[Qemu-devel] [PATCH V2 0/5] Add vPMU vPMU support under TCG mode

[Qemu-devel] [PATCH V2 0/5] Add vPMU vPMU support under TCG mode

[Wei Huang]

But this feature is not complete. In fact using perf inside a
64-bit Linux guest VM (under TCG) can cause the following kernel panic
because some PMU registers are not implemented.

[  329.445970] [<fffffe000009e600>] armv8pmu_enable_event+0x58/0x8c
[  329.446713] [<fffffe0000621e74>] armpmu_start+0x4c/0x74

This patchset solves the problem by adding support for missing vPMU
registers. Basic perf test can work (both ACPI and DT) now under TCG
by applying this patchset.

address@hidden ~]# perf stat ls
 Performance counter stats for 'ls':

        226.740256      task-clock (msec)         #    0.312 CPUs utilized    
                76      context-switches          #    0.335 K/sec
                 0      cpu-migrations            #    0.000 K/sec
                64      page-faults               #    0.282 K/sec
       186,031,410      cycles                    #    0.820 GHz      (36.40%)
   <not supported>      stalled-cycles-frontend
   <not supported>      stalled-cycles-backend
     <not counted>      instructions               (0.00%)
   <not supported>      branches
     <not counted>      branch-misses              (0.00%)

V1->V2:
  * Change most PMU registers to 64bit and the behavior of PMXEVTYPER
  * Add support for PMXEVCNTR_EL0
  * Misc fixes (DT, ID_AA64DFR0_EL1, ...) under TCG mode

Thanks,
-Wei

Wei Huang (5):
  target-arm: Add support for PMU register PMSELR_EL0
  target-arm: Add support for AArch64 PMU register PMXEVTYPER_EL0
  target-arm: Add support for PMU register PMXEVCNTR_EL0
  target-arm: Add support for PMU register PMINTENSET_EL1
  target-arm: Enable vPMU support under TCG mode

 hw/arm/virt.c       |  2 +-
 target/arm/cpu.c    |  2 +-
 target/arm/cpu.h    |  5 +++--
 target/arm/helper.c | 65 ++++++++++++++++++++++++++++++++++++++++-------------
 4 files changed, 55 insertions(+), 19 deletions(-)

-- 
1.8.3.1

[Qemu-devel] [PATCH V2 1/5] target-arm: Add support for PMU register PMSELR_EL0

[Wei Huang]

This patch adds support for AArch64 register PMSELR_EL0. The existing
PMSELR definition is revised accordingly.

Signed-off-by: Wei Huang <wei@redhat.com>
---
 target/arm/cpu.h    |  1 +
 target/arm/helper.c | 25 ++++++++++++++++++++-----
 2 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 39bff86..8a82c73 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -309,6 +309,7 @@ typedef struct CPUARMState {
         uint32_t c9_pmovsr; /* perf monitor overflow status */
         uint32_t c9_pmxevtyper; /* perf monitor event type */
         uint32_t c9_pmuserenr; /* perf monitor user enable */
+        uint64_t c9_pmselr; /* perf monitor counter selection register */
         uint32_t c9_pminten; /* perf monitor interrupt enables */
         union { /* Memory attribute redirection */
             struct {
diff --git a/target/arm/helper.c b/target/arm/helper.c
index c23df1b..67520ea 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -975,6 +975,17 @@ static uint64_t pmccntr_read(CPUARMState *env, const ARMCPRegInfo *ri)
     return total_ticks - env->cp15.c15_ccnt;
 }
 
+static void pmselr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                         uint64_t value)
+{
+    /* The value of PMSELR.SEL affects the behavior of PMXEVTYPER and
+     * PMXEVCNTR. We allow [0..31] to be written to PMSELR here; in the
+     * meanwhile, we check PMSELR.SEL when PMXEVTYPER and PMXEVCNTR are
+     * accessed.
+     */
+    env->cp15.c9_pmselr = value & 0x1f;
+}
+
 static void pmccntr_write(CPUARMState *env, const ARMCPRegInfo *ri,
                         uint64_t value)
 {
@@ -1194,12 +1205,16 @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
     /* Unimplemented so WI. */
     { .name = "PMSWINC", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 4,
       .access = PL0_W, .accessfn = pmreg_access, .type = ARM_CP_NOP },
-    /* Since we don't implement any events, writing to PMSELR is UNPREDICTABLE.
-     * We choose to RAZ/WI.
-     */
     { .name = "PMSELR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 5,
-      .access = PL0_RW, .type = ARM_CP_CONST, .resetvalue = 0,
-      .accessfn = pmreg_access },
+      .access = PL0_RW, .type = ARM_CP_ALIAS,
+      .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmselr),
+      .accessfn = pmreg_access, .writefn = pmselr_write,
+      .raw_writefn = raw_write},
+    { .name = "PMSELR_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 5,
+      .access = PL0_RW, .accessfn = pmreg_access,
+      .fieldoffset = offsetof(CPUARMState, cp15.c9_pmselr),
+      .writefn = pmselr_write, .raw_writefn = raw_write, },
 #ifndef CONFIG_USER_ONLY
     { .name = "PMCCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 0,
       .access = PL0_RW, .resetvalue = 0, .type = ARM_CP_IO,
-- 
1.8.3.1

