CoreSight

coresight@lists.linaro.org

3 participants
2706 discussions

Re: [PATCH v4 1/9] coresight: etm4x: introduce struct etm4_caps

by Leo Yan

On Mon, Apr 13, 2026 at 03:19:54PM +0100, Yeoreum Yun wrote: > Introduce struct etm4_caps to describe ETMv4 capabilities > and move capabilities information into it. > > Signed-off-by: Yeoreum Yun <yeoreum.yun(a)arm.com> LGTM: Reviewed-by: Leo Yan <leo.yan(a)arm.com> FWIW, two comments from Sashiko are valuable for me, please see below. > --- > .../coresight/coresight-etm4x-core.c | 234 +++++++++--------- > .../coresight/coresight-etm4x-sysfs.c | 190 ++++++++------ > drivers/hwtracing/coresight/coresight-etm4x.h | 176 ++++++------- > 3 files changed, 328 insertions(+), 272 deletions(-) > > diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c > index d565a73f0042..6443f3717b37 100644 > --- a/drivers/hwtracing/coresight/coresight-etm4x-core.c > +++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c > @@ -88,8 +88,9 @@ static int etm4_probe_cpu(unsigned int cpu); > */ > static bool etm4x_sspcicrn_present(struct etmv4_drvdata *drvdata, int n) > { > - return (n < drvdata->nr_ss_cmp) && > - drvdata->nr_pe && > + const struct etmv4_caps *caps = &drvdata->caps; > + > + return (n < caps->nr_ss_cmp) && caps->nr_pe && > (drvdata->config.ss_status[n] & TRCSSCSRn_PC); As Sashiko suggests: "This isn't a regression introduced by this patch, but should this be checking caps->nr_pe_cmp instead of caps->nr_pe?" I confirmed the ETMv4 specification (ARM IHI0064H.b), the comment above is valid as the we should check caps->nr_pe_cmp instead. Could you first use a patch to fix the typo and then apply capabilities afterwards? This is helpful for porting to stable kernels. [...] > @@ -525,14 +530,14 @@ static int etm4_enable_hw(struct etmv4_drvdata *drvdata) > if (etm4x_wait_status(csa, TRCSTATR_IDLE_BIT, 1)) > dev_err(etm_dev, > "timeout while waiting for Idle Trace Status\n"); > - if (drvdata->nr_pe) > + if (caps->nr_pe) > etm4x_relaxed_write32(csa, config->pe_sel, TRCPROCSELR); > etm4x_relaxed_write32(csa, config->cfg, TRCCONFIGR); > /* nothing specific implemented */ > etm4x_relaxed_write32(csa, 0x0, TRCAUXCTLR); > etm4x_relaxed_write32(csa, config->eventctrl0, TRCEVENTCTL0R); > etm4x_relaxed_write32(csa, config->eventctrl1, TRCEVENTCTL1R); > - if (drvdata->stallctl) > + if (caps->stallctl) > etm4x_relaxed_write32(csa, config->stall_ctrl, TRCSTALLCTLR); > etm4x_relaxed_write32(csa, config->ts_ctrl, TRCTSCTLR); > etm4x_relaxed_write32(csa, config->syncfreq, TRCSYNCPR); > @@ -542,17 +547,17 @@ static int etm4_enable_hw(struct etmv4_drvdata *drvdata) > etm4x_relaxed_write32(csa, config->vinst_ctrl, TRCVICTLR); > etm4x_relaxed_write32(csa, config->viiectlr, TRCVIIECTLR); > etm4x_relaxed_write32(csa, config->vissctlr, TRCVISSCTLR); > - if (drvdata->nr_pe_cmp) > + if (caps->nr_pe_cmp) > etm4x_relaxed_write32(csa, config->vipcssctlr, TRCVIPCSSCTLR); > - for (i = 0; i < drvdata->nrseqstate - 1; i++) > + for (i = 0; i < caps->nrseqstate - 1; i++) > etm4x_relaxed_write32(csa, config->seq_ctrl[i], TRCSEQEVRn(i)); Sashiko's comment: "If the hardware does not implement a sequencer, caps->nrseqstate (a u8) will be 0. Does 0 - 1 evaluate to -1 as an int, which then gets promoted to ULONG_MAX against val (an unsigned long)?" This is a good catch. The condition check should be: for (i = 0; i < caps->nrseqstate; i++) ...; The issue is irrelevant to your patch, but could you use a patch to fix "nrseqstate - 1" first and then apply the cap refactoring on it? This would be friendly for porting to stable kernel. Thanks, Leo

