Re: [PATCH 1/1] target/i386/kvm: Use logical counter index for AMD PMU getter

Hi Paolo,

Apologies for bothering you.

Would it be possible to merge this bugfix? It has already been reviewed by many
developers.

Reviewed-by: Zhao Liu <[email protected]>
Reviewed-by: Sandipan Das <[email protected]>
Reviewed-by: Zide Chen <[email protected]>

I have verified that it still applies cleanly to the latest mainline QEMU
commit.

[PATCH 1/1] target/i386/kvm: Use logical counter index for AMD PMU getter
https://lore.kernel.org/qemu-devel/[email protected]/

Live migration of AMD PMUs will not work correctly without this fix.

At the moment, there is no actual out-of-bounds memory access because
MAX_GP_COUNTERS is large enough. However, if MAX_GP_COUNTERS is reduced further
to fewer than 12 in the future, this could result in an out-of-bounds memory access.

Once the bugfix is merged, the upcoming v11.1.0 release will provide more
comprehensive and robust support for AMD PMU live migration.

Thank you very much!

Dongli Zhang


On 2026-06-09 7:09 AM, Zhao Liu wrote:
> Cc: [email protected]
> 
> On Tue, Mar 24, 2026 at 07:12:36PM -0700, Dongli Zhang wrote:
>> Date: Tue, 24 Mar 2026 19:12:36 -0700
>> From: Dongli Zhang <[email protected]>
>> Subject: [PATCH 1/1] target/i386/kvm: Use logical counter index for AMD PMU
>>  getter
>> X-Mailer: git-send-email 2.43.5
>>
>> For Intel PMU, the counter and selector MSR ranges are disjoint. AMD PMU
>> behaves the same way when PerfCore is unavailable.
>>
>> However, once PerfCore is present, AMD PMU switches to an interleaved
>> layout in which selector and counter MSRs share a single alternating range.
>>
>> MSR_F15H_PERF_CTL0 = 0xc0010200
>> MSR_F15H_PERF_CTR0 = 0xc0010201
>> ... ...
>> ... ...
>> MSR_F15H_PERF_CTL5 = 0xc001020a
>> MSR_F15H_PERF_CTR5 = 0xc001020b
>>
>> The commit 4c7f05232c ("target/i386/kvm: reset AMD PMU registers during VM
>> reset") added the getter/putter pair for AMD PMU MSRs to clear them on
>> reset, but it ignored that, without PerfCore, AMD reuses alternating MSR
>> addresses for selectors and counters. env->msr_gp_counters[] holds the raw
>> counts and env->msr_gp_evtsel[] holds the selectors, so with the
>> interleaved layout we must translate the MSR address back to the logical
>> counter index instead of treating the interleaved slot as the array index.
>>
>> The arrays are sized to MAX_GP_COUNTERS = 18, so the code never writes past
>> the end. And in the reset path QEMU simply zeroes everything, so that use
>> case still works.
>>
>> However, the live migration is broken. The PMU state is stored at the
>> wrong indices, so the destination VM reloads mismatched selector/counter
>> pairs. Fix the getter to use the logical counter index rather than the raw
>> interleaved offset.
>>
>> Fixes: 4c7f05232c ("target/i386/kvm: reset AMD PMU registers during VM reset")
>> Signed-off-by: Dongli Zhang <[email protected]>
>> ---
>>  target/i386/kvm/kvm.c | 4 ++--
>>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> Sorry for late response, LGTM,
> 
> Reviewed-by: Zhao Liu <[email protected]>
> 
>