Instruction/Cycle Counting in Guest Using the Kvm PMU


My name is Jan and i am currently writing my master’s thesis.

I am using the Kvm Api and try to integrate it as an instruction set simulator in a SystemC environment.


I need some mechanism to count executed instructions in the guest (or cycles).

Currently I am trying to use the emulated PMU cycle counter in the guest to get the number of executed cycles in the guest.

I am working on Arm64 and use Linux Kernel 4.14.33.

I create the PMU device without creating a in-kernel vgic.

Basically I create a vcpu and run some bare metal code.

For convienence, I append the critical assembler snippet.

I configure the counter, then start the counter, execute 3 or 4 dummy instructions and read the counter again and then exit the guest with an exit_mmio.

I assumed the value should be a very small number, as the guest only executed a few instructions.

The thing is as I read the counter, the value is something like 2970 or 0 (changes in each run).

So to me it looks like the counter is also counting the cycles for instruction emulation in the host, am I right?

Is it possible to just count the cycles in the guest from the guests’s point of view?

I read the kvm-api.txt Documentation and the other documents a few times and tried different approaches, so this forum is my last resort.

Thanks in advance!




// we are in el1

// init system registers

LDR X1, =0x30C50838


// enable access to pmu counters from el0

mov x0, 0xff

mrs x1, currentel

mrs x7, pmuserenr_el0

orr x7, x7, #0b1111

msr pmuserenr_el0, x7

// set pmcr register (control register)

//enable long counter, count every cycle and enable counters

mrs x5, pmcr_el0

orr x5, x5, #0b1

orr x5, x5, #(1<<6)

eor x5, x5, #(1<<3)

eor x5, x5, #(1<<5)

msr pmcr_el0, x5

// read mvccfiltr register (only enable counting of el1)

mrs x6, pmccfiltr_el0

mov x6, #(1<<30)

msr pmccfiltr_el0, x6

// get interrupt configuration and clear overflow bit

mrs x9, pmintenset_el1

mov x8, #(1<<31)

msr pmovsclr_el0, x8

// write counter

mov x0, #0x0

msr pmccntr_el0, x0 // write counter

// enable cycle counter

mov x1, #(1<<31)

msr pmcntenset_el0, x1

mov x0, #0x2 */

// dummy instruction and provoke mmio-exit

mov x1, #0x3

add x2, x0, x1

mov x2, 0x5000

//read counter

mrs x1, pmccntr_el0

// read overflow

mrs x8, pmovsclr_el0

// provoke mmio exit (0x500 is not mapped)

ldr x3, [x2]