2 weeks, 5 days

Re: [PATCH v10 00/20] CoreSight: Refactor power management for CoreSight path

by Leo Yan

On Mon, Apr 13, 2026 at 06:30:18PM +0800, Jie Gan wrote: [...] > tested on QCOM sa8775-ride: > > === 1. Sysfs mode: basic enable/disable === > PASS: Sink tmc_etr0 enabled > PASS: Source etm0 enabled > PASS: Source etm0 disabled cleanly > PASS: Sink tmc_etr0 disabled cleanly > > === 2. Sysfs mode: repeated enable/disable cycles (10x) === > PASS: 10 enable/disable cycles completed without error > > === 3. Sysfs mode: enable source with no active sink === > PASS: Enable without sink returned error (expected) > > === 4. Sysfs mode: enable/disable all per-CPU sources === > etm0 (cpu0): enabled OK > etm1 (cpu1): enabled OK > etm2 (cpu2): enabled OK > etm3 (cpu3): enabled OK > etm4 (cpu4): enabled OK > etm5 (cpu5): enabled OK > etm6 (cpu6): enabled OK > etm7 (cpu7): enabled OK > PASS: All online per-CPU sources enabled/disabled successfully > > === 5. CPU hotplug: offline CPU while sysfs tracing active === > Using source etm1 on cpu1 > Tracing active on cpu1, offlining CPU... > [ 82.805359] psci: CPU1 killed (polled 0 ms) > PASS: Source auto-disabled on CPU offline > [ 83.346033] Detected PIPT I-cache on CPU1 > [ 83.346114] GICv3: CPU1: found redistributor 100 region > 0:0x0000000017a80000 > [ 83.346283] CPU1: Booted secondary processor 0x0000000100 [0x410fd4b2] > PASS: Source re-enabled after CPU re-online > > === 6. Sysfs: enable source on offline CPU (expect ENODEV) === > [ 84.013788] psci: CPU1 killed (polled 0 ms) > PASS: Enable on offline cpu1 rejected (enable_source=0) > [ 84.349558] Detected PIPT I-cache on CPU1 > [ 84.349640] GICv3: CPU1: found redistributor 100 region > 0:0x0000000017a80000 > [ 84.349811] CPU1: Booted secondary processor 0x0000000100 [0x410fd4b2] > > === 7. CPU PM: trace survives CPU idle entry/exit === > Sleeping 3s to allow CPU idle entry... > Idle entries on cpu0 during test: 35 > PASS: Source still enabled after idle (PM save/restore working) > > === 8. Perf mode: basic cs_etm recording === > SKIP: perf not found in PATH > > === 11. TRBE: check save/restore sysfs nodes (if present) === > SKIP: No TRBE devices found > > Tested-by: Jie Gan <jie.gan(a)oss.qualcomm.com> Just heads up: since Sashiko [1] pointed out a corner case where an SMP call may fail when disabling the source device, the per-CPU path pointer might not be cleared. If the ETMv4 device is then removed (e.g. if the user unloads the ETMv4 module), CPU PM notifier might access the stale path pointer. Though this is a rare case, we should handle it safely. This is why the series was not picked for the v7.1 merge window. Thanks a lot for the testing, Jie! It's very helpful, and I will add your test tags in the next spin. Anyway, please expect more iterations. Thanks, Leo [1] https://sashiko.dev/#/patchset/20260405-arm_coresight_path_power_management…

