CoreSight July 2026

coresight@lists.linaro.org

6 participants
21 discussions

Re: [PATCH v3] coresight: Fix scheduling while atomic in coresight_cpu_pm_notify()

by Leo Yan

On Fri, Jul 17, 2026 at 12:41:54AM +0300, Mohamed Ayman wrote: [...] > static struct coresight_path *coresight_cpu_get_active_path(enum cs_mode mode) > { > struct coresight_device *source; > - bool is_active = false; > + struct coresight_path *path = NULL; > > - source = coresight_get_percpu_source_ref(smp_processor_id()); > - if (!source) > - return NULL; > - > - if (coresight_get_mode(source) & mode) > - is_active = true; > + guard(raw_spinlock_irqsave)(&coresight_dev_lock); > > - coresight_put_percpu_source_ref(source); > + source = per_cpu(csdev_source, smp_processor_id()); > + if (source && (coresight_get_mode(source) & mode)) > + path = source->path; > > - /* > - * It is expected to run in atomic context or with the CPU lock held for > - * sysfs mode, so it cannot be preempted to disable the path. Here > - * returns the active path pointer without concern that its state may > - * change. Since the build path has taken a reference on the component, > - * the path can be safely used by the caller. > - */ Please keep the comment, as it helps explain why the path pointer can be returned and safely used by the caller. > - return is_active ? source->path : NULL; > + return path; With above update: Reviewed-by: Leo Yan <leo.yan(a)arm.com> Just a thought: we could view this in two stages. 1) The first stage is building the CoreSight path, where we need to ensure the involved modules remain bound while the path is being established. 2) Once the path has been built and the device mode is enabled, we enter the runtime stage. From that point on, observing the device mode as enabled guarantees that the associated data structures can be accessed safely. I would leave this to maintainers for a call in case any concerns on lifetime management.

1 hour, 21 minutes

Re: [PATCH v3] coresight: Fix scheduling while atomic in coresight_cpu_pm_notify()

by Leo Yan

On Fri, Jul 17, 2026 at 06:12:01PM +0200, Sebastian Andrzej Siewior wrote: [...] > > The raw spinlock (coresight_dev_lock) serializes access to the per-CPU > > csdev_source pointer. It does not guarantee the lifetime of the source > > or its _parent_ device. coresight_unregister() is not only reached from > > module unload; it can also be called when a driver is unbind, for > > example DT overlay removal or device hotplug/unplug. > > But doesn't coresight_unregister() block on the coresight_dev_lock here? Fair point. coresight_cpu_get_active_path() can safely access the source while holding coresight_dev_lock. Unregistration will be blocked until the access from the CPU PM notifier has finished. > > I think a proper fix needs a clearer lifetime model for an active > > session. E.g., we could consider to call device_link_add() to prevent > > device unbind / unregister, and unlink device when the session is > > finished. Once that is in place, the CPU PM notifier can safely use the > > active path without get_device()/put_device() pair anymore. > > Right. I am also not sure about lifetime of coresight_device::path. coresight_device::path is a runtime pointer that is valid only while the device is enabled. Since both the path and the device mode are updated atomically on the local CPU, observing the device mode as enabled guarantees that the corresponding coresight_device::path is valid. Thanks, Leo

