CoreSight

coresight@lists.linaro.org

5 participants
2847 discussions

[GIT PULL] coresight: Updates for Linux v7.3

by Suzuki K Poulose

Hi Greg Please find this pull request for CoreSight subsystem targeting v7.3. Almost all of them are fixes to the existing code, along with a MAINTAINERS update for HiSilicon PTT driver. Kindly pull Suzuki The following changes since commit 8cdeaa50eae8dad34885515f62559ee83e7e8dda: Linux 7.2-rc2 (2026-07-05 14:44:06 -1000) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/coresight/linux.git tags/coresight-next-v7.3 for you to fetch changes up to 9e3604d7369cfc0110100eb1a0acab1865ee2d18: coresight: etm4x: remove redundant fields in etmv4_save_state (2026-08-07 10:45:11 +0100) ---------------------------------------------------------------- coresight: Updates for Linux v7.3 This is relatively smaller update for CoreSight/hwtracing subsystem updates. - MAINTAINERS update for HiSilicon PCI Trace & Tune drivers - Minor fixes to hisi_ptt driver - Various fixes to the coresight etm4x dirvers Signed-off-by: Suzuki K Poulose <suzuki.poulose(a)arm.com> ---------------------------------------------------------------- Jonathan Cameron (1): MAINTAINERS: Update HiSilicon PCI Trace and Tune maintainer Kuan-Wei Chiu (1): coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior Sanman Pradhan (2): hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() hwtracing: hisi_ptt: Remove unnecessary trace buffer zeroing in trace_start() Yeoreum Yun (5): coresight: etm4x: fix wrong check of etm4x_sspcicrn_present() coresight: etm4x: fix underflow for usage of (nrseqstate - 1) coresight: etm4x: fix leaked trace id coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable coresight: etm4x: remove redundant fields in etmv4_save_state MAINTAINERS | 3 +- .../hwtracing/coresight/coresight-etm3x-sysfs.c | 15 ++---- drivers/hwtracing/coresight/coresight-etm4x-cfg.c | 2 +- drivers/hwtracing/coresight/coresight-etm4x-core.c | 59 +++++++++++++--------- .../hwtracing/coresight/coresight-etm4x-sysfs.c | 6 ++- drivers/hwtracing/coresight/coresight-etm4x.h | 12 ++--- drivers/hwtracing/ptt/hisi_ptt.c | 25 ++++----- 7 files changed, 63 insertions(+), 59 deletions(-)

1 month, 1 week

Re: [PATCH v1] coresight: Check runtime PM resume result

by Anshuman Khandual

On 03/08/26 4:55 AM, Yuho Choi wrote: > coresight_get_ref() ignores the return value of pm_runtime_get_sync() > and reports success even when runtime resume fails. A path is then built > and the CoreSight device may be accessed while it remains powered off. > > Use pm_runtime_resume_and_get() so a failed resume is reported and its > runtime PM usage reference is rolled back. Drop the module and device > references acquired before the resume attempt when it fails. > > Fixes: 5da5325fa856 ("coresight: moving PM runtime operations to core framework") > Signed-off-by: Yuho Choi <dbgh9129(a)gmail.com> > --- Should 'Fixes:' be tagging the following commit - which had introduced coresight_get_ref() unconditionally calling pm_runtime_get_sync() ? 32b0707a4182 ("coresight: Add try_get_module() in coresight_grab_device()") > drivers/hwtracing/coresight/coresight-core.c | 6 +++++- > 1 file changed, 5 insertions(+), 1 deletion(-) > > diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c > index 6d65c43d574f..77d05b360484 100644 > --- a/drivers/hwtracing/coresight/coresight-core.c > +++ b/drivers/hwtracing/coresight/coresight-core.c > @@ -843,7 +843,11 @@ static bool coresight_get_ref(struct coresight_device *csdev) > goto err_module; > > /* Make sure the device is powered on */ > - pm_runtime_get_sync(parent); > + if (pm_runtime_resume_and_get(parent) < 0) { > + module_put(drv->owner); > + goto err_module; > + } > + > return true; > > err_module:

1 month, 1 week

Re: [PATCH v3] coresight: coresight.h: add '*' to kernel-doc lines

by Anshuman Khandual

On 20/07/26 3:54 AM, Randy Dunlap wrote: > kernel-doc reports 2 (kernel-doc) lines in coresight.h that don't have > a beginning '*' in them, so fix these lines. > > Also convert struct coresight_trace_id_map to kernel-doc format to > remove another warning. > > Warning: include/linux/coresight.h:173 bad line: > connected to @src_port. NULL until the device is created > Warning: include/linux/coresight.h:177 bad line: > needs to be filtered. > Warning: include/linux/coresight.h:236 This comment starts with '/**', > but isn't a kernel-doc comment. > > Fixes: ec9903d6cc34 ("coresight: Add support for trace filtering by source") > Fixes: d49c9cf15f89 ("coresight: Rename connection members to make the direction explicit") > Signed-off-by: Randy Dunlap <rdunlap(a)infradead.org> > --- > v2: rebase & resend > v3: rebase & resend > > Cc: James Clark <james.clark(a)arm.com> > Cc: Tao Zhang <quic_taozha(a)quicinc.com> > Cc: Suzuki K Poulose <suzuki.poulose(a)arm.com> > Cc: coresight(a)lists.linaro.org > Cc: Danilo Krummrich <dakr(a)kernel.org> > Cc: Mike Leach <mike.leach(a)arm.com> > Cc: Leo Yan <leo.yan(a)arm.com> > Cc: linux-arm-kernel(a)lists.infradead.org > --- > include/linux/coresight.h | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > > --- linux-next-20260717.orig/include/linux/coresight.h > +++ linux-next-20260717/include/linux/coresight.h > @@ -177,11 +177,11 @@ struct coresight_desc { > * @dest_port: destination's input port number @src_port is connected to. > * @dest_fwnode: destination component's fwnode handle. > * @dest_dev: a @coresight_device representation of the component > - connected to @src_port. NULL until the device is created > + * connected to @src_port. NULL until the device is created > * @link: Representation of the connection as a sysfs link. > * @filter_src_fwnode: filter source component's fwnode handle. > * @filter_src_dev: a @coresight_device representation of the component that > - needs to be filtered. > + * needs to be filtered. > * > * The full connection structure looks like this, where in_conns store > * references to same connection as the source device's out_conns. > @@ -234,7 +234,7 @@ struct coresight_sysfs_link { > #define CORESIGHT_TRACE_IDS_MAX 128 > > /** > - * Trace ID map. > + * struct coresight_trace_id_map - Trace ID map. > * > * @used_ids: Bitmap to register available (bit = 0) and in use (bit = 1) IDs. > * Initialised so that the reserved IDs are permanently marked as > But still there are more warnings left in the documentation file even after the patch applied. Should they be fixed as well ? ./scripts/kernel-doc -none include/linux/coresight.h Warning: include/linux/coresight.h:216 struct member 'src_dev' not described in 'coresight_connection' Warning: include/linux/coresight.h:216 struct member 'src_refcnt' not described in 'coresight_connection' Warning: include/linux/coresight.h:216 struct member 'dest_refcnt' not described in 'coresight_connection' Warning: include/linux/coresight.h:248 struct member 'cpu_map' not described in 'coresight_trace_id_map' Warning: include/linux/coresight.h:248 struct member 'lock' not described in 'coresight_trace_id_map' Warning: include/linux/coresight.h:312 struct member 'perf_sink_id_map' not described in 'coresight_device' Warning: include/linux/coresight.h:216 struct member 'src_dev' not described in 'coresight_connection' Warning: include/linux/coresight.h:216 struct member 'src_refcnt' not described in 'coresight_connection' Warning: include/linux/coresight.h:216 struct member 'dest_refcnt' not described in 'coresight_connection' Warning: include/linux/coresight.h:248 struct member 'cpu_map' not described in 'coresight_trace_id_map' Warning: include/linux/coresight.h:248 struct member 'lock' not described in 'coresight_trace_id_map' Warning: include/linux/coresight.h:312 struct member 'perf_sink_id_map' not described in 'coresight_device'

