[Qemu-devel] [PATCH V3 0/4] Add vPMU vPMU support under TCG mode

[Qemu-devel] [PATCH V3 0/4] Add vPMU vPMU support under TCG mode

[Wei Huang]

QEMU has implemented cycle count support for guest VM under TCG mode.
But this feature is not complete. In fact using perf inside a
64-bit Linux guest VM (under TCG) can cause the following kernel panic
because some PMU registers are not implemented.

[  329.445970] [<fffffe000009e600>] armv8pmu_enable_event+0x58/0x8c
[  329.446713] [<fffffe0000621e74>] armpmu_start+0x4c/0x74

This patchset solves the problem by adding support for missing vPMU
registers. Basic perf test can work (both ACPI and DT) now under TCG
by applying this patchset.

address@hidden ~]# perf stat ls
 Performance counter stats for 'ls':

        226.740256      task-clock (msec)         #    0.312 CPUs utilized    
                76      context-switches          #    0.335 K/sec
                 0      cpu-migrations            #    0.000 K/sec
                64      page-faults               #    0.282 K/sec
       186,031,410      cycles                    #    0.820 GHz      (36.40%)
   <not supported>      stalled-cycles-frontend
   <not supported>      stalled-cycles-backend
     <not counted>      instructions               (0.00%)
   <not supported>      branches
     <not counted>      branch-misses              (0.00%)

V2->V3:
 * Remove PMXEVCNTR_EL0 support
 * Add read access support for PMXEVTYPER and change the CONSTRAINED
   UNPREDICTABLE behavior of PMXEVTYPER to RAZ/WI.

V1->V2:
  * Change most PMU registers to 64bit and the behavior of PMXEVTYPER
  * Add support for PMXEVCNTR_EL0
  * Misc fixes (DT, ID_AA64DFR0_EL1, ...) under TCG mode

Thanks,
-Wei

Wei Huang (4):
  target-arm: Add support for PMU register PMSELR_EL0
  target-arm: Add support for AArch64 PMU register PMXEVTYPER_EL0
  target-arm: Add support for PMU register PMINTENSET_EL1
  target-arm: Enable vPMU support under TCG mode

 hw/arm/virt.c       |  2 +-
 target/arm/cpu.c    |  2 +-
 target/arm/cpu.h    |  4 +--
 target/arm/helper.c | 72 ++++++++++++++++++++++++++++++++++++++++-------------
 4 files changed, 59 insertions(+), 21 deletions(-)

-- 
1.8.3.1

[Qemu-devel] [PATCH V3 1/4] target-arm: Add support for PMU register PMSELR_EL0

[Wei Huang]

This patch adds support for AArch64 register PMSELR_EL0. The existing
PMSELR definition is revised accordingly.

Signed-off-by: Wei Huang <wei@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h    |  1 +
 target/arm/helper.c | 25 ++++++++++++++++++++-----
 2 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 39bff86..8a82c73 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -309,6 +309,7 @@ typedef struct CPUARMState {
         uint32_t c9_pmovsr; /* perf monitor overflow status */
         uint32_t c9_pmxevtyper; /* perf monitor event type */
         uint32_t c9_pmuserenr; /* perf monitor user enable */
+        uint64_t c9_pmselr; /* perf monitor counter selection register */
         uint32_t c9_pminten; /* perf monitor interrupt enables */
         union { /* Memory attribute redirection */
             struct {
diff --git a/target/arm/helper.c b/target/arm/helper.c
index c23df1b..67520ea 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -975,6 +975,17 @@ static uint64_t pmccntr_read(CPUARMState *env, const ARMCPRegInfo *ri)
     return total_ticks - env->cp15.c15_ccnt;
 }
 
