[PATCH 00/14] RISC-V TCG PMU correctness fixes

TANG Tiancheng posted 14 patches 2 weeks, 6 days ago
Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20260907-riscv-pmu-correctness-v1-0-5f1f41458989@linux.alibaba.com
Maintainers: Paolo Bonzini <pbonzini@redhat.com>, Richard Henderson <richard.henderson@linaro.org>, "Philippe Mathieu-Daudé" <philmd@oss.qualcomm.com>, Palmer Dabbelt <palmer@dabbelt.com>, Alistair Francis <alistair.francis@wdc.com>, Weiwei Li <liwei1518@gmail.com>, Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>, Liu Zhiwei <zhiwei_liu@linux.alibaba.com>, Chao Liu <chao.liu@processmission.com>
There is a newer version of this series
system/cpu-timers.c                         |   4 +-
system/cpus.c                               |   6 +-
target/riscv/cpu.c                          |  17 +
target/riscv/cpu.h                          |  14 +-
target/riscv/machine.c                      |  92 +++-
target/riscv/tcg/cpu_helper.c               |   2 +
target/riscv/tcg/csr.c                      | 281 +++-------
target/riscv/tcg/pmu.c                      | 793 +++++++++++++++++++---------
target/riscv/tcg/pmu.h                      |  29 +-
target/riscv/tcg/tcg-cpu.c                  |  10 +
tests/tcg/riscv32/Makefile.softmmu-target   |  42 ++
tests/tcg/riscv32/pmu-fixed-rv32.S          |  90 ++++
tests/tcg/riscv32/pmu-minstretcfg-rv32.S    |  48 ++
tests/tcg/riscv32/smcdeleg-counter-rv32.S   |  84 +++
tests/tcg/riscv32/smcdeleg-event-rv32.S     |  69 +++
tests/tcg/riscv32/smcdeleg-minh-rv32.S      |  70 +++
tests/tcg/riscv32/sscofpmf-event-rv32.S     |  91 ++++
tests/tcg/riscv64/Makefile.softmmu-target   |  63 ++-
tests/tcg/riscv64/pmu-cycle-controls.S      | 104 ++++
tests/tcg/riscv64/pmu-lpad.S                |  69 +++
tests/tcg/riscv64/pmu-reset-vs.S            | 102 ++++
tests/tcg/riscv64/smcdeleg-minh.S           |  70 +++
tests/tcg/riscv64/smcdeleg-sxl32.S          | 219 ++++++++
tests/tcg/riscv64/sscofpmf-cycle-overflow.S |  58 ++
tests/tcg/riscv64/sscofpmf-event-overflow.S | 103 ++++
tests/tcg/riscv64/sscofpmf-overflow.S       | 134 +++++
tests/tcg/riscv64/test-minstret-ecall.S     |  26 +
27 files changed, 2223 insertions(+), 467 deletions(-)
[PATCH 00/14] RISC-V TCG PMU correctness fixes
Posted by TANG Tiancheng 2 weeks, 6 days ago
This series fixes RISC-V TCG PMU accounting, overflow notification, and
migration. It is based on Zephyr Li's "target/riscv: fix RV32 fixed
counter accesses" [1], which is a prerequisite and is not included here.

The patches allow multiple HPM counters to select the same event and
preserve counts across selector, privilege-filter, and inhibit writes.
They use consistent cycle/instruction sources and compute the shared
overflow deadline from all eligible counters. Timer callbacks queue
checks on the owner vCPU instead of racing MTTCG execution.

Migration saves counter values including pending increments and restores
destination-local source baselines, event mappings, and overflow
scheduling. A new cpu/pmu-fixed subsection carries mcyclecfg/minstretcfg
and identifies this format. All TCG CPUs require the subsection; loading
older TCG streams without it is rejected. Source and destination still
need compatible CPU configurations. KVM PMU migration is unchanged.

The reset changes preserve the final counts in the old privilege/V mode
before entering M-mode with V=0.

TCG tests cover RV32/RV64 counter accesses, delegated registers, selector
and filter changes, multiple counters per event, overflow notification
with and without Sscofpmf, instruction exceptions, and reset. The RV32
HPM tests also cover full-width accesses through the shared counter path.

