[PATCH 0/2] KVM: TDX: Disable PMU virtualization for TDX VMs

[PATCH 0/2] KVM: TDX: Disable PMU virtualization for TDX VMs

[FirstName LastName]

From: Vishal Annapurve <vannapurve@google.com>

TDX module virtualizes PMU for TDX VMs [1]. KVM has limited role to play
in virtualizing PMU accesses and needs additional enlightenment to
support all toggles provided by TDX module.

This series disables PMU virtualization within KVM for TDX VMs, which is
a safe bet until the complete set of PMU controls are implemented within KVM.

[1] Section 15.2: https://cdrdv2.intel.com/v1/dl/getContent/733575

Vishal Annapurve (2):
  KVM: x86: Move the default arch state init before vm_init() call
  KVM: TDX: Disable pmu virtualization for TDX VMs

 arch/x86/kvm/vmx/tdx.c |  6 ++++++
 arch/x86/kvm/x86.c     | 10 +++++-----
 2 files changed, 11 insertions(+), 5 deletions(-)

-- 
2.54.0.545.g6539524ca2-goog

[PATCH 1/2] KVM: x86: Move the default arch state init before vm_init() call

[FirstName LastName]

From: Vishal Annapurve <vannapurve@google.com>

Move the default kvm state initialization before vendor specific
vm_init() call to allow vendor specific code to override these defaults.

Next patch will use this update to allow TDX specific vm_init() to
override enable_pmu toggle.

Suggested-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Vishal Annapurve <vannapurve@google.com>
---
 arch/x86/kvm/x86.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 0a1b63c63d1a..fda842adb58a 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -13349,6 +13349,11 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
 		type == KVM_X86_DEFAULT_VM || type == KVM_X86_SW_PROTECTED_VM;
 	kvm->arch.disabled_quirks = kvm_caps.inapplicable_quirks & kvm_caps.supported_quirks;
 
+	kvm->arch.default_tsc_khz = max_tsc_khz ? : tsc_khz;
+	kvm->arch.apic_bus_cycle_ns = APIC_BUS_CYCLE_NS_DEFAULT;
+	kvm->arch.guest_can_read_msr_platform_info = true;
+	kvm->arch.enable_pmu = enable_pmu;
+
 	ret = kvm_page_track_init(kvm);
 	if (ret)
 		goto out;
@@ -13372,11 +13377,6 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
 	pvclock_update_vm_gtod_copy(kvm);
 	raw_spin_unlock_irqrestore(&kvm->arch.tsc_write_lock, flags);
 
-	kvm->arch.default_tsc_khz = max_tsc_khz ? : tsc_khz;
-	kvm->arch.apic_bus_cycle_ns = APIC_BUS_CYCLE_NS_DEFAULT;
-	kvm->arch.guest_can_read_msr_platform_info = true;
-	kvm->arch.enable_pmu = enable_pmu;
-
 #if IS_ENABLED(CONFIG_HYPERV)
 	spin_lock_init(&kvm->arch.hv_root_tdp_lock);
 	kvm->arch.hv_root_tdp = INVALID_PAGE;
-- 
2.54.0.545.g6539524ca2-goog

[PATCH 2/2] KVM: TDX: Disable pmu virtualization for TDX VMs

[FirstName LastName]

From: Vishal Annapurve <vannapurve@google.com>

TDX module virtualizes PMU for TDX VMs[1]. Host has following
toggles to control the PMU functionality exposed to TDX VMs:
1) Configure TD_PARAMS to allow guests to use performance monitoring.
2) Restrict the TD to a subset of the PEBS counters if supported.
3) Limit the TD to setup a certain perfmon events using basic/enhanced
   event filtering.

KVM will need to be enlightened to support these toggles. Explicitly
disable PMU virtualization for TDX VMs by default until such a support lands.