2 weeks, 5 days

Re: [PATCH v10 16/20] coresight: Add PM callbacks for sink device

by Leo Yan

On Mon, Apr 13, 2026 at 01:45:50PM +0800, Jie Gan wrote: [...] > > @@ -1787,15 +1808,32 @@ static int coresight_pm_save(struct coresight_path *path) > > to = list_prev_entry(coresight_path_last_node(path), link); > > coresight_disable_path_from_to(path, from, to); > > + ret = coresight_pm_device_save(coresight_get_sink(path)); > > + if (ret) > > + goto sink_failed; > > + > > return 0; > > + > > +sink_failed: > > + if (!coresight_enable_path_from_to(path, coresight_get_mode(source), > > + from, to)) > > + coresight_pm_device_restore(source); > > I have go through the history messages. I have a question about this point > here: > > how can we handle the scenario if coresight_enable_path_from_to failed? It > means we are never calling coresight_pm_device_restore for the ETM and > leaving the ETM with OS lock state until CPU reset? From a design perspective, if any failure occurs in the idle flow, the priority is to avoid further mess, especially partial enable/disable sequences that could lead to lockups. The case you mentioned is a typical risk - if a path after source to sink fails to be enabled, it is unsafe to arbitrarily enable the source further. We rely on the per-CPU flag "percpu_pm_failed" to disable idle states, if ETE/TRBE fails to be disabled, if CPU is turned off, this also might cause lockup. > Consider we are calling etm4_disable_hw with OS lock: > etm4_disable_hw -> etm4_disable_trace_unit -> etm4x_wait_status (may timeout > here?) This is expected. I don't want to introduce a _recovery_ mechanism for CPU PM failures, which is complex and over-engineering. CPU PM notifier is low level code, and in my experience, PM issues can be easily observed once CPU idle is enabled and should be resolved during the development phase. In many cases PM issues are often not caused by CoreSight drivers but by other modules (e.g., clock or regulator drivers). The log "Failed in coresight PM save ..." reminds developers the bugs. As said, percpu_pm_failed is used as a last resort to prevent the platform from locking up if there is a PM bug. Thanks, Leo