+static void pmselr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                         uint64_t value)
+{
+    /* The value of PMSELR.SEL affects the behavior of PMXEVTYPER and
+     * PMXEVCNTR. We allow [0..31] to be written to PMSELR here; in the
+     * meanwhile, we check PMSELR.SEL when PMXEVTYPER and PMXEVCNTR are
+     * accessed.
+     */
+    env->cp15.c9_pmselr = value & 0x1f;
+}
+
 static void pmccntr_write(CPUARMState *env, const ARMCPRegInfo *ri,
                         uint64_t value)
 {
@@ -1194,12 +1205,16 @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
     /* Unimplemented so WI. */
     { .name = "PMSWINC", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 4,
       .access = PL0_W, .accessfn = pmreg_access, .type = ARM_CP_NOP },
-    /* Since we don't implement any events, writing to PMSELR is UNPREDICTABLE.
-     * We choose to RAZ/WI.
-     */
     { .name = "PMSELR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 5,
-      .access = PL0_RW, .type = ARM_CP_CONST, .resetvalue = 0,
-      .accessfn = pmreg_access },
+      .access = PL0_RW, .type = ARM_CP_ALIAS,
+      .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmselr),
+      .accessfn = pmreg_access, .writefn = pmselr_write,
+      .raw_writefn = raw_write},
+    { .name = "PMSELR_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 5,
+      .access = PL0_RW, .accessfn = pmreg_access,
+      .fieldoffset = offsetof(CPUARMState, cp15.c9_pmselr),
+      .writefn = pmselr_write, .raw_writefn = raw_write, },
 #ifndef CONFIG_USER_ONLY
     { .name = "PMCCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 0,
       .access = PL0_RW, .resetvalue = 0, .type = ARM_CP_IO,
-- 
1.8.3.1

[Qemu-devel] [PATCH V3 2/4] target-arm: Add support for AArch64 PMU register PMXEVTYPER_EL0

[Wei Huang]

In order to support Linux perf, which uses PMXEVTYPER register,
this patch adds read/write access support for PMXEVTYPER. The access
is CONSTRAINED UNPREDICTABLE when PMSELR is not 0x1f. Additionally
this patch adds support for PMXEVTYPER_EL0.

Signed-off-by: Wei Huang <wei@redhat.com>
---
 target/arm/cpu.h    |  1 -
 target/arm/helper.c | 30 +++++++++++++++++++++++++-----
 2 files changed, 25 insertions(+), 6 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 8a82c73..f46607e 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -307,7 +307,6 @@ typedef struct CPUARMState {
         uint64_t c9_pmcr; /* performance monitor control register */
         uint64_t c9_pmcnten; /* perf monitor counter enables */
         uint32_t c9_pmovsr; /* perf monitor overflow status */
-        uint32_t c9_pmxevtyper; /* perf monitor event type */
         uint32_t c9_pmuserenr; /* perf monitor user enable */
         uint64_t c9_pmselr; /* perf monitor counter selection register */
         uint32_t c9_pminten; /* perf monitor interrupt enables */
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 67520ea..ec5cf1f 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -1054,7 +1054,25 @@ static void pmovsr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 static void pmxevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri,
                              uint64_t value)
 {
-    env->cp15.c9_pmxevtyper = value & 0xff;
+    /* Attempts to access PMXEVTYPER are CONSTRAINED UNPREDICTABLE when
+     * PMSELR value is equal to or greater than the number of implemented
+     * counters, but not equal to 0x1f. We opt to behave as a RAZ/WI.
+     */
+    if (env->cp15.c9_pmselr == 0x1f) {
+        pmccfiltr_write(env, ri, value);
+    }
+}
+
+static uint64_t pmxevtyper_read(CPUARMState *env, const ARMCPRegInfo *ri)
+{
+    /* We opt to behave as a RAZ/WI when attempts to access PMXEVTYPER
+     * are CONSTRAINED UNPREDICTABLE. See comments in pmxevtyper_write().
+     */
+    if (env->cp15.c9_pmselr == 0x1f) {
+        return env->cp15.pmccfiltr_el0;
+    } else {
+        return 0;
+    }
 }
 