1 month, 2 weeks

[PATCH v8 00/13] fix several inconsistencies with sysfs configuration in etmX

by Yeoreum Yun

The current ETMx configuration via sysfs can lead to the following inconsistencies: - If a configuration is modified via sysfs while a perf session is active, the running configuration may differ between before a sched-out and after a subsequent sched-in. - If a perf session and sysfs session tries to enable concurrently, configuration from configfs could be corrupted (etm4). - There is chance to corrupt drvdata->config if perf session tries to enabled among handling cscfg_csdev_disable_active_config() in etm4_disable_sysfs() (etm4). To resolve these inconsistencies, the configuration should be separated into: - active_config, which is applied configuration for the current session - config, which stores the settings configured via sysfs. and apply configuration from configfs after taking a mode. Also, This patch set includes some small fixes: - missing trace id release in etm4x. - underflow issue for nrseqstate. - wrong check in etm4x_sspcicrn_present(). - missing call of cscfg_csdev_disable_active_config() This patch based on coresight tree's next Patch History ============= from v7 to v8: - accept @Leo Yan' suggestion to handle error. - small minor fixes following @Suzuki' suggestion. - https://lore.kernel.org/all/20260519154812.254884-1-yeoreum.yun@arm.com/ from v6 to v7: - rebase on coresight/next - add ETM_MAX_SEQ_TRANSITIONS define - remove redundant patch relavent cpu-hotplug as coresight-pm patch merged. - https://lore.kernel.org/all/20260422132203.977549-1-yeoreum.yun@arm.com/ from v5 to v6: - fix missing of calling cscfg_csdev_disable_active_config() - add rb & fixes tags. - add ss_status field in etm4x_drvdata to expose STATUS and PENDING bits. - https://lore.kernel.org/all/20260415165528.3369607-1-yeoreum.yun@arm.com/ from v4 to v5: - add rb-tag. - fix underflow issue for nrseqstate. - fix wrong check in etm4_sspcicrn_present(). - remove redundant fields on etmv4_save_state. - rename caps->ss_status to ss_cmp. - fix wrong location of etm4_release_trace_id. - https://lore.kernel.org/all/20260413142003.3549310-1-yeoreum.yun@arm.com/ from v3 to v4: - change etm_drvdata->spinlock type to raw_spin_lock_t - remove redundant call etmX_enable_hw() with starting_cpu() callsback. - fix missing trace id release. - add missing docs. - https://lore.kernel.org/all/20260412175506.412301-1-yeoreum.yun@arm.com/ from v2 to v3: - fix build error for etm3x. - fix checkpatch warning. - https://lore.kernel.org/all/20260410074310.2693385-1-yeoreum.yun@arm.com/ from v1 to v2 - rebased to v7.0-rc7. - introduce etmX_caps structure to save etmX's capabilities. - remove ss_status from etmv4_config. - modify active_config after taking a mode (perf/sysfs). - https://lore.kernel.org/all/20260317181705.2456271-1-yeoreum.yun@arm.com/ Yeoreum Yun (13): coresight: etm4x: fix wrong check of etm4x_sspcicrn_present() coresight: etm4x: fix underflow for usage of (nrseqstate - 1) coresight: etm4x: introduce struct etm4_caps coresight: etm4x: exclude ss_status from drvdata->config coresight: etm4x: remove s_ex_level from config coresight: etm4x: remove redundant fields in etmv4_save_state coresight: etm4x: fix leaked trace id coresight: etm4x: fix inconsistencies with sysfs configuration coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable coresight: etm3x: change drvdata->spinlock type to raw_spin_lock_t coresight: etm3x: introduce struct etm_caps coresight: etm3x: fix inconsistencies with sysfs configuration coresight: etm3x: remove redundant cpu online check on etm_enable_sysfs() drivers/hwtracing/coresight/coresight-etm.h | 46 +- .../coresight/coresight-etm3x-core.c | 96 ++-- .../coresight/coresight-etm3x-sysfs.c | 159 +++--- .../hwtracing/coresight/coresight-etm4x-cfg.c | 5 +- .../coresight/coresight-etm4x-core.c | 454 ++++++++++-------- .../coresight/coresight-etm4x-sysfs.c | 204 ++++---- drivers/hwtracing/coresight/coresight-etm4x.h | 202 ++++---- 7 files changed, 639 insertions(+), 527 deletions(-) -- LEVI:{C3F47F37-75D8-414A-A8BA-3980EC8A46D7}

