CoreSight

coresight@lists.linaro.org

7 participants
2807 discussions

[PATCH v7 0/8] perf cs-etm: Support thread stack and callchain

by Leo Yan

This series adds thread-stack and synthesized callchain support for Arm CoreSight, which comes from older series [1] but heavily rewritten. CS ETM previously kept last-branch state in a per-trace-queue buffer. That effectively makes the state per CPU, while the call/return history belongs to a thread. This series moves branch tracking to the common thread-stack code. The series records CoreSight branches with thread_stack__event(), uses thread_stack__br_sample() for last branch entries, flushes thread stacks after decoder resets. A decoder reset between AUX trace buffers is treated as a global trace discontinuity, so all thread stacks are flushed, so avoids carrying stale call/return history across a trace discontinuity. One limitation remains for instructions emulated by the kernel. In that case the exception return address may not match the return address stored in the thread stack, because after exception return can be one instruction ahead. The stack can still recover when a later return matches an upper caller. Given emulated instructions are not the common target for performance callchain analysis. Supporting this would require extending the common thread-stack path to accept both the real target address and an adjusted address for stack matching, so this series leaves that extra complexity out. The series has been tested on Orion6 board: perf test 136 -vvv 136: CoreSight synthesized callchain: --- start --- test child forked, pid 3539 ---- end(0) ---- 136: CoreSight synthesized callchain : Ok perf script --itrace=g16i10il64 callchain_test 17468 [005] 1031003.229943: 10 instructions: aaaac32507c4 main+0x8 (/home/kernel/leoy/test_cs_callchain/callchain_test) ffff90bd225c __libc_start_call_main+0x7c (/usr/lib/aarch64-linux-gnu/libc.so.6) ffff90bd233c call_init+0x9c (inlined) ffff90bd233c __libc_start_main_impl+0x9c (inlined) aaaac3250670 _start+0x30 (/home/kernel/leoy/test_cs_callchain/callchain_test) callchain_test 17468 [005] 1031003.229943: 10 instructions: aaaac3250774 do_svc+0xc (/home/kernel/leoy/test_cs_callchain/callchain_test) aaaac3250798 print+0xc (/home/kernel/leoy/test_cs_callchain/callchain_test) aaaac32507b0 foo+0xc (/home/kernel/leoy/test_cs_callchain/callchain_test) aaaac32507c8 main+0xc (/home/kernel/leoy/test_cs_callchain/callchain_test) ffff90bd225c __libc_start_call_main+0x7c (/usr/lib/aarch64-linux-gnu/libc.so.6) ffff90bd233c call_init+0x9c (inlined) ffff90bd233c __libc_start_main_impl+0x9c (inlined) aaaac3250670 _start+0x30 (/home/kernel/leoy/test_cs_callchain/callchain_test) callchain_test 17468 [005] 1031003.229944: 10 instructions: ffff800080010c20 vectors+0x420 ([kernel.kallsyms]) aaaac3250784 do_svc+0x1c (/home/kernel/leoy/test_cs_callchain/callchain_test) aaaac3250798 print+0xc (/home/kernel/leoy/test_cs_callchain/callchain_test) aaaac32507b0 foo+0xc (/home/kernel/leoy/test_cs_callchain/callchain_test) aaaac32507c8 main+0xc (/home/kernel/leoy/test_cs_callchain/callchain_test) ffff90bd225c __libc_start_call_main+0x7c (/usr/lib/aarch64-linux-gnu/libc.so.6) ffff90bd233c call_init+0x9c (inlined) ffff90bd233c __libc_start_main_impl+0x9c (inlined) aaaac3250670 _start+0x30 (/home/kernel/leoy/test_cs_callchain/callchain_test) Note, the test fails on Juno board which is caused by many discontinuity packets (mainly caused by NO_SYNC elem). This is likely caused by the FIFO overflow on the path. [1] https://lore.kernel.org/linux-arm-kernel/20200220052701.7754-1-leo.yan@lina… Signed-off-by: Leo Yan <leo.yan(a)arm.com> --- Changes in v7: - Rebased on the latest perf-tools-next. - Used struct_size() for allocation callchain struct (James). - Added a helper cs_etm__packet_has_taken_branch() (James). - Minor improvements for the callchain test (used record-ctl FIFO and reworked the validation callstack push / pop). - Link to v6: https://lore.kernel.org/r/20260526-b4-arm_cs_callchain_support_v1-v6-0-f9f4… Changes in v6: - Heavily rewrote the patches since restarted the work after 6 years. - Changed to use the common thread-stack for branch stack and callchain management. - Added a callchain test. - Link to v5: https://lore.kernel.org/linux-arm-kernel/20200220052701.7754-1-leo.yan@lina… Changes in v5: - Addressed Mike's suggestion for performance improvement for function cs_etm__instr_addr() for quick calculation for non T32; - Removed the patch 'perf cs-etm: Synchronize instruction sample with the thread stack' (Mike); - Fixed the issue for exception is taken for branch target address accessing, for the branch sample and stack thread handling, the related patches are 01, 02, 07; - Fixed the stack thread handling for instruction emulation and single step with patches 08, 09. - Link to v4: https://lore.kernel.org/linux-arm-kernel/20200203020716.31832-1-leo.yan@lin… Changes in v4: - Split out separate patch set for instruction samples fixing. - Rebased on latest perf/core branch. - Link to v3: https://lore.kernel.org/linux-arm-kernel/20191005091614.11635-1-leo.yan@lin… --- Leo Yan (8): perf cs-etm: Filter synthesized branch samples perf cs-etm: Decode ETE exception packets perf cs-etm: Refactor instruction size handling perf cs-etm: Use thread-stack for last branch entries perf cs-etm: Flush thread stacks after decoder reset perf cs-etm: Support call indentation perf cs-etm: Synthesize callchains for instruction samples perf test: Add Arm CoreSight callchain test tools/perf/Documentation/perf-test.txt | 6 +- tools/perf/tests/builtin-test.c | 1 + tools/perf/tests/shell/coresight/callchain.sh | 168 ++++++++++++ tools/perf/tests/tests.h | 1 + tools/perf/tests/workloads/Build | 2 + tools/perf/tests/workloads/callchain.c | 24 ++ tools/perf/util/cs-etm.c | 351 +++++++++++++++----------- 7 files changed, 410 insertions(+), 143 deletions(-) --- base-commit: 7336514f41e75d44782fee7e0990d4195a3d3161 change-id: 20260521-b4-arm_cs_callchain_support_v1-2c2a70719bcc Best regards, -- Leo Yan <leo.yan(a)arm.com>