2 weeks, 5 days

[PATCH v10 00/20] CoreSight: Refactor power management for CoreSight path

by Leo Yan

This series focuses on CoreSight path power management. The changes can be divided into four parts for review: Patches 01 - 04: Refactor the CPU ID storing in csdev, later patches consume csdev->cpu. Move CPU lock to sysfs layer so it is safe for later changes. Patches 05 - 09: Refactor the CPU idle flow with moving common code into the CoreSight core layer. Patches 10 - 15: Refactor path enabling and disabling with range, add path control during CPU idle. Patches 16 - 17: Support the sink (TRBE) control during CPU idle. Patches 18 - 20: Move CPU hotplug into the core layer, and fix sysfs mode for hotplug. This series is rebased on the coresight-next branch and has been verified on Juno-r2 (ETM + ETR) and FVP RevC (ETE + TRBE). Built successfully for armv7 (ARCH=arm). --- Changes in v10: - Removed redundant checks in ETMv4 PM callbacks (sashiko). - Added a new const structure etm4_cs_pm_ops (sashiko). - Used fine-grained spinlock on sysfs_active_config (sashiko). - Blocked notification after failures in save / restore to avoid lockups. - Changed Change CPUHP_AP_ARM_CORESIGHT_STARTING to CPUHP_AP_ARM_CORESIGHT_ONLINE so that the CPU hotplug callback runs in the thread context (sashiko). - Link to v9: https://lore.kernel.org/r/20260401-arm_coresight_path_power_management_impr… Changes in v9: - Changed to use per-CPU path pointer with lockless access. - Removed the change for adding csdev->path, the related refactoring will be sent separately. - Re-orged patches to avoid intermediate breakage (sashiko). - Link to v8: https://lore.kernel.org/r/20260325-arm_coresight_path_power_management_impr… Changes in v8: - Moved the "cpu" field in coresight_device for better pack with new patch 01 (Suzuki). - Added check if not set CPU for per_cpu_source/per_cpu_sink (Suzuki). - Renamed spinlock name in syscfg (Suzuki). - Refactored paired enable and disable path with new patches 10 and 12 (Suzuki). - Link to v7: https://lore.kernel.org/r/20260320-arm_coresight_path_power_management_impr… Changes in v7: - Added a flag in coresight_desc to indicate CPU bound device (Suzuki). - Used coresight_mutex to protect per-CPU source pointer (Suzuki). - Added a spinlock for exclusive access per-CPU source pointer (Suzuki). - Dropped .pm_is_needed() callback (Suzuki). - Supported range in path enabling / disabling (Suzuki). - Gathered test and review tags (Levi / James). - Link to v6: https://lore.kernel.org/r/20260305-arm_coresight_path_power_management_impr… Signed-off-by: Leo Yan <leo.yan(a)arm.com> --- Leo Yan (19): coresight: Extract device init into coresight_init_device() coresight: Populate CPU ID into coresight_device coresight: Remove .cpu_id() callback from source ops coresight: Take hotplug lock in enable_source_store() for Sysfs mode coresight: etm4x: Set per-CPU path on local CPU coresight: etm3x: Set per-CPU path on local CPU coresight: Register CPU PM notifier in core layer coresight: etm4x: Hook CPU PM callbacks coresight: etm4x: Remove redundant checks in PM save and restore coresight: syscfg: Use IRQ-safe spinlock to protect active variables coresight: Move source helper disabling to coresight_disable_path() coresight: Control path with range coresight: Use helpers to fetch first and last nodes coresight: Introduce coresight_enable_source() helper coresight: Control path during CPU idle coresight: Add PM callbacks for sink device coresight: sysfs: Increment refcount only for system tracers coresight: Move CPU hotplug callbacks to core layer coresight: sysfs: Validate CPU online status for per-CPU sources Yabin Cui (1): coresight: trbe: Save and restore state across CPU low power state drivers/hwtracing/coresight/coresight-catu.c | 2 +- drivers/hwtracing/coresight/coresight-core.c | 419 ++++++++++++++++++--- drivers/hwtracing/coresight/coresight-cti-core.c | 9 +- drivers/hwtracing/coresight/coresight-etm-perf.c | 4 +- drivers/hwtracing/coresight/coresight-etm3x-core.c | 73 +--- drivers/hwtracing/coresight/coresight-etm4x-core.c | 168 ++------- drivers/hwtracing/coresight/coresight-priv.h | 4 + drivers/hwtracing/coresight/coresight-syscfg.c | 35 +- drivers/hwtracing/coresight/coresight-syscfg.h | 2 + drivers/hwtracing/coresight/coresight-sysfs.c | 50 ++- drivers/hwtracing/coresight/coresight-trbe.c | 61 ++- include/linux/coresight.h | 13 +- include/linux/cpuhotplug.h | 2 +- 13 files changed, 566 insertions(+), 276 deletions(-) --- base-commit: ec687ba84000d7d50cf243558041f6729d1d8119 change-id: 20251104-arm_coresight_path_power_management_improvement-dab4966f8280 Best regards, -- Leo Yan <leo.yan(a)arm.com>