[1] Section 15.2: https://cdrdv2.intel.com/v1/dl/getContent/733575

Suggested-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Vishal Annapurve <vannapurve@google.com>
---
 arch/x86/kvm/vmx/tdx.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
index 1e47c194af53..01498c25942d 100644
--- a/arch/x86/kvm/vmx/tdx.c
+++ b/arch/x86/kvm/vmx/tdx.c
@@ -638,6 +638,12 @@ int tdx_vm_init(struct kvm *kvm)
 	kvm->arch.has_private_mem = true;
 	kvm->arch.disabled_quirks |= KVM_X86_QUIRK_IGNORE_GUEST_PAT;
 
+	/*
+	 * PMU support is provide by the TDX-Module (if enabled for the VM).
+	 * From KVM's perspective, the VM doesn't have a virtual PMU.
+	 */
+	kvm->arch.enable_pmu = false;
+
 	/*
 	 * Because guest TD is protected, VMM can't parse the instruction in TD.
 	 * Instead, guest uses MMIO hypercall.  For unmodified device driver,
-- 
2.54.0.545.g6539524ca2-goog

Re: [PATCH 2/2] KVM: TDX: Disable pmu virtualization for TDX VMs

[Sean Christopherson]

On Tue, May 05, 2026, FirstName LastName wrote:
> From: Vishal Annapurve <vannapurve@google.com>
> 
> TDX module virtualizes PMU for TDX VMs[1]. Host has following
> toggles to control the PMU functionality exposed to TDX VMs:
> 1) Configure TD_PARAMS to allow guests to use performance monitoring.
> 2) Restrict the TD to a subset of the PEBS counters if supported.
> 3) Limit the TD to setup a certain perfmon events using basic/enhanced
>    event filtering.
> 
> KVM will need to be enlightened to support these toggles. Explicitly
> disable PMU virtualization for TDX VMs by default until such a support lands.
> 
> [1] Section 15.2: https://cdrdv2.intel.com/v1/dl/getContent/733575
> 
> Suggested-by: Sean Christopherson <seanjc@google.com>
> Signed-off-by: Vishal Annapurve <vannapurve@google.com>
> ---
>  arch/x86/kvm/vmx/tdx.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
> index 1e47c194af53..01498c25942d 100644
> --- a/arch/x86/kvm/vmx/tdx.c
> +++ b/arch/x86/kvm/vmx/tdx.c
> @@ -638,6 +638,12 @@ int tdx_vm_init(struct kvm *kvm)
>  	kvm->arch.has_private_mem = true;
>  	kvm->arch.disabled_quirks |= KVM_X86_QUIRK_IGNORE_GUEST_PAT;
>  
> +	/*
> +	 * PMU support is provide by the TDX-Module (if enabled for the VM).
> +	 * From KVM's perspective, the VM doesn't have a virtual PMU.
> +	 */
> +	kvm->arch.enable_pmu = false;

Gah, I forgot that KVM_CAP_PMU_CAPABILITY allows re-enabling PMU support (which
is really quite annoying).  Unless we want to risk breaking userspace, the best
idea I can come up with is to add a has_protected_pmu flag, and then disallow
KVM_CAP_PMU_CAPABILITY.

The question then becomes, do we keep patch 1 and also clear enable_pmu in tdx.c,
or do we keep the ordering and have kvm_arch_init_vm() consume has_protected_pmu?
Neither one is particularly awesome :-/

diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index c470e40a00aa..8371dcaaed1a 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -1422,6 +1422,7 @@ struct kvm_arch {
        bool has_private_mem;
        bool has_protected_state;
        bool has_protected_eoi;
+       bool has_protected_pmu;
        bool pre_fault_allowed;
        struct hlist_head *mmu_page_hash;
        struct list_head active_mmu_pages;
diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
index 04ce321ebdf3..3ba295bd44f8 100644
--- a/arch/x86/kvm/vmx/tdx.c
+++ b/arch/x86/kvm/vmx/tdx.c
@@ -635,6 +635,7 @@ int tdx_vm_init(struct kvm *kvm)
         * i.e. all EOIs are accelerated and never trigger exits.
         */
        kvm->arch.has_protected_eoi = true;
+       kvm->arch.has_protected_pmu = true;
        kvm->arch.has_private_mem = true;
        kvm->arch.disabled_quirks |= KVM_X86_QUIRK_IGNORE_GUEST_PAT;
 
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 0a1b63c63d1a..57d78255c80c 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -6910,7 +6910,8 @@ int kvm_vm_ioctl_enable_cap(struct kvm *kvm,
                        break;
 
                mutex_lock(&kvm->lock);
-               if (!kvm->created_vcpus && !kvm->arch.created_mediated_pmu) {
+               if (!kvm->created_vcpus && !kvm->arch.created_mediated_pmu &&
+                   !kvm->arch.has_protected_pmu) {
                        kvm->arch.enable_pmu = !(cap->args[0] & KVM_PMU_CAP_DISABLE);
                        r = 0;
                }

Re: [PATCH 2/2] KVM: TDX: Disable pmu virtualization for TDX VMs

[Vishal Annapurve]

