[PATCH v1] KVM: arm64: Use the host kvm_host_data for nr_event_counters

[Marc Zyngier]

On Fri, 23 Oct 2026 10:20:07 +0100,
Vincent Donnefort <vdonnefort at google.com> wrote:
> 
> nr_event_counters is only used by the host to populate mdcr_el2.
> However, host_data_ptr() for pKVM switches between the hypervisor copy
> of kvm_host_data before it is deprivileged to the host copy after.
> 
> So kvm_init_host_debug_data() initialises nr_event_counters in the
> hypervisor's kvm_host_data, while kvm_arm_setup_mdcr_el2() reads the
> host copy which is 0. With a HPMN of 0, this stops programmable event
> counters from counting a non-protected guest.
> 
> Always use the host copy for nr_event_counters.
> 
> Fixes: 2417218f2f23 ("KVM: arm64: Get rid of __kvm_get_mdcr_el2() and related warts")
> Signed-off-by: Vincent Donnefort <vdonnefort at google.com>
> ---
>  arch/arm64/kvm/debug.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/arch/arm64/kvm/debug.c b/arch/arm64/kvm/debug.c
> index f4d7b12045e8..a00771339c62 100644
> --- a/arch/arm64/kvm/debug.c
> +++ b/arch/arm64/kvm/debug.c
> @@ -44,7 +44,7 @@ static void kvm_arm_setup_mdcr_el2(struct kvm_vcpu *vcpu)
>  	 * to disable guest access to the profiling and trace buffers
>  	 */
>  	vcpu->arch.mdcr_el2 = FIELD_PREP(MDCR_EL2_HPMN,
> -					 *host_data_ptr(nr_event_counters));
> +					 __this_cpu_read(kvm_host_data.nr_event_counters));
>  	vcpu->arch.mdcr_el2 |= (MDCR_EL2_TPM |
>  				MDCR_EL2_TPMS |
>  				MDCR_EL2_TTRF |
> @@ -80,8 +80,8 @@ void kvm_init_host_debug_data(void)
>  								   ID_AA64DFR0_EL1_PMUVer_SHIFT);
>  
>  	if (pmuv3_implemented(pmuver))
> -		*host_data_ptr(nr_event_counters) = FIELD_GET(ARMV8_PMU_PMCR_N,
> -							      read_sysreg(pmcr_el0));
> +		__this_cpu_write(kvm_host_data.nr_event_counters,
> +				 FIELD_GET(ARMV8_PMU_PMCR_N, read_sysreg(pmcr_el0)));
>  
>  	*host_data_ptr(debug_brps) = SYS_FIELD_GET(ID_AA64DFR0_EL1, BRPs, dfr0);
>  	*host_data_ptr(debug_wrps) = SYS_FIELD_GET(ID_AA64DFR0_EL1, WRPs, dfr0);
> 

This really looks like the wrong approach.

host_data_ptr() should be reliable, and always point at the correct
data, irrespective of the backend. If host_data_ptr() returns a
pointer to stale data on pKVM, then it is purely a pKVM bug, and
that's what needs fixing by synchronising the two copies by whatever
means necessary.

Randomly picking a different accessor is not an acceptable outcome.

	M.

-- 
Without deviation from the norm, progress is not possible.