CoreSight September 2026

coresight@lists.linaro.org

6 participants
39 discussions

[PATCH v2 00/14] perf cs-etm: Per-thread mode fixes and snapshot wrap support

by James Clark

Fix a few issues with per-thread mode: - With TRBE, thread migrations hit a queue without a decoder assert - On nVHE, everything looks like guest trace instead of host - Tracing multiple threads didn't really work After adding a tests for those, it turns out there were some snapshot bugs not picked up by the other snapshot tests. That showed that the different snapshot searches for Intel BTS and Arm SPE were inconsistent and I think all tracers can benefit from using the same pointer fixup logic, so that gets refactored into the common auxtrace.c. Then SPE can just share the Intel BTS search as it was obviously copied from it originally. IntelPT keeps the more advanced duplicate data search, but in the future that could probably be made the common one and all tracers would benefit from using it (except maybe BTS if it always has a very small buffer, but I doubt the overhead of the duplicate search would be an issue). For now this is more of a refactor rather than behavioral change so don't do that yet. Signed-off-by: James Clark <james.clark(a)linaro.org> --- Changes in v2: - Remove stale "may be reset to -1 in per-thread mode" comment - Set CPU when queueing auxtrace fragments otherwise auxtrace_queues__add_event() overwrites the queue's CPU - Link to v1: https://patch.msgid.link/20260811-james-cs-unformatted-per-thread-fix-v1-0-… --- James Clark (14): perf cs-etm: Fix nVHE per-thread decoding perf cs-etm: Warn for invalid timestamp option perf cs-etm: Turn on context packet timestamps in per-thread mode perf cs-etm: Use per-CPU queues for per-thread mode perf cs-etm: Increase default timestamp generation period perf auxtrace: Turn Intel BTS snapshot search into a generic one perf arm-spe: Use generic snapshot search perf auxtrace: intel-pt: Use new snapshot_has_wrapped callback perf cs-etm: Queue partial AUX records perf cs-etm: Don't print missing buffers in snapshot mode perf auxtrace: cs-etm: Capture wrapped snapshots perf test: Allow infinite named_thread loops perf test: Add test for per-thread mode perf cs-etm: Test multiple per-thread threads Documentation/userspace-api/perf_ring_buffer.rst | 6 +- tools/perf/Documentation/perf-test.txt | 2 +- tools/perf/arch/arm/util/cs-etm.c | 30 ++++- tools/perf/arch/arm64/util/arm-spe.c | 147 +-------------------- tools/perf/arch/x86/util/intel-bts.c | 115 +--------------- tools/perf/arch/x86/util/intel-pt.c | 58 +++----- .../perf/tests/shell/coresight/per-thread-multi.sh | 78 +++++++++++ tools/perf/tests/shell/coresight/per-thread.sh | 48 +++++++ .../perf/tests/shell/coresight/raw_dump_stress.sh | 5 - tools/perf/tests/workloads/named_threads.c | 7 +- tools/perf/util/auxtrace.c | 136 +++++++++++++++++-- tools/perf/util/auxtrace.h | 20 ++- tools/perf/util/cs-etm.c | 101 ++++++++++---- 13 files changed, 384 insertions(+), 369 deletions(-) --- base-commit: 9453bc6a69ef43755f1c28d5688cacdd69fa16bd change-id: 20260605-james-cs-unformatted-per-thread-fix-50e723aa7f0e Best regards, -- James Clark <james.clark(a)linaro.org>