[Qemu-devel] [PATCH V2 2/5] target-arm: Add support for AArch64 PMU register PMXEVTYPER_EL0

[Wei Huang]

In order to support Linux perf, which uses PMXEVTYPER register,
this patch adds access support for PMXEVTYPER_EL0.

Signed-off-by: Wei Huang <wei@redhat.com>
---
 target/arm/cpu.h    |  2 +-
 target/arm/helper.c | 19 ++++++++++++++++---
 2 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 8a82c73..ce02044 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -307,7 +307,7 @@ typedef struct CPUARMState {
         uint64_t c9_pmcr; /* performance monitor control register */
         uint64_t c9_pmcnten; /* perf monitor counter enables */
         uint32_t c9_pmovsr; /* perf monitor overflow status */
-        uint32_t c9_pmxevtyper; /* perf monitor event type */
+        uint64_t c9_pmxevtyper; /* perf monitor event type */
         uint32_t c9_pmuserenr; /* perf monitor user enable */
         uint64_t c9_pmselr; /* perf monitor counter selection register */
         uint32_t c9_pminten; /* perf monitor interrupt enables */
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 67520ea..c8620d9 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -1054,7 +1054,13 @@ static void pmovsr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 static void pmxevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri,
                              uint64_t value)
 {
-    env->cp15.c9_pmxevtyper = value & 0xff;
+    /* Attempts to access PMXEVTYPER are CONSTRAINED UNPREDICTABLE when
+     * PMSELR value is equal to or greater than the number of implemented
+     * counters, but not euqal to 0x1f. We opt to behave as a NOP.
+     */
+    if (env->cp15.c9_pmselr == 0x1f) {
+        pmccfiltr_write(env, ri, value);
+    }
 }
 
 static void pmuserenr_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -1234,10 +1240,17 @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
       .fieldoffset = offsetof(CPUARMState, cp15.pmccfiltr_el0),
       .resetvalue = 0, },
     { .name = "PMXEVTYPER", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 1,
-      .access = PL0_RW,
-      .fieldoffset = offsetof(CPUARMState, cp15.c9_pmxevtyper),
+      .access = PL0_RW, .type = ARM_CP_ALIAS,
+      .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmxevtyper),
       .accessfn = pmreg_access, .writefn = pmxevtyper_write,
       .raw_writefn = raw_write },
+    { .name = "PMXEVTYPER_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 1,
+      .access = PL0_RW, .accessfn = pmreg_access,
+      .type = ARM_CP_IO,
+      .fieldoffset = offsetof(CPUARMState, cp15.c9_pmxevtyper),
+      .writefn = pmxevtyper_write, .raw_writefn = raw_write,
+      .resetvalue = 0x0 },
     /* Unimplemented, RAZ/WI. */
     { .name = "PMXEVCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 2,
       .access = PL0_RW, .type = ARM_CP_CONST, .resetvalue = 0,
-- 
1.8.3.1

[Qemu-devel] [PATCH V2 3/5] target-arm: Add support for PMU register PMXEVCNTR_EL0

[Wei Huang]

To make PMU register support complete, this patch adds support for
PMXEVCNTR_EL0.

Signed-off-by: Wei Huang <wei@redhat.com>
---
 target/arm/helper.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index c8620d9..6b8460a 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -1255,6 +1255,10 @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
     { .name = "PMXEVCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 2,
       .access = PL0_RW, .type = ARM_CP_CONST, .resetvalue = 0,
       .accessfn = pmreg_access },
+    { .name = "PMXEVCNTR_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 2,
+      .access = PL0_RW, .type = ARM_CP_CONST, .resetvalue = 0,
+      .accessfn = pmreg_access },
     { .name = "PMUSERENR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 0,
       .access = PL0_R | PL1_RW, .accessfn = access_tpm,
       .fieldoffset = offsetof(CPUARMState, cp15.c9_pmuserenr),
-- 
1.8.3.1

[Qemu-devel] [PATCH V2 4/5] target-arm: Add support for PMU register PMINTENSET_EL1

[Wei Huang]

This patch adds access support for PMINTENSET_EL1.

