diff --git a/xen/arch/x86/psr.c b/xen/arch/x86/psr.c
index f2c2614..d4db407 100644
--- a/xen/arch/x86/psr.c
+++ b/xen/arch/x86/psr.c
@@ -136,6 +136,19 @@ struct feat_node {
          */
         int (*compare_val)(const uint32_t val[], const struct feat_node *feat,
                            unsigned int cos);
+
+        /*
+         * fits_cos_max is used to check if the input cos id exceeds the
+         * feature's cos_max and if the input value is not the default one.
+         * Even if the associated cos exceeds the cos_max, HW can work with
+         * default value. That is the reason we need check if input value is
+         * default one. If both criteria are fulfilled, that means the input
+         * exceeds the range. If not, that means the input fits the
+         * requirements.
+         */
+        bool (*fits_cos_max)(const uint32_t val[],
+                             const struct feat_node *feat,
+                             unsigned int cos);
     } ops;
 
     /* Encapsulate feature specific HW info here. */
@@ -392,6 +405,21 @@ static int cat_compare_val(const uint32_t val[],
     return 0;
 }
 
+static bool cat_fits_cos_max(const uint32_t val[],
+                             const struct feat_node *feat,
+                             unsigned int cos)
+{
+    if ( cos > feat->info.cat_info.cos_max &&
+         val[0] != feat->cos_reg_val[0] )
+            /*
+             * Exceed cos_max and value to set is not default,
+             * return error.
+             */
+            return false;
+
+    return true;
+}
+
 /* L3 CAT ops */
 static const struct feat_ops l3_cat_ops = {
     .get_cos_max = cat_get_cos_max,
@@ -400,6 +428,7 @@ static const struct feat_ops l3_cat_ops = {
     .get_old_val = cat_get_old_val,
     .set_new_val = cat_set_new_val,
     .compare_val = cat_compare_val,
+    .fits_cos_max = cat_fits_cos_max,
 };
 
 static void __init parse_psr_bool(char *s, char *value, char *feature,
@@ -851,13 +880,81 @@ static int find_cos(const uint32_t val[], uint32_t array_len,
     return -ENOENT;
 }
 
+static bool fits_cos_max(const uint32_t val[],
+                         uint32_t array_len,
+                         const struct psr_socket_info *info,
+                         unsigned int cos)
+{
+    unsigned int ret, i;
+    const struct feat_node *feat;
+
+    for ( i = 0; i < PSR_SOCKET_MAX_FEAT; i++ )
+    {
+        if ( !info->features[i] )
+            continue;
+
+        feat = info->features[i];
+
+        ret = feat->ops.fits_cos_max(val, feat, cos);
+        if ( !ret )
+            return false;
+
+        array_len -= feat->cos_num;
+        if ( array_len < 0 )
+            return false;
+
+        val += feat->cos_num;
+    }
+
+    return true;
+}
+
 static int pick_avail_cos(const struct psr_socket_info *info,
                           const uint32_t val[], uint32_t array_len,
                           unsigned int old_cos,
                           enum psr_feat_type feat_type)
 {
+    unsigned int cos;
+    unsigned int cos_max = 0;
+    const struct feat_node *feat;
+    const unsigned int *ref = info->cos_ref;
+
     ASSERT(spin_is_locked((spinlock_t *)(&info->ref_lock)));
-    return -ENOENT;
+
+    /* cos_max is the one of the feature which is being set. */
+    feat = info->features[feat_type];
+    if ( !feat )
+        return -ENOENT;
+
+    cos_max = feat->ops.get_cos_max(feat);
+    if ( !cos_max )
+        return -ENOENT;
+
+    /*
+     * If old cos is referred only by the domain, then use it. And, we cannot
+     * use id 0 because it stores the default values.
+     */
+    if ( old_cos && ref[old_cos] == 1 &&
+         fits_cos_max(val, array_len, info, old_cos) )
+            return old_cos;
+
+    /* Find an unused one other than cos0. */
+    for ( cos = 1; cos <= cos_max; cos++ )
+    {
+        /*
+         * ref is 0 means this COS is not used by other domain and
+         * can be used for current setting.
+         */
+        if ( !ref[cos] )
+        {
+            if ( !fits_cos_max(val, array_len, info, cos) )
+                return -EOVERFLOW;
+
+            return cos;
+        }
+    }
+
+    return -EOVERFLOW;
 }
 
 static int write_psr_msr(unsigned int socket, unsigned int cos,
