[PATCH v1] KVM: arm64: Use the host kvm_host_data for nr_event_counters

[Vincent Donnefort]

On Fri, Oct 23, 2026 at 01:37:45PM +0100, Marc Zyngier wrote:
> On Fri, 23 Oct 2026 10:20:07 +0100,
> Vincent Donnefort <vdonnefort at google.com> wrote:
> > 
> > nr_event_counters is only used by the host to populate mdcr_el2.
> > However, host_data_ptr() for pKVM switches between the hypervisor copy
> > of kvm_host_data before it is deprivileged to the host copy after.
> > 
> > So kvm_init_host_debug_data() initialises nr_event_counters in the
> > hypervisor's kvm_host_data, while kvm_arm_setup_mdcr_el2() reads the
> > host copy which is 0. With a HPMN of 0, this stops programmable event
> > counters from counting a non-protected guest.
> > 
> > Always use the host copy for nr_event_counters.
> > 
> > Fixes: 2417218f2f23 ("KVM: arm64: Get rid of __kvm_get_mdcr_el2() and related warts")
> > Signed-off-by: Vincent Donnefort <vdonnefort at google.com>
> > ---
> >  arch/arm64/kvm/debug.c | 6 +++---
> >  1 file changed, 3 insertions(+), 3 deletions(-)
> > 
> > diff --git a/arch/arm64/kvm/debug.c b/arch/arm64/kvm/debug.c
> > index f4d7b12045e8..a00771339c62 100644
> > --- a/arch/arm64/kvm/debug.c
> > +++ b/arch/arm64/kvm/debug.c
> > @@ -44,7 +44,7 @@ static void kvm_arm_setup_mdcr_el2(struct kvm_vcpu *vcpu)
> >  	 * to disable guest access to the profiling and trace buffers
> >  	 */
> >  	vcpu->arch.mdcr_el2 = FIELD_PREP(MDCR_EL2_HPMN,
> > -					 *host_data_ptr(nr_event_counters));
> > +					 __this_cpu_read(kvm_host_data.nr_event_counters));
> >  	vcpu->arch.mdcr_el2 |= (MDCR_EL2_TPM |
> >  				MDCR_EL2_TPMS |
> >  				MDCR_EL2_TTRF |
> > @@ -80,8 +80,8 @@ void kvm_init_host_debug_data(void)
> >  								   ID_AA64DFR0_EL1_PMUVer_SHIFT);
> >  
> >  	if (pmuv3_implemented(pmuver))
> > -		*host_data_ptr(nr_event_counters) = FIELD_GET(ARMV8_PMU_PMCR_N,
> > -							      read_sysreg(pmcr_el0));
> > +		__this_cpu_write(kvm_host_data.nr_event_counters,
> > +				 FIELD_GET(ARMV8_PMU_PMCR_N, read_sysreg(pmcr_el0)));
> >  
> >  	*host_data_ptr(debug_brps) = SYS_FIELD_GET(ID_AA64DFR0_EL1, BRPs, dfr0);
> >  	*host_data_ptr(debug_wrps) = SYS_FIELD_GET(ID_AA64DFR0_EL1, WRPs, dfr0);
> > 
> 
> This really looks like the wrong approach.
> 
> host_data_ptr() should be reliable, and always point at the correct
> data, irrespective of the backend. If host_data_ptr() returns a
> pointer to stale data on pKVM, then it is purely a pKVM bug, and
> that's what needs fixing by synchronising the two copies by whatever
> means necessary.

I'll update both copies and make a common series Fuad.

Thanks

-- 
Vincent


> 
> Randomly picking a different accessor is not an acceptable outcome.
> 
> 	M.
> 
> -- 
> Without deviation from the norm, progress is not possible.