19 hours, 1 minute

[PATCH 00/25] CoreSight / perf: Support AUX sampling

by Leo Yan

This series adds AUX sampling support to Arm CoreSight. A PMU sample can carry a window of recent AUX trace, which perf generates callchain and branch stack for the sampled thread. This provides execution history for context-based profiling. The series can be divided into four parts: 1. Patches 01 ~ 03 for event core: The perf event core changes warn on non-positive AUX snapshot returns before checking alignment padding. Space for a non-zero AUX payload has already been reserved, so a zero return leaves that payload unwritten. CoreSight fills unavailable trace with zeros and returns the requested size. It also prevents AUX sampling and pause/resume from nesting through an NMI. A driver guard alone can leave perf's pause state (aux_paused) inconsistent with the hardware state. The event core ensures only one AUX callback is exclusively invoked. Export the output copy helpers so CoreSight can fill sample payloads when the driver is built as a module. 2. Patches 04 ~ 09 for ETM perf: The ETM perf changes separate the lifetime of the published CoreSight context from that of the AUX output handle. Centralize buffer updates, and end AUX output when throttling stops an event without PERF_EF_UPDATE so a later restart can acquire a fresh handle. Make hardware-state transitions reflect completed operations. 3. Patches 10 ~ 13 for TRBE driver: TRBE snapshot buffers need padding to meet the CPU's alignment and wrap constraints. Use circular buffer mode for overwrite snapshots, retaining Fill mode on CPUs that require the write out-of-range workaround. TRBE faults can still raise interrupts in circular mode. Track when the sink is handling an interrupt so an AUX sampling NMI can skip a snapshot while the interrupted handler is updating the buffer. Make repeated sink disable safe for deferred cleanup after a snapshot failure. 4. Patches 14 ~ 25 for AUX sampling and decoding: Shared atomic STOP and AUX action bits prevent an NMI stop from tearing down the context while pause, resume or snapshot accesses it. The AUX operation finishes and then completes the deferred stop, publishing the stopped state only after hardware teardown. Add snapshot_aux() to the CoreSight driver to pause the source, update the sink buffer, disable the path, copy the recent trace into the PMU sample, and then re-enable the path and resume the source. Patch 17 fixes history collection for zero-IP PMU samples. Perf clears the IP when a user-only sampling interrupt skids into the kernel, but the timestamp and TID remain valid for matching the trace history. In perf, decode each embedded payload as an independent trace window, selecting the decoder with the sampled CPU and using the sample's PID/TID and traced context IDs to attribute history to the sampled thread. Refactor common timeless decoding and history collection, and drain pending OpenCSD output so buffered history is not lost. Attach reconstructed callchains and branch stacks to the original PMU samples, preserving histories already present in the samples. Add a test, and document the recording and decoding workflow and its limitations. The initial support targets unformatted trace from per-CPU sinks such as TRBE. Shared formatted sinks such as ETR can mix trace from multiple CPUs, consuming the limited sample window with execution unrelated to the sampled thread. This series is based on Amir's series "perf: Add CoreSight branch history to existing samples" [1] for perf tool's branch / callchain generating. [1] https://lore.kernel.org/linux-perf-users/cover.1787005265.git.aaupov@fb.com/ Signed-off-by: Leo Yan <leo.yan(a)arm.com> --- Leo Yan (25): perf/core: Reject non-positive AUX snapshot sizes perf/core: Prevent AUX sampling from racing with pause/resume perf/core: Export output copy helpers for CoreSight coresight: perf: End AUX output when an event is throttled coresight: perf: Extract AUX buffer update helper coresight: perf: Simplify flow for CPUs without a path coresight: perf: Validate the live context through its path coresight: perf: Validate context before resuming trace coresight: perf: Improve hardware state transitions coresight: trbe: Pad snapshot buffers coresight: trbe: Use circular buffer mode for snapshots coresight: trbe: Track per-CPU sink interrupt handling coresight: trbe: Handle an already disabled sink coresight: perf: Look up the trace path in etm_event_pause() coresight: perf: Serialize AUX pause and resume with event stops coresight: perf: Support AUX sampling with per-CPU sinks perf cs-etm: Allow history collection for samples with zero IP perf cs-etm: Unify timeless buffer decoding perf cs-etm: Propagate errors from trace queue flushing perf cs-etm: Drain pending packets before finishing trace blocks perf cs-etm: Complete packet draining with end of trace perf cs-etm: Centralize sample history collection perf cs-etm: Decode AUX samples into callchains and branch stacks perf test: Add CoreSight AUX sample decoding test Documentation: coresight: Document AUX sample decoding Documentation/trace/coresight/coresight-perf.rst | 39 ++ drivers/hwtracing/coresight/coresight-etm-perf.c | 396 +++++++++++++----- drivers/hwtracing/coresight/coresight-etm-perf.h | 2 + drivers/hwtracing/coresight/coresight-trbe.c | 122 ++++-- include/linux/coresight.h | 2 + kernel/events/core.c | 26 +- kernel/events/ring_buffer.c | 2 + tools/perf/arch/arm/util/cs-etm.c | 6 + tools/perf/tests/shell/coresight/aux_sample.sh | 189 +++++++++ tools/perf/util/cs-etm-decoder/cs-etm-decoder.c | 39 ++ tools/perf/util/cs-etm-decoder/cs-etm-decoder.h | 7 + tools/perf/util/cs-etm.c | 491 ++++++++++++++++------- 12 files changed, 1040 insertions(+), 281 deletions(-) --- base-commit: 134e1295eedfc9a3c6e4e63d8ef45dc63749449b change-id: 20260826-arm_cs_support_aux_sample-275664545588 Best regards, -- Leo Yan <leo.yan(a)arm.com>