1 hour, 45 minutes

[PATCH] perf cs-etm: Avoid truncating AUX buffer sizes to int

by Leo Yan

cs_etm__get_trace() returns an int, but it used to return etmq->buf_len on success. That value comes from auxtrace_buffer::size, which is a size_t. For a large AUX trace block, returning the byte count through an int can overflow and make a valid buffer look like a negative error. The callers do not need the actual byte count from cs_etm__get_trace(). The buffer length is already stored in the etmq->buf_len. The callers only need to distinguish three states: < 0: error = 0: no more AUX buffers > 0: data is available Make cs_etm__get_trace() return 0 for all non-error cases and use etmq->buf_len to indicate whether a new buffer was found. Then make cs_etm__get_data_block() return 1 whenever data is available, instead of returning the buffer length. Also refactor cs_etm__get_data_block() to make its return value semantics clearer. Reported-by: Suyash Mahar <smahar(a)meta.com> Fixes: 8224531cf5a1 ("perf cs-etm: Modularize auxtrace_buffer fetch function") Signed-off-by: Leo Yan <leo.yan(a)arm.com> --- tools/perf/util/cs-etm.c | 46 ++++++++++++++++++++++++++-------------------- 1 file changed, 26 insertions(+), 20 deletions(-) diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c index 95e3ec1171acc8442d8539a72a26a1a5a53a2f37..114b3cd2da495e54e78df8fbd707898312f95079 100644 --- a/tools/perf/util/cs-etm.c +++ b/tools/perf/util/cs-etm.c @@ -1467,8 +1467,7 @@ cs_etm__get_trace(struct cs_etm_queue *etmq) etmq->buf_used = 0; etmq->buf_len = aux_buffer->size; etmq->buf = aux_buffer->data; - - return etmq->buf_len; + return 0; } /* @@ -2151,26 +2150,33 @@ static int cs_etm__get_data_block(struct cs_etm_queue *etmq) { int ret; - if (!etmq->buf_len) { - ret = cs_etm__get_trace(etmq); - if (ret <= 0) - return ret; - /* - * We cannot assume consecutive blocks in the data file - * are contiguous, reset the decoder to force re-sync. - */ - ret = cs_etm_decoder__reset(etmq->decoder); - if (ret) - return ret; + /* The current block is not finished */ + if (etmq->buf_len) + return 1; - /* - * Since the decoder is reset, this causes a global trace - * discontinuity. Flush all thread stacks. - */ - cs_etm__flush_all_stack(etmq); - } + ret = cs_etm__get_trace(etmq); + if (ret < 0) + return ret; + + /* No more buffer to read */ + if (!etmq->buf_len) + return 0; + + /* + * We cannot assume consecutive blocks in the data file + * are contiguous, reset the decoder to force re-sync. + */ + ret = cs_etm_decoder__reset(etmq->decoder); + if (ret) + return ret; + + /* + * Since the decoder is reset, this causes a global trace + * discontinuity. Flush all thread stacks. + */ + cs_etm__flush_all_stack(etmq); - return etmq->buf_len; + return 1; } static bool cs_etm__is_svc_instr(struct cs_etm_queue *etmq, --- base-commit: e01c7bd5b1eece254bcbf282db066b12c4815d21 change-id: 20260720-perf_cs_etm_fix_big_size-ec5608f767df Best regards, -- Leo Yan <leo.yan(a)arm.com>

2 hours, 19 minutes

Re: [PATCH v2] coresight: dummy: add missing MODULE_DEVICE_TABLE()

by Leo Yan

On Mon, Jul 20, 2026 at 07:45:14PM +0800, Pengpeng Hou wrote: > The CoreSight dummy driver has an OF match table wired into its platform > driver, but does not export the table to module metadata. A modular build > therefore lacks OF aliases for automatic loading. > > Export dummy_match with MODULE_DEVICE_TABLE(). > > Fixes: 9d3ba0b6c056 ("Coresight: Add coresight dummy driver") > Reviewed-by: Jie Gan <jie.gan(a)oss.qualcomm.com> > Signed-off-by: Pengpeng Hou <pengpeng(a)iscas.ac.cn> Reviewed-by: Leo Yan <leo.yan(a)arm.com> > --- > Changes since v1: https://lore.kernel.org/all/20260704121621.48544-1-pengpeng@iscas.ac.cn/ > - add the requested Fixes tag > - carry Jie Gan's conditional Reviewed-by after making that change > - rebase onto v7.2-rc4 > > drivers/hwtracing/coresight/coresight-dummy.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/hwtracing/coresight/coresight-dummy.c b/drivers/hwtracing/coresight/coresight-dummy.c > index c176a2f57300..04880d38feb7 100644 > --- a/drivers/hwtracing/coresight/coresight-dummy.c > +++ b/drivers/hwtracing/coresight/coresight-dummy.c > @@ -212,6 +212,7 @@ static const struct of_device_id dummy_match[] = { > {.compatible = "arm,coresight-dummy-sink"}, > {}, > }; > +MODULE_DEVICE_TABLE(of, dummy_match); > > static struct platform_driver dummy_driver = { > .probe = dummy_probe, >