1 month, 2 weeks

[PATCH v5 00/19] perf cs-etm: Queue context packets for frontend

by James Clark

Fix thread tracking when decoding Coresight trace and add a new test for it. The new test is added as a Perf test workload instead of a custom binary with its own build system, but this requires a new feature in Perf test to pass in control pipes which can enable and disable events. This scopes the recording to just the workload and helps to reduce the amount of data recorded in tracing tests. With this new feature we can re-write all of the Coresight tests to make use of it and remove the remaining binaries which fixes the following issues: * They didn't work in out of source builds * A lot of the tests unnecessarily required root and didn't skip without it * They were mainly qualitative tests which didn't look for specific behavior Most importantly, the long build and runtime has been reduced. On a Radxa Orion O6, unroll_loop_thread.c took 37s to compile which is longer than the entire Perf build. Now the build time is negligible and the before and after test runtimes for all the Coresight tests are: | N1SDP | Orion O6 ----------------------------------- Before | 4m 0s | 14m 49s After | 26s | 56s ----------------------------------- Signed-off-by: James Clark <james.clark(a)linaro.org> --- Changes in v5: - Forgot to include this change: - Test for actual length of expected raw dump (Leo) - Link to v4: https://lore.kernel.org/r/20260609-james-cs-context-tracking-fix-v4-0-44f9f… Changes in v4: - Rename workload-ctl to record-ctl and improve docs (Leo) - Use new packet argument everywhere in cs_etm__synth_instruction_sample() (Sashiko) - Test for actual length of expected raw dump (Leo) - Use -fno-inline instead of keyword (Leo) - Don't test any brace or call lines in deterministic test - Make sure context switch loop test does cleanup on failure (Sashiko) - Remove undef int overflows in workloads (Sashiko) - Link to v3: https://lore.kernel.org/r/20260603-james-cs-context-tracking-fix-v3-0-c3929… Changes in v3: - Minor sashiko comments - Close some more pipes - Fix warning messages - Error handling improvements - Pass packet into cs_etm__synth_instruction_sample() - Fixup stale comment (Leo) - Link to v2: https://lore.kernel.org/r/20260602-james-cs-context-tracking-fix-v2-0-85b5c… Changes in v2: - Add --workload-ctl option to Perf test - Re-write all the Coresight tests and speed them up - Pass packet to memory access function so frontend can use either the previous or current packet's EL - Link to v1: https://lore.kernel.org/r/20260526-james-cs-context-tracking-fix-v1-0-ebd60… --- James Clark (19): perf cs-etm: Queue context packets for frontend perf test: Add workload-ctl option perf test: Add a workload that forces context switches perf test cs-etm: Test process attribution perf test: Add deterministic workload perf test cs-etm: Replace unroll loop thread with deterministic decode test perf test cs-etm: Remove asm_pure_loop test perf test cs-etm: Replace memcpy test with raw dump stress test perf test: Add named_threads workload perf test cs-etm: Test decoding for concurrent threads test perf test cs-etm: Remove duplicate branch tests perf test cs-etm: Skip if not root perf test cs-etm: Reduce snapshot size perf test cs-etm: Speed up basic test perf test cs-etm: Remove unused Coresight workloads perf test cs-etm: Make disassembly test use kcore perf test cs-etm: Add all branch instructions to test perf test cs-etm: Speed up disassembly test perf test cs-etm: Move existing tests to coresight folder Documentation/trace/coresight/coresight-perf.rst | 78 +------ MAINTAINERS | 2 - tools/perf/Documentation/perf-test.txt | 24 ++- tools/perf/Makefile.perf | 14 +- tools/perf/scripts/python/arm-cs-trace-disasm.py | 20 +- tools/perf/tests/builtin-test.c | 187 +++++++++++++++- tools/perf/tests/shell/coresight/Makefile | 29 --- .../perf/tests/shell/coresight/Makefile.miniconfig | 14 -- tools/perf/tests/shell/coresight/asm_pure_loop.sh | 22 -- .../tests/shell/coresight/asm_pure_loop/.gitignore | 1 - .../tests/shell/coresight/asm_pure_loop/Makefile | 34 --- .../shell/coresight/asm_pure_loop/asm_pure_loop.S | 30 --- .../tests/shell/coresight/concurrent_threads.sh | 45 ++++ .../tests/shell/coresight/context_switch_thread.sh | 69 ++++++ tools/perf/tests/shell/coresight/deterministic.sh | 72 +++++++ .../tests/shell/coresight/memcpy_thread/.gitignore | 1 - .../tests/shell/coresight/memcpy_thread/Makefile | 33 --- .../shell/coresight/memcpy_thread/memcpy_thread.c | 80 ------- .../tests/shell/coresight/memcpy_thread_16k_10.sh | 22 -- .../perf/tests/shell/coresight/raw_dump_stress.sh | 65 ++++++ .../shell/{ => coresight}/test_arm_coresight.sh | 43 ++-- .../{ => coresight}/test_arm_coresight_disasm.sh | 23 +- .../tests/shell/coresight/thread_loop/.gitignore | 1 - .../tests/shell/coresight/thread_loop/Makefile | 33 --- .../shell/coresight/thread_loop/thread_loop.c | 85 -------- .../shell/coresight/thread_loop_check_tid_10.sh | 23 -- .../shell/coresight/thread_loop_check_tid_2.sh | 23 -- .../shell/coresight/unroll_loop_thread/.gitignore | 1 - .../shell/coresight/unroll_loop_thread/Makefile | 33 --- .../unroll_loop_thread/unroll_loop_thread.c | 75 ------- .../tests/shell/coresight/unroll_loop_thread_10.sh | 22 -- tools/perf/tests/shell/lib/coresight.sh | 134 ------------ tools/perf/tests/tests.h | 3 + tools/perf/tests/workloads/Build | 4 + tools/perf/tests/workloads/context_switch_loop.c | 110 ++++++++++ tools/perf/tests/workloads/deterministic.c | 39 ++++ tools/perf/tests/workloads/named_threads.c | 109 ++++++++++ tools/perf/util/cs-etm-decoder/cs-etm-decoder.c | 21 +- tools/perf/util/cs-etm.c | 236 ++++++++++++--------- tools/perf/util/cs-etm.h | 8 +- 40 files changed, 926 insertions(+), 942 deletions(-) --- base-commit: 351a37f2fda4db668cff8ba12f2992d73dccdaea change-id: 20260515-james-cs-context-tracking-fix-754998bae7ed Best regards, -- James Clark <james.clark(a)linaro.org>