1 month, 3 weeks

Re: [PATCH v3] coresight: Fix scheduling while atomic in coresight_cpu_pm_notify()

by Leo Yan

On Fri, Jul 17, 2026 at 12:41:54AM +0300, Mohamed Ayman wrote: [...] > static struct coresight_path *coresight_cpu_get_active_path(enum cs_mode mode) > { > struct coresight_device *source; > - bool is_active = false; > + struct coresight_path *path = NULL; > > - source = coresight_get_percpu_source_ref(smp_processor_id()); > - if (!source) > - return NULL; > - > - if (coresight_get_mode(source) & mode) > - is_active = true; > + guard(raw_spinlock_irqsave)(&coresight_dev_lock); > > - coresight_put_percpu_source_ref(source); > + source = per_cpu(csdev_source, smp_processor_id()); > + if (source && (coresight_get_mode(source) & mode)) > + path = source->path; > > - /* > - * It is expected to run in atomic context or with the CPU lock held for > - * sysfs mode, so it cannot be preempted to disable the path. Here > - * returns the active path pointer without concern that its state may > - * change. Since the build path has taken a reference on the component, > - * the path can be safely used by the caller. > - */ Please keep the comment, as it helps explain why the path pointer can be returned and safely used by the caller. > - return is_active ? source->path : NULL; > + return path; With above update: Reviewed-by: Leo Yan <leo.yan(a)arm.com> Just a thought: we could view this in two stages. 1) The first stage is building the CoreSight path, where we need to ensure the involved modules remain bound while the path is being established. 2) Once the path has been built and the device mode is enabled, we enter the runtime stage. From that point on, observing the device mode as enabled guarantees that the associated data structures can be accessed safely. I would leave this to maintainers for a call in case any concerns on lifetime management.

1 month, 3 weeks

Re: [PATCH v3] coresight: Fix scheduling while atomic in coresight_cpu_pm_notify()

by Leo Yan

On Fri, Jul 17, 2026 at 06:12:01PM +0200, Sebastian Andrzej Siewior wrote: [...] > > The raw spinlock (coresight_dev_lock) serializes access to the per-CPU > > csdev_source pointer. It does not guarantee the lifetime of the source > > or its _parent_ device. coresight_unregister() is not only reached from > > module unload; it can also be called when a driver is unbind, for > > example DT overlay removal or device hotplug/unplug. > > But doesn't coresight_unregister() block on the coresight_dev_lock here? Fair point. coresight_cpu_get_active_path() can safely access the source while holding coresight_dev_lock. Unregistration will be blocked until the access from the CPU PM notifier has finished. > > I think a proper fix needs a clearer lifetime model for an active > > session. E.g., we could consider to call device_link_add() to prevent > > device unbind / unregister, and unlink device when the session is > > finished. Once that is in place, the CPU PM notifier can safely use the > > active path without get_device()/put_device() pair anymore. > > Right. I am also not sure about lifetime of coresight_device::path. coresight_device::path is a runtime pointer that is valid only while the device is enabled. Since both the path and the device mode are updated atomically on the local CPU, observing the device mode as enabled guarantees that the corresponding coresight_device::path is valid. Thanks, Leo