1 day, 13 hours

[PATCH v3 0/8] coresight: Prevent per-thread events from sharing a sink

by James Clark

Concurrent per-thread events results in a WARN on N1SDP which leads to the realization that per-thread events shouldn't have been sharing sinks in the first place. This slips through because different per-thread events will have the same PID if owned by the same process, and we only check the PID and nothing else. That results in unexpected WARNs because it looks like we assumed it couldn't happen (although exclusive PMU rules allow it). But even if it was supported it would result in trace from the wrong thread in another event's per-thread buffer, so we should disallow it. Fix it everywhere the same PID checking logic was copy pasted. Then the PIDs can be dropped from a few structs as they are now unused. Signed-off-by: James Clark <james.clark(a)linaro.org> --- Changes in v3: - Storing and accessing event owners at runtime causes problems due to various scenarios of: events (and sibling events) exiting, children inheriting event FDs, PID reuse, CPU affine events that also have a target process set but different inherit settings. Fix it by creating a session ID in etm_setup_aux() and holding the references in it for the duration of the whole session. (Leo) - Make the ETR buffer allocator consistent with sink sharing rules by not doing numeric PID comparisons there either. - Fix up some Sashiko reports that it sees after interacting with cscfg and taking extra references to tasks and PIDs. - Link to v2: https://lore.kernel.org/r/20260709-james-cs-multiple-per-threads-v2-0-10ac7… Changes in v2: - Fix inherited events by following event->parent - Link to v1: https://lore.kernel.org/r/20260709-james-cs-multiple-per-threads-v1-0-d384e… --- James Clark (8): coresight: tmc-etr: Don't stop Perf cleanup for active sysfs reads coresight: configfs: Don't assume active until cscfg_mgr is set coresight: etm-perf: Flush workqueue before unloading module coresight: tmc-etr: Prevent per-thread events from sharing a sink coresight: tmc-etr: Use session ID for buffer ownership coresight: tmc-etf: Prevent per-thread events from sharing a sink coresight: etb10: Prevent per-thread events from sharing a sink coresight: ultrasoc-smb: Prevent per-thread events from sharing a sink drivers/hwtracing/coresight/coresight-core.c | 28 +-- drivers/hwtracing/coresight/coresight-etb10.c | 33 ++-- drivers/hwtracing/coresight/coresight-etm-perf.c | 79 ++++++++- drivers/hwtracing/coresight/coresight-etm-perf.h | 15 ++ drivers/hwtracing/coresight/coresight-priv.h | 2 - drivers/hwtracing/coresight/coresight-syscfg.c | 6 +- drivers/hwtracing/coresight/coresight-tmc-core.c | 6 +- drivers/hwtracing/coresight/coresight-tmc-etf.c | 44 ++--- drivers/hwtracing/coresight/coresight-tmc-etr.c | 207 +++++++++++++---------- drivers/hwtracing/coresight/coresight-tmc.h | 30 ++-- drivers/hwtracing/coresight/coresight-trbe.c | 3 +- drivers/hwtracing/coresight/ultrasoc-smb.c | 25 +-- drivers/hwtracing/coresight/ultrasoc-smb.h | 6 +- include/linux/coresight.h | 5 +- 14 files changed, 294 insertions(+), 195 deletions(-) --- base-commit: 98495b5a4d77dd22e106f462b76e1093a55b29a7 change-id: 20260708-james-cs-multiple-per-threads-ed1d25ed1734 Best regards, -- James Clark <james.clark(a)linaro.org>