Signed-off-by: Wei Huang <wei@redhat.com>
---
 target/arm/cpu.h    |  2 +-
 target/arm/helper.c | 10 +++++++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index ce02044..42aaea9 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -310,7 +310,7 @@ typedef struct CPUARMState {
         uint64_t c9_pmxevtyper; /* perf monitor event type */
         uint32_t c9_pmuserenr; /* perf monitor user enable */
         uint64_t c9_pmselr; /* perf monitor counter selection register */
-        uint32_t c9_pminten; /* perf monitor interrupt enables */
+        uint64_t c9_pminten; /* perf monitor interrupt enables */
         union { /* Memory attribute redirection */
             struct {
 #ifdef HOST_WORDS_BIGENDIAN
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 6b8460a..b028042 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -1272,9 +1272,17 @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
       .writefn = pmuserenr_write, .raw_writefn = raw_write },
     { .name = "PMINTENSET", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 1,
       .access = PL1_RW, .accessfn = access_tpm,
-      .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
+      .type = ARM_CP_ALIAS,
+      .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pminten),
       .resetvalue = 0,
       .writefn = pmintenset_write, .raw_writefn = raw_write },
+    { .name = "PMINTENSET_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 1,
+      .access = PL1_RW, .accessfn = access_tpm,
+      .type = ARM_CP_IO,
+      .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
+      .writefn = pmintenset_write, .raw_writefn = raw_write,
+      .resetvalue = 0x0 },
     { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2,
       .access = PL1_RW, .accessfn = access_tpm, .type = ARM_CP_ALIAS,
       .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
-- 
1.8.3.1

[Qemu-devel] [PATCH V2 5/5] target-arm: Enable vPMU support under TCG mode

[Wei Huang]

This patch contains several fixes to enable vPMU under TCG mode. It
first removes the checking of kvm_enabled() while unsetting
ARM_FEATURE_PMU. With it, the .pmu option can be used to turn on/off vPMU
under TCG mode. Secondly the PMU node of DT table is now created under TCG.
The last fix is to disable the masking of PMUver field of ID_AA64DFR0_EL1.

Signed-off-by: Wei Huang <wei@redhat.com>
---
 hw/arm/virt.c       | 2 +-
 target/arm/cpu.c    | 2 +-
 target/arm/helper.c | 7 +------
 3 files changed, 3 insertions(+), 8 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 6c9e898..5687d49 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -471,7 +471,7 @@ static void fdt_add_pmu_nodes(const VirtMachineState *vms)
     CPU_FOREACH(cpu) {
         armcpu = ARM_CPU(cpu);
         if (!arm_feature(&armcpu->env, ARM_FEATURE_PMU) ||
-            !kvm_arm_pmu_create(cpu, PPI(VIRTUAL_PMU_IRQ))) {
+            (kvm_enabled() && !kvm_arm_pmu_create(cpu, PPI(VIRTUAL_PMU_IRQ)))) {
             return;
         }
     }
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index e9f10f7..9a2bc8a 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -745,7 +745,7 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         unset_feature(env, ARM_FEATURE_EL2);
     }
 
-    if (!cpu->has_pmu || !kvm_enabled()) {
+    if (!cpu->has_pmu) {
         cpu->has_pmu = false;
         unset_feature(env, ARM_FEATURE_PMU);
     }
diff --git a/target/arm/helper.c b/target/arm/helper.c
index b028042..6cf0f4f 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -4630,12 +4630,7 @@ void register_cp_regs_for_features(ARMCPU *cpu)
             { .name = "ID_AA64DFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
-              /* We mask out the PMUVer field, because we don't currently
-               * implement the PMU. Not advertising it prevents the guest
-               * from trying to use it and getting UNDEFs on registers we
-               * don't implement.
-               */
-              .resetvalue = cpu->id_aa64dfr0 & ~0xf00 },
+              .resetvalue = cpu->id_aa64dfr0 },
             { .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
-- 
1.8.3.1

Re: [Qemu-devel] [PATCH V2 1/5] target-arm: Add support for PMU register PMSELR_EL0

[Peter Maydell]