1 month, 2 weeks

[PATCH v4 00/19] perf cs-etm: Queue context packets for frontend

by James Clark

Fix thread tracking when decoding Coresight trace and add a new test for it. The new test is added as a Perf test workload instead of a custom binary with its own build system, but this requires a new feature in Perf test to pass in control pipes which can enable and disable events. This scopes the recording to just the workload and helps to reduce the amount of data recorded in tracing tests. With this new feature we can re-write all of the Coresight tests to make use of it and remove the remaining binaries which fixes the following issues: * They didn't work in out of source builds * A lot of the tests unnecessarily required root and didn't skip without it * They were mainly qualitative tests which didn't look for specific behavior Most importantly, the long build and runtime has been reduced. On a Radxa Orion O6, unroll_loop_thread.c took 37s to compile which is longer than the entire Perf build. Now the build time is negligible and the before and after test runtimes for all the Coresight tests are: | N1SDP | Orion O6 ----------------------------------- Before | 4m 0s | 14m 49s After | 26s | 56s ----------------------------------- Signed-off-by: James Clark <james.clark(a)linaro.org> --- Changes in v4: - Rename workload-ctl to record-ctl and improve docs (Leo) - Use new packet argument everywhere in cs_etm__synth_instruction_sample() (Sashiko) - Test for actual length of expected raw dump (Leo) - Use -fno-inline instead of keyword (Leo) - Don't test any brace or call lines in deterministic test - Make sure context switch loop test does cleanup on failure (Sashiko) - Remove undef int overflows in workloads (Sashiko) - Link to v3: https://lore.kernel.org/r/20260603-james-cs-context-tracking-fix-v3-0-c3929… Changes in v3: - Minor sashiko comments - Close some more pipes - Fix warning messages - Error handling improvements - Pass packet into cs_etm__synth_instruction_sample() - Fixup stale comment (Leo) - Link to v2: https://lore.kernel.org/r/20260602-james-cs-context-tracking-fix-v2-0-85b5c… Changes in v2: - Add --workload-ctl option to Perf test - Re-write all the Coresight tests and speed them up - Pass packet to memory access function so frontend can use either the previous or current packet's EL - Link to v1: https://lore.kernel.org/r/20260526-james-cs-context-tracking-fix-v1-0-ebd60… --- James Clark (19): perf cs-etm: Queue context packets for frontend perf test: Add workload-ctl option perf test: Add a workload that forces context switches perf test cs-etm: Test process attribution perf test: Add deterministic workload perf test cs-etm: Replace unroll loop thread with deterministic decode test perf test cs-etm: Remove asm_pure_loop test perf test cs-etm: Replace memcpy test with raw dump stress test perf test: Add named_threads workload perf test cs-etm: Test decoding for concurrent threads test perf test cs-etm: Remove duplicate branch tests perf test cs-etm: Skip if not root perf test cs-etm: Reduce snapshot size perf test cs-etm: Speed up basic test perf test cs-etm: Remove unused Coresight workloads perf test cs-etm: Make disassembly test use kcore perf test cs-etm: Add all branch instructions to test perf test cs-etm: Speed up disassembly test perf test cs-etm: Move existing tests to coresight folder Documentation/trace/coresight/coresight-perf.rst | 78 +------ MAINTAINERS | 2 - tools/perf/Documentation/perf-test.txt | 24 ++- tools/perf/Makefile.perf | 14 +- tools/perf/scripts/python/arm-cs-trace-disasm.py | 20 +- tools/perf/tests/builtin-test.c | 187 +++++++++++++++- tools/perf/tests/shell/coresight/Makefile | 29 --- .../perf/tests/shell/coresight/Makefile.miniconfig | 14 -- tools/perf/tests/shell/coresight/asm_pure_loop.sh | 22 -- .../tests/shell/coresight/asm_pure_loop/.gitignore | 1 - .../tests/shell/coresight/asm_pure_loop/Makefile | 34 --- .../shell/coresight/asm_pure_loop/asm_pure_loop.S | 30 --- .../tests/shell/coresight/concurrent_threads.sh | 45 ++++ .../tests/shell/coresight/context_switch_thread.sh | 69 ++++++ tools/perf/tests/shell/coresight/deterministic.sh | 72 +++++++ .../tests/shell/coresight/memcpy_thread/.gitignore | 1 - .../tests/shell/coresight/memcpy_thread/Makefile | 33 --- .../shell/coresight/memcpy_thread/memcpy_thread.c | 80 ------- .../tests/shell/coresight/memcpy_thread_16k_10.sh | 22 -- .../perf/tests/shell/coresight/raw_dump_stress.sh | 47 ++++ .../shell/{ => coresight}/test_arm_coresight.sh | 43 ++-- .../{ => coresight}/test_arm_coresight_disasm.sh | 23 +- .../tests/shell/coresight/thread_loop/.gitignore | 1 - .../tests/shell/coresight/thread_loop/Makefile | 33 --- .../shell/coresight/thread_loop/thread_loop.c | 85 -------- .../shell/coresight/thread_loop_check_tid_10.sh | 23 -- .../shell/coresight/thread_loop_check_tid_2.sh | 23 -- .../shell/coresight/unroll_loop_thread/.gitignore | 1 - .../shell/coresight/unroll_loop_thread/Makefile | 33 --- .../unroll_loop_thread/unroll_loop_thread.c | 75 ------- .../tests/shell/coresight/unroll_loop_thread_10.sh | 22 -- tools/perf/tests/shell/lib/coresight.sh | 134 ------------ tools/perf/tests/tests.h | 3 + tools/perf/tests/workloads/Build | 4 + tools/perf/tests/workloads/context_switch_loop.c | 110 ++++++++++ tools/perf/tests/workloads/deterministic.c | 39 ++++ tools/perf/tests/workloads/named_threads.c | 109 ++++++++++ tools/perf/util/cs-etm-decoder/cs-etm-decoder.c | 21 +- tools/perf/util/cs-etm.c | 236 ++++++++++++--------- tools/perf/util/cs-etm.h | 8 +- 40 files changed, 908 insertions(+), 942 deletions(-) --- base-commit: 351a37f2fda4db668cff8ba12f2992d73dccdaea change-id: 20260515-james-cs-context-tracking-fix-754998bae7ed Best regards, -- James Clark <james.clark(a)linaro.org>