1 week, 5 days

[PATCH v2] coresight: trbe: Hide enable_sink sysfs file

by James Clark

TRBE doesn't support sysfs mode, but the enable_sink file can still be successfully written to enable the device, and only attempting to enable the source would later fail. Avoid misleading users by adding a flag that devices can use to hide either the enable_sink or enable_source files, and set it for TRBE. Don't set it for ETE as it's possible that ETE could appear on the legacy bus and work with sysfs, and writing to enable_source already reports EINVAL if the device doesn't support sysfs mode. Signed-off-by: James Clark <james.clark(a)linaro.org> --- Changes in v2: - Re-use CORESIGHT_DESC flags in csdev instead of converting to bool. - Hide all remaining attrs after label instead of only source and sink attrs as there aren't any others anyway (Leo). - Link to v1: https://lore.kernel.org/r/20260507-james-cs-hide-trbe-enable-v1-1-b4e40439f… --- drivers/hwtracing/coresight/coresight-core.c | 1 + drivers/hwtracing/coresight/coresight-sysfs.c | 15 +++++++++------ drivers/hwtracing/coresight/coresight-trbe.c | 7 +++++++ include/linux/coresight.h | 4 ++++ 4 files changed, 21 insertions(+), 6 deletions(-) diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c index f7b1308a759c..a0c098980096 100644 --- a/drivers/hwtracing/coresight/coresight-core.c +++ b/drivers/hwtracing/coresight/coresight-core.c @@ -1543,6 +1543,7 @@ coresight_init_device(struct coresight_desc *desc) csdev->ops = desc->ops; csdev->access = desc->access; csdev->orphan = true; + csdev->flags = desc->flags; if (desc->flags & CORESIGHT_DESC_CPU_BOUND) { csdev->cpu = desc->cpu; diff --git a/drivers/hwtracing/coresight/coresight-sysfs.c b/drivers/hwtracing/coresight/coresight-sysfs.c index 4b010f8bc4c0..75000fe64fda 100644 --- a/drivers/hwtracing/coresight/coresight-sysfs.c +++ b/drivers/hwtracing/coresight/coresight-sysfs.c @@ -346,16 +346,19 @@ static ssize_t label_show(struct device *dev, } static DEVICE_ATTR_RO(label); -static umode_t label_is_visible(struct kobject *kobj, - struct attribute *attr, int n) +static umode_t coresight_attr_is_visible(struct kobject *kobj, + struct attribute *attr, int n) { struct device *dev = kobj_to_dev(kobj); + struct coresight_device *csdev = to_coresight_device(dev); if (attr == &dev_attr_label.attr) { if (fwnode_property_present(dev_fwnode(dev), "label")) return attr->mode; else return 0; + } else if (csdev->flags & CORESIGHT_DESC_NO_SYSFS_MODE) { + return 0; } return attr->mode; @@ -369,7 +372,7 @@ static struct attribute *coresight_sink_attrs[] = { static struct attribute_group coresight_sink_group = { .attrs = coresight_sink_attrs, - .is_visible = label_is_visible, + .is_visible = coresight_attr_is_visible, }; __ATTRIBUTE_GROUPS(coresight_sink); @@ -381,7 +384,7 @@ static struct attribute *coresight_source_attrs[] = { static struct attribute_group coresight_source_group = { .attrs = coresight_source_attrs, - .is_visible = label_is_visible, + .is_visible = coresight_attr_is_visible, }; __ATTRIBUTE_GROUPS(coresight_source); @@ -392,7 +395,7 @@ static struct attribute *coresight_link_attrs[] = { static struct attribute_group coresight_link_group = { .attrs = coresight_link_attrs, - .is_visible = label_is_visible, + .is_visible = coresight_attr_is_visible, }; __ATTRIBUTE_GROUPS(coresight_link); @@ -403,7 +406,7 @@ static struct attribute *coresight_helper_attrs[] = { static struct attribute_group coresight_helper_group = { .attrs = coresight_helper_attrs, - .is_visible = label_is_visible, + .is_visible = coresight_attr_is_visible, }; __ATTRIBUTE_GROUPS(coresight_helper); diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c index c7cbca45f2de..eca8e13a9744 100644 --- a/drivers/hwtracing/coresight/coresight-trbe.c +++ b/drivers/hwtracing/coresight/coresight-trbe.c @@ -1348,6 +1348,13 @@ static void arm_trbe_register_coresight_cpu(struct trbe_drvdata *drvdata, int cp desc.dev = dev; desc.cpu = cpu; desc.flags = CORESIGHT_DESC_CPU_BOUND; + /* + * ETE isn't connected to TRBE with a link like other Coresight devices + * and the TRBE driver has been written to always assume Perf mode, so + * Prevent sysfs from being used. + */ + desc.flags |= CORESIGHT_DESC_NO_SYSFS_MODE; + trbe_csdev = coresight_register(&desc); if (IS_ERR(trbe_csdev)) goto cpu_clear; diff --git a/include/linux/coresight.h b/include/linux/coresight.h index add0579cad88..6cd1d01b843b 100644 --- a/include/linux/coresight.h +++ b/include/linux/coresight.h @@ -142,6 +142,8 @@ struct csdev_access { }) #define CORESIGHT_DESC_CPU_BOUND BIT(0) +/* Device can't be activated from sysfs, only via Perf. */ +#define CORESIGHT_DESC_NO_SYSFS_MODE BIT(1) /** * struct coresight_desc - description of a component required from drivers @@ -310,6 +312,8 @@ struct coresight_device { struct list_head config_csdev_list; raw_spinlock_t cscfg_csdev_lock; void *active_cscfg_ctxt; + /* CORESIGHT_DESC_[x] flags */ + u32 flags; }; /* --- base-commit: c8eb4a8dd259fb2b215da32764fa8c6c76519896 change-id: 20260506-james-cs-hide-trbe-enable-3c8d784e72d8 Best regards, -- James Clark <james.clark(a)linaro.org>