3 weeks, 1 day

Re: [PATCH] coresight: tpda: fix race between refcnt check and register access

by James Clark

On 08/04/2026 2:23 pm, Jie Gan wrote: > Several sysfs show/store handlers check csdev->refcnt before acquiring > the spinlock, then access hardware registers inside the lock. This is > a race: between the check and the lock acquisition, the following can > occur on another CPU: > > CPU 0 (sysfs reader) CPU 1 (disable path) > ───────────────────────────── ────────────────────────────────── > refcnt == 1, check passes > [waiting for spinlock] tpda_disable(): refcnt → 0 > debug clock disabled > spinlock acquired > readl_relaxed() ← FAULT/hang > > tpda_disable() decrements csdev->refcnt under the same spinlock, so > moving the refcnt check inside the lock closes the race. > > Fix all six affected sysfs handlers: global_flush_req_show/store, > syncr_mode_show, syncr_count_show, and port_flush_req_show/store. > > Fixes: 8e1c358a3b0e ("coresight: tpda: add global_flush_req sysfs node") > Fixes: 33f04ead7c49 ("coresight: tpda: add logic to configure TPDA_SYNCR register") > Fixes: a089d585a7f4 ("coresight: tpda: add sysfs node to flush specific port") > Signed-off-by: Jie Gan <jie.gan(a)oss.qualcomm.com> Reviewed-by: James Clark <james.clark(a)linaro.org> > --- > drivers/hwtracing/coresight/coresight-tpda.c | 18 ++++++++++++------ > 1 file changed, 12 insertions(+), 6 deletions(-) > > diff --git a/drivers/hwtracing/coresight/coresight-tpda.c b/drivers/hwtracing/coresight/coresight-tpda.c > index 89c8f71f0aff..63a979312463 100644 > --- a/drivers/hwtracing/coresight/coresight-tpda.c > +++ b/drivers/hwtracing/coresight/coresight-tpda.c > @@ -360,10 +360,10 @@ static ssize_t global_flush_req_show(struct device *dev, > struct tpda_drvdata *drvdata = dev_get_drvdata(dev->parent); > unsigned long val; > > + guard(spinlock)(&drvdata->spinlock); > if (!drvdata->csdev->refcnt) > return -EINVAL; > > - guard(spinlock)(&drvdata->spinlock); > val = readl_relaxed(drvdata->base + TPDA_CR); > /* read global_flush_req bit */ > val &= TPDA_CR_FLREQ; > @@ -382,10 +382,13 @@ static ssize_t global_flush_req_store(struct device *dev, > if (kstrtoul(buf, 0, &val)) > return -EINVAL; > > - if (!drvdata->csdev->refcnt || !val) > + if (!val) > return -EINVAL; > > guard(spinlock)(&drvdata->spinlock); > + if (!drvdata->csdev->refcnt) > + return -EINVAL; > + > val = readl_relaxed(drvdata->base + TPDA_CR); > /* set global_flush_req bit */ > val |= TPDA_CR_FLREQ; > @@ -404,10 +407,10 @@ static ssize_t syncr_mode_show(struct device *dev, > struct tpda_drvdata *drvdata = dev_get_drvdata(dev->parent); > unsigned long val, syncr_val; > > + guard(spinlock)(&drvdata->spinlock); > if (!drvdata->csdev->refcnt) > return -EINVAL; > > - guard(spinlock)(&drvdata->spinlock); > syncr_val = readl_relaxed(drvdata->base + TPDA_SYNCR); > val = FIELD_GET(TPDA_SYNCR_MODE_CTRL_MASK, syncr_val); > > @@ -440,10 +443,10 @@ static ssize_t syncr_count_show(struct device *dev, > struct tpda_drvdata *drvdata = dev_get_drvdata(dev->parent); > unsigned long val; > > + guard(spinlock)(&drvdata->spinlock); > if (!drvdata->csdev->refcnt) > return -EINVAL; > > - guard(spinlock)(&drvdata->spinlock); > val = readl_relaxed(drvdata->base + TPDA_SYNCR); > val &= TPDA_SYNCR_COUNT_MASK; > > @@ -478,10 +481,10 @@ static ssize_t port_flush_req_show(struct device *dev, > struct tpda_drvdata *drvdata = dev_get_drvdata(dev->parent); > unsigned long val; > > + guard(spinlock)(&drvdata->spinlock); > if (!drvdata->csdev->refcnt) > return -EINVAL; > > - guard(spinlock)(&drvdata->spinlock); > val = readl_relaxed(drvdata->base + TPDA_FLUSH_CR); > > return sysfs_emit(buf, "0x%lx\n", val); > @@ -498,10 +501,13 @@ static ssize_t port_flush_req_store(struct device *dev, > if (kstrtou32(buf, 0, &val)) > return -EINVAL; > > - if (!drvdata->csdev->refcnt || !val) > + if (!val) > return -EINVAL; > > guard(spinlock)(&drvdata->spinlock); > + if (!drvdata->csdev->refcnt) > + return -EINVAL; > + > CS_UNLOCK(drvdata->base); > writel_relaxed(val, drvdata->base + TPDA_FLUSH_CR); > CS_LOCK(drvdata->base); > > --- > base-commit: f3e6330d7fe42b204af05a2dbc68b379e0ad179e > change-id: 20260408-fix-race-condition-issue-d44203254b87 > > Best regards,