1 day, 4 hours

Re: [PATCH v3] coresight: Fix scheduling while atomic in coresight_cpu_pm_notify()

by Leo Yan

On Fri, Jul 17, 2026 at 12:41:54AM +0300, Mohamed Ayman wrote: [...] > static struct coresight_path *coresight_cpu_get_active_path(enum cs_mode mode) > { > struct coresight_device *source; > - bool is_active = false; > + struct coresight_path *path = NULL; > > - source = coresight_get_percpu_source_ref(smp_processor_id()); > - if (!source) > - return NULL; > - > - if (coresight_get_mode(source) & mode) > - is_active = true; > + guard(raw_spinlock_irqsave)(&coresight_dev_lock); > > - coresight_put_percpu_source_ref(source); > + source = per_cpu(csdev_source, smp_processor_id()); > + if (source && (coresight_get_mode(source) & mode)) > + path = source->path; I agree the get_device()/put_device() pair in coresight_cpu_get_active_path() is not a good fit for CPU PM notifier, because the put_device() can become the final put while IRQ is disabled. However, my understanding is this patch might cause UAF issue that the existing code is intended to prevent. The raw spinlock (coresight_dev_lock) serializes access to the per-CPU csdev_source pointer. It does not guarantee the lifetime of the source or its _parent_ device. coresight_unregister() is not only reached from module unload; it can also be called when a driver is unbind, for example DT overlay removal or device hotplug/unplug. This is why the UAF issue Sashiko mentioned in patch 03 of [1]. A built CoreSight path currently grabs references for the path components, which keeps module alive, but that is not the same as preventing the parent device/driver from being unbound and tearing down CoreSight device data while an active session still has raw pointers. There are also similar race window before the path is built: for example etm_setup_aux() has to look up source/sink state before coresight_build_path() establishes the path, so it might access released source/sink data if device is unbound. I think a proper fix needs a clearer lifetime model for an active session. E.g., we could consider to call device_link_add() to prevent device unbind / unregister, and unlink device when the session is finished. Once that is in place, the CPU PM notifier can safely use the active path without get_device()/put_device() pair anymore. Hope this is clear and makes sense. Thanks, Leo [1] https://sashiko.dev/#/patchset/20260405-arm_coresight_path_power_management…

4 days

Re: [PATCH v3] coresight: Fix scheduling while atomic in coresight_cpu_pm_notify()

by Leo Yan

Hi Mohamed & Sebastian, On Fri, Jul 17, 2026 at 10:14:53AM +0200, Sebastian Andrzej Siewior wrote: [...] > There is coresight_put_percpu_source_ref() with holds coresight_dev_lock > during a put_cpu. I don't know why the lock is held, it is not obvious > to me. But it will lead to a similar problem if the put actually invokes > the release callback. Sorry I am a bit late to join the discussion. Essentially, this is about how to manage a module's lifetime correctly so that the CPU PM notifier can safely access a device. There is an edge case where the CPU PM notifier is accessing the device while, at the same time, the module is being unloaded and the device's resources are being released. For now, I'd suggest please hold on this patch. Give me a bit time to study this thread, I will share back more details. Thanks, Leo