2 weeks, 6 days

[PATCH 0/6] perf: cs-etm: HW_ID improvements

by James Clark

The driver might not always be able to write HW_IDs, but we don't need them for unformatted mode anyway, so fix that in commit ("perf cs-etm: Synthesize missing HW_ID mappings for raw trace"). At the same time, give the driver another chance to send them in commit ("coresight: perf: Retry failed HW_ID writes"). The other commits are semi-related improvements and fixes. ("perf: cs-etm: Respect --no-itrace option") makes debugging broken Coresight perf.data files easier. Applies on top of "[PATCH v2 00/14] perf cs-etm: Per-thread mode fixes and snapshot wrap support" Signed-off-by: James Clark <james.clark(a)linaro.org> --- James Clark (5): perf: cs-etm: Don't add global v0 HW_IDs to unformatted queues perf cs-etm: Free partially created queues perf: cs-etm: Respect --no-itrace option perf/core: Return errors from perf_report_aux_output_id() coresight: perf: Retry failed HW_ID writes Leo Yan (1): perf cs-etm: Synthesize missing HW_ID mappings for raw trace drivers/hwtracing/coresight/coresight-etm-perf.c | 52 +++++---- include/linux/perf_event.h | 2 +- kernel/events/core.c | 6 +- tools/perf/util/auxtrace.c | 2 +- tools/perf/util/auxtrace.h | 1 + tools/perf/util/cs-etm.c | 143 ++++++++++++++++------- 6 files changed, 139 insertions(+), 67 deletions(-) --- base-commit: 78148c85297024ffe7a709acb7cc4fc907271176 change-id: 20260706-james-cs-hw_id-output-failure-1d06d042ef96 prerequisite-change-id: 20260605-james-cs-unformatted-per-thread-fix-50e723aa7f0e:v2 prerequisite-patch-id: 1aa32269a3a7dc76840dd8a24cb5a8715507e898 prerequisite-patch-id: ef471f468351462f67efa58a09a3461306ac5a0a prerequisite-patch-id: c78946cf4ec1c7722570865403a3562625bdaa33 prerequisite-patch-id: 0b953eee0252db3c7ba3ef1e3397048a94482ca2 prerequisite-patch-id: 27da72c2f01bcc68205bbcc14d5019369c02cb83 prerequisite-patch-id: 365c6d5f71c754e4c690b5ebed3453565bb5b809 prerequisite-patch-id: 64e9419a41082a2db3daf255baf0fb40efbae5dd prerequisite-patch-id: 1dc2e6ef8e76b369736b4c88560302861b2e4faf prerequisite-patch-id: b7de38ec4d90f5b45d56390a4e5919a1d6439951 prerequisite-patch-id: 3548d5b161cfb8c11a166ca2b3228ca4821f1ca0 prerequisite-patch-id: 97e66600218a2b32e5b21d0abcb6321590f98de9 prerequisite-patch-id: 292282b20bd8ad7d096ee7ffbc55dcfb75455f53 prerequisite-patch-id: c80259b47850ba65c985c85a29c8cf4948463d59 Best regards, -- James Clark <james.clark(a)linaro.org>

2 weeks, 6 days

Re: [PATCH 2/2] perf: arm_spe: Prefer large AUX mappings

by Leo Yan

Hi Will, On Mon, Aug 10, 2026 at 04:10:48PM +0100, Will Deacon wrote: > On Mon, Aug 10, 2026 at 03:44:42PM +0100, Leo Yan wrote: > > Commit 18049c8cff9c ("perf/aux: Allocate non-contiguous AUX pages by > > default") made the AUX allocator use order-0 pages by default unless a > > PMU explicitly asks for contiguous allocations. > > But that commit specifically calls out SPE as benefitting from > non-contiguous pages: > > "For instance, ARM SPE and TRBE operate with virtual pages, and > Coresight ETR allocates a separate buffer. For these PMUs, > allocating contiguous AUX pages unnecessarily exacerbates memory > fragmentation. This fragmentation can prevent their use on > long-running devices." > > so why doesn't passing PERF_PMU_CAP_AUX_PREFER_LARGE reintroduce the > problems that 18049c8cff9c was trying to solve? How about adding a field to struct pmu to specify a preferred maximum page order for the AUX buffer? The perf core could try that order first and fall back to smaller orders if the allocation fails. For example, the Neoverse V2 TRM documents: L1 Trace Buffer Extension (TRBE) TLB: 1 entry Given the single L1 TRBE TLB entry, the TRBE driver could prefer PMD_ORDER (2 MiB with 4 KiB pages) to reduce TLB pressure. This reflects the hardware characteristic. This could be a trade-off instead of using PERF_PMU_CAP_AUX_PREFER_LARGE, avoiding large contiguous allocations that could reintroduce the Android OOM issue. I did a quick test with this approach and the results look positive. Does this sound like a reasonable direction? I might also need Yabin's judgement from Android side. Thanks, Leo

