* [PATCH v9 01/20] RISC-V: perf: fix resource cleanup on driver probe failure
2026-08-07 8:08 [PATCH v9 00/20] Add Counter delegation ISA extension support Atish Patra
@ 2026-08-07 8:08 ` Atish Patra
2026-08-07 8:30 ` sashiko-bot
2026-08-07 8:08 ` [PATCH v9 02/20] RISC-V: Add Smcsrind and Sscsrind ISA extension CSR definitions Atish Patra
` (19 subsequent siblings)
20 siblings, 1 reply; 30+ messages in thread
From: Atish Patra @ 2026-08-07 8:08 UTC (permalink / raw)
To: Will Deacon, Atish Patra, Arnaldo Carvalho de Melo, Anup Patel,
Ian Rogers, Rob Herring, Paul Walmsley, Mark Rutland, Jiri Olsa,
Krzysztof Kozlowski, James Clark, Namhyung Kim
Cc: linux-riscv, linux-arm-kernel, Conor Dooley, linux-kernel,
linux-perf-users, devicetree
From: Atish Patra <atishp@meta.com>
Sashiko pointed out various UAF and memory leak issues around
pmu_sbi_device_probe() error paths.
If the probe fails, here are list of cleanups needed.
a. Already registered pmu must be freed
b. per cpu IRQ must be released
c. pmu_ctr_list data structure must be freed
d. cpu hotplug state must be cleaned up only if added.
Fix the resource cleanup by reorganizing the code around probe failure.
Reported-by: Sashiko AI <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260701-counter_delegation-v8-1-7909f863a645@meta.com
Signed-off-by: Paul Walmsley <pjw@kernel.org>
Reviewed-by: Charlie Jenkins <thecharlesjenkins@gmail.com>
Signed-off-by: Atish Patra <atishp@meta.com>
---
drivers/perf/riscv_pmu_sbi.c | 33 +++++++++++++++++++++++++++------
1 file changed, 27 insertions(+), 6 deletions(-)
diff --git a/drivers/perf/riscv_pmu_sbi.c b/drivers/perf/riscv_pmu_sbi.c
index dfc886dee5ad..50220f7b46d9 100644
--- a/drivers/perf/riscv_pmu_sbi.c
+++ b/drivers/perf/riscv_pmu_sbi.c
@@ -1219,22 +1219,29 @@ static int pmu_sbi_setup_irqs(struct riscv_pmu *pmu, struct platform_device *pde
DOMAIN_BUS_ANY);
if (!domain) {
pr_err("Failed to find INTC IRQ root domain\n");
- return -ENODEV;
+ ret = -ENODEV;
+ goto err;
}
riscv_pmu_irq = irq_create_mapping(domain, riscv_pmu_irq_num);
if (!riscv_pmu_irq) {
pr_err("Failed to map PMU interrupt for node\n");
- return -ENODEV;
+ ret = -ENODEV;
+ goto err;
}
ret = request_percpu_irq(riscv_pmu_irq, pmu_sbi_ovf_handler, "riscv-pmu", hw_events);
if (ret) {
pr_err("registering percpu irq failed [%d]\n", ret);
- return ret;
+ irq_dispose_mapping(riscv_pmu_irq);
+ riscv_pmu_irq = 0;
+ goto err;
}
return 0;
+err:
+ riscv_pmu_use_irq = false;
+ return ret;
}
#ifdef CONFIG_CPU_PM
@@ -1301,7 +1308,8 @@ static void riscv_pmu_destroy(struct riscv_pmu *pmu)
}
}
riscv_pm_pmu_unregister(pmu);
- cpuhp_state_remove_instance(CPUHP_AP_PERF_RISCV_STARTING, &pmu->node);
+ if (!hlist_unhashed(&pmu->node))
+ cpuhp_state_remove_instance(CPUHP_AP_PERF_RISCV_STARTING, &pmu->node);
}
static void pmu_sbi_event_init(struct perf_event *event)
@@ -1423,6 +1431,7 @@ static int pmu_sbi_device_probe(struct platform_device *pdev)
struct riscv_pmu *pmu = NULL;
int ret = -ENODEV;
int num_counters;
+ bool irq_requested = false;
pr_info("SBI PMU extension is available\n");
pmu = riscv_pmu_alloc();
@@ -1451,6 +1460,7 @@ static int pmu_sbi_device_probe(struct platform_device *pdev)
pmu->pmu.capabilities |= PERF_PMU_CAP_NO_INTERRUPT;
pmu->pmu.capabilities |= PERF_PMU_CAP_NO_EXCLUDE;
}
+ irq_requested = (ret == 0);
pmu->pmu.attr_groups = riscv_pmu_attr_groups;
pmu->pmu.parent = &pdev->dev;
@@ -1469,11 +1479,11 @@ static int pmu_sbi_device_probe(struct platform_device *pdev)
ret = riscv_pm_pmu_register(pmu);
if (ret)
- goto out_unregister;
+ goto out_destroy;
ret = perf_pmu_register(&pmu->pmu, "cpu", PERF_TYPE_RAW);
if (ret)
- goto out_unregister;
+ goto out_destroy;
/* SBI PMU Snapsphot is only available in SBI v2.0 */
if (sbi_v2_available) {
@@ -1514,9 +1524,20 @@ static int pmu_sbi_device_probe(struct platform_device *pdev)
return 0;
out_unregister:
+ perf_pmu_unregister(&pmu->pmu);
+
+out_destroy:
riscv_pmu_destroy(pmu);
+ if (irq_requested) {
+ free_percpu_irq(riscv_pmu_irq, pmu->hw_events);
+ irq_dispose_mapping(riscv_pmu_irq);
+ riscv_pmu_irq = 0;
+ }
out_free:
+ free_percpu(pmu->hw_events);
+ kfree(pmu_ctr_list);
+ pmu_ctr_list = NULL;
kfree(pmu);
return ret;
}
--
2.53.0-Meta
^ permalink raw reply related [flat|nested] 30+ messages in thread* Re: [PATCH v9 01/20] RISC-V: perf: fix resource cleanup on driver probe failure
2026-08-07 8:08 ` [PATCH v9 01/20] RISC-V: perf: fix resource cleanup on driver probe failure Atish Patra
@ 2026-08-07 8:30 ` sashiko-bot
0 siblings, 0 replies; 30+ messages in thread
From: sashiko-bot @ 2026-08-07 8:30 UTC (permalink / raw)
To: Atish Patra; +Cc: robh, conor+dt, devicetree, linux-perf-users
Thank you for your contribution! Sashiko AI review found 5 potential issue(s) to consider:
Pre-existing issues:
- [Critical] Process migration during a probe failure leaves the SBI firmware configured to write to a freed memory page (Firmware Use-After-Free).
- [High] The `sbi_pmu_snapshot_available` static key is not disabled on the probe error path, leading to a potential NULL pointer dereference on subsequent probe attempts.
- [High] Race condition in the probe error path leads to Use-After-Free of the `pmu` structure.
- [Medium] Missing cleanup of the registered sysctl table on the probe error path.
- [Low] CPU hotplug state registered in init is not removed if subsequent init steps fail.
--
--- Patch [1]: [PATCH v9 01/20] RISC-V: perf: fix resource cleanup on driver probe failure ---
commit e501d85892f2097d5cb521e3b393610d4683e0a4
Author: Atish Patra <atishp@meta.com>
RISC-V: perf: fix resource cleanup on driver probe failure
This patch fixes various UAF and memory leak issues around
pmu_sbi_device_probe() error paths. It ensures that registered PMUs,
per-cpu IRQs, and other data structures are correctly freed on failure.
Link: https://patch.msgid.link/20260701-counter_delegation-v8-1-7909f863a645@meta.com
> diff --git a/drivers/perf/riscv_pmu_sbi.c b/drivers/perf/riscv_pmu_sbi.c
> index dfc886dee5ad0..50220f7b46d9b 100644
> --- a/drivers/perf/riscv_pmu_sbi.c
> +++ b/drivers/perf/riscv_pmu_sbi.c
[ ... ]
> @@ -1301,7 +1308,8 @@ static void riscv_pmu_destroy(struct riscv_pmu *pmu)
> }
> }
> riscv_pm_pmu_unregister(pmu);
> - cpuhp_state_remove_instance(CPUHP_AP_PERF_RISCV_STARTING, &pmu->node);
> + if (!hlist_unhashed(&pmu->node))
> + cpuhp_state_remove_instance(CPUHP_AP_PERF_RISCV_STARTING, &pmu->node);
> }
[Severity: Critical]
This is a pre-existing issue, but does riscv_pmu_destroy() safely disable the
snapshot?
In pmu_sbi_device_probe(), pmu_sbi_snapshot_setup() is called within a
get_cpu()/put_cpu() block, configuring the SBI firmware for that specific CPU.
However, if probe fails and riscv_pmu_destroy() is called,
pmu_sbi_snapshot_disable() is executed without CPU pinning.
Could the thread migrate to a different CPU before disabling the snapshot,
leaving the original CPU's firmware configured to write to the snapshot
memory which is then freed by pmu_sbi_snapshot_free()?
[ ... ]
> @@ -1469,11 +1479,11 @@ static int pmu_sbi_device_probe(struct platform_device *pdev)
>
> ret = riscv_pm_pmu_register(pmu);
> if (ret)
> - goto out_unregister;
> + goto out_destroy;
>
> ret = perf_pmu_register(&pmu->pmu, "cpu", PERF_TYPE_RAW);
> if (ret)
> - goto out_unregister;
> + goto out_destroy;
[Severity: High]
This is a pre-existing issue, but does this expose the PMU to userspace before
fallible setups are complete?
Since perf_pmu_register() makes the PMU accessible, if userspace opens a perf
event before a subsequent initialization step fails (such as allocating
snapshot memory), the driver jumps to out_unregister and eventually calls
kfree(pmu).
Will this leave the perf core holding a pointer to a freed pmu structure?
[ ... ]
> @@ -1514,9 +1524,20 @@ static int pmu_sbi_device_probe(struct platform_device *pdev)
> return 0;
>
> out_unregister:
> + perf_pmu_unregister(&pmu->pmu);
> +
> +out_destroy:
[Severity: Medium]
This is a pre-existing issue, but is the sysctl table leaked on this error
path?
Before the return 0, pmu_sbi_device_probe() calls:
register_sysctl("kernel", sbi_pmu_sysctl_table);
If the subsequent cpuhp_state_add_instance() call fails, the error path skips
unregistering this sysctl table. Will repeated probe failures leak
ctl_table_header structures?
> riscv_pmu_destroy(pmu);
[Severity: High]
This is a pre-existing issue, but does the error path fail to disable the
sbi_pmu_snapshot_available static key?
If the probe fails after static_branch_enable(&sbi_pmu_snapshot_available),
the error path frees the snapshot memory in riscv_pmu_destroy() but never
disables the static key.
On a subsequent probe attempt or an interrupt, could code paths like
pmu_sbi_ovf_handler() execute assuming the snapshot memory is active, leading
to a NULL pointer dereference when accessing sdata->ctr_overflow_mask?
> + if (irq_requested) {
> + free_percpu_irq(riscv_pmu_irq, pmu->hw_events);
> + irq_dispose_mapping(riscv_pmu_irq);
> + riscv_pmu_irq = 0;
> + }
>
> out_free:
> + free_percpu(pmu->hw_events);
> + kfree(pmu_ctr_list);
> + pmu_ctr_list = NULL;
> kfree(pmu);
> return ret;
> }
[Severity: Low]
This is a pre-existing issue, but is there a CPU hotplug state leak in
pmu_sbi_devinit() if platform registration fails?
pmu_sbi_devinit() registers a multi-state CPU hotplug hook:
ret = cpuhp_setup_state_multi(CPUHP_AP_PERF_RISCV_STARTING, ...);
If platform_driver_register() or platform_device_register_simple() fails
afterward, the function returns directly without calling
cpuhp_remove_multi_state(), leaving the hotplug state registered.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260807-counter_delegation-v9-0-58658104e487@meta.com?part=1
^ permalink raw reply [flat|nested] 30+ messages in thread
* [PATCH v9 02/20] RISC-V: Add Smcsrind and Sscsrind ISA extension CSR definitions
2026-08-07 8:08 [PATCH v9 00/20] Add Counter delegation ISA extension support Atish Patra
2026-08-07 8:08 ` [PATCH v9 01/20] RISC-V: perf: fix resource cleanup on driver probe failure Atish Patra
@ 2026-08-07 8:08 ` Atish Patra
2026-08-07 8:08 ` [PATCH v9 03/20] RISC-V: Add Smcsrind and Sscsrind ISA extension definition and parsing Atish Patra
` (18 subsequent siblings)
20 siblings, 0 replies; 30+ messages in thread
From: Atish Patra @ 2026-08-07 8:08 UTC (permalink / raw)
To: Will Deacon, Atish Patra, Arnaldo Carvalho de Melo, Anup Patel,
Ian Rogers, Rob Herring, Paul Walmsley, Mark Rutland, Jiri Olsa,
Krzysztof Kozlowski, James Clark, Namhyung Kim
Cc: linux-riscv, linux-arm-kernel, Conor Dooley, linux-kernel,
linux-perf-users, devicetree
From: Kaiwen Xue <kaiwenx@rivosinc.com>
This adds definitions of new CSRs and bits defined in the Smcsrind and
Sscsrind ISA extensions. These CSRs enable the indirect CSR accesses
mechanism to access any indirect CSRs in M-, S-, and VS-mode. The
range of the select values and ireg will be defined by the ISA
extension that are based on the Smcsrind and Sscsrind extensions.
Signed-off-by: Kaiwen Xue <kaiwenx@rivosinc.com>
Reviewed-by: Clément Léger <cleger@rivosinc.com>
Signed-off-by: Atish Patra <atishp@rivosinc.com>
Reviewed-by: Charlie Jenkins <thecharlesjenkins@gmail.com>
Tested-by: Charlie Jenkins <thecharlesjenkins@gmail.com>
Link: https://patch.msgid.link/20260701-counter_delegation-v8-2-7909f863a645@meta.com
[pjw@kernel.org: clean up the patch description; use official RISC-V extension names]
Signed-off-by: Paul Walmsley <pjw@kernel.org>
---
arch/riscv/include/asm/csr.h | 30 ++++++++++++++++++++++++++++++
1 file changed, 30 insertions(+)
diff --git a/arch/riscv/include/asm/csr.h b/arch/riscv/include/asm/csr.h
index 31b8988f4488..7f09e54a0f9a 100644
--- a/arch/riscv/include/asm/csr.h
+++ b/arch/riscv/include/asm/csr.h
@@ -347,6 +347,12 @@
/* Supervisor-Level Window to Indirectly Accessed Registers (AIA) */
#define CSR_SISELECT 0x150
#define CSR_SIREG 0x151
+/* Supervisor-Level Window to Indirectly Accessed Registers (Sscsrind) */
+#define CSR_SIREG2 0x152
+#define CSR_SIREG3 0x153
+#define CSR_SIREG4 0x155
+#define CSR_SIREG5 0x156
+#define CSR_SIREG6 0x157
/* Supervisor-Level Interrupts (AIA) */
#define CSR_STOPEI 0x15c
@@ -394,6 +400,14 @@
/* VS-Level Window to Indirectly Accessed Registers (H-extension with AIA) */
#define CSR_VSISELECT 0x250
#define CSR_VSIREG 0x251
+/*
+ * VS-Level Window to Indirectly Accessed Registers (H-extension with Sscsrind)
+ */
+#define CSR_VSIREG2 0x252
+#define CSR_VSIREG3 0x253
+#define CSR_VSIREG4 0x255
+#define CSR_VSIREG5 0x256
+#define CSR_VSIREG6 0x257
/* VS-Level Interrupts (H-extension with AIA) */
#define CSR_VSTOPEI 0x25c
@@ -436,6 +450,12 @@
/* Machine-Level Window to Indirectly Accessed Registers (AIA) */
#define CSR_MISELECT 0x350
#define CSR_MIREG 0x351
+/* Machine-Level Window to Indirectly Accessed Registers (Smcsrind) */
+#define CSR_MIREG2 0x352
+#define CSR_MIREG3 0x353
+#define CSR_MIREG4 0x355
+#define CSR_MIREG5 0x356
+#define CSR_MIREG6 0x357
/* Machine-Level Interrupts (AIA) */
#define CSR_MTOPEI 0x35c
@@ -498,6 +518,11 @@
# define CSR_IEH CSR_MIEH
# define CSR_ISELECT CSR_MISELECT
# define CSR_IREG CSR_MIREG
+# define CSR_IREG2 CSR_MIREG2
+# define CSR_IREG3 CSR_MIREG3
+# define CSR_IREG4 CSR_MIREG4
+# define CSR_IREG5 CSR_MIREG5
+# define CSR_IREG6 CSR_MIREG6
# define CSR_IPH CSR_MIPH
# define CSR_TOPEI CSR_MTOPEI
# define CSR_TOPI CSR_MTOPI
@@ -523,6 +548,11 @@
# define CSR_IEH CSR_SIEH
# define CSR_ISELECT CSR_SISELECT
# define CSR_IREG CSR_SIREG
+# define CSR_IREG2 CSR_SIREG2
+# define CSR_IREG3 CSR_SIREG3
+# define CSR_IREG4 CSR_SIREG4
+# define CSR_IREG5 CSR_SIREG5
+# define CSR_IREG6 CSR_SIREG6
# define CSR_IPH CSR_SIPH
# define CSR_TOPEI CSR_STOPEI
# define CSR_TOPI CSR_STOPI
--
2.53.0-Meta
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH v9 03/20] RISC-V: Add Smcsrind and Sscsrind ISA extension definition and parsing
2026-08-07 8:08 [PATCH v9 00/20] Add Counter delegation ISA extension support Atish Patra
2026-08-07 8:08 ` [PATCH v9 01/20] RISC-V: perf: fix resource cleanup on driver probe failure Atish Patra
2026-08-07 8:08 ` [PATCH v9 02/20] RISC-V: Add Smcsrind and Sscsrind ISA extension CSR definitions Atish Patra
@ 2026-08-07 8:08 ` Atish Patra
2026-08-07 8:08 ` [PATCH v9 04/20] dt-bindings: riscv: add Smcsrind and Sscsrind ISA extension descriptions Atish Patra
` (17 subsequent siblings)
20 siblings, 0 replies; 30+ messages in thread
From: Atish Patra @ 2026-08-07 8:08 UTC (permalink / raw)
To: Will Deacon, Atish Patra, Arnaldo Carvalho de Melo, Anup Patel,
Ian Rogers, Rob Herring, Paul Walmsley, Mark Rutland, Jiri Olsa,
Krzysztof Kozlowski, James Clark, Namhyung Kim
Cc: linux-riscv, linux-arm-kernel, Conor Dooley, linux-kernel,
linux-perf-users, devicetree
From: Atish Patra <atishp@rivosinc.com>
The S[m|s]csrind extensions extend the indirect CSR access mechanism
defined in Smaia/Ssaia extensions.
This patch just enables the definition and parsing.
Signed-off-by: Atish Patra <atishp@rivosinc.com>
Reviewed-by: Charlie Jenkins <thecharlesjenkins@gmail.com>
Tested-by: Charlie Jenkins <thecharlesjenkins@gmail.com>
Link: https://patch.msgid.link/20260701-counter_delegation-v8-3-7909f863a645@meta.com
[pjw@kernel.org: use official RISC-V extension names in the patch description]
Signed-off-by: Paul Walmsley <pjw@kernel.org>
---
arch/riscv/include/asm/hwcap.h | 4 ++++
arch/riscv/kernel/cpufeature.c | 2 ++
2 files changed, 6 insertions(+)
diff --git a/arch/riscv/include/asm/hwcap.h b/arch/riscv/include/asm/hwcap.h
index 7ef8e5f55c8d..d4a7b90e2d78 100644
--- a/arch/riscv/include/asm/hwcap.h
+++ b/arch/riscv/include/asm/hwcap.h
@@ -112,6 +112,8 @@
#define RISCV_ISA_EXT_ZCLSD 103
#define RISCV_ISA_EXT_ZICFILP 104
#define RISCV_ISA_EXT_ZICFISS 105
+#define RISCV_ISA_EXT_SSCSRIND 106
+#define RISCV_ISA_EXT_SMCSRIND 107
#define RISCV_ISA_EXT_XLINUXENVCFG 127
@@ -121,9 +123,11 @@
#ifdef CONFIG_RISCV_M_MODE
#define RISCV_ISA_EXT_SxAIA RISCV_ISA_EXT_SMAIA
#define RISCV_ISA_EXT_SUPM RISCV_ISA_EXT_SMNPM
+#define RISCV_ISA_EXT_SxCSRIND RISCV_ISA_EXT_SMCSRIND
#else
#define RISCV_ISA_EXT_SxAIA RISCV_ISA_EXT_SSAIA
#define RISCV_ISA_EXT_SUPM RISCV_ISA_EXT_SSNPM
+#define RISCV_ISA_EXT_SxCSRIND RISCV_ISA_EXT_SSCSRIND
#endif
#endif /* _ASM_RISCV_HWCAP_H */
diff --git a/arch/riscv/kernel/cpufeature.c b/arch/riscv/kernel/cpufeature.c
index f46aa5602d74..3fa0a563fb21 100644
--- a/arch/riscv/kernel/cpufeature.c
+++ b/arch/riscv/kernel/cpufeature.c
@@ -576,11 +576,13 @@ const struct riscv_isa_ext_data riscv_isa_ext[] = {
__RISCV_ISA_EXT_BUNDLE_VALIDATE(zvksg, riscv_zvksg_bundled_exts, riscv_ext_vector_crypto_validate),
__RISCV_ISA_EXT_DATA_VALIDATE(zvkt, RISCV_ISA_EXT_ZVKT, riscv_ext_vector_crypto_validate),
__RISCV_ISA_EXT_DATA(smaia, RISCV_ISA_EXT_SMAIA),
+ __RISCV_ISA_EXT_DATA(smcsrind, RISCV_ISA_EXT_SMCSRIND),
__RISCV_ISA_EXT_DATA(smmpm, RISCV_ISA_EXT_SMMPM),
__RISCV_ISA_EXT_SUPERSET(smnpm, RISCV_ISA_EXT_SMNPM, riscv_xlinuxenvcfg_exts),
__RISCV_ISA_EXT_DATA(smstateen, RISCV_ISA_EXT_SMSTATEEN),
__RISCV_ISA_EXT_DATA(ssaia, RISCV_ISA_EXT_SSAIA),
__RISCV_ISA_EXT_DATA(sscofpmf, RISCV_ISA_EXT_SSCOFPMF),
+ __RISCV_ISA_EXT_DATA(sscsrind, RISCV_ISA_EXT_SSCSRIND),
__RISCV_ISA_EXT_SUPERSET(ssnpm, RISCV_ISA_EXT_SSNPM, riscv_xlinuxenvcfg_exts),
__RISCV_ISA_EXT_DATA(sstc, RISCV_ISA_EXT_SSTC),
__RISCV_ISA_EXT_DATA(svade, RISCV_ISA_EXT_SVADE),
--
2.53.0-Meta
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH v9 04/20] dt-bindings: riscv: add Smcsrind and Sscsrind ISA extension descriptions
2026-08-07 8:08 [PATCH v9 00/20] Add Counter delegation ISA extension support Atish Patra
` (2 preceding siblings ...)
2026-08-07 8:08 ` [PATCH v9 03/20] RISC-V: Add Smcsrind and Sscsrind ISA extension definition and parsing Atish Patra
@ 2026-08-07 8:08 ` Atish Patra
2026-08-07 8:09 ` [PATCH v9 05/20] RISC-V: Define indirect CSR access helpers Atish Patra
` (16 subsequent siblings)
20 siblings, 0 replies; 30+ messages in thread
From: Atish Patra @ 2026-08-07 8:08 UTC (permalink / raw)
To: Will Deacon, Atish Patra, Arnaldo Carvalho de Melo, Anup Patel,
Ian Rogers, Rob Herring, Paul Walmsley, Mark Rutland, Jiri Olsa,
Krzysztof Kozlowski, James Clark, Namhyung Kim
Cc: linux-riscv, linux-arm-kernel, Conor Dooley, linux-kernel,
linux-perf-users, devicetree
From: Atish Patra <atishp@rivosinc.com>
Add the S[m|s]csrind ISA extension description.
Acked-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Atish Patra <atishp@rivosinc.com>
Link: https://patch.msgid.link/20260701-counter_delegation-v8-4-7909f863a645@meta.com
[pjw@kernel.org: use official extension names in the patch description]
Signed-off-by: Paul Walmsley <pjw@kernel.org>
---
Documentation/devicetree/bindings/riscv/extensions.yaml | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/Documentation/devicetree/bindings/riscv/extensions.yaml b/Documentation/devicetree/bindings/riscv/extensions.yaml
index 5ffc40d599c0..ccff2be1224d 100644
--- a/Documentation/devicetree/bindings/riscv/extensions.yaml
+++ b/Documentation/devicetree/bindings/riscv/extensions.yaml
@@ -181,6 +181,14 @@ properties:
changes to interrupts as frozen at commit ccbddab ("Merge pull
request #42 from riscv/jhauser-2023-RC4") of riscv-aia.
+ - const: smcsrind
+ description: |
+ The standard Smcsrind machine-level extension extends the
+ indirect CSR access mechanism defined by the Smaia extension. This
+ extension allows other ISA extensions to use indirect CSR access
+ mechanism in M-mode as ratified in the 20240326 version of the
+ privileged ISA specification.
+
- const: smmpm
description: |
The standard Smmpm extension for M-mode pointer masking as
@@ -226,6 +234,14 @@ properties:
Profiles Version 1.0, with commit b1d806605f87 ("Updated to
ratified state.")
+ - const: sscsrind
+ description: |
+ The standard Sscsrind supervisor-level extension extends the
+ indirect CSR access mechanism defined by the Ssaia extension. This
+ extension allows other ISA extensions to use indirect CSR access
+ mechanism in S-mode as ratified in the 20240326 version of the
+ privileged ISA specification.
+
- const: ssnpm
description: |
The standard Ssnpm extension for next-mode pointer masking as
--
2.53.0-Meta
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH v9 05/20] RISC-V: Define indirect CSR access helpers
2026-08-07 8:08 [PATCH v9 00/20] Add Counter delegation ISA extension support Atish Patra
` (3 preceding siblings ...)
