[PATCH v2 0/5] Fix PMU kselftests errors on GNR/SRF/CWF

[PATCH v2 0/5] Fix PMU kselftests errors on GNR/SRF/CWF

[Dapeng Mi]

This patch series fixes KVM PMU kselftests errors encountered on Granite
Rapids (GNR), Sierra Forest (SRF) and Clearwater Forest (CWF).

GNR and SRF starts to support the timed PEBS. Timed PEBS adds a new
"retired latency" field in basic info group to show the timing info and
the PERF_CAPABILITIES[17] called "PEBS_TIMING_INFO" bit is added
to indicated whether timed PEBS is supported. KVM module doesn't need to
do any specific change to support timed PEBS except a perf change adding
PERF_CAP_PEBS_TIMING_INFO flag into PERF_CAP_PEBS_MASK[1]. The patch 2/5
adds timed PEBS support in vmx_pmu_caps_test and fix the error as the
PEBS caps field mismatch.

CWF introduces 5 new architectural events (4 level-1 topdown metrics
events and LBR inserts event). The patch 3/5 adds support for these 5
arch-events and fixes the error that caused by mismatch between HW real
supported arch-events number with NR_INTEL_ARCH_EVENTS.

On Intel Atom platforms, the PMU events "Instruction Retired" or
"Branch Instruction Retired" may be overcounted for some certain
instructions, like FAR CALL/JMP, RETF, IRET, VMENTRY/VMEXIT/VMPTRLD
and complex SGX/SMX/CSTATE instructions/flows[2].

In details, for the Atom platforms before Sierra Forest (including
Sierra Forest), Both 2 events "Instruction Retired" and
"Branch Instruction Retired" would be overcounted on these certain
instructions, but for Clearwater Forest only "Instruction Retired" event
is overcounted on these instructions.

As this overcount issue, pmu_counters_test and pmu_event_filter_test
would fail on the precise event count validation for these 2 events on
Atom platforms.

To work around this Atom platform overcount issue, Patches 4-5/5 looses
the precise count validation separately for pmu_counters_test and
pmu_event_filter_test.

BTW, this patch series doesn't depend on the mediated vPMU support.

Changes:
  * Add error fix for vmx_pmu_caps_test on GNR/SRF (patch 2/5).
  * Opportunistically fix a typo (patch 1/5).

Tests:
  * PMU kselftests (pmu_counters_test/pmu_event_filter_test/
    vmx_pmu_caps_test) passed on Intel SPR/GNR/SRF/CWF platforms.

History:
  * v1: https://lore.kernel.org/all/20250712172522.187414-1-dapeng1.mi@linux.intel.com/

Ref:
  [1] https://lore.kernel.org/all/20250717090302.11316-1-dapeng1.mi@linux.intel.com/
  [2] https://edc.intel.com/content/www/us/en/design/products-and-solutions/processors-and-chipsets/sierra-forest/xeon-6700-series-processor-with-e-cores-specification-update/errata-details

Dapeng Mi (4):
  KVM: x86/pmu: Correct typo "_COUTNERS" to "_COUNTERS"
  KVM: selftests: Add timing_info bit support in vmx_pmu_caps_test
  KVM: Selftests: Validate more arch-events in pmu_counters_test
  KVM: selftests: Relax branches event count check for event_filter test

dongsheng (1):
  KVM: selftests: Relax precise event count validation as overcount
    issue

 arch/x86/include/asm/kvm_host.h               |  8 ++--
 arch/x86/kvm/vmx/pmu_intel.c                  |  6 +--
 tools/testing/selftests/kvm/include/x86/pmu.h | 19 ++++++++
 .../selftests/kvm/include/x86/processor.h     |  7 ++-
 tools/testing/selftests/kvm/lib/x86/pmu.c     | 43 +++++++++++++++++++
 .../selftests/kvm/x86/pmu_counters_test.c     | 39 ++++++++++++++---
 .../selftests/kvm/x86/pmu_event_filter_test.c |  9 +++-
 .../selftests/kvm/x86/vmx_pmu_caps_test.c     |  3 +-
 8 files changed, 117 insertions(+), 17 deletions(-)


base-commit: 772d50d9b87bec08b56ecee0a880d6b2ee5c7da5
-- 
2.34.1

[PATCH v2 1/5] KVM: x86/pmu: Correct typo "_COUTNERS" to "_COUNTERS"

[Dapeng Mi]

Fix typos. "_COUTNERS" -> "_COUNTERS".

Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Tested-by: Yi Lai <yi1.lai@intel.com>
---
 arch/x86/include/asm/kvm_host.h | 8 ++++----
 arch/x86/kvm/vmx/pmu_intel.c    | 6 +++---
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index 46ad65a4d524..0a8010e2859c 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -545,10 +545,10 @@ struct kvm_pmc {
 #define KVM_MAX_NR_GP_COUNTERS		KVM_MAX(KVM_MAX_NR_INTEL_GP_COUNTERS, \
 						KVM_MAX_NR_AMD_GP_COUNTERS)
 
-#define KVM_MAX_NR_INTEL_FIXED_COUTNERS	3
-#define KVM_MAX_NR_AMD_FIXED_COUTNERS	0
-#define KVM_MAX_NR_FIXED_COUNTERS	KVM_MAX(KVM_MAX_NR_INTEL_FIXED_COUTNERS, \
-						KVM_MAX_NR_AMD_FIXED_COUTNERS)
+#define KVM_MAX_NR_INTEL_FIXED_COUNTERS	3
+#define KVM_MAX_NR_AMD_FIXED_COUNTERS	0
+#define KVM_MAX_NR_FIXED_COUNTERS	KVM_MAX(KVM_MAX_NR_INTEL_FIXED_COUNTERS, \
+						KVM_MAX_NR_AMD_FIXED_COUNTERS)
 
 struct kvm_pmu {
 	u8 version;
diff --git a/arch/x86/kvm/vmx/pmu_intel.c b/arch/x86/kvm/vmx/pmu_intel.c
index 0b173602821b..e8b37a38fbba 100644
--- a/arch/x86/kvm/vmx/pmu_intel.c
+++ b/arch/x86/kvm/vmx/pmu_intel.c
@@ -478,8 +478,8 @@ static __always_inline u64 intel_get_fixed_pmc_eventsel(unsigned int index)
 	};
 	u64 eventsel;
 
-	BUILD_BUG_ON(ARRAY_SIZE(fixed_pmc_perf_ids) != KVM_MAX_NR_INTEL_FIXED_COUTNERS);
-	BUILD_BUG_ON(index >= KVM_MAX_NR_INTEL_FIXED_COUTNERS);
+	BUILD_BUG_ON(ARRAY_SIZE(fixed_pmc_perf_ids) != KVM_MAX_NR_INTEL_FIXED_COUNTERS);
+	BUILD_BUG_ON(index >= KVM_MAX_NR_INTEL_FIXED_COUNTERS);
 
 	/*
 	 * Yell if perf reports support for a fixed counter but perf doesn't
@@ -625,7 +625,7 @@ static void intel_pmu_init(struct kvm_vcpu *vcpu)
 		pmu->gp_counters[i].current_config = 0;
 	}
 
-	for (i = 0; i < KVM_MAX_NR_INTEL_FIXED_COUTNERS; i++) {
+	for (i = 0; i < KVM_MAX_NR_INTEL_FIXED_COUNTERS; i++) {
 		pmu->fixed_counters[i].type = KVM_PMC_FIXED;
 		pmu->fixed_counters[i].vcpu = vcpu;
 		pmu->fixed_counters[i].idx = i + KVM_FIXED_PMC_BASE_IDX;
-- 
2.34.1

[PATCH v2 2/5] KVM: selftests: Add timing_info bit support in vmx_pmu_caps_test

[Dapeng Mi]

A new bit PERF_CAPABILITIES[17] called "PEBS_TIMING_INFO" bit is added
to indicated if PEBS supports to record timing information in a new
"Retried Latency" field.

Since KVM requires user can only set host consistent PEBS capabilities,
otherwise the PERF_CAPABILITIES setting would fail, so add
pebs_timing_info bit into "immutable_caps" to block host inconsistent
PEBS configuration and cause errors.

Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Tested-by: Yi Lai <yi1.lai@intel.com>
---
 tools/testing/selftests/kvm/x86/vmx_pmu_caps_test.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tools/testing/selftests/kvm/x86/vmx_pmu_caps_test.c b/tools/testing/selftests/kvm/x86/vmx_pmu_caps_test.c
index a1f5ff45d518..f8deea220156 100644
--- a/tools/testing/selftests/kvm/x86/vmx_pmu_caps_test.c
+++ b/tools/testing/selftests/kvm/x86/vmx_pmu_caps_test.c
@@ -29,7 +29,7 @@ static union perf_capabilities {
 		u64 pebs_baseline:1;
 		u64	perf_metrics:1;
 		u64	pebs_output_pt_available:1;
-		u64	anythread_deprecated:1;
+		u64	pebs_timing_info:1;
 	};
 	u64	capabilities;
 } host_cap;
@@ -44,6 +44,7 @@ static const union perf_capabilities immutable_caps = {
 	.pebs_arch_reg = 1,
 	.pebs_format = -1,
 	.pebs_baseline = 1,
+	.pebs_timing_info = 1,
 };
 
 static const union perf_capabilities format_caps = {
-- 
2.34.1

Re: [PATCH v2 2/5] KVM: selftests: Add timing_info bit support in vmx_pmu_caps_test

[Sean Christopherson]

On Fri, Jul 18, 2025, Dapeng Mi wrote:
> A new bit PERF_CAPABILITIES[17] called "PEBS_TIMING_INFO" bit is added
> to indicated if PEBS supports to record timing information in a new
> "Retried Latency" field.
> 
> Since KVM requires user can only set host consistent PEBS capabilities,
> otherwise the PERF_CAPABILITIES setting would fail, so add
> pebs_timing_info bit into "immutable_caps" to block host inconsistent
> PEBS configuration and cause errors.

