[PATCH 2/3] KVM: arm64: Pass the PMU events to the hyp vCPU of non-protected guests

[Vincent Donnefort]

On Tue, Oct 27, 2026 at 08:11:46AM +0000, Fuad Tabba wrote:
> From: Oliver Upton <oliver.upton at linux.dev>
> 
> Before every run, the host records in vcpu->arch.pmu.events which perf
> counters to disable and enable around guest entry, and
> __pmu_switch_to_guest() applies them at EL2. Since commit be66e67f1750
> ("KVM: arm64: Use the pKVM hyp vCPU structure in handle___kvm_vcpu_run()"),
> protected mode runs the hyp vCPU instead, and flush_hyp_vcpu() never
> copies the events into it. So the counters backing a non-protected
> guest's PMU are never enabled, and every counter the guest reads stays
> at 0, the cycle counter included. The host's counters that exclude
> guests keep counting the guest as well.
> 
> Copy the events into the hyp vCPU of a non-protected guest on every run.
> The events only exist with CONFIG_HW_PERF_EVENTS, so the copy is built
> under it. Like mdcr_el2, they're host-controlled and never reach a
> protected guest.
> 
> Fixes: be66e67f1750 ("KVM: arm64: Use the pKVM hyp vCPU structure in handle___kvm_vcpu_run()")
> Link: https://lore.kernel.org/all/20240305184840.636212-2-oliver.upton@linux.dev/
> Signed-off-by: Oliver Upton <oliver.upton at linux.dev>
> [Fuad: non-protected copy only, tested on the hyp vCPU, under
>  CONFIG_HW_PERF_EVENTS, new message]
> Co-developed-by: Fuad Tabba <fuad.tabba at linux.dev>
> Signed-off-by: Fuad Tabba <fuad.tabba at linux.dev>
> ---
>  arch/arm64/kvm/hyp/nvhe/hyp-main.c | 11 +++++++++++
>  1 file changed, 11 insertions(+)
> 
> diff --git a/arch/arm64/kvm/hyp/nvhe/hyp-main.c b/arch/arm64/kvm/hyp/nvhe/hyp-main.c
> index d715aa942577e..28a292deecb64 100644
> --- a/arch/arm64/kvm/hyp/nvhe/hyp-main.c
> +++ b/arch/arm64/kvm/hyp/nvhe/hyp-main.c
> @@ -690,6 +690,16 @@ static void sync_debug_state(struct pkvm_hyp_vcpu *hyp_vcpu)
>  		host_vcpu->arch.external_debug_state = hyp_vcpu->vcpu.arch.external_debug_state;
>  }
>  
> +#ifdef CONFIG_HW_PERF_EVENTS
> +static void flush_pmu_state(struct pkvm_hyp_vcpu *hyp_vcpu)
> +{
> +	if (!pkvm_hyp_vcpu_is_protected(hyp_vcpu))
> +		hyp_vcpu->vcpu.arch.pmu.events = hyp_vcpu->host_vcpu->arch.pmu.events;
> +}
> +#else
> +static void flush_pmu_state(struct pkvm_hyp_vcpu *hyp_vcpu) {}
> +#endif

nit: Could save a couple of lines by just doing?

#ifdef CONFIG_HW_PERF_EVENTS
   if (!pkvm_hyp_vcpu_is_protected(hyp_vcpu))
        hyp_vcpu->vcpu.arch.pmu.events = hyp_vcpu->host_vcpu->arch.pmu.events;
#endif

> +
>  static void flush_hyp_vcpu(struct pkvm_hyp_vcpu *hyp_vcpu)
>  {
>  	struct kvm_vcpu *host_vcpu = hyp_vcpu->host_vcpu;
> @@ -698,6 +708,7 @@ static void flush_hyp_vcpu(struct pkvm_hyp_vcpu *hyp_vcpu)
>  
>  	fpsimd_sve_flush();
>  	flush_debug_state(hyp_vcpu);
> +	flush_pmu_state(hyp_vcpu);
>  
>  	/*
>  	 * If we deal with a non-protected guest and the state is potentially
> -- 
> 2.47.3
> 

Reviewed-by: Vincent Donnefort <vdonnefort at google.com>
Tested-by: Vincent Donnefort <vdonnefort at google.com>

-- 
Vincent