2026-08-07 8:08 ` [PATCH v9 04/20] dt-bindings: riscv: add Smcsrind and Sscsrind ISA extension descriptions Atish Patra
@ 2026-08-07 8:09 ` Atish Patra
2026-08-07 8:27 ` sashiko-bot
2026-08-07 8:09 ` [PATCH v9 06/20] RISC-V: Add Smcntrpmf extension parsing Atish Patra
` (15 subsequent siblings)
20 siblings, 1 reply; 30+ messages in thread
From: Atish Patra @ 2026-08-07 8:09 UTC (permalink / raw)
To: Will Deacon, Atish Patra, Arnaldo Carvalho de Melo, Anup Patel,
Ian Rogers, Rob Herring, Paul Walmsley, Mark Rutland, Jiri Olsa,
Krzysztof Kozlowski, James Clark, Namhyung Kim
Cc: linux-riscv, linux-arm-kernel, Conor Dooley, linux-kernel,
linux-perf-users, devicetree
From: Atish Patra <atishp@rivosinc.com>
The indirect CSR requires multiple instructions to read/write CSR.
Add a few helper macros for ease of usage.
These have to be macros rather than functions. csr_read()/csr_write()
stringify their CSR argument into the inline asm template via
__ASM_STR(), so the CSR number must be a literal token; passing it as a
function parameter emits "csrr %0, iregcsr", which the assembler rejects
with "unknown CSR `iregcsr'". The stringification happens in the
preprocessor, before inlining or constant propagation, so it cannot be
worked around by forcing inlining or by only ever passing constants -
gcc 12, gcc 16 and clang 22 all reject it alike. Underneath, csrr/csrw
encode the CSR as a 12-bit immediate and RISC-V has no register-indirect
form, which is also why asm/csr.h keeps every one of its accessors as a
macro.
Signed-off-by: Atish Patra <atishp@rivosinc.com>
Reviewed-by: Charlie Jenkins <thecharlesjenkins@gmail.com>
Tested-by: Charlie Jenkins <thecharlesjenkins@gmail.com>
Link: https://patch.msgid.link/20260701-counter_delegation-v8-5-7909f863a645@meta.com
[pjw@kernel.org: expand "ind" abbreviation]
Signed-off-by: Paul Walmsley <pjw@kernel.org>
---
arch/riscv/include/asm/csr_indirect.h | 50 +++++++++++++++++++++++++++++++++++
1 file changed, 50 insertions(+)
diff --git a/arch/riscv/include/asm/csr_indirect.h b/arch/riscv/include/asm/csr_indirect.h
new file mode 100644
index 000000000000..0f558fac8f5f
--- /dev/null
+++ b/arch/riscv/include/asm/csr_indirect.h
@@ -0,0 +1,50 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+
+#ifndef _ASM_RISCV_CSR_INDIRECT_H
+#define _ASM_RISCV_CSR_INDIRECT_H
+
+#include <linux/irqflags.h>
+
+#include <asm/csr.h>
+
+/*
+ * These have to be macros rather than functions: csr_read()/csr_write()
+ * stringify their CSR argument into the inline asm template via __ASM_STR(),
+ * so the CSR number must be a literal token at preprocessing time. Passing it
+ * as a function parameter emits "csrr %0, iregcsr", which no assembler can
+ * resolve. RISC-V has no register-indirect form of csrr/csrw - the CSR is a
+ * 12-bit immediate - so the sireg CSR selecting the indirect window cannot
+ * itself be a variable.
+ */
+#define csr_indirect_read(iregcsr, iselbase, iseloff) ({ \
+ unsigned long __value = 0; \
+ unsigned long __flags; \
+ local_irq_save(__flags); \
+ csr_write(CSR_ISELECT, (iselbase) + (iseloff)); \
+ __value = csr_read(iregcsr); \
+ local_irq_restore(__flags); \
+ __value; \
+})
+
+#define csr_indirect_write(iregcsr, iselbase, iseloff, value) ({ \
+ unsigned long __flags; \
+ local_irq_save(__flags); \
+ csr_write(CSR_ISELECT, (iselbase) + (iseloff)); \
+ csr_write(iregcsr, (value)); \
+ local_irq_restore(__flags); \
+})
+
+#define csr_indirect_warl(iregcsr, iselbase, iseloff, warl_val) ({ \
+ unsigned long __old_val = 0, __value = 0; \
+ unsigned long __flags; \
+ local_irq_save(__flags); \
+ csr_write(CSR_ISELECT, (iselbase) + (iseloff)); \
+ __old_val = csr_read(iregcsr); \
+ csr_write(iregcsr, (warl_val)); \
+ __value = csr_read(iregcsr); \
+ csr_write(iregcsr, __old_val); \
+ local_irq_restore(__flags); \
+ __value; \
+})
+
+#endif
--
2.53.0-Meta
^ permalink raw reply related [flat|nested] 30+ messages in thread* Re: [PATCH v9 05/20] RISC-V: Define indirect CSR access helpers
2026-08-07 8:09 ` [PATCH v9 05/20] RISC-V: Define indirect CSR access helpers Atish Patra
@ 2026-08-07 8:27 ` sashiko-bot
0 siblings, 0 replies; 30+ messages in thread
From: sashiko-bot @ 2026-08-07 8:27 UTC (permalink / raw)
To: Atish Patra; +Cc: robh, devicetree, conor+dt, linux-perf-users
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The indirect CSR access macros use generic local variable names (`__flags`, `__value`, `__old_val`) which can silently shadow caller arguments, leading to logic corruption and unintended hardware writes.
--
--- Patch [5]: [PATCH v9 05/20] RISC-V: Define indirect CSR access helpers ---
commit abb666a0789f79a51327c355784dec21386f3bf0
Author: Atish Patra <atishp@rivosinc.com>
RISC-V: Define indirect CSR access helpers
The indirect CSR requires multiple instructions to read/write CSR. Add a few
helper macros for ease of usage.
Link: https://patch.msgid.link/20260701-counter_delegation-v8-5-7909f863a645@meta.com
> diff --git a/arch/riscv/include/asm/csr_indirect.h b/arch/riscv/include/asm/csr_indirect.h
> new file mode 100644
> index 0000000000000..0f558fac8f5f7
> --- /dev/null
> +++ b/arch/riscv/include/asm/csr_indirect.h
[ ... ]
> +#define csr_indirect_read(iregcsr, iselbase, iseloff) ({ \
> + unsigned long __value = 0; \
> + unsigned long __flags; \
[Severity: Medium]
Could these generic local variable names silently shadow caller arguments?
If a caller passes an expression using __flags or __value for iselbase or
iseloff, the macro's local variables will shadow them, potentially causing
the macro to use unintended values.
> + local_irq_save(__flags); \
> + csr_write(CSR_ISELECT, (iselbase) + (iseloff)); \
> + __value = csr_read(iregcsr); \
> + local_irq_restore(__flags); \
> + __value; \
> +})
> +
> +#define csr_indirect_write(iregcsr, iselbase, iseloff, value) ({ \
> + unsigned long __flags; \
[Severity: Medium]
Can this local __flags variable shadow the value argument if the caller
passes a variable named __flags?
If a caller executes csr_indirect_write(reg, base, off, __flags), the macro
would evaluate (value) using its own __flags variable (which holds the saved
IRQ state) instead of the caller's value. This would write the IRQ state to
the hardware CSR, potentially corrupting the CPU state.
> + local_irq_save(__flags); \
> + csr_write(CSR_ISELECT, (iselbase) + (iseloff)); \
> + csr_write(iregcsr, (value)); \
> + local_irq_restore(__flags); \
> +})
> +
> +#define csr_indirect_warl(iregcsr, iselbase, iseloff, warl_val) ({ \
> + unsigned long __old_val = 0, __value = 0; \
> + unsigned long __flags; \
[Severity: Medium]
Similar to the other macros, do these generic local variable names risk
shadowing the warl_val, iselbase, or iseloff arguments?
> + local_irq_save(__flags); \
> + csr_write(CSR_ISELECT, (iselbase) + (iseloff)); \
> + __old_val = csr_read(iregcsr); \
> + csr_write(iregcsr, (warl_val)); \
> + __value = csr_read(iregcsr); \
> + csr_write(iregcsr, __old_val); \
> + local_irq_restore(__flags); \
> + __value; \
> +})
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260807-counter_delegation-v9-0-58658104e487@meta.com?part=5
^ permalink raw reply [flat|nested] 30+ messages in thread
* [PATCH v9 06/20] RISC-V: Add Smcntrpmf extension parsing
2026-08-07 8:08 [PATCH v9 00/20] Add Counter delegation ISA extension support Atish Patra
` (4 preceding siblings ...)
2026-08-07 8:09 ` [PATCH v9 05/20] RISC-V: Define indirect CSR access helpers Atish Patra
@ 2026-08-07 8:09 ` Atish Patra
2026-08-07 8:09 ` [PATCH v9 07/20] dt-bindings: riscv: add Smcntrpmf ISA extension description Atish Patra
` (14 subsequent siblings)
20 siblings, 0 replies; 30+ messages in thread
From: Atish Patra @ 2026-08-07 8:09 UTC (permalink / raw)
To: Will Deacon, Atish Patra, Arnaldo Carvalho de Melo, Anup Patel,
Ian Rogers, Rob Herring, Paul Walmsley, Mark Rutland, Jiri Olsa,
Krzysztof Kozlowski, James Clark, Namhyung Kim
Cc: linux-riscv, linux-arm-kernel, Conor Dooley, linux-kernel,
linux-perf-users, devicetree
From: Atish Patra <atishp@rivosinc.com>
Smcntrpmf extension allows M-mode to enable privilege mode filtering
for cycle/instret counters. However, the cyclecfg/instretcfg CSRs are
available in Ssccfg only if Smcntrpmf is present.
That's why, kernel needs to detect presence of Smcntrpmf extension and
enable privilege mode filtering for cycle/instret counters.
Reviewed-by: Clément Léger <cleger@rivosinc.com>
Signed-off-by: Atish Patra <atishp@rivosinc.com>
Reviewed-by: Charlie Jenkins <thecharlesjenkins@gmail.com>
Tested-by: Charlie Jenkins <thecharlesjenkins@gmail.com>
Link: https://patch.msgid.link/20260701-counter_delegation-v8-6-7909f863a645@meta.com
Signed-off-by: Paul Walmsley <pjw@kernel.org>
---
arch/riscv/include/asm/hwcap.h | 1 +
arch/riscv/kernel/cpufeature.c | 1 +
2 files changed, 2 insertions(+)
diff --git a/arch/riscv/include/asm/hwcap.h b/arch/riscv/include/asm/hwcap.h
index d4a7b90e2d78..51ad55b9677a 100644
--- a/arch/riscv/include/asm/hwcap.h
+++ b/arch/riscv/include/asm/hwcap.h
@@ -114,6 +114,7 @@
#define RISCV_ISA_EXT_ZICFISS 105
#define RISCV_ISA_EXT_SSCSRIND 106
#define RISCV_ISA_EXT_SMCSRIND 107
+#define RISCV_ISA_EXT_SMCNTRPMF 108
#define RISCV_ISA_EXT_XLINUXENVCFG 127
diff --git a/arch/riscv/kernel/cpufeature.c b/arch/riscv/kernel/cpufeature.c
index 3fa0a563fb21..1452521d740a 100644
--- a/arch/riscv/kernel/cpufeature.c
+++ b/arch/riscv/kernel/cpufeature.c
@@ -576,6 +576,7 @@ const struct riscv_isa_ext_data riscv_isa_ext[] = {
__RISCV_ISA_EXT_BUNDLE_VALIDATE(zvksg, riscv_zvksg_bundled_exts, riscv_ext_vector_crypto_validate),
__RISCV_ISA_EXT_DATA_VALIDATE(zvkt, RISCV_ISA_EXT_ZVKT, riscv_ext_vector_crypto_validate),
__RISCV_ISA_EXT_DATA(smaia, RISCV_ISA_EXT_SMAIA),
+ __RISCV_ISA_EXT_DATA(smcntrpmf, RISCV_ISA_EXT_SMCNTRPMF),
__RISCV_ISA_EXT_DATA(smcsrind, RISCV_ISA_EXT_SMCSRIND),
__RISCV_ISA_EXT_DATA(smmpm, RISCV_ISA_EXT_SMMPM),
__RISCV_ISA_EXT_SUPERSET(smnpm, RISCV_ISA_EXT_SMNPM, riscv_xlinuxenvcfg_exts),
--
2.53.0-Meta
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH v9 07/20] dt-bindings: riscv: add Smcntrpmf ISA extension description
2026-08-07 8:08 [PATCH v9 00/20] Add Counter delegation ISA extension support Atish Patra
` (5 preceding siblings ...)
2026-08-07 8:09 ` [PATCH v9 06/20] RISC-V: Add Smcntrpmf extension parsing Atish Patra
@ 2026-08-07 8:09 ` Atish Patra
2026-08-07 8:09 ` [PATCH v9 08/20] RISC-V: Add Ssccfg extension CSR definition Atish Patra
` (13 subsequent siblings)
20 siblings, 0 replies; 30+ messages in thread
From: Atish Patra @ 2026-08-07 8:09 UTC (permalink / raw)
To: Will Deacon, Atish Patra, Arnaldo Carvalho de Melo, Anup Patel,
Ian Rogers, Rob Herring, Paul Walmsley, Mark Rutland, Jiri Olsa,
Krzysztof Kozlowski, James Clark, Namhyung Kim
Cc: linux-riscv, linux-arm-kernel, Conor Dooley, linux-kernel,
linux-perf-users, devicetree
From: Atish Patra <atishp@rivosinc.com>
Add the description for Smcntrpmf ISA extension
Acked-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Atish Patra <atishp@rivosinc.com>
Link: https://patch.msgid.link/20260701-counter_delegation-v8-7-7909f863a645@meta.com
Signed-off-by: Paul Walmsley <pjw@kernel.org>
---
Documentation/devicetree/bindings/riscv/extensions.yaml | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/Documentation/devicetree/bindings/riscv/extensions.yaml b/Documentation/devicetree/bindings/riscv/extensions.yaml
index ccff2be1224d..eee65cf73d6c 100644
--- a/Documentation/devicetree/bindings/riscv/extensions.yaml
+++ b/Documentation/devicetree/bindings/riscv/extensions.yaml
@@ -181,6 +181,12 @@ properties:
changes to interrupts as frozen at commit ccbddab ("Merge pull
request #42 from riscv/jhauser-2023-RC4") of riscv-aia.
+ - const: smcntrpmf
+ description: |
+ The standard Smcntrpmf machine-level extension for the machine mode
+ to enable privilege mode filtering for cycle and instret counters as
+ ratified in the 20240326 version of the privileged ISA specification.
+
- const: smcsrind
description: |
The standard Smcsrind machine-level extension extends the
--
2.53.0-Meta
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH v9 08/20] RISC-V: Add Ssccfg extension CSR definition
2026-08-07 8:08 [PATCH v9 00/20] Add Counter delegation ISA extension support Atish Patra
` (6 preceding siblings ...)
2026-08-07 8:09 ` [PATCH v9 07/20] dt-bindings: riscv: add Smcntrpmf ISA extension description Atish Patra
@ 2026-08-07 8:09 ` Atish Patra
2026-08-07 8:09 ` [PATCH v9 09/20] RISC-V: Add Ssccfg/Smcdeleg ISA extension definition and parsing Atish Patra
` (12 subsequent siblings)
20 siblings, 0 replies; 30+ messages in thread
From: Atish Patra @ 2026-08-07 8:09 UTC (permalink / raw)
To: Will Deacon, Atish Patra, Arnaldo Carvalho de Melo, Anup Patel,
Ian Rogers, Rob Herring, Paul Walmsley, Mark Rutland, Jiri Olsa,
Krzysztof Kozlowski, James Clark, Namhyung Kim
Cc: linux-riscv, linux-arm-kernel, Conor Dooley, linux-kernel,
linux-perf-users, devicetree
From: Kaiwen Xue <kaiwenx@rivosinc.com>
This adds the scountinhibit CSR definition and S-mode accessible hpmevent
bits defined by smcdeleg/ssccfg. scountinhibit allows S-mode to start/stop
counters directly from S-mode without invoking SBI calls to M-mode. It is
also used to figure out the counters delegated to S-mode by the M-mode as
well.
Signed-off-by: Kaiwen Xue <kaiwenx@rivosinc.com>
Reviewed-by: Clément Léger <cleger@rivosinc.com>
Reviewed-by: Charlie Jenkins <thecharlesjenkins@gmail.com>
Tested-by: Charlie Jenkins <thecharlesjenkins@gmail.com>
Link: https://patch.msgid.link/20260701-counter_delegation-v8-8-7909f863a645@meta.com
[pjw@kernel.org: fixed subject typo]
Signed-off-by: Paul Walmsley <pjw@kernel.org>
---
arch/riscv/include/asm/csr.h | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/arch/riscv/include/asm/csr.h b/arch/riscv/include/asm/csr.h
index 7f09e54a0f9a..c8b94f3337c1 100644
--- a/arch/riscv/include/asm/csr.h
+++ b/arch/riscv/include/asm/csr.h
@@ -241,6 +241,23 @@
#define SMSTATEEN0_HSENVCFG (_ULL(1) << SMSTATEEN0_HSENVCFG_SHIFT)
#define SMSTATEEN0_SSTATEEN0_SHIFT 63
#define SMSTATEEN0_SSTATEEN0 (_ULL(1) << SMSTATEEN0_SSTATEEN0_SHIFT)
+/* HPMEVENT bits. These are accessible in S-mode via Smcdeleg/Ssccfg */
+#define HPMEVENT_OF (BIT_ULL(63))
+#define HPMEVENT_MINH (BIT_ULL(62))
+#define HPMEVENT_SINH (BIT_ULL(61))
+#define HPMEVENT_UINH (BIT_ULL(60))
+#define HPMEVENT_VSINH (BIT_ULL(59))
+#define HPMEVENT_VUINH (BIT_ULL(58))
+#ifndef CONFIG_64BIT
+#define HPMEVENTH_OF (BIT(31))
+#define HPMEVENTH_MINH (BIT(30))
+#define HPMEVENTH_SINH (BIT(29))
+#define HPMEVENTH_UINH (BIT(28))
+#define HPMEVENTH_VSINH (BIT(27))
+#define HPMEVENTH_VUINH (BIT(26))
+#endif
+
+#define SISELECT_SSCCFG_BASE 0x40
/* mseccfg bits */
#define MSECCFG_PMM ENVCFG_PMM
@@ -322,6 +339,7 @@
#define CSR_SCOUNTEREN 0x106
#define CSR_SENVCFG 0x10a
#define CSR_SSTATEEN0 0x10c
+#define CSR_SCOUNTINHIBIT 0x120
#define CSR_SSCRATCH 0x140
#define CSR_SEPC 0x141
#define CSR_SCAUSE 0x142
--
2.53.0-Meta
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH v9 09/20] RISC-V: Add Ssccfg/Smcdeleg ISA extension definition and parsing
2026-08-07 8:08 [PATCH v9 00/20] Add Counter delegation ISA extension support Atish Patra
` (7 preceding siblings ...)
2026-08-07 8:09 ` [PATCH v9 08/20] RISC-V: Add Ssccfg extension CSR definition Atish Patra
@ 2026-08-07 8:09 ` Atish Patra
2026-08-07 8:25 ` sashiko-bot
2026-08-07 8:09 ` [PATCH v9 10/20] dt-bindings: riscv: add Counter delegation ISA extensions description Atish Patra
` (11 subsequent siblings)
20 siblings, 1 reply; 30+ messages in thread
From: Atish Patra @ 2026-08-07 8:09 UTC (permalink / raw)
To: Will Deacon, Atish Patra, Arnaldo Carvalho de Melo, Anup Patel,
Ian Rogers, Rob Herring, Paul Walmsley, Mark Rutland, Jiri Olsa,
Krzysztof Kozlowski, James Clark, Namhyung Kim
Cc: linux-riscv, linux-arm-kernel, Conor Dooley, linux-kernel,
linux-perf-users, devicetree
From: Atish Patra <atishp@rivosinc.com>
Smcdeleg extension allows the M-mode to delegate selected counters
to S-mode so that it can access those counters and correpsonding
hpmevent CSRs without M-mode.
Ssccfg (‘Ss’ for Privileged architecture and Supervisor-level
extension, ‘ccfg’ for Counter Configuration) provides access to
delegated counters and new supervisor-level state.
This patch just enables these definitions and enable parsing.
Signed-off-by: Atish Patra <atishp@rivosinc.com>
Link: https://patch.msgid.link/20260701-counter_delegation-v8-9-7909f863a645@meta.com
Signed-off-by: Paul Walmsley <pjw@kernel.org>
Reviewed-by: Charlie Jenkins <thecharlesjenkins@gmail.com>
---
arch/riscv/include/asm/hwcap.h | 2 ++
arch/riscv/kernel/cpufeature.c | 24 ++++++++++++++++++++++++
2 files changed, 26 insertions(+)
diff --git a/arch/riscv/include/asm/hwcap.h b/arch/riscv/include/asm/hwcap.h
index 51ad55b9677a..089353b250b0 100644
--- a/arch/riscv/include/asm/hwcap.h
+++ b/arch/riscv/include/asm/hwcap.h
@@ -115,6 +115,8 @@
#define RISCV_ISA_EXT_SSCSRIND 106
#define RISCV_ISA_EXT_SMCSRIND 107
#define RISCV_ISA_EXT_SMCNTRPMF 108
+#define RISCV_ISA_EXT_SSCCFG 109
+#define RISCV_ISA_EXT_SMCDELEG 110
#define RISCV_ISA_EXT_XLINUXENVCFG 127
diff --git a/arch/riscv/kernel/cpufeature.c b/arch/riscv/kernel/cpufeature.c
index 1452521d740a..1fe647e03515 100644
--- a/arch/riscv/kernel/cpufeature.c
+++ b/arch/riscv/kernel/cpufeature.c
@@ -330,6 +330,27 @@ static const unsigned int riscv_a_exts[] = {
RISCV_ISA_EXT_ZKNE, \
RISCV_ISA_EXT_ZKNH
+static int riscv_ext_smcdeleg_validate(const struct riscv_isa_ext_data *data,
+ const unsigned long *isa_bitmap)
+{
+ if (__riscv_isa_extension_available(isa_bitmap, RISCV_ISA_EXT_SSCSRIND) &&
+ __riscv_isa_extension_available(isa_bitmap, RISCV_ISA_EXT_ZIHPM) &&
+ __riscv_isa_extension_available(isa_bitmap, RISCV_ISA_EXT_ZICNTR))
+ return 0;
+
+ return -EPROBE_DEFER;
+}
+
+static int riscv_ext_ssccfg_validate(const struct riscv_isa_ext_data *data,
+ const unsigned long *isa_bitmap)
+{
+ if (!riscv_ext_smcdeleg_validate(data, isa_bitmap) &&
+ __riscv_isa_extension_available(isa_bitmap, RISCV_ISA_EXT_SMCDELEG))
+ return 0;
+
+ return -EPROBE_DEFER;
+}
+
static const unsigned int riscv_zk_bundled_exts[] = {
RISCV_ISA_EXT_ZKN,
RISCV_ISA_EXT_ZKR,
@@ -576,12 +597,15 @@ const struct riscv_isa_ext_data riscv_isa_ext[] = {
__RISCV_ISA_EXT_BUNDLE_VALIDATE(zvksg, riscv_zvksg_bundled_exts, riscv_ext_vector_crypto_validate),
__RISCV_ISA_EXT_DATA_VALIDATE(zvkt, RISCV_ISA_EXT_ZVKT, riscv_ext_vector_crypto_validate),
__RISCV_ISA_EXT_DATA(smaia, RISCV_ISA_EXT_SMAIA),
+ __RISCV_ISA_EXT_DATA_VALIDATE(smcdeleg, RISCV_ISA_EXT_SMCDELEG,
+ riscv_ext_smcdeleg_validate),
__RISCV_ISA_EXT_DATA(smcntrpmf, RISCV_ISA_EXT_SMCNTRPMF),
__RISCV_ISA_EXT_DATA(smcsrind, RISCV_ISA_EXT_SMCSRIND),
__RISCV_ISA_EXT_DATA(smmpm, RISCV_ISA_EXT_SMMPM),
__RISCV_ISA_EXT_SUPERSET(smnpm, RISCV_ISA_EXT_SMNPM, riscv_xlinuxenvcfg_exts),
__RISCV_ISA_EXT_DATA(smstateen, RISCV_ISA_EXT_SMSTATEEN),
__RISCV_ISA_EXT_DATA(ssaia, RISCV_ISA_EXT_SSAIA),
+ __RISCV_ISA_EXT_DATA_VALIDATE(ssccfg, RISCV_ISA_EXT_SSCCFG, riscv_ext_ssccfg_validate),
__RISCV_ISA_EXT_DATA(sscofpmf, RISCV_ISA_EXT_SSCOFPMF),
__RISCV_ISA_EXT_DATA(sscsrind, RISCV_ISA_EXT_SSCSRIND),
__RISCV_ISA_EXT_SUPERSET(ssnpm, RISCV_ISA_EXT_SSNPM, riscv_xlinuxenvcfg_exts),
--
2.53.0-Meta
^ permalink raw reply related [flat|nested] 30+ messages in thread* Re: [PATCH v9 09/20] RISC-V: Add Ssccfg/Smcdeleg ISA extension definition and parsing
2026-08-07 8:09 ` [PATCH v9 09/20] RISC-V: Add Ssccfg/Smcdeleg ISA extension definition and parsing Atish Patra
@ 2026-08-07 8:25 ` sashiko-bot
0 siblings, 0 replies; 30+ messages in thread
From: sashiko-bot @ 2026-08-07 8:25 UTC (permalink / raw)
To: Atish Patra; +Cc: linux-perf-users, robh, devicetree, conor+dt
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] Ssccfg validation incorrectly depends on the machine-mode extension SMCDELEG, breaking virtualization.
- [Medium] Smcdeleg validation incorrectly checks for the supervisor-mode extension SSCSRIND instead of the machine-mode variant SMCSRIND.
--
--- Patch [9]: [PATCH v9 09/20] RISC-V: Add Ssccfg/Smcdeleg ISA extension definition and parsing ---
commit e656dfc58bff7f1b23f61ced28dbec6228def44b
Author: Atish Patra <atishp@rivosinc.com>
RISC-V: Add Ssccfg/Smcdeleg ISA extension definition and parsing
Smcdeleg extension allows the M-mode to delegate selected counters
to S-mode so that it can access those counters and correpsonding
hpmevent CSRs without M-mode. Ssccfg provides access to delegated
counters and new supervisor-level state. This patch enables these
definitions and parsing.
