[PATCH v5 0/2] perf: Add Raspberry Pi AXI PMU driver

[Ian Rogers]

On Wed, Aug 12, 2026 at 4:01 PM Ian Rogers <irogers at google.com> wrote:
>
> This patch series adds an uncore Performance Monitoring Unit (PMU) driver
> for Broadcom AXI system and VideoCore VPU performance monitors found on
> Raspberry Pi SoCs (BCM2835 through BCM2712 / Raspberry Pi 1 through 5).
>
> Motivation & Background
> ------------------------
> Currently, Linux lacks a standard perf-API compatible driver for the
> Broadcom AXI performance counter blocks on Raspberry Pi platforms. Prior
> out-of-tree vendor solutions relied on custom debugfs nodes and ad-hoc
> kthreads, preventing integration with standard Linux perf tooling (`perf stat`,
> `perf list`, etc.).
>
> This driver implements standard `struct pmu` hardware uncore callbacks
> under `drivers/perf/`, exposing human-readable sysfs event aliases, unit
> scaling (`Bytes`), and bus filtering directly to user space.
>
> Key Architectural Improvements & Features
> ------------------------------------------
> 1. Standard Linux Perf Integration:
>    - Exposes uncore AXI interconnect events via `/sys/bus/event_source/devices/rpi_axi_pmu/`.
>    - Supports event sampling and hardware counter accumulation (`local64_add`),
>      automatically managing 31-bit hardware counter wraparound across high-bandwidth
>      interconnect transfers.
>
> 2. CPU Hotplug Support (`cpuhp`):
>    - Registers dynamic CPU hotplug notifiers (`CPUHP_AP_ONLINE_DYN`).
>    - Automatically migrates PMU context (`perf_pmu_migrate_context`) to an online
>      CPU core when a designated CPU goes offline, avoiding stale uncore state.
>
> 3. Hybrid Memory-Mapped & Mailbox Work Queue Architecture:
>    - System Monitor (MMIO): Performs fast atomic-safe memory reads (~15ns)
>      directly mapped over ARM physical memory space (`MON__SYSTEM`).
>    - VPU Monitor (Mailbox IPC): For Broadcom BCM2835-BCM2711 platforms (RPi 1-4),
>      VideoCore VPU monitor IPC calls are offloaded to process context via a dedicated
>      workqueue (`vpu_work`) and serialized under `vpu_mutex`. This avoids atomic
>      sleeps or blocking in timer/interrupt context.
>
> 4. PREEMPT_RT & Safety Hardening:
>    - Uses HRTIMER_MODE_REL_SOFT for timer callbacks to execute in softirq context,
>      ensuring spinlock acquisitions are 100% PREEMPT_RT safe.
>    - Sets suppress_bind_attrs = true to prevent unsafe manual sysfs unbinding while
>      active perf events exist.
>
> 5. SoC Generation Support:
>    - Patch 1 adds core driver support for Broadcom BCM2835-BCM2711 (RPi 1-4).
>    - Patch 2 expands support for Broadcom BCM2712 (Raspberry Pi 5), adding PCIe RP1
>      Southbridge links, HEVC decoder, HVS display engine, and Cortex-A76 DSU L3
>      interconnect monitoring.
>
> Hardware Validation
> -------------------
> The driver has been validated on real hardware across multiple SoC generations:
> - Raspberry Pi 400 (BCM2711): Validated System L2, ARM CPU, and VideoCore VPU
>   firmware mailbox IPC performance counters.
> - Raspberry Pi 5 (BCM2712): Validated live byte throughput across HVS display
>   refresh cycles, Cortex-A76 DSU L3 interconnect memory traffic, and PCIe RP1
>   Southbridge transfers.
>
> Changes in v5
> -------------
> - Teardown UAF/Orphaning Fix: Reversed module exit logic, calling cpuhp_state_remove_instance()
>   *before* perf_pmu_unregister() to prevent accessing an unregistered PMU in the offline
>   CPU handler during device removal, and to prevent event orphaning races during hotplug.
