PMU configuration is VM-scoped, but SET_NR_COUNTERS can be issued through any vCPU. Checking only whether that vCPU's PMU has been initialized allows userspace to change the counter count through an idle sibling after another vCPU has run. Reject the attribute once any vCPU has run. This keeps the VM-wide implemented counter mask and the PMCR_EL0.N value stable after guest execution begins. Fixes: b7628c797376 ("KVM: arm64: Allow userspace to limit the number of PMU counters for EL2 VMs") Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Akihiko Odaki Reviewed-by: Fuad Tabba --- arch/arm64/kvm/pmu-emul.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/arch/arm64/kvm/pmu-emul.c b/arch/arm64/kvm/pmu-emul.c index 832dd145af2a..950b7a349659 100644 --- a/arch/arm64/kvm/pmu-emul.c +++ b/arch/arm64/kvm/pmu-emul.c @@ -1112,6 +1112,9 @@ static int kvm_arm_pmu_v3_set_nr_counters(struct kvm_vcpu *vcpu, unsigned int n) { struct kvm *kvm = vcpu->kvm; + if (kvm_vm_has_ran_once(kvm)) + return -EBUSY; + if (!kvm->arch.arm_pmu) return -EINVAL; -- 2.55.0