3 weeks

[PATCH v2 00/14] perf cs-etm: Fix bogus branch samples on exceptions

by Leo Yan

CoreSight currently models exception entry by changing the preceding instruction range into a taken branch. This can give an IRQ the source PC of an instruction that already retired and overwrite a real branch immediately before the exception. For an untaken B.LS followed by an IRQ, perf script currently reports: hw int 4000f8 => ffff800080010c80 b.ls #0x400118 ... iret ffff800080012284 => 4000fc eret The hardware trace supplies 0x4000fc as the preferred return address. For an IRQ, this is the architectural resume PC (Arm ARM, R_VBQMV). B.LS has retired, and the saved PC identifies the boundary before the following MOV. Using this PC as the IRQ source reflects the architectural state at exception entry: hw int 4000fc => ffff800080010c80 movz x2, #0x1796 ... iret ffff800080012284 => 4000fc eret The IRQ sample represents the transfer from this architectural execution position to the handler. The series synthesizes exception entries from exception packets, preserving the preceding branch and its outcome. The supporting changes: - Let decoders supply sample.ret_addr so later instruction fetching cannot change thread-stack return addresses. Apply this to Intel PT asynchronous samples as well. - Prepare packet ISA and instruction-size handling and share sample synthesis helpers. Mark untaken branches and break history when instruction memory is unavailable. - Add a thread-stack regression test and four AArch64 CoreSight tests. IRQs and page faults must resume at the entry PC; SVC and emulated MRS must resume four bytes later. Based on the AI search and test on my x86 machine, this matches perf's Intel PT handling of IRQs. Intel PT records the next instruction's IP in the FUP packet, and Perf uses that IP as the interrupt sample's source. This series is verified on Orion6 board with "perf test coresight". Signed-off-by: Leo Yan <leo.yan(a)arm.com> --- Changes in v2: - Rework the fix around exception packets to preserve both exception entries and preceding branches. - Add explicit return addresses and the Intel PT asynchronous-branch fix. - Split out packet/synthesis preparation, record not-taken branches and handle unreadable instruction memory. - Add thread-stack regression coverage and four CoreSight tests. - Link to v1: https://lore.kernel.org/r/20260713-perf_cs_etm_fix_non_taken-v1-0-4561607fc… --- Leo Yan (14): perf sample: Allow decoders to supply branch return addresses perf intel-pt: Preserve return addresses for asynchronous branches perf cs-etm: Break branch history when instruction memory is unavailable perf cs-etm: Centralize packet ISA initialization perf cs-etm: Use the recorded instruction size for A32 and A64 perf cs-etm: Mark branches that were not taken perf cs-etm: Factor out final instruction sample synthesis perf cs-etm: Centralize branch sample synthesis checks perf cs-etm: Classify exception calls using the exception packet perf cs-etm: Synthesize exception entries separately from branches perf tests: Check CoreSight IRQ entry and exit perf tests: Check CoreSight syscall entry and exit perf tests: Check CoreSight abort entry and exit perf tests: Check CoreSight emulated instruction entry and exit tools/perf/tests/Build | 1 + tools/perf/tests/builtin-test.c | 3 + .../perf/tests/shell/coresight/abort_entry_exit.sh | 21 ++ tools/perf/tests/shell/coresight/irq_entry_exit.sh | 37 ++++ .../tests/shell/coresight/syscall_entry_exit.sh | 21 ++ .../perf/tests/shell/coresight/trap_entry_exit.sh | 24 +++ tools/perf/tests/shell/lib/coresight_exception.sh | 165 +++++++++++++++ tools/perf/tests/tests.h | 3 + tools/perf/tests/thread-stack.c | 106 ++++++++++ tools/perf/tests/workloads/Build | 4 + tools/perf/tests/workloads/branch_not_taken_loop.c | 33 +++ tools/perf/tests/workloads/page_fault_loop.c | 37 ++++ tools/perf/util/cs-etm-decoder/cs-etm-decoder.c | 106 +++++++--- tools/perf/util/cs-etm.c | 222 ++++++++++----------- tools/perf/util/cs-etm.h | 2 + tools/perf/util/intel-pt.c | 7 + tools/perf/util/sample.c | 1 + tools/perf/util/sample.h | 5 + tools/perf/util/thread-stack.c | 5 +- 19 files changed, 656 insertions(+), 147 deletions(-) --- base-commit: edd8a9fe2eca009599e013a29c421c7a6b5ad1b9 change-id: 20260713-perf_cs_etm_fix_non_taken-5b4d7f73f41e Best regards, -- Leo Yan <leo.yan(a)arm.com>

3 weeks, 1 day

Re: [PATCH] coresight: syscfg: Fix null pointer dereference when configfs init fails