1 month, 2 weeks

Re: [PATCH v3] coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior

by Suzuki K Poulose

On 08/06/2026 17:55, Kuan-Wei Chiu wrote: > Hi Suzuki, > > On Fri, Apr 03, 2026 at 04:57:59PM +0800, Kuan-Wei Chiu wrote: >> Hi Suzuki, >> >> On Mon, Feb 02, 2026 at 09:33:59AM +0000, Suzuki K Poulose wrote: >>> Hello >>> >>> On 02/02/2026 05:09, Kuan-Wei Chiu wrote: >>>> On Tue, Dec 02, 2025 at 09:26:19AM +0000, James Clark wrote: >>>>> >>>>> >>>>> On 02/12/2025 8:26 am, Kuan-Wei Chiu wrote: >>>>>> The cntr_val_show() function was intended to print the values of all >>>>>> counters using a loop. However, due to a buffer overwrite issue with >>>>>> sprintf(), it effectively only displayed the value of the last counter. >>>>>> >>>>>> The companion function, cntr_val_store(), allows users to modify a >>>>>> specific counter selected by 'cntr_idx'. To maintain consistency >>>>>> between read and write operations and to align with the ETM4x driver >>>>>> behavior, modify cntr_val_show() to report only the value of the >>>>>> currently selected counter. >>>>>> >>>>>> This change removes the loop and the "counter %d:" prefix, printing >>>>>> only the hexadecimal value. It also adopts sysfs_emit() for standard >>>>>> sysfs output formatting. >>>>>> >>>>>> Fixes: a939fc5a71ad ("coresight-etm: add CoreSight ETM/PTM driver") >>>>>> Cc: stable(a)vger.kernel.org >>>>>> Signed-off-by: Kuan-Wei Chiu <visitorckw(a)gmail.com> >>>>>> --- >>>>>> Build test only. >>>>>> >>>>>> Changes in v3: >>>>>> - Switch format specifier to %#x to include the 0x prefix. >>>>>> - Add Cc stable >>>>>> >>>>>> v2: https://lore.kernel.org/lkml/20251201095228.1905489-1-visitorckw@gmail.com/ >>>>>> >>>>>> .../hwtracing/coresight/coresight-etm3x-sysfs.c | 15 ++++----------- >>>>>> 1 file changed, 4 insertions(+), 11 deletions(-) >>>>>> >>>>>> diff --git a/drivers/hwtracing/coresight/coresight-etm3x-sysfs.c b/drivers/hwtracing/coresight/coresight-etm3x-sysfs.c >>>>>> index 762109307b86..b3c67e96a82a 100644 >>>>>> --- a/drivers/hwtracing/coresight/coresight-etm3x-sysfs.c >>>>>> +++ b/drivers/hwtracing/coresight/coresight-etm3x-sysfs.c >>>>>> @@ -717,26 +717,19 @@ static DEVICE_ATTR_RW(cntr_rld_event); >>>>>> static ssize_t cntr_val_show(struct device *dev, >>>>>> struct device_attribute *attr, char *buf) >>>>>> { >>>>>> - int i, ret = 0; >>>>>> u32 val; >>>>>> struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent); >>>>>> struct etm_config *config = &drvdata->config; >>>>>> if (!coresight_get_mode(drvdata->csdev)) { >>>>>> spin_lock(&drvdata->spinlock); >>>>>> - for (i = 0; i < drvdata->nr_cntr; i++) >>>>>> - ret += sprintf(buf, "counter %d: %x\n", >>>>>> - i, config->cntr_val[i]); >>>>>> + val = config->cntr_val[config->cntr_idx]; >>>>>> spin_unlock(&drvdata->spinlock); >>>>>> - return ret; >>>>>> - } >>>>>> - >>>>>> - for (i = 0; i < drvdata->nr_cntr; i++) { >>>>>> - val = etm_readl(drvdata, ETMCNTVRn(i)); >>>>>> - ret += sprintf(buf, "counter %d: %x\n", i, val); >>>>>> + } else { >>>>>> + val = etm_readl(drvdata, ETMCNTVRn(config->cntr_idx)); >>>>>> } >>>>>> - return ret; >>>>>> + return sysfs_emit(buf, "%#x\n", val); >>>>>> } >>>>>> static ssize_t cntr_val_store(struct device *dev, >>>>> >>>>> Reviewed-by: James Clark <james.clark(a)linaro.org> >>>>> >>>> Thanks for the review! >>>> Is there anything else I need to do for this fix to land? >>> >>> Thanks for the patch, I will queue this for the next release (v7.1). >>> >> Just a gentle ping. >> >> Since the v7.1 merge window is presumably opening in about a week, I >> noticed this patch isn't in linux-next yet and wanted to send a quick >> reminder. Thanks. >> > This patch still applies cleanly on top of linux-next. > I suspect this patch may have fallen through the cracks. > Would you still be willing to pick it up? Apologies, it did. I will pick this up, if we have sufficient fixes, I might send it as fixes for v7.2, otherwise , queue it for v7.3 Once again, apologies. Suzuki > > Regards, > Kuan-Wei

1 month, 2 weeks

[PATCH v6 0/8] perf cs-etm: Support thread stack and callchain

by Leo Yan

This series adds thread-stack and synthesized callchain support for Arm CoreSight, which comes from older series [1] but heavily rewritten. CS ETM previously kept last-branch state in a per-trace-queue buffer. That effectively makes the state per CPU, while the call/return history belongs to a thread. This series moves branch tracking to the common thread-stack code. The series records CoreSight branches with thread_stack__event(), uses thread_stack__br_sample() for last branch entries, flushes thread stacks after decoder resets. A decoder reset between AUX trace buffers is treated as a global trace discontinuity, so all thread stacks are flushed, so avoids carrying stale call/return history across a trace discontinuity. One limitation remains for instructions emulated by the kernel. In that case the exception return address may not match the return address stored in the thread stack, because after exception return can be one instruction ahead. The stack can still recover when a later return matches an upper caller. Given emulated instructions are not the common target for performance callchain analysis. Supporting this would require extending the common thread-stack path to accept both the real target address and an adjusted address for stack matching, so this series leaves that extra complexity out. The series has been tested on Orion6 board: perf test 150 -vvv 150: Check Arm CoreSight synthesized callchain: --- start --- test child forked, pid 13528 Test callchain push: PASS Test callchain pop: PASS ---- end(0) ---- 150: Check Arm CoreSight synthesized callchain : Ok perf script --itrace=g16i10il64 callchain_test 17468 [005] 1031003.229943: 10 instructions: aaaac32507c4 main+0x8 (/home/kernel/leoy/test_cs_callchain/callchain_test) ffff90bd225c __libc_start_call_main+0x7c (/usr/lib/aarch64-linux-gnu/libc.so.6) ffff90bd233c call_init+0x9c (inlined) ffff90bd233c __libc_start_main_impl+0x9c (inlined) aaaac3250670 _start+0x30 (/home/kernel/leoy/test_cs_callchain/callchain_test) callchain_test 17468 [005] 1031003.229943: 10 instructions: aaaac3250774 do_svc+0xc (/home/kernel/leoy/test_cs_callchain/callchain_test) aaaac3250798 print+0xc (/home/kernel/leoy/test_cs_callchain/callchain_test) aaaac32507b0 foo+0xc (/home/kernel/leoy/test_cs_callchain/callchain_test) aaaac32507c8 main+0xc (/home/kernel/leoy/test_cs_callchain/callchain_test) ffff90bd225c __libc_start_call_main+0x7c (/usr/lib/aarch64-linux-gnu/libc.so.6) ffff90bd233c call_init+0x9c (inlined) ffff90bd233c __libc_start_main_impl+0x9c (inlined) aaaac3250670 _start+0x30 (/home/kernel/leoy/test_cs_callchain/callchain_test) callchain_test 17468 [005] 1031003.229944: 10 instructions: ffff800080010c20 vectors+0x420 ([kernel.kallsyms]) aaaac3250784 do_svc+0x1c (/home/kernel/leoy/test_cs_callchain/callchain_test) aaaac3250798 print+0xc (/home/kernel/leoy/test_cs_callchain/callchain_test) aaaac32507b0 foo+0xc (/home/kernel/leoy/test_cs_callchain/callchain_test) aaaac32507c8 main+0xc (/home/kernel/leoy/test_cs_callchain/callchain_test) ffff90bd225c __libc_start_call_main+0x7c (/usr/lib/aarch64-linux-gnu/libc.so.6) ffff90bd233c call_init+0x9c (inlined) ffff90bd233c __libc_start_main_impl+0x9c (inlined) aaaac3250670 _start+0x30 (/home/kernel/leoy/test_cs_callchain/callchain_test) Note, the test fails on Juno board which is caused by many discontinuity packets (mainly caused by NO_SYNC elem). This is likely caused by the FIFO overflow on the path. [1] https://lore.kernel.org/linux-arm-kernel/20200220052701.7754-1-leo.yan@lina… Signed-off-by: Leo Yan <leo.yan(a)arm.com> --- Leo Yan (8): perf cs-etm: Decode ETE exception packets perf cs-etm: Refactor instruction size handling perf cs-etm: Use thread-stack for last branch entries perf cs-etm: Flush thread stacks after decoder reset perf cs-etm: Support call indentation perf cs-etm: Filter synthesized branch samples perf cs-etm: Synthesize callchains for instruction samples perf test: Add Arm CoreSight callchain test .../tests/shell/test_arm_coresight_callchain.sh | 235 ++++++++++++++++ tools/perf/util/cs-etm.c | 309 ++++++++++++--------- 2 files changed, 408 insertions(+), 136 deletions(-) --- base-commit: bd2a5be1fe731bc7548205dd148db75f1d588da2 change-id: 20260521-b4-arm_cs_callchain_support_v1-2c2a70719bcc Best regards, -- Leo Yan <leo.yan(a)arm.com>