4 days, 5 hours

Re: [PATCH v2 00/12] coresight: Add CPU cluster funnel/replicator/tmc support

by Yuanfang Zhang

Hi Sudeep & Suzuki, Gentle reminder on this patch. Any feedback would be appreciated. Thanks, Yuanfang. On 5/25/2026 9:17 PM, Maulik Shah (mkshah) wrote: > > > On 12/19/2025 3:51 PM, Sudeep Holla wrote: >> On Fri, Dec 19, 2025 at 10:13:14AM +0800, yuanfang zhang wrote: >>> >>> >>> On 12/18/2025 7:33 PM, Sudeep Holla wrote: >>>> On Thu, Dec 18, 2025 at 12:09:40AM -0800, Yuanfang Zhang wrote: >>>>> This patch series adds support for CoreSight components local to CPU clusters, >>>>> including funnel, replicator, and TMC, which reside within CPU cluster power >>>>> domains. These components require special handling due to power domain >>>>> constraints. >>>>> >>>> >>>> Could you clarify why PSCI-based power domains associated with clusters in >>>> domain-idle-states cannot address these requirements, given that PSCI CPU-idle >>>> OSI mode was originally intended to support them? My understanding of this >>>> patch series is that OSI mode is unable to do so, which, if accurate, appears >>>> to be a flaw that should be corrected. >>> >>> It is due to the particular characteristics of the CPU cluster power >>> domain.Runtime PM for CPU devices works little different, it is mostly used >>> to manage hierarchicalCPU topology (PSCI OSI mode) to talk with genpd >>> framework to manage the last CPU handling in cluster. >> >> That is indeed the intended design. Could you clarify which specific >> characteristics differentiate it here? > > Sorry for coming very late on this. > > This series is intended to handle coresight components which resides within CPU cluster. > For the cases where cluster is in deepest idle low power mode or all CPUs belonging to cluster > are hotplugged off, access to coresight components can not be done. > > The implementation tried to address in two parts, > 1. Using cluster power-domain to know which coresight component belongs to which cluster/CPUs > 2. Schedule the task on intended cluster's CPU to make sure the CPU (and cluster) power is > ON while coresight component of the cluster is being accessed (using smp_call_function_single()). > > The use of power-domains in (1) will limit this to PSCI OS-Initiated mode, > to have this support on PSCI Platform-Coordinated mode too, probably instead of power-domains, > cpu-maps (which also defines the clusters) from device tree is a better choice which will give > the information on which CPU belongs to which cluster. > > (2) ensured that scheduling happened on intended CPU and while the access is in progress, CPU (and > cluster) will not enter power down in between. > >> >>> It doesn’t really send IPI to wakeup CPU device (It don’t have >>> .power_on/.power_off) callback implemented which gets invoked from >>> .runtime_resume callback. This behavior is aligned with the upstream Kernel. >>> >> >> I am quite lost here. Why is it necessary to wake up the CPU? If I understand >> correctly, all of this complexity is meant to ensure that the cluster power >> domain is enabled before any of the funnel registers are accessed. Is that >> correct? > > Yes, This is to ensure that CPU (and cluster) power is ON while coresight components > for same cluster are being accessed. > >> >> If so, and if the cluster domains are already defined as the power domains for >> these funnel devices, then they should be requested to power on automatically >> before any register access occurs. Is that not the case? > > Cluster power-domains will be only available for PSCI OS-initiated mode but also > will not help for cases where all CPUs in cluster are hotplugged off as hotplugs are > platform coordinated. > > After discussion with our HW team to automatically request power on for coresight > component GPR [1] can be used but they seems not working as intended on the existing > SoCs and will be available on next generation SoC. > > [1] https://developer.arm.com/documentation/ddi0480/d/Functional-Overview/Granu… > >> >> What am I missing in this reasoning? >> >> The only explanation I can see is that the firmware does not properly honor >> power-domain requests coming directly from the OS. I believe that may be the >> case, but I would be glad to be proven wrong. >> > > please see below comment for more details, This seems not a firmware issue. > >>>> >>>>> Unlike system-level CoreSight devices, these components share the CPU cluster's >>>>> power domain. When the cluster enters low-power mode (LPM), their registers >>>>> become inaccessible. Notably, `pm_runtime_get` alone cannot bring the cluster >>>>> out of LPM, making standard register access unreliable. >>>>> >>>> >>>> Are these devices the only ones on the system that are uniquely bound to >>>> cluster-level power domains? If not, what additional devices share this >>>> dependency so that we can understand how they are managed in comparison? >>>> >>> >>> Yes, devices like ETM and TRBE also share this power domain and access constraint. >>> Their drivers naturally handle enablement/disablement on the specific CPU they >>> belong to (e.g., via hotplug callbacks or existing smp_call_function paths). >> >> I understand many things are possible to implement, but the key question >> remains: why doesn’t the existing OSI mechanism - added specifically to cover >> cases like this solve the problem today? >> >> Especially on platforms with OSI enabled, what concrete limitation forces us >> into this additional “wake-up” path instead of relying on OSI to manage the >> dependency/power sequencing? > > + Ulf in loop. > > Current platforms with OSI enabled, Linux PSCI do not implement the power_on/power_off > requests, as far as i know, runtime PM was never meant to implement this part and > pm_runtime_get_sync() (from drivers/cpuidle/cpuidle-psci.c) call is only used to convey > to cluster power domains about a child CPU/ sub domain being on after it has already > been landed in Linux. > > The standalone invoke of pm_runtime_get_sync() from another CPU do not really turn on/get > the CPU (and cluster), as the CPUs either use CPUidle / CPU hotplug paths to enter/exit > low power mode. > > To put it other way, > For a hot-plugged off CPU, invoking a pm_runtime_get_sync() won't get the CPU (and make > its cluster power domain) ON. In order to turn on the CPU, one has to still request > the online of the CPU, say via sysfs command echo 1 > /sys/devices/system/cpu/cpuX/online > which would invoke PSCI CPU_ON function and the power domain for CPU gets marked as ON > only after CPU already landed in Linux via psci_idle_cpuhp_up() invoking pm_runtime_get_sync(). > > I used specific hotplug example but same applies to idle powered down CPU (or Cluster) too. > >> >>>>> To address this, the series introduces: >>>>> - Identifying cluster-bound devices via a new `qcom,cpu-bound-components` >>>>> device tree property. >>>> >>>> Really, no please. >>>> >>> >>> Our objective is to determine which CoreSight components are physically locate >>> within the CPU cluster power domain. >>> >>> Would it be acceptable to derive this relationship from the existing >>> power-domains binding? >> >> In my opinion, this is not merely a possibility but an explicit expectation. >> >>> For example, if a Funnel or Replicator node is linked to a power-domains >>> entry that specifies a cpumask, the driver could recognize this shared >>> dependency and automatically apply the appropriate cluster-aware behavior. >>> >> >> Sure, but for the driver to use that information, we need clear explanation >> for all the questions above. In short, why it is not working with the existing >> PSCI domain idle support. >> > > Explained above. > > Thanks, > Maulik