On 31 January 2017 at 15:15, Wei Huang <wei@redhat.com> wrote:
> This patch adds support for AArch64 register PMSELR_EL0. The existing
> PMSELR definition is revised accordingly.
>
> Signed-off-by: Wei Huang <wei@redhat.com>
> ---
>  target/arm/cpu.h    |  1 +
>  target/arm/helper.c | 25 ++++++++++++++++++++-----
>  2 files changed, 21 insertions(+), 5 deletions(-)
>
> diff --git a/target/arm/cpu.h b/target/arm/cpu.h
> index 39bff86..8a82c73 100644
> --- a/target/arm/cpu.h
> +++ b/target/arm/cpu.h
> @@ -309,6 +309,7 @@ typedef struct CPUARMState {
>          uint32_t c9_pmovsr; /* perf monitor overflow status */
>          uint32_t c9_pmxevtyper; /* perf monitor event type */
>          uint32_t c9_pmuserenr; /* perf monitor user enable */
> +        uint64_t c9_pmselr; /* perf monitor counter selection register */
>          uint32_t c9_pminten; /* perf monitor interrupt enables */
>          union { /* Memory attribute redirection */
>              struct {
> diff --git a/target/arm/helper.c b/target/arm/helper.c
> index c23df1b..67520ea 100644
> --- a/target/arm/helper.c
> +++ b/target/arm/helper.c
> @@ -975,6 +975,17 @@ static uint64_t pmccntr_read(CPUARMState *env, const ARMCPRegInfo *ri)
>      return total_ticks - env->cp15.c15_ccnt;
>  }
>
> +static void pmselr_write(CPUARMState *env, const ARMCPRegInfo *ri,
> +                         uint64_t value)
> +{
> +    /* The value of PMSELR.SEL affects the behavior of PMXEVTYPER and
> +     * PMXEVCNTR. We allow [0..31] to be written to PMSELR here; in the
> +     * meanwhile, we check PMSELR.SEL when PMXEVTYPER and PMXEVCNTR are
> +     * accessed.
> +     */
> +    env->cp15.c9_pmselr = value & 0x1f;
> +}
> +
>  static void pmccntr_write(CPUARMState *env, const ARMCPRegInfo *ri,
>                          uint64_t value)
>  {
> @@ -1194,12 +1205,16 @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
>      /* Unimplemented so WI. */
>      { .name = "PMSWINC", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 4,
>        .access = PL0_W, .accessfn = pmreg_access, .type = ARM_CP_NOP },
> -    /* Since we don't implement any events, writing to PMSELR is UNPREDICTABLE.
> -     * We choose to RAZ/WI.
> -     */
>      { .name = "PMSELR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 5,
> -      .access = PL0_RW, .type = ARM_CP_CONST, .resetvalue = 0,
> -      .accessfn = pmreg_access },
> +      .access = PL0_RW, .type = ARM_CP_ALIAS,
> +      .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmselr),
> +      .accessfn = pmreg_access, .writefn = pmselr_write,
> +      .raw_writefn = raw_write},
> +    { .name = "PMSELR_EL0", .state = ARM_CP_STATE_AA64,
> +      .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 5,
> +      .access = PL0_RW, .accessfn = pmreg_access,
> +      .fieldoffset = offsetof(CPUARMState, cp15.c9_pmselr),
> +      .writefn = pmselr_write, .raw_writefn = raw_write, },
>  #ifndef CONFIG_USER_ONLY
>      { .name = "PMCCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 0,
>        .access = PL0_RW, .resetvalue = 0, .type = ARM_CP_IO,
> --
> 1.8.3.1
>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

thanks
-- PMM

Re: [Qemu-devel] [PATCH V2 2/5] target-arm: Add support for AArch64 PMU register PMXEVTYPER_EL0

[Peter Maydell]

On 31 January 2017 at 15:15, Wei Huang <wei@redhat.com> wrote:
> In order to support Linux perf, which uses PMXEVTYPER register,
> this patch adds access support for PMXEVTYPER_EL0.
>
> Signed-off-by: Wei Huang <wei@redhat.com>
> ---
>  target/arm/cpu.h    |  2 +-
>  target/arm/helper.c | 19 ++++++++++++++++---
>  2 files changed, 17 insertions(+), 4 deletions(-)
>
> diff --git a/target/arm/cpu.h b/target/arm/cpu.h
> index 8a82c73..ce02044 100644
> --- a/target/arm/cpu.h
> +++ b/target/arm/cpu.h
> @@ -307,7 +307,7 @@ typedef struct CPUARMState {
>          uint64_t c9_pmcr; /* performance monitor control register */
>          uint64_t c9_pmcnten; /* perf monitor counter enables */
>          uint32_t c9_pmovsr; /* perf monitor overflow status */
> -        uint32_t c9_pmxevtyper; /* perf monitor event type */
> +        uint64_t c9_pmxevtyper; /* perf monitor event type */
>          uint32_t c9_pmuserenr; /* perf monitor user enable */
>          uint64_t c9_pmselr; /* perf monitor counter selection register */
>          uint32_t c9_pminten; /* perf monitor interrupt enables */
> diff --git a/target/arm/helper.c b/target/arm/helper.c
> index 67520ea..c8620d9 100644
> --- a/target/arm/helper.c
> +++ b/target/arm/helper.c
> @@ -1054,7 +1054,13 @@ static void pmovsr_write(CPUARMState *env, const ARMCPRegInfo *ri,
>  static void pmxevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri,
>                               uint64_t value)
>  {
> -    env->cp15.c9_pmxevtyper = value & 0xff;
> +    /* Attempts to access PMXEVTYPER are CONSTRAINED UNPREDICTABLE when
> +     * PMSELR value is equal to or greater than the number of implemented
> +     * counters, but not euqal to 0x1f. We opt to behave as a NOP.