1 month, 2 weeks

[GIT PULL] coresight: Updates for Linux v7.2

by Suzuki K Poulose

Hi Greg Please find the updates for CoreSight self hosted tracing subsystem targeting Linux v7.2 Kindly pull, Suzuki --- The following changes since commit 7fd2df204f342fc17d1a0bfcd474b24232fb0f32: Linux 7.1-rc2 (2026-05-03 14:21:25 -0700) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/coresight/linux.git tags/coresight-next-v7.2 for you to fetch changes up to 98495b5a4d77dd22e106f462b76e1093a55b29a7: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (2026-06-04 09:56:13 +0100) ---------------------------------------------------------------- coresight: Self-hosted tracing updates for Linux v7.2 Updates for the CoreSight self hosted tracing subsystem includes: - Better power management for components based on the CPU PM, including support for components on the trace path for CPUs. Add support for save/restore for TRBE - Miscellaneous fixes to the drivers * Fix overflow when the buffer size is > 2GB for tmc-etr * Ultrasoc SMB Perf buffer OOB access Signed-off-by: Suzuki K Poulose <suzuki.poulose(a)arm.com> ---------------------------------------------------------------- James Clark (1): coresight: ete: Always save state on power down Jie Gan (3): coresight: fix missing error code when trace ID is invalid coresight: Fix source not disabled on idr_alloc_u32 failure coresight: platform: defer connection counter increment until alloc succeeds Junrui Luo (1): coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() Leo Yan (28): coresight: tmc: Fix overflow when calculating is bigger than 2GiB coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore coresight: Handle helper enable failure properly coresight: Extract device init into coresight_init_device() coresight: Populate CPU ID into coresight_device coresight: Remove .cpu_id() callback from source ops coresight: Take hotplug lock in enable_source_store() for Sysfs mode coresight: perf: Retrieve path and source from event data coresight: Take a reference on csdev coresight: Move per-CPU source pointer to core layer coresight: Take per-CPU source reference during AUX setup coresight: Register CPU PM notifier in core layer coresight: etm4x: Hook CPU PM callbacks coresight: etm4x: Remove redundant checks in PM save and restore coresight: syscfg: Use IRQ-safe spinlock to protect active variables coresight: Disable source helpers in coresight_disable_path() coresight: Control path with range coresight: Use helpers to fetch first and last nodes coresight: Introduce coresight_enable_source() helper coresight: Save active path for system tracers coresight: etm4x: Set active path on target CPU coresight: etm3x: Set active path on target CPU coresight: sysfs: Use source's path pointer for path control coresight: Control path during CPU idle coresight: Add PM callbacks for sink device coresight: sysfs: Increment refcount only for software source coresight: Move CPU hotplug callbacks to core layer coresight: sysfs: Validate CPU online status for per-CPU sources Runyu Xiao (1): coresight: etb10: restore atomic_t for shared reading state Yabin Cui (1): coresight: trbe: Save and restore state across CPU low power state Yingchao Deng (1): coresight: cti: Fix DT filter signals silently ignored drivers/hwtracing/coresight/coresight-catu.c | 2 +- drivers/hwtracing/coresight/coresight-core.c | 574 ++++++++++++++++++--- drivers/hwtracing/coresight/coresight-cti-core.c | 9 +- .../hwtracing/coresight/coresight-cti-platform.c | 1 + drivers/hwtracing/coresight/coresight-etb10.c | 6 +- drivers/hwtracing/coresight/coresight-etm-perf.c | 289 ++++++----- drivers/hwtracing/coresight/coresight-etm3x-core.c | 73 +-- drivers/hwtracing/coresight/coresight-etm4x-core.c | 216 +++----- drivers/hwtracing/coresight/coresight-platform.c | 12 +- drivers/hwtracing/coresight/coresight-priv.h | 8 +- drivers/hwtracing/coresight/coresight-syscfg.c | 38 +- drivers/hwtracing/coresight/coresight-syscfg.h | 2 + drivers/hwtracing/coresight/coresight-sysfs.c | 135 ++--- drivers/hwtracing/coresight/coresight-tmc-etr.c | 4 +- drivers/hwtracing/coresight/coresight-trbe.c | 61 ++- drivers/hwtracing/coresight/ultrasoc-smb.c | 1 + include/linux/coresight.h | 27 +- include/linux/cpuhotplug.h | 2 +- 18 files changed, 939 insertions(+), 521 deletions(-)