Link: https://patch.msgid.link/20260701-counter_delegation-v8-9-7909f863a645@meta.com
> diff --git a/arch/riscv/kernel/cpufeature.c b/arch/riscv/kernel/cpufeature.c
> index 1452521d740a6..1fe647e035157 100644
> --- a/arch/riscv/kernel/cpufeature.c
> +++ b/arch/riscv/kernel/cpufeature.c
> @@ -330,6 +330,27 @@ static const unsigned int riscv_a_exts[] = {
> RISCV_ISA_EXT_ZKNE, \
> RISCV_ISA_EXT_ZKNH
>
> +static int riscv_ext_smcdeleg_validate(const struct riscv_isa_ext_data *data,
> + const unsigned long *isa_bitmap)
> +{
> + if (__riscv_isa_extension_available(isa_bitmap, RISCV_ISA_EXT_SSCSRIND) &&
[Severity: Medium]
Should this check for the machine-mode extension RISCV_ISA_EXT_SMCSRIND
instead?
Validating a machine-mode extension (Smcdeleg) against a supervisor-mode
dependency (SSCSRIND) seems semantically incorrect according to the RISC-V
specification, which usually ties M-mode extensions to M-mode prerequisites.
> + __riscv_isa_extension_available(isa_bitmap, RISCV_ISA_EXT_ZIHPM) &&
> + __riscv_isa_extension_available(isa_bitmap, RISCV_ISA_EXT_ZICNTR))
> + return 0;
> +
> + return -EPROBE_DEFER;
> +}
> +
> +static int riscv_ext_ssccfg_validate(const struct riscv_isa_ext_data *data,
> + const unsigned long *isa_bitmap)
> +{
> + if (!riscv_ext_smcdeleg_validate(data, isa_bitmap) &&
> + __riscv_isa_extension_available(isa_bitmap, RISCV_ISA_EXT_SMCDELEG))
[Severity: High]
Will this check cause the Ssccfg extension to fail validation when running as
a guest VM?
Since a hypervisor (HS-mode) exposes the supervisor-level Ssccfg extension to
the guest (VS-mode) but omits machine-mode extensions like SMCDELEG,
requiring SMCDELEG to be present in the ISA bitmap means Ssccfg will return
-EPROBE_DEFER.
This appears to break performance counter configuration in virtualized
environments where M-mode extensions are structurally impossible for the guest
to possess.
> + return 0;
> +
> + return -EPROBE_DEFER;
> +}
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260807-counter_delegation-v9-0-58658104e487@meta.com?part=9
^ permalink raw reply [flat|nested] 30+ messages in thread
* [PATCH v9 10/20] dt-bindings: riscv: add Counter delegation ISA extensions description
2026-08-07 8:08 [PATCH v9 00/20] Add Counter delegation ISA extension support Atish Patra
` (8 preceding siblings ...)
2026-08-07 8:09 ` [PATCH v9 09/20] RISC-V: Add Ssccfg/Smcdeleg ISA extension definition and parsing Atish Patra
@ 2026-08-07 8:09 ` Atish Patra
2026-08-07 8:09 ` [PATCH v9 11/20] RISC-V: perf: Restructure the SBI PMU code Atish Patra
` (10 subsequent siblings)
20 siblings, 0 replies; 30+ messages in thread
From: Atish Patra @ 2026-08-07 8:09 UTC (permalink / raw)
To: Will Deacon, Atish Patra, Arnaldo Carvalho de Melo, Anup Patel,
Ian Rogers, Rob Herring, Paul Walmsley, Mark Rutland, Jiri Olsa,
Krzysztof Kozlowski, James Clark, Namhyung Kim
Cc: linux-riscv, linux-arm-kernel, Conor Dooley, linux-kernel,
linux-perf-users, devicetree
From: Atish Patra <atishp@rivosinc.com>
Add description for the Smcdeleg/Ssccfg extension.
Signed-off-by: Atish Patra <atishp@rivosinc.com>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Link: https://patch.msgid.link/20260701-counter_delegation-v8-10-7909f863a645@meta.com
Signed-off-by: Paul Walmsley <pjw@kernel.org>
---
.../devicetree/bindings/riscv/extensions.yaml | 41 ++++++++++++++++++++++
1 file changed, 41 insertions(+)
diff --git a/Documentation/devicetree/bindings/riscv/extensions.yaml b/Documentation/devicetree/bindings/riscv/extensions.yaml
index eee65cf73d6c..24efd3e1cf8e 100644
--- a/Documentation/devicetree/bindings/riscv/extensions.yaml
+++ b/Documentation/devicetree/bindings/riscv/extensions.yaml
@@ -181,6 +181,13 @@ properties:
changes to interrupts as frozen at commit ccbddab ("Merge pull
request #42 from riscv/jhauser-2023-RC4") of riscv-aia.
+ - const: smcdeleg
+ description: |
+ The standard Smcdeleg machine-level extension for the machine mode
+ to delegate the hpmcounters to supervisor mode so that they are
+ directly accessible in the supervisor mode as ratified in the
+ 20240213 version of the privileged ISA specification.
+
- const: smcntrpmf
description: |
The standard Smcntrpmf machine-level extension for the machine mode
@@ -220,6 +227,14 @@ properties:
behavioural changes to interrupts as frozen at commit ccbddab
("Merge pull request #42 from riscv/jhauser-2023-RC4") of riscv-aia.
+ - const: ssccfg
+ description: |
+ The standard Ssccfg supervisor-level extension for configuring
+ the delegated hpmcounters to be accessible directly in supervisor
+ mode as ratified in the 20240213 version of the privileged ISA
+ specification. This extension depends on Sscsrind, Smcdeleg, Zihpm,
+ Zicntr extensions.
+
- const: ssccptr
description: |
The standard Ssccptr extension for main memory (cacheability and
@@ -1135,6 +1150,32 @@ properties:
allOf:
- const: zilsd
- const: zca
+ # Smcdeleg depends on Sscsrind, Zihpm, Zicntr
+ - if:
+ contains:
+ const: smcdeleg
+ then:
+ allOf:
+ - contains:
+ const: sscsrind
+ - contains:
+ const: zihpm
+ - contains:
+ const: zicntr
+ # Ssccfg depends on Smcdeleg, Sscsrind, Zihpm, Zicntr
+ - if:
+ contains:
+ const: ssccfg
+ then:
+ allOf:
+ - contains:
+ const: smcdeleg
+ - contains:
+ const: sscsrind
+ - contains:
+ const: zihpm
+ - contains:
+ const: zicntr
allOf:
# Zcf extension does not exist on rv64
--
2.53.0-Meta
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH v9 11/20] RISC-V: perf: Restructure the SBI PMU code
2026-08-07 8:08 [PATCH v9 00/20] Add Counter delegation ISA extension support Atish Patra
` (9 preceding siblings ...)
2026-08-07 8:09 ` [PATCH v9 10/20] dt-bindings: riscv: add Counter delegation ISA extensions description Atish Patra
@ 2026-08-07 8:09 ` Atish Patra
2026-08-07 8:09 ` [PATCH v9 12/20] RISC-V: perf: Modify the counter discovery mechanism Atish Patra
` (9 subsequent siblings)
20 siblings, 0 replies; 30+ messages in thread
From: Atish Patra @ 2026-08-07 8:09 UTC (permalink / raw)
To: Will Deacon, Atish Patra, Arnaldo Carvalho de Melo, Anup Patel,
Ian Rogers, Rob Herring, Paul Walmsley, Mark Rutland, Jiri Olsa,
Krzysztof Kozlowski, James Clark, Namhyung Kim
Cc: linux-riscv, linux-arm-kernel, Conor Dooley, linux-kernel,
linux-perf-users, devicetree
From: Atish Patra <atishp@rivosinc.com>
With Ssccfg/Smcdeleg, supervisor mode can program and access the
hpmcounters and events directly, without the SBI PMU extension. The SBI
PMU extension is still required for firmware counters. Restructure the
existing SBI PMU code so the hpmcounter/event helpers can be shared
between the SBI and the counter delegation paths that follow.
The driver, file, module and Kconfig names are intentionally kept
unchanged to avoid backport churn and userspace breakage (module listings,
udev rules, cmdline options).
No functional change intended.
Signed-off-by: Atish Patra <atishp@rivosinc.com>
---
drivers/perf/Kconfig | 14 ++-
drivers/perf/riscv_pmu_sbi.c | 238 +++++++++++++++++++++++++------------------
2 files changed, 150 insertions(+), 102 deletions(-)
diff --git a/drivers/perf/Kconfig b/drivers/perf/Kconfig
index 245e7bb763b9..190cf0ee7065 100644
--- a/drivers/perf/Kconfig
+++ b/drivers/perf/Kconfig
@@ -97,13 +97,17 @@ config RISCV_PMU_LEGACY
config RISCV_PMU_SBI
depends on RISCV_PMU && RISCV_SBI
- bool "RISC-V PMU based on SBI PMU extension"
+ bool "RISC-V PMU based on SBI PMU extension and/or counter delegation"
default y
help
- Say y if you want to use the CPU performance monitor
- using SBI PMU extension on RISC-V based systems. This option provides
- full perf feature support i.e. counter overflow, privilege mode
- filtering, counter configuration.
+ Say y if you want to use the CPU performance monitor on RISC-V based
+ systems. This single driver supports both hardware counter access
+ mechanisms: it uses the counter delegation (Smcdeleg/Ssccfg) ISA
+ extension to program and read the hpmcounters directly in supervisor
+ mode when available, and uses the SBI PMU extension for firmware
+ counters and when counter delegation is not present. This option
+ provides full perf feature support i.e. counter overflow, privilege
+ mode filtering, counter configuration.
config STARFIVE_STARLINK_PMU
depends on ARCH_STARFIVE || COMPILE_TEST
diff --git a/drivers/perf/riscv_pmu_sbi.c b/drivers/perf/riscv_pmu_sbi.c
index 50220f7b46d9..a8a197d341c3 100644
--- a/drivers/perf/riscv_pmu_sbi.c
+++ b/drivers/perf/riscv_pmu_sbi.c
@@ -87,6 +87,8 @@ static const struct attribute_group *riscv_pmu_attr_groups[] = {
static int sysctl_perf_user_access __read_mostly = SYSCTL_USER_ACCESS;
/*
+ * This structure is SBI specific but counter delegation also require counter
+ * width, csr mapping. Reuse it for now.
* RISC-V doesn't have heterogeneous harts yet. This need to be part of
* per_cpu in case of harts with different pmu counters
*/
@@ -99,7 +101,7 @@ static unsigned int riscv_pmu_irq;
/* Cache the available counters in a bitmask */
static unsigned long cmask;
-static int pmu_event_find_cache(u64 config);
+static int sbi_pmu_event_find_cache(u64 config);
struct sbi_pmu_event_data {
union {
union {
@@ -120,7 +122,7 @@ struct sbi_pmu_event_data {
};
};
-static struct sbi_pmu_event_data pmu_hw_event_map[] = {
+static struct sbi_pmu_event_data pmu_hw_event_sbi_map[] = {
[PERF_COUNT_HW_CPU_CYCLES] = {.hw_gen_event = {
SBI_PMU_HW_CPU_CYCLES,
SBI_PMU_EVENT_TYPE_HW, 0}},
@@ -154,7 +156,7 @@ static struct sbi_pmu_event_data pmu_hw_event_map[] = {
};
#define C(x) PERF_COUNT_HW_CACHE_##x
-static struct sbi_pmu_event_data pmu_cache_event_map[PERF_COUNT_HW_CACHE_MAX]
+static struct sbi_pmu_event_data pmu_cache_event_sbi_map[PERF_COUNT_HW_CACHE_MAX]
[PERF_COUNT_HW_CACHE_OP_MAX]
[PERF_COUNT_HW_CACHE_RESULT_MAX] = {
[C(L1D)] = {
@@ -301,7 +303,7 @@ static struct sbi_pmu_event_data pmu_cache_event_map[PERF_COUNT_HW_CACHE_MAX]
static int pmu_sbi_check_event_info(void)
{
- int num_events = ARRAY_SIZE(pmu_hw_event_map) + PERF_COUNT_HW_CACHE_MAX *
+ int num_events = ARRAY_SIZE(pmu_hw_event_sbi_map) + PERF_COUNT_HW_CACHE_MAX *
PERF_COUNT_HW_CACHE_OP_MAX * PERF_COUNT_HW_CACHE_RESULT_MAX;
struct riscv_pmu_event_info *event_info_shmem;
phys_addr_t base_addr;
@@ -312,14 +314,14 @@ static int pmu_sbi_check_event_info(void)
if (!event_info_shmem)
return -ENOMEM;
- for (i = 0; i < ARRAY_SIZE(pmu_hw_event_map); i++)
- event_info_shmem[count++].event_idx = pmu_hw_event_map[i].event_idx;
+ for (i = 0; i < ARRAY_SIZE(pmu_hw_event_sbi_map); i++)
+ event_info_shmem[count++].event_idx = pmu_hw_event_sbi_map[i].event_idx;
- for (i = 0; i < ARRAY_SIZE(pmu_cache_event_map); i++) {
- for (j = 0; j < ARRAY_SIZE(pmu_cache_event_map[i]); j++) {
- for (k = 0; k < ARRAY_SIZE(pmu_cache_event_map[i][j]); k++)
+ for (i = 0; i < ARRAY_SIZE(pmu_cache_event_sbi_map); i++) {
+ for (j = 0; j < ARRAY_SIZE(pmu_cache_event_sbi_map[i]); j++) {
+ for (k = 0; k < ARRAY_SIZE(pmu_cache_event_sbi_map[i][j]); k++)
event_info_shmem[count++].event_idx =
- pmu_cache_event_map[i][j][k].event_idx;
+ pmu_cache_event_sbi_map[i][j][k].event_idx;
}
}
@@ -335,19 +337,19 @@ static int pmu_sbi_check_event_info(void)
goto free_mem;
}
- for (i = 0; i < ARRAY_SIZE(pmu_hw_event_map); i++) {
+ for (i = 0; i < ARRAY_SIZE(pmu_hw_event_sbi_map); i++) {
if (!(event_info_shmem[i].output & RISCV_PMU_EVENT_INFO_OUTPUT_MASK))
- pmu_hw_event_map[i].event_idx = -ENOENT;
+ pmu_hw_event_sbi_map[i].event_idx = -ENOENT;
}
- count = ARRAY_SIZE(pmu_hw_event_map);
+ count = ARRAY_SIZE(pmu_hw_event_sbi_map);
- for (i = 0; i < ARRAY_SIZE(pmu_cache_event_map); i++) {
- for (j = 0; j < ARRAY_SIZE(pmu_cache_event_map[i]); j++) {
- for (k = 0; k < ARRAY_SIZE(pmu_cache_event_map[i][j]); k++) {
+ for (i = 0; i < ARRAY_SIZE(pmu_cache_event_sbi_map); i++) {
+ for (j = 0; j < ARRAY_SIZE(pmu_cache_event_sbi_map[i]); j++) {
+ for (k = 0; k < ARRAY_SIZE(pmu_cache_event_sbi_map[i][j]); k++) {
if (!(event_info_shmem[count].output &
RISCV_PMU_EVENT_INFO_OUTPUT_MASK))
- pmu_cache_event_map[i][j][k].event_idx = -ENOENT;
+ pmu_cache_event_sbi_map[i][j][k].event_idx = -ENOENT;
count++;
}
}
@@ -359,7 +361,7 @@ static int pmu_sbi_check_event_info(void)
return result;
}
-static void pmu_sbi_check_event(struct sbi_pmu_event_data *edata)
+static void rvpmu_sbi_check_event(struct sbi_pmu_event_data *edata)
{
struct sbiret ret;
@@ -374,7 +376,7 @@ static void pmu_sbi_check_event(struct sbi_pmu_event_data *edata)
}
}
-static void pmu_sbi_check_std_events(struct work_struct *work)
+static void rvpmu_sbi_check_std_events(struct work_struct *work)
{
int ret;
@@ -385,23 +387,23 @@ static void pmu_sbi_check_std_events(struct work_struct *work)
return;
}
- for (int i = 0; i < ARRAY_SIZE(pmu_hw_event_map); i++)
- pmu_sbi_check_event(&pmu_hw_event_map[i]);
+ for (int i = 0; i < ARRAY_SIZE(pmu_hw_event_sbi_map); i++)
+ rvpmu_sbi_check_event(&pmu_hw_event_sbi_map[i]);
- for (int i = 0; i < ARRAY_SIZE(pmu_cache_event_map); i++)
- for (int j = 0; j < ARRAY_SIZE(pmu_cache_event_map[i]); j++)
- for (int k = 0; k < ARRAY_SIZE(pmu_cache_event_map[i][j]); k++)
- pmu_sbi_check_event(&pmu_cache_event_map[i][j][k]);
+ for (int i = 0; i < ARRAY_SIZE(pmu_cache_event_sbi_map); i++)
+ for (int j = 0; j < ARRAY_SIZE(pmu_cache_event_sbi_map[i]); j++)
+ for (int k = 0; k < ARRAY_SIZE(pmu_cache_event_sbi_map[i][j]); k++)
+ rvpmu_sbi_check_event(&pmu_cache_event_sbi_map[i][j][k]);
}
-static DECLARE_WORK(check_std_events_work, pmu_sbi_check_std_events);
+static DECLARE_WORK(check_std_events_work, rvpmu_sbi_check_std_events);
-static int pmu_sbi_ctr_get_width(int idx)
+static int rvpmu_ctr_get_width(int idx)
{
return pmu_ctr_list[idx].width;
}
-static bool pmu_sbi_ctr_is_fw(int cidx)
+static bool rvpmu_ctr_is_fw(int cidx)
{
union sbi_pmu_ctr_info *info;
@@ -420,10 +422,10 @@ int riscv_pmu_get_event_info(u32 type, u64 config, u64 *econfig)
case PERF_TYPE_HARDWARE:
if (config >= PERF_COUNT_HW_MAX)
return -EINVAL;
- ret = pmu_hw_event_map[config].event_idx;
+ ret = pmu_hw_event_sbi_map[config].event_idx;
break;
case PERF_TYPE_HW_CACHE:
- ret = pmu_event_find_cache(config);
+ ret = sbi_pmu_event_find_cache(config);
break;
case PERF_TYPE_RAW:
/*
@@ -508,12 +510,12 @@ int riscv_pmu_get_hpm_info(u32 *hw_ctr_width, u32 *num_hw_ctr)
}
EXPORT_SYMBOL_GPL(riscv_pmu_get_hpm_info);
-static uint8_t pmu_sbi_csr_index(struct perf_event *event)
+static uint8_t rvpmu_csr_index(struct perf_event *event)
{
return pmu_ctr_list[event->hw.idx].csr - CSR_CYCLE;
}
-static unsigned long pmu_sbi_get_filter_flags(struct perf_event *event)
+static unsigned long rvpmu_sbi_get_filter_flags(struct perf_event *event)
{
unsigned long cflags = 0;
bool guest_events = false;
@@ -534,7 +536,7 @@ static unsigned long pmu_sbi_get_filter_flags(struct perf_event *event)
return cflags;
}
-static int pmu_sbi_ctr_get_idx(struct perf_event *event)
+static int rvpmu_sbi_ctr_get_idx(struct perf_event *event)
{
struct hw_perf_event *hwc = &event->hw;
struct riscv_pmu *rvpmu = to_riscv_pmu(event->pmu);
@@ -544,7 +546,7 @@ static int pmu_sbi_ctr_get_idx(struct perf_event *event)
uint64_t cbase = 0, cmask = rvpmu->cmask;
unsigned long cflags = 0;
- cflags = pmu_sbi_get_filter_flags(event);
+ cflags = rvpmu_sbi_get_filter_flags(event);
/*
* In legacy mode, we have to force the fixed counters for those events
@@ -581,7 +583,7 @@ static int pmu_sbi_ctr_get_idx(struct perf_event *event)
return -ENOENT;
/* Additional sanity check for the counter id */
- if (pmu_sbi_ctr_is_fw(idx)) {
+ if (rvpmu_ctr_is_fw(idx)) {
if (!test_and_set_bit(idx, cpuc->used_fw_ctrs))
return idx;
} else {
@@ -592,7 +594,7 @@ static int pmu_sbi_ctr_get_idx(struct perf_event *event)
return -ENOENT;
}
-static void pmu_sbi_ctr_clear_idx(struct perf_event *event)
+static void rvpmu_ctr_clear_idx(struct perf_event *event)
{
struct hw_perf_event *hwc = &event->hw;
@@ -600,13 +602,13 @@ static void pmu_sbi_ctr_clear_idx(struct perf_event *event)
struct cpu_hw_events *cpuc = this_cpu_ptr(rvpmu->hw_events);
int idx = hwc->idx;
- if (pmu_sbi_ctr_is_fw(idx))
+ if (rvpmu_ctr_is_fw(idx))
clear_bit(idx, cpuc->used_fw_ctrs);
else
clear_bit(idx, cpuc->used_hw_ctrs);
}
-static int pmu_event_find_cache(u64 config)
+static int sbi_pmu_event_find_cache(u64 config)
{
unsigned int cache_type, cache_op, cache_result, ret;
@@ -622,7 +624,7 @@ static int pmu_event_find_cache(u64 config)
if (cache_result >= PERF_COUNT_HW_CACHE_RESULT_MAX)
return -EINVAL;
- ret = pmu_cache_event_map[cache_type][cache_op][cache_result].event_idx;
+ ret = pmu_cache_event_sbi_map[cache_type][cache_op][cache_result].event_idx;
return ret;
}
@@ -638,7 +640,7 @@ static bool pmu_sbi_is_fw_event(struct perf_event *event)
return false;
}
-static int pmu_sbi_event_map(struct perf_event *event, u64 *econfig)
+static int rvpmu_sbi_event_map(struct perf_event *event, u64 *econfig)
{
u32 type = event->attr.type;
u64 config = event->attr.config;
@@ -735,7 +737,7 @@ static int pmu_sbi_snapshot_setup(struct riscv_pmu *pmu, int cpu)
return 0;
}
-static u64 pmu_sbi_ctr_read(struct perf_event *event)
+static u64 rvpmu_sbi_ctr_read(struct perf_event *event)
{
struct hw_perf_event *hwc = &event->hw;
int idx = hwc->idx;
@@ -777,25 +779,25 @@ static u64 pmu_sbi_ctr_read(struct perf_event *event)
return val;
}
-static void pmu_sbi_set_scounteren(void *arg)
+static void rvpmu_set_scounteren(void *arg)
{
struct perf_event *event = (struct perf_event *)arg;
if (event->hw.idx != -1)
csr_write(CSR_SCOUNTEREN,
- csr_read(CSR_SCOUNTEREN) | BIT(pmu_sbi_csr_index(event)));
+ csr_read(CSR_SCOUNTEREN) | BIT(rvpmu_csr_index(event)));
}
-static void pmu_sbi_reset_scounteren(void *arg)
+static void rvpmu_reset_scounteren(void *arg)
{
struct perf_event *event = (struct perf_event *)arg;
if (event->hw.idx != -1)
csr_write(CSR_SCOUNTEREN,
- csr_read(CSR_SCOUNTEREN) & ~BIT(pmu_sbi_csr_index(event)));
+ csr_read(CSR_SCOUNTEREN) & ~BIT(rvpmu_csr_index(event)));
}
-static void pmu_sbi_ctr_start(struct perf_event *event, u64 ival)
+static void rvpmu_sbi_ctr_start(struct perf_event *event, u64 ival)
{
struct sbiret ret;
struct hw_perf_event *hwc = &event->hw;
@@ -815,10 +817,10 @@ static void pmu_sbi_ctr_start(struct perf_event *event, u64 ival)
if ((hwc->flags & PERF_EVENT_FLAG_USER_ACCESS) &&
(hwc->flags & PERF_EVENT_FLAG_USER_READ_CNT))
- pmu_sbi_set_scounteren((void *)event);
+ rvpmu_set_scounteren((void *)event);
}
-static void pmu_sbi_ctr_stop(struct perf_event *event, unsigned long flag)
+static void rvpmu_sbi_ctr_stop(struct perf_event *event, unsigned long flag)
{
struct sbiret ret;
struct hw_perf_event *hwc = &event->hw;
@@ -828,7 +830,7 @@ static void pmu_sbi_ctr_stop(struct perf_event *event, unsigned long flag)
if ((hwc->flags & PERF_EVENT_FLAG_USER_ACCESS) &&
(hwc->flags & PERF_EVENT_FLAG_USER_READ_CNT))
- pmu_sbi_reset_scounteren((void *)event);
+ rvpmu_reset_scounteren((void *)event);
if (sbi_pmu_snapshot_available())
flag |= SBI_PMU_STOP_FLAG_TAKE_SNAPSHOT;
@@ -854,7 +856,7 @@ static void pmu_sbi_ctr_stop(struct perf_event *event, unsigned long flag)
}
}
-static int pmu_sbi_find_num_ctrs(void)
+static int rvpmu_sbi_find_num_ctrs(void)
{
struct sbiret ret;
@@ -865,7 +867,7 @@ static int pmu_sbi_find_num_ctrs(void)
return sbi_err_map_linux_errno(ret.error);
}
-static int pmu_sbi_get_ctrinfo(int nctr, unsigned long *mask)
+static int rvpmu_sbi_get_ctrinfo(int nctr, unsigned long *mask)
{
struct sbiret ret;
int i, num_hw_ctr = 0, num_fw_ctr = 0;
@@ -896,7 +898,7 @@ static int pmu_sbi_get_ctrinfo(int nctr, unsigned long *mask)
return 0;
}
-static inline void pmu_sbi_stop_all(struct riscv_pmu *pmu)
+static inline void rvpmu_sbi_stop_all(struct riscv_pmu *pmu)
{
/*
* No need to check the error because we are disabling all the counters
@@ -906,7 +908,7 @@ static inline void pmu_sbi_stop_all(struct riscv_pmu *pmu)
0, pmu->cmask, SBI_PMU_STOP_FLAG_RESET, 0, 0, 0);
}
-static inline void pmu_sbi_stop_hw_ctrs(struct riscv_pmu *pmu)
+static inline void rvpmu_sbi_stop_hw_ctrs(struct riscv_pmu *pmu)
{
struct cpu_hw_events *cpu_hw_evt = this_cpu_ptr(pmu->hw_events);
struct riscv_pmu_snapshot_data *sdata = cpu_hw_evt->snapshot_addr;
@@ -950,8 +952,8 @@ static inline void pmu_sbi_stop_hw_ctrs(struct riscv_pmu *pmu)
* while the overflowed counters need to be started with updated initialization
* value.