4 days, 5 hours

[PATCH v8 00/13] fix several inconsistencies with sysfs configuration in etmX

by Yeoreum Yun

The current ETMx configuration via sysfs can lead to the following inconsistencies: - If a configuration is modified via sysfs while a perf session is active, the running configuration may differ between before a sched-out and after a subsequent sched-in. - If a perf session and sysfs session tries to enable concurrently, configuration from configfs could be corrupted (etm4). - There is chance to corrupt drvdata->config if perf session tries to enabled among handling cscfg_csdev_disable_active_config() in etm4_disable_sysfs() (etm4). To resolve these inconsistencies, the configuration should be separated into: - active_config, which is applied configuration for the current session - config, which stores the settings configured via sysfs. and apply configuration from configfs after taking a mode. Also, This patch set includes some small fixes: - missing trace id release in etm4x. - underflow issue for nrseqstate. - wrong check in etm4x_sspcicrn_present(). - missing call of cscfg_csdev_disable_active_config() This patch based on coresight tree's next Patch History ============= from v7 to v8: - accept @Leo Yan' suggestion to handle error. - small minor fixes following @Suzuki' suggestion. - https://lore.kernel.org/all/20260519154812.254884-1-yeoreum.yun@arm.com/ from v6 to v7: - rebase on coresight/next - add ETM_MAX_SEQ_TRANSITIONS define - remove redundant patch relavent cpu-hotplug as coresight-pm patch merged. - https://lore.kernel.org/all/20260422132203.977549-1-yeoreum.yun@arm.com/ from v5 to v6: - fix missing of calling cscfg_csdev_disable_active_config() - add rb & fixes tags. - add ss_status field in etm4x_drvdata to expose STATUS and PENDING bits. - https://lore.kernel.org/all/20260415165528.3369607-1-yeoreum.yun@arm.com/ from v4 to v5: - add rb-tag. - fix underflow issue for nrseqstate. - fix wrong check in etm4_sspcicrn_present(). - remove redundant fields on etmv4_save_state. - rename caps->ss_status to ss_cmp. - fix wrong location of etm4_release_trace_id. - https://lore.kernel.org/all/20260413142003.3549310-1-yeoreum.yun@arm.com/ from v3 to v4: - change etm_drvdata->spinlock type to raw_spin_lock_t - remove redundant call etmX_enable_hw() with starting_cpu() callsback. - fix missing trace id release. - add missing docs. - https://lore.kernel.org/all/20260412175506.412301-1-yeoreum.yun@arm.com/ from v2 to v3: - fix build error for etm3x. - fix checkpatch warning. - https://lore.kernel.org/all/20260410074310.2693385-1-yeoreum.yun@arm.com/ from v1 to v2 - rebased to v7.0-rc7. - introduce etmX_caps structure to save etmX's capabilities. - remove ss_status from etmv4_config. - modify active_config after taking a mode (perf/sysfs). - https://lore.kernel.org/all/20260317181705.2456271-1-yeoreum.yun@arm.com/ Yeoreum Yun (13): coresight: etm4x: fix wrong check of etm4x_sspcicrn_present() coresight: etm4x: fix underflow for usage of (nrseqstate - 1) coresight: etm4x: introduce struct etm4_caps coresight: etm4x: exclude ss_status from drvdata->config coresight: etm4x: remove s_ex_level from config coresight: etm4x: remove redundant fields in etmv4_save_state coresight: etm4x: fix leaked trace id coresight: etm4x: fix inconsistencies with sysfs configuration coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable coresight: etm3x: change drvdata->spinlock type to raw_spin_lock_t coresight: etm3x: introduce struct etm_caps coresight: etm3x: fix inconsistencies with sysfs configuration coresight: etm3x: remove redundant cpu online check on etm_enable_sysfs() drivers/hwtracing/coresight/coresight-etm.h | 46 +- .../coresight/coresight-etm3x-core.c | 96 ++-- .../coresight/coresight-etm3x-sysfs.c | 159 +++--- .../hwtracing/coresight/coresight-etm4x-cfg.c | 5 +- .../coresight/coresight-etm4x-core.c | 454 ++++++++++-------- .../coresight/coresight-etm4x-sysfs.c | 204 ++++---- drivers/hwtracing/coresight/coresight-etm4x.h | 202 ++++---- 7 files changed, 639 insertions(+), 527 deletions(-) -- LEVI:{C3F47F37-75D8-414A-A8BA-3980EC8A46D7}