1 month, 2 weeks

[RFC PATCH 00/12] Add Linux RISC-V trace support via CoreSight

by Zane Leung

From: liangzhen <zhen.liang(a)spacemit.com> This series adds Linux RISC-V trace support via CoreSight, implementing RISC-V trace drivers within the CoreSight framework and integrating them with perf tools. The K3 SoC contains RISC-V Encoder, Funnel, ATB, CoreSight Funnel, and CoreSight TMC components, which can be directly leveraged through the existing CoreSight infrastructure. Linux RISC-V trace support form Anup Patel: (https://patchwork.kernel.org/project/linux-riscv/cover/20260225062448.40279…) which currently lacks ATB component support and guidance on reusing CoreSight components. The series includes: - RISC-V trace driver implementation within the CoreSight framework - RISC-V Trace Encoder, Funnel, and ATB Bridge drivers as CoreSight devices - RISC-V trace PMU record capabilities and parsing events in perf. - RISC-V Nexus Trace decoder for perf tools Any comments or suggestions are welcome. Verification on K3 SoC: To verify this patch series on K3 hardware, the following device tree are required: 1. RISC-V Trace Encoder node (8) 2. RISC-V ATB Bridge node (8) 3. RISC-V Trace Funnel node (2) 3. CoreSight Funnel configuration for RISC-V (1) 4. CoreSight TMC configuration for trace buffer (1) /{ dummy_clk: apb-pclk { compatible = "fixed-clock"; #clock-cells = <0x0>; clock-output-names = "clk14mhz"; clock-frequency = <14000000>; }; soc: soc { #address-cells = <2>; #size-cells = <2>; encoder0: encoder@d9002000 { compatible = "riscv,trace-encoder"; reg = <0x0 0xd9002000 0x0 0x1000>; cpus = <&cpu_0>; out-ports { port { cluster0_encoder0_out_port: endpoint { remote-endpoint = <&cluster0_bridge0_in_port>; }; }; }; }; bridge0: bridge@d9003000 { compatible = "riscv,trace-atbbridge"; reg = <0x0 0xd9003000 0x0 0x1000>; cpus = <&cpu_0>; out-ports { port { cluster0_bridge0_out_port: endpoint { remote-endpoint = <&cluster0_funnel_in_port0>; }; }; }; in-ports { port { cluster0_bridge0_in_port: endpoint { remote-endpoint = <&cluster0_encoder0_out_port>; }; }; }; }; ... cluster0_funnel: funnel@d9000000 { compatible = "riscv,trace-funnel"; reg = <0x0 0xd9000000 0x0 0x1000>; cpus = <&cpu_0>, <&cpu_1>, <&cpu_2>, <&cpu_3>; riscv,timestamp-present; out-ports { port { cluster0_funnel_out_port: endpoint { remote-endpoint = <&main_funnel_in_port0>; }; }; }; in-ports { #address-cells = <1>; #size-cells = <0>; port@0 { reg = <0>; cluster0_funnel_in_port0: endpoint { remote-endpoint = <&cluster0_bridge0_out_port>; }; }; port@1 { reg = <1>; cluster0_funnel_in_port1: endpoint { remote-endpoint = <&cluster0_bridge1_out_port>; }; }; port@2 { reg = <2>; cluster0_funnel_in_port2: endpoint { remote-endpoint = <&cluster0_bridge2_out_port>; }; }; port@3 { reg = <3>; cluster0_funnel_in_port3: endpoint { remote-endpoint = <&cluster0_bridge3_out_port>; }; }; }; }; cluster1_funnel: funnel@d9010000 { compatible = "riscv,trace-funnel"; reg = <0x0 0xd9010000 0x0 0x1000>; cpus = <&cpu_4>, <&cpu_5>, <&cpu_6>, <&cpu_7>; riscv,timestamp-present; out-ports { port { cluster1_funnel_out_port: endpoint { remote-endpoint = <&main_funnel_in_port1>; }; }; }; in-ports { #address-cells = <1>; #size-cells = <0>; port@0 { reg = <0>; cluster1_funnel_in_port0: endpoint { remote-endpoint = <&cluster1_bridge0_out_port>; }; }; port@1 { reg = <1>; cluster1_funnel_in_port1: endpoint { remote-endpoint = <&cluster1_bridge1_out_port>; }; }; port@2 { reg = <2>; cluster1_funnel_in_port2: endpoint { remote-endpoint = <&cluster1_bridge2_out_port>; }; }; port@3 { reg = <3>; cluster1_funnel_in_port3: endpoint { remote-endpoint = <&cluster1_bridge3_out_port>; }; }; }; }; main_funnel: funnel@d9042000 { compatible = "arm,coresight-dynamic-funnel", "arm,primecell"; reg = <0x0 0xd9042000 0x0 0x1000>; clocks = <&dummy_clk>; clock-names = "apb_pclk"; out-ports { port { main_funnel_out_port: endpoint { remote-endpoint = <&etf_in_port>; }; }; }; in-ports { #address-cells = <1>; #size-cells = <0>; port@0 { reg = <0>; main_funnel_in_port0: endpoint { remote-endpoint = <&cluster0_funnel_out_port>; }; }; port@1 { reg = <1>; main_funnel_in_port1: endpoint { remote-endpoint = <&cluster1_funnel_out_port>; }; }; }; }; etf: etf@d9043000 { compatible = "arm,coresight-tmc", "arm,primecell"; reg = <0x0 0xd9043000 0x0 0x1000>; clocks = <&dummy_clk>; clock-names = "apb_pclk"; out-ports { port { etf_out_port: endpoint { remote-endpoint = <&etr_in_port>; }; }; }; in-ports { port { etf_in_port: endpoint { remote-endpoint = <&main_funnel_out_port>; }; }; }; }; etr: etr@d9044000 { compatible = "arm,coresight-tmc", "arm,primecell"; reg = <0x0 0xd9044000 0x0 0x1000>; clocks = <&dummy_clk>; clock-names = "apb_pclk"; arm,scatter-gather; in-ports { port { etr_in_port: endpoint { remote-endpoint = <&etf_out_port>; }; }; }; }; }; }; Verification case: ~ # perf list pmu rvtrace// [Kernel PMU event] ~ # perf record -e rvtrace/@tmc_etr0/ --per-thread uname Linux [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.191 MB perf.data ] ~ # perf script uname 137 [003] 1 branches: ffffffff80931470 rvtrace_poll_bit+0x38 ([kernel.kallsyms]) => ffffffff80931492 rvtrace_poll_bit+0x5a ([kernel.kallsyms]) uname 137 [003] 1 branches: ffffffff809328a6 encoder_enable_hw+0x252 ([kernel.kallsyms]) => ffffffff809328ba encoder_enable_hw+0x266 ([kernel.kallsyms]) uname 