Small fixes for bugs in the CoreSight drivers that were found by
Sashiko. Mostly reference and resource leaks on error paths, plus a
deadlock, a missing lock, and a sysfs store that should return -EBUSY
while a sysfs session is enabled.
This series depends on "coresight: Prevent per-thread events from
sharing a sink" v4 [1]. That series takes coresight_mutex for perf AUX
setup and adds coresight_release_path_locked(), which the
etm_setup_aux() and coresight_build_path() fixes here are based on.
[1]: https://lore.kernel.org/r/20261016-james-cs-multiple-per-threads-v4-0-dedf9…
Signed-off-by: James Clark <james.clark(a)linaro.org>
---
James Clark (9):
coresight: cpu-debug: Fix PM usage counter leak in debug_enable_func()
coresight: etm4x: Remove perf symlink if config registration fails
coresight: etm4x: Fix truncation of nr_ext_inp
coresight: etm-perf: Fix sink device reference leak in etm_setup_aux()
coresight: syscfg: Take csdev lock when removing owned features
coresight: syscfg: Fix deadlock in cscfg_create_device() error path
coresight: Fix resource leaks on coresight_build_path() errors
coresight: etm3x: Don't ignore etm_parse_event_config() errors
coresight: etm3x: Prohibit modifying seq_curr_state while session is enabled
drivers/hwtracing/coresight/coresight-core.c | 6 ++++--
drivers/hwtracing/coresight/coresight-cpu-debug.c | 4 ++--
drivers/hwtracing/coresight/coresight-etm-perf.c | 4 ++++
drivers/hwtracing/coresight/coresight-etm3x-core.c | 6 +++++-
drivers/hwtracing/coresight/coresight-etm3x-sysfs.c | 5 +++++
drivers/hwtracing/coresight/coresight-etm4x-core.c | 1 +
drivers/hwtracing/coresight/coresight-etm4x.h | 2 +-
drivers/hwtracing/coresight/coresight-syscfg.c | 8 +++++++-
8 files changed, 29 insertions(+), 7 deletions(-)
---
base-commit: 343cfcbb3ecfdb80aa576a428cfa3b65ad783842
change-id: 20261027-james-cs-sashiko-easy-fixes-1-692d80016a89
prerequisite-message-id: <20261016-james-cs-multiple-per-threads-v4-0-dedf961aca0e(a)linaro.org>
prerequisite-patch-id: 81acda380ba25acd3845eb58d5ded812175b9631
prerequisite-patch-id: 430caddc9c87948d4e9a0d1967bf3d8a50bca06b
prerequisite-patch-id: 633377150141300f7578b265fcc02eba52e592a8
prerequisite-patch-id: 9a82ffe5d705ac1fdf1250ff6bf242cfcd9d8fbf
prerequisite-patch-id: cf211801575d6bd0aa7fc0f6e19c3b90cea446a0
prerequisite-patch-id: d22fee48bf4aa3e01536e4683ccd797b3dbe1c91
prerequisite-patch-id: 55eeffb37cae55a1f47c2827899e0512b47a6efa
prerequisite-patch-id: c542d74cd4bc76158d5872bab12b8bd7a00f0c27
prerequisite-patch-id: 71cd37ed83d3e01d7a0321cdfa5cfc5ee113fe7b
prerequisite-patch-id: 74c1e3ed6dba4e25bfd3c39f06d43b079eed45e1
Best regards,
--
James Clark <james.clark(a)linaro.org>
On Mon, Oct 12, 2026 at 04:05:21PM -0700, Amir Ayupov wrote:
[...]
> --- a/drivers/hwtracing/coresight/coresight-config.h
> +++ b/drivers/hwtracing/coresight/coresight-config.h
> @@ -30,6 +30,12 @@
> #define CS_CFG_MATCH_CLASS_SRC_ALL 0x0001 /* match any source */
> #define CS_CFG_MATCH_CLASS_SRC_ETM4 0x0002 /* match any ETMv4 device */
It is good to introduce a marco:
#define CS_CFG_MATCH_CLASS_MASK GENMASK_U32(7, 0)
> +/*
> + * flags defining device capabilities a feature can require. A feature loads on
> + * a device that matches one of its classes and has all of its capabilities.