 static void pmuserenr_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -1234,10 +1252,12 @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
       .fieldoffset = offsetof(CPUARMState, cp15.pmccfiltr_el0),
       .resetvalue = 0, },
     { .name = "PMXEVTYPER", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 1,
-      .access = PL0_RW,
-      .fieldoffset = offsetof(CPUARMState, cp15.c9_pmxevtyper),
-      .accessfn = pmreg_access, .writefn = pmxevtyper_write,
-      .raw_writefn = raw_write },
+      .access = PL0_RW, .type = ARM_CP_NO_RAW, .accessfn = pmreg_access,
+      .writefn = pmxevtyper_write, .readfn = pmxevtyper_read },
+    { .name = "PMXEVTYPER_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 1,
+      .access = PL0_RW, .type = ARM_CP_NO_RAW, .accessfn = pmreg_access,
+      .writefn = pmxevtyper_write, .readfn = pmxevtyper_read },
     /* Unimplemented, RAZ/WI. */
     { .name = "PMXEVCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 2,
       .access = PL0_RW, .type = ARM_CP_CONST, .resetvalue = 0,
-- 
1.8.3.1

[Qemu-devel] [PATCH V3 3/4] target-arm: Add support for PMU register PMINTENSET_EL1

[Wei Huang]

This patch adds access support for PMINTENSET_EL1.

Signed-off-by: Wei Huang <wei@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h    |  2 +-
 target/arm/helper.c | 10 +++++++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index f46607e..e28cd2e 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -309,7 +309,7 @@ typedef struct CPUARMState {
         uint32_t c9_pmovsr; /* perf monitor overflow status */
         uint32_t c9_pmuserenr; /* perf monitor user enable */
         uint64_t c9_pmselr; /* perf monitor counter selection register */
-        uint32_t c9_pminten; /* perf monitor interrupt enables */
+        uint64_t c9_pminten; /* perf monitor interrupt enables */
         union { /* Memory attribute redirection */
             struct {
 #ifdef HOST_WORDS_BIGENDIAN
diff --git a/target/arm/helper.c b/target/arm/helper.c
index ec5cf1f..c4daa6e 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -1275,9 +1275,17 @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
       .writefn = pmuserenr_write, .raw_writefn = raw_write },
     { .name = "PMINTENSET", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 1,
       .access = PL1_RW, .accessfn = access_tpm,
-      .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
+      .type = ARM_CP_ALIAS,
+      .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pminten),
       .resetvalue = 0,
       .writefn = pmintenset_write, .raw_writefn = raw_write },
+    { .name = "PMINTENSET_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 1,
+      .access = PL1_RW, .accessfn = access_tpm,
+      .type = ARM_CP_IO,
+      .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
+      .writefn = pmintenset_write, .raw_writefn = raw_write,
+      .resetvalue = 0x0 },
     { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2,
       .access = PL1_RW, .accessfn = access_tpm, .type = ARM_CP_ALIAS,
       .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
-- 
1.8.3.1

[Qemu-devel] [PATCH V3 4/4] target-arm: Enable vPMU support under TCG mode

[Wei Huang]

This patch contains several fixes to enable vPMU under TCG mode. It
first removes the checking of kvm_enabled() while unsetting
ARM_FEATURE_PMU. With it, the .pmu option can be used to turn on/off vPMU
under TCG mode. Secondly the PMU node of DT table is now created under TCG.
The last fix is to disable the masking of PMUver field of ID_AA64DFR0_EL1.

Signed-off-by: Wei Huang <wei@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c       | 2 +-
 target/arm/cpu.c    | 2 +-
 target/arm/helper.c | 7 +------
 3 files changed, 3 insertions(+), 8 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 1f216cf..8eef143 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -471,7 +471,7 @@ static void fdt_add_pmu_nodes(const VirtMachineState *vms)
     CPU_FOREACH(cpu) {
         armcpu = ARM_CPU(cpu);
         if (!arm_feature(&armcpu->env, ARM_FEATURE_PMU) ||
-            !kvm_arm_pmu_create(cpu, PPI(VIRTUAL_PMU_IRQ))) {
+            (kvm_enabled() && !kvm_arm_pmu_create(cpu, PPI(VIRTUAL_PMU_IRQ)))) {
             return;
         }
     }
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index e9f10f7..9a2bc8a 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -745,7 +745,7 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         unset_feature(env, ARM_FEATURE_EL2);
     }
 