*/
-static inline void pmu_sbi_start_ovf_ctrs_sbi(struct cpu_hw_events *cpu_hw_evt,
- u64 ctr_ovf_mask)
+static inline void rvpmu_sbi_start_ovf_ctrs_sbi(struct cpu_hw_events *cpu_hw_evt,
+ u64 ctr_ovf_mask)
{
int idx = 0, i;
struct perf_event *event;
@@ -991,8 +993,8 @@ static inline void pmu_sbi_start_ovf_ctrs_sbi(struct cpu_hw_events *cpu_hw_evt,
}
}
-static inline void pmu_sbi_start_ovf_ctrs_snapshot(struct cpu_hw_events *cpu_hw_evt,
- u64 ctr_ovf_mask)
+static inline void rvpmu_sbi_start_ovf_ctrs_snapshot(struct cpu_hw_events *cpu_hw_evt,
+ u64 ctr_ovf_mask)
{
int i, idx = 0;
struct perf_event *event;
@@ -1026,18 +1028,18 @@ static inline void pmu_sbi_start_ovf_ctrs_snapshot(struct cpu_hw_events *cpu_hw_
}
}
-static void pmu_sbi_start_overflow_mask(struct riscv_pmu *pmu,
- u64 ctr_ovf_mask)
+static void rvpmu_sbi_start_overflow_mask(struct riscv_pmu *pmu,
+ u64 ctr_ovf_mask)
{
struct cpu_hw_events *cpu_hw_evt = this_cpu_ptr(pmu->hw_events);
if (sbi_pmu_snapshot_available())
- pmu_sbi_start_ovf_ctrs_snapshot(cpu_hw_evt, ctr_ovf_mask);
+ rvpmu_sbi_start_ovf_ctrs_snapshot(cpu_hw_evt, ctr_ovf_mask);
else
- pmu_sbi_start_ovf_ctrs_sbi(cpu_hw_evt, ctr_ovf_mask);
+ rvpmu_sbi_start_ovf_ctrs_sbi(cpu_hw_evt, ctr_ovf_mask);
}
-static irqreturn_t pmu_sbi_ovf_handler(int irq, void *dev)
+static irqreturn_t rvpmu_ovf_handler(int irq, void *dev)
{
struct perf_sample_data data;
struct pt_regs *regs;
@@ -1069,7 +1071,7 @@ static irqreturn_t pmu_sbi_ovf_handler(int irq, void *dev)
}
pmu = to_riscv_pmu(event->pmu);
- pmu_sbi_stop_hw_ctrs(pmu);
+ rvpmu_sbi_stop_hw_ctrs(pmu);
/* Overflow status register should only be read after counter are stopped */
if (sbi_pmu_snapshot_available())
@@ -1138,13 +1140,55 @@ static irqreturn_t pmu_sbi_ovf_handler(int irq, void *dev)
hw_evt->state = 0;
}
- pmu_sbi_start_overflow_mask(pmu, overflowed_ctrs);
+ rvpmu_sbi_start_overflow_mask(pmu, overflowed_ctrs);
perf_sample_event_took(sched_clock() - start_clock);
return IRQ_HANDLED;
}
-static int pmu_sbi_starting_cpu(unsigned int cpu, struct hlist_node *node)
+static void rvpmu_ctr_start(struct perf_event *event, u64 ival)
+{
+ rvpmu_sbi_ctr_start(event, ival);
+ /* TODO: Counter delegation implementation */
+}
+
+static void rvpmu_ctr_stop(struct perf_event *event, unsigned long flag)
+{
+ rvpmu_sbi_ctr_stop(event, flag);
+ /* TODO: Counter delegation implementation */
+}
+
+static int rvpmu_find_num_ctrs(void)
+{
+ return rvpmu_sbi_find_num_ctrs();
+ /* TODO: Counter delegation implementation */
+}
+
+static int rvpmu_get_ctrinfo(int nctr, unsigned long *mask)
+{
+ return rvpmu_sbi_get_ctrinfo(nctr, mask);
+ /* TODO: Counter delegation implementation */
+}
+
+static int rvpmu_event_map(struct perf_event *event, u64 *econfig)
+{
+ return rvpmu_sbi_event_map(event, econfig);
+ /* TODO: Counter delegation implementation */
+}
+
+static int rvpmu_ctr_get_idx(struct perf_event *event)
+{
+ return rvpmu_sbi_ctr_get_idx(event);
+ /* TODO: Counter delegation implementation */
+}
+
+static u64 rvpmu_ctr_read(struct perf_event *event)
+{
+ return rvpmu_sbi_ctr_read(event);
+ /* TODO: Counter delegation implementation */
+}
+
+static int rvpmu_starting_cpu(unsigned int cpu, struct hlist_node *node)
{
struct riscv_pmu *pmu = hlist_entry_safe(node, struct riscv_pmu, node);
struct cpu_hw_events *cpu_hw_evt = this_cpu_ptr(pmu->hw_events);
@@ -1159,7 +1203,7 @@ static int pmu_sbi_starting_cpu(unsigned int cpu, struct hlist_node *node)
csr_write(CSR_SCOUNTEREN, 0x2);
/* Stop all the counters so that they can be enabled from perf */
- pmu_sbi_stop_all(pmu);
+ rvpmu_sbi_stop_all(pmu);
if (riscv_pmu_use_irq) {
cpu_hw_evt->irq = riscv_pmu_irq;
@@ -1173,7 +1217,7 @@ static int pmu_sbi_starting_cpu(unsigned int cpu, struct hlist_node *node)
return 0;
}
-static int pmu_sbi_dying_cpu(unsigned int cpu, struct hlist_node *node)
+static int rvpmu_dying_cpu(unsigned int cpu, struct hlist_node *node)
{
if (riscv_pmu_use_irq) {
disable_percpu_irq(riscv_pmu_irq);
@@ -1188,7 +1232,7 @@ static int pmu_sbi_dying_cpu(unsigned int cpu, struct hlist_node *node)
return 0;
}
-static int pmu_sbi_setup_irqs(struct riscv_pmu *pmu, struct platform_device *pdev)
+static int rvpmu_setup_irqs(struct riscv_pmu *pmu, struct platform_device *pdev)
{
int ret;
struct cpu_hw_events __percpu *hw_events = pmu->hw_events;
@@ -1230,7 +1274,7 @@ static int pmu_sbi_setup_irqs(struct riscv_pmu *pmu, struct platform_device *pde
goto err;
}
- ret = request_percpu_irq(riscv_pmu_irq, pmu_sbi_ovf_handler, "riscv-pmu", hw_events);
+ ret = request_percpu_irq(riscv_pmu_irq, rvpmu_ovf_handler, "riscv-pmu", hw_events);
if (ret) {
pr_err("registering percpu irq failed [%d]\n", ret);
irq_dispose_mapping(riscv_pmu_irq);
@@ -1312,7 +1356,7 @@ static void riscv_pmu_destroy(struct riscv_pmu *pmu)
cpuhp_state_remove_instance(CPUHP_AP_PERF_RISCV_STARTING, &pmu->node);
}
-static void pmu_sbi_event_init(struct perf_event *event)
+static void rvpmu_event_init(struct perf_event *event)
{
/*
* The permissions are set at event_init so that we do not depend
@@ -1326,7 +1370,7 @@ static void pmu_sbi_event_init(struct perf_event *event)
event->hw.flags |= PERF_EVENT_FLAG_LEGACY;
}
-static void pmu_sbi_event_mapped(struct perf_event *event, struct mm_struct *mm)
+static void rvpmu_event_mapped(struct perf_event *event, struct mm_struct *mm)
{
if (event->hw.flags & PERF_EVENT_FLAG_NO_USER_ACCESS)
return;
@@ -1354,14 +1398,14 @@ static void pmu_sbi_event_mapped(struct perf_event *event, struct mm_struct *mm)
* that it is possible to do so to avoid any race.
* And we must notify all cpus here because threads that currently run
* on other cpus will try to directly access the counter too without
- * calling pmu_sbi_ctr_start.
+ * calling rvpmu_sbi_ctr_start.
*/
if (event->hw.flags & PERF_EVENT_FLAG_USER_ACCESS)
on_each_cpu_mask(mm_cpumask(mm),
- pmu_sbi_set_scounteren, (void *)event, 1);
+ rvpmu_set_scounteren, (void *)event, 1);
}
-static void pmu_sbi_event_unmapped(struct perf_event *event, struct mm_struct *mm)
+static void rvpmu_event_unmapped(struct perf_event *event, struct mm_struct *mm)
{
if (event->hw.flags & PERF_EVENT_FLAG_NO_USER_ACCESS)
return;
@@ -1383,7 +1427,7 @@ static void pmu_sbi_event_unmapped(struct perf_event *event, struct mm_struct *m
if (event->hw.flags & PERF_EVENT_FLAG_USER_ACCESS)
on_each_cpu_mask(mm_cpumask(mm),
- pmu_sbi_reset_scounteren, (void *)event, 1);
+ rvpmu_reset_scounteren, (void *)event, 1);
}
static void riscv_pmu_update_counter_access(void *info)
@@ -1426,7 +1470,7 @@ static const struct ctl_table sbi_pmu_sysctl_table[] = {
},
};
-static int pmu_sbi_device_probe(struct platform_device *pdev)
+static int rvpmu_device_probe(struct platform_device *pdev)
{
struct riscv_pmu *pmu = NULL;
int ret = -ENODEV;
@@ -1438,7 +1482,7 @@ static int pmu_sbi_device_probe(struct platform_device *pdev)
if (!pmu)
return -ENOMEM;
- num_counters = pmu_sbi_find_num_ctrs();
+ num_counters = rvpmu_find_num_ctrs();
if (num_counters < 0) {
pr_err("SBI PMU extension doesn't provide any counters\n");
goto out_free;
@@ -1451,10 +1495,10 @@ static int pmu_sbi_device_probe(struct platform_device *pdev)
}
/* cache all the information about counters now */
- if (pmu_sbi_get_ctrinfo(num_counters, &cmask))
+ if (rvpmu_get_ctrinfo(num_counters, &cmask))
goto out_free;
- ret = pmu_sbi_setup_irqs(pmu, pdev);
+ ret = rvpmu_setup_irqs(pmu, pdev);
if (ret < 0) {
pr_info("Perf sampling/filtering is not supported as sscof extension is not available\n");
pmu->pmu.capabilities |= PERF_PMU_CAP_NO_INTERRUPT;
@@ -1465,17 +1509,17 @@ static int pmu_sbi_device_probe(struct platform_device *pdev)
pmu->pmu.attr_groups = riscv_pmu_attr_groups;
pmu->pmu.parent = &pdev->dev;
pmu->cmask = cmask;
- pmu->ctr_start = pmu_sbi_ctr_start;
- pmu->ctr_stop = pmu_sbi_ctr_stop;
- pmu->event_map = pmu_sbi_event_map;
- pmu->ctr_get_idx = pmu_sbi_ctr_get_idx;
- pmu->ctr_get_width = pmu_sbi_ctr_get_width;
- pmu->ctr_clear_idx = pmu_sbi_ctr_clear_idx;
- pmu->ctr_read = pmu_sbi_ctr_read;
- pmu->event_init = pmu_sbi_event_init;
- pmu->event_mapped = pmu_sbi_event_mapped;
- pmu->event_unmapped = pmu_sbi_event_unmapped;
- pmu->csr_index = pmu_sbi_csr_index;
+ pmu->ctr_start = rvpmu_ctr_start;
+ pmu->ctr_stop = rvpmu_ctr_stop;
+ pmu->event_map = rvpmu_event_map;
+ pmu->ctr_get_idx = rvpmu_ctr_get_idx;
+ pmu->ctr_get_width = rvpmu_ctr_get_width;
+ pmu->ctr_clear_idx = rvpmu_ctr_clear_idx;
+ pmu->ctr_read = rvpmu_ctr_read;
+ pmu->event_init = rvpmu_event_init;
+ pmu->event_mapped = rvpmu_event_mapped;
+ pmu->event_unmapped = rvpmu_event_unmapped;
+ pmu->csr_index = rvpmu_csr_index;
ret = riscv_pm_pmu_register(pmu);
if (ret)
@@ -1542,14 +1586,14 @@ static int pmu_sbi_device_probe(struct platform_device *pdev)
return ret;
}
-static struct platform_driver pmu_sbi_driver = {
- .probe = pmu_sbi_device_probe,
+static struct platform_driver rvpmu_driver = {
+ .probe = rvpmu_device_probe,
.driver = {
.name = RISCV_PMU_SBI_PDEV_NAME,
},
};
-static int __init pmu_sbi_devinit(void)
+static int __init rvpmu_devinit(void)
{
int ret;
struct platform_device *pdev;
@@ -1567,20 +1611,20 @@ static int __init pmu_sbi_devinit(void)
ret = cpuhp_setup_state_multi(CPUHP_AP_PERF_RISCV_STARTING,
"perf/riscv/pmu:starting",
- pmu_sbi_starting_cpu, pmu_sbi_dying_cpu);
+ rvpmu_starting_cpu, rvpmu_dying_cpu);
if (ret) {
pr_err("CPU hotplug notifier could not be registered: %d\n",
ret);
return ret;
}
- ret = platform_driver_register(&pmu_sbi_driver);
+ ret = platform_driver_register(&rvpmu_driver);
if (ret)
return ret;
pdev = platform_device_register_simple(RISCV_PMU_SBI_PDEV_NAME, -1, NULL, 0);
if (IS_ERR(pdev)) {
- platform_driver_unregister(&pmu_sbi_driver);
+ platform_driver_unregister(&rvpmu_driver);
return PTR_ERR(pdev);
}
@@ -1589,4 +1633,4 @@ static int __init pmu_sbi_devinit(void)
return ret;
}
-device_initcall(pmu_sbi_devinit)
+device_initcall(rvpmu_devinit)
--
2.53.0-Meta
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH v9 12/20] RISC-V: perf: Modify the counter discovery mechanism
2026-08-07 8:08 [PATCH v9 00/20] Add Counter delegation ISA extension support Atish Patra
` (10 preceding siblings ...)
2026-08-07 8:09 ` [PATCH v9 11/20] RISC-V: perf: Restructure the SBI PMU code Atish Patra
@ 2026-08-07 8:09 ` Atish Patra
2026-08-07 8:29 ` sashiko-bot
2026-08-07 8:09 ` [PATCH v9 13/20] RISC-V: perf: Add a mechanism to defined legacy event encoding Atish Patra
` (8 subsequent siblings)
20 siblings, 1 reply; 30+ messages in thread
From: Atish Patra @ 2026-08-07 8:09 UTC (permalink / raw)
To: Will Deacon, Atish Patra, Arnaldo Carvalho de Melo, Anup Patel,
Ian Rogers, Rob Herring, Paul Walmsley, Mark Rutland, Jiri Olsa,
Krzysztof Kozlowski, James Clark, Namhyung Kim
Cc: linux-riscv, linux-arm-kernel, Conor Dooley, linux-kernel,
linux-perf-users, devicetree
From: Atish Patra <atishp@rivosinc.com>
If both counter delegation and SBI PMU is present, the counter
delegation will be used for hardware pmu counters while the SBI PMU
will be used for firmware counters. Thus, the driver has to probe
the counters info via SBI PMU to distinguish the firmware counters.
The hybrid scheme also requires improvements of the informational
logging messages to indicate the user about underlying interface
used for each use case.
Signed-off-by: Atish Patra <atishp@rivosinc.com>
---
drivers/perf/riscv_pmu_sbi.c | 151 +++++++++++++++++++++++++++++++++----------
1 file changed, 116 insertions(+), 35 deletions(-)
diff --git a/drivers/perf/riscv_pmu_sbi.c b/drivers/perf/riscv_pmu_sbi.c
index a8a197d341c3..1a1430059909 100644
--- a/drivers/perf/riscv_pmu_sbi.c
+++ b/drivers/perf/riscv_pmu_sbi.c
@@ -66,6 +66,20 @@ static bool sbi_v3_available;
static DEFINE_STATIC_KEY_FALSE(sbi_pmu_snapshot_available);
#define sbi_pmu_snapshot_available() \
static_branch_unlikely(&sbi_pmu_snapshot_available)
+static DEFINE_STATIC_KEY_FALSE(riscv_pmu_sbi_available);
+static DEFINE_STATIC_KEY_FALSE(riscv_pmu_cdeleg_available);
+
+/* Avoid unnecessary code patching in the one time booting path*/
+#define riscv_pmu_cdeleg_available_boot() \
+ static_key_enabled(&riscv_pmu_cdeleg_available)
+#define riscv_pmu_sbi_available_boot() \
+ static_key_enabled(&riscv_pmu_sbi_available)
+
+/* Perform a runtime code patching with static key */
+#define riscv_pmu_cdeleg_available() \
+ static_branch_unlikely(&riscv_pmu_cdeleg_available)
+#define riscv_pmu_sbi_available() \
+ static_branch_likely(&riscv_pmu_sbi_available)
static struct attribute *riscv_arch_formats_attr[] = {
&format_attr_event.attr,
@@ -88,7 +102,8 @@ static int sysctl_perf_user_access __read_mostly = SYSCTL_USER_ACCESS;
/*
* This structure is SBI specific but counter delegation also require counter
- * width, csr mapping. Reuse it for now.
+ * width, csr mapping. Reuse it for now we can have firmware counters for
+ * platfroms with counter delegation support.
* RISC-V doesn't have heterogeneous harts yet. This need to be part of
* per_cpu in case of harts with different pmu counters
*/
@@ -100,6 +115,8 @@ static unsigned int riscv_pmu_irq;
/* Cache the available counters in a bitmask */
static unsigned long cmask;
+/* Cache the available firmware counters in another bitmask */
+static unsigned long firmware_cmask;
static int sbi_pmu_event_find_cache(u64 config);
struct sbi_pmu_event_data {
@@ -867,34 +884,44 @@ static int rvpmu_sbi_find_num_ctrs(void)
return sbi_err_map_linux_errno(ret.error);
}
-static int rvpmu_sbi_get_ctrinfo(int nctr, unsigned long *mask)
+static u32 rvpmu_deleg_find_ctrs(void)
+{
+ /* TODO */
+ return 0;
+}
+
+static int rvpmu_sbi_get_ctrinfo(u32 nsbi_ctr, u32 *num_fw_ctr, u32 *num_hw_ctr)
{
struct sbiret ret;
- int i, num_hw_ctr = 0, num_fw_ctr = 0;
+ int i;
union sbi_pmu_ctr_info cinfo;
- pmu_ctr_list = kzalloc_objs(*pmu_ctr_list, nctr);
- if (!pmu_ctr_list)
- return -ENOMEM;
-
- for (i = 0; i < nctr; i++) {
+ for (i = 0; i < nsbi_ctr; i++) {
ret = sbi_ecall(SBI_EXT_PMU, SBI_EXT_PMU_COUNTER_GET_INFO, i, 0, 0, 0, 0, 0);
if (ret.error)
/* The logical counter ids are not expected to be contiguous */
continue;
- *mask |= BIT(i);
-
cinfo.value = ret.value;
- if (cinfo.type == SBI_PMU_CTR_TYPE_FW)
- num_fw_ctr++;
- else
- num_hw_ctr++;
- pmu_ctr_list[i].value = cinfo.value;
+ if (cinfo.type == SBI_PMU_CTR_TYPE_FW) {
+ /* FW counters use SBI logical ids; skip any that collide */
+ if (cmask & BIT(i)) {
+ pr_warn_once("SBI firmware counter %d overlaps a delegated hardware counter, ignoring it\n",
+ i);
+ continue;
+ }
+ /* Track firmware counters in a different mask */
+ firmware_cmask |= BIT(i);
+ pmu_ctr_list[i].value = cinfo.value;
+ *num_fw_ctr = *num_fw_ctr + 1;
+ } else if (cinfo.type == SBI_PMU_CTR_TYPE_HW &&
+ !riscv_pmu_cdeleg_available_boot()) {
+ *num_hw_ctr = *num_hw_ctr + 1;
+ cmask |= BIT(i);
+ pmu_ctr_list[i].value = cinfo.value;
+ }
}
- pr_info("%d firmware and %d hardware counters\n", num_fw_ctr, num_hw_ctr);
-
return 0;
}
@@ -905,7 +932,7 @@ static inline void rvpmu_sbi_stop_all(struct riscv_pmu *pmu)
* which may include counters that are not enabled yet.
*/
sbi_ecall(SBI_EXT_PMU, SBI_EXT_PMU_COUNTER_STOP,
- 0, pmu->cmask, SBI_PMU_STOP_FLAG_RESET, 0, 0, 0);
+ 0, pmu->cmask | firmware_cmask, SBI_PMU_STOP_FLAG_RESET, 0, 0, 0);
}
static inline void rvpmu_sbi_stop_hw_ctrs(struct riscv_pmu *pmu)
@@ -1158,16 +1185,54 @@ static void rvpmu_ctr_stop(struct perf_event *event, unsigned long flag)
/* TODO: Counter delegation implementation */
}
-static int rvpmu_find_num_ctrs(void)
+static int rvpmu_find_ctrs(void)
{
- return rvpmu_sbi_find_num_ctrs();
- /* TODO: Counter delegation implementation */
-}
+ int num_sbi_counters = 0;
+ u32 num_deleg_counters = 0;
+ u32 num_hw_ctr = 0, num_fw_ctr = 0, num_ctr = 0;
+ /*
+ * We don't know how many firmware counters are available. Just allocate
+ * for maximum counters the driver can support. The default is 64 anyways.
+ */
+ pmu_ctr_list = kcalloc(RISCV_MAX_COUNTERS, sizeof(*pmu_ctr_list),
+ GFP_KERNEL);
+ if (!pmu_ctr_list)
+ return -ENOMEM;
-static int rvpmu_get_ctrinfo(int nctr, unsigned long *mask)
-{
- return rvpmu_sbi_get_ctrinfo(nctr, mask);
- /* TODO: Counter delegation implementation */
+ if (riscv_pmu_cdeleg_available_boot())
+ num_deleg_counters = rvpmu_deleg_find_ctrs();
+
+ /* SBI PMU is only needed for firmware counters; delegation is independent */
+ if (riscv_pmu_sbi_available_boot()) {
+ num_sbi_counters = rvpmu_sbi_find_num_ctrs();
+ if (num_sbi_counters < 0) {
+ /* Keep going if delegation already gave us counters */
+ if (!num_deleg_counters) {
+ kfree(pmu_ctr_list);
+ pmu_ctr_list = NULL;
+ return num_sbi_counters;
+ }
+ pr_warn("Firmware counters unavailable (%d), continuing with %u delegated hardware counters\n",
+ num_sbi_counters, num_deleg_counters);
+ num_sbi_counters = 0;
+ }
+ if (num_sbi_counters > RISCV_MAX_COUNTERS)
+ num_sbi_counters = RISCV_MAX_COUNTERS;
+ }
+
+ /* cache all the information about counters now */
+ if (riscv_pmu_sbi_available_boot())
+ rvpmu_sbi_get_ctrinfo(num_sbi_counters, &num_fw_ctr, &num_hw_ctr);
+
+ if (riscv_pmu_cdeleg_available_boot()) {
+ pr_info("%u firmware and %u hardware counters\n", num_fw_ctr, num_deleg_counters);
+ num_ctr = num_fw_ctr + num_deleg_counters;
+ } else {
+ pr_info("%u firmware and %u hardware counters\n", num_fw_ctr, num_hw_ctr);
+ num_ctr = num_sbi_counters;
+ }
+
+ return num_ctr;
}
static int rvpmu_event_map(struct perf_event *event, u64 *econfig)
@@ -1477,12 +1542,21 @@ static int rvpmu_device_probe(struct platform_device *pdev)
int num_counters;
bool irq_requested = false;
- pr_info("SBI PMU extension is available\n");
+ if (riscv_pmu_cdeleg_available_boot()) {
+ pr_info("hpmcounters will use the counter delegation ISA extension\n");
+ if (riscv_pmu_sbi_available_boot())
+ pr_info("Firmware counters will use SBI PMU extension\n");
+ else
+ pr_info("Firmware counters will not be available as SBI PMU extension is not present\n");
+ } else if (riscv_pmu_sbi_available_boot()) {
+ pr_info("Both hpmcounters and firmware counters will use SBI PMU extension\n");
+ }
+
pmu = riscv_pmu_alloc();
if (!pmu)
return -ENOMEM;
- num_counters = rvpmu_find_num_ctrs();
+ num_counters = rvpmu_find_ctrs();
if (num_counters < 0) {
pr_err("SBI PMU extension doesn't provide any counters\n");
goto out_free;
@@ -1494,9 +1568,6 @@ static int rvpmu_device_probe(struct platform_device *pdev)
pr_info("SBI returned more than maximum number of counters. Limiting the number of counters to %d\n", num_counters);
}
- /* cache all the information about counters now */
- if (rvpmu_get_ctrinfo(num_counters, &cmask))
- goto out_free;
ret = rvpmu_setup_irqs(pmu, pdev);
if (ret < 0) {
@@ -1598,13 +1669,23 @@ static int __init rvpmu_devinit(void)
int ret;
struct platform_device *pdev;
- if (sbi_spec_version < sbi_mk_version(0, 3) ||
- !sbi_probe_extension(SBI_EXT_PMU)) {
- return 0;
- }
+ if (sbi_spec_version >= sbi_mk_version(0, 3) &&
+ sbi_probe_extension(SBI_EXT_PMU))
+ static_branch_enable(&riscv_pmu_sbi_available);
if (sbi_spec_version >= sbi_mk_version(2, 0))
sbi_v2_available = true;
+ /*
+ * We need all three extensions to be present to access the counters
+ * in S-mode via Supervisor Counter delegation.
+ */
+ if (riscv_isa_extension_available(NULL, SSCCFG) &&
+ riscv_isa_extension_available(NULL, SMCDELEG) &&
+ riscv_isa_extension_available(NULL, SSCSRIND))
+ static_branch_enable(&riscv_pmu_cdeleg_available);
+
+ if (!(riscv_pmu_sbi_available_boot() || riscv_pmu_cdeleg_available_boot()))
+ return 0;
if (sbi_spec_version >= sbi_mk_version(3, 0))
sbi_v3_available = true;
--
2.53.0-Meta
^ permalink raw reply related [flat|nested] 30+ messages in thread* Re: [PATCH v9 12/20] RISC-V: perf: Modify the counter discovery mechanism
2026-08-07 8:09 ` [PATCH v9 12/20] RISC-V: perf: Modify the counter discovery mechanism Atish Patra
@ 2026-08-07 8:29 ` sashiko-bot
0 siblings, 0 replies; 30+ messages in thread
From: sashiko-bot @ 2026-08-07 8:29 UTC (permalink / raw)
To: Atish Patra; +Cc: linux-perf-users, devicetree, robh, conor+dt
Thank you for your contribution! Sashiko AI review found 4 potential issue(s) to consider:
- [High] Firmware PMU counters are completely disabled due to being omitted from the PMU's main counter mask.