[1] https://lore.kernel.org/qemu-devel/20260905092810.660-1-fritchleybohrer@gmail.com/
Based-on: <20260905092810.660-1-fritchleybohrer@gmail.com>

Signed-off-by: TANG Tiancheng <lyndra@linux.alibaba.com>
---
TANG Tiancheng (14):
      target/riscv: Preserve PMU state across event selector writes
      target/riscv: Support multiple counters per PMU event
      target/riscv: Use VM-elapsed sources for fixed PMU events
      target/riscv: Preserve MINH on delegated config reads
      target/riscv: Preserve minstretcfgh on RV32 minstretcfg writes
      target/riscv: Fix RV32 accesses to delegated PMU registers
      target/riscv: Preserve fixed counters across PMU state changes
      target/riscv: Require Sscofpmf for non-fixed event overflow
      target/riscv: Rebuild fixed-event PMU overflow deadlines
      target/riscv: Apply minstret exception accounting to HPM counters
      target/riscv: Process PMU timer expiry on the owner vCPU
      target/riscv: Migrate fixed PMU counter state
      target/riscv: Clear virtualization mode on reset
      target/riscv: Preserve fixed PMU state across reset

 system/cpu-timers.c                         |   4 +-
 system/cpus.c                               |   6 +-
 target/riscv/cpu.c                          |  17 +
 target/riscv/cpu.h                          |  14 +-
 target/riscv/machine.c                      |  92 +++-
 target/riscv/tcg/cpu_helper.c               |   2 +
 target/riscv/tcg/csr.c                      | 281 +++-------
 target/riscv/tcg/pmu.c                      | 793 +++++++++++++++++++---------
 target/riscv/tcg/pmu.h                      |  29 +-
 target/riscv/tcg/tcg-cpu.c                  |  10 +
 tests/tcg/riscv32/Makefile.softmmu-target   |  42 ++
 tests/tcg/riscv32/pmu-fixed-rv32.S          |  90 ++++
 tests/tcg/riscv32/pmu-minstretcfg-rv32.S    |  48 ++
 tests/tcg/riscv32/smcdeleg-counter-rv32.S   |  84 +++
 tests/tcg/riscv32/smcdeleg-event-rv32.S     |  69 +++
 tests/tcg/riscv32/smcdeleg-minh-rv32.S      |  70 +++
 tests/tcg/riscv32/sscofpmf-event-rv32.S     |  91 ++++
 tests/tcg/riscv64/Makefile.softmmu-target   |  63 ++-
 tests/tcg/riscv64/pmu-cycle-controls.S      | 104 ++++
 tests/tcg/riscv64/pmu-lpad.S                |  69 +++
 tests/tcg/riscv64/pmu-reset-vs.S            | 102 ++++
 tests/tcg/riscv64/smcdeleg-minh.S           |  70 +++
 tests/tcg/riscv64/smcdeleg-sxl32.S          | 219 ++++++++
 tests/tcg/riscv64/sscofpmf-cycle-overflow.S |  58 ++
 tests/tcg/riscv64/sscofpmf-event-overflow.S | 103 ++++
 tests/tcg/riscv64/sscofpmf-overflow.S       | 134 +++++
 tests/tcg/riscv64/test-minstret-ecall.S     |  26 +
 27 files changed, 2223 insertions(+), 467 deletions(-)
---
base-commit: b23a62773a7856299cbb3782e64968b6a92c792f
change-id: 20260827-riscv-pmu-correctness-fa880fd9c48d
prerequisite-message-id: <20260905092810.660-1-fritchleybohrer@gmail.com>
prerequisite-patch-id: 3dfb379e910f47acaa9e94ac5766045f86e76799

Best regards,
-- 
TANG Tiancheng <lyndra@linux.alibaba.com>
Re: [PATCH 00/14] RISC-V TCG PMU correctness fixes
Posted by Daniel Henrique Barboza 2 weeks, 2 days ago
Hi Tang,


I took a look in all patches and they all look LGTM code-wise.  But seems
like we need a new version of all patches rebased on top of a recent
master, using a new meson framework instead of Makefile, otherwise check-tcg
won't be able to run them.  In theory is as simple as adding entries in
tests/tcg/riscv32/system/meson.build and tests/tcg/riscv64/system/meson.build
instead of Makefile.softmmu-target.