"equal"

> +     */
> +    if (env->cp15.c9_pmselr == 0x1f) {
> +        pmccfiltr_write(env, ri, value);
> +    }
>  }
>
>  static void pmuserenr_write(CPUARMState *env, const ARMCPRegInfo *ri,
> @@ -1234,10 +1240,17 @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
>        .fieldoffset = offsetof(CPUARMState, cp15.pmccfiltr_el0),
>        .resetvalue = 0, },
>      { .name = "PMXEVTYPER", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 1,
> -      .access = PL0_RW,
> -      .fieldoffset = offsetof(CPUARMState, cp15.c9_pmxevtyper),
> +      .access = PL0_RW, .type = ARM_CP_ALIAS,
> +      .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmxevtyper),
>        .accessfn = pmreg_access, .writefn = pmxevtyper_write,
>        .raw_writefn = raw_write },
> +    { .name = "PMXEVTYPER_EL0", .state = ARM_CP_STATE_AA64,
> +      .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 1,
> +      .access = PL0_RW, .accessfn = pmreg_access,
> +      .type = ARM_CP_IO,
> +      .fieldoffset = offsetof(CPUARMState, cp15.c9_pmxevtyper),
> +      .writefn = pmxevtyper_write, .raw_writefn = raw_write,
> +      .resetvalue = 0x0 },

Reads also need to give you PMCCFILTR_EL0, if PMSELR is set to 31,
so you need a readfn as well. (That also means that the c9_pmxevtyper
field in the struct becomes unused, so you can drop it, and
the .fieldoffset setting, and mark both the A32 and A64 reg structs
as ARM_CP_NO_RAW.)

>      /* Unimplemented, RAZ/WI. */
>      { .name = "PMXEVCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 2,
>        .access = PL0_RW, .type = ARM_CP_CONST, .resetvalue = 0,
> --
> 1.8.3.1
>

thanks
-- PMM

Re: [Qemu-devel] [PATCH V2 3/5] target-arm: Add support for PMU register PMXEVCNTR_EL0

[Peter Maydell]

On 31 January 2017 at 15:15, Wei Huang <wei@redhat.com> wrote:
> To make PMU register support complete, this patch adds support for
> PMXEVCNTR_EL0.
>
> Signed-off-by: Wei Huang <wei@redhat.com>
> ---
>  target/arm/helper.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/target/arm/helper.c b/target/arm/helper.c
> index c8620d9..6b8460a 100644
> --- a/target/arm/helper.c
> +++ b/target/arm/helper.c
> @@ -1255,6 +1255,10 @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
>      { .name = "PMXEVCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 2,
>        .access = PL0_RW, .type = ARM_CP_CONST, .resetvalue = 0,
>        .accessfn = pmreg_access },
> +    { .name = "PMXEVCNTR_EL0", .state = ARM_CP_STATE_AA64,
> +      .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 2,
> +      .access = PL0_RW, .type = ARM_CP_CONST, .resetvalue = 0,
> +      .accessfn = pmreg_access },

We don't need to do this, because we're already spec-compliant.
Since we only support the cycle counter, accesses to PMXEVCNTR
are always CONSTRAINED UNPREDICTABLE and "accesses UNDEF" is
a permitted choice, which is what we do at the moment.
('Accesses are RAZ/WI' are also a permitted choice.)