Please explain the removal of anythread_deprecated.  AFAICT, something like this
is accurate:

Opportunistically drop the anythread_deprecated bit.  It isn't and likely
never was a PERF_CAPABILITIES flag, the test's definition snuck in when
the union was copy+pasted from the kernel's definition.

> Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
> Tested-by: Yi Lai <yi1.lai@intel.com>
> ---
>  tools/testing/selftests/kvm/x86/vmx_pmu_caps_test.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/tools/testing/selftests/kvm/x86/vmx_pmu_caps_test.c b/tools/testing/selftests/kvm/x86/vmx_pmu_caps_test.c
> index a1f5ff45d518..f8deea220156 100644
> --- a/tools/testing/selftests/kvm/x86/vmx_pmu_caps_test.c
> +++ b/tools/testing/selftests/kvm/x86/vmx_pmu_caps_test.c
> @@ -29,7 +29,7 @@ static union perf_capabilities {
>  		u64 pebs_baseline:1;
>  		u64	perf_metrics:1;
>  		u64	pebs_output_pt_available:1;
> -		u64	anythread_deprecated:1;
> +		u64	pebs_timing_info:1;
>  	};
>  	u64	capabilities;
>  } host_cap;
> @@ -44,6 +44,7 @@ static const union perf_capabilities immutable_caps = {
>  	.pebs_arch_reg = 1,
>  	.pebs_format = -1,
>  	.pebs_baseline = 1,
> +	.pebs_timing_info = 1,
>  };
>  
>  static const union perf_capabilities format_caps = {
> -- 
> 2.34.1
> 

Re: [PATCH v2 2/5] KVM: selftests: Add timing_info bit support in vmx_pmu_caps_test

[Mi, Dapeng]

On 9/11/2025 6:03 AM, Sean Christopherson wrote:
> On Fri, Jul 18, 2025, Dapeng Mi wrote:
>> A new bit PERF_CAPABILITIES[17] called "PEBS_TIMING_INFO" bit is added
>> to indicated if PEBS supports to record timing information in a new
>> "Retried Latency" field.
>>
>> Since KVM requires user can only set host consistent PEBS capabilities,
>> otherwise the PERF_CAPABILITIES setting would fail, so add
>> pebs_timing_info bit into "immutable_caps" to block host inconsistent
>> PEBS configuration and cause errors.
> Please explain the removal of anythread_deprecated.  AFAICT, something like this
> is accurate:
>
> Opportunistically drop the anythread_deprecated bit.  It isn't and likely
> never was a PERF_CAPABILITIES flag, the test's definition snuck in when
> the union was copy+pasted from the kernel's definition.

Yes, would add this in next version. Thanks.


>
>> Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
>> Tested-by: Yi Lai <yi1.lai@intel.com>
>> ---
>>  tools/testing/selftests/kvm/x86/vmx_pmu_caps_test.c | 3 ++-
>>  1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/tools/testing/selftests/kvm/x86/vmx_pmu_caps_test.c b/tools/testing/selftests/kvm/x86/vmx_pmu_caps_test.c
>> index a1f5ff45d518..f8deea220156 100644
>> --- a/tools/testing/selftests/kvm/x86/vmx_pmu_caps_test.c
>> +++ b/tools/testing/selftests/kvm/x86/vmx_pmu_caps_test.c
>> @@ -29,7 +29,7 @@ static union perf_capabilities {
>>  		u64 pebs_baseline:1;
>>  		u64	perf_metrics:1;
>>  		u64	pebs_output_pt_available:1;
>> -		u64	anythread_deprecated:1;
>> +		u64	pebs_timing_info:1;
>>  	};
>>  	u64	capabilities;
>>  } host_cap;
>> @@ -44,6 +44,7 @@ static const union perf_capabilities immutable_caps = {
>>  	.pebs_arch_reg = 1,
>>  	.pebs_format = -1,
>>  	.pebs_baseline = 1,
>> +	.pebs_timing_info = 1,
>>  };
>>  
>>  static const union perf_capabilities format_caps = {
>> -- 
>> 2.34.1
>>

[PATCH v2 3/5] KVM: Selftests: Validate more arch-events in pmu_counters_test

[Dapeng Mi]

Clearwater Forest introduces 5 new architectural events (4 topdown
level 1 metrics events and LBR inserts event). This patch supports
to validate these 5 newly added events. The detailed info about these
5 events can be found in SDM section 21.2.7 "Pre-defined Architectural
 Performance Events".

It becomes unrealistic to traverse all possible combinations of
unavailable events mask (may need dozens of minutes to finish all
possible combination validation). So only limit unavailable events mask
traverse to the first 8 arch-events.

Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Tested-by: Yi Lai <yi1.lai@intel.com>
---
 tools/testing/selftests/kvm/include/x86/pmu.h | 10 +++++++++
 .../selftests/kvm/include/x86/processor.h     |  7 +++++-
 tools/testing/selftests/kvm/lib/x86/pmu.c     |  5 +++++
 .../selftests/kvm/x86/pmu_counters_test.c     | 22 ++++++++++++++-----
 4 files changed, 38 insertions(+), 6 deletions(-)

diff --git a/tools/testing/selftests/kvm/include/x86/pmu.h b/tools/testing/selftests/kvm/include/x86/pmu.h
index 3c10c4dc0ae8..2aabda2da002 100644
--- a/tools/testing/selftests/kvm/include/x86/pmu.h
+++ b/tools/testing/selftests/kvm/include/x86/pmu.h
@@ -61,6 +61,11 @@
 #define	INTEL_ARCH_BRANCHES_RETIRED		RAW_EVENT(0xc4, 0x00)
 #define	INTEL_ARCH_BRANCHES_MISPREDICTED	RAW_EVENT(0xc5, 0x00)
 #define	INTEL_ARCH_TOPDOWN_SLOTS		RAW_EVENT(0xa4, 0x01)
+#define	INTEL_ARCH_TOPDOWN_BE_BOUND		RAW_EVENT(0xa4, 0x02)
+#define	INTEL_ARCH_TOPDOWN_BAD_SPEC		RAW_EVENT(0x73, 0x00)
+#define	INTEL_ARCH_TOPDOWN_FE_BOUND		RAW_EVENT(0x9c, 0x01)
+#define	INTEL_ARCH_TOPDOWN_RETIRING		RAW_EVENT(0xc2, 0x02)
+#define	INTEL_ARCH_LBR_INSERTS			RAW_EVENT(0xe4, 0x01)
 
 #define	AMD_ZEN_CORE_CYCLES			RAW_EVENT(0x76, 0x00)
 #define	AMD_ZEN_INSTRUCTIONS_RETIRED		RAW_EVENT(0xc0, 0x00)
@@ -80,6 +85,11 @@ enum intel_pmu_architectural_events {
 	INTEL_ARCH_BRANCHES_RETIRED_INDEX,
 	INTEL_ARCH_BRANCHES_MISPREDICTED_INDEX,
 	INTEL_ARCH_TOPDOWN_SLOTS_INDEX,
+	INTEL_ARCH_TOPDOWN_BE_BOUND_INDEX,
+	INTEL_ARCH_TOPDOWN_BAD_SPEC_INDEX,
+	INTEL_ARCH_TOPDOWN_FE_BOUND_INDEX,
+	INTEL_ARCH_TOPDOWN_RETIRING_INDEX,
+	INTEL_ARCH_LBR_INSERTS_INDEX,
 	NR_INTEL_ARCH_EVENTS,
 };
 