-    if (!cpu->has_pmu || !kvm_enabled()) {
+    if (!cpu->has_pmu) {
         cpu->has_pmu = false;
         unset_feature(env, ARM_FEATURE_PMU);
     }
diff --git a/target/arm/helper.c b/target/arm/helper.c
index c4daa6e..d363d02 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -4633,12 +4633,7 @@ void register_cp_regs_for_features(ARMCPU *cpu)
             { .name = "ID_AA64DFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
-              /* We mask out the PMUVer field, because we don't currently
-               * implement the PMU. Not advertising it prevents the guest
-               * from trying to use it and getting UNDEFs on registers we
-               * don't implement.
-               */
-              .resetvalue = cpu->id_aa64dfr0 & ~0xf00 },
+              .resetvalue = cpu->id_aa64dfr0 },
             { .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
-- 
1.8.3.1

Re: [Qemu-devel] [PATCH V3 0/4] Add vPMU vPMU support under TCG mode

[Peter Maydell]

On 7 February 2017 at 21:49, Wei Huang <wei@redhat.com> wrote:
> QEMU has implemented cycle count support for guest VM under TCG mode.
> But this feature is not complete. In fact using perf inside a
> 64-bit Linux guest VM (under TCG) can cause the following kernel panic
> because some PMU registers are not implemented.
>
> [  329.445970] [<fffffe000009e600>] armv8pmu_enable_event+0x58/0x8c
> [  329.446713] [<fffffe0000621e74>] armpmu_start+0x4c/0x74
>
> This patchset solves the problem by adding support for missing vPMU
> registers. Basic perf test can work (both ACPI and DT) now under TCG
> by applying this patchset.
>
> address@hidden ~]# perf stat ls
>  Performance counter stats for 'ls':
>
>         226.740256      task-clock (msec)         #    0.312 CPUs utilized
>                 76      context-switches          #    0.335 K/sec
>                  0      cpu-migrations            #    0.000 K/sec
>                 64      page-faults               #    0.282 K/sec
>        186,031,410      cycles                    #    0.820 GHz      (36.40%)
>    <not supported>      stalled-cycles-frontend
>    <not supported>      stalled-cycles-backend
>      <not counted>      instructions               (0.00%)
>    <not supported>      branches
>      <not counted>      branch-misses              (0.00%)
>
> V2->V3:
>  * Remove PMXEVCNTR_EL0 support
>  * Add read access support for PMXEVTYPER and change the CONSTRAINED
>    UNPREDICTABLE behavior of PMXEVTYPER to RAZ/WI.
>
> V1->V2:
>   * Change most PMU registers to 64bit and the behavior of PMXEVTYPER
>   * Add support for PMXEVCNTR_EL0
>   * Misc fixes (DT, ID_AA64DFR0_EL1, ...) under TCG mod

Applied to target-arm.next, thanks.

-- PMM

Re: [Qemu-devel] [PATCH V3 0/4] Add vPMU vPMU support under TCG mode

[Peter Maydell]

