[PATCH v3 10/18] KVM: x86/pmu: Document GLOBAL_STATUS_RESET passthrough erratum

[Zide Chen <zide.chen@intel.com>]

IA32_PERF_GLOBAL_STATUS_RESET, introduced in PerfMon version 4,
inherits the MSR address and architecturally defined bits from
IA32_PERF_GLOBAL_OVF_CTRL, while providing additional bits to clear
new indicators in IA32_PERF_GLOBAL_STATUS.

From an emulation perspective, KVM handles it identically to the
OVF_CTRL MSR: reads return zero, and intercepted writes are guarded
against pmu->global_status_rsvd. No code changes are needed in KVM
to emulate this MSR.

However, to reduce VM exits, KVM passes through this MSR in mediated
PMU mode when GLOBAL_STATUS is also passed through. Consequently,
writes to bits that are valid on the host but unvirtualized by KVM
will not trigger a #GP (unlike when the MSR is intercepted). Except
for the known limitation where host Intel PT in system mode can
assert Trace_ToPA_PMI (bit 55), unvirtualized status bits are not set
while the guest is running, so clearing them has no negative effects.

Document this divergence in errata.rst.

Signed-off-by: Zide Chen <zide.chen@intel.com>
---
v3:
- New patch prompted by Jim and Yosry's review on unvirtualized
  status bits.
---
 Documentation/virt/kvm/x86/errata.rst | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/Documentation/virt/kvm/x86/errata.rst b/Documentation/virt/kvm/x86/errata.rst
index a9cf0e004651..161ba6d1beb4 100644
--- a/Documentation/virt/kvm/x86/errata.rst
+++ b/Documentation/virt/kvm/x86/errata.rst
@@ -84,4 +84,12 @@ memory.
 
 Note, this erratum does not affect AMD CPUs, which fully virtualize CR0.CD in
 hardware, i.e. put the CPU caches into "no fill" mode when CR0.CD=1, even when
-running in the guest.
\ No newline at end of file
+running in the guest.
+
+IA32_PERF_GLOBAL_STATUS_RESET
+-----------------------------
+To reduce VM-exits on performance-critical paths, KVM passes through writes
+to IA32_PERF_GLOBAL_STATUS_RESET (0x390) in mediated PMU mode when the guest's
+counters match hardware, without injecting #GP on unvirtualized bits.  Because
+the MSR is read-as-zero and write-to-clear, this cannot leak host information
+to the guest.
-- 
2.56.0