On Wed, May 6, 2026 at 4:03 PM Sean Christopherson <seanjc@google.com> wrote:
>
> On Tue, May 05, 2026, FirstName LastName wrote:
> > From: Vishal Annapurve <vannapurve@google.com>
> >
> > TDX module virtualizes PMU for TDX VMs[1]. Host has following
> > toggles to control the PMU functionality exposed to TDX VMs:
> > 1) Configure TD_PARAMS to allow guests to use performance monitoring.
> > 2) Restrict the TD to a subset of the PEBS counters if supported.
> > 3) Limit the TD to setup a certain perfmon events using basic/enhanced
> >    event filtering.
> >
> > KVM will need to be enlightened to support these toggles. Explicitly
> > disable PMU virtualization for TDX VMs by default until such a support lands.
> >
> > [1] Section 15.2: https://cdrdv2.intel.com/v1/dl/getContent/733575
> >
> > Suggested-by: Sean Christopherson <seanjc@google.com>
> > Signed-off-by: Vishal Annapurve <vannapurve@google.com>
> > ---
> >  arch/x86/kvm/vmx/tdx.c | 6 ++++++
> >  1 file changed, 6 insertions(+)
> >
> > diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
> > index 1e47c194af53..01498c25942d 100644
> > --- a/arch/x86/kvm/vmx/tdx.c
> > +++ b/arch/x86/kvm/vmx/tdx.c
> > @@ -638,6 +638,12 @@ int tdx_vm_init(struct kvm *kvm)
> >       kvm->arch.has_private_mem = true;
> >       kvm->arch.disabled_quirks |= KVM_X86_QUIRK_IGNORE_GUEST_PAT;
> >
> > +     /*
> > +      * PMU support is provide by the TDX-Module (if enabled for the VM).
> > +      * From KVM's perspective, the VM doesn't have a virtual PMU.
> > +      */
> > +     kvm->arch.enable_pmu = false;
>
> Gah, I forgot that KVM_CAP_PMU_CAPABILITY allows re-enabling PMU support (which
> is really quite annoying).  Unless we want to risk breaking userspace, the best
> idea I can come up with is to add a has_protected_pmu flag, and then disallow
> KVM_CAP_PMU_CAPABILITY.
>
> The question then becomes, do we keep patch 1 and also clear enable_pmu in tdx.c,
> or do we keep the ordering and have kvm_arch_init_vm() consume has_protected_pmu?
> Neither one is particularly awesome :-/

I am inclined to send the v2 with the latter option i.e. keep the
ordering the same and have kvm_arch_init_vm() consume
has_protected_pmu. Let's see how that goes.

>
> diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
> index c470e40a00aa..8371dcaaed1a 100644
> --- a/arch/x86/include/asm/kvm_host.h
> +++ b/arch/x86/include/asm/kvm_host.h
> @@ -1422,6 +1422,7 @@ struct kvm_arch {
>         bool has_private_mem;
>         bool has_protected_state;
>         bool has_protected_eoi;
> +       bool has_protected_pmu;
>         bool pre_fault_allowed;
>         struct hlist_head *mmu_page_hash;
>         struct list_head active_mmu_pages;
> diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
> index 04ce321ebdf3..3ba295bd44f8 100644
> --- a/arch/x86/kvm/vmx/tdx.c
> +++ b/arch/x86/kvm/vmx/tdx.c
> @@ -635,6 +635,7 @@ int tdx_vm_init(struct kvm *kvm)
>          * i.e. all EOIs are accelerated and never trigger exits.
>          */
>         kvm->arch.has_protected_eoi = true;
> +       kvm->arch.has_protected_pmu = true;
>         kvm->arch.has_private_mem = true;
>         kvm->arch.disabled_quirks |= KVM_X86_QUIRK_IGNORE_GUEST_PAT;
>
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index 0a1b63c63d1a..57d78255c80c 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -6910,7 +6910,8 @@ int kvm_vm_ioctl_enable_cap(struct kvm *kvm,
>                         break;
>
>                 mutex_lock(&kvm->lock);
> -               if (!kvm->created_vcpus && !kvm->arch.created_mediated_pmu) {
> +               if (!kvm->created_vcpus && !kvm->arch.created_mediated_pmu &&
> +                   !kvm->arch.has_protected_pmu) {
>                         kvm->arch.enable_pmu = !(cap->args[0] & KVM_PMU_CAP_DISABLE);
>                         r = 0;
>                 }

Re: [PATCH 2/2] KVM: TDX: Disable pmu virtualization for TDX VMs

[Huang, Kai]

On Wed, 2026-05-06 at 16:03 -0700, Sean Christopherson wrote:
> The question then becomes, do we keep patch 1 and also clear enable_pmu in tdx.c,
> or do we keep the ordering and have kvm_arch_init_vm() consume has_protected_pmu?
> Neither one is particularly awesome :-/

Maybe keeping patch 1 is slightly better?  This allows the vm_init() to toggle
all the values and flags that the default ones don't fit.  If we go with latter,
when there's similar cases where we need more flags, then kvm_arch_init_vm()
needs to consume more flags.

