Re: [PATCH v7 7/9] KVM: x86/pmu: Restrict RDPMC passthrough to known CPUs

["Chen, Zide" <zide.chen@intel.com>]

On 7/29/2026 9:51 PM, Mi, Dapeng wrote:
> 
> On 7/28/2026 3:21 AM, Zide Chen wrote:
>> RDPMC type encodings are vendor-defined and could theoretically be
>> extended on future CPUs. An unknown RDPMC type could leak host
>> PMU information to the guest through RDPMC passthrough.
>>
>> Rather than assuming future CPUs are safe, explicitly permit only
>> reviewed CPU models and require RDPMC interception everywhere else.
>> This ensures RDPMC passthrough is enabled only on CPUs whose RDPMC
>> encodings are audited and supported by KVM.
>>
>> Suggested-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
>> Suggested-by: Jim Mattson <jmattson@google.com>
>> Signed-off-by: Zide Chen <zide.chen@intel.com>
>> ---
>> v7: new patch.
>> ---
>>  arch/x86/kvm/pmu.c | 32 ++++++++++++++++++++++++++++++++
>>  1 file changed, 32 insertions(+)
>>
>> diff --git a/arch/x86/kvm/pmu.c b/arch/x86/kvm/pmu.c
>> index 51c6d00a485f..092809bd757d 100644
>> --- a/arch/x86/kvm/pmu.c
>> +++ b/arch/x86/kvm/pmu.c
>> @@ -77,6 +77,21 @@ static const struct x86_cpu_id vmx_pebs_pdist_cpu[] = {
>>  	{}
>>  };
>>  
>> +/*
>> + * CPUs whose RDPMC encodings have been audited for KVM RDPMC
>> + * passthrough support.
>> + */
>> +static const struct x86_cpu_id kvm_rdpmc_known_cpus[] = {
>> +	X86_MATCH_VFM(INTEL_ATOM_DARKMONT_X, NULL),
>> +	X86_MATCH_VFM(INTEL_LUNARLAKE_M, NULL),
>> +	X86_MATCH_VFM(INTEL_NOVALAKE, NULL),
>> +	X86_MATCH_VFM(INTEL_NOVALAKE_L, NULL),
>> +	X86_MATCH_VFM(INTEL_PANTHERLAKE_L, NULL),
>> +	X86_MATCH_VFM(INTEL_PANTHERLAKE_R, NULL),
>> +	X86_MATCH_VFM(INTEL_WILDCATLAKE_L, NULL),
>> +	{}
>> +};
>> +
>>  /* NOTE:
>>   * - Each perf counter is defined as "struct kvm_pmc";
>>   * - There are two types of perf counters: general purpose (gp) and fixed.
>> @@ -807,6 +822,20 @@ bool kvm_need_perf_global_ctrl_intercept(struct kvm_vcpu *vcpu)
>>  }
>>  EXPORT_SYMBOL_FOR_KVM_INTERNAL(kvm_need_perf_global_ctrl_intercept);
>>  
>> +static bool kvm_rdpmc_encoding_supported(void)
>> +{
>> +	/* KVM understands all RDPMC encodings prior to PMU v6. */
>> +	if (kvm_host_pmu.version < 6)
> 
> I'm not sure if this works for AMD platforms. Jim said current AMD
> platforms already have security holes and I believe the PMU version of AMD
> platforms are less than 6.
> 
> Need AMD guys to confirm. @Sandipan, @Manali.
> 
> 
>> +		return true;
>> +
>> +	/*
>> +	 * Future PMU v6 implementations and future PMU versions require RDPMC
>> +	 * interception until their RDPMC encodings are audited and supported
>> +	 * by KVM.
>> +	 */
>> +	return x86_match_cpu(kvm_rdpmc_known_cpus);
> 
> x86_match_cpu() returns structure x86_cpu_id pointer or NULL instead of a
> boolean variable. Better explicitly covert it to a boolean variable.
> 
> return x86_match_cpu(kvm_rdpmc_known_cpus) != NULL;

I think the implicit conversion is valid here. In C99, implicit
conversion from a pointer to bool is well-defined, and is commonly used,
e.g. if (x86_match_cpu(...)).

bool is a typedef of _Bool.

C99 6.3.1.2 "Boolean type":

When any scalar value is converted to _Bool, the result is 0 if the
value compares equal to 0; otherwise the result is 1.


>> +}
>> +
>>  bool kvm_need_rdpmc_intercept(struct kvm_vcpu *vcpu)
>>  {
>>  	struct kvm_pmu *pmu = vcpu_to_pmu(vcpu);
>> @@ -818,6 +847,9 @@ bool kvm_need_rdpmc_intercept(struct kvm_vcpu *vcpu)
>>  	if (enable_vmware_backdoor)
>>  		return true;
>>  
>> +	if (!kvm_rdpmc_encoding_supported())
>> +		return true;
>> +
>>  	return kvm_need_any_pmc_intercept(vcpu) ||
>>  	       pmu->counter_bitmask[KVM_PMC_GP] != (BIT_ULL(kvm_host_pmu.bit_width_gp) - 1) ||
>>  	       pmu->counter_bitmask[KVM_PMC_FIXED] != (BIT_ULL(kvm_host_pmu.bit_width_fixed) - 1);