- [High] Using 32-bit `unsigned long` bitmasks with `BIT(i)` for up to 64 counters causes false ID collisions on 32-bit RISC-V platforms.
- [High] Counter delegation discovery is a stub, causing the driver to disable all hardware counters on supported systems and incorrectly use SBI for verification.
- [High] Memory leak and fatal UAF/NULL-dereference on platform driver re-probe due to freed global pointer.
--
--- Patch [12]: [PATCH v9 12/20] RISC-V: perf: Modify the counter discovery mechanism ---
commit e2768c5a0a20d7c61d402570f684ea95ebbdf2e6
Author: Atish Patra <atishp@rivosinc.com>
RISC-V: perf: Modify the counter discovery mechanism
This commit modifies the counter discovery mechanism to accommodate hybrid
PMU schemes where counter delegation is used for hardware counters and SBI
PMU is used for firmware counters. It tracks firmware counters in a
separate bitmask and updates the informational logging to reflect the
underlying interfaces.
> diff --git a/drivers/perf/riscv_pmu_sbi.c b/drivers/perf/riscv_pmu_sbi.c
> index a8a197d341c3c..1a14300599096 100644
> --- a/drivers/perf/riscv_pmu_sbi.c
> +++ b/drivers/perf/riscv_pmu_sbi.c
[ ... ]
> @@ -867,34 +884,44 @@ static int rvpmu_sbi_find_num_ctrs(void)
> return sbi_err_map_linux_errno(ret.error);
> }
>
> -static int rvpmu_sbi_get_ctrinfo(int nctr, unsigned long *mask)
> +static u32 rvpmu_deleg_find_ctrs(void)
> +{
> + /* TODO */
> + return 0;
> +}
[Severity: High]
Does returning 0 from this stub cause the driver to disable all hardware
counters on systems where counter delegation is available?
When counter delegation is available, this stub returns 0 delegated
hardware counters, but the code in rvpmu_sbi_get_ctrinfo() also explicitly
ignores the SBI fallback for hardware counters:
} else if (cinfo.type == SBI_PMU_CTR_TYPE_HW &&
!riscv_pmu_cdeleg_available_boot()) {
Will this result in 0 hardware counters being registered and all standard
hardware events being marked as unsupported when they are checked against
the empty mask?
> +
> +static int rvpmu_sbi_get_ctrinfo(u32 nsbi_ctr, u32 *num_fw_ctr, u32 *num_hw_ctr)
> {
> struct sbiret ret;
> - int i, num_hw_ctr = 0, num_fw_ctr = 0;
> + int i;
> union sbi_pmu_ctr_info cinfo;
>
> - pmu_ctr_list = kzalloc_objs(*pmu_ctr_list, nctr);
> - if (!pmu_ctr_list)
> - return -ENOMEM;
> -
> - for (i = 0; i < nctr; i++) {
> + for (i = 0; i < nsbi_ctr; i++) {
> ret = sbi_ecall(SBI_EXT_PMU, SBI_EXT_PMU_COUNTER_GET_INFO, i, 0, 0, 0, 0, 0);
> if (ret.error)
> /* The logical counter ids are not expected to be contiguous */
> continue;
>
> - *mask |= BIT(i);
> -
> cinfo.value = ret.value;
> - if (cinfo.type == SBI_PMU_CTR_TYPE_FW)
> - num_fw_ctr++;
> - else
> - num_hw_ctr++;
> - pmu_ctr_list[i].value = cinfo.value;
> + if (cinfo.type == SBI_PMU_CTR_TYPE_FW) {
> + /* FW counters use SBI logical ids; skip any that collide */
> + if (cmask & BIT(i)) {
[Severity: High]
Could this bitwise check cause false ID collisions on 32-bit RISC-V platforms?
Since cmask is an unsigned long, on RV32 it is 32 bits wide. RISC-V supports
up to 64 PMU counters. When processing counters >= 32, BIT(i) will wrap and
alias to BIT(i % 32), which could incorrectly trigger this warning and drop
valid firmware counters.
> + pr_warn_once("SBI firmware counter %d overlaps a delegated hardware counter, ignoring it\n",
> + i);
> + continue;
> + }
> + /* Track firmware counters in a different mask */
> + firmware_cmask |= BIT(i);
> + pmu_ctr_list[i].value = cinfo.value;
> + *num_fw_ctr = *num_fw_ctr + 1;
> + } else if (cinfo.type == SBI_PMU_CTR_TYPE_HW &&
> + !riscv_pmu_cdeleg_available_boot()) {
> + *num_hw_ctr = *num_hw_ctr + 1;
> + cmask |= BIT(i);
[Severity: High]
Are firmware PMU counters inadvertently disabled by tracking them separately
from the main counter mask?
Here firmware_cmask tracks the firmware counters, but later in
rvpmu_device_probe(), the driver initializes pmu->cmask strictly using
cmask:
pmu->cmask = cmask;
When a firmware event is requested, rvpmu_sbi_ctr_get_idx() validates it
against the main mask:
if (!test_bit(idx, &rvpmu->cmask) || !pmu_ctr_list[idx].value)
return -ENOENT;
Will this cause the validation to unconditionally fail for all firmware
counters?
> + pmu_ctr_list[i].value = cinfo.value;
> + }
> }
[ ... ]
> @@ -1158,16 +1185,54 @@ static void rvpmu_ctr_stop(struct perf_event *event, unsigned long flag)
> /* TODO: Counter delegation implementation */
> }
>
> -static int rvpmu_find_num_ctrs(void)
> +static int rvpmu_find_ctrs(void)
> {
> - return rvpmu_sbi_find_num_ctrs();
> - /* TODO: Counter delegation implementation */
> -}
> + int num_sbi_counters = 0;
> + u32 num_deleg_counters = 0;
> + u32 num_hw_ctr = 0, num_fw_ctr = 0, num_ctr = 0;
> + /*
> + * We don't know how many firmware counters are available. Just allocate
> + * for maximum counters the driver can support. The default is 64 anyways.
> + */
> + pmu_ctr_list = kcalloc(RISCV_MAX_COUNTERS, sizeof(*pmu_ctr_list),
> + GFP_KERNEL);
[Severity: High]
Does this allocation leak memory and potentially cause a fatal crash if the
driver is re-probed?
If a user unbinds and rebinds the driver via sysfs, this probe will
unconditionally allocate pmu_ctr_list without cleaning up the previous
allocation, leaking the memory.
Then, when perf_pmu_register() fails because the PMU is already registered,
the error path in rvpmu_device_probe() will free the pointer:
out_free:
free_percpu(pmu->hw_events);
kfree(pmu_ctr_list);
pmu_ctr_list = NULL;
Since the original PMU remains active in the subsystem, would any
subsequent perf event operation dereference this freed and NULLed
pmu_ctr_list pointer?
> + if (!pmu_ctr_list)
> + return -ENOMEM;
>
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260807-counter_delegation-v9-0-58658104e487@meta.com?part=12
^ permalink raw reply [flat|nested] 30+ messages in thread
* [PATCH v9 13/20] RISC-V: perf: Add a mechanism to defined legacy event encoding
2026-08-07 8:08 [PATCH v9 00/20] Add Counter delegation ISA extension support Atish Patra
` (11 preceding siblings ...)
2026-08-07 8:09 ` [PATCH v9 12/20] RISC-V: perf: Modify the counter discovery mechanism Atish Patra
@ 2026-08-07 8:09 ` Atish Patra
2026-08-07 8:09 ` [PATCH v9 14/20] RISC-V: perf: Implement supervisor counter delegation support Atish Patra
` (7 subsequent siblings)
20 siblings, 0 replies; 30+ messages in thread
From: Atish Patra @ 2026-08-07 8:09 UTC (permalink / raw)
To: Will Deacon, Atish Patra, Arnaldo Carvalho de Melo, Anup Patel,
Ian Rogers, Rob Herring, Paul Walmsley, Mark Rutland, Jiri Olsa,
Krzysztof Kozlowski, James Clark, Namhyung Kim
Cc: linux-riscv, linux-arm-kernel, Conor Dooley, linux-kernel,
linux-perf-users, devicetree
From: Atish Patra <atishp@rivosinc.com>
RISC-V ISA doesn't define any standard event encodings or specify
any event to counter mapping. Thus, event encoding information
and corresponding counter mapping fot those events needs to be
provided in the driver for each vendor.
Add a framework to support that. The individual platform events
will be added later.
Signed-off-by: Atish Patra <atishp@rivosinc.com>
Reviewed-by: Charlie Jenkins <thecharlesjenkins@gmail.com>
Tested-by: Charlie Jenkins <thecharlesjenkins@gmail.com>
---
drivers/perf/riscv_pmu_sbi.c | 69 +++++++++++++++++++++++++++++++++++++++++++-
1 file changed, 68 insertions(+), 1 deletion(-)
diff --git a/drivers/perf/riscv_pmu_sbi.c b/drivers/perf/riscv_pmu_sbi.c
index 1a1430059909..7afd79b0a29b 100644
--- a/drivers/perf/riscv_pmu_sbi.c
+++ b/drivers/perf/riscv_pmu_sbi.c
@@ -10,6 +10,7 @@
#define pr_fmt(fmt) "riscv-pmu-sbi: " fmt
+#include <linux/limits.h>
#include <linux/perf/riscv_pmu.h>
#include <linux/platform_device.h>
#include <linux/irq.h>
@@ -378,6 +379,70 @@ static int pmu_sbi_check_event_info(void)
return result;
}
+/*
+ * Vendor specific PMU events.
+ */
+struct riscv_pmu_event {
+ u64 event_id;
+ u32 counterid_mask;
+};
+
+#define HW_OP_UNSUPPORTED U64_MAX
+#define CACHE_OP_UNSUPPORTED U64_MAX
+
+#define PERF_MAP_ALL_UNSUPPORTED \
+ [0 ... PERF_COUNT_HW_MAX - 1] = {HW_OP_UNSUPPORTED, 0x0}
+
+#define PERF_CACHE_MAP_ALL_UNSUPPORTED \
+[0 ... PERF_COUNT_HW_CACHE_MAX - 1] = { \
+ [0 ... PERF_COUNT_HW_CACHE_OP_MAX - 1] = { \
+ [0 ... PERF_COUNT_HW_CACHE_RESULT_MAX - 1] = { \
+ CACHE_OP_UNSUPPORTED, 0x0 \
+ }, \
+ }, \
+}
+
+struct riscv_vendor_pmu_events {
+ unsigned long vendorid;
+ unsigned long archid;
+ unsigned long implid;
+ const struct riscv_pmu_event *hw_event_map;
+ const struct riscv_pmu_event (*cache_event_map)[PERF_COUNT_HW_CACHE_OP_MAX]
+ [PERF_COUNT_HW_CACHE_RESULT_MAX];
+};
+
+#define RISCV_VENDOR_PMU_EVENTS(_vendorid, _archid, _implid, _hw_event_map, _cache_event_map) \
+ { .vendorid = _vendorid, .archid = _archid, .implid = _implid, \
+ .hw_event_map = _hw_event_map, .cache_event_map = _cache_event_map },
+
+static struct riscv_vendor_pmu_events pmu_vendor_events_table[] = {
+};
+
+static const struct riscv_pmu_event *current_pmu_hw_event_map;
+static const struct riscv_pmu_event (*current_pmu_cache_event_map)[PERF_COUNT_HW_CACHE_OP_MAX]
+ [PERF_COUNT_HW_CACHE_RESULT_MAX];
+
+static void __init rvpmu_vendor_register_events(void)
+{
+ int cpu = raw_smp_processor_id();
+ unsigned long vendor_id = riscv_cached_mvendorid(cpu);
+ unsigned long impl_id = riscv_cached_mimpid(cpu);
+ unsigned long arch_id = riscv_cached_marchid(cpu);
+
+ for (int i = 0; i < ARRAY_SIZE(pmu_vendor_events_table); i++) {
+ if (pmu_vendor_events_table[i].vendorid == vendor_id &&
+ pmu_vendor_events_table[i].implid == impl_id &&
+ pmu_vendor_events_table[i].archid == arch_id) {
+ current_pmu_hw_event_map = pmu_vendor_events_table[i].hw_event_map;
+ current_pmu_cache_event_map = pmu_vendor_events_table[i].cache_event_map;
+ break;
+ }
+ }
+
+ if (!current_pmu_hw_event_map && !current_pmu_cache_event_map)
+ pr_info("No default PMU events found\n");
+}
+
static void rvpmu_sbi_check_event(struct sbi_pmu_event_data *edata)
{
struct sbiret ret;
@@ -1681,8 +1746,10 @@ static int __init rvpmu_devinit(void)
*/
if (riscv_isa_extension_available(NULL, SSCCFG) &&
riscv_isa_extension_available(NULL, SMCDELEG) &&
- riscv_isa_extension_available(NULL, SSCSRIND))
+ riscv_isa_extension_available(NULL, SSCSRIND)) {
static_branch_enable(&riscv_pmu_cdeleg_available);
+ rvpmu_vendor_register_events();
+ }
if (!(riscv_pmu_sbi_available_boot() || riscv_pmu_cdeleg_available_boot()))
return 0;
--
2.53.0-Meta
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH v9 14/20] RISC-V: perf: Implement supervisor counter delegation support
2026-08-07 8:08 [PATCH v9 00/20] Add Counter delegation ISA extension support Atish Patra
` (12 preceding siblings ...)
2026-08-07 8:09 ` [PATCH v9 13/20] RISC-V: perf: Add a mechanism to defined legacy event encoding Atish Patra
@ 2026-08-07 8:09 ` Atish Patra
2026-08-07 8:34 ` sashiko-bot
2026-08-07 8:09 ` [PATCH v9 15/20] RISC-V: perf: Skip PMU SBI extension when not implemented Atish Patra
` (6 subsequent siblings)
20 siblings, 1 reply; 30+ messages in thread
From: Atish Patra @ 2026-08-07 8:09 UTC (permalink / raw)
To: Will Deacon, Atish Patra, Arnaldo Carvalho de Melo, Anup Patel,
Ian Rogers, Rob Herring, Paul Walmsley, Mark Rutland, Jiri Olsa,
Krzysztof Kozlowski, James Clark, Namhyung Kim
Cc: linux-riscv, linux-arm-kernel, Conor Dooley, linux-kernel,
linux-perf-users, devicetree
From: Atish Patra <atishp@rivosinc.com>
There are few new RISC-V ISA exensions (ssccfg, sscsrind, smcntrpmf) which
allows the hpmcounter/hpmevents to be programmed directly from S-mode. The
implementation detects the ISA extension at runtime and uses them if
available instead of SBI PMU extension. SBI PMU extension will still be
used for firmware counters if the user requests it.
The current linux driver relies on event encoding defined by SBI PMU
specification for standard perf events. However, there are no standard
event encoding available in the ISA. In the future, we may want to
decouple the counter delegation and SBI PMU completely. In that case,
counter delegation supported platforms must rely on the event encoding
defined in the perf json file or in the pmu driver.
For firmware events, it will continue to use the SBI PMU encoding as
one can not support firmware event without SBI PMU.
Signed-off-by: Atish Patra <atishp@rivosinc.com>
Reviewed-by: Charlie Jenkins <thecharlesjenkins@gmail.com>
Tested-by: Charlie Jenkins <thecharlesjenkins@gmail.com>
---
arch/riscv/include/asm/csr.h | 1 +
drivers/perf/riscv_pmu_sbi.c | 612 ++++++++++++++++++++++++++++++++++-------
include/linux/perf/riscv_pmu.h | 3 +
3 files changed, 509 insertions(+), 107 deletions(-)
diff --git a/arch/riscv/include/asm/csr.h b/arch/riscv/include/asm/csr.h
index c8b94f3337c1..7b0fda63f3a2 100644
--- a/arch/riscv/include/asm/csr.h
+++ b/arch/riscv/include/asm/csr.h
@@ -258,6 +258,7 @@
#endif
#define SISELECT_SSCCFG_BASE 0x40
+#define HPMEVENT_MASK GENMASK_ULL(63, 56)
/* mseccfg bits */
#define MSECCFG_PMM ENVCFG_PMM
diff --git a/drivers/perf/riscv_pmu_sbi.c b/drivers/perf/riscv_pmu_sbi.c
index 7afd79b0a29b..fd4bf8804c9a 100644
--- a/drivers/perf/riscv_pmu_sbi.c
+++ b/drivers/perf/riscv_pmu_sbi.c
@@ -27,6 +27,8 @@
#include <asm/cpufeature.h>
#include <asm/vendor_extensions.h>
#include <asm/vendor_extensions/andes.h>
+#include <asm/hwcap.h>
+#include <asm/csr_indirect.h>
#define ALT_SBI_PMU_OVERFLOW(__ovl) \
asm volatile(ALTERNATIVE_2( \
@@ -59,7 +61,20 @@ asm volatile(ALTERNATIVE( \
#define PERF_EVENT_FLAG_USER_ACCESS BIT(SYSCTL_USER_ACCESS)
#define PERF_EVENT_FLAG_LEGACY BIT(SYSCTL_LEGACY)
-PMU_FORMAT_ATTR(event, "config:0-55");
+#define RVPMU_SBI_PMU_FORMAT_ATTR "config:0-47"
+#define RVPMU_CDELEG_PMU_FORMAT_ATTR "config:0-55"
+
+static ssize_t __maybe_unused rvpmu_format_show(struct device *dev, struct device_attribute *attr,
+ char *buf);
+
+#define RVPMU_ATTR_ENTRY(_name, _func, _config) ( \
+ &((struct dev_ext_attribute[]) { \
+ { __ATTR(_name, 0444, _func, NULL), (void *)_config } \
+ })[0].attr.attr)
+
+#define RVPMU_FORMAT_ATTR_ENTRY(_name, _config) \
+ RVPMU_ATTR_ENTRY(_name, rvpmu_format_show, (char *)_config)
+
PMU_FORMAT_ATTR(firmware, "config:62-63");
static bool sbi_v2_available;
@@ -67,7 +82,11 @@ static bool sbi_v3_available;
static DEFINE_STATIC_KEY_FALSE(sbi_pmu_snapshot_available);
#define sbi_pmu_snapshot_available() \
static_branch_unlikely(&sbi_pmu_snapshot_available)
+
static DEFINE_STATIC_KEY_FALSE(riscv_pmu_sbi_available);
+#define riscv_pmu_sbi_available() \
+ static_branch_likely(&riscv_pmu_sbi_available)
+
static DEFINE_STATIC_KEY_FALSE(riscv_pmu_cdeleg_available);
/* Avoid unnecessary code patching in the one time booting path*/
@@ -82,19 +101,35 @@ static DEFINE_STATIC_KEY_FALSE(riscv_pmu_cdeleg_available);
#define riscv_pmu_sbi_available() \
static_branch_likely(&riscv_pmu_sbi_available)
-static struct attribute *riscv_arch_formats_attr[] = {
- &format_attr_event.attr,
+static struct attribute *riscv_sbi_pmu_formats_attr[] = {
+ RVPMU_FORMAT_ATTR_ENTRY(event, RVPMU_SBI_PMU_FORMAT_ATTR),
&format_attr_firmware.attr,
NULL,
};
-static struct attribute_group riscv_pmu_format_group = {
+static struct attribute_group riscv_sbi_pmu_format_group = {
.name = "format",
- .attrs = riscv_arch_formats_attr,
+ .attrs = riscv_sbi_pmu_formats_attr,
};
-static const struct attribute_group *riscv_pmu_attr_groups[] = {
- &riscv_pmu_format_group,
+static const struct attribute_group *riscv_sbi_pmu_attr_groups[] = {
+ &riscv_sbi_pmu_format_group,
+ NULL,
+};
+
+static struct attribute *riscv_cdeleg_pmu_formats_attr[] = {
+ RVPMU_FORMAT_ATTR_ENTRY(event, RVPMU_CDELEG_PMU_FORMAT_ATTR),
+ &format_attr_firmware.attr,
+ NULL,
+};
+
+static struct attribute_group riscv_cdeleg_pmu_format_group = {
+ .name = "format",
+ .attrs = riscv_cdeleg_pmu_formats_attr,
+};
+
+static const struct attribute_group *riscv_cdeleg_pmu_attr_groups[] = {
+ &riscv_cdeleg_pmu_format_group,
NULL,
};
@@ -480,6 +515,14 @@ static void rvpmu_sbi_check_std_events(struct work_struct *work)
static DECLARE_WORK(check_std_events_work, rvpmu_sbi_check_std_events);
+static ssize_t rvpmu_format_show(struct device *dev,
+ struct device_attribute *attr, char *buf)
+{
+ struct dev_ext_attribute *eattr = container_of(attr,
+ struct dev_ext_attribute, attr);
+ return sysfs_emit(buf, "%s\n", (char *)eattr->var);
+}
+
static int rvpmu_ctr_get_width(int idx)
{
return pmu_ctr_list[idx].width;
@@ -597,6 +640,44 @@ static uint8_t rvpmu_csr_index(struct perf_event *event)
return pmu_ctr_list[event->hw.idx].csr - CSR_CYCLE;
}
+static uint64_t get_deleg_priv_filter_bits(struct perf_event *event)
+{
+ u64 priv_filter_bits = 0;
+ bool guest_events = false;
+
+ if (event->attr.config1 & RISCV_PMU_CONFIG1_GUEST_EVENTS)
+ guest_events = true;
+ if (event->attr.exclude_kernel)
+ priv_filter_bits |= guest_events ? HPMEVENT_VSINH : HPMEVENT_SINH;
+ if (event->attr.exclude_user)
+ priv_filter_bits |= guest_events ? HPMEVENT_VUINH : HPMEVENT_UINH;
+ if (guest_events && event->attr.exclude_hv)
+ priv_filter_bits |= HPMEVENT_SINH;
+ if (event->attr.exclude_host)
+ priv_filter_bits |= HPMEVENT_UINH | HPMEVENT_SINH;
+ if (event->attr.exclude_guest)
+ priv_filter_bits |= HPMEVENT_VSINH | HPMEVENT_VUINH;
+
+ return priv_filter_bits;
+}
+
+static bool pmu_sbi_is_fw_event(struct perf_event *event)
+{
+ u32 type = event->attr.type;
+ u64 config = event->attr.config;
+
+ if (type == PERF_TYPE_RAW && ((config >> 63) == 1))
+ return true;
+ else
+ return false;
+}
+
+/* Hardware counters are driven from S-mode; firmware counters still go via SBI */
+static __always_inline bool rvpmu_is_deleg_event(struct perf_event *event)
+{
+ return riscv_pmu_cdeleg_available() && !pmu_sbi_is_fw_event(event);
+}
+
static unsigned long rvpmu_sbi_get_filter_flags(struct perf_event *event)
{
unsigned long cflags = 0;
@@ -625,7 +706,8 @@ static int rvpmu_sbi_ctr_get_idx(struct perf_event *event)
struct cpu_hw_events *cpuc = this_cpu_ptr(rvpmu->hw_events);
struct sbiret ret;
int idx;
- uint64_t cbase = 0, cmask = rvpmu->cmask;
+ u64 cbase = 0;
+ unsigned long ctr_mask = rvpmu->cmask;
unsigned long cflags = 0;
cflags = rvpmu_sbi_get_filter_flags(event);
@@ -638,21 +720,23 @@ static int rvpmu_sbi_ctr_get_idx(struct perf_event *event)
if ((hwc->flags & PERF_EVENT_FLAG_LEGACY) && (event->attr.type == PERF_TYPE_HARDWARE)) {
if (event->attr.config == PERF_COUNT_HW_CPU_CYCLES) {
cflags |= SBI_PMU_CFG_FLAG_SKIP_MATCH;
- cmask = 1;
+ ctr_mask = 1;
} else if (event->attr.config == PERF_COUNT_HW_INSTRUCTIONS) {
cflags |= SBI_PMU_CFG_FLAG_SKIP_MATCH;
- cmask = BIT(CSR_INSTRET - CSR_CYCLE);
+ ctr_mask = BIT(CSR_INSTRET - CSR_CYCLE);
}
+ } else if (pmu_sbi_is_fw_event(event)) {
+ ctr_mask = firmware_cmask;
}
/* retrieve the available counter index */
#if defined(CONFIG_32BIT)
ret = sbi_ecall(SBI_EXT_PMU, SBI_EXT_PMU_COUNTER_CFG_MATCH, cbase,
- cmask, cflags, hwc->event_base, hwc->config,
+ ctr_mask, cflags, hwc->event_base, hwc->config,
hwc->config >> 32);
#else
ret = sbi_ecall(SBI_EXT_PMU, SBI_EXT_PMU_COUNTER_CFG_MATCH, cbase,
- cmask, cflags, hwc->event_base, hwc->config, 0);
+ ctr_mask, cflags, hwc->event_base, hwc->config, 0);
#endif
if (ret.error) {
pr_debug("Not able to find a counter for event %lx config %llx\n",
@@ -661,7 +745,7 @@ static int rvpmu_sbi_ctr_get_idx(struct perf_event *event)
}
idx = ret.value;
- if (!test_bit(idx, &rvpmu->cmask) || !pmu_ctr_list[idx].value)
+ if (!test_bit(idx, &ctr_mask) || !pmu_ctr_list[idx].value)
return -ENOENT;
/* Additional sanity check for the counter id */
@@ -711,29 +795,104 @@ static int sbi_pmu_event_find_cache(u64 config)
return ret;
}
-static bool pmu_sbi_is_fw_event(struct perf_event *event)
+static int rvpmu_sbi_event_map(struct perf_event *event, u64 *econfig)
{
u32 type = event->attr.type;
u64 config = event->attr.config;
- if ((type == PERF_TYPE_RAW) && ((config >> 63) == 1))
- return true;
- else
- return false;
+ /*
+ * Ensure we are finished checking standard hardware events for
+ * validity before allowing userspace to configure any events.
