[PATCH 0/2] KVM: x86/pmu: Fix a fixed PMC event filter bypass bug

[PATCH 0/2] KVM: x86/pmu: Fix a fixed PMC event filter bypass bug

[Sean Christopherson]

Fix a bug reported by Sashiko, where KVM will effectively ignore PMU event
filters for fixed counters if FIXED_CTR_CTRL is changing, but enable bits
for denied counters are NOT changing.

Sean Christopherson (2):
  KVM: x86/pmu: Use hardware value when reprogramming for FIXED_CTR_CTRL
    changes
  KVM: selftests: Add regression test for mediated PMU fixed counter
    filter bug

 arch/x86/kvm/vmx/pmu_intel.c                           | 10 +++++++++-
 .../testing/selftests/kvm/x86/pmu_event_filter_test.c  |  6 ++++++
 2 files changed, 15 insertions(+), 1 deletion(-)


base-commit: d4bfaa66fa171089b9b9fb2dc17af9245f2b9b34
-- 
2.54.0.1032.g2f8565e1d1-goog

[PATCH 1/2] KVM: x86/pmu: Use hardware value when reprogramming for FIXED_CTR_CTRL changes

[Sean Christopherson]

When (conditionally) reprogramming fixed counters, use the hardware value
of FIXED_CTR_CTRL to detect changes, not the guest's original value.  For
guests with a mediated PMU, overwriting fixed_ctr_ctrl_hw at the start of
reprogramming without actually reacting to changes in fixed_ctr_ctrl_hw can
lead to KVM ignoring PMU event filters.

E.g. if the guest attempts to enable a fixed PMC that is disallowed, and
then toggles a different PMC in a subsequent WRMSR, KVM will update
pmu->fixed_ctr_ctrl_hw and reprogram the PMC that is changing, but not the
others that are now effectively enabled in pmu->fixed_ctr_ctrl_hw.

Note, the perf-based PMU is unaffected, as it doesn't use fixed_ctr_ctrl_hw
(which is also why keying off fixed_ctr_ctrl_hw works for both PMUs.

Note #2, fixed_ctr_ctrl_hw won't mess up pmc_in_use either, because the
latter isn't used by the mediated PMU.  Its purpose is solely to release
perf events that are no longer being actively used, and the meadiated PMU
obviously doesn't create perf events.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/all/20260528005419.0228F1F00A3A@smtp.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
---
 arch/x86/kvm/vmx/pmu_intel.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/arch/x86/kvm/vmx/pmu_intel.c b/arch/x86/kvm/vmx/pmu_intel.c
index 453cb3d3ec9b..a73a9515d96c 100644
--- a/arch/x86/kvm/vmx/pmu_intel.c
+++ b/arch/x86/kvm/vmx/pmu_intel.c
@@ -56,8 +56,16 @@ static struct x86_pmu_lbr *vcpu_to_lbr_records(struct kvm_vcpu *vcpu)
 
 static void reprogram_fixed_counters(struct kvm_pmu *pmu, u64 data)
 {
+	/*
+	 * Compare against the value the mediated PMU shoves into hardware, not
+	 * the guest's desired value.  For the emulated PMU (proxied via perf),
+	 * they are one and the same (fixed_ctr_ctrl_hw isn't used other than
+	 * here).  For the mediated PMU, KVM needs to reprogram the actual MSR,
+	 * and so needs to react to potential changes in the value shoved into
+	 * hardware, e.g. to ensure the event filter is enforced.
+	 */
+	u64 old_fixed_ctr_ctrl = pmu->fixed_ctr_ctrl_hw;
 	struct kvm_pmc *pmc;
-	u64 old_fixed_ctr_ctrl = pmu->fixed_ctr_ctrl;
 	int i;
 
 	pmu->fixed_ctr_ctrl = data;
-- 
2.54.0.1032.g2f8565e1d1-goog

[PATCH 2/2] KVM: selftests: Add regression test for mediated PMU fixed counter filter bug

[Sean Christopherson]

Add a regression test where KVM would inadvertently ignore PMU event
filters on writes that change _some_ bits in FIXED_CTR_CTRL, but not the
enable bits for PMCs that are denied to the guest.

Signed-off-by: Sean Christopherson <seanjc@google.com>
---
 tools/testing/selftests/kvm/x86/pmu_event_filter_test.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/tools/testing/selftests/kvm/x86/pmu_event_filter_test.c b/tools/testing/selftests/kvm/x86/pmu_event_filter_test.c
index c1232344fda8..84e4c6ca67a3 100644
--- a/tools/testing/selftests/kvm/x86/pmu_event_filter_test.c
+++ b/tools/testing/selftests/kvm/x86/pmu_event_filter_test.c
@@ -731,6 +731,8 @@ static void test_filter_ioctl(struct kvm_vcpu *vcpu)
 
 static void intel_run_fixed_counter_guest_code(u8 idx)
 {
+	u8 nr_fixed_counters = this_cpu_property(X86_PROPERTY_PMU_NR_FIXED_COUNTERS);
+
 	for (;;) {
 		wrmsr(MSR_CORE_PERF_GLOBAL_CTRL, 0);
 		wrmsr(MSR_CORE_PERF_FIXED_CTR0 + idx, 0);
@@ -738,6 +740,10 @@ static void intel_run_fixed_counter_guest_code(u8 idx)
 		/* Only OS_EN bit is enabled for fixed counter[idx]. */
 		wrmsr(MSR_CORE_PERF_FIXED_CTR_CTRL, FIXED_PMC_CTRL(idx, FIXED_PMC_KERNEL));
 		wrmsr(MSR_CORE_PERF_GLOBAL_CTRL, FIXED_PMC_GLOBAL_CTRL_ENABLE(idx));
+		if (nr_fixed_counters > 1)
+			wrmsr(MSR_CORE_PERF_FIXED_CTR_CTRL,
+			      FIXED_PMC_CTRL(idx, FIXED_PMC_KERNEL) |
+			      FIXED_PMC_CTRL((idx + 1) % nr_fixed_counters, FIXED_PMC_KERNEL));
 		__asm__ __volatile__("loop ." : "+c"((int){NUM_BRANCHES}));
 		wrmsr(MSR_CORE_PERF_GLOBAL_CTRL, 0);
 
-- 
2.54.0.1032.g2f8565e1d1-goog

Re: [PATCH 0/2] KVM: x86/pmu: Fix a fixed PMC event filter bypass bug

[Sean Christopherson]

On Wed, 03 Jun 2026 16:19:03 -0700, Sean Christopherson wrote:
> Fix a bug reported by Sashiko, where KVM will effectively ignore PMU event
> filters for fixed counters if FIXED_CTR_CTRL is changing, but enable bits
> for denied counters are NOT changing.
> 
> Sean Christopherson (2):
>   KVM: x86/pmu: Use hardware value when reprogramming for FIXED_CTR_CTRL
>     changes
>   KVM: selftests: Add regression test for mediated PMU fixed counter
>     filter bug
> 
> [...]

Applied to kvm-x86 misc, thanks!

[1/2] KVM: x86/pmu: Use hardware value when reprogramming for FIXED_CTR_CTRL changes
      https://github.com/kvm-x86/linux/commit/9c6e2463c9f3
[2/2] KVM: selftests: Add regression test for mediated PMU fixed counter filter bug
      https://github.com/kvm-x86/linux/commit/2c725bd2802f

--
https://github.com/kvm-x86/linux/tree/next