3 weeks, 3 days

[PATCH] coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore

by Leo Yan

It is a typo to use trcvmidcctlr0 to save and restore TRCVMIDCCTLR1. Use trcvmidcctlr1 instead. Fixes: f5bd523690d2 ("coresight: etm4x: Convert all register accesses") Signed-off-by: Leo Yan <leo.yan(a)arm.com> --- drivers/hwtracing/coresight/coresight-etm4x-core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c index d565a73f0042e3e0b21fcf9cb94009cc25834d3d..c370b6bf45ef26aff29ee71630f86eae2487069a 100644 --- a/drivers/hwtracing/coresight/coresight-etm4x-core.c +++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c @@ -1979,7 +1979,7 @@ static int __etm4_cpu_save(struct etmv4_drvdata *drvdata) state->trcvmidcctlr0 = etm4x_read32(csa, TRCVMIDCCTLR0); if (drvdata->numvmidc > 4) - state->trcvmidcctlr0 = etm4x_read32(csa, TRCVMIDCCTLR1); + state->trcvmidcctlr1 = etm4x_read32(csa, TRCVMIDCCTLR1); state->trcclaimset = etm4x_read32(csa, TRCCLAIMCLR); @@ -2102,7 +2102,7 @@ static void __etm4_cpu_restore(struct etmv4_drvdata *drvdata) etm4x_relaxed_write32(csa, state->trcvmidcctlr0, TRCVMIDCCTLR0); if (drvdata->numvmidc > 4) - etm4x_relaxed_write32(csa, state->trcvmidcctlr0, TRCVMIDCCTLR1); + etm4x_relaxed_write32(csa, state->trcvmidcctlr1, TRCVMIDCCTLR1); etm4x_relaxed_write32(csa, state->trcclaimset, TRCCLAIMSET); --- base-commit: 971f3474f8898ae8bbab19a9b547819a5e6fbcf1 change-id: 20260408-arm_cs_fix_trcvmidcctlr1_typo-3382c27d1c28 Best regards, -- Leo Yan <leo.yan(a)arm.com>