> + */
> +#define CS_CFG_MATCH_CAP_MASK 0x0000ff00
To make the mask explicitly 32-bit unsigned:
#define CS_CFG_MATCH_CAP_MASK GENMASK_U32(15, 8)
> +
> /* flags defining device instance matching - used in config match desc data. */
> #define CS_CFG_MATCH_INST_ANY 0x80000000 /* any instance of a class */
Not an issue with this patch, but CS_CFG_MATCH_INST_ANY appears to be
unused and could be removed in a separate cleanup patch.
> diff --git a/drivers/hwtracing/coresight/coresight-syscfg.c b/drivers/hwtracing/coresight/coresight-syscfg.c
> index a816c22c87bc8..1545d64afec01 100644
> --- a/drivers/hwtracing/coresight/coresight-syscfg.c
> +++ b/drivers/hwtracing/coresight/coresight-syscfg.c
> @@ -172,7 +172,21 @@ cscfg_alloc_csdev_feat(struct coresight_device *csdev, struct cscfg_feature_desc
> }
>
> /* load one feature into one coresight device */
> +/*
> + * A feature matches a device that shares one of its class flags and has all of
> + * the capability flags it requires.
> + */
> +static bool cscfg_match_feat_csdev(u32 feat_flags, u32 csdev_flags)
> +{
> + u32 caps = feat_flags & CS_CFG_MATCH_CAP_MASK;
> +
> + return (feat_flags & csdev_flags & ~CS_CFG_MATCH_CAP_MASK) &&
> + (csdev_flags & caps) == caps;
For clearer comparison conditions:
/* Class type must be matches */
if ((feat_flags & CS_CFG_MATCH_CLASS_MASK) !=
(csdev_flags & CS_CFG_MATCH_CLASS_MASK)
return false;
/* No required capabilities miss from the device */
if (feat_flags & ~csdev_flags & CS_CFG_MATCH_CAP_MASK)
return false;
return true;
Thanks,
Leo
Hi,
On Sun, Oct 25, 2026 at 09:13:07PM +0800, Chao Xu wrote:
> Before enable funnel, priority must be set. Changing the port
> priorities in real time is not supported.
> If the priority control register is written when one or more of ports
> are enable, then the write is silently rejected.
Could you cite the relevant documentation in commit log?
The CoreSight SoC-600 TRM, section 9.11.2, PRIORITYCONTROL, a funnel
rejects priority register writes whenever any port is enabled. The
current sequence therefore prevent the configured priorities from
taking effect.
Write the priority register before enabling the first port.
> Signed-off-by: Chao Xu <xuchao066(a)163.com>
> ---
> drivers/hwtracing/coresight/coresight-funnel.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/hwtracing/coresight/coresight-funnel.c b/drivers/hwtracing/coresight/coresight-funnel.c
> index af40814ce560..17f985798d7f 100644
> --- a/drivers/hwtracing/coresight/coresight-funnel.c
> +++ b/drivers/hwtracing/coresight/coresight-funnel.c
> @@ -66,8 +66,8 @@ static int dynamic_funnel_enable_hw(struct funnel_drvdata *drvdata, int port)
> functl &= ~FUNNEL_HOLDTIME_MASK;
> functl |= FUNNEL_HOLDTIME;
> functl |= (1 << port);
> - writel_relaxed(functl, drvdata->base + FUNNEL_FUNCTL);
> writel_relaxed(drvdata->priority, drvdata->base + FUNNEL_PRICTL);
> + writel_relaxed(functl, drvdata->base + FUNNEL_FUNCTL);
Please move the priority write into the first port branch:
/* Claim the device only when we enable the first slave */
if (!(functl & FUNNEL_ENSx_MASK)) {
rc = coresight_claim_device_unlocked(csdev);
if (rc)
goto done;
/* Update priorities while all ports are disabled */
writel_relaxed(drvdata->priority,
drvdata->base + FUNNEL_PRICTL);
}
Thanks,
Leo
This reverts commit 18049c8cff9cc89daadc4df6975f7d9069638926.
The original commit claimed that contiguous AUX pages unnecessarily
exacerbate fragmentation for SPE, TRBE and ETR. This is not generally
valid: larger allocations can keep pages with the same lifetime
together, while order-0 allocations can scatter them across large
blocks and prevent free pages from coalescing [1]. The follow-up
discussion [2] has not established how forcing order-0 allocations
addresses the reported problem.