4 days, 20 hours

[PATCH 0/2] perf cs-etm: Fix bogus branch samples

by Leo Yan

This series fixes the bogus branch samples in the CoreSight ETM trace. When an interrupt occurs immediately after an untaken branch, the decoder incorrectly synthesizes a branch sample for that branch. The first patch fixes this issue. The second patch consolidate the branch check so make sure the flush flow to apply the same check to avoid generate bogus samples. The series has been verified on Orion6 board. Signed-off-by: Leo Yan <leo.yan(a)arm.com> --- Leo Yan (2): perf cs-etm: Avoid bogus branch samples before async exceptions perf cs-etm: Centralize branch sample checks tools/perf/util/cs-etm.c | 44 ++++++++++++++++++++------------------------ 1 file changed, 20 insertions(+), 24 deletions(-) --- base-commit: ef3af1df4f3372bd8ad47619452a283048b3bc8d change-id: 20260713-perf_cs_etm_fix_non_taken-5b4d7f73f41e Best regards, -- Leo Yan <leo.yan(a)arm.com>

1 week

Re: [PATCH v6 2/5] coresight: tnoc: Bind Aggregator TNOC on the platform bus

by Leo Yan

On Fri, Jul 10, 2026 at 10:39:01AM +0800, Jie Gan wrote: [...] > The ATID-unsupported handling keyed off dev_is_amba(), which disabled ATID > allocation for every platform-bus device. With the Aggregator TNOC now on > the platform bus, that check would wrongly disable its ATID, even though > the Aggregator TNOC owns the ATID that tags the whole aggregation path. > The Interconnect TNOC aggregates trace within its subsystem but carries no > ATID of its own, because the downstream Aggregator TNOC already owns the > ATID for the path. So base the check on the "qcom,coresight-itnoc" > compatible and let every other form allocate a trace ID. > > Signed-off-by: Jie Gan <jie.gan(a)oss.qualcomm.com> Reviewed-by: Leo Yan <leo.yan(a)arm.com>

1 week, 4 days

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

CoreSight July 2026