3 weeks, 3 days

Re: [PATCH 1/2] coresight: etm4x: fix inconsistencies with sysfs configration

by Leo Yan

On Tue, Mar 17, 2026 at 06:17:04PM +0000, Yeoreum Yun wrote: > The current ETM4x configuration via sysfs can lead to the following > inconsistencies: > > - If a configuration is modified via sysfs while a perf session is > active, the running configuration may differ between before > a sched-out and after a subsequent sched-in. > > - Once a perf session is enabled, some read-only register fields > (e.g., TRCSSCSR<n>) may not be reported correctly, > because drvdata->config is cleared while enabling with perf mode, > even though the information was previously read via etm4_init_arch_data(). > > To resolve these inconsistencies, the configuration should be separated into: > > - active_config, which represents the currently applied configuration > - config, which stores the settings configured via sysfs. > > Signed-off-by: Yeoreum Yun <yeoreum.yun(a)arm.com> > --- > .../hwtracing/coresight/coresight-etm4x-cfg.c | 2 +- > .../coresight/coresight-etm4x-core.c | 45 +++++++++++-------- > drivers/hwtracing/coresight/coresight-etm4x.h | 2 + > 3 files changed, 30 insertions(+), 19 deletions(-) > > diff --git a/drivers/hwtracing/coresight/coresight-etm4x-cfg.c b/drivers/hwtracing/coresight/coresight-etm4x-cfg.c > index c302072b293a..84213d40d1ae 100644 > --- a/drivers/hwtracing/coresight/coresight-etm4x-cfg.c > +++ b/drivers/hwtracing/coresight/coresight-etm4x-cfg.c > @@ -47,7 +47,7 @@ static int etm4_cfg_map_reg_offset(struct etmv4_drvdata *drvdata, > struct cscfg_regval_csdev *reg_csdev, u32 offset) > { > int err = -EINVAL, idx; > - struct etmv4_config *drvcfg = &drvdata->config; > + struct etmv4_config *drvcfg = &drvdata->active_config; I'd suggest we leave out complex cfg things, we can refactor it later. In this series, let us first separate active_config and config, and keep using drvdata->config to save complex cfg ? > u32 off_mask; > > if (((offset >= TRCEVENTCTL0R) && (offset <= TRCVIPCSSCTLR)) || > diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c > index d565a73f0042..c552129c4a0c 100644 > --- a/drivers/hwtracing/coresight/coresight-etm4x-core.c > +++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c > @@ -88,9 +88,11 @@ static int etm4_probe_cpu(unsigned int cpu); > */ > static bool etm4x_sspcicrn_present(struct etmv4_drvdata *drvdata, int n) > { > + struct etmv4_config *config = &drvdata->active_config; > + > return (n < drvdata->nr_ss_cmp) && > drvdata->nr_pe && > - (drvdata->config.ss_status[n] & TRCSSCSRn_PC); > + (config->ss_status[n] & TRCSSCSRn_PC); As Suzuki suggested in another reply, we need to extract capabilities into a separate structure. I'd also extract status related registers into a new structure: struct etm4_cap { int nr_ss_cmp; bool pe_comparator; // TRCSSCSRn.PC bool dv_comparator; // TRCSSCSRn.DV bool da_comparator; // TRCSSCSRn.DA bool inst_comparator; // TRCSSCSRn.INST int ns_ex_level; int nr_pe; int nr_pe_cmp; int nr_resource; ... } struct etm4_status_reg { u32 ss_status[ETM_MAX_SS_CMP]; u32 cntr_val[ETMv4_MAX_CNTR]; } [...] > @@ -911,14 +915,17 @@ static int etm4_enable_sysfs(struct coresight_device *csdev, struct coresight_pa > > /* enable any config activated by configfs */ > cscfg_config_sysfs_get_active_cfg(&cfg_hash, &preset); > + > + raw_spin_lock(&drvdata->spinlock); > + > + drvdata->active_config = drvdata->config; This is not an issue introduced by this patch, but we might need to consider to copy active config until it has acquired SYSFS mode. Otherwise, it might update config here but will disturb a perf session has been running. > @@ -2246,7 +2254,8 @@ static int etm4_add_coresight_dev(struct etm4_init_arg *init_arg) > if (!desc.name) > return -ENOMEM; > > - etm4_set_default(&drvdata->config); > + etm4_set_default(&drvdata->active_config); Should we set default values to drvdata->config ? My understanding is drvdata->active_config would be always set at the runtime, but "drvdata->config" should be initialized properly so it can be consumed by sysfs knobs. Thanks, Leo

3 weeks, 4 days

Re: [PATCH v2] coresight: tpdm: fix invalid MMIO access issue

by Suzuki K Poulose

On Tue, 07 Apr 2026 19:09:05 +0800, Jie Gan wrote: > Create the csdev_access struct only when a valid MMIO resource is > available. In tpdm_probe(), base is uninitialized for static TPDM > instances that lack an MMIO resource, causing csdev_access to be > created with a garbage address. > > So far there has no register access for static instance, but this > change helps mitigate potential risks in the future. > > [...] Applied, thanks! [1/1] coresight: tpdm: fix invalid MMIO access issue https://git.kernel.org/coresight/c/971f3474f889 Best regards, -- Suzuki K Poulose <suzuki.poulose(a)arm.com>