Is there a reason you've opted for the RAZ/WI here?

thanks
-- PMM

Re: [Qemu-devel] [PATCH V2 4/5] target-arm: Add support for PMU register PMINTENSET_EL1

[Peter Maydell]

On 31 January 2017 at 15:15, Wei Huang <wei@redhat.com> wrote:
> This patch adds access support for PMINTENSET_EL1.
>
> Signed-off-by: Wei Huang <wei@redhat.com>
> ---
>  target/arm/cpu.h    |  2 +-
>  target/arm/helper.c | 10 +++++++++-
>  2 files changed, 10 insertions(+), 2 deletions(-)
>
> diff --git a/target/arm/cpu.h b/target/arm/cpu.h
> index ce02044..42aaea9 100644
> --- a/target/arm/cpu.h
> +++ b/target/arm/cpu.h
> @@ -310,7 +310,7 @@ typedef struct CPUARMState {
>          uint64_t c9_pmxevtyper; /* perf monitor event type */
>          uint32_t c9_pmuserenr; /* perf monitor user enable */
>          uint64_t c9_pmselr; /* perf monitor counter selection register */
> -        uint32_t c9_pminten; /* perf monitor interrupt enables */
> +        uint64_t c9_pminten; /* perf monitor interrupt enables */
>          union { /* Memory attribute redirection */
>              struct {
>  #ifdef HOST_WORDS_BIGENDIAN
> diff --git a/target/arm/helper.c b/target/arm/helper.c
> index 6b8460a..b028042 100644
> --- a/target/arm/helper.c
> +++ b/target/arm/helper.c
> @@ -1272,9 +1272,17 @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
>        .writefn = pmuserenr_write, .raw_writefn = raw_write },
>      { .name = "PMINTENSET", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 1,
>        .access = PL1_RW, .accessfn = access_tpm,
> -      .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
> +      .type = ARM_CP_ALIAS,
> +      .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pminten),
>        .resetvalue = 0,
>        .writefn = pmintenset_write, .raw_writefn = raw_write },
> +    { .name = "PMINTENSET_EL1", .state = ARM_CP_STATE_AA64,
> +      .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 1,
> +      .access = PL1_RW, .accessfn = access_tpm,
> +      .type = ARM_CP_IO,
> +      .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
> +      .writefn = pmintenset_write, .raw_writefn = raw_write,
> +      .resetvalue = 0x0 },
>      { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2,
>        .access = PL1_RW, .accessfn = access_tpm, .type = ARM_CP_ALIAS,
>        .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),

Add PMINTENCLR_EL1 as well, please.

thanks
-- PMM

Re: [Qemu-devel] [PATCH V2 5/5] target-arm: Enable vPMU support under TCG mode

[Peter Maydell]

On 31 January 2017 at 15:15, Wei Huang <wei@redhat.com> wrote:
> This patch contains several fixes to enable vPMU under TCG mode. It
> first removes the checking of kvm_enabled() while unsetting
> ARM_FEATURE_PMU. With it, the .pmu option can be used to turn on/off vPMU
> under TCG mode. Secondly the PMU node of DT table is now created under TCG.
> The last fix is to disable the masking of PMUver field of ID_AA64DFR0_EL1.
>
> Signed-off-by: Wei Huang <wei@redhat.com>
> ---

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

thanks
-- PMM

Re: [Qemu-devel] [PATCH V2 2/5] target-arm: Add support for AArch64 PMU register PMXEVTYPER_EL0

[Wei Huang]