TRBE and SPE write to virtually addressed buffers. The TRBE L1 TLB
has one entry on Neoverse V2 [3] and two on Neoverse V3 [4]. Small
mappings increase translation pressure, and TTW stalls can contribute
to FIFO overflow and trace loss on TRBE.
Larger allocations provide contiguous, aligned chunks for PMD or
contiguous-PTE mappings with the proposed vmap() support [5].
With the proposed vmap() support already applied, the tests in [2]
showed that preferring larger AUX allocations reduced L2 data TLB
refills by 99.68% in the TRBE test and 34.74% in the SPE test.
Restore the previous policy of trying higher-order allocations first.
The allocator already uses __GFP_NORETRY and falls back to smaller
orders, including order 0, when larger allocations fail.
Remove PERF_PMU_CAP_AUX_PREFER_LARGE, since the restored default
provides that preference. Intel PT retains its existing allocation
behaviour, with no functional change.
[1] https://lore.kernel.org/all/aPjrRkjiIt6HmXmT@casper.infradead.org/
[2] https://lore.kernel.org/linux-arm-kernel/20260810-perf_aux_trace_large_gran…
[3] https://documentation-service.arm.com/static/633fe1ec4c59b30b517730b8#page=…
[4] https://documentation-service.arm.com/static/67361bd2c7fc0d1f211da382#page=…
[5] https://lore.kernel.org/linux-mm/20260715120813.3609949-1-jiangwen6@xiaomi.…
Signed-off-by: Leo Yan <leo.yan(a)arm.com>
---
arch/x86/events/intel/pt.c | 2 --
include/linux/perf_event.h | 5 ++---
kernel/events/ring_buffer.c | 29 +++++++++--------------------
3 files changed, 11 insertions(+), 25 deletions(-)
diff --git a/arch/x86/events/intel/pt.c b/arch/x86/events/intel/pt.c
index 49349afee6119fb6fad815c847cb3cd9daa97604..3782af40f0832a874a7f0b60961d6652513de241 100644
--- a/arch/x86/events/intel/pt.c
+++ b/arch/x86/events/intel/pt.c
@@ -1896,8 +1896,6 @@ static __init int pt_init(void)
if (!intel_pt_validate_hw_cap(PT_CAP_topa_multiple_entries))
pt_pmu.pmu.capabilities = PERF_PMU_CAP_AUX_NO_SG;
- else
- pt_pmu.pmu.capabilities = PERF_PMU_CAP_AUX_PREFER_LARGE;
pt_pmu.pmu.capabilities |= PERF_PMU_CAP_EXCLUSIVE |
PERF_PMU_CAP_ITRACE |
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index eb3f7bab498ca9bee9ce7193744943b24ab2e0c5..b8d8b005f5c8a7c1def7cad02230bf9ffb876bd6 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -304,9 +304,8 @@ struct perf_event_pmu_context;
#define PERF_PMU_CAP_AUX_OUTPUT 0x0080
#define PERF_PMU_CAP_EXTENDED_HW_TYPE 0x0100
#define PERF_PMU_CAP_AUX_PAUSE 0x0200
-#define PERF_PMU_CAP_AUX_PREFER_LARGE 0x0400
-#define PERF_PMU_CAP_MEDIATED_VPMU 0x0800
-#define PERF_PMU_CAP_SIMD_REGS 0x1000
+#define PERF_PMU_CAP_MEDIATED_VPMU 0x0400
+#define PERF_PMU_CAP_SIMD_REGS 0x0800
/**
* pmu::scope
diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
index 64d4dbdc6c071b72b670dd044616f52981206ae8..95f4fbdfd2764de5b72d901d778c46302f525fad 100644
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -684,15 +684,7 @@ int rb_alloc_aux(struct perf_buffer *rb, struct perf_event *event,
{
bool overwrite = !(flags & RING_BUFFER_WRITABLE);
int node = (event->cpu == -1) ? -1 : cpu_to_node(event->cpu);
- bool use_contiguous_pages = event->pmu->capabilities & (
- PERF_PMU_CAP_AUX_NO_SG | PERF_PMU_CAP_AUX_PREFER_LARGE);
- /*
- * Initialize max_order to 0 for page allocation. This allocates single
- * pages to minimize memory fragmentation. This is overridden if the
- * PMU needs or prefers contiguous pages (use_contiguous_pages = true).
