Re: [PATCH v7 2/9] KVM: x86/pmu: Support Intel fixed counter 3 on mediated vPMU

On 7/27/2026 2:51 PM, [email protected] wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] The logic to filter non-contiguous fixed counters incorrectly uses CPUID.0A:EDX[4:0] instead of counting the contiguous 1-bits in the ECX bitmask. This causes KVM to expose non-existent fixed counters to the guest while hiding supported ones.
> --
> 
> --- Patch [2]: [PATCH v7 2/9] KVM: x86/pmu: Support Intel fixed counter 3 on mediated vPMU ---
> commit 7c8d5061e2216416ace2a9414a66d8b5fc0bf8bd
> Author: Dapeng Mi <[email protected]>
> 
> KVM: x86/pmu: Support Intel fixed counter 3 on mediated vPMU
> 
> This commit exposes Intel's fixed counter 3 to guests when mediated vPMU is
> enabled. It updates the maximum number of fixed counters and adds logic to
> filter non-contiguous fixed counters since KVM currently does not support
> them.
> 
>> diff --git a/arch/x86/kvm/pmu.c b/arch/x86/kvm/pmu.c
>> --- a/arch/x86/kvm/pmu.c
>> +++ b/arch/x86/kvm/pmu.c
> [ ... ]
>> @@ -181,6 +185,19 @@ void kvm_init_pmu_capability(struct kvm_pmu_ops *pmu_ops)
>>  	kvm_pmu_cap.num_counters_fixed = min(kvm_pmu_cap.num_counters_fixed,
>>  					     KVM_MAX_NR_FIXED_COUNTERS);
>>  
>> +	/*
>> +	 * Currently, KVM doesn't support non-contiguous fixed counters; make
>> +	 * sure only contiguous ones are retained in kvm_pmu_cap.
>> +	 */
>> +	if (kvm_host_pmu.version >= 5) {
>> +		cpuid(0xa, &eax, &ebx, &ecx, &edx.full);
>> +		if (kvm_pmu_cap.num_counters_fixed > edx.split.num_counters_fixed)
>> +			kvm_pmu_cap.num_counters_fixed = edx.split.num_counters_fixed;
> 
> [Severity: High]
> Does this logic correctly determine the number of contiguous fixed counters?
> 
> If a host supports PMU version 5 with fixed counters 0, 1, and 3, the ecx
> bitmask would be 0xB, and kvm_pmu_cap.num_counters_fixed would initially be
> populated with the weight of that mask, which is 3.
> 
> The value in edx.split.num_counters_fixed reports the maximum fixed counter
> index plus one (4 in this scenario). The condition 3 > 4 evaluates to
> false, so kvm_pmu_cap.num_counters_fixed remains 3.

I think it's a false positive.

edx.split.num_counters_fixed represents the number of contiguous fixed
counters, which is 2 in this case. The code correctly sets
kvm_pmu_cap.num_counters_fixed to 2.

> This leaves KVM exposing the first three contiguous counters (0, 1, and 2)
> to the guest. Since the host hardware does not actually support counter 2,
> KVMs attempt to back it with a host perf event will fail.
> 
> Should this instead inspect the contiguous 1-bits starting from bit 0 in the
> ecx bitmask, for example by using ffz(~ecx)?
> 
>> +	}
>> +
>> +	if (!enable_mediated_pmu && kvm_pmu_cap.num_counters_fixed > 3)
>> +		kvm_pmu_cap.num_counters_fixed = 3;
>> +
>