On 02/03/2017 07:24 AM, Peter Maydell wrote:
> On 31 January 2017 at 15:15, Wei Huang <wei@redhat.com> wrote:
>> In order to support Linux perf, which uses PMXEVTYPER register,
>> this patch adds access support for PMXEVTYPER_EL0.
>>
>> Signed-off-by: Wei Huang <wei@redhat.com>
>> ---
>>  target/arm/cpu.h    |  2 +-
>>  target/arm/helper.c | 19 ++++++++++++++++---
>>  2 files changed, 17 insertions(+), 4 deletions(-)
>>
>> diff --git a/target/arm/cpu.h b/target/arm/cpu.h
>> index 8a82c73..ce02044 100644
>> --- a/target/arm/cpu.h
>> +++ b/target/arm/cpu.h
>> @@ -307,7 +307,7 @@ typedef struct CPUARMState {
>>          uint64_t c9_pmcr; /* performance monitor control register */
>>          uint64_t c9_pmcnten; /* perf monitor counter enables */
>>          uint32_t c9_pmovsr; /* perf monitor overflow status */
>> -        uint32_t c9_pmxevtyper; /* perf monitor event type */
>> +        uint64_t c9_pmxevtyper; /* perf monitor event type */
>>          uint32_t c9_pmuserenr; /* perf monitor user enable */
>>          uint64_t c9_pmselr; /* perf monitor counter selection register */
>>          uint32_t c9_pminten; /* perf monitor interrupt enables */
>> diff --git a/target/arm/helper.c b/target/arm/helper.c
>> index 67520ea..c8620d9 100644
>> --- a/target/arm/helper.c
>> +++ b/target/arm/helper.c
>> @@ -1054,7 +1054,13 @@ static void pmovsr_write(CPUARMState *env, const ARMCPRegInfo *ri,
>>  static void pmxevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri,
>>                               uint64_t value)
>>  {
>> -    env->cp15.c9_pmxevtyper = value & 0xff;
>> +    /* Attempts to access PMXEVTYPER are CONSTRAINED UNPREDICTABLE when
>> +     * PMSELR value is equal to or greater than the number of implemented
>> +     * counters, but not euqal to 0x1f. We opt to behave as a NOP.
> 
> "equal"
> 
>> +     */
>> +    if (env->cp15.c9_pmselr == 0x1f) {
>> +        pmccfiltr_write(env, ri, value);
>> +    }
>>  }
>>
>>  static void pmuserenr_write(CPUARMState *env, const ARMCPRegInfo *ri,
>> @@ -1234,10 +1240,17 @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
>>        .fieldoffset = offsetof(CPUARMState, cp15.pmccfiltr_el0),
>>        .resetvalue = 0, },
>>      { .name = "PMXEVTYPER", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 1,
>> -      .access = PL0_RW,
>> -      .fieldoffset = offsetof(CPUARMState, cp15.c9_pmxevtyper),
>> +      .access = PL0_RW, .type = ARM_CP_ALIAS,
>> +      .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmxevtyper),
>>        .accessfn = pmreg_access, .writefn = pmxevtyper_write,
>>        .raw_writefn = raw_write },
>> +    { .name = "PMXEVTYPER_EL0", .state = ARM_CP_STATE_AA64,
>> +      .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 1,
>> +      .access = PL0_RW, .accessfn = pmreg_access,
>> +      .type = ARM_CP_IO,
>> +      .fieldoffset = offsetof(CPUARMState, cp15.c9_pmxevtyper),
>> +      .writefn = pmxevtyper_write, .raw_writefn = raw_write,
>> +      .resetvalue = 0x0 },
> 
> Reads also need to give you PMCCFILTR_EL0, if PMSELR is set to 31,
> so you need a readfn as well. (That also means that the c9_pmxevtyper
> field in the struct becomes unused, so you can drop it, and
> the .fieldoffset setting, and mark both the A32 and A64 reg structs
> as ARM_CP_NO_RAW.)

OK. I will redo this one. Since we are changing the design, I will
revise the CONSTRAINED UNPREDICTABLE behavior of pmxevtyper access to
RAZ/WI instead of NOP.

> 
>>      /* Unimplemented, RAZ/WI. */
>>      { .name = "PMXEVCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 2,
>>        .access = PL0_RW, .type = ARM_CP_CONST, .resetvalue = 0,
>> --
>> 1.8.3.1
>>
> 
> thanks
> -- PMM
> 

Re: [Qemu-devel] [PATCH V2 4/5] target-arm: Add support for PMU register PMINTENSET_EL1

[Wei Huang]

On 02/03/2017 07:30 AM, Peter Maydell wrote:
> On 31 January 2017 at 15:15, Wei Huang <wei@redhat.com> wrote:
>> This patch adds access support for PMINTENSET_EL1.
>>
>> Signed-off-by: Wei Huang <wei@redhat.com>
>> ---
>>  target/arm/cpu.h    |  2 +-
>>  target/arm/helper.c | 10 +++++++++-
>>  2 files changed, 10 insertions(+), 2 deletions(-)
>>
>> diff --git a/target/arm/cpu.h b/target/arm/cpu.h
>> index ce02044..42aaea9 100644
>> --- a/target/arm/cpu.h
>> +++ b/target/arm/cpu.h
>> @@ -310,7 +310,7 @@ typedef struct CPUARMState {
>>          uint64_t c9_pmxevtyper; /* perf monitor event type */
>>          uint32_t c9_pmuserenr; /* perf monitor user enable */
>>          uint64_t c9_pmselr; /* perf monitor counter selection register */
>> -        uint32_t c9_pminten; /* perf monitor interrupt enables */
>> +        uint64_t c9_pminten; /* perf monitor interrupt enables */
>>          union { /* Memory attribute redirection */
>>              struct {
>>  #ifdef HOST_WORDS_BIGENDIAN
>> diff --git a/target/arm/helper.c b/target/arm/helper.c
>> index 6b8460a..b028042 100644
>> --- a/target/arm/helper.c
>> +++ b/target/arm/helper.c
>> @@ -1272,9 +1272,17 @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
>>        .writefn = pmuserenr_write, .raw_writefn = raw_write },
>>      { .name = "PMINTENSET", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 1,
>>        .access = PL1_RW, .accessfn = access_tpm,
>> -      .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
>> +      .type = ARM_CP_ALIAS,
>> +      .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pminten),
>>        .resetvalue = 0,
>>        .writefn = pmintenset_write, .raw_writefn = raw_write },
>> +    { .name = "PMINTENSET_EL1", .state = ARM_CP_STATE_AA64,
>> +      .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 1,
>> +      .access = PL1_RW, .accessfn = access_tpm,
>> +      .type = ARM_CP_IO,
>> +      .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
>> +      .writefn = pmintenset_write, .raw_writefn = raw_write,
>> +      .resetvalue = 0x0 },
>>      { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2,
>>        .access = PL1_RW, .accessfn = access_tpm, .type = ARM_CP_ALIAS,
>>        .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
> 
> Add PMINTENCLR_EL1 as well, please.