Given that the series is based on the v1 of "target/riscv: fix RV32 fixed counter
accesses"  I believe you can re-send v2 based on the new version Zephyr Li
sent:

[PATCH v2] target/riscv: fix RV32 fixed counter accesses

This v2 has additional scaffolding for meson tcg tests for riscv32.  Might as well
use it to rebase this work.


Thanks,
Daniel


On 9/6/2026 1:37 PM, TANG Tiancheng wrote:
> This series fixes RISC-V TCG PMU accounting, overflow notification, and
> migration. It is based on Zephyr Li's "target/riscv: fix RV32 fixed
> counter accesses" [1], which is a prerequisite and is not included here.
> 
> The patches allow multiple HPM counters to select the same event and
> preserve counts across selector, privilege-filter, and inhibit writes.
> They use consistent cycle/instruction sources and compute the shared
> overflow deadline from all eligible counters. Timer callbacks queue
> checks on the owner vCPU instead of racing MTTCG execution.
> 
> Migration saves counter values including pending increments and restores
> destination-local source baselines, event mappings, and overflow
> scheduling. A new cpu/pmu-fixed subsection carries mcyclecfg/minstretcfg
> and identifies this format. All TCG CPUs require the subsection; loading
> older TCG streams without it is rejected. Source and destination still
> need compatible CPU configurations. KVM PMU migration is unchanged.
> 
> The reset changes preserve the final counts in the old privilege/V mode
> before entering M-mode with V=0.
> 
> TCG tests cover RV32/RV64 counter accesses, delegated registers, selector
> and filter changes, multiple counters per event, overflow notification
> with and without Sscofpmf, instruction exceptions, and reset. The RV32
> HPM tests also cover full-width accesses through the shared counter path.
> 
> [1] https://lore.kernel.org/qemu-devel/20260905092810.660-1-fritchleybohrer@gmail.com/
> Based-on: <20260905092810.660-1-fritchleybohrer@gmail.com>
> 
> Signed-off-by: TANG Tiancheng <lyndra@linux.alibaba.com>
> ---
> TANG Tiancheng (14):
>        target/riscv: Preserve PMU state across event selector writes
>        target/riscv: Support multiple counters per PMU event
>        target/riscv: Use VM-elapsed sources for fixed PMU events
>        target/riscv: Preserve MINH on delegated config reads
>        target/riscv: Preserve minstretcfgh on RV32 minstretcfg writes
>        target/riscv: Fix RV32 accesses to delegated PMU registers
>        target/riscv: Preserve fixed counters across PMU state changes
>        target/riscv: Require Sscofpmf for non-fixed event overflow
>        target/riscv: Rebuild fixed-event PMU overflow deadlines
>        target/riscv: Apply minstret exception accounting to HPM counters
>        target/riscv: Process PMU timer expiry on the owner vCPU
>        target/riscv: Migrate fixed PMU counter state
>        target/riscv: Clear virtualization mode on reset
