Re: [PATCH v2 04/16] KVM: x86/pmu: Gate BUFFER_OVF reserved bit on guest DS

[Chen, Zide]

On 10/28/2026 9:25 AM, Jim Mattson wrote:
> On Thu, Aug 27, 2026 at 3:49 PM Zide Chen <zide.chen@xxxxxxxxx> wrote:
>>
>> global_status_rsvd unconditionally clears GLOBAL_STATUS_BUFFER_OVF
>> (bit 62), even when the guest does not have X86_FEATURE_DS feature.
>> Clear it only when guest_cpu_cap_has(vcpu, X86_FEATURE_DS), matching
>> hardware behavior.
>>
>> Fixes: f5132b01386b ("KVM: Expose a version 2 architectural PMU to a guests")
>> Signed-off-by: Zide Chen <zide.chen@xxxxxxxxx>
>> ---
>> v2: new patch.
>> ---
>>  arch/x86/kvm/vmx/pmu_intel.c | 12 ++++++++++--
>>  1 file changed, 10 insertions(+), 2 deletions(-)
>>
>> diff --git a/arch/x86/kvm/vmx/pmu_intel.c b/arch/x86/kvm/vmx/pmu_intel.c
>> index 11c9161dc853..9fdae437e569 100644
>> --- a/arch/x86/kvm/vmx/pmu_intel.c
>> +++ b/arch/x86/kvm/vmx/pmu_intel.c
>> @@ -576,8 +576,16 @@ static void intel_pmu_refresh(struct kvm_vcpu *vcpu)
>>                          ((BIT_ULL(pmu->nr_arch_fixed_counters) - 1) << KVM_FIXED_PMC_BASE_IDX));
>>         pmu->global_ctrl_rsvd = counter_rsvd;
>>
>> -       pmu->global_status_rsvd = pmu->global_ctrl_rsvd
>> -                       & ~(GLOBAL_STATUS_BUFFER_OVF | GLOBAL_STATUS_COND_CHG);
>> +       /*
>> +        * Layout of bits 48:0 in IA32_PERF_GLOBAL_CTRL is identical to
>> +        * IA32_PERF_GLOBAL_STATUS, but IA32_PERF_GLOBAL_STATUS has additional
>> +        * bits.
>> +        */
>> +       pmu->global_status_rsvd = pmu->global_ctrl_rsvd;
>> +       if (guest_cpu_cap_has(vcpu, X86_FEATURE_DS))
>> +               pmu->global_status_rsvd &= ~GLOBAL_STATUS_BUFFER_OVF;
> 
> According to Intel SDM Vol. 4, Table 2-2 ("IA-32 Architectural MSRs"), bit
> 62 (OvfBuf / ClrOvfBuf) in IA32_PERF_GLOBAL_STATUS (0x38e) and
> IA32_PERF_GLOBAL_STATUS_RESET (0x390) is supported "If CPUID.0AH:EAX[7:0] >
> 0", and bit 62 (Set OvfBuf) in IA32_PERF_GLOBAL_STATUS_SET (0x391) is
> supported "If CPUID.0AH:EAX[7:0] > 3". Though it makes some sense, a
> dependency on CPUID.01H:EDX.DS[bit 21] is not documented in the SDM.
> 
> In mediated PMU mode, vmx_pebs_supported() is false, so KVM clears
> X86_FEATURE_DS for mediated PMU guests. However, when PMU global controls
> don't have to be intercepted, MSR_CORE_PERF_GLOBAL_STATUS,
> MSR_CORE_PERF_GLOBAL_OVF_CTRL, and MSR_CORE_PERF_GLOBAL_STATUS_SET are
> passed through directly to the guest. Hardware certainly allows bit 62 to
> be written to IA32_PERF_GLOBAL_OVF_CTRL or IA32_PERF_GLOBAL_STATUS_SET.
> 
> If a guest sets bit 62 in hardware via IA32_PERF_GLOBAL_STATUS_SET,
> intel_mediated_pmu_put() will save bit 62 into pmu->global_status, and
> subsequent KVM_SET_MSRS(MSR_CORE_PERF_GLOBAL_STATUS) or intercepted writes
> to MSR_CORE_PERF_GLOBAL_OVF_CTRL will fail the pmu->global_status_rsvd
> check.
> 
> Essentially, this means that we can't pass through the PMU global controls
> unless their reserved bits match hardware.

Thanks for bringing this up. This patch should be dropped.