Re: [PATCH v3 1/1] KVM: x86: Introduce has_protected_pmu state for TDX VMs

[Sean Christopherson <seanjc@google.com>]

On Thu, May 07, 2026, Vishal Annapurve wrote:
> PMU state for TDX VMs is virtualized by TDX Module [1]. Host has following
> toggles to control the PMU functionality exposed to TDX VMs:
> 1) Configure TD_PARAMS to allow guests to use performance monitoring.
> 2) Restrict the TD to a subset of the PEBS counters if supported.
> 3) Limit the TD to setup a certain perfmon events using basic/enhanced
>    event filtering.
> 
> KVM will need to be enlightened to support these toggles. Introduce
> has_protected_pmu state to track the pmu state for such scenarios
> and explicitly set the has_protected_pmu flag for TDX VMs.
> 
> If pmu state is protected:
> 1) Disable KVM's PMU virtualization framework as additional
> enlightenment is needed within KVM to control/manage the
> visibility of PMU state to such VMs.
> 2) Disallow userspace VMM from toggling PMU virtualization state
> using KVM_CAP_PMU_CAPABILITY.
> 
> [1] Section 15.2: https://cdrdv2.intel.com/v1/dl/getContent/733575
> 
> Suggested-by: Sean Christopherson <seanjc@google.com>
> Signed-off-by: Vishal Annapurve <vannapurve@google.com>
> 
> ---
> v2 -> v3:
> - Squashed two patches into a single patch as per feedback from Sean.
> - Dropped the cover letter.

...

> @@ -13375,7 +13376,10 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
>  	kvm->arch.default_tsc_khz = max_tsc_khz ? : tsc_khz;
>  	kvm->arch.apic_bus_cycle_ns = APIC_BUS_CYCLE_NS_DEFAULT;
>  	kvm->arch.guest_can_read_msr_platform_info = true;
> -	kvm->arch.enable_pmu = enable_pmu;
> +	if (kvm->arch.has_protected_pmu)
> +		kvm->arch.enable_pmu = false;
> +	else
> +		kvm->arch.enable_pmu = enable_pmu;

Once more, with feeling :-)

	kvm->arch.enable_pmu = enable_pmu && !kvm->arch.has_protected_pmu;

No need for a v4, I'll fixup when applying (assuming this is indeed the directin
we take).

>  
>  #if IS_ENABLED(CONFIG_HYPERV)
>  	spin_lock_init(&kvm->arch.hv_root_tdp_lock);
> -- 
> 2.54.0.563.g4f69b47b94-goog
>