diff --git a/tools/testing/selftests/kvm/include/x86/processor.h b/tools/testing/selftests/kvm/include/x86/processor.h
index 2efb05c2f2fb..232964f2a687 100644
--- a/tools/testing/selftests/kvm/include/x86/processor.h
+++ b/tools/testing/selftests/kvm/include/x86/processor.h
@@ -265,7 +265,7 @@ struct kvm_x86_cpu_property {
 #define X86_PROPERTY_PMU_NR_GP_COUNTERS		KVM_X86_CPU_PROPERTY(0xa, 0, EAX, 8, 15)
 #define X86_PROPERTY_PMU_GP_COUNTERS_BIT_WIDTH	KVM_X86_CPU_PROPERTY(0xa, 0, EAX, 16, 23)
 #define X86_PROPERTY_PMU_EBX_BIT_VECTOR_LENGTH	KVM_X86_CPU_PROPERTY(0xa, 0, EAX, 24, 31)
-#define X86_PROPERTY_PMU_EVENTS_MASK		KVM_X86_CPU_PROPERTY(0xa, 0, EBX, 0, 7)
+#define X86_PROPERTY_PMU_EVENTS_MASK		KVM_X86_CPU_PROPERTY(0xa, 0, EBX, 0, 12)
 #define X86_PROPERTY_PMU_FIXED_COUNTERS_BITMASK	KVM_X86_CPU_PROPERTY(0xa, 0, ECX, 0, 31)
 #define X86_PROPERTY_PMU_NR_FIXED_COUNTERS	KVM_X86_CPU_PROPERTY(0xa, 0, EDX, 0, 4)
 #define X86_PROPERTY_PMU_FIXED_COUNTERS_BIT_WIDTH	KVM_X86_CPU_PROPERTY(0xa, 0, EDX, 5, 12)
@@ -332,6 +332,11 @@ struct kvm_x86_pmu_feature {
 #define X86_PMU_FEATURE_BRANCH_INSNS_RETIRED		KVM_X86_PMU_FEATURE(EBX, 5)
 #define X86_PMU_FEATURE_BRANCHES_MISPREDICTED		KVM_X86_PMU_FEATURE(EBX, 6)
 #define X86_PMU_FEATURE_TOPDOWN_SLOTS			KVM_X86_PMU_FEATURE(EBX, 7)
+#define X86_PMU_FEATURE_TOPDOWN_BE_BOUND		KVM_X86_PMU_FEATURE(EBX, 8)
+#define X86_PMU_FEATURE_TOPDOWN_BAD_SPEC		KVM_X86_PMU_FEATURE(EBX, 9)
+#define X86_PMU_FEATURE_TOPDOWN_FE_BOUND		KVM_X86_PMU_FEATURE(EBX, 10)
+#define X86_PMU_FEATURE_TOPDOWN_RETIRING		KVM_X86_PMU_FEATURE(EBX, 11)
+#define X86_PMU_FEATURE_LBR_INSERTS			KVM_X86_PMU_FEATURE(EBX, 12)
 
 #define X86_PMU_FEATURE_INSNS_RETIRED_FIXED		KVM_X86_PMU_FEATURE(ECX, 0)
 #define X86_PMU_FEATURE_CPU_CYCLES_FIXED		KVM_X86_PMU_FEATURE(ECX, 1)
diff --git a/tools/testing/selftests/kvm/lib/x86/pmu.c b/tools/testing/selftests/kvm/lib/x86/pmu.c
index f31f0427c17c..5ab44bf54773 100644
--- a/tools/testing/selftests/kvm/lib/x86/pmu.c
+++ b/tools/testing/selftests/kvm/lib/x86/pmu.c
@@ -19,6 +19,11 @@ const uint64_t intel_pmu_arch_events[] = {
 	INTEL_ARCH_BRANCHES_RETIRED,
 	INTEL_ARCH_BRANCHES_MISPREDICTED,
 	INTEL_ARCH_TOPDOWN_SLOTS,
+	INTEL_ARCH_TOPDOWN_BE_BOUND,
+	INTEL_ARCH_TOPDOWN_BAD_SPEC,
+	INTEL_ARCH_TOPDOWN_FE_BOUND,
+	INTEL_ARCH_TOPDOWN_RETIRING,
+	INTEL_ARCH_LBR_INSERTS,
 };
 kvm_static_assert(ARRAY_SIZE(intel_pmu_arch_events) == NR_INTEL_ARCH_EVENTS);
 
diff --git a/tools/testing/selftests/kvm/x86/pmu_counters_test.c b/tools/testing/selftests/kvm/x86/pmu_counters_test.c
index 8aaaf25b6111..342a72420177 100644
--- a/tools/testing/selftests/kvm/x86/pmu_counters_test.c
+++ b/tools/testing/selftests/kvm/x86/pmu_counters_test.c
@@ -75,6 +75,11 @@ static struct kvm_intel_pmu_event intel_event_to_feature(uint8_t idx)
 		[INTEL_ARCH_BRANCHES_RETIRED_INDEX]	 = { X86_PMU_FEATURE_BRANCH_INSNS_RETIRED, X86_PMU_FEATURE_NULL },
 		[INTEL_ARCH_BRANCHES_MISPREDICTED_INDEX] = { X86_PMU_FEATURE_BRANCHES_MISPREDICTED, X86_PMU_FEATURE_NULL },
 		[INTEL_ARCH_TOPDOWN_SLOTS_INDEX]	 = { X86_PMU_FEATURE_TOPDOWN_SLOTS, X86_PMU_FEATURE_TOPDOWN_SLOTS_FIXED },
+		[INTEL_ARCH_TOPDOWN_BE_BOUND_INDEX]	 = { X86_PMU_FEATURE_TOPDOWN_BE_BOUND, X86_PMU_FEATURE_NULL },
+		[INTEL_ARCH_TOPDOWN_BAD_SPEC_INDEX]	 = { X86_PMU_FEATURE_TOPDOWN_BAD_SPEC, X86_PMU_FEATURE_NULL },
+		[INTEL_ARCH_TOPDOWN_FE_BOUND_INDEX]	 = { X86_PMU_FEATURE_TOPDOWN_FE_BOUND, X86_PMU_FEATURE_NULL },
+		[INTEL_ARCH_TOPDOWN_RETIRING_INDEX]	 = { X86_PMU_FEATURE_TOPDOWN_RETIRING, X86_PMU_FEATURE_NULL },
+		[INTEL_ARCH_LBR_INSERTS_INDEX]		 = { X86_PMU_FEATURE_LBR_INSERTS, X86_PMU_FEATURE_NULL },
 	};
 
 	kvm_static_assert(ARRAY_SIZE(__intel_event_to_feature) == NR_INTEL_ARCH_EVENTS);
@@ -171,9 +176,12 @@ static void guest_assert_event_count(uint8_t idx, uint32_t pmc, uint32_t pmc_msr
 		fallthrough;
 	case INTEL_ARCH_CPU_CYCLES_INDEX:
 	case INTEL_ARCH_REFERENCE_CYCLES_INDEX:
+	case INTEL_ARCH_TOPDOWN_BE_BOUND_INDEX:
+	case INTEL_ARCH_TOPDOWN_FE_BOUND_INDEX:
 		GUEST_ASSERT_NE(count, 0);
 		break;
 	case INTEL_ARCH_TOPDOWN_SLOTS_INDEX:
+	case INTEL_ARCH_TOPDOWN_RETIRING_INDEX:
 		__GUEST_ASSERT(count >= NUM_INSNS_RETIRED,
 			       "Expected top-down slots >= %u, got count = %lu",
 			       NUM_INSNS_RETIRED, count);
@@ -612,15 +620,19 @@ static void test_intel_counters(void)
 			pr_info("Testing arch events, PMU version %u, perf_caps = %lx\n",
 				v, perf_caps[i]);
 			/*
-			 * To keep the total runtime reasonable, test every
-			 * possible non-zero, non-reserved bitmap combination
-			 * only with the native PMU version and the full bit
-			 * vector length.
+			 * To keep the total runtime reasonable, especially after
+			 * the total number of arch-events increasing to 13, It's
+			 * impossible to test every possible non-zero, non-reserved
+			 * bitmap combination. Only test the first 8-bits combination
+			 * with the native PMU version and the full bit vector length.
 			 */
 			if (v == pmu_version) {
-				for (k = 1; k < (BIT(NR_INTEL_ARCH_EVENTS) - 1); k++)
+				int max_events = min(NR_INTEL_ARCH_EVENTS, 8);
+
+				for (k = 1; k < (BIT(max_events) - 1); k++)
 					test_arch_events(v, perf_caps[i], NR_INTEL_ARCH_EVENTS, k);
 			}
+
 			/*
 			 * Test single bits for all PMU version and lengths up
 			 * the number of events +1 (to verify KVM doesn't do
-- 
2.34.1

Re: [PATCH v2 3/5] KVM: Selftests: Validate more arch-events in pmu_counters_test

[Sean Christopherson]

On Fri, Jul 18, 2025, Dapeng Mi wrote:
> Clearwater Forest introduces 5 new architectural events (4 topdown
> level 1 metrics events and LBR inserts event). This patch supports
> to validate these 5 newly added events. The detailed info about these
> 5 events can be found in SDM section 21.2.7 "Pre-defined Architectural
>  Performance Events".
> 
> It becomes unrealistic to traverse all possible combinations of
> unavailable events mask (may need dozens of minutes to finish all
> possible combination validation). So only limit unavailable events mask
> traverse to the first 8 arch-events.

Split these into separate patches.  Buring a meaningful change like this in a big
patch that seemingly just adds architectural collateral is pure evil.
> @@ -612,15 +620,19 @@ static void test_intel_counters(void)
>  			pr_info("Testing arch events, PMU version %u, perf_caps = %lx\n",
>  				v, perf_caps[i]);
>  			/*
> -			 * To keep the total runtime reasonable, test every
> -			 * possible non-zero, non-reserved bitmap combination
> -			 * only with the native PMU version and the full bit
> -			 * vector length.
> +			 * To keep the total runtime reasonable, especially after
> +			 * the total number of arch-events increasing to 13, It's
> +			 * impossible to test every possible non-zero, non-reserved
> +			 * bitmap combination. Only test the first 8-bits combination
> +			 * with the native PMU version and the full bit vector length.
>  			 */
>  			if (v == pmu_version) {
> -				for (k = 1; k < (BIT(NR_INTEL_ARCH_EVENTS) - 1); k++)
> +				int max_events = min(NR_INTEL_ARCH_EVENTS, 8);

Too arbitrary, and worse, bad coverage.  And honestly, even iterating over 255
(or 512?) different values is a waste of time.  Ha!  And test_arch_events() is
buggy, it takes unavailable_mask as u8 instead of a u32.  I'll slot in a patch
to fix that.