- */
- int max_order = 0;
- int ret = -ENOMEM;
+ int ret = -ENOMEM, max_order;
if (!has_aux(event))
return -EOPNOTSUPP;
@@ -702,8 +694,8 @@ int rb_alloc_aux(struct perf_buffer *rb, struct perf_event *event,
if (!overwrite) {
/*
- * Watermark defaults to half the buffer, to aid PMU drivers
- * in double buffering.
+ * Watermark defaults to half the buffer, and so does the
+ * max_order, to aid PMU drivers in double buffering.
*/
if (!watermark)
watermark = min_t(unsigned long,
@@ -711,19 +703,16 @@ int rb_alloc_aux(struct perf_buffer *rb, struct perf_event *event,
(unsigned long)nr_pages << (PAGE_SHIFT - 1));
/*
- * If using contiguous pages, use aux_watermark as the basis
- * for chunking to help PMU drivers honor the watermark.
+ * Use aux_watermark as the basis for chunking to
+ * help PMU drivers honor the watermark.
*/
- if (use_contiguous_pages)
- max_order = get_order(watermark);
+ max_order = get_order(watermark);
} else {
/*
- * If using contiguous pages, we need to start with the
- * max_order that fits in nr_pages, not the other way around,
- * hence ilog2() and not get_order.
+ * We need to start with the max_order that fits in nr_pages,
+ * not the other way around, hence ilog2() and not get_order.
*/
- if (use_contiguous_pages)
- max_order = ilog2(nr_pages);
+ max_order = ilog2(nr_pages);
watermark = 0;
}
---
base-commit: 21a7f44fd0765fcc5194130b28767786eba1d1e7
change-id: 20261025-perf_revert_prefer_large_alloc-a0177d6379f6
Best regards,
--
Leo Yan <leo.yan(a)arm.com>
On 26/10/2026 05:48, Amir Ayupov wrote:
> CS_CFG_MATCH_INST_ANY has been defined since the system configuration was
> introduced but is not used by any configuration, feature or device.
> Remove it.
>
> Suggested-by: Leo Yan <leo.yan(a)arm.com>
> Assisted-by: Devmate:Opus-5.5
> Signed-off-by: Amir Ayupov <aaupov(a)fb.com>
> ---
> drivers/hwtracing/coresight/coresight-config.h | 3 ---
> 1 file changed, 3 deletions(-)
>
> diff --git a/drivers/hwtracing/coresight/coresight-config.h b/drivers/hwtracing/coresight/coresight-config.h
> index f04e73b91d9a6..220bc54f8e5e1 100644
> --- a/drivers/hwtracing/coresight/coresight-config.h
> +++ b/drivers/hwtracing/coresight/coresight-config.h
> @@ -39,9 +39,6 @@
> */
> #define CS_CFG_MATCH_CAP_MASK GENMASK_U32(15, 8)
>
> -/* flags defining device instance matching - used in config match desc data. */
> -#define CS_CFG_MATCH_INST_ANY 0x80000000 /* any instance of a class */
> -
> /*
> * Limit number of presets in a configuration
> * This is related to the number of bits (4) we use to select the preset on
Reviewed-by: James Clark <james.clark(a)linaro.org>
On 26/10/2026 05:48, Amir Ayupov wrote:
> A feature loads on a device when the two share any match flag. That works
> for device classes, where a feature wants any one of them, but not for
> capabilities a device may or may not have: a feature that sets a class
> and a capability would still load on a device of that class without the
> capability.
>
> Split the match flags into CS_CFG_MATCH_CLASS_MASK for device classes and
> CS_CFG_MATCH_CAP_MASK for capabilities. A feature now loads on a device
> that shares one of its classes and has all of its capabilities. Check
> this once in cscfg_load_feat_csdev(), which both the feature and the
> device registration paths call. No capability flags are defined yet, so
> matching is unchanged.