On 10 February 2017 at 15:00, Peter Maydell <peter.maydell@linaro.org> wrote:
> On 7 February 2017 at 21:49, Wei Huang <wei@redhat.com> wrote:
>> QEMU has implemented cycle count support for guest VM under TCG mode.
>> But this feature is not complete. In fact using perf inside a
>> 64-bit Linux guest VM (under TCG) can cause the following kernel panic
>> because some PMU registers are not implemented.
>>
>> [  329.445970] [<fffffe000009e600>] armv8pmu_enable_event+0x58/0x8c
>> [  329.446713] [<fffffe0000621e74>] armpmu_start+0x4c/0x74
>>
>> This patchset solves the problem by adding support for missing vPMU
>> registers. Basic perf test can work (both ACPI and DT) now under TCG
>> by applying this patchset.
>>
>> address@hidden ~]# perf stat ls
>>  Performance counter stats for 'ls':
>>
>>         226.740256      task-clock (msec)         #    0.312 CPUs utilized
>>                 76      context-switches          #    0.335 K/sec
>>                  0      cpu-migrations            #    0.000 K/sec
>>                 64      page-faults               #    0.282 K/sec
>>        186,031,410      cycles                    #    0.820 GHz      (36.40%)
>>    <not supported>      stalled-cycles-frontend
>>    <not supported>      stalled-cycles-backend
>>      <not counted>      instructions               (0.00%)
>>    <not supported>      branches
>>      <not counted>      branch-misses              (0.00%)
>>
>> V2->V3:
>>  * Remove PMXEVCNTR_EL0 support
>>  * Add read access support for PMXEVTYPER and change the CONSTRAINED
>>    UNPREDICTABLE behavior of PMXEVTYPER to RAZ/WI.
>>
>> V1->V2:
>>   * Change most PMU registers to 64bit and the behavior of PMXEVTYPER
>>   * Add support for PMXEVCNTR_EL0
>>   * Misc fixes (DT, ID_AA64DFR0_EL1, ...) under TCG mod
>
> Applied to target-arm.next, thanks.

...though patch 1 breaks compilation of linux-user targets. I've
fixed it up by moving the #ifndef CONFIG_USER_ONLY to the right
place to cover the new regdefs.

thanks
-- PMM

Re: [Qemu-devel] [PATCH V3 0/4] Add vPMU vPMU support under TCG mode

[Wei Huang]

On 02/10/2017 09:11 AM, Peter Maydell wrote:
> On 10 February 2017 at 15:00, Peter Maydell <peter.maydell@linaro.org> wrote:
>> On 7 February 2017 at 21:49, Wei Huang <wei@redhat.com> wrote:
>>> QEMU has implemented cycle count support for guest VM under TCG mode.
>>> But this feature is not complete. In fact using perf inside a
>>> 64-bit Linux guest VM (under TCG) can cause the following kernel panic
>>> because some PMU registers are not implemented.
>>>
>>> [  329.445970] [<fffffe000009e600>] armv8pmu_enable_event+0x58/0x8c
>>> [  329.446713] [<fffffe0000621e74>] armpmu_start+0x4c/0x74
>>>
>>> This patchset solves the problem by adding support for missing vPMU
>>> registers. Basic perf test can work (both ACPI and DT) now under TCG
>>> by applying this patchset.
>>>
>>> address@hidden ~]# perf stat ls
>>>  Performance counter stats for 'ls':
>>>
>>>         226.740256      task-clock (msec)         #    0.312 CPUs utilized
>>>                 76      context-switches          #    0.335 K/sec
>>>                  0      cpu-migrations            #    0.000 K/sec
>>>                 64      page-faults               #    0.282 K/sec
>>>        186,031,410      cycles                    #    0.820 GHz      (36.40%)
>>>    <not supported>      stalled-cycles-frontend
>>>    <not supported>      stalled-cycles-backend
>>>      <not counted>      instructions               (0.00%)
>>>    <not supported>      branches
>>>      <not counted>      branch-misses              (0.00%)
>>>
>>> V2->V3:
>>>  * Remove PMXEVCNTR_EL0 support
>>>  * Add read access support for PMXEVTYPER and change the CONSTRAINED
>>>    UNPREDICTABLE behavior of PMXEVTYPER to RAZ/WI.
>>>
>>> V1->V2:
>>>   * Change most PMU registers to 64bit and the behavior of PMXEVTYPER
>>>   * Add support for PMXEVCNTR_EL0
>>>   * Misc fixes (DT, ID_AA64DFR0_EL1, ...) under TCG mod
>>
>> Applied to target-arm.next, thanks.
> 
> ...though patch 1 breaks compilation of linux-user targets. I've
> fixed it up by moving the #ifndef CONFIG_USER_ONLY to the right
> place to cover the new regdefs.

My bad. I normally did compilation for all targets + "make check" before
sending patches out. But on that particular machine, qemu was configured
for aarch64-softmmu only, thus missing this compilation error ...

> 
> thanks
> -- PMM
>