As for the runtime, I think it's time to throw in the towel in terms of brute
forcing the validation space, and just test a handful of hopefully-interesting
values, e.g.

---
 .../selftests/kvm/x86/pmu_counters_test.c     | 38 +++++++++++--------
 1 file changed, 23 insertions(+), 15 deletions(-)

diff --git a/tools/testing/selftests/kvm/x86/pmu_counters_test.c b/tools/testing/selftests/kvm/x86/pmu_counters_test.c
index cfeed0103341..09ad68675576 100644
--- a/tools/testing/selftests/kvm/x86/pmu_counters_test.c
+++ b/tools/testing/selftests/kvm/x86/pmu_counters_test.c
@@ -577,6 +577,26 @@ static void test_intel_counters(void)
 		PMU_CAP_FW_WRITES,
 	};
 
+	/*
+	 * To keep the total runtime reasonable, test only a handful of select,
+	 * semi-arbitrary values for the mask of unavailable PMU events.  Test
+	 * 0 (all events available) and all ones (no events available) as well
+	 * as alternating bit sequencues, e.g. to detect if KVM is checking the
+	 * wrong bit(s).
+	 */
+	const uint32_t unavailable_masks[] = {
+		0x0,
+		0xffffffffu,
+		0xf0f0f0f0u,
+		0x0f0f0f0fu,
+		0xaaaaaaaau,
+		0xa0a0a0a0u,
+		0x0a0a0a0au,
+		0x55555555u,
+		0x50505050u,
+		0x05050505u,
+	};
+
 	/*
 	 * Test up to PMU v5, which is the current maximum version defined by
 	 * Intel, i.e. is the last version that is guaranteed to be backwards
@@ -614,16 +634,7 @@ static void test_intel_counters(void)
 
 			pr_info("Testing arch events, PMU version %u, perf_caps = %lx\n",
 				v, perf_caps[i]);
-			/*
-			 * To keep the total runtime reasonable, test every
-			 * possible non-zero, non-reserved bitmap combination
-			 * only with the native PMU version and the full bit
-			 * vector length.
-			 */
-			if (v == pmu_version) {
-				for (k = 1; k < (BIT(NR_INTEL_ARCH_EVENTS) - 1); k++)
-					test_arch_events(v, perf_caps[i], NR_INTEL_ARCH_EVENTS, k);
-			}
+
 			/*
 			 * Test single bits for all PMU version and lengths up
 			 * the number of events +1 (to verify KVM doesn't do
@@ -632,11 +643,8 @@ static void test_intel_counters(void)
 			 * ones i.e. all events being available and unavailable.
 			 */
 			for (j = 0; j <= NR_INTEL_ARCH_EVENTS + 1; j++) {
-				test_arch_events(v, perf_caps[i], j, 0);
-				test_arch_events(v, perf_caps[i], j, -1u);
-
-				for (k = 0; k < NR_INTEL_ARCH_EVENTS; k++)
-					test_arch_events(v, perf_caps[i], j, BIT(k));
+				for (k = 1; k < ARRAY_SIZE(unavailable_masks); k++)
+					test_arch_events(v, perf_caps[i], j, unavailable_masks[k]);
 			}
 
 			pr_info("Testing GP counters, PMU version %u, perf_caps = %lx\n",
-- 

Re: [PATCH v2 3/5] KVM: Selftests: Validate more arch-events in pmu_counters_test

[Mi, Dapeng]

On 9/11/2025 7:51 AM, Sean Christopherson wrote:
> On Fri, Jul 18, 2025, Dapeng Mi wrote:
>> Clearwater Forest introduces 5 new architectural events (4 topdown
>> level 1 metrics events and LBR inserts event). This patch supports
>> to validate these 5 newly added events. The detailed info about these
>> 5 events can be found in SDM section 21.2.7 "Pre-defined Architectural
>>  Performance Events".
>>
>> It becomes unrealistic to traverse all possible combinations of
>> unavailable events mask (may need dozens of minutes to finish all
>> possible combination validation). So only limit unavailable events mask
>> traverse to the first 8 arch-events.
> Split these into separate patches.  Buring a meaningful change like this in a big
> patch that seemingly just adds architectural collateral is pure evil.
>> @@ -612,15 +620,19 @@ static void test_intel_counters(void)
>>  			pr_info("Testing arch events, PMU version %u, perf_caps = %lx\n",
>>  				v, perf_caps[i]);
>>  			/*
>> -			 * To keep the total runtime reasonable, test every
>> -			 * possible non-zero, non-reserved bitmap combination
>> -			 * only with the native PMU version and the full bit
>> -			 * vector length.
>> +			 * To keep the total runtime reasonable, especially after
>> +			 * the total number of arch-events increasing to 13, It's
>> +			 * impossible to test every possible non-zero, non-reserved
>> +			 * bitmap combination. Only test the first 8-bits combination
>> +			 * with the native PMU version and the full bit vector length.
>>  			 */
>>  			if (v == pmu_version) {
>> -				for (k = 1; k < (BIT(NR_INTEL_ARCH_EVENTS) - 1); k++)
>> +				int max_events = min(NR_INTEL_ARCH_EVENTS, 8);
> Too arbitrary, and worse, bad coverage.  And honestly, even iterating over 255
> (or 512?) different values is a waste of time.  Ha!  And test_arch_events() is
> buggy, it takes unavailable_mask as u8 instead of a u32.  I'll slot in a patch
> to fix that.
>
> As for the runtime, I think it's time to throw in the towel in terms of brute
> forcing the validation space, and just test a handful of hopefully-interesting
> values, e.g.
>
> ---
>  .../selftests/kvm/x86/pmu_counters_test.c     | 38 +++++++++++--------
>  1 file changed, 23 insertions(+), 15 deletions(-)
>
> diff --git a/tools/testing/selftests/kvm/x86/pmu_counters_test.c b/tools/testing/selftests/kvm/x86/pmu_counters_test.c
> index cfeed0103341..09ad68675576 100644
> --- a/tools/testing/selftests/kvm/x86/pmu_counters_test.c
> +++ b/tools/testing/selftests/kvm/x86/pmu_counters_test.c
> @@ -577,6 +577,26 @@ static void test_intel_counters(void)
>  		PMU_CAP_FW_WRITES,
>  	};
>  
> +	/*
> +	 * To keep the total runtime reasonable, test only a handful of select,
> +	 * semi-arbitrary values for the mask of unavailable PMU events.  Test
> +	 * 0 (all events available) and all ones (no events available) as well
> +	 * as alternating bit sequencues, e.g. to detect if KVM is checking the
> +	 * wrong bit(s).
> +	 */
> +	const uint32_t unavailable_masks[] = {
> +		0x0,
> +		0xffffffffu,
> +		0xf0f0f0f0u,
> +		0x0f0f0f0fu,
> +		0xaaaaaaaau,
> +		0xa0a0a0a0u,
> +		0x0a0a0a0au,
> +		0x55555555u,
> +		0x50505050u,
> +		0x05050505u,
> +	};

Looks good to me. Just a minor suggestion, better to move 0x55555555u
closely before and after 0xaaaaaaaau since they are the 2 complementary
items. This makes the sequences more easily understood. Thanks.


> +
>  	/*
>  	 * Test up to PMU v5, which is the current maximum version defined by
>  	 * Intel, i.e. is the last version that is guaranteed to be backwards
> @@ -614,16 +634,7 @@ static void test_intel_counters(void)
>  
>  			pr_info("Testing arch events, PMU version %u, perf_caps = %lx\n",
>  				v, perf_caps[i]);
> -			/*
> -			 * To keep the total runtime reasonable, test every
> -			 * possible non-zero, non-reserved bitmap combination
> -			 * only with the native PMU version and the full bit
> -			 * vector length.
> -			 */
> -			if (v == pmu_version) {
> -				for (k = 1; k < (BIT(NR_INTEL_ARCH_EVENTS) - 1); k++)
> -					test_arch_events(v, perf_caps[i], NR_INTEL_ARCH_EVENTS, k);
> -			}
> +
>  			/*
>  			 * Test single bits for all PMU version and lengths up
>  			 * the number of events +1 (to verify KVM doesn't do
> @@ -632,11 +643,8 @@ static void test_intel_counters(void)
>  			 * ones i.e. all events being available and unavailable.
>  			 */
>  			for (j = 0; j <= NR_INTEL_ARCH_EVENTS + 1; j++) {
> -				test_arch_events(v, perf_caps[i], j, 0);
> -				test_arch_events(v, perf_caps[i], j, -1u);
> -
> -				for (k = 0; k < NR_INTEL_ARCH_EVENTS; k++)
> -					test_arch_events(v, perf_caps[i], j, BIT(k));
> +				for (k = 1; k < ARRAY_SIZE(unavailable_masks); k++)
> +					test_arch_events(v, perf_caps[i], j, unavailable_masks[k]);
>  			}
>  
>  			pr_info("Testing GP counters, PMU version %u, perf_caps = %lx\n",

[PATCH v2 4/5] KVM: selftests: Relax precise event count validation as overcount issue

[Dapeng Mi]

From: dongsheng <dongsheng.x.zhang@intel.com>

For Intel Atom CPUs, the PMU events "Instruction Retired" or
"Branch Instruction Retired" may be overcounted for some certain
instructions, like FAR CALL/JMP, RETF, IRET, VMENTRY/VMEXIT/VMPTRLD
and complex SGX/SMX/CSTATE instructions/flows.