137 [003] 1 branches: ffffffff80932c4a encoder_enable+0x82 ([kernel.kallsyms]) => ffffffff80932c36 encoder_enable+0x6e ([kernel.kallsyms]) uname 137 [003] 1 branches: ffffffff80928198 etm_event_start+0xf0 ([kernel.kallsyms]) => ffffffff809281aa etm_event_start+0x102 ([kernel.kallsyms]) uname 137 [003] 1 branches: ffffffff809281e6 etm_event_start+0x13e ([kernel.kallsyms]) => ffffffff8092755e coresight_get_sink_id+0x16 ([kernel.kallsyms]) uname 137 [003] 1 branches: ffffffff8092820e etm_event_start+0x166 ([kernel.kallsyms]) => ffffffff80928226 etm_event_start+0x17e ([kernel.kallsyms]) uname 137 [003] 1 branches: ffffffff801c3bb4 perf_report_aux_output_id+0x0 ([kernel.kallsyms]) => ffffffff801c3bd6 perf_report_aux_output_id+0x22 ([kernel.kallsyms]) uname 137 [003] 1 branches: ffffffff801c3c5a perf_report_aux_output_id+0xa6 ([kernel.kallsyms]) => ffffffff801c3bf0 perf_report_aux_output_id+0x3c ([kernel.kallsyms]) uname 137 [003] 1 branches: ffffffff801c3c40 perf_report_aux_output_id+0x8c ([kernel.kallsyms]) => ffffffff801c3aea __perf_event_header__init_id+0x2a ([kernel.kallsyms]) uname 137 [003] 1 branches: ffffffff801c3b42 __perf_event_header__init_id+0x82 ([kernel.kallsyms]) => ffffffff801c3b4a __perf_event_header__init_id+0x8a ([kernel.kallsyms]) uname 137 [003] 1 branches: ffffffff801c3bb0 __perf_event_header__init_id+0xf0 ([kernel.kallsyms]) => ffffffff801c3b58 __perf_event_header__init_id+0x98 ([kernel.kallsyms]) uname 137 [003] 1 branches: ffffffff8004c658 __task_pid_nr_ns+0x0 ([kernel.kallsyms]) => ffffffff8004c696 __task_pid_nr_ns+0x3e ([kernel.kallsyms]) uname 137 [003] 1 branches: ffffffff8004c71e __task_pid_nr_ns+0xc6 ([kernel.kallsyms]) => ffffffff8004c6a4 __task_pid_nr_ns+0x4c ([kernel.kallsyms]) uname 137 [003] 1 branches: ffffffff8004c6e4 __task_pid_nr_ns+0x8c ([kernel.kallsyms]) => ffffffff8004c6e4 __task_pid_nr_ns+0x8c ([kernel.kallsyms]) ... liangzhen (12): coresight: Add RISC-V support to CoreSight tracing coresight: Initial implementation of RISC-V trace driver coresight: Add RISC-V Trace Encoder driver coresight: Add RISC-V Trace Funnel driver coresight: Add RISC-V Trace ATB Bridge driver coresight rvtrace: Add timestamp component support for encoder and funnel coresight: Add RISC-V PMU name support perf tools: riscv: making rvtrace PMU listable perf tools: Add RISC-V trace PMU record capabilities perf tools: Add Nexus RISC-V Trace decoder perf symbols: Add RISC-V PLT entry sizes perf tools: Integrate RISC-V trace decoder into auxtrace drivers/hwtracing/Kconfig | 2 + drivers/hwtracing/coresight/Kconfig | 46 +- drivers/hwtracing/coresight/Makefile | 6 + drivers/hwtracing/coresight/coresight-core.c | 8 + .../hwtracing/coresight/coresight-etm-perf.c | 1 - .../hwtracing/coresight/coresight-etm-perf.h | 21 + .../hwtracing/coresight/coresight-platform.c | 1 - .../hwtracing/coresight/coresight-tmc-etf.c | 4 + .../hwtracing/coresight/coresight-tmc-etr.c | 4 + .../hwtracing/coresight/rvtrace-atbbridge.c | 239 +++ drivers/hwtracing/coresight/rvtrace-core.c | 135 ++ .../coresight/rvtrace-encoder-core.c | 562 +++++++ .../coresight/rvtrace-encoder-sysfs.c | 363 +++++ drivers/hwtracing/coresight/rvtrace-encoder.h | 151 ++ drivers/hwtracing/coresight/rvtrace-funnel.c | 337 ++++ drivers/hwtracing/coresight/rvtrace-funnel.h | 39 + .../hwtracing/coresight/rvtrace-timestamp.c | 278 ++++ .../hwtracing/coresight/rvtrace-timestamp.h | 64 + include/linux/coresight-pmu.h | 4 + include/linux/rvtrace.h | 116 ++ tools/arch/riscv/include/asm/insn.h | 645 ++++++++ tools/perf/arch/riscv/util/Build | 2 + tools/perf/arch/riscv/util/auxtrace.c | 490 ++++++ tools/perf/arch/riscv/util/pmu.c | 20 + tools/perf/util/Build | 3 + tools/perf/util/auxtrace.c | 4 + tools/perf/util/auxtrace.h | 1 + tools/perf/util/nexus-rv-decoder/Build | 1 + .../util/nexus-rv-decoder/nexus-rv-decoder.c | 1364 +++++++++++++++++ .../util/nexus-rv-decoder/nexus-rv-decoder.h | 139 ++ .../perf/util/nexus-rv-decoder/nexus-rv-msg.h | 190 +++ tools/perf/util/rvtrace-decoder.c | 1039 +++++++++++++ tools/perf/util/rvtrace.h | 40 + tools/perf/util/symbol-elf.c | 4 + 34 files changed, 6320 insertions(+), 3 deletions(-) create mode 100644 drivers/hwtracing/coresight/rvtrace-atbbridge.c create mode 100644 drivers/hwtracing/coresight/rvtrace-core.c create mode 100644 drivers/hwtracing/coresight/rvtrace-encoder-core.c create mode 100644 drivers/hwtracing/coresight/rvtrace-encoder-sysfs.c create mode 100644 drivers/hwtracing/coresight/rvtrace-encoder.h create mode 100644 drivers/hwtracing/coresight/rvtrace-funnel.c create mode 100644 drivers/hwtracing/coresight/rvtrace-funnel.h create mode 100644 drivers/hwtracing/coresight/rvtrace-timestamp.c create mode 100644 drivers/hwtracing/coresight/rvtrace-timestamp.h create mode 100644 include/linux/rvtrace.h create mode 100644 tools/arch/riscv/include/asm/insn.h create mode 100644 tools/perf/arch/riscv/util/auxtrace.c create mode 100644 tools/perf/arch/riscv/util/pmu.c create mode 100644 tools/perf/util/nexus-rv-decoder/Build create mode 100644 tools/perf/util/nexus-rv-decoder/nexus-rv-decoder.c create mode 100644 tools/perf/util/nexus-rv-decoder/nexus-rv-decoder.h create mode 100644 tools/perf/util/nexus-rv-decoder/nexus-rv-msg.h create mode 100644 tools/perf/util/rvtrace-decoder.c create mode 100644 tools/perf/util/rvtrace.h -- 2.34.1