+ */
+ flush_work(&check_std_events_work);
+
+ return riscv_pmu_get_event_info(type, config, econfig);
}
-static int rvpmu_sbi_event_map(struct perf_event *event, u64 *econfig)
+static int cdeleg_pmu_event_find_cache(u64 config, u64 *eventid, uint32_t *counterid_mask)
+{
+ unsigned int cache_type, cache_op, cache_result;
+
+ if (!current_pmu_cache_event_map)
+ return -ENOENT;
+
+ cache_type = (config >> 0) & 0xff;
+ if (cache_type >= PERF_COUNT_HW_CACHE_MAX)
+ return -EINVAL;
+
+ cache_op = (config >> 8) & 0xff;
+ if (cache_op >= PERF_COUNT_HW_CACHE_OP_MAX)
+ return -EINVAL;
+
+ cache_result = (config >> 16) & 0xff;
+ if (cache_result >= PERF_COUNT_HW_CACHE_RESULT_MAX)
+ return -EINVAL;
+
+ if (eventid)
+ *eventid = current_pmu_cache_event_map[cache_type][cache_op]
+ [cache_result].event_id;
+ if (counterid_mask)
+ *counterid_mask = current_pmu_cache_event_map[cache_type][cache_op]
+ [cache_result].counterid_mask;
+
+ return 0;
+}
+
+static int rvpmu_cdeleg_event_map(struct perf_event *event, u64 *econfig)
{
u32 type = event->attr.type;
u64 config = event->attr.config;
+ int ret = 0;
/*
- * Ensure we are finished checking standard hardware events for
- * validity before allowing userspace to configure any events.
+ * There are two ways standard perf events can be mapped to platform specific
+ * encoding.
+ * 1. The vendor may specify the encodings in the driver.
+ * 2. The Perf tool for RISC-V may remap the standard perf event to platform
+ * specific encoding.
+ *
+ * As RISC-V ISA doesn't define any standard event encoding. Thus, perf tool allows
+ * vendor to define it via json file. The encoding defined in the json will override
+ * the perf legacy encoding. However, some user may want to run performance
+ * monitoring without perf tool as well. That's why, vendors may specify the event
+ * encoding in the driver as well if they want to support that use case too.
+ * If an encoding is defined in the json, it will be encoded as a raw event.
*/
- flush_work(&check_std_events_work);
- return riscv_pmu_get_event_info(type, config, econfig);
+ switch (type) {
+ case PERF_TYPE_HARDWARE:
+ if (config >= PERF_COUNT_HW_MAX)
+ return -EINVAL;
+ if (!current_pmu_hw_event_map)
+ return -ENOENT;
+
+ *econfig = current_pmu_hw_event_map[config].event_id;
+ if (*econfig == HW_OP_UNSUPPORTED)
+ ret = -ENOENT;
+ break;
+ case PERF_TYPE_HW_CACHE:
+ ret = cdeleg_pmu_event_find_cache(config, econfig, NULL);
+ if (ret)
+ break;
+ if (*econfig == CACHE_OP_UNSUPPORTED)
+ ret = -ENOENT;
+ break;
+ case PERF_TYPE_RAW:
+ /*
+ * counterid_mask is config2:0-31; higher bits would silently
+ * truncate to 0 and read as "no constraint".
+ */
+ if (event->attr.config2 & ~GENMASK_ULL(31, 0))
+ return -EINVAL;
+ *econfig = config & RISCV_PMU_DELEG_RAW_EVENT_MASK;
+ break;
+ default:
+ ret = -ENOENT;
+ break;
+ }
+
+ /* event_base is not used for counter delegation */
+ return ret;
}
static void pmu_sbi_snapshot_free(struct riscv_pmu *pmu)
@@ -819,7 +978,7 @@ static int pmu_sbi_snapshot_setup(struct riscv_pmu *pmu, int cpu)
return 0;
}
-static u64 rvpmu_sbi_ctr_read(struct perf_event *event)
+static u64 rvpmu_ctr_read(struct perf_event *event)
{
struct hw_perf_event *hwc = &event->hw;
int idx = hwc->idx;
@@ -830,8 +989,12 @@ static u64 rvpmu_sbi_ctr_read(struct perf_event *event)
struct riscv_pmu_snapshot_data *sdata = cpu_hw_evt->snapshot_addr;
union sbi_pmu_ctr_info info = pmu_ctr_list[idx];
- /* Read the value from the shared memory directly only if counter is stopped */
- if (sbi_pmu_snapshot_available() && (hwc->state & PERF_HES_STOPPED)) {
+ /*
+ * Read from shared memory only if the counter is stopped. Delegated
+ * counters stop via scountinhibit, so their snapshot copy is stale.
+ */
+ if (sbi_pmu_snapshot_available() && (hwc->state & PERF_HES_STOPPED) &&
+ !rvpmu_is_deleg_event(event)) {
val = sdata->ctr_values[idx];
return val;
}
@@ -896,10 +1059,6 @@ static void rvpmu_sbi_ctr_start(struct perf_event *event, u64 ival)
if (ret.error && (ret.error != SBI_ERR_ALREADY_STARTED))
pr_err("Starting counter idx %d failed with error %d\n",
hwc->idx, sbi_err_map_linux_errno(ret.error));
-
- if ((hwc->flags & PERF_EVENT_FLAG_USER_ACCESS) &&
- (hwc->flags & PERF_EVENT_FLAG_USER_READ_CNT))
- rvpmu_set_scounteren((void *)event);
}
static void rvpmu_sbi_ctr_stop(struct perf_event *event, unsigned long flag)
@@ -910,10 +1069,6 @@ static void rvpmu_sbi_ctr_stop(struct perf_event *event, unsigned long flag)
struct cpu_hw_events *cpu_hw_evt = this_cpu_ptr(pmu->hw_events);
struct riscv_pmu_snapshot_data *sdata = cpu_hw_evt->snapshot_addr;
- if ((hwc->flags & PERF_EVENT_FLAG_USER_ACCESS) &&
- (hwc->flags & PERF_EVENT_FLAG_USER_READ_CNT))
- rvpmu_reset_scounteren((void *)event);
-
if (sbi_pmu_snapshot_available())
flag |= SBI_PMU_STOP_FLAG_TAKE_SNAPSHOT;
@@ -949,12 +1104,6 @@ static int rvpmu_sbi_find_num_ctrs(void)
return sbi_err_map_linux_errno(ret.error);
}
-static u32 rvpmu_deleg_find_ctrs(void)
-{
- /* TODO */
- return 0;
-}
-
static int rvpmu_sbi_get_ctrinfo(u32 nsbi_ctr, u32 *num_fw_ctr, u32 *num_hw_ctr)
{
struct sbiret ret;
@@ -1038,55 +1187,75 @@ static inline void rvpmu_sbi_stop_hw_ctrs(struct riscv_pmu *pmu)
}
}
-/*
- * This function starts all the used counters in two step approach.
- * Any counter that did not overflow can be start in a single step
- * while the overflowed counters need to be started with updated initialization
- * value.
- */
-static inline void rvpmu_sbi_start_ovf_ctrs_sbi(struct cpu_hw_events *cpu_hw_evt,
- u64 ctr_ovf_mask)
+static void rvpmu_deleg_ctr_start_mask(unsigned long mask)
{
- int idx = 0, i;
- struct perf_event *event;
- unsigned long flag = SBI_PMU_START_FLAG_SET_INIT_VALUE;
- unsigned long ctr_start_mask = 0;
- uint64_t max_period;
- struct hw_perf_event *hwc;
- u64 init_val = 0;
+ unsigned long scountinhibit_val = 0;
- for (i = 0; i < BITS_TO_LONGS(RISCV_MAX_COUNTERS); i++) {
- ctr_start_mask = cpu_hw_evt->used_hw_ctrs[i] & ~ctr_ovf_mask;
- /* Start all the counters that did not overflow in a single shot */
- if (ctr_start_mask) {
- sbi_ecall(SBI_EXT_PMU, SBI_EXT_PMU_COUNTER_START, i * BITS_PER_LONG,
- ctr_start_mask, 0, 0, 0, 0);
- }
- }
+ scountinhibit_val = csr_read(CSR_SCOUNTINHIBIT);
+ scountinhibit_val &= ~mask;
+
+ csr_write(CSR_SCOUNTINHIBIT, scountinhibit_val);
+}
+
+static void rvpmu_deleg_ctr_enable_irq(struct perf_event *event)
+{
+ unsigned long hpmevent_curr;
+ unsigned long of_mask;
+ struct hw_perf_event *hwc = &event->hw;
+ int counter_idx = hwc->idx;
+ unsigned long sip_val = csr_read(CSR_SIP);
+
+ if (!is_sampling_event(event) || (sip_val & SIP_LCOFIP))
+ return;
- /* Reinitialize and start all the counter that overflowed */
- while (ctr_ovf_mask) {
- if (ctr_ovf_mask & 0x01) {
- event = cpu_hw_evt->events[idx];
- hwc = &event->hw;
- max_period = riscv_pmu_ctr_get_width_mask(event);
- init_val = local64_read(&hwc->prev_count) & max_period;
#if defined(CONFIG_32BIT)
- sbi_ecall(SBI_EXT_PMU, SBI_EXT_PMU_COUNTER_START, idx, 1,
- flag, init_val, init_val >> 32, 0);
+ hpmevent_curr = csr_indirect_read(CSR_SIREG5, SISELECT_SSCCFG_BASE, counter_idx);
+ of_mask = (u32)~HPMEVENTH_OF;
#else
- sbi_ecall(SBI_EXT_PMU, SBI_EXT_PMU_COUNTER_START, idx, 1,
- flag, init_val, 0, 0);
+ hpmevent_curr = csr_indirect_read(CSR_SIREG2, SISELECT_SSCCFG_BASE, counter_idx);
+ of_mask = ~HPMEVENT_OF;
#endif
- perf_event_update_userpage(event);
- }
- ctr_ovf_mask = ctr_ovf_mask >> 1;
- idx++;
- }
+
+ hpmevent_curr &= of_mask;
+#if defined(CONFIG_32BIT)
+ csr_indirect_write(CSR_SIREG5, SISELECT_SSCCFG_BASE, counter_idx, hpmevent_curr);
+#else
+ csr_indirect_write(CSR_SIREG2, SISELECT_SSCCFG_BASE, counter_idx, hpmevent_curr);
+#endif
+}
+
+static void rvpmu_deleg_ctr_start(struct perf_event *event, u64 ival)
+{
+ unsigned long scountinhibit_val = 0;
+ struct hw_perf_event *hwc = &event->hw;
+
+#if defined(CONFIG_32BIT)
+ csr_indirect_write(CSR_SIREG, SISELECT_SSCCFG_BASE, hwc->idx, ival & 0xFFFFFFFF);
+ csr_indirect_write(CSR_SIREG4, SISELECT_SSCCFG_BASE, hwc->idx, ival >> BITS_PER_LONG);
+#else
+ csr_indirect_write(CSR_SIREG, SISELECT_SSCCFG_BASE, hwc->idx, ival);
+#endif
+
+ rvpmu_deleg_ctr_enable_irq(event);
+
+ scountinhibit_val = csr_read(CSR_SCOUNTINHIBIT);
+ scountinhibit_val &= ~BIT(hwc->idx);
+
+ csr_write(CSR_SCOUNTINHIBIT, scountinhibit_val);
+}
+
+static void rvpmu_deleg_ctr_stop_mask(unsigned long mask)
+{
+ unsigned long scountinhibit_val = 0;
+
+ scountinhibit_val = csr_read(CSR_SCOUNTINHIBIT);
+ scountinhibit_val |= mask;
+
+ csr_write(CSR_SCOUNTINHIBIT, scountinhibit_val);
}
-static inline void rvpmu_sbi_start_ovf_ctrs_snapshot(struct cpu_hw_events *cpu_hw_evt,
- u64 ctr_ovf_mask)
+static void rvpmu_sbi_start_ovf_ctrs_snapshot(struct cpu_hw_events *cpu_hw_evt,
+ u64 ctr_ovf_mask)
{
int i, idx = 0;
struct perf_event *event;
@@ -1120,15 +1289,54 @@ static inline void rvpmu_sbi_start_ovf_ctrs_snapshot(struct cpu_hw_events *cpu_h
}
}
-static void rvpmu_sbi_start_overflow_mask(struct riscv_pmu *pmu,
- u64 ctr_ovf_mask)
+/*
+ * This function starts all the used counters in two step approach.
+ * Any counter that did not overflow can be start in a single step
+ * while the overflowed counters need to be started with updated initialization
+ * value.
+ */
+static void rvpmu_start_overflow_mask(struct riscv_pmu *pmu, u64 ctr_ovf_mask)
{
+ int idx = 0, i;
+ struct perf_event *event;
+ unsigned long ctr_start_mask = 0;
+ u64 max_period, init_val = 0;
+ struct hw_perf_event *hwc;
struct cpu_hw_events *cpu_hw_evt = this_cpu_ptr(pmu->hw_events);
- if (sbi_pmu_snapshot_available())
- rvpmu_sbi_start_ovf_ctrs_snapshot(cpu_hw_evt, ctr_ovf_mask);
- else
- rvpmu_sbi_start_ovf_ctrs_sbi(cpu_hw_evt, ctr_ovf_mask);
+ /* Delegated counters must not be re-armed from stale snapshot memory */
+ if (sbi_pmu_snapshot_available() && !riscv_pmu_cdeleg_available())
+ return rvpmu_sbi_start_ovf_ctrs_snapshot(cpu_hw_evt, ctr_ovf_mask);
+
+ /* Start all the counters that did not overflow */
+ if (riscv_pmu_cdeleg_available()) {
+ ctr_start_mask = cpu_hw_evt->used_hw_ctrs[0] & ~ctr_ovf_mask;
+ rvpmu_deleg_ctr_start_mask(ctr_start_mask);
+ } else {
+ for (i = 0; i < BITS_TO_LONGS(RISCV_MAX_COUNTERS); i++) {
+ ctr_start_mask = cpu_hw_evt->used_hw_ctrs[i] & ~ctr_ovf_mask;
+ /* Start all the counters that did not overflow in a single shot */
+ sbi_ecall(SBI_EXT_PMU, SBI_EXT_PMU_COUNTER_START, i * BITS_PER_LONG,
+ ctr_start_mask, 0, 0, 0, 0);
+ }
+ }
+
+ /* Reinitialize and start all the counter that overflowed */
+ while (ctr_ovf_mask) {
+ if (ctr_ovf_mask & 0x01) {
+ event = cpu_hw_evt->events[idx];
+ hwc = &event->hw;
+ max_period = riscv_pmu_ctr_get_width_mask(event);
+ init_val = local64_read(&hwc->prev_count) & max_period;
+ if (riscv_pmu_cdeleg_available())
+ rvpmu_deleg_ctr_start(event, init_val);
+ else
+ rvpmu_sbi_ctr_start(event, init_val);
+ perf_event_update_userpage(event);
+ }
+ ctr_ovf_mask = ctr_ovf_mask >> 1;
+ idx++;
+ }
}
static irqreturn_t rvpmu_ovf_handler(int irq, void *dev)
@@ -1163,10 +1371,18 @@ static irqreturn_t rvpmu_ovf_handler(int irq, void *dev)
}
pmu = to_riscv_pmu(event->pmu);
- rvpmu_sbi_stop_hw_ctrs(pmu);
+ if (riscv_pmu_cdeleg_available())
+ rvpmu_deleg_ctr_stop_mask(cpu_hw_evt->used_hw_ctrs[0]);
+ else
+ rvpmu_sbi_stop_hw_ctrs(pmu);
- /* Overflow status register should only be read after counter are stopped */
- if (sbi_pmu_snapshot_available())
+ /*
+ * Overflow status register should only be read after counter are stopped.
+ * In counter delegation mode the overflows are reported in scountovf, not
+ * in the SBI snapshot area, so read the CSR directly even when an SBI PMU
+ * snapshot is also available.
+ */
+ if (sbi_pmu_snapshot_available() && !riscv_pmu_cdeleg_available())
overflow = sdata->ctr_overflow_mask;
else
ALT_SBI_PMU_OVERFLOW(overflow);
@@ -1232,22 +1448,194 @@ static irqreturn_t rvpmu_ovf_handler(int irq, void *dev)
hw_evt->state = 0;
}
- rvpmu_sbi_start_overflow_mask(pmu, overflowed_ctrs);
+ rvpmu_start_overflow_mask(pmu, overflowed_ctrs);
perf_sample_event_took(sched_clock() - start_clock);
return IRQ_HANDLED;
}
+static int get_deleg_hw_ctr_width(int counter_offset)
+{
+ unsigned long hpm_warl;
+ int num_bits;
+
+ if (counter_offset < 3 || counter_offset > 31)
+ return 0;
+
+ hpm_warl = csr_indirect_warl(CSR_SIREG, SISELECT_SSCCFG_BASE, counter_offset, -1);
+ if (!hpm_warl)
+ return 0;
+ num_bits = __fls(hpm_warl);
+
+#if defined(CONFIG_32BIT)
+ /*
+ * The low half contributes a full BITS_PER_LONG bits when the counter is
+ * wider than 32 bits; the high half's __fls() gives the remaining width.
+ */
+ hpm_warl = csr_indirect_warl(CSR_SIREG4, SISELECT_SSCCFG_BASE, counter_offset, -1);
+ if (hpm_warl)
+ num_bits = BITS_PER_LONG + __fls(hpm_warl);
+#endif
+ return num_bits;
+}
+
+static int rvpmu_deleg_find_ctrs(void)
+{
+ int i, num_hw_ctr = 0;
+ union sbi_pmu_ctr_info cinfo;
+ unsigned long scountinhibit_old = 0;
+
+ /* Do a WARL write/read to detect which hpmcounters have been delegated */
+ scountinhibit_old = csr_read(CSR_SCOUNTINHIBIT);
+ csr_write(CSR_SCOUNTINHIBIT, -1);
+ cmask = csr_read(CSR_SCOUNTINHIBIT);
+
+ csr_write(CSR_SCOUNTINHIBIT, scountinhibit_old);
+
+ for_each_set_bit(i, &cmask, RISCV_MAX_HW_COUNTERS) {
+ if (unlikely(i == 1))
+ continue; /* This should never happen as TM is read only */
+ cinfo.value = 0;
+ cinfo.type = SBI_PMU_CTR_TYPE_HW;
+ /*
+ * If counter delegation is enabled, the csr stored to the cinfo will
+ * be a virtual counter that the delegation attempts to read.
+ */
+ cinfo.csr = CSR_CYCLE + i;
+ if (i == 0 || i == 2)
+ cinfo.width = 63;
+ else
+ cinfo.width = get_deleg_hw_ctr_width(i);
+
+ num_hw_ctr++;
+ pmu_ctr_list[i].value = cinfo.value;
+ }
+
+ return num_hw_ctr;
+}
+
+static int get_deleg_fixed_hw_idx(struct cpu_hw_events *cpuc, struct perf_event *event)
+{
+ return -EINVAL;
+}
+
+static int get_deleg_next_hpm_hw_idx(struct cpu_hw_events *cpuc, struct perf_event *event)
+{
+ unsigned long hw_ctr_mask = 0;
+
+ /*
+ * TODO: Treat every hpmcounter can monitor every event for now.
+ * The event to counter mapping should come from the json file.
+ * The mapping should also tell if sampling is supported or not.
+ */
+
+ /* Select only hpmcounters */
+ hw_ctr_mask = cmask & (~0x7);
+ hw_ctr_mask &= ~(cpuc->used_hw_ctrs[0]);
+ return __ffs(hw_ctr_mask);
+}
+
+static void write_deleg_hpmevent(int counter_idx, uint64_t event_value, uint64_t filter_bits)
+{
+ u64 hpmevent_value = 0;
+
+ /* OF bit should be enable during the start if sampling is requested */
+ hpmevent_value = (event_value & ~HPMEVENT_MASK) | filter_bits | HPMEVENT_OF;
+#if defined(CONFIG_32BIT)
+ csr_indirect_write(CSR_SIREG2, SISELECT_SSCCFG_BASE, counter_idx,
+ hpmevent_value & 0xFFFFFFFF);
+ if (riscv_isa_extension_available(NULL, SSCOFPMF))
+ csr_indirect_write(CSR_SIREG5, SISELECT_SSCCFG_BASE, counter_idx,
+ hpmevent_value >> BITS_PER_LONG);
+#else
+ csr_indirect_write(CSR_SIREG2, SISELECT_SSCCFG_BASE, counter_idx, hpmevent_value);
+#endif
+}
+
+/* cyclecfg/instretcfg only exist with Smcntrpmf; writing them otherwise traps */
+static void clear_deleg_hpmevent(int counter_idx)
+{
+ if ((counter_idx == 0 || counter_idx == 2) &&
+ !riscv_isa_extension_available(NULL, SMCNTRPMF))
+ return;
+
+ write_deleg_hpmevent(counter_idx, 0, 0);
+}
+
+static int rvpmu_deleg_ctr_get_idx(struct perf_event *event)
+{
+ struct hw_perf_event *hwc = &event->hw;
+ struct riscv_pmu *rvpmu = to_riscv_pmu(event->pmu);
+ struct cpu_hw_events *cpuc = this_cpu_ptr(rvpmu->hw_events);
+ unsigned long hw_ctr_max_id;
+ u64 priv_filter;
+ int idx;
+
+ /*
+ * TODO: We should not rely on SBI Perf encoding to check if the event
+ * is a fixed one or not.
+ */
+ if (!is_sampling_event(event)) {
+ idx = get_deleg_fixed_hw_idx(cpuc, event);
+ if (idx == 0 || idx == 2) {
+ /* Priv mode filter bits are only available if smcntrpmf is present */
+ if (riscv_isa_extension_available(NULL, SMCNTRPMF))
+ goto found_idx;
+ else
+ goto skip_update;
+ }
+ }
+
+ if (!cmask)
+ goto out_err;
+ hw_ctr_max_id = __fls(cmask);
+ idx = get_deleg_next_hpm_hw_idx(cpuc, event);
+ if (idx < 3 || idx > hw_ctr_max_id)
+ goto out_err;
+found_idx:
+ priv_filter = get_deleg_priv_filter_bits(event);
+ write_deleg_hpmevent(idx, hwc->config, priv_filter);
+skip_update:
+ if (!test_and_set_bit(idx, cpuc->used_hw_ctrs))
+ return idx;
+out_err:
+ return -ENOENT;
+}
+
static void rvpmu_ctr_start(struct perf_event *event, u64 ival)
{
- rvpmu_sbi_ctr_start(event, ival);
- /* TODO: Counter delegation implementation */
+ struct hw_perf_event *hwc = &event->hw;
+
+ if (rvpmu_is_deleg_event(event))
+ rvpmu_deleg_ctr_start(event, ival);
+ else
+ rvpmu_sbi_ctr_start(event, ival);
+
+ if ((hwc->flags & PERF_EVENT_FLAG_USER_ACCESS) &&
+ (hwc->flags & PERF_EVENT_FLAG_USER_READ_CNT))
+ rvpmu_set_scounteren((void *)event);
}
static void rvpmu_ctr_stop(struct perf_event *event, unsigned long flag)
{
- rvpmu_sbi_ctr_stop(event, flag);
- /* TODO: Counter delegation implementation */
+ struct hw_perf_event *hwc = &event->hw;
+
+ if ((hwc->flags & PERF_EVENT_FLAG_USER_ACCESS) &&
+ (hwc->flags & PERF_EVENT_FLAG_USER_READ_CNT))
+ rvpmu_reset_scounteren((void *)event);
+
+ if (rvpmu_is_deleg_event(event)) {
+ /*
+ * The counter is already stopped. No need to stop again. Counter
+ * mapping will be reset in clear_idx function.
+ */
+ if (flag != RISCV_PMU_STOP_FLAG_RESET)
+ rvpmu_deleg_ctr_stop_mask(BIT(hwc->idx));
+ else
+ clear_deleg_hpmevent(hwc->idx);
+ } else {
+ rvpmu_sbi_ctr_stop(event, flag);
+ }
}
static int rvpmu_find_ctrs(void)
@@ -1302,20 +1690,18 @@ static int rvpmu_find_ctrs(void)
static int rvpmu_event_map(struct perf_event *event, u64 *econfig)
{
- return rvpmu_sbi_event_map(event, econfig);
- /* TODO: Counter delegation implementation */
+ if (rvpmu_is_deleg_event(event))
+ return rvpmu_cdeleg_event_map(event, econfig);
+ else
+ return rvpmu_sbi_event_map(event, econfig);
}
static int rvpmu_ctr_get_idx(struct perf_event *event)
{
- return rvpmu_sbi_ctr_get_idx(event);
- /* TODO: Counter delegation implementation */
-}
-
-static u64 rvpmu_ctr_read(struct perf_event *event)
-{
- return rvpmu_sbi_ctr_read(event);
- /* TODO: Counter delegation implementation */
+ if (rvpmu_is_deleg_event(event))
+ return rvpmu_deleg_ctr_get_idx(event);
+ else
+ return rvpmu_sbi_ctr_get_idx(event);
}
static int rvpmu_starting_cpu(unsigned int cpu, struct hlist_node *node)
@@ -1333,7 +1719,16 @@ static int rvpmu_starting_cpu(unsigned int cpu, struct hlist_node *node)
csr_write(CSR_SCOUNTEREN, 0x2);
/* Stop all the counters so that they can be enabled from perf */
- rvpmu_sbi_stop_all(pmu);
+ if (riscv_pmu_cdeleg_available()) {
+ rvpmu_deleg_ctr_stop_mask(cmask);
+ if (riscv_pmu_sbi_available()) {
+ /* Stop the firmware counters as well */
+ sbi_ecall(SBI_EXT_PMU, SBI_EXT_PMU_COUNTER_STOP, 0, firmware_cmask,
+ 0, 0, 0, 0);
+ }
+ } else {
+ rvpmu_sbi_stop_all(pmu);
+ }
if (riscv_pmu_use_irq) {
cpu_hw_evt->irq = riscv_pmu_irq;
@@ -1642,8 +2037,11 @@ static int rvpmu_device_probe(struct platform_device *pdev)
}
irq_requested = (ret == 0);
- pmu->pmu.attr_groups = riscv_pmu_attr_groups;
pmu->pmu.parent = &pdev->dev;
+ if (riscv_pmu_cdeleg_available_boot())
+ pmu->pmu.attr_groups = riscv_cdeleg_pmu_attr_groups;
+ else
+ pmu->pmu.attr_groups = riscv_sbi_pmu_attr_groups;
pmu->cmask = cmask;
pmu->ctr_start = rvpmu_ctr_start;
pmu->ctr_stop = rvpmu_ctr_stop;
diff --git a/include/linux/perf/riscv_pmu.h b/include/linux/perf/riscv_pmu.h
index f82a28040594..3c64151cb038 100644
--- a/include/linux/perf/riscv_pmu.h
+++ b/include/linux/perf/riscv_pmu.h
@@ -20,6 +20,7 @@
*/
#define RISCV_MAX_COUNTERS 64
+#define RISCV_MAX_HW_COUNTERS 32
#define RISCV_OP_UNSUPP (-EOPNOTSUPP)
#define RISCV_PMU_SBI_PDEV_NAME "riscv-pmu-sbi"
#define RISCV_PMU_LEGACY_PDEV_NAME "riscv-pmu-legacy"
@@ -28,6 +29,8 @@
#define RISCV_PMU_CONFIG1_GUEST_EVENTS 0x1
+#define RISCV_PMU_DELEG_RAW_EVENT_MASK GENMASK_ULL(55, 0)
+
struct cpu_hw_events {
/* currently enabled events */
int n_events;
--
2.53.0-Meta
^ permalink raw reply related [flat|nested] 30+ messages in thread* Re: [PATCH v9 14/20] RISC-V: perf: Implement supervisor counter delegation support
2026-08-07 8:09 ` [PATCH v9 14/20] RISC-V: perf: Implement supervisor counter delegation support Atish Patra
@ 2026-08-07 8:34 ` sashiko-bot
0 siblings, 0 replies; 30+ messages in thread
From: sashiko-bot @ 2026-08-07 8:34 UTC (permalink / raw)
To: Atish Patra; +Cc: linux-perf-users, robh, devicetree, conor+dt
Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
- [Critical] Unconditionally setting the HPMEVENT_OF bit causes an unrecoverable interrupt storm for non-sampling events.