The detailed information can be found in the errata (section SRF7):
https://edc.intel.com/content/www/us/en/design/products-and-solutions/processors-and-chipsets/sierra-forest/xeon-6700-series-processor-with-e-cores-specification-update/errata-details/

For the Atom platforms before Sierra Forest (including Sierra Forest),
Both 2 events "Instruction Retired" and "Branch Instruction Retired" would
be overcounted on these certain instructions, but for Clearwater Forest
only "Instruction Retired" event is overcounted on these instructions.

As the overcount issue on VM-Exit/VM-Entry, it has no way to validate
the precise count for these 2 events on these affected Atom platforms,
so just relax the precise event count check for these 2 events on these
Atom platforms.

Signed-off-by: dongsheng <dongsheng.x.zhang@intel.com>
Co-developed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Tested-by: Yi Lai <yi1.lai@intel.com>
---
 tools/testing/selftests/kvm/include/x86/pmu.h |  9 +++++
 tools/testing/selftests/kvm/lib/x86/pmu.c     | 38 +++++++++++++++++++
 .../selftests/kvm/x86/pmu_counters_test.c     | 17 ++++++++-
 3 files changed, 62 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/kvm/include/x86/pmu.h b/tools/testing/selftests/kvm/include/x86/pmu.h
index 2aabda2da002..db14c08abc59 100644
--- a/tools/testing/selftests/kvm/include/x86/pmu.h
+++ b/tools/testing/selftests/kvm/include/x86/pmu.h
@@ -104,4 +104,13 @@ enum amd_pmu_zen_events {
 extern const uint64_t intel_pmu_arch_events[];
 extern const uint64_t amd_pmu_zen_events[];
 
+/*
+ * Flags for "Instruction Retired" and "Branch Instruction Retired"
+ * overcount flaws.
+ */
+#define INST_RETIRED_OVERCOUNT BIT(0)
+#define BR_RETIRED_OVERCOUNT   BIT(1)
+
+extern uint32_t detect_inst_overcount_flags(void);
+
 #endif /* SELFTEST_KVM_PMU_H */
diff --git a/tools/testing/selftests/kvm/lib/x86/pmu.c b/tools/testing/selftests/kvm/lib/x86/pmu.c
index 5ab44bf54773..fd4ed577c88f 100644
--- a/tools/testing/selftests/kvm/lib/x86/pmu.c
+++ b/tools/testing/selftests/kvm/lib/x86/pmu.c
@@ -8,6 +8,7 @@
 #include <linux/kernel.h>
 
 #include "kvm_util.h"
+#include "processor.h"
 #include "pmu.h"
 
 const uint64_t intel_pmu_arch_events[] = {
@@ -34,3 +35,40 @@ const uint64_t amd_pmu_zen_events[] = {
 	AMD_ZEN_BRANCHES_MISPREDICTED,
 };
 kvm_static_assert(ARRAY_SIZE(amd_pmu_zen_events) == NR_AMD_ZEN_EVENTS);
+
+/*
+ * For Intel Atom CPUs, the PMU events "Instruction Retired" or
+ * "Branch Instruction Retired" may be overcounted for some certain
+ * instructions, like FAR CALL/JMP, RETF, IRET, VMENTRY/VMEXIT/VMPTRLD
+ * and complex SGX/SMX/CSTATE instructions/flows.
+ *
+ * The detailed information can be found in the errata (section SRF7):
+ * https://edc.intel.com/content/www/us/en/design/products-and-solutions/processors-and-chipsets/sierra-forest/xeon-6700-series-processor-with-e-cores-specification-update/errata-details/
+ *
+ * For the Atom platforms before Sierra Forest (including Sierra Forest),
+ * Both 2 events "Instruction Retired" and "Branch Instruction Retired" would
+ * be overcounted on these certain instructions, but for Clearwater Forest
+ * only "Instruction Retired" event is overcounted on these instructions.
+ */
+uint32_t detect_inst_overcount_flags(void)
+{
+	uint32_t eax, ebx, ecx, edx;
+	uint32_t flags = 0;
+
+	cpuid(1, &eax, &ebx, &ecx, &edx);
+	if (x86_family(eax) == 0x6) {
+		switch (x86_model(eax)) {
+		case 0xDD: /* Clearwater Forest */
+			flags = INST_RETIRED_OVERCOUNT;
+			break;
+		case 0xAF: /* Sierra Forest */
+		case 0x4D: /* Avaton, Rangely */
+		case 0x5F: /* Denverton */
+		case 0x86: /* Jacobsville */
+			flags = INST_RETIRED_OVERCOUNT | BR_RETIRED_OVERCOUNT;
+			break;
+		}
+	}
+
+	return flags;
+}
diff --git a/tools/testing/selftests/kvm/x86/pmu_counters_test.c b/tools/testing/selftests/kvm/x86/pmu_counters_test.c
index 342a72420177..074cdf323406 100644
--- a/tools/testing/selftests/kvm/x86/pmu_counters_test.c
+++ b/tools/testing/selftests/kvm/x86/pmu_counters_test.c
@@ -52,6 +52,9 @@ struct kvm_intel_pmu_event {
 	struct kvm_x86_pmu_feature fixed_event;
 };
 
+
+static uint8_t inst_overcount_flags;
+
 /*
  * Wrap the array to appease the compiler, as the macros used to construct each
  * kvm_x86_pmu_feature use syntax that's only valid in function scope, and the
@@ -163,10 +166,18 @@ static void guest_assert_event_count(uint8_t idx, uint32_t pmc, uint32_t pmc_msr
 
 	switch (idx) {
 	case INTEL_ARCH_INSTRUCTIONS_RETIRED_INDEX:
-		GUEST_ASSERT_EQ(count, NUM_INSNS_RETIRED);
+		/* Relax precise count check due to VM-EXIT/VM-ENTRY overcount issue */
+		if (inst_overcount_flags & INST_RETIRED_OVERCOUNT)
+			GUEST_ASSERT(count >= NUM_INSNS_RETIRED);
+		else
+			GUEST_ASSERT_EQ(count, NUM_INSNS_RETIRED);
 		break;
 	case INTEL_ARCH_BRANCHES_RETIRED_INDEX:
-		GUEST_ASSERT_EQ(count, NUM_BRANCH_INSNS_RETIRED);
+		/* Relax precise count check due to VM-EXIT/VM-ENTRY overcount issue */
+		if (inst_overcount_flags & BR_RETIRED_OVERCOUNT)
+			GUEST_ASSERT(count >= NUM_BRANCH_INSNS_RETIRED);
+		else
+			GUEST_ASSERT_EQ(count, NUM_BRANCH_INSNS_RETIRED);
 		break;
 	case INTEL_ARCH_LLC_REFERENCES_INDEX:
 	case INTEL_ARCH_LLC_MISSES_INDEX:
@@ -335,6 +346,7 @@ static void test_arch_events(uint8_t pmu_version, uint64_t perf_capabilities,
 				length);
 	vcpu_set_cpuid_property(vcpu, X86_PROPERTY_PMU_EVENTS_MASK,
 				unavailable_mask);
+	sync_global_to_guest(vm, inst_overcount_flags);
 
 	run_vcpu(vcpu);
 
@@ -673,6 +685,7 @@ int main(int argc, char *argv[])
 
 	kvm_pmu_version = kvm_cpu_property(X86_PROPERTY_PMU_VERSION);
 	kvm_has_perf_caps = kvm_cpu_has(X86_FEATURE_PDCM);
+	inst_overcount_flags = detect_inst_overcount_flags();
 
 	test_intel_counters();
 
-- 
2.34.1

Re: [PATCH v2 4/5] KVM: selftests: Relax precise event count validation as overcount issue

[Sean Christopherson]

On Fri, Jul 18, 2025, Dapeng Mi wrote:
> From: dongsheng <dongsheng.x.zhang@intel.com>
> 
> For Intel Atom CPUs, the PMU events "Instruction Retired" or
> "Branch Instruction Retired" may be overcounted for some certain
> instructions, like FAR CALL/JMP, RETF, IRET, VMENTRY/VMEXIT/VMPTRLD
> and complex SGX/SMX/CSTATE instructions/flows.
> 
> The detailed information can be found in the errata (section SRF7):
> https://edc.intel.com/content/www/us/en/design/products-and-solutions/processors-and-chipsets/sierra-forest/xeon-6700-series-processor-with-e-cores-specification-update/errata-details/
> 
> For the Atom platforms before Sierra Forest (including Sierra Forest),
> Both 2 events "Instruction Retired" and "Branch Instruction Retired" would
> be overcounted on these certain instructions, but for Clearwater Forest
> only "Instruction Retired" event is overcounted on these instructions.
> 
> As the overcount issue on VM-Exit/VM-Entry, it has no way to validate
> the precise count for these 2 events on these affected Atom platforms,
> so just relax the precise event count check for these 2 events on these
> Atom platforms.
> 
> Signed-off-by: dongsheng <dongsheng.x.zhang@intel.com>
> Co-developed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
> Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
> Tested-by: Yi Lai <yi1.lai@intel.com>
> ---

...