>        target/riscv: Preserve fixed PMU state across reset
> 
>   system/cpu-timers.c                         |   4 +-
>   system/cpus.c                               |   6 +-
>   target/riscv/cpu.c                          |  17 +
>   target/riscv/cpu.h                          |  14 +-
>   target/riscv/machine.c                      |  92 +++-
>   target/riscv/tcg/cpu_helper.c               |   2 +
>   target/riscv/tcg/csr.c                      | 281 +++-------
>   target/riscv/tcg/pmu.c                      | 793 +++++++++++++++++++---------
>   target/riscv/tcg/pmu.h                      |  29 +-
>   target/riscv/tcg/tcg-cpu.c                  |  10 +
>   tests/tcg/riscv32/Makefile.softmmu-target   |  42 ++
>   tests/tcg/riscv32/pmu-fixed-rv32.S          |  90 ++++
>   tests/tcg/riscv32/pmu-minstretcfg-rv32.S    |  48 ++
>   tests/tcg/riscv32/smcdeleg-counter-rv32.S   |  84 +++
>   tests/tcg/riscv32/smcdeleg-event-rv32.S     |  69 +++
>   tests/tcg/riscv32/smcdeleg-minh-rv32.S      |  70 +++
>   tests/tcg/riscv32/sscofpmf-event-rv32.S     |  91 ++++
>   tests/tcg/riscv64/Makefile.softmmu-target   |  63 ++-
>   tests/tcg/riscv64/pmu-cycle-controls.S      | 104 ++++
>   tests/tcg/riscv64/pmu-lpad.S                |  69 +++
>   tests/tcg/riscv64/pmu-reset-vs.S            | 102 ++++
>   tests/tcg/riscv64/smcdeleg-minh.S           |  70 +++
>   tests/tcg/riscv64/smcdeleg-sxl32.S          | 219 ++++++++
>   tests/tcg/riscv64/sscofpmf-cycle-overflow.S |  58 ++
>   tests/tcg/riscv64/sscofpmf-event-overflow.S | 103 ++++
>   tests/tcg/riscv64/sscofpmf-overflow.S       | 134 +++++
>   tests/tcg/riscv64/test-minstret-ecall.S     |  26 +
>   27 files changed, 2223 insertions(+), 467 deletions(-)
> ---
> base-commit: b23a62773a7856299cbb3782e64968b6a92c792f
> change-id: 20260827-riscv-pmu-correctness-fa880fd9c48d
> prerequisite-message-id: <20260905092810.660-1-fritchleybohrer@gmail.com>
> prerequisite-patch-id: 3dfb379e910f47acaa9e94ac5766045f86e76799
> 
> Best regards,
Re: [PATCH 00/14] RISC-V TCG PMU correctness fixes
Posted by TianCheng TANG 2 weeks, 2 days ago
在 2026/9/10 04:49, Daniel Henrique Barboza 写道:
> Hi Tang,
>
>
> I took a look in all patches and they all look LGTM code-wise. But seems
> like we need a new version of all patches rebased on top of a recent
> master, using a new meson framework instead of Makefile, otherwise 
> check-tcg
> won't be able to run them.  In theory is as simple as adding entries in
> tests/tcg/riscv32/system/meson.build and 
> tests/tcg/riscv64/system/meson.build
> instead of Makefile.softmmu-target.
>
> Given that the series is based on the v1 of "target/riscv: fix RV32 
> fixed counter
> accesses"  I believe you can re-send v2 based on the new version 
> Zephyr Li
> sent:
>
> [PATCH v2] target/riscv: fix RV32 fixed counter accesses
>
> This v2 has additional scaffolding for meson tcg tests for riscv32.  
> Might as well
> use it to rebase this work.
>
Hi Daniel,