It was already defined in target-arm/helper.c file. Could you elaborate
which part is missing?

    { .name = "PMINTENCLR_EL1", .state = ARM_CP_STATE_AA64,
      .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 2,
      .access = PL1_RW, .accessfn = access_tpm, .type = ARM_CP_ALIAS,
      .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
      .writefn = pmintenclr_write },




> 
> thanks
> -- PMM
> 

Re: [Qemu-devel] [PATCH V2 4/5] target-arm: Add support for PMU register PMINTENSET_EL1

[Peter Maydell]

On 3 February 2017 at 15:19, Wei Huang <wei@redhat.com> wrote:
>
>
> On 02/03/2017 07:30 AM, Peter Maydell wrote:
>> On 31 January 2017 at 15:15, Wei Huang <wei@redhat.com> wrote:
>>> This patch adds access support for PMINTENSET_EL1.
>>>
>>> Signed-off-by: Wei Huang <wei@redhat.com>
>>> ---
>>>  target/arm/cpu.h    |  2 +-
>>>  target/arm/helper.c | 10 +++++++++-
>>>  2 files changed, 10 insertions(+), 2 deletions(-)
>>>
>>> diff --git a/target/arm/cpu.h b/target/arm/cpu.h
>>> index ce02044..42aaea9 100644
>>> --- a/target/arm/cpu.h
>>> +++ b/target/arm/cpu.h
>>> @@ -310,7 +310,7 @@ typedef struct CPUARMState {
>>>          uint64_t c9_pmxevtyper; /* perf monitor event type */
>>>          uint32_t c9_pmuserenr; /* perf monitor user enable */
>>>          uint64_t c9_pmselr; /* perf monitor counter selection register */
>>> -        uint32_t c9_pminten; /* perf monitor interrupt enables */
>>> +        uint64_t c9_pminten; /* perf monitor interrupt enables */
>>>          union { /* Memory attribute redirection */
>>>              struct {
>>>  #ifdef HOST_WORDS_BIGENDIAN
>>> diff --git a/target/arm/helper.c b/target/arm/helper.c
>>> index 6b8460a..b028042 100644
>>> --- a/target/arm/helper.c
>>> +++ b/target/arm/helper.c
>>> @@ -1272,9 +1272,17 @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
>>>        .writefn = pmuserenr_write, .raw_writefn = raw_write },
>>>      { .name = "PMINTENSET", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 1,
>>>        .access = PL1_RW, .accessfn = access_tpm,
>>> -      .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
>>> +      .type = ARM_CP_ALIAS,
>>> +      .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pminten),
>>>        .resetvalue = 0,
>>>        .writefn = pmintenset_write, .raw_writefn = raw_write },
>>> +    { .name = "PMINTENSET_EL1", .state = ARM_CP_STATE_AA64,
>>> +      .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 1,
>>> +      .access = PL1_RW, .accessfn = access_tpm,
>>> +      .type = ARM_CP_IO,
>>> +      .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
>>> +      .writefn = pmintenset_write, .raw_writefn = raw_write,
>>> +      .resetvalue = 0x0 },
>>>      { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2,
>>>        .access = PL1_RW, .accessfn = access_tpm, .type = ARM_CP_ALIAS,
>>>        .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
>>
>> Add PMINTENCLR_EL1 as well, please.
>
> It was already defined in target-arm/helper.c file. Could you elaborate
> which part is missing?
>
>     { .name = "PMINTENCLR_EL1", .state = ARM_CP_STATE_AA64,
>       .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 2,
>       .access = PL1_RW, .accessfn = access_tpm, .type = ARM_CP_ALIAS,
>       .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
>       .writefn = pmintenclr_write },

I'm sorry, you're right. I assumed that because we didn't have
a 64-bit version of the SET we didn't have a 64-bit version
of the CLR either.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

thanks
-- PMM