> diff --git a/tools/testing/selftests/kvm/x86/pmu_counters_test.c b/tools/testing/selftests/kvm/x86/pmu_counters_test.c
> index 342a72420177..074cdf323406 100644
> --- a/tools/testing/selftests/kvm/x86/pmu_counters_test.c
> +++ b/tools/testing/selftests/kvm/x86/pmu_counters_test.c
> @@ -52,6 +52,9 @@ struct kvm_intel_pmu_event {
>  	struct kvm_x86_pmu_feature fixed_event;
>  };
>  
> +
> +static uint8_t inst_overcount_flags;
> +
>  /*
>   * Wrap the array to appease the compiler, as the macros used to construct each
>   * kvm_x86_pmu_feature use syntax that's only valid in function scope, and the
> @@ -163,10 +166,18 @@ static void guest_assert_event_count(uint8_t idx, uint32_t pmc, uint32_t pmc_msr
>  
>  	switch (idx) {
>  	case INTEL_ARCH_INSTRUCTIONS_RETIRED_INDEX:
> -		GUEST_ASSERT_EQ(count, NUM_INSNS_RETIRED);
> +		/* Relax precise count check due to VM-EXIT/VM-ENTRY overcount issue */
> +		if (inst_overcount_flags & INST_RETIRED_OVERCOUNT)
> +			GUEST_ASSERT(count >= NUM_INSNS_RETIRED);
> +		else
> +			GUEST_ASSERT_EQ(count, NUM_INSNS_RETIRED);
>  		break;
>  	case INTEL_ARCH_BRANCHES_RETIRED_INDEX:
> -		GUEST_ASSERT_EQ(count, NUM_BRANCH_INSNS_RETIRED);
> +		/* Relax precise count check due to VM-EXIT/VM-ENTRY overcount issue */
> +		if (inst_overcount_flags & BR_RETIRED_OVERCOUNT)
> +			GUEST_ASSERT(count >= NUM_BRANCH_INSNS_RETIRED);
> +		else
> +			GUEST_ASSERT_EQ(count, NUM_BRANCH_INSNS_RETIRED);
>  		break;
>  	case INTEL_ARCH_LLC_REFERENCES_INDEX:
>  	case INTEL_ARCH_LLC_MISSES_INDEX:
> @@ -335,6 +346,7 @@ static void test_arch_events(uint8_t pmu_version, uint64_t perf_capabilities,
>  				length);
>  	vcpu_set_cpuid_property(vcpu, X86_PROPERTY_PMU_EVENTS_MASK,
>  				unavailable_mask);
> +	sync_global_to_guest(vm, inst_overcount_flags);

Rather than force individual tests to sync_global_to_guest(), and to cache the
value, I think it makes sense to handle this automatically in kvm_arch_vm_post_create(),
similar to things like host_cpu_is_intel and host_cpu_is_amd.

And explicitly call these out as errata, so that it's super clear that we're
working around PMU/CPU flaws, not KVM bugs.  With some shenanigans, we can even
reuse the this_pmu_has()/this_cpu_has(0 terminology as this_pmu_has_errata(), and
hide the use of a bitmask too.

diff --git a/tools/testing/selftests/kvm/x86/pmu_counters_test.c b/tools/testing/selftests/kvm/x86/pmu_counters_test.c
index d4f90f5ec5b8..046d992c5940 100644
--- a/tools/testing/selftests/kvm/x86/pmu_counters_test.c
+++ b/tools/testing/selftests/kvm/x86/pmu_counters_test.c
@@ -163,10 +163,18 @@ static void guest_assert_event_count(uint8_t idx, uint32_t pmc, uint32_t pmc_msr
 
        switch (idx) {
        case INTEL_ARCH_INSTRUCTIONS_RETIRED_INDEX:
-               GUEST_ASSERT_EQ(count, NUM_INSNS_RETIRED);
+               /* Relax precise count check due to VM-EXIT/VM-ENTRY overcount issue */
+               if (this_pmu_has_errata(INSTRUCTIONS_RETIRED_OVERCOUNT))
+                       GUEST_ASSERT(count >= NUM_INSNS_RETIRED);
+               else
+                       GUEST_ASSERT_EQ(count, NUM_INSNS_RETIRED);
                break;
        case INTEL_ARCH_BRANCHES_RETIRED_INDEX:
-               GUEST_ASSERT_EQ(count, NUM_BRANCH_INSNS_RETIRED);
+               /* Relax precise count check due to VM-EXIT/VM-ENTRY overcount issue */
+               if (this_pmu_has_errata(BRANCHES_RETIRED_OVERCOUNT))
+                       GUEST_ASSERT(count >= NUM_BRANCH_INSNS_RETIRED);
+               else
+                       GUEST_ASSERT_EQ(count, NUM_BRANCH_INSNS_RETIRED);
                break;
        case INTEL_ARCH_LLC_REFERENCES_INDEX:
        case INTEL_ARCH_LLC_MISSES_INDEX:
diff --git a/tools/testing/selftests/kvm/x86/pmu_event_filter_test.c b/tools/testing/selftests/kvm/x86/pmu_event_filter_test.c
index c15513cd74d1..1c5b7611db24 100644
--- a/tools/testing/selftests/kvm/x86/pmu_event_filter_test.c
+++ b/tools/testing/selftests/kvm/x86/pmu_event_filter_test.c
@@ -214,8 +214,10 @@ static void remove_event(struct __kvm_pmu_event_filter *f, uint64_t event)
 do {                                                                                   \
        uint64_t br = pmc_results.branches_retired;                                     \
        uint64_t ir = pmc_results.instructions_retired;                                 \
+       bool br_matched = this_pmu_has_errata(BRANCHES_RETIRED_OVERCOUNT) ?             \
+                         br >= NUM_BRANCHES : br == NUM_BRANCHES;                      \
                                                                                        \
-       if (br && br != NUM_BRANCHES)                                                   \
+       if (br && !br_matched)                                                          \
                pr_info("%s: Branch instructions retired = %lu (expected %u)\n",        \
                        __func__, br, NUM_BRANCHES);                                    \
        TEST_ASSERT(br, "%s: Branch instructions retired = %lu (expected > 0)",         \

Re: [PATCH v2 4/5] KVM: selftests: Relax precise event count validation as overcount issue

[Mi, Dapeng]

On 9/11/2025 7:56 AM, Sean Christopherson wrote:
> On Fri, Jul 18, 2025, Dapeng Mi wrote:
>> From: dongsheng <dongsheng.x.zhang@intel.com>
>>
>> For Intel Atom CPUs, the PMU events "Instruction Retired" or
>> "Branch Instruction Retired" may be overcounted for some certain
>> instructions, like FAR CALL/JMP, RETF, IRET, VMENTRY/VMEXIT/VMPTRLD
>> and complex SGX/SMX/CSTATE instructions/flows.
>>
>> The detailed information can be found in the errata (section SRF7):
>> https://edc.intel.com/content/www/us/en/design/products-and-solutions/processors-and-chipsets/sierra-forest/xeon-6700-series-processor-with-e-cores-specification-update/errata-details/
>>
>> For the Atom platforms before Sierra Forest (including Sierra Forest),
>> Both 2 events "Instruction Retired" and "Branch Instruction Retired" would
>> be overcounted on these certain instructions, but for Clearwater Forest
>> only "Instruction Retired" event is overcounted on these instructions.
>>
>> As the overcount issue on VM-Exit/VM-Entry, it has no way to validate
>> the precise count for these 2 events on these affected Atom platforms,
>> so just relax the precise event count check for these 2 events on these
>> Atom platforms.
>>
>> Signed-off-by: dongsheng <dongsheng.x.zhang@intel.com>
>> Co-developed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
>> Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
>> Tested-by: Yi Lai <yi1.lai@intel.com>
>> ---
> ...
>
>> diff --git a/tools/testing/selftests/kvm/x86/pmu_counters_test.c b/tools/testing/selftests/kvm/x86/pmu_counters_test.c
>> index 342a72420177..074cdf323406 100644
>> --- a/tools/testing/selftests/kvm/x86/pmu_counters_test.c
>> +++ b/tools/testing/selftests/kvm/x86/pmu_counters_test.c
>> @@ -52,6 +52,9 @@ struct kvm_intel_pmu_event {
>>  	struct kvm_x86_pmu_feature fixed_event;
>>  };
>>  
>> +
>> +static uint8_t inst_overcount_flags;
>> +
>>  /*
>>   * Wrap the array to appease the compiler, as the macros used to construct each
>>   * kvm_x86_pmu_feature use syntax that's only valid in function scope, and the
>> @@ -163,10 +166,18 @@ static void guest_assert_event_count(uint8_t idx, uint32_t pmc, uint32_t pmc_msr
>>  
>>  	switch (idx) {
>>  	case INTEL_ARCH_INSTRUCTIONS_RETIRED_INDEX:
>> -		GUEST_ASSERT_EQ(count, NUM_INSNS_RETIRED);
>> +		/* Relax precise count check due to VM-EXIT/VM-ENTRY overcount issue */
>> +		if (inst_overcount_flags & INST_RETIRED_OVERCOUNT)
>> +			GUEST_ASSERT(count >= NUM_INSNS_RETIRED);
>> +		else
>> +			GUEST_ASSERT_EQ(count, NUM_INSNS_RETIRED);
>>  		break;
>>  	case INTEL_ARCH_BRANCHES_RETIRED_INDEX:
>> -		GUEST_ASSERT_EQ(count, NUM_BRANCH_INSNS_RETIRED);
>> +		/* Relax precise count check due to VM-EXIT/VM-ENTRY overcount issue */
>> +		if (inst_overcount_flags & BR_RETIRED_OVERCOUNT)
>> +			GUEST_ASSERT(count >= NUM_BRANCH_INSNS_RETIRED);
>> +		else
>> +			GUEST_ASSERT_EQ(count, NUM_BRANCH_INSNS_RETIRED);
>>  		break;
>>  	case INTEL_ARCH_LLC_REFERENCES_INDEX:
>>  	case INTEL_ARCH_LLC_MISSES_INDEX:
>> @@ -335,6 +346,7 @@ static void test_arch_events(uint8_t pmu_version, uint64_t perf_capabilities,
>>  				length);
>>  	vcpu_set_cpuid_property(vcpu, X86_PROPERTY_PMU_EVENTS_MASK,
>>  				unavailable_mask);
>> +	sync_global_to_guest(vm, inst_overcount_flags);
> Rather than force individual tests to sync_global_to_guest(), and to cache the
> value, I think it makes sense to handle this automatically in kvm_arch_vm_post_create(),
> similar to things like host_cpu_is_intel and host_cpu_is_amd.