by Mike Leach

Reviewed-by: Mike Leach <mike.leach(a)arm.com> On 9/28/26 13:35, Yingchao Deng wrote: > If cscfg_configfs_init() fails, cscfg_init() takes the exit_err path: > > cscfg_init() -> cscfg_clear_device() -> cscfg_configfs_release() > -> configfs_unregister_subsystem() > > which tears down a configfs subsystem that was never registered. > configfs_unregister_subsystem() begins with: > > struct dentry *dentry = dget(group->cg_item.ci_dentry); > struct dentry *root = dentry->d_sb->s_root; > > ci_dentry is assigned in configfs_create_dir() only once the subsystem > directory has been created, which never happened here. cscfg_mgr > comes from kzalloc_obj(), so ci_dentry is still NULL, and dget() > hands a NULL dentry back unchanged - the next line dereferences it. > > Handle the failure in cscfg_init() directly: unregister the device and > return the error, releasing the devres-allocated config item type and > cscfg_mgr without touching the subsystem. > > Fixes: a13d5a246aca ("coresight: syscfg: Add initial configfs support") > Suggested-by: Leo Yan <leo.yan(a)arm.com> > Link: https://lore.kernel.org/all/20260924162404.GN200420@e132581.arm.com/ > Signed-off-by: Yingchao Deng <dengyingchao(a)kylinsec.com.cn> > --- > drivers/hwtracing/coresight/coresight-syscfg.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/drivers/hwtracing/coresight/coresight-syscfg.c b/drivers/hwtracing/coresight/coresight-syscfg.c > index 2bfdd7b45e49..00b29d1656c0 100644 > --- a/drivers/hwtracing/coresight/coresight-syscfg.c > +++ b/drivers/hwtracing/coresight/coresight-syscfg.c > @@ -1299,8 +1299,10 @@ int __init cscfg_init(void) > > /* initialise configfs subsystem */ > err = cscfg_configfs_init(cscfg_mgr); > - if (err) > - goto exit_err; > + if (err) { > + device_unregister(cscfg_device()); > + return err; > + } > > /* preload built-in configurations */ > err = cscfg_preload(THIS_MODULE);

3 weeks, 1 day

[PATCH v12 00/14] fix several inconsistencies with sysfs configuration in etmX

by Yeoreum Yun

The current ETMx configuration via sysfs can lead to the following inconsistencies: - If a configuration is modified via sysfs while a perf session is active, the running configuration may differ between before a sched-out and after a subsequent sched-in. - If a perf session and sysfs session tries to enable concurrently, configuration from configfs could be corrupted (etm4). - There is chance to corrupt drvdata->config if perf session tries to enabled among handling cscfg_csdev_disable_active_config() in etm4_disable_sysfs() (etm4). To resolve these inconsistencies, the configuration should be separated into: - curr_config, which is applied configuration for the current session - config, which stores the settings configured via sysfs. and apply configuration from configfs after taking a mode. Patch History ============= from v11 to v12: - rename active_config to curr_config. - rename config to sysfs_config. - remove redundant config argument in etmX_args. - add read-back and copy from curr_config to sysfs_config TRCSEQSTR (seq_state). - add r-b and t-b tags. - Link to v11: https://lore.kernel.org/r/20260915-separate_etm_cfg_v2-v11-0-d2b258d51747@a… from v10 to v11: - replace direct register read from etm3 sysfs with IPI. - fix issue cntr_val and others field which required to be shown after sysfs session disable. - prohibit the write for some etm3 sysfs while sysfs session is enabled. - drop locktype change in etm3 - Link to v10: https://lore.kernel.org/r/20260911-separate_etm_cfg_v2-v10-0-1b715d95927a@a… from v9 to v10: - rebase to coresight/next - https://lore.kernel.org/all/20260725113645.57519-1-yeoreum.yun@arm.com/ from v8 to v9: - add feat_csdev_lock guard interface. - set feat_csdev->drv_spinlock as NULL for etmv4_drvdata. - https://lore.kernel.org/all/20260629090007.1718746-1-yeoreum.yun@arm.com/ from v7 to v8: - accept @Leo Yan' suggestion to handle error. - small minor fixes following @Suzuki' suggestion. - https://lore.kernel.org/all/20260519154812.254884-1-yeoreum.yun@arm.com/ from v6 to v7: - rebase on coresight/next - add ETM_MAX_SEQ_TRANSITIONS define - remove redundant patch relavent cpu-hotplug as coresight-pm patch merged. - https://lore.kernel.org/all/20260422132203.977549-1-yeoreum.yun@arm.com/ from v5 to v6: - fix missing of calling cscfg_csdev_disable_active_config() - add rb & fixes tags. - add ss_status field in etm4x_drvdata to expose STATUS and PENDING bits. - https://lore.kernel.org/all/20260415165528.3369607-1-yeoreum.yun@arm.com/ from v4 to v5: - add rb-tag. - fix underflow issue for nrseqstate. - fix wrong check in etm4_sspcicrn_present(). - remove redundant fields on etmv4_save_state. - rename caps->ss_status to ss_cmp. - fix wrong location of etm4_release_trace_id. - https://lore.kernel.org/all/20260413142003.3549310-1-yeoreum.yun@arm.com/ from v3 to v4: - change etm_drvdata->spinlock type to raw_spin_lock_t - remove redundant call etmX_enable_hw() with starting_cpu() callsback. - fix missing trace id release. - add missing docs. - https://lore.kernel.org/all/20260412175506.412301-1-yeoreum.yun@arm.com/ from v2 to v3: - fix build error for etm3x. - fix checkpatch warning. - https://lore.kernel.org/all/20260410074310.2693385-1-yeoreum.yun@arm.com/ from v1 to v2 - rebased to v7.0-rc7. - introduce etmX_caps structure to save etmX's capabilities. - remove ss_status from etmv4_config. - modify active_config after taking a mode (perf/sysfs). - https://lore.kernel.org/all/20260317181705.2456271-1-yeoreum.yun@arm.com/ --- Yeoreum Yun (14): coresight: etm4x: read-back TRCSEQSTR at disabling and prohibit modifying seq_state while enabling. coresight: etm4x: prohibit modifying cntr_val while session is enabled coresight: etm3x: prohibit modifying cntr_val and reset while session is enabled coresight: etm4x: fix inconsistencies with sysfs configuration coresight: etm3x: fix inconsistencies with sysfs configuration coresight: etm3x: remove redundant cpu online check on etm_enable_sysfs() coresight: etm4x: introduce struct etm4_caps coresight: etm4x: exclude ss_status from drvdata->config coresight: etm4x: remove s_ex_level from config coresight: etm4x: rename local config as curr_config referring drvdata->curr_config coresight: etm4x: rename drvdata->config to sysfs_config coresight: etm3x: introduce struct etm_caps coresight: etm3x: rename local config as curr_config referring drvdata->curr_config coresight: etm3x: rename drvdata->config to sysfs_config drivers/hwtracing/coresight/coresight-config.c | 18 +- drivers/hwtracing/coresight/coresight-config.h | 22 + drivers/hwtracing/coresight/coresight-etm.h | 48 +- drivers/hwtracing/coresight/coresight-etm3x-core.c | 196 +++-- .../hwtracing/coresight/coresight-etm3x-sysfs.c | 461 +++++----- drivers/hwtracing/coresight/coresight-etm4x-cfg.c | 14 +- drivers/hwtracing/coresight/coresight-etm4x-core.c | 567 ++++++------ .../hwtracing/coresight/coresight-etm4x-sysfs.c | 961 +++++++++++---------- drivers/hwtracing/coresight/coresight-etm4x.h | 199 +++-- 9 files changed, 1340 insertions(+), 1146 deletions(-) --- base-commit: 9e3604d7369cfc0110100eb1a0acab1865ee2d18 change-id: 20260911-separate_etm_cfg_v2-3518a168cbff Best regards, -- Sincerely, Yeoreum Yun