This is also consistent with how KVM sets the existing kvm-
>arch.shadow_mmio_value: KVM sets the default in kvm_arch_init_vm() ->
kvm_mmu_init_vm(), and then TDX changes it to other values in tdx_vm_init().

Re: [PATCH 2/2] KVM: TDX: Disable pmu virtualization for TDX VMs

[Vishal Annapurve]

On Wed, May 6, 2026 at 4:56 PM Huang, Kai <kai.huang@intel.com> wrote:
>
> On Wed, 2026-05-06 at 16:03 -0700, Sean Christopherson wrote:
> > The question then becomes, do we keep patch 1 and also clear enable_pmu in tdx.c,
> > or do we keep the ordering and have kvm_arch_init_vm() consume has_protected_pmu?
> > Neither one is particularly awesome :-/
>
> Maybe keeping patch 1 is slightly better?  This allows the vm_init() to toggle
> all the values and flags that the default ones don't fit.  If we go with latter,
> when there's similar cases where we need more flags, then kvm_arch_init_vm()
> needs to consume more flags.

For now I have sent a v2 without moving around the default flags. It's
definitely better to move them up as done in patch1, but I think its
ok to keep the flow unchanged untill we have a more concrete reason to
do the move.

>
> This is also consistent with how KVM sets the existing kvm-
> >arch.shadow_mmio_value: KVM sets the default in kvm_arch_init_vm() ->
> kvm_mmu_init_vm(), and then TDX changes it to other values in tdx_vm_init().

Re: [PATCH 2/2] KVM: TDX: Disable pmu virtualization for TDX VMs

[Sean Christopherson]

On Wed, May 06, 2026, Vishal Annapurve wrote:
> On Wed, May 6, 2026 at 4:56 PM Huang, Kai <kai.huang@intel.com> wrote:
> >
> > On Wed, 2026-05-06 at 16:03 -0700, Sean Christopherson wrote:
> > > The question then becomes, do we keep patch 1 and also clear enable_pmu in tdx.c,
> > > or do we keep the ordering and have kvm_arch_init_vm() consume has_protected_pmu?
> > > Neither one is particularly awesome :-/
> >
> > Maybe keeping patch 1 is slightly better?  This allows the vm_init() to toggle
> > all the values and flags that the default ones don't fit.  If we go with latter,
> > when there's similar cases where we need more flags, then kvm_arch_init_vm()
> > needs to consume more flags.
> 
> For now I have sent a v2 without moving around the default flags. It's
> definitely better to move them up as done in patch1,

Yes and no.  No matter what we do, we're subtly relying on ordering between
initialization in kvm_arch_init_vm() and kvm_x86_ops.vm_init().  I don't see an
easy way around that.

For these fields:

	kvm->arch.default_tsc_khz = max_tsc_khz ? : tsc_khz;
	kvm->arch.apic_bus_cycle_ns = APIC_BUS_CYCLE_NS_DEFAULT;
	kvm->arch.guest_can_read_msr_platform_info = true;

and any other fields that KVM initializes with hardcoded values, from globals, or
from local variables (including @type), I 100% agree that they should be initialized
before calling kvm_x86_ops.vm_init().

But with the proposed has_protected_pmu, I'm leaning towards keeping this:

	kvm->arch.enable_pmu = enable_pmu && !kvm->arch.has_protected_pmu;

which obviously means keeping it after kvm_x86_ops.vm_init().  Because if we make
vendor code responsible for clearing kvm->arch.enable_pmu, then (a) we may end
up with duplicate code for SEV-ES+ (does SEV-ES/SNP allow for a virtual/emulated
PMU?), and (b) the x86 code _looks_ wrong, because kvm_arch_init_vm() will ignore
kvm->arch.has_protected_pmu, while the KVM_CAP_PMU_CAPABILITY case-statement does
not.