Re: [PATCH v3 1/1] KVM: x86: Introduce has_protected_pmu state for TDX VMs

[Sean Christopherson <seanjc@google.com>]

On Thu, May 07, 2026, Vishal Annapurve wrote:
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index 0a1b63c63d1a..99a383455d46 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -6910,7 +6910,8 @@ int kvm_vm_ioctl_enable_cap(struct kvm *kvm,
>  			break;
>  
>  		mutex_lock(&kvm->lock);
> -		if (!kvm->created_vcpus && !kvm->arch.created_mediated_pmu) {
> +		if (!kvm->created_vcpus && !kvm->arch.created_mediated_pmu &&
> +		    !kvm->arch.has_protected_pmu) {

An offlist Sashiko review pointed out that this will prevent doing
KVM_PMU_CAP_DISABLE on a TDX VM, which could prove problematic if userspace is
already explicitly disabling vPMU support for TDX.  I was thinking that wouldn't
be a problem since KVM already disallows KVM_PMU_CAP_DISABLE if enable_pmu=false,
but in that case KVM doesn't advertise KVM_CAP_PMU_VALID_MASK:

	r = enable_pmu ? KVM_CAP_PMU_VALID_MASK : 0;

And unless I'm misreading QEMU code, this will indeed be a problem.

Argh.  I was going to suggest something sightly fancier, but we rather stupidly
didn't provide a flag for ENABLE, and so we can't feed has_protected_pmu into the
valid mask.  Lame.

The other super minor detail is that kvm->arch.has_protected_pmu isn't guarded by
kvm->lock, and I really hope we never get to that point (e.g. for SNP).

So instead of disallowing KVM_CAP_PMU_CAPABILITY entirely, this?

diff --git arch/x86/kvm/x86.c arch/x86/kvm/x86.c
index dc69b8cebe0b..b833a2596430 100644
--- arch/x86/kvm/x86.c
+++ arch/x86/kvm/x86.c
@@ -6911,6 +6911,13 @@ int kvm_vm_ioctl_enable_cap(struct kvm *kvm,
                if (!enable_pmu || (cap->args[0] & ~KVM_CAP_PMU_VALID_MASK))
                        break;
 
+               if (kvm->arch.has_protected_pmu) {
+                       WARN_ON_ONCE(kvm->arch.enable_pmu);
+                       if (cap->args[0] == KVM_PMU_CAP_DISABLE)
+                               r = 0;
+                       break;
+               }
+
                mutex_lock(&kvm->lock);
                if (!kvm->created_vcpus && !kvm->arch.created_mediated_pmu) {
                        kvm->arch.enable_pmu = !(cap->args[0] & KVM_PMU_CAP_DISABLE);


>  			kvm->arch.enable_pmu = !(cap->args[0] & KVM_PMU_CAP_DISABLE);
>  			r = 0;
>  		}
> @@ -13375,7 +13376,10 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
>  	kvm->arch.default_tsc_khz = max_tsc_khz ? : tsc_khz;
>  	kvm->arch.apic_bus_cycle_ns = APIC_BUS_CYCLE_NS_DEFAULT;
>  	kvm->arch.guest_can_read_msr_platform_info = true;
> -	kvm->arch.enable_pmu = enable_pmu;
> +	if (kvm->arch.has_protected_pmu)
> +		kvm->arch.enable_pmu = false;
> +	else
> +		kvm->arch.enable_pmu = enable_pmu;
>  
>  #if IS_ENABLED(CONFIG_HYPERV)
>  	spin_lock_init(&kvm->arch.hv_root_tdp_lock);
> -- 
> 2.54.0.563.g4f69b47b94-goog
>