>
> Assisted-by: Devmate:Opus-5.5
> Signed-off-by: Amir Ayupov <aaupov(a)fb.com>
> ---
> .../hwtracing/coresight/coresight-config.h | 8 ++++
> .../hwtracing/coresight/coresight-syscfg.c | 37 +++++++++++++------
> 2 files changed, 34 insertions(+), 11 deletions(-)
>
> diff --git a/drivers/hwtracing/coresight/coresight-config.h b/drivers/hwtracing/coresight/coresight-config.h
> index ae6295e308131..f04e73b91d9a6 100644
> --- a/drivers/hwtracing/coresight/coresight-config.h
> +++ b/drivers/hwtracing/coresight/coresight-config.h
> @@ -7,6 +7,7 @@
> #ifndef _CORESIGHT_CORESIGHT_CONFIG_H
> #define _CORESIGHT_CORESIGHT_CONFIG_H
>
> +#include <linux/bits.h>
> #include <linux/cleanup.h>
> #include <linux/coresight.h>
> #include <linux/types.h>
> @@ -30,6 +31,13 @@
> */
> #define CS_CFG_MATCH_CLASS_SRC_ALL 0x0001 /* match any source */
> #define CS_CFG_MATCH_CLASS_SRC_ETM4 0x0002 /* match any ETMv4 device */
> +#define CS_CFG_MATCH_CLASS_MASK GENMASK_U32(7, 0)
> +
> +/*
> + * flags defining device capabilities a feature can require. A feature loads on
> + * a device that matches one of its classes and has all of its capabilities.
> + */
> +#define CS_CFG_MATCH_CAP_MASK GENMASK_U32(15, 8)
>
> /* flags defining device instance matching - used in config match desc data. */
> #define CS_CFG_MATCH_INST_ANY 0x80000000 /* any instance of a class */
> diff --git a/drivers/hwtracing/coresight/coresight-syscfg.c b/drivers/hwtracing/coresight/coresight-syscfg.c
> index a816c22c87bc8..3ee104e94a4cd 100644
> --- a/drivers/hwtracing/coresight/coresight-syscfg.c
> +++ b/drivers/hwtracing/coresight/coresight-syscfg.c
> @@ -171,8 +171,22 @@ cscfg_alloc_csdev_feat(struct coresight_device *csdev, struct cscfg_feature_desc
> return feat_csdev;
> }
>
> -/* load one feature into one coresight device */
> +static bool cscfg_match_feat_csdev(u32 feat_flags, u32 csdev_flags)
> +{
> + /* The device must be in one of the feature's classes */
> + if (!(feat_flags & csdev_flags & CS_CFG_MATCH_CLASS_MASK))
> + return false;
> +
> + /* The device must have every capability the feature requires */
> + if (feat_flags & ~csdev_flags & CS_CFG_MATCH_CAP_MASK)
> + return false;
> +
> + return true;
> +}
> +
> +/* Load the feature into the device if it matches, otherwise skip it. */
> static int cscfg_load_feat_csdev(struct coresight_device *csdev,
> + u32 match_flags,
> struct cscfg_feature_desc *feat_desc,
> struct cscfg_csdev_feat_ops *ops)
> {
> @@ -183,6 +197,9 @@ static int cscfg_load_feat_csdev(struct coresight_device *csdev,
> if (!ops->load_feat)
> return -EINVAL;
>
> + if (!cscfg_match_feat_csdev(feat_desc->match_flags, match_flags))
> + return 0;
> +
> feat_csdev = cscfg_alloc_csdev_feat(csdev, feat_desc);
> if (!feat_csdev)
> return -ENOMEM;
> @@ -212,11 +229,11 @@ static int cscfg_add_feat_to_csdevs(struct cscfg_feature_desc *feat_desc)
> int err;
>
> list_for_each_entry(csdev_item, &cscfg_mgr->csdev_desc_list, item) {
> - if (csdev_item->match_flags & feat_desc->match_flags) {
> - err = cscfg_load_feat_csdev(csdev_item->csdev, feat_desc, &csdev_item->ops);
> - if (err)
> - return err;
> - }
> + err = cscfg_load_feat_csdev(csdev_item->csdev,
> + csdev_item->match_flags, feat_desc,
> + &csdev_item->ops);
> + if (err)
> + return err;
> }
> return 0;
> }
> @@ -739,11 +756,9 @@ static int cscfg_add_feats_csdev(struct coresight_device *csdev,
> return -EINVAL;
>
> list_for_each_entry(feat_desc, &cscfg_mgr->feat_desc_list, item) {
> - if (feat_desc->match_flags & match_flags) {
> - err = cscfg_load_feat_csdev(csdev, feat_desc, ops);
> - if (err)
> - break;
> - }
> + err = cscfg_load_feat_csdev(csdev, match_flags, feat_desc, ops);
> + if (err)
> + break;
> }
> return err;
> }
Reviewed-by: James Clark <james.clark(a)linaro.org>