3 weeks, 4 days

Re: [PATCH] coresight: tpdm: fix invalid MMIO access issue

by Leo Yan

Hi Jie, On Tue, Apr 07, 2026 at 04:33:22PM +0800, Jie Gan wrote: > On 4/7/2026 4:10 PM, Leo Yan wrote: > > On Tue, Apr 07, 2026 at 12:47:11PM +0800, Jie Gan wrote: > > > Create the csdev_access struct only when a valid MMIO resource is > > > available. In tpdm_probe(), base is uninitialized for static TPDM > > > instances that lack an MMIO resource, causing csdev_access to be > > > created with a garbage address and potentially leading to > > > unexpected issues. > > > > This patch itself is fine for me. However, I am wandering if this > > is sufficient. > > > > As mentioned "potentially leading to unexpected issues", can I > > understand some code pieces access register with uninitialized base? > > If so, you would also explictly add coresight_is_static_tpdm() to > > prevent register access. > > > > Actually, we havent MMIO access for the static TPDM device, So no issues are > observed. The commit message here may be misleading. do I need rephrase the > commit message? Yes, good to clarify a bit in commit log: "So far there has no register access for static instance, but this change helps mitigate potential risks in the future." With this: Reviewed-by: Leo Yan <leo.yan(a)arm.com>

3 weeks, 4 days

Re: [PATCH] coresight: tpdm: fix invalid MMIO access issue

by Leo Yan

On Tue, Apr 07, 2026 at 12:47:11PM +0800, Jie Gan wrote: > Create the csdev_access struct only when a valid MMIO resource is > available. In tpdm_probe(), base is uninitialized for static TPDM > instances that lack an MMIO resource, causing csdev_access to be > created with a garbage address and potentially leading to > unexpected issues. This patch itself is fine for me. However, I am wandering if this is sufficient. As mentioned "potentially leading to unexpected issues", can I understand some code pieces access register with uninitialized base? If so, you would also explictly add coresight_is_static_tpdm() to prevent register access. Thanks, Leo > Fixes: 14ae052f7947 ("coresight: tpdm: add static tpdm support") > Signed-off-by: Jie Gan <jie.gan(a)oss.qualcomm.com> > --- > drivers/hwtracing/coresight/coresight-tpdm.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/hwtracing/coresight/coresight-tpdm.c b/drivers/hwtracing/coresight/coresight-tpdm.c > index 9b16f368a58b..eaf7210af648 100644 > --- a/drivers/hwtracing/coresight/coresight-tpdm.c > +++ b/drivers/hwtracing/coresight/coresight-tpdm.c > @@ -1430,6 +1430,7 @@ static int tpdm_probe(struct device *dev, struct resource *res) > if (ret) > return ret; > > + desc.access = CSDEV_ACCESS_IOMEM(base); > if (tpdm_has_dsb_dataset(drvdata)) > of_property_read_u32(drvdata->dev->of_node, > "qcom,dsb-msrs-num", &drvdata->dsb_msr_num); > @@ -1452,7 +1453,6 @@ static int tpdm_probe(struct device *dev, struct resource *res) > desc.ops = &tpdm_cs_ops; > desc.pdata = dev->platform_data; > desc.dev = dev; > - desc.access = CSDEV_ACCESS_IOMEM(base); > if (res) > desc.groups = tpdm_attr_grps; > else > > --- > base-commit: 816f193dd0d95246f208590924dd962b192def78 > change-id: 20260407-fix-potential-issue-in-tpdm-b07b44416051 > > Best regards, > -- > Jie Gan <jie.gan(a)oss.qualcomm.com> >

3 weeks, 4 days

← Newer
1
2
3
4
5
6
7
...
271
Older →

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

CoreSight