With hardware-assisted PMC filtering, a protected guest programs its event-selects itself, and KVM can't read or change them. If the PMU event filter changes while the guest runs, KVM can't stop an event the new filter denies, or restart one the old filter denied. So fail filter changes with EBUSY once the VM has vCPUs. The guest then always runs with the filter it started with. Signed-off-by: Manali Shukla --- arch/x86/kvm/pmu.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/arch/x86/kvm/pmu.c b/arch/x86/kvm/pmu.c index 23d439ad182c6..b3115c63f5c45 100644 --- a/arch/x86/kvm/pmu.c +++ b/arch/x86/kvm/pmu.c @@ -1388,6 +1388,17 @@ int kvm_vm_ioctl_set_pmu_event_filter(struct kvm *kvm, void __user *argp) goto cleanup; mutex_lock(&kvm->lock); + /* + * A protected guest's event-selects are in its encrypted VMSA, KVM + * can't re-vet the counters it runs against a new filter. + */ + if (kvm->arch.has_protected_state && + (kvm->arch.mediated_pmu_caps & KVM_MEDIATED_PMU_CAP_HW_FILTERED) && + kvm->created_vcpus) { + mutex_unlock(&kvm->lock); + r = -EBUSY; + goto cleanup; + } filter = rcu_replace_pointer(kvm->arch.pmu_event_filter, filter, mutex_is_locked(&kvm->lock)); mutex_unlock(&kvm->lock); -- 2.43.0