Yeah,  that is the better place.


>
> And explicitly call these out as errata, so that it's super clear that we're
> working around PMU/CPU flaws, not KVM bugs.  With some shenanigans, we can even
> reuse the this_pmu_has()/this_cpu_has(0 terminology as this_pmu_has_errata(), and
> hide the use of a bitmask too.

Agree.


>
> diff --git a/tools/testing/selftests/kvm/x86/pmu_counters_test.c b/tools/testing/selftests/kvm/x86/pmu_counters_test.c
> index d4f90f5ec5b8..046d992c5940 100644
> --- a/tools/testing/selftests/kvm/x86/pmu_counters_test.c
> +++ b/tools/testing/selftests/kvm/x86/pmu_counters_test.c
> @@ -163,10 +163,18 @@ static void guest_assert_event_count(uint8_t idx, uint32_t pmc, uint32_t pmc_msr
>  
>         switch (idx) {
>         case INTEL_ARCH_INSTRUCTIONS_RETIRED_INDEX:
> -               GUEST_ASSERT_EQ(count, NUM_INSNS_RETIRED);
> +               /* Relax precise count check due to VM-EXIT/VM-ENTRY overcount issue */
> +               if (this_pmu_has_errata(INSTRUCTIONS_RETIRED_OVERCOUNT))
> +                       GUEST_ASSERT(count >= NUM_INSNS_RETIRED);
> +               else
> +                       GUEST_ASSERT_EQ(count, NUM_INSNS_RETIRED);
>                 break;
>         case INTEL_ARCH_BRANCHES_RETIRED_INDEX:
> -               GUEST_ASSERT_EQ(count, NUM_BRANCH_INSNS_RETIRED);
> +               /* Relax precise count check due to VM-EXIT/VM-ENTRY overcount issue */
> +               if (this_pmu_has_errata(BRANCHES_RETIRED_OVERCOUNT))
> +                       GUEST_ASSERT(count >= NUM_BRANCH_INSNS_RETIRED);
> +               else
> +                       GUEST_ASSERT_EQ(count, NUM_BRANCH_INSNS_RETIRED);
>                 break;
>         case INTEL_ARCH_LLC_REFERENCES_INDEX:
>         case INTEL_ARCH_LLC_MISSES_INDEX:
> diff --git a/tools/testing/selftests/kvm/x86/pmu_event_filter_test.c b/tools/testing/selftests/kvm/x86/pmu_event_filter_test.c
> index c15513cd74d1..1c5b7611db24 100644
> --- a/tools/testing/selftests/kvm/x86/pmu_event_filter_test.c
> +++ b/tools/testing/selftests/kvm/x86/pmu_event_filter_test.c
> @@ -214,8 +214,10 @@ static void remove_event(struct __kvm_pmu_event_filter *f, uint64_t event)
>  do {                                                                                   \
>         uint64_t br = pmc_results.branches_retired;                                     \
>         uint64_t ir = pmc_results.instructions_retired;                                 \
> +       bool br_matched = this_pmu_has_errata(BRANCHES_RETIRED_OVERCOUNT) ?             \
> +                         br >= NUM_BRANCHES : br == NUM_BRANCHES;                      \
>                                                                                         \
> -       if (br && br != NUM_BRANCHES)                                                   \
> +       if (br && !br_matched)                                                          \
>                 pr_info("%s: Branch instructions retired = %lu (expected %u)\n",        \
>                         __func__, br, NUM_BRANCHES);                                    \
>         TEST_ASSERT(br, "%s: Branch instructions retired = %lu (expected > 0)",         \

Looks good to me.

[PATCH v2 5/5] KVM: selftests: Relax branches event count check for event_filter test

[Dapeng Mi]

As the branches event overcount issue on Atom platforms, once there are
VM-Exits triggered (external interrupts) in the guest loop, the measured
branch event count could be larger than NUM_BRANCHES, this would lead to
the pmu_event_filter_test print warning to info the measured branches
event count is mismatched with expected number (NUM_BRANCHES).

To eliminate this warning, relax the branches event count check on the
Atom platform which have the branches event overcount issue.

Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Tested-by: Yi Lai <yi1.lai@intel.com>
---
 tools/testing/selftests/kvm/x86/pmu_event_filter_test.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/tools/testing/selftests/kvm/x86/pmu_event_filter_test.c b/tools/testing/selftests/kvm/x86/pmu_event_filter_test.c
index c15513cd74d1..9c1a92f05786 100644
--- a/tools/testing/selftests/kvm/x86/pmu_event_filter_test.c
+++ b/tools/testing/selftests/kvm/x86/pmu_event_filter_test.c
@@ -60,6 +60,8 @@ struct {
 	uint64_t instructions_retired;
 } pmc_results;
 
+static uint8_t inst_overcount_flags;
+
 /*
  * If we encounter a #GP during the guest PMU sanity check, then the guest
  * PMU is not functional. Inform the hypervisor via GUEST_SYNC(0).
@@ -214,8 +216,10 @@ static void remove_event(struct __kvm_pmu_event_filter *f, uint64_t event)
 do {											\
 	uint64_t br = pmc_results.branches_retired;					\
 	uint64_t ir = pmc_results.instructions_retired;					\
+	bool br_matched = inst_overcount_flags & BR_RETIRED_OVERCOUNT ?			\
+			  br >= NUM_BRANCHES : br == NUM_BRANCHES;			\
 											\
-	if (br && br != NUM_BRANCHES)							\
+	if (br && !br_matched)								\
 		pr_info("%s: Branch instructions retired = %lu (expected %u)\n",	\
 			__func__, br, NUM_BRANCHES);					\
 	TEST_ASSERT(br, "%s: Branch instructions retired = %lu (expected > 0)",		\
@@ -850,6 +854,9 @@ int main(int argc, char *argv[])
 	if (use_amd_pmu())
 		test_amd_deny_list(vcpu);
 
+	if (use_intel_pmu())
+		inst_overcount_flags = detect_inst_overcount_flags();
+
 	test_without_filter(vcpu);
 	test_member_deny_list(vcpu);
 	test_member_allow_list(vcpu);
-- 
2.34.1

Re: [PATCH v2 5/5] KVM: selftests: Relax branches event count check for event_filter test

[Sean Christopherson]

On Fri, Jul 18, 2025, Dapeng Mi wrote:
> As the branches event overcount issue on Atom platforms, once there are
> VM-Exits triggered (external interrupts) in the guest loop, the measured
> branch event count could be larger than NUM_BRANCHES, this would lead to
> the pmu_event_filter_test print warning to info the measured branches
> event count is mismatched with expected number (NUM_BRANCHES).
> 
> To eliminate this warning, relax the branches event count check on the
> Atom platform which have the branches event overcount issue.
> 
> Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
> Tested-by: Yi Lai <yi1.lai@intel.com>
> ---

This can be squashed with the previous patch, "workaround errata" is a single
logical change as far as I'm concerned.