- [High] Bailing out of `rvpmu_deleg_ctr_enable_irq()` when `SIP_LCOFIP` is set causes newly started counters to falsely trigger spurious overflows.
- [High] Calling `__ffs()` on a zero mask when all hardware PMU counters are in use invokes undefined behavior and silently corrupts active perf events.
--
--- Patch [14]: [PATCH v9 14/20] RISC-V: perf: Implement supervisor counter delegation support ---
commit c2b448f2df09243c89d8cc4f0c47edd59230b3d1
Author: Atish Patra <atishp@rivosinc.com>
RISC-V: perf: Implement supervisor counter delegation support
This commit adds runtime detection and support for RISC-V ISA extensions
(ssccfg, sscsrind, smcntrpmf) to program hpmcounter/hpmevents directly from
S-mode. It falls back to the SBI PMU extension if the new extensions are
unavailable or for firmware counters.
> diff --git a/drivers/perf/riscv_pmu_sbi.c b/drivers/perf/riscv_pmu_sbi.c
> index 7afd79b0a29b8..fd4bf8804c9a6 100644
> --- a/drivers/perf/riscv_pmu_sbi.c
> +++ b/drivers/perf/riscv_pmu_sbi.c
[ ... ]
> @@ -1038,55 +1187,75 @@ static inline void rvpmu_sbi_stop_hw_ctrs(struct riscv_pmu *pmu)
[ ... ]
> +static void rvpmu_deleg_ctr_enable_irq(struct perf_event *event)
> +{
> + unsigned long hpmevent_curr;
> + unsigned long of_mask;
> + struct hw_perf_event *hwc = &event->hw;
> + int counter_idx = hwc->idx;
> + unsigned long sip_val = csr_read(CSR_SIP);
> +
> + if (!is_sampling_event(event) || (sip_val & SIP_LCOFIP))
> + return;
[Severity: Critical]
write_deleg_hpmevent() unconditionally sets the HPMEVENT_OF flag on the
counter. If this returns early for non-sampling events, the OF flag remains
set. When the counter is uninhibited, won't the set OF flag immediately assert
an interrupt?
And since rvpmu_ovf_handler() skips non-sampling events:
/* Skip if invalid event or user did not request a sampling */
if (!event || !is_sampling_event(event))
continue;
Will this result in an unrecoverable interrupt storm that hangs the CPU?
[Severity: High]
If SIP_LCOFIP is set from another counter's pending overflow, returning early
here means this new counter starts with its OF bit still set. When local
interrupts are re-enabled, won't the overflow handler falsely detect this new
counter as having instantly overflowed, corrupting the event state?
[ ... ]
> @@ -1232,22 +1448,194 @@ static irqreturn_t rvpmu_ovf_handler(int irq, void *dev)
[ ... ]
> +static int get_deleg_next_hpm_hw_idx(struct cpu_hw_events *cpuc, struct perf_event *event)
> +{
> + unsigned long hw_ctr_mask = 0;
> +
> + /*
> + * TODO: Treat every hpmcounter can monitor every event for now.
> + * The event to counter mapping should come from the json file.
> + * The mapping should also tell if sampling is supported or not.
> + */
> +
> + /* Select only hpmcounters */
> + hw_ctr_mask = cmask & (~0x7);
> + hw_ctr_mask &= ~(cpuc->used_hw_ctrs[0]);
> + return __ffs(hw_ctr_mask);
> +}
[Severity: High]
If all eligible PMU counters are currently active, hw_ctr_mask will be 0.
Calling __ffs(0) invokes undefined behavior, which on RV32 without the Zbb
extension evaluates to 31.
Then in rvpmu_deleg_ctr_get_idx():
idx = get_deleg_next_hpm_hw_idx(cpuc, event);
if (idx < 3 || idx > hw_ctr_max_id)
goto out_err;
found_idx:
priv_filter = get_deleg_priv_filter_bits(event);
write_deleg_hpmevent(idx, hwc->config, priv_filter);
skip_update:
if (!test_and_set_bit(idx, cpuc->used_hw_ctrs))
return idx;
Won't this overwrite the configuration of the active counter (e.g. index 31)
in write_deleg_hpmevent() before verifying its availability with
test_and_set_bit(), silently corrupting the active counter's
configuration?
[ ... ]
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260807-counter_delegation-v9-0-58658104e487@meta.com?part=14
^ permalink raw reply [flat|nested] 30+ messages in thread
* [PATCH v9 15/20] RISC-V: perf: Skip PMU SBI extension when not implemented
2026-08-07 8:08 [PATCH v9 00/20] Add Counter delegation ISA extension support Atish Patra
` (13 preceding siblings ...)
2026-08-07 8:09 ` [PATCH v9 14/20] RISC-V: perf: Implement supervisor counter delegation support Atish Patra
@ 2026-08-07 8:09 ` Atish Patra
2026-08-07 8:09 ` [PATCH v9 16/20] RISC-V: perf: Use config2/vendor table for event to counter mapping Atish Patra
` (5 subsequent siblings)
20 siblings, 0 replies; 30+ messages in thread
From: Atish Patra @ 2026-08-07 8:09 UTC (permalink / raw)
To: Will Deacon, Atish Patra, Arnaldo Carvalho de Melo, Anup Patel,
Ian Rogers, Rob Herring, Paul Walmsley, Mark Rutland, Jiri Olsa,
Krzysztof Kozlowski, James Clark, Namhyung Kim
Cc: linux-riscv, linux-arm-kernel, Conor Dooley, linux-kernel,
linux-perf-users, devicetree
From: Charlie Jenkins <charlie@rivosinc.com>
When the PMU SBI extension is not implemented, sbi_v2_available should
not be set to true. The SBI implementation for counter config matching
and firmware counter read should also be skipped when the SBI extension
is not implemented.
Signed-off-by: Atish Patra <atishp@meta.com>
Signed-off-by: Charlie Jenkins <charlie@rivosinc.com>
---
drivers/perf/riscv_pmu_sbi.c | 55 ++++++++++++++++++++++++++------------------
1 file changed, 32 insertions(+), 23 deletions(-)
diff --git a/drivers/perf/riscv_pmu_sbi.c b/drivers/perf/riscv_pmu_sbi.c
index fd4bf8804c9a..f0b8b6eff2ea 100644
--- a/drivers/perf/riscv_pmu_sbi.c
+++ b/drivers/perf/riscv_pmu_sbi.c
@@ -493,27 +493,32 @@ static void rvpmu_sbi_check_event(struct sbi_pmu_event_data *edata)
}
}
-static void rvpmu_sbi_check_std_events(struct work_struct *work)
+static void rvpmu_check_std_events(struct work_struct *work)
{
int ret;
- if (sbi_v3_available) {
- ret = pmu_sbi_check_event_info();
- if (ret)
- pr_err("pmu_sbi_check_event_info failed with error %d\n", ret);
- return;
- }
+ if (riscv_pmu_sbi_available()) {
+ if (sbi_v3_available) {
+ ret = pmu_sbi_check_event_info();
+ if (ret)
+ pr_err("pmu_sbi_check_event_info failed with error %d\n", ret);
+ return;
+ }
- for (int i = 0; i < ARRAY_SIZE(pmu_hw_event_sbi_map); i++)
- rvpmu_sbi_check_event(&pmu_hw_event_sbi_map[i]);
+ for (int i = 0; i < ARRAY_SIZE(pmu_hw_event_sbi_map); i++)
+ rvpmu_sbi_check_event(&pmu_hw_event_sbi_map[i]);
- for (int i = 0; i < ARRAY_SIZE(pmu_cache_event_sbi_map); i++)
- for (int j = 0; j < ARRAY_SIZE(pmu_cache_event_sbi_map[i]); j++)
- for (int k = 0; k < ARRAY_SIZE(pmu_cache_event_sbi_map[i][j]); k++)
- rvpmu_sbi_check_event(&pmu_cache_event_sbi_map[i][j][k]);
+ for (int i = 0; i < ARRAY_SIZE(pmu_cache_event_sbi_map); i++)
+ for (int j = 0; j < ARRAY_SIZE(pmu_cache_event_sbi_map[i]); j++)
+ for (int k = 0; k < ARRAY_SIZE(pmu_cache_event_sbi_map[i][j]); k++)
+ rvpmu_sbi_check_event(&pmu_cache_event_sbi_map[i][j][k]);
+ } else {
+ DO_ONCE_LITE_IF(1, pr_info,
+ "Boot time config matching not required for smcdeleg\n");
+ }
}
-static DECLARE_WORK(check_std_events_work, rvpmu_sbi_check_std_events);
+static DECLARE_WORK(check_std_events_work, rvpmu_check_std_events);
static ssize_t rvpmu_format_show(struct device *dev,
struct device_attribute *attr, char *buf)
@@ -712,6 +717,9 @@ static int rvpmu_sbi_ctr_get_idx(struct perf_event *event)
cflags = rvpmu_sbi_get_filter_flags(event);
+ if (!riscv_pmu_sbi_available())
+ return -ENOENT;
+
/*
* In legacy mode, we have to force the fixed counters for those events
* but not in the user access mode as we want to use the other counters
@@ -999,7 +1007,7 @@ static u64 rvpmu_ctr_read(struct perf_event *event)
return val;
}
- if (pmu_sbi_is_fw_event(event)) {
+ if (pmu_sbi_is_fw_event(event) && riscv_pmu_sbi_available()) {
ret = sbi_ecall(SBI_EXT_PMU, SBI_EXT_PMU_COUNTER_FW_READ,
hwc->idx, 0, 0, 0, 0, 0);
if (ret.error)
@@ -2132,12 +2140,16 @@ static int __init rvpmu_devinit(void)
int ret;
struct platform_device *pdev;
- if (sbi_spec_version >= sbi_mk_version(0, 3) &&
- sbi_probe_extension(SBI_EXT_PMU))
- static_branch_enable(&riscv_pmu_sbi_available);
+ if (sbi_probe_extension(SBI_EXT_PMU)) {
+ if (sbi_spec_version >= sbi_mk_version(0, 3)) {
+ static_branch_enable(&riscv_pmu_sbi_available);
+ if (sbi_spec_version >= sbi_mk_version(2, 0))
+ sbi_v2_available = true;
+ if (sbi_spec_version >= sbi_mk_version(3, 0))
+ sbi_v3_available = true;
+ }
+ }
- if (sbi_spec_version >= sbi_mk_version(2, 0))
- sbi_v2_available = true;
/*
* We need all three extensions to be present to access the counters
* in S-mode via Supervisor Counter delegation.
@@ -2152,9 +2164,6 @@ static int __init rvpmu_devinit(void)
if (!(riscv_pmu_sbi_available_boot() || riscv_pmu_cdeleg_available_boot()))
return 0;
- if (sbi_spec_version >= sbi_mk_version(3, 0))
- sbi_v3_available = true;
-
ret = cpuhp_setup_state_multi(CPUHP_AP_PERF_RISCV_STARTING,
"perf/riscv/pmu:starting",
rvpmu_starting_cpu, rvpmu_dying_cpu);
--
2.53.0-Meta
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH v9 16/20] RISC-V: perf: Use config2/vendor table for event to counter mapping
2026-08-07 8:08 [PATCH v9 00/20] Add Counter delegation ISA extension support Atish Patra
` (14 preceding siblings ...)
2026-08-07 8:09 ` [PATCH v9 15/20] RISC-V: perf: Skip PMU SBI extension when not implemented Atish Patra
@ 2026-08-07 8:09 ` Atish Patra
2026-08-07 8:43 ` sashiko-bot
2026-08-07 8:09 ` [PATCH v9 17/20] RISC-V: perf: Add legacy event encodings via sysfs Atish Patra
` (4 subsequent siblings)
20 siblings, 1 reply; 30+ messages in thread
From: Atish Patra @ 2026-08-07 8:09 UTC (permalink / raw)
To: Will Deacon, Atish Patra, Arnaldo Carvalho de Melo, Anup Patel,
Ian Rogers, Rob Herring, Paul Walmsley, Mark Rutland, Jiri Olsa,
Krzysztof Kozlowski, James Clark, Namhyung Kim
Cc: linux-riscv, linux-arm-kernel, Conor Dooley, linux-kernel,
linux-perf-users, devicetree
From: Atish Patra <atishp@rivosinc.com>
The counter restriction specified in the json file is passed to
the drivers via config2 paarameter in perf attributes. This allows
any platform vendor to define their custom mapping between event and
hpmcounters without any rules defined in the ISA.
For legacy events, the platform vendor may define the mapping in
the driver in the vendor event table.
The fixed cycle and instruction counters are fixed (0 and 2
respectively) by the ISA and maps to the legacy events. The platform
vendor must specify this in the driver if intended to be used while
profiling. Otherwise, they can just specify the alternate hpmcounters
that may monitor and/or sample the cycle/instruction counts.
Signed-off-by: Atish Patra <atishp@rivosinc.com>
Reviewed-by: Charlie Jenkins <thecharlesjenkins@gmail.com>
Tested-by: Charlie Jenkins <thecharlesjenkins@gmail.com>
---
drivers/perf/riscv_pmu_sbi.c | 94 +++++++++++++++++++++++++++++++++++-------
include/linux/perf/riscv_pmu.h | 2 +
2 files changed, 80 insertions(+), 16 deletions(-)
diff --git a/drivers/perf/riscv_pmu_sbi.c b/drivers/perf/riscv_pmu_sbi.c
index f0b8b6eff2ea..ee0c07785927 100644
--- a/drivers/perf/riscv_pmu_sbi.c
+++ b/drivers/perf/riscv_pmu_sbi.c
@@ -76,6 +76,7 @@ static ssize_t __maybe_unused rvpmu_format_show(struct device *dev, struct devic
RVPMU_ATTR_ENTRY(_name, rvpmu_format_show, (char *)_config)
PMU_FORMAT_ATTR(firmware, "config:62-63");
+PMU_FORMAT_ATTR(counterid_mask, "config2:0-31");
static bool sbi_v2_available;
static bool sbi_v3_available;
@@ -120,6 +121,7 @@ static const struct attribute_group *riscv_sbi_pmu_attr_groups[] = {
static struct attribute *riscv_cdeleg_pmu_formats_attr[] = {
RVPMU_FORMAT_ATTR_ENTRY(event, RVPMU_CDELEG_PMU_FORMAT_ATTR),
&format_attr_firmware.attr,
+ &format_attr_counterid_mask.attr,
NULL,
};
@@ -1522,24 +1524,85 @@ static int rvpmu_deleg_find_ctrs(void)
return num_hw_ctr;
}
+/*
+ * The json file must correctly specify counter 0 or counter 2 is available
+ * in the counter lists for cycle/instret events. Otherwise, the drivers have
+ * no way to figure out if a fixed counter must be used and pick a programmable
+ * counter if available.
+ */
static int get_deleg_fixed_hw_idx(struct cpu_hw_events *cpuc, struct perf_event *event)
{
- return -EINVAL;
+ bool guest_events = event->attr.config1 & RISCV_PMU_CONFIG1_GUEST_EVENTS;
+ int idx;
+
+ /* event_base is 0 on the delegation path; match via the original perf attrs. */
+ if (guest_events) {
+ if (event->attr.type != PERF_TYPE_HARDWARE)
+ return -EINVAL;
+ if (event->attr.config == PERF_COUNT_HW_CPU_CYCLES)
+ idx = 0; /* CY counter */
+ else if (event->attr.config == PERF_COUNT_HW_INSTRUCTIONS)
+ idx = 2; /* IR counter */
+ else
+ return -EINVAL;
+ } else if (event->attr.config2 & RISCV_PMU_CYCLE_FIXED_CTR_MASK) {
+ idx = 0; /* CY counter */
+ } else if (event->attr.config2 & RISCV_PMU_INSTRUCTION_FIXED_CTR_MASK) {
+ idx = 2; /* IR counter */
+ } else {
+ return -EINVAL;
+ }
+
+ /* Take the fixed counter only if delegated and free, else fall back. */
+ if (!(cmask & BIT(idx)) || test_bit(idx, cpuc->used_hw_ctrs))
+ return -EINVAL;
+
+ return idx;
}
static int get_deleg_next_hpm_hw_idx(struct cpu_hw_events *cpuc, struct perf_event *event)
{
- unsigned long hw_ctr_mask = 0;
+ u32 hw_ctr_mask = 0, temp_mask = 0;
+ u32 type = event->attr.type;
+ u64 config = event->attr.config;
+ int ret;
- /*
- * TODO: Treat every hpmcounter can monitor every event for now.
- * The event to counter mapping should come from the json file.
- * The mapping should also tell if sampling is supported or not.
- */
+ /* Select only available hpmcounters */
+ hw_ctr_mask = cmask & (~0x7) & ~(cpuc->used_hw_ctrs[0]);
+
+ switch (type) {
+ case PERF_TYPE_HARDWARE:
+ temp_mask = current_pmu_hw_event_map[config].counterid_mask;
+ break;
+ case PERF_TYPE_HW_CACHE:
+ ret = cdeleg_pmu_event_find_cache(config, NULL, &temp_mask);
+ if (ret)
+ return ret;
+ break;
+ case PERF_TYPE_RAW:
+ /*
+ * Mask off the counters that can't monitor this event (specified via json)
+ * The counter mask for this event is set in config2 via the property 'Counter'
+ * in the json file or manual configuration of config2. If the config2 is not set,
+ * it is assumed all the available hpmcounters can monitor this event.
+ * Note: This assumption may fail for virtualization use case where they hypervisor
+ * (e.g. KVM) virtualizes the counter. Any event to counter mapping provided by the
+ * guest is meaningless from a hypervisor perspective. Thus, the hypervisor doesn't
+ * set config2 when creating kernel counter and relies default host mapping.
+ */
+ if (event->attr.config2)
+ temp_mask = event->attr.config2;
+ break;
+ default:
+ break;
+ }
+
+ if (temp_mask)
+ hw_ctr_mask &= temp_mask;
+
+ if (!hw_ctr_mask)
+ return -EINVAL;
- /* Select only hpmcounters */
- hw_ctr_mask = cmask & (~0x7);
- hw_ctr_mask &= ~(cpuc->used_hw_ctrs[0]);
return __ffs(hw_ctr_mask);
}
@@ -1579,10 +1642,6 @@ static int rvpmu_deleg_ctr_get_idx(struct perf_event *event)
u64 priv_filter;
int idx;
- /*
- * TODO: We should not rely on SBI Perf encoding to check if the event
- * is a fixed one or not.
- */
if (!is_sampling_event(event)) {
idx = get_deleg_fixed_hw_idx(cpuc, event);
if (idx == 0 || idx == 2) {
@@ -1602,10 +1661,13 @@ static int rvpmu_deleg_ctr_get_idx(struct perf_event *event)
goto out_err;
found_idx:
priv_filter = get_deleg_priv_filter_bits(event);
+ if (test_and_set_bit(idx, cpuc->used_hw_ctrs))
+ goto out_err;
write_deleg_hpmevent(idx, hwc->config, priv_filter);
+ return idx;
skip_update:
- if (!test_and_set_bit(idx, cpuc->used_hw_ctrs))
- return idx;
+ set_bit(idx, cpuc->used_hw_ctrs);
+ return idx;
out_err:
return -ENOENT;
}
diff --git a/include/linux/perf/riscv_pmu.h b/include/linux/perf/riscv_pmu.h
index 3c64151cb038..b23b71cb4e66 100644
--- a/include/linux/perf/riscv_pmu.h
+++ b/include/linux/perf/riscv_pmu.h
@@ -30,6 +30,8 @@
#define RISCV_PMU_CONFIG1_GUEST_EVENTS 0x1
#define RISCV_PMU_DELEG_RAW_EVENT_MASK GENMASK_ULL(55, 0)
+#define RISCV_PMU_CYCLE_FIXED_CTR_MASK 0x01
+#define RISCV_PMU_INSTRUCTION_FIXED_CTR_MASK 0x04
struct cpu_hw_events {
/* currently enabled events */
--
2.53.0-Meta
^ permalink raw reply related [flat|nested] 30+ messages in thread* Re: [PATCH v9 16/20] RISC-V: perf: Use config2/vendor table for event to counter mapping
2026-08-07 8:09 ` [PATCH v9 16/20] RISC-V: perf: Use config2/vendor table for event to counter mapping Atish Patra
@ 2026-08-07 8:43 ` sashiko-bot
0 siblings, 0 replies; 30+ messages in thread
From: sashiko-bot @ 2026-08-07 8:43 UTC (permalink / raw)
To: Atish Patra; +Cc: conor+dt, linux-perf-users, robh, devicetree
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] Standard host legacy hardware events (e.g., 'perf stat -e cycles') fail to open and cannot map to fixed counters via the vendor driver table.
- [High] Raw events with broad counter masks are unconditionally forced to count cycles or instructions on fixed counters, returning incorrect metrics.
--
--- Patch [16]: [PATCH v9 16/20] RISC-V: perf: Use config2/vendor table for event to counter mapping ---
commit 450780026222524d85a7b60f40dbdc3d52fed837
Author: Atish Patra <atishp@rivosinc.com>
Subject: RISC-V: perf: Use config2/vendor table for event to counter mapping
This patch allows platform vendors to specify custom mapping between
events and hpmcounters using the config2 parameter in perf attributes.
Legacy events are mapped via the vendor event table in the driver, while
the fixed cycle and instruction counters map to legacy events.
> diff --git a/drivers/perf/riscv_pmu_sbi.c b/drivers/perf/riscv_pmu_sbi.c
> index f0b8b6eff2ea7..ee0c077859273 100644
> --- a/drivers/perf/riscv_pmu_sbi.c
> +++ b/drivers/perf/riscv_pmu_sbi.c
[ ... ]
> @@ -1522,24 +1524,85 @@ static int rvpmu_deleg_find_ctrs(void)
> static int get_deleg_fixed_hw_idx(struct cpu_hw_events *cpuc, struct perf_event *event)
> {
> - return -EINVAL;
> + bool guest_events = event->attr.config1 & RISCV_PMU_CONFIG1_GUEST_EVENTS;
> + int idx;
> +
> + /* event_base is 0 on the delegation path; match via the original perf attrs. */
> + if (guest_events) {
> + if (event->attr.type != PERF_TYPE_HARDWARE)
> + return -EINVAL;
> + if (event->attr.config == PERF_COUNT_HW_CPU_CYCLES)
> + idx = 0; /* CY counter */
> + else if (event->attr.config == PERF_COUNT_HW_INSTRUCTIONS)
> + idx = 2; /* IR counter */
> + else
> + return -EINVAL;
> + } else if (event->attr.config2 & RISCV_PMU_CYCLE_FIXED_CTR_MASK) {
> + idx = 0; /* CY counter */
[Severity: High]
Does this unconditionally force raw events with broad counter masks to count
cycles instead of the requested metric?
If a raw event is provided with a broad counterid_mask (e.g., 0xFFFFFFFF)
that allows any counter, config2 will have bit 0 set. This causes
get_deleg_fixed_hw_idx() to immediately assign it to fixed counter 0.
Since fixed counter 0 is architecturally hardwired to count cycles, the
actual raw event ID is ignored and the PMU returns cycle counts, leading to
incorrect metrics.
> + } else if (event->attr.config2 & RISCV_PMU_INSTRUCTION_FIXED_CTR_MASK) {
> + idx = 2; /* IR counter */
> + } else {
> + return -EINVAL;
> + }
> +
> + /* Take the fixed counter only if delegated and free, else fall back. */
> + if (!(cmask & BIT(idx)) || test_bit(idx, cpuc->used_hw_ctrs))
> + return -EINVAL;
> +
> + return idx;
> }
>
> static int get_deleg_next_hpm_hw_idx(struct cpu_hw_events *cpuc, struct perf_event *event)
> {
> - unsigned long hw_ctr_mask = 0;
> + u32 hw_ctr_mask = 0, temp_mask = 0;
> + u32 type = event->attr.type;
> + u64 config = event->attr.config;
> + int ret;
>
> - /*
> - * TODO: Treat every hpmcounter can monitor every event for now.
> - * The event to counter mapping should come from the json file.
> - * The mapping should also tell if sampling is supported or not.
> - */
> + /* Select only available hpmcounters */
> + hw_ctr_mask = cmask & (~0x7) & ~(cpuc->used_hw_ctrs[0]);
[Severity: High]
Will standard host legacy hardware events fail to map to fixed counters if
the vendor map mandates them?
When a user runs a command like "perf stat -e cycles", config2 is 0.
As a result, get_deleg_fixed_hw_idx() ignores current_pmu_hw_event_map and
returns -EINVAL without finding a fixed counter mapping.
This fallback function then explicitly strips out fixed counter bits (~0x7),
which prevents assigning fixed counters even if the vendor table specifically
requests them. If the vendor map requires counter 0 via counterid_mask, the
resulting hw_ctr_mask becomes 0, and the allocation fails entirely with
-ENOENT.