1 month, 3 weeks

[PATCH] perf cs-etm: Avoid truncating AUX buffer sizes to int

by Leo Yan

cs_etm__get_trace() returns an int, but it used to return etmq->buf_len on success. That value comes from auxtrace_buffer::size, which is a size_t. For a large AUX trace block, returning the byte count through an int can overflow and make a valid buffer look like a negative error. The callers do not need the actual byte count from cs_etm__get_trace(). The buffer length is already stored in the etmq->buf_len. The callers only need to distinguish three states: < 0: error = 0: no more AUX buffers > 0: data is available Make cs_etm__get_trace() return 0 for all non-error cases and use etmq->buf_len to indicate whether a new buffer was found. Then make cs_etm__get_data_block() return 1 whenever data is available, instead of returning the buffer length. Also refactor cs_etm__get_data_block() to make its return value semantics clearer. Reported-by: Suyash Mahar <smahar(a)meta.com> Fixes: 8224531cf5a1 ("perf cs-etm: Modularize auxtrace_buffer fetch function") Signed-off-by: Leo Yan <leo.yan(a)arm.com> --- tools/perf/util/cs-etm.c | 46 ++++++++++++++++++++++++++-------------------- 1 file changed, 26 insertions(+), 20 deletions(-) diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c index 95e3ec1171acc8442d8539a72a26a1a5a53a2f37..114b3cd2da495e54e78df8fbd707898312f95079 100644 --- a/tools/perf/util/cs-etm.c +++ b/tools/perf/util/cs-etm.c @@ -1467,8 +1467,7 @@ cs_etm__get_trace(struct cs_etm_queue *etmq) etmq->buf_used = 0; etmq->buf_len = aux_buffer->size; etmq->buf = aux_buffer->data; - - return etmq->buf_len; + return 0; } /* @@ -2151,26 +2150,33 @@ static int cs_etm__get_data_block(struct cs_etm_queue *etmq) { int ret; - if (!etmq->buf_len) { - ret = cs_etm__get_trace(etmq); - if (ret <= 0) - return ret; - /* - * We cannot assume consecutive blocks in the data file - * are contiguous, reset the decoder to force re-sync. - */ - ret = cs_etm_decoder__reset(etmq->decoder); - if (ret) - return ret; + /* The current block is not finished */ + if (etmq->buf_len) + return 1; - /* - * Since the decoder is reset, this causes a global trace - * discontinuity. Flush all thread stacks. - */ - cs_etm__flush_all_stack(etmq); - } + ret = cs_etm__get_trace(etmq); + if (ret < 0) + return ret; + + /* No more buffer to read */ + if (!etmq->buf_len) + return 0; + + /* + * We cannot assume consecutive blocks in the data file + * are contiguous, reset the decoder to force re-sync. + */ + ret = cs_etm_decoder__reset(etmq->decoder); + if (ret) + return ret; + + /* + * Since the decoder is reset, this causes a global trace + * discontinuity. Flush all thread stacks. + */ + cs_etm__flush_all_stack(etmq); - return etmq->buf_len; + return 1; } static bool cs_etm__is_svc_instr(struct cs_etm_queue *etmq, --- base-commit: e01c7bd5b1eece254bcbf282db066b12c4815d21 change-id: 20260720-perf_cs_etm_fix_big_size-ec5608f767df Best regards, -- Leo Yan <leo.yan(a)arm.com>

1 month, 3 weeks

Re: [PATCH v2] coresight: dummy: add missing MODULE_DEVICE_TABLE()

by Leo Yan

On Mon, Jul 20, 2026 at 07:45:14PM +0800, Pengpeng Hou wrote: > The CoreSight dummy driver has an OF match table wired into its platform > driver, but does not export the table to module metadata. A modular build > therefore lacks OF aliases for automatic loading. > > Export dummy_match with MODULE_DEVICE_TABLE(). > > Fixes: 9d3ba0b6c056 ("Coresight: Add coresight dummy driver") > Reviewed-by: Jie Gan <jie.gan(a)oss.qualcomm.com> > Signed-off-by: Pengpeng Hou <pengpeng(a)iscas.ac.cn> Reviewed-by: Leo Yan <leo.yan(a)arm.com> > --- > Changes since v1: https://lore.kernel.org/all/20260704121621.48544-1-pengpeng@iscas.ac.cn/ > - add the requested Fixes tag > - carry Jie Gan's conditional Reviewed-by after making that change > - rebase onto v7.2-rc4 > > drivers/hwtracing/coresight/coresight-dummy.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/hwtracing/coresight/coresight-dummy.c b/drivers/hwtracing/coresight/coresight-dummy.c > index c176a2f57300..04880d38feb7 100644 > --- a/drivers/hwtracing/coresight/coresight-dummy.c > +++ b/drivers/hwtracing/coresight/coresight-dummy.c > @@ -212,6 +212,7 @@ static const struct of_device_id dummy_match[] = { > {.compatible = "arm,coresight-dummy-sink"}, > {}, > }; > +MODULE_DEVICE_TABLE(of, dummy_match); > > static struct platform_driver dummy_driver = { > .probe = dummy_probe, >

