Speaker
Description
PMU Event filtering is a security feature that allows hypervisors to restrict which performance events guests can monitor, preventing potential side-channel attacks. However, when using hardware-acceleration PMU virtualization, the encrypted VMSA in SEV-ES and SEV-SNP creates a fundamental challenge: hypervisors cannot read or modify guest PMU states directly, which breaks PMC filtering with hardware-accelerated PMU virtualization and prevents confidential VMs from using upcoming AMD feature: Guest PMC Event Filtering.
This talk explores how PMC filtering can be restored for SEV-ES and SEV-SNP guests without weakening their isolation guarantees. The key idea is a cooperative model between guest and hypervisor that re-establishes the hypervisor's filtering authority even when it cannot touch the guest's encrypted state directly.
We will discuss the protocol design, implementation challenges, and how this approach restores hypervisor security control over guest PMC usage in confidential computing environments.