> +
> + switch (type) {
> + case PERF_TYPE_HARDWARE:
> + temp_mask = current_pmu_hw_event_map[config].counterid_mask;
> + break;
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260807-counter_delegation-v9-0-58658104e487@meta.com?part=16
^ permalink raw reply [flat|nested] 30+ messages in thread
* [PATCH v9 17/20] RISC-V: perf: Add legacy event encodings via sysfs
2026-08-07 8:08 [PATCH v9 00/20] Add Counter delegation ISA extension support Atish Patra
` (15 preceding siblings ...)
2026-08-07 8:09 ` [PATCH v9 16/20] RISC-V: perf: Use config2/vendor table for event to counter mapping Atish Patra
@ 2026-08-07 8:09 ` Atish Patra
2026-08-07 8:40 ` sashiko-bot
2026-08-07 8:09 ` [PATCH v9 18/20] RISC-V: perf: Add Qemu virt machine events Atish Patra
` (3 subsequent siblings)
20 siblings, 1 reply; 30+ messages in thread
From: Atish Patra @ 2026-08-07 8:09 UTC (permalink / raw)
To: Will Deacon, Atish Patra, Arnaldo Carvalho de Melo, Anup Patel,
Ian Rogers, Rob Herring, Paul Walmsley, Mark Rutland, Jiri Olsa,
Krzysztof Kozlowski, James Clark, Namhyung Kim
Cc: linux-riscv, linux-arm-kernel, Conor Dooley, linux-kernel,
linux-perf-users, devicetree
From: Atish Patra <atishp@rivosinc.com>
Define sysfs details for the legacy events so that any tool can
parse these to understand the minimum set of legacy events
supported by the platform. The sysfs entry will describe both event
encoding and corresponding counter map so that an perf event can be
programmed accordingly.
Signed-off-by: Atish Patra <atishp@rivosinc.com>
Reviewed-by: Charlie Jenkins <thecharlesjenkins@gmail.com>
Tested-by: Charlie Jenkins <thecharlesjenkins@gmail.com>
---
drivers/perf/riscv_pmu_sbi.c | 22 ++++++++++++++++++++--
1 file changed, 20 insertions(+), 2 deletions(-)
diff --git a/drivers/perf/riscv_pmu_sbi.c b/drivers/perf/riscv_pmu_sbi.c
index ee0c07785927..5eb49db8bc7c 100644
--- a/drivers/perf/riscv_pmu_sbi.c
+++ b/drivers/perf/riscv_pmu_sbi.c
@@ -130,7 +130,20 @@ static struct attribute_group riscv_cdeleg_pmu_format_group = {
.attrs = riscv_cdeleg_pmu_formats_attr,
};
+#define RVPMU_EVENT_ATTR_RESOLVE(m) #m
+#define RVPMU_EVENT_CMASK_ATTR(_name, _var, config, mask) \
+ PMU_EVENT_ATTR_STRING(_name, rvpmu_event_attr_##_var, \
+ "event=" RVPMU_EVENT_ATTR_RESOLVE(config) \
+ ",counterid_mask=" RVPMU_EVENT_ATTR_RESOLVE(mask))
+
+#define RVPMU_EVENT_ATTR_PTR(name) (&rvpmu_event_attr_##name.attr.attr)
+
+static struct attribute_group riscv_cdeleg_pmu_event_group __ro_after_init = {
+ .name = "events",
+};
+
static const struct attribute_group *riscv_cdeleg_pmu_attr_groups[] = {
+ &riscv_cdeleg_pmu_event_group,
&riscv_cdeleg_pmu_format_group,
NULL,
};
@@ -446,11 +459,14 @@ struct riscv_vendor_pmu_events {
const struct riscv_pmu_event *hw_event_map;
const struct riscv_pmu_event (*cache_event_map)[PERF_COUNT_HW_CACHE_OP_MAX]
[PERF_COUNT_HW_CACHE_RESULT_MAX];
+ struct attribute **attrs_events;
};
-#define RISCV_VENDOR_PMU_EVENTS(_vendorid, _archid, _implid, _hw_event_map, _cache_event_map) \
+#define RISCV_VENDOR_PMU_EVENTS(_vendorid, _archid, _implid, _hw_event_map, \
+ _cache_event_map, _attrs) \
{ .vendorid = _vendorid, .archid = _archid, .implid = _implid, \
- .hw_event_map = _hw_event_map, .cache_event_map = _cache_event_map },
+ .hw_event_map = _hw_event_map, .cache_event_map = _cache_event_map, \
+ .attrs_events = _attrs },
static struct riscv_vendor_pmu_events pmu_vendor_events_table[] = {
};
@@ -472,6 +488,8 @@ static void __init rvpmu_vendor_register_events(void)
pmu_vendor_events_table[i].archid == arch_id) {
current_pmu_hw_event_map = pmu_vendor_events_table[i].hw_event_map;
current_pmu_cache_event_map = pmu_vendor_events_table[i].cache_event_map;
+ riscv_cdeleg_pmu_event_group.attrs =
+ pmu_vendor_events_table[i].attrs_events;
break;
}
}
--
2.53.0-Meta
^ permalink raw reply related [flat|nested] 30+ messages in thread* Re: [PATCH v9 17/20] RISC-V: perf: Add legacy event encodings via sysfs
2026-08-07 8:09 ` [PATCH v9 17/20] RISC-V: perf: Add legacy event encodings via sysfs Atish Patra
@ 2026-08-07 8:40 ` sashiko-bot
0 siblings, 0 replies; 30+ messages in thread
From: sashiko-bot @ 2026-08-07 8:40 UTC (permalink / raw)
To: Atish Patra; +Cc: robh, conor+dt, devicetree, linux-perf-users
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The macro RVPMU_EVENT_ATTR_RESOLVE performs single-level stringification, preventing macro expansion of event configuration values.
--
--- Patch [17]: [PATCH v9 17/20] RISC-V: perf: Add legacy event encodings via sysfs ---
commit b1ff3421691bcc5997cb4d931f9fdffb9eef0d1c
Author: Atish Patra <atishp@rivosinc.com>
RISC-V: perf: Add legacy event encodings via sysfs
This commit defines sysfs entries for legacy events to expose event
encoding and counter maps to tools like perf.
> diff --git a/drivers/perf/riscv_pmu_sbi.c b/drivers/perf/riscv_pmu_sbi.c
> index ee0c077859273..5eb49db8bc7c1 100644
> --- a/drivers/perf/riscv_pmu_sbi.c
> +++ b/drivers/perf/riscv_pmu_sbi.c
> @@ -130,7 +130,20 @@ static struct attribute_group riscv_cdeleg_pmu_format_group = {
> .attrs = riscv_cdeleg_pmu_formats_attr,
> };
>
> +#define RVPMU_EVENT_ATTR_RESOLVE(m) #m
[Severity: Medium]
Does this single-level stringification handle macro arguments correctly?
If a platform driver defines event mappings and passes standard kernel macros
for the config or mask arguments to RVPMU_EVENT_CMASK_ATTR, this definition
will stringify them verbatim without evaluation.
For example, passing a macro like RISCV_PMU_CYCLE_FIXED_CTR_MASK would emit
the literal string "event=RISCV_PMU_CYCLE_FIXED_CTR_MASK" instead of its
numeric value. This breaks the perf tool's ability to parse the event
encoding, rendering the PMU events unusable.
Would it be better to use __stringify() from linux/stringify.h so that both
literal numbers and macros evaluate correctly?
> +#define RVPMU_EVENT_CMASK_ATTR(_name, _var, config, mask) \
> + PMU_EVENT_ATTR_STRING(_name, rvpmu_event_attr_##_var, \
> + "event=" RVPMU_EVENT_ATTR_RESOLVE(config) \
> + ",counterid_mask=" RVPMU_EVENT_ATTR_RESOLVE(mask))
> +
[ ... ]
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260807-counter_delegation-v9-0-58658104e487@meta.com?part=17
^ permalink raw reply [flat|nested] 30+ messages in thread
* [PATCH v9 18/20] RISC-V: perf: Add Qemu virt machine events
2026-08-07 8:08 [PATCH v9 00/20] Add Counter delegation ISA extension support Atish Patra
` (16 preceding siblings ...)
2026-08-07 8:09 ` [PATCH v9 17/20] RISC-V: perf: Add legacy event encodings via sysfs Atish Patra
@ 2026-08-07 8:09 ` Atish Patra
2026-08-07 8:41 ` sashiko-bot
2026-08-07 8:09 ` [PATCH v9 19/20] tools/perf: Support event code for arch standard events Atish Patra
` (2 subsequent siblings)
20 siblings, 1 reply; 30+ messages in thread
From: Atish Patra @ 2026-08-07 8:09 UTC (permalink / raw)
To: Will Deacon, Atish Patra, Arnaldo Carvalho de Melo, Anup Patel,
Ian Rogers, Rob Herring, Paul Walmsley, Mark Rutland, Jiri Olsa,
Krzysztof Kozlowski, James Clark, Namhyung Kim
Cc: linux-riscv, linux-arm-kernel, Conor Dooley, linux-kernel,
linux-perf-users, devicetree
From: Atish Patra <atishp@rivosinc.com>
Qemu virt machine supports a very minimal set of legacy perf events.
Add them to the vendor table so that users can use them when
counter delegation is enabled.
Qemu is identified by its marchid. Older Qemu reports all-zero
mvendorid/marchid/mimpid, while newer Qemu reports the marchid 0x2a (42)
allocated to it in the RISC-V ISA manual [1]. Register the events for
both ids so they are available across Qemu versions.
[1] https://github.com/riscv/riscv-isa-manual/blob/main/marchid.md
Signed-off-by: Atish Patra <atishp@rivosinc.com>
Reviewed-by: Charlie Jenkins <thecharlesjenkins@gmail.com>
Tested-by: Charlie Jenkins <thecharlesjenkins@gmail.com>
---
arch/riscv/include/asm/vendorid_list.h | 6 ++++++
drivers/perf/riscv_pmu_sbi.c | 39 ++++++++++++++++++++++++++++++++++
2 files changed, 45 insertions(+)
diff --git a/arch/riscv/include/asm/vendorid_list.h b/arch/riscv/include/asm/vendorid_list.h
index 7f5030ee1fcf..beaf9236dba7 100644
--- a/arch/riscv/include/asm/vendorid_list.h
+++ b/arch/riscv/include/asm/vendorid_list.h
@@ -11,4 +11,10 @@
#define SIFIVE_VENDOR_ID 0x489
#define THEAD_VENDOR_ID 0x5b7
+#define QEMU_VIRT_VENDOR_ID 0x000
+#define QEMU_VIRT_IMPL_ID 0x000
+#define QEMU_VIRT_ARCH_ID 0x000
+/* Newer Qemu reports the spec-allocated marchid 0x2a (42) for non-vendor CPUs */
+#define QEMU_VIRT_ARCH_ID_SPEC 0x2a
+
#endif
diff --git a/drivers/perf/riscv_pmu_sbi.c b/drivers/perf/riscv_pmu_sbi.c
index 5eb49db8bc7c..9220c75651a5 100644
--- a/drivers/perf/riscv_pmu_sbi.c
+++ b/drivers/perf/riscv_pmu_sbi.c
@@ -26,6 +26,7 @@
#include <asm/sbi.h>
#include <asm/cpufeature.h>
#include <asm/vendor_extensions.h>
+#include <asm/vendorid_list.h>
#include <asm/vendor_extensions/andes.h>
#include <asm/hwcap.h>
#include <asm/csr_indirect.h>
@@ -468,7 +469,45 @@ struct riscv_vendor_pmu_events {
.hw_event_map = _hw_event_map, .cache_event_map = _cache_event_map, \
.attrs_events = _attrs },
+/* QEMU virt PMU events */
+static const struct riscv_pmu_event qemu_virt_hw_event_map[PERF_COUNT_HW_MAX] = {
+ PERF_MAP_ALL_UNSUPPORTED,
+ [PERF_COUNT_HW_CPU_CYCLES] = {0x01, 0xFFFFFFF8},
+ [PERF_COUNT_HW_INSTRUCTIONS] = {0x02, 0xFFFFFFF8}
+};
+
+static const struct riscv_pmu_event qemu_virt_cache_event_map[PERF_COUNT_HW_CACHE_MAX]
+ [PERF_COUNT_HW_CACHE_OP_MAX]
+ [PERF_COUNT_HW_CACHE_RESULT_MAX] = {
+ PERF_CACHE_MAP_ALL_UNSUPPORTED,
+ [C(DTLB)][C(OP_READ)][C(RESULT_MISS)] = {0x10019, 0xFFFFFFF8},
+ [C(DTLB)][C(OP_WRITE)][C(RESULT_MISS)] = {0x1001B, 0xFFFFFFF8},
+
+ [C(ITLB)][C(OP_READ)][C(RESULT_MISS)] = {0x10021, 0xFFFFFFF8},
+};
+
+RVPMU_EVENT_CMASK_ATTR(cycles, cycles, 0x01, 0xFFFFFFF8);
+RVPMU_EVENT_CMASK_ATTR(instructions, instructions, 0x02, 0xFFFFFFF8);
+RVPMU_EVENT_CMASK_ATTR(dTLB-load-misses, dTLB_load_miss, 0x10019, 0xFFFFFFF8);
+RVPMU_EVENT_CMASK_ATTR(dTLB-store-misses, dTLB_store_miss, 0x1001B, 0xFFFFFFF8);
+RVPMU_EVENT_CMASK_ATTR(iTLB-load-misses, iTLB_load_miss, 0x10021, 0xFFFFFFF8);
+
+static struct attribute *qemu_virt_event_group[] = {
+ RVPMU_EVENT_ATTR_PTR(cycles),
+ RVPMU_EVENT_ATTR_PTR(instructions),
+ RVPMU_EVENT_ATTR_PTR(dTLB_load_miss),
+ RVPMU_EVENT_ATTR_PTR(dTLB_store_miss),
+ RVPMU_EVENT_ATTR_PTR(iTLB_load_miss),
+ NULL,
+};
+
static struct riscv_vendor_pmu_events pmu_vendor_events_table[] = {
+ RISCV_VENDOR_PMU_EVENTS(QEMU_VIRT_VENDOR_ID, QEMU_VIRT_ARCH_ID, QEMU_VIRT_IMPL_ID,
+ qemu_virt_hw_event_map, qemu_virt_cache_event_map,
+ qemu_virt_event_group)
+ RISCV_VENDOR_PMU_EVENTS(QEMU_VIRT_VENDOR_ID, QEMU_VIRT_ARCH_ID_SPEC, QEMU_VIRT_IMPL_ID,
+ qemu_virt_hw_event_map, qemu_virt_cache_event_map,
+ qemu_virt_event_group)
};
static const struct riscv_pmu_event *current_pmu_hw_event_map;
--
2.53.0-Meta
^ permalink raw reply related [flat|nested] 30+ messages in thread* Re: [PATCH v9 18/20] RISC-V: perf: Add Qemu virt machine events
2026-08-07 8:09 ` [PATCH v9 18/20] RISC-V: perf: Add Qemu virt machine events Atish Patra
@ 2026-08-07 8:41 ` sashiko-bot
0 siblings, 0 replies; 30+ messages in thread
From: sashiko-bot @ 2026-08-07 8:41 UTC (permalink / raw)
To: Atish Patra; +Cc: robh, linux-perf-users, conor+dt, devicetree
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The `counterid_mask` for `cycles` and `instructions` events in the QEMU PMU vendor events table incorrectly excludes fixed counters, unnecessarily consuming limited programmable counters.
--
--- Patch [18]: [PATCH v9 18/20] RISC-V: perf: Add Qemu virt machine events ---
commit c3b03b30f6d05637f0ec5ea8c549bff42e2bbc49
Author: Atish Patra <atishp@rivosinc.com>
RISC-V: perf: Add Qemu virt machine events
Qemu virt machine supports a very minimal set of legacy perf events.
Add them to the vendor table so that users can use them when
counter delegation is enabled.
> diff --git a/drivers/perf/riscv_pmu_sbi.c b/drivers/perf/riscv_pmu_sbi.c
> index 5eb49db8bc7c1..9220c75651a5c 100644
> --- a/drivers/perf/riscv_pmu_sbi.c
> +++ b/drivers/perf/riscv_pmu_sbi.c
[ ... ]
> @@ -468,7 +469,45 @@ struct riscv_vendor_pmu_events {
> .hw_event_map = _hw_event_map, .cache_event_map = _cache_event_map, \
> .attrs_events = _attrs },
>
> +/* QEMU virt PMU events */
> +static const struct riscv_pmu_event qemu_virt_hw_event_map[PERF_COUNT_HW_MAX] = {
> + PERF_MAP_ALL_UNSUPPORTED,
> + [PERF_COUNT_HW_CPU_CYCLES] = {0x01, 0xFFFFFFF8},
> + [PERF_COUNT_HW_INSTRUCTIONS] = {0x02, 0xFFFFFFF8}
> +};
[Severity: Medium]
Does the counterid_mask of 0xFFFFFFF8 inadvertently exclude the fixed hardware
counters for these events?
By clearing bits 0, 1, and 2, this mask prevents the driver from using the
dedicated fixed counters (counter 0 for cycles, counter 2 for instructions).
When checking if a fixed counter is permitted, get_deleg_fixed_hw_idx()
verifies event->attr.config2 against RISCV_PMU_CYCLE_FIXED_CTR_MASK (0x01)
or RISCV_PMU_INSTRUCTION_FIXED_CTR_MASK (0x04). Because 0xFFFFFFF8 & 0x01 == 0
and 0xFFFFFFF8 & 0x04 == 0, the driver will bypass the fixed counters and
unnecessarily consume scarce programmable HPM counters instead.
Would it be better to include the respective fixed counter bits in the mask
(e.g., 0xFFFFFFF9 for cycles and 0xFFFFFFFD for instructions), or perhaps
use 0xFFFFFFFF?
> +
> +static const struct riscv_pmu_event qemu_virt_cache_event_map[PERF_COUNT_HW_CACHE_MAX]
> + [PERF_COUNT_HW_CACHE_OP_MAX]
> + [PERF_COUNT_HW_CACHE_RESULT_MAX] = {
[ ... ]
> + [C(ITLB)][C(OP_READ)][C(RESULT_MISS)] = {0x10021, 0xFFFFFFF8},
> +};
> +
> +RVPMU_EVENT_CMASK_ATTR(cycles, cycles, 0x01, 0xFFFFFFF8);
> +RVPMU_EVENT_CMASK_ATTR(instructions, instructions, 0x02, 0xFFFFFFF8);
[Severity: Medium]
Since this macro exposes the counterid_mask to userspace via sysfs aliases,
does providing 0xFFFFFFF8 here cause the perf tool to populate config2 with
0xFFFFFFF8?
If so, this will enforce the same fixed-counter bypass on the counter
delegation path. Updating these masks to include the fixed counter bits
would ensure they can be fully utilized.
> +RVPMU_EVENT_CMASK_ATTR(dTLB-load-misses, dTLB_load_miss, 0x10019, 0xFFFFFFF8);
[ ... ]
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260807-counter_delegation-v9-0-58658104e487@meta.com?part=18
^ permalink raw reply [flat|nested] 30+ messages in thread
* [PATCH v9 19/20] tools/perf: Support event code for arch standard events
2026-08-07 8:08 [PATCH v9 00/20] Add Counter delegation ISA extension support Atish Patra
` (17 preceding siblings ...)
2026-08-07 8:09 ` [PATCH v9 18/20] RISC-V: perf: Add Qemu virt machine events Atish Patra
@ 2026-08-07 8:09 ` Atish Patra
2026-08-07 8:09 ` [PATCH v9 20/20] tools/perf: Add RISC-V CounterIDMask event field Atish Patra
2026-08-08 17:36 ` [PATCH v9 00/20] Add Counter delegation ISA extension support Paul Walmsley
20 siblings, 0 replies; 30+ messages in thread
From: Atish Patra @ 2026-08-07 8:09 UTC (permalink / raw)
To: Will Deacon, Atish Patra, Arnaldo Carvalho de Melo, Anup Patel,
Ian Rogers, Rob Herring, Paul Walmsley, Mark Rutland, Jiri Olsa,
Krzysztof Kozlowski, James Clark, Namhyung Kim
Cc: linux-riscv, linux-arm-kernel, Conor Dooley, linux-kernel,
linux-perf-users, devicetree
From: Atish Patra <atishp@rivosinc.com>
RISC-V relies on the event encoding from the json file. That includes
arch standard events. If event code is present, event is already updated
with correct encoding. No need to update it again which results in losing
the event encoding.
Signed-off-by: Atish Patra <atishp@rivosinc.com>
Reviewed-by: Ian Rogers <irogers@google.com>
---
tools/perf/pmu-events/arch/riscv/arch-standard.json | 10 ++++++++++
tools/perf/pmu-events/jevents.py | 9 ++++++++-
2 files changed, 18 insertions(+), 1 deletion(-)
diff --git a/tools/perf/pmu-events/arch/riscv/arch-standard.json b/tools/perf/pmu-events/arch/riscv/arch-standard.json
new file mode 100644
index 000000000000..96e21f088558
--- /dev/null
+++ b/tools/perf/pmu-events/arch/riscv/arch-standard.json
@@ -0,0 +1,10 @@
+[
+ {
+ "EventName": "cycles",
+ "BriefDescription": "cycle executed"
+ },
+ {
+ "EventName": "instructions",
+ "BriefDescription": "instruction retired"
+ }
+]
diff --git a/tools/perf/pmu-events/jevents.py b/tools/perf/pmu-events/jevents.py
index 376dc2d24162..e9c6b7990880 100755
--- a/tools/perf/pmu-events/jevents.py
+++ b/tools/perf/pmu-events/jevents.py
@@ -413,7 +413,14 @@ class JsonEvent:
self.long_desc = None
if arch_std:
if arch_std.lower() in _arch_std_events:
- event = _arch_std_events[arch_std.lower()].event
+ # Inherit the arch-standard encoding only if this event defines no
+ # explicit encoding of its own. Events with explicit EventCode,
+ # ConfigCode, etc. may carry alternate encodings and appended modifiers
+ # that must survive.
+ if ('EventCode' not in jd and 'ExtSel' not in jd and
+ configcode is None and eventidcode is None and
+ legacy_hw_config is None and legacy_cache_config is None):
+ event = _arch_std_events[arch_std.lower()].event
# Copy from the architecture standard event to self for undefined fields.
for attr, value in _arch_std_events[arch_std.lower()].__dict__.items():
if hasattr(self, attr) and not getattr(self, attr):
--
2.53.0-Meta
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH v9 20/20] tools/perf: Add RISC-V CounterIDMask event field
2026-08-07 8:08 [PATCH v9 00/20] Add Counter delegation ISA extension support Atish Patra
` (18 preceding siblings ...)
2026-08-07 8:09 ` [PATCH v9 19/20] tools/perf: Support event code for arch standard events Atish Patra
@ 2026-08-07 8:09 ` Atish Patra
2026-08-08 17:36 ` [PATCH v9 00/20] Add Counter delegation ISA extension support Paul Walmsley
20 siblings, 0 replies; 30+ messages in thread
From: Atish Patra @ 2026-08-07 8:09 UTC (permalink / raw)
To: Will Deacon, Atish Patra, Arnaldo Carvalho de Melo, Anup Patel,
Ian Rogers, Rob Herring, Paul Walmsley, Mark Rutland, Jiri Olsa,
Krzysztof Kozlowski, James Clark, Namhyung Kim
Cc: linux-riscv, linux-arm-kernel, Conor Dooley, linux-kernel,
linux-perf-users, devicetree
From: Atish Patra <atishp@rivosinc.com>
Counter delegation lets supervisor mode choose the hpmcounter for an event,
but the hardware may only allow a given event on a subset of counters. Add
a RISC-V specific "CounterIDMask" json event field, handled like the other
arch-specific entries in event_fields[], that carries the allowed-counter
bitmask through to the driver's existing counterid_mask (config2:0-31)
format.
The value is the bitmask directly so no counter-list to bitmask
conversion is needed, and because the field is RISC-V specific it is a
no-op for every other architecture's events (unlike the shared "Counter"
field).
Signed-off-by: Atish Patra <atishp@rivosinc.com>
Reviewed-by: Ian Rogers <irogers@google.com>
---
tools/perf/pmu-events/jevents.py | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/perf/pmu-events/jevents.py b/tools/perf/pmu-events/jevents.py
index e9c6b7990880..e79143af6aa0 100755
--- a/tools/perf/pmu-events/jevents.py
+++ b/tools/perf/pmu-events/jevents.py
@@ -396,6 +396,7 @@ class JsonEvent:
('EnAllSlices', 'enallslices='),
('SliceId', 'sliceid='),
('ThreadMask', 'threadmask='),
+ ('CounterIDMask', 'counterid_mask='),
]
for key, value in event_fields:
if key in jd and not is_zero(jd[key]):
--
2.53.0-Meta
^ permalink raw reply related [flat|nested] 30+ messages in thread* Re: [PATCH v9 00/20] Add Counter delegation ISA extension support
2026-08-07 8:08 [PATCH v9 00/20] Add Counter delegation ISA extension support Atish Patra
` (19 preceding siblings ...)
2026-08-07 8:09 ` [PATCH v9 20/20] tools/perf: Add RISC-V CounterIDMask event field Atish Patra
@ 2026-08-08 17:36 ` Paul Walmsley
20 siblings, 0 replies; 30+ messages in thread
From: Paul Walmsley @ 2026-08-08 17:36 UTC (permalink / raw)
To: Atish Patra
Cc: Will Deacon, Arnaldo Carvalho de Melo, Anup Patel, Ian Rogers,
Rob Herring, Paul Walmsley, Mark Rutland, Jiri Olsa,
Krzysztof Kozlowski, James Clark, Namhyung Kim, linux-riscv,
linux-arm-kernel, Conor Dooley, linux-kernel, linux-perf-users,
devicetree
On Fri, 7 Aug 2026, Atish Patra wrote:
> This series adds the counter delegation extension support. It is based on
> very early PoC work done by Kevin Xue and mostly rewritten after that.
> The counter delegation ISA extension(Smcdeleg/Ssccfg) actually depends
> on multiple ISA extensions.
I'll put the first ten patches in riscv/for-next, replacing the ones I
queued up earlier. Let's take a look at the remaining patches in the v7.4
time period, due to the other recent updates.
thanks
- Paul
^ permalink raw reply [flat|nested] 30+ messages in thread