1 month, 3 weeks

Re: [PATCH v3] coresight: Fix scheduling while atomic in coresight_cpu_pm_notify()

by Leo Yan

On Fri, Jul 17, 2026 at 12:41:54AM +0300, Mohamed Ayman wrote: [...] > static struct coresight_path *coresight_cpu_get_active_path(enum cs_mode mode) > { > struct coresight_device *source; > - bool is_active = false; > + struct coresight_path *path = NULL; > > - source = coresight_get_percpu_source_ref(smp_processor_id()); > - if (!source) > - return NULL; > - > - if (coresight_get_mode(source) & mode) > - is_active = true; > + guard(raw_spinlock_irqsave)(&coresight_dev_lock); > > - coresight_put_percpu_source_ref(source); > + source = per_cpu(csdev_source, smp_processor_id()); > + if (source && (coresight_get_mode(source) & mode)) > + path = source->path; I agree the get_device()/put_device() pair in coresight_cpu_get_active_path() is not a good fit for CPU PM notifier, because the put_device() can become the final put while IRQ is disabled. However, my understanding is this patch might cause UAF issue that the existing code is intended to prevent. The raw spinlock (coresight_dev_lock) serializes access to the per-CPU csdev_source pointer. It does not guarantee the lifetime of the source or its _parent_ device. coresight_unregister() is not only reached from module unload; it can also be called when a driver is unbind, for example DT overlay removal or device hotplug/unplug. This is why the UAF issue Sashiko mentioned in patch 03 of [1]. A built CoreSight path currently grabs references for the path components, which keeps module alive, but that is not the same as preventing the parent device/driver from being unbound and tearing down CoreSight device data while an active session still has raw pointers. There are also similar race window before the path is built: for example etm_setup_aux() has to look up source/sink state before coresight_build_path() establishes the path, so it might access released source/sink data if device is unbound. I think a proper fix needs a clearer lifetime model for an active session. E.g., we could consider to call device_link_add() to prevent device unbind / unregister, and unlink device when the session is finished. Once that is in place, the CPU PM notifier can safely use the active path without get_device()/put_device() pair anymore. Hope this is clear and makes sense. Thanks, Leo [1] https://sashiko.dev/#/patchset/20260405-arm_coresight_path_power_management…

2 months

Re: [PATCH v3] coresight: Fix scheduling while atomic in coresight_cpu_pm_notify()

by Leo Yan

Hi Mohamed & Sebastian, On Fri, Jul 17, 2026 at 10:14:53AM +0200, Sebastian Andrzej Siewior wrote: [...] > There is coresight_put_percpu_source_ref() with holds coresight_dev_lock > during a put_cpu. I don't know why the lock is held, it is not obvious > to me. But it will lead to a similar problem if the put actually invokes > the release callback. Sorry I am a bit late to join the discussion. Essentially, this is about how to manage a module's lifetime correctly so that the CPU PM notifier can safely access a device. There is an edge case where the CPU PM notifier is accessing the device while, at the same time, the module is being unloaded and the device's resources are being released. For now, I'd suggest please hold on this patch. Give me a bit time to study this thread, I will share back more details. Thanks, Leo

2 months

← Newer
1
2
3
4
5
6
7
8
...
285
Older →

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

CoreSight