Thanks for reviewing the series.
I'll send v2 based on current master and Zephyr's v2, with the tests 
converted to Meson.


Thanks,
Tiancheng Tang

>
> Thanks,
> Daniel
>
>
> On 9/6/2026 1:37 PM, TANG Tiancheng wrote:
>> This series fixes RISC-V TCG PMU accounting, overflow notification, and
>> migration. It is based on Zephyr Li's "target/riscv: fix RV32 fixed
>> counter accesses" [1], which is a prerequisite and is not included here.
>>
>> The patches allow multiple HPM counters to select the same event and
>> preserve counts across selector, privilege-filter, and inhibit writes.
>> They use consistent cycle/instruction sources and compute the shared
>> overflow deadline from all eligible counters. Timer callbacks queue
>> checks on the owner vCPU instead of racing MTTCG execution.
>>
>> Migration saves counter values including pending increments and restores
>> destination-local source baselines, event mappings, and overflow
>> scheduling. A new cpu/pmu-fixed subsection carries mcyclecfg/minstretcfg
>> and identifies this format. All TCG CPUs require the subsection; loading
>> older TCG streams without it is rejected. Source and destination still
>> need compatible CPU configurations. KVM PMU migration is unchanged.
>>
>> The reset changes preserve the final counts in the old privilege/V mode
>> before entering M-mode with V=0.
>>
>> TCG tests cover RV32/RV64 counter accesses, delegated registers, 
>> selector
>> and filter changes, multiple counters per event, overflow notification
>> with and without Sscofpmf, instruction exceptions, and reset. The RV32
>> HPM tests also cover full-width accesses through the shared counter 
>> path.
>>
>> [1] 
>> https://lore.kernel.org/qemu-devel/20260905092810.660-1-fritchleybohrer@gmail.com/
>> Based-on: <20260905092810.660-1-fritchleybohrer@gmail.com>
>>
>> Signed-off-by: TANG Tiancheng <lyndra@linux.alibaba.com>
>> ---
>> TANG Tiancheng (14):
>>        target/riscv: Preserve PMU state across event selector writes
>>        target/riscv: Support multiple counters per PMU event
>>        target/riscv: Use VM-elapsed sources for fixed PMU events
>>        target/riscv: Preserve MINH on delegated config reads
>>        target/riscv: Preserve minstretcfgh on RV32 minstretcfg writes
>>        target/riscv: Fix RV32 accesses to delegated PMU registers
>>        target/riscv: Preserve fixed counters across PMU state changes
>>        target/riscv: Require Sscofpmf for non-fixed event overflow
>>        target/riscv: Rebuild fixed-event PMU overflow deadlines
>>        target/riscv: Apply minstret exception accounting to HPM counters
>>        target/riscv: Process PMU timer expiry on the owner vCPU
>>        target/riscv: Migrate fixed PMU counter state
>>        target/riscv: Clear virtualization mode on reset
>>        target/riscv: Preserve fixed PMU state across reset
>>
>>   system/cpu-timers.c                         |   4 +-
>>   system/cpus.c                               |   6 +-
>>   target/riscv/cpu.c                          |  17 +
>>   target/riscv/cpu.h                          |  14 +-
>>   target/riscv/machine.c                      |  92 +++-
>>   target/riscv/tcg/cpu_helper.c               |   2 +
>>   target/riscv/tcg/csr.c                      | 281 +++-------
>>   target/riscv/tcg/pmu.c                      | 793 
>> +++++++++++++++++++---------
>>   target/riscv/tcg/pmu.h                      |  29 +-
>>   target/riscv/tcg/tcg-cpu.c                  |  10 +
>>   tests/tcg/riscv32/Makefile.softmmu-target   |  42 ++
>>   tests/tcg/riscv32/pmu-fixed-rv32.S          |  90 ++++
>>   tests/tcg/riscv32/pmu-minstretcfg-rv32.S    |  48 ++
>>   tests/tcg/riscv32/smcdeleg-counter-rv32.S   |  84 +++
>>   tests/tcg/riscv32/smcdeleg-event-rv32.S     |  69 +++
>>   tests/tcg/riscv32/smcdeleg-minh-rv32.S      |  70 +++
>>   tests/tcg/riscv32/sscofpmf-event-rv32.S     |  91 ++++
>>   tests/tcg/riscv64/Makefile.softmmu-target   |  63 ++-
>>   tests/tcg/riscv64/pmu-cycle-controls.S      | 104 ++++
>>   tests/tcg/riscv64/pmu-lpad.S                |  69 +++
>>   tests/tcg/riscv64/pmu-reset-vs.S            | 102 ++++
>>   tests/tcg/riscv64/smcdeleg-minh.S           |  70 +++
>>   tests/tcg/riscv64/smcdeleg-sxl32.S          | 219 ++++++++
>>   tests/tcg/riscv64/sscofpmf-cycle-overflow.S |  58 ++
>>   tests/tcg/riscv64/sscofpmf-event-overflow.S | 103 ++++
>>   tests/tcg/riscv64/sscofpmf-overflow.S       | 134 +++++
>>   tests/tcg/riscv64/test-minstret-ecall.S     |  26 +
>>   27 files changed, 2223 insertions(+), 467 deletions(-)
>> ---
>> base-commit: b23a62773a7856299cbb3782e64968b6a92c792f
>> change-id: 20260827-riscv-pmu-correctness-fa880fd9c48d
>> prerequisite-message-id: 
>> <20260905092810.660-1-fritchleybohrer@gmail.com>
>> prerequisite-patch-id: 3dfb379e910f47acaa9e94ac5766045f86e76799
>>
>> Best regards,