>  tools/testing/selftests/kvm/x86/pmu_event_filter_test.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/tools/testing/selftests/kvm/x86/pmu_event_filter_test.c b/tools/testing/selftests/kvm/x86/pmu_event_filter_test.c
> index c15513cd74d1..9c1a92f05786 100644
> --- a/tools/testing/selftests/kvm/x86/pmu_event_filter_test.c
> +++ b/tools/testing/selftests/kvm/x86/pmu_event_filter_test.c
> @@ -60,6 +60,8 @@ struct {
>  	uint64_t instructions_retired;
>  } pmc_results;
>  
> +static uint8_t inst_overcount_flags;
> +
>  /*
>   * If we encounter a #GP during the guest PMU sanity check, then the guest
>   * PMU is not functional. Inform the hypervisor via GUEST_SYNC(0).
> @@ -214,8 +216,10 @@ static void remove_event(struct __kvm_pmu_event_filter *f, uint64_t event)
>  do {											\
>  	uint64_t br = pmc_results.branches_retired;					\
>  	uint64_t ir = pmc_results.instructions_retired;					\
> +	bool br_matched = inst_overcount_flags & BR_RETIRED_OVERCOUNT ?			\
> +			  br >= NUM_BRANCHES : br == NUM_BRANCHES;			\
>  											\
> -	if (br && br != NUM_BRANCHES)							\
> +	if (br && !br_matched)								\
>  		pr_info("%s: Branch instructions retired = %lu (expected %u)\n",	\
>  			__func__, br, NUM_BRANCHES);					\
>  	TEST_ASSERT(br, "%s: Branch instructions retired = %lu (expected > 0)",		\
> @@ -850,6 +854,9 @@ int main(int argc, char *argv[])
>  	if (use_amd_pmu())
>  		test_amd_deny_list(vcpu);
>  
> +	if (use_intel_pmu())

Checking for an Intel CPU should be done by the library.

Re: [PATCH v2 0/5] Fix PMU kselftests errors on GNR/SRF/CWF

[Sean Christopherson]

On Fri, Jul 18, 2025, Dapeng Mi wrote:
> This patch series fixes KVM PMU kselftests errors encountered on Granite
> Rapids (GNR), Sierra Forest (SRF) and Clearwater Forest (CWF).
> 
> GNR and SRF starts to support the timed PEBS. Timed PEBS adds a new
> "retired latency" field in basic info group to show the timing info and
> the PERF_CAPABILITIES[17] called "PEBS_TIMING_INFO" bit is added
> to indicated whether timed PEBS is supported. KVM module doesn't need to
> do any specific change to support timed PEBS except a perf change adding
> PERF_CAP_PEBS_TIMING_INFO flag into PERF_CAP_PEBS_MASK[1]. The patch 2/5
> adds timed PEBS support in vmx_pmu_caps_test and fix the error as the
> PEBS caps field mismatch.
> 
> CWF introduces 5 new architectural events (4 level-1 topdown metrics
> events and LBR inserts event). The patch 3/5 adds support for these 5
> arch-events and fixes the error that caused by mismatch between HW real
> supported arch-events number with NR_INTEL_ARCH_EVENTS.
> 
> On Intel Atom platforms, the PMU events "Instruction Retired" or
> "Branch Instruction Retired" may be overcounted for some certain
> instructions, like FAR CALL/JMP, RETF, IRET, VMENTRY/VMEXIT/VMPTRLD
> and complex SGX/SMX/CSTATE instructions/flows[2].
> 
> In details, for the Atom platforms before Sierra Forest (including
> Sierra Forest), Both 2 events "Instruction Retired" and
> "Branch Instruction Retired" would be overcounted on these certain
> instructions, but for Clearwater Forest only "Instruction Retired" event
> is overcounted on these instructions.
> 
> As this overcount issue, pmu_counters_test and pmu_event_filter_test
> would fail on the precise event count validation for these 2 events on
> Atom platforms.
> 
> To work around this Atom platform overcount issue, Patches 4-5/5 looses
> the precise count validation separately for pmu_counters_test and
> pmu_event_filter_test.
> 
> BTW, this patch series doesn't depend on the mediated vPMU support.
> 
> Changes:
>   * Add error fix for vmx_pmu_caps_test on GNR/SRF (patch 2/5).
>   * Opportunistically fix a typo (patch 1/5).
> 
> Tests:
>   * PMU kselftests (pmu_counters_test/pmu_event_filter_test/
>     vmx_pmu_caps_test) passed on Intel SPR/GNR/SRF/CWF platforms.
> 
> History:
>   * v1: https://lore.kernel.org/all/20250712172522.187414-1-dapeng1.mi@linux.intel.com/
> 
> Ref:
>   [1] https://lore.kernel.org/all/20250717090302.11316-1-dapeng1.mi@linux.intel.com/
>   [2] https://edc.intel.com/content/www/us/en/design/products-and-solutions/processors-and-chipsets/sierra-forest/xeon-6700-series-processor-with-e-cores-specification-update/errata-details
> 
> Dapeng Mi (4):
>   KVM: x86/pmu: Correct typo "_COUTNERS" to "_COUNTERS"
>   KVM: selftests: Add timing_info bit support in vmx_pmu_caps_test
>   KVM: Selftests: Validate more arch-events in pmu_counters_test
>   KVM: selftests: Relax branches event count check for event_filter test
> 
> dongsheng (1):
>   KVM: selftests: Relax precise event count validation as overcount
>     issue

Overall looks good, I just want to take a more infrastructure-oriented approach
for the errata.  I'll post a v3 tomorrow.  All coding is done and the tests pass,
but I want to take a second look with fresh eyes before posting it :-)

Re: [PATCH v2 0/5] Fix PMU kselftests errors on GNR/SRF/CWF

[Mi, Dapeng]

On 9/11/2025 7:59 AM, Sean Christopherson wrote:
> On Fri, Jul 18, 2025, Dapeng Mi wrote:
>> This patch series fixes KVM PMU kselftests errors encountered on Granite
>> Rapids (GNR), Sierra Forest (SRF) and Clearwater Forest (CWF).
>>
>> GNR and SRF starts to support the timed PEBS. Timed PEBS adds a new
>> "retired latency" field in basic info group to show the timing info and
>> the PERF_CAPABILITIES[17] called "PEBS_TIMING_INFO" bit is added
>> to indicated whether timed PEBS is supported. KVM module doesn't need to
>> do any specific change to support timed PEBS except a perf change adding
>> PERF_CAP_PEBS_TIMING_INFO flag into PERF_CAP_PEBS_MASK[1]. The patch 2/5
>> adds timed PEBS support in vmx_pmu_caps_test and fix the error as the
>> PEBS caps field mismatch.
>>
>> CWF introduces 5 new architectural events (4 level-1 topdown metrics
>> events and LBR inserts event). The patch 3/5 adds support for these 5
>> arch-events and fixes the error that caused by mismatch between HW real
>> supported arch-events number with NR_INTEL_ARCH_EVENTS.
>>
>> On Intel Atom platforms, the PMU events "Instruction Retired" or
>> "Branch Instruction Retired" may be overcounted for some certain
>> instructions, like FAR CALL/JMP, RETF, IRET, VMENTRY/VMEXIT/VMPTRLD
>> and complex SGX/SMX/CSTATE instructions/flows[2].
>>
>> In details, for the Atom platforms before Sierra Forest (including
>> Sierra Forest), Both 2 events "Instruction Retired" and
>> "Branch Instruction Retired" would be overcounted on these certain
>> instructions, but for Clearwater Forest only "Instruction Retired" event
>> is overcounted on these instructions.
>>
>> As this overcount issue, pmu_counters_test and pmu_event_filter_test
>> would fail on the precise event count validation for these 2 events on
>> Atom platforms.
>>
>> To work around this Atom platform overcount issue, Patches 4-5/5 looses
>> the precise count validation separately for pmu_counters_test and
>> pmu_event_filter_test.
>>
>> BTW, this patch series doesn't depend on the mediated vPMU support.
>>
>> Changes:
>>   * Add error fix for vmx_pmu_caps_test on GNR/SRF (patch 2/5).
>>   * Opportunistically fix a typo (patch 1/5).
>>
>> Tests:
>>   * PMU kselftests (pmu_counters_test/pmu_event_filter_test/
>>     vmx_pmu_caps_test) passed on Intel SPR/GNR/SRF/CWF platforms.
>>
>> History:
>>   * v1: https://lore.kernel.org/all/20250712172522.187414-1-dapeng1.mi@linux.intel.com/
>>
>> Ref:
>>   [1] https://lore.kernel.org/all/20250717090302.11316-1-dapeng1.mi@linux.intel.com/
>>   [2] https://edc.intel.com/content/www/us/en/design/products-and-solutions/processors-and-chipsets/sierra-forest/xeon-6700-series-processor-with-e-cores-specification-update/errata-details
>>
>> Dapeng Mi (4):
>>   KVM: x86/pmu: Correct typo "_COUTNERS" to "_COUNTERS"
>>   KVM: selftests: Add timing_info bit support in vmx_pmu_caps_test
>>   KVM: Selftests: Validate more arch-events in pmu_counters_test
>>   KVM: selftests: Relax branches event count check for event_filter test
>>
>> dongsheng (1):
>>   KVM: selftests: Relax precise event count validation as overcount
>>     issue
> Overall looks good, I just want to take a more infrastructure-oriented approach
> for the errata.  I'll post a v3 tomorrow.  All coding is done and the tests pass,
> but I want to take a second look with fresh eyes before posting it :-)

Thanks! :-)


>