e40a00aa..8371dcaaed1a 100644 --- a/arch/x86/include/asm/kvm_host.h +++ b/arch/x86/include/asm/kvm_host.h @@ -1422,6 +1422,7 @@ struct kvm_arch { bool has_private_mem; bool has_protected_state; bool has_protected_eoi; + bool has_protected_pmu; bool pre_fault_allowed; struct hlist_head *mmu_page_hash; struct list_head active_mmu_pages; diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c index 1e47c194af53..eb4b4518e6f0 100644 --- a/arch/x86/kvm/vmx/tdx.c +++ b/arch/x86/kvm/vmx/tdx.c @@ -638,6 +638,12 @@ int tdx_vm_init(struct kvm *kvm) kvm->arch.has_private_mem = true; kvm->arch.disabled_quirks |= KVM_X86_QUIRK_IGNORE_GUEST_PAT; + /* + * PMU support is provided by the TDX-Module (if enabled for the VM). + * From KVM's perspective, the VM doesn't have a virtual PMU. + */ + kvm->arch.has_protected_pmu = true; + /* * Because guest TD is protected, VMM can't parse the instruction in TD. * Instead, guest uses MMIO hypercall. For unmodified device driver, diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 0a1b63c63d1a..99a383455d46 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -6910,7 +6910,8 @@ int kvm_vm_ioctl_enable_cap(struct kvm *kvm, break; mutex_lock(&kvm->lock); - if (!kvm->created_vcpus && !kvm->arch.created_mediated_pmu) { + if (!kvm->created_vcpus && !kvm->arch.created_mediated_pmu && + !kvm->arch.has_protected_pmu) { kvm->arch.enable_pmu = !(cap->args[0] & KVM_PMU_CAP_DISABLE); r = 0; } @@ -13375,7 +13376,10 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type) kvm->arch.default_tsc_khz = max_tsc_khz ? : tsc_khz; kvm->arch.apic_bus_cycle_ns = APIC_BUS_CYCLE_NS_DEFAULT; kvm->arch.guest_can_read_msr_platform_info = true; - kvm->arch.enable_pmu = enable_pmu; + if (kvm->arch.has_protected_pmu) + kvm->arch.enable_pmu = false; + else + kvm->arch.enable_pmu = enable_pmu; #if IS_ENABLED(CONFIG_HYPERV) spin_lock_init(&kvm->arch.hv_root_tdp_lock); -- 2.54.0.563.g4f69b47b94-goog