[PATCH] arm64: mpam: Document when to set arm64.nompam

[Fuad Tabba]

Hi Ben,

On Thu, 3 Sept 2026 at 10:55, Ben Horgan <ben.horgan at arm.com> wrote:
...
> > +arm64.nompam
> > +============
>
> This assumes that the reader already knows or can guess that arm64.nompam is a command line
> parameter. Perhaps the section name can be 'Command line parameters' with a single 'arm64.nompam'
> subsection underneath or all in the section name.

Will do: a "Command line parameters" section with arm64.nompam as its
subsection.

>
> > +Firmware must enable MPAM at the highest implemented exception level and
> > +leave the MPAM system registers accessible to the kernel, or trap the
> > +accesses and emulate MPAM as disabled. Where it does neither, the CPUs
> > +still advertise MPAM in the ID registers, the first kernel access to an
> > +MPAM register traps to EL3, and the boot fails. ``arm64.nompam`` exists
> > +for that firmware: it makes the kernel treat the CPUs as not implementing
> > +MPAM, so no MPAM system register is accessed. Set it only on a machine
> > +that does not boot without it.
> > +
> > +It is not a way to turn MPAM off. On a system whose firmware has enabled
> > +MPAM at EL3, the option leaves the trap controls in MPAM2_EL2 and> +MPAMHCR_EL2 unwritten, and their reset values are UNKNOWN.
>
> Enabling MPAM at EL3 is separate from disabling traps. Setting MPAM3_EL3.MPAMEN to 1 means that the
> values in MPAMn_ELx are used to determine the PARTID and PMG for CPU requests. At this point EL3 can
> configure the PARTID and PMG for the different exception levels and MPAM can be used in the system
> under firmware control. Setting MPAM3_EL3.TRAPLOWER to 0 is what enables EL2 to access the MPAM
> registers without trapping and configure the traps for MPAM register accesses at EL1.

Thanks, I'll separate the two: TRAPLOWER being clear is what leaves
the EL2 trap controls unwritten, and MPAMEN is what makes a guest's
choice of PARTID and PMG take effect.

> > KVM still
> > +hides MPAM from guests but no longer enables the traps that stop a guest
> > +from using it, so a guest may be able to choose its own PARTID and PMG.
> >
> Shouldn't this also mention that the MPAM_*_EL1 are not save restored and so if the traps aren't
> enabled provide a side channel between guests.

Yes, I'll add that KVM does not save or restore MPAM0_EL1 and
MPAM1_EL1, so what one guest writes is still there for the next guest
on that CPU.

I'll send a v2 with these once others have had a chance to comment as well.

Cheers,
/fuad

> Thanks,
>
> Ben
>
> >  Reporting Bugs
> >  ==============
> >  If you are not seeing the counters or controls you expect please share the
>