3 weeks, 1 day

[PATCH v2] perf test: Record kcore for the CoreSight callchain test

by Leo Yan

The CoreSight callchain test traces both userspace and kernel execution and checks the callchain across a syscall. Add --kcore to perf record to save the running kernel image alongside the trace data so perf script can use it to decode the kernel trace. If kcore is not available, the test will be skipped. Add a Fixes tag so the change can be backported to stable kernels and improve the test reliability. Fixes: ca0e19074bd6 ("perf test: Add Arm CoreSight callchain test") Reviewed-by: James Clark <james.clark(a)linaro.org> Signed-off-by: Leo Yan <leo.yan(a)arm.com> --- Changes in v2: - Add check /proc/kcore and skip test if absent. Signed-off-by: Leo Yan <leo.yan(a)arm.com> --- tools/perf/tests/shell/coresight/callchain.sh | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/tools/perf/tests/shell/coresight/callchain.sh b/tools/perf/tests/shell/coresight/callchain.sh index 13cca7dc11184002e3ddc058c0d0ffa1c458c483..43ad90bc30345efdd40ba4649ceeb435a1781a4b 100755 --- a/tools/perf/tests/shell/coresight/callchain.sh +++ b/tools/perf/tests/shell/coresight/callchain.sh @@ -30,6 +30,11 @@ skip_if_system_is_not_ready() return 2 } + [ -e /proc/kcore ] || { + echo "[Skip] /proc/kcore is not available" >&2 + return 2 + } + return 0 } @@ -43,7 +48,7 @@ record_trace() mkfifo "$cf" "$af" - perf record -o "$data" -e cs_etm// --per-thread -D -1 --control fifo:"$cf","$af" -- \ + perf record --kcore -o "$data" -e cs_etm// --per-thread -D -1 --control fifo:"$cf","$af" -- \ perf test --record-ctl fifo:"$cf","$af" -w callchain >/dev/null 2>&1 && # It is safe to use 'i3i' with a three-instruction interval, since the --- base-commit: 0ae6fc78c5ce0dfd18d8712a50f0fd4602eff103 change-id: 20260928-perf_cs_etm_callchain_test_add_kcore-f96e891f91c5 Best regards, -- Leo Yan <leo.yan(a)arm.com>

3 weeks, 2 days

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

CoreSight September 2026