Re: [PATCH v2 04/16] KVM: x86/pmu: Gate BUFFER_OVF reserved bit on guest DS

[Jim Mattson]

On Thu, Aug 27, 2026 at 3:49 PM Zide Chen <zide.chen@xxxxxxxxx> wrote:
>
> global_status_rsvd unconditionally clears GLOBAL_STATUS_BUFFER_OVF
> (bit 62), even when the guest does not have X86_FEATURE_DS feature.
> Clear it only when guest_cpu_cap_has(vcpu, X86_FEATURE_DS), matching
> hardware behavior.
>
> Fixes: f5132b01386b ("KVM: Expose a version 2 architectural PMU to a guests")
> Signed-off-by: Zide Chen <zide.chen@xxxxxxxxx>
> ---
> v2: new patch.
> ---
>  arch/x86/kvm/vmx/pmu_intel.c | 12 ++++++++++--
>  1 file changed, 10 insertions(+), 2 deletions(-)
>
> diff --git a/arch/x86/kvm/vmx/pmu_intel.c b/arch/x86/kvm/vmx/pmu_intel.c
> index 11c9161dc853..9fdae437e569 100644
> --- a/arch/x86/kvm/vmx/pmu_intel.c
> +++ b/arch/x86/kvm/vmx/pmu_intel.c
> @@ -576,8 +576,16 @@ static void intel_pmu_refresh(struct kvm_vcpu *vcpu)
>                          ((BIT_ULL(pmu->nr_arch_fixed_counters) - 1) << KVM_FIXED_PMC_BASE_IDX));
>         pmu->global_ctrl_rsvd = counter_rsvd;
>
> -       pmu->global_status_rsvd = pmu->global_ctrl_rsvd
> -                       & ~(GLOBAL_STATUS_BUFFER_OVF | GLOBAL_STATUS_COND_CHG);
> +       /*
> +        * Layout of bits 48:0 in IA32_PERF_GLOBAL_CTRL is identical to
> +        * IA32_PERF_GLOBAL_STATUS, but IA32_PERF_GLOBAL_STATUS has additional
> +        * bits.
> +        */
> +       pmu->global_status_rsvd = pmu->global_ctrl_rsvd;
> +       if (guest_cpu_cap_has(vcpu, X86_FEATURE_DS))
> +               pmu->global_status_rsvd &= ~GLOBAL_STATUS_BUFFER_OVF;

According to Intel SDM Vol. 4, Table 2-2 ("IA-32 Architectural MSRs"), bit
62 (OvfBuf / ClrOvfBuf) in IA32_PERF_GLOBAL_STATUS (0x38e) and
IA32_PERF_GLOBAL_STATUS_RESET (0x390) is supported "If CPUID.0AH:EAX[7:0] >
0", and bit 62 (Set OvfBuf) in IA32_PERF_GLOBAL_STATUS_SET (0x391) is
supported "If CPUID.0AH:EAX[7:0] > 3". Though it makes some sense, a
dependency on CPUID.01H:EDX.DS[bit 21] is not documented in the SDM.

In mediated PMU mode, vmx_pebs_supported() is false, so KVM clears
X86_FEATURE_DS for mediated PMU guests. However, when PMU global controls
don't have to be intercepted, MSR_CORE_PERF_GLOBAL_STATUS,
MSR_CORE_PERF_GLOBAL_OVF_CTRL, and MSR_CORE_PERF_GLOBAL_STATUS_SET are
passed through directly to the guest. Hardware certainly allows bit 62 to
be written to IA32_PERF_GLOBAL_OVF_CTRL or IA32_PERF_GLOBAL_STATUS_SET.

If a guest sets bit 62 in hardware via IA32_PERF_GLOBAL_STATUS_SET,
intel_mediated_pmu_put() will save bit 62 into pmu->global_status, and
subsequent KVM_SET_MSRS(MSR_CORE_PERF_GLOBAL_STATUS) or intercepted writes
to MSR_CORE_PERF_GLOBAL_OVF_CTRL will fail the pmu->global_status_rsvd
check.

Essentially, this means that we can't pass through the PMU global controls
unless their reserved bits match hardware.