> - VPU Hardware Watcher Leak Fix: In rpi_axi_pmu_del(), hardware disablement operations for VPU
>   bus watchers are now properly deferred to the vpu_work workqueue to avoid silently leaking
>   running hardware counters when the VPU monitor is no longer in use.
> - Grouped Event Start Bug Fix: Deprecated reliance on num_monitored == 1 to initialize
>   the global bus watcher. Instead, use a dedicated monitor_running flag correctly to
>   start the global monitor when the first bus watcher gets enabled, mitigating bugs when
>   adding grouped PMU events.
> - IPC Phantom Spikes Zero Fallback Fix: Modified rpi_axi_pmu_read_counter() to return U32_MAX
>   on IPC or MMIO hardware read failures, gracefully ignoring the delta calculation returning.
>   This fixes unsigned 31-bit huge spikes where delta (0 - old_count) & 0x7FFFFFFF occurred.
> - Code Comments: Added doc block comments inside rpi_axi_pmu_read(), rpi_axi_pmu_vpu_work_handler(),
>   and everywhere U32_MAX returns occur to document the explicit justification for why U32_MAX indicates
>   failure (valid counters are 31-bit) and why the driver drops the sample to avoid artificial spikes.
> - VPU Data Race Lockdep Fix: Rewrote locking hierarchy inside vpu_work_handler(). PMU spinlock
>   is now correctly held across rpi_axi_pmu_enable_bus_watcher() unconditionally since the function
>   touches active monitor registers directly via MMIO, dropping it purely for mailbox IPC reads.
> - Hrtimer Add/Del Forward Concurrency Warning Fix: rpi_axi_pmu_timer_handler() now executes
>   hrtimer_forward_now() *before* releasing the PMU spinlock, fully mitigating timer enqueue races
>   resulting from a simultaneous parallel pmu->add()/pmu->del().
> - VPU Start Asynchronous Latency: Added explicit schedule_work(&pmu->vpu_work) call inside
>   rpi_axi_pmu_start() when starting VPU-tracked events so they begin immediately instead of
>   waiting for a 2-second timer interrupt period for short workloads.
> - Event Stop Read-Modify-Write Spinlock Protection: Moved event->hw.state modifications inside
>   rpi_axi_pmu_stop() under the local CPU PMU irqsave spinlock to safeguard atomic bitwise flags
>   against the timer handler or workqueue updates.
> - BCM2712 Pre-probe Initializer UAF race: Shifted perf_pmu_register() to the very end of
>   rpi_axi_pmu__init() to ensure all hardware structures and CPU HP bindings securely exist prior to
>   exposing the PMU to userspace tools preventing devres unregistration memory faults.
> - BCM2712 ARM CPU L2 Event Correction: Corrected the bus index for the Cortex-A76 Cores PMU event
>   aliases to bus=14 (BCM2712_SB__CPU_L2) to match architectural routing specifications on the RPi 5.
> - BCM2712 JPEG Bus Monitor Visibility: Stopped improperly hiding the legacy JPEG bus aliases in the
>   is_visible() callback on BCM2712 chips.
> - BCM2712 Custom Event Replacements: Created specific BCM2712 equivalents for peripheral_rtrans/wtrans
>   and cpu_uc_rtrans/wtrans since raw bus mappings shifted structurally on VideoCore VII.

Sorry, inadvertently added TAG=agy. Will resend with this removed.

Thanks,
Ian

> Ian Rogers (2):
>   perf: Add Raspberry Pi BCM2835 AXI PMU driver
>   perf: Add Raspberry Pi 5 (BCM2712) AXI PMU support
>
>  drivers/perf/Kconfig       |   10 +
>  drivers/perf/Makefile      |    1 +
>  drivers/perf/rpi_axi_pmu.c | 2078 ++++++++++++++++++++++++++++++++++++
>  3 files changed, 2089 insertions(+)
>  create mode 100644 drivers/perf/rpi_axi_pmu.c
>
> --
> 2.55.0.679.g6767b8d81c-goog