1 month, 3 weeks

[PATCH v2 00/18] perf cs-etm: Queue context packets for frontend

by James Clark

Fix thread tracking when decoding Coresight trace and add a new test for it. The new test is added as a Perf test workload instead of a custom binary with its own build system, but this requires a new feature in Perf test to pass in control pipes which can enable and disable events. This scopes the recording to just the workload and helps to reduce the amount of data recorded in tracing tests. With this new feature we can re-write all of the Coresight tests to make use of it and remove the remaining binaries which fixes the following issues: * They didn't work in out of source builds * A lot of the tests unnecessarily required root and didn't skip without it * They were mainly qualitative tests which didn't look for specific behavior Most importantly, the long build and runtime has been reduced. On a Radxa Orion O6, unroll_loop_thread.c took 37s to compile which is longer than the entire Perf build. Now the build time is negligible and the before and after test runtimes for all the Coresight tests are: | N1SDP | Orion O6 ----------------------------------- Before | 4m 0s | 14m 49s After | 26s | 56s ----------------------------------- Signed-off-by: James Clark <james.clark(a)linaro.org> --- Changes in v2: - Add --workload-ctl option to Perf test - Re-write all the Coresight tests and speed them up - Pass packet to memory access function so frontend can use either the previous or current packet's EL - Link to v1: https://lore.kernel.org/r/20260526-james-cs-context-tracking-fix-v1-0-ebd60… --- James Clark (18): perf cs-etm: Queue context packets for frontend perf test: Add workload-ctl option perf test: Add a workload that forces context switches perf test cs-etm: Test process attribution perf test: Add deterministic workload perf test cs-etm: Replace unroll loop thread with deterministic decode test perf test cs-etm: Remove asm_pure_loop test perf test cs-etm: Replace memcpy test with raw dump stress test perf test: Add named_threads workload perf test cs-etm: Test decoding for concurrent threads test perf test cs-etm: Remove duplicate branch tests perf test cs-etm: Reduce snapshot size perf test cs-etm: Speed up basic test perf test cs-etm: Remove unused Coresight workloads perf test cs-etm: Make disassembly test use kcore perf test cs-etm: Add all branch instructions to test perf test cs-etm: Speed up disassembly test perf test cs-etm: Move existing tests to coresight folder Documentation/trace/coresight/coresight-perf.rst | 78 +------ MAINTAINERS | 2 - tools/perf/Documentation/perf-test.txt | 18 +- tools/perf/Makefile.perf | 14 +- tools/perf/scripts/python/arm-cs-trace-disasm.py | 20 +- tools/perf/tests/builtin-test.c | 187 ++++++++++++++++- tools/perf/tests/shell/coresight/Makefile | 29 --- .../perf/tests/shell/coresight/Makefile.miniconfig | 14 -- tools/perf/tests/shell/coresight/asm_pure_loop.sh | 22 -- .../tests/shell/coresight/asm_pure_loop/.gitignore | 1 - .../tests/shell/coresight/asm_pure_loop/Makefile | 34 --- .../shell/coresight/asm_pure_loop/asm_pure_loop.S | 30 --- .../tests/shell/coresight/concurrent_threads.sh | 45 ++++ .../tests/shell/coresight/context_switch_thread.sh | 69 ++++++ tools/perf/tests/shell/coresight/deterministic.sh | 71 +++++++ .../tests/shell/coresight/memcpy_thread/.gitignore | 1 - .../tests/shell/coresight/memcpy_thread/Makefile | 33 --- .../shell/coresight/memcpy_thread/memcpy_thread.c | 80 ------- .../tests/shell/coresight/memcpy_thread_16k_10.sh | 22 -- .../perf/tests/shell/coresight/raw_dump_stress.sh | 54 +++++ .../shell/{ => coresight}/test_arm_coresight.sh | 43 ++-- .../{ => coresight}/test_arm_coresight_disasm.sh | 17 +- .../tests/shell/coresight/thread_loop/.gitignore | 1 - .../tests/shell/coresight/thread_loop/Makefile | 33 --- .../shell/coresight/thread_loop/thread_loop.c | 85 -------- .../shell/coresight/thread_loop_check_tid_10.sh | 23 -- .../shell/coresight/thread_loop_check_tid_2.sh | 23 -- .../shell/coresight/unroll_loop_thread/.gitignore | 1 - .../shell/coresight/unroll_loop_thread/Makefile | 33 --- .../unroll_loop_thread/unroll_loop_thread.c | 75 ------- .../tests/shell/coresight/unroll_loop_thread_10.sh | 22 -- tools/perf/tests/shell/lib/coresight.sh | 134 ------------ tools/perf/tests/tests.h | 3 + tools/perf/tests/workloads/Build | 4 + tools/perf/tests/workloads/context_switch_loop.c | 95 +++++++++ tools/perf/tests/workloads/deterministic.c | 39 ++++ tools/perf/tests/workloads/named_threads.c | 109 ++++++++++ tools/perf/util/cs-etm-decoder/cs-etm-decoder.c | 21 +- tools/perf/util/cs-etm.c | 233 +++++++++++++-------- tools/perf/util/cs-etm.h | 8 +- 40 files changed, 892 insertions(+), 934 deletions(-) --- base-commit: 5f0ca6b80b12bab1ce06839cdffb6148bb650ff4 change-id: 20260515-james-cs-context-tracking-fix-754998bae7ed Best regards, -- James Clark <james.clark(a)linaro.org>

1 month, 3 weeks

Re: [PATCH v3 01/19] perf cs-etm: Queue context packets for frontend

by James Clark

On 03/06/2026 9:14 pm, Amir Ayupov wrote: > Hi James, > > I tested the v2 patch series and it looks good. Compared to my > stamping pid/tid on each packet, there was a minor difference in 2/39 > tested perf data files: the number of brstack samples differs by one, > however, there was no loss of binary profile. The resulting BOLT > profile converted from the perf script output was identical, so I'm OK > with v2 patch as-is. > > -Amir > Thanks for testing. Seems like Leo might have an explanation for the branch stack difference on the other thread. If you want to share the files I can look into it, otherwise I'm ok with ignoring it too. James > > > On Wed, Jun 3, 2026 at 3:17 AM James Clark <james.clark(a)linaro.org> wrote: >> >>> >> PE_CONTEXT elements update the context ID and exception level, but the >> decoder may still have prior packets cached for frontend processing. >> Updating the context immediately in the decoder backend can make those >> cached packets get consumed with the wrong thread or EL state. >> >> Add a CS_ETM_CONTEXT packet carrying the TID and EL to the frontend, >> this keeps context changes ordered with the rest of the packet stream >> and avoids mismatches when synthesizing samples from cached packets. >> >> Separate the memory access function into one for the frontend and one >> for decoding. The frontend also needs memory access to attach the >> instruction to samples. Because the frontend does memory access for >> both previous and current packets, change all the frontend memory access >> function signatures to take both a tidq and packet. But backend always >> uses the current backend EL and thread from the tidq. >> >> Treat context packets as a boundary for branch sample generation and >> remove tidq->prev_packet_thread because it's not possible to branch to a >> different thread, so only tracking the current thread is required for >> sample generation. >> >> Fixes: e573e978fb12 ("perf cs-etm: Inject capabilitity for CoreSight traces") >> Reported-by: Amir Ayupov <aaupov(a)meta.com> >> Closes: https://lore.kernel.org/linux-perf-users/20260515021135.1729028-1-aaupov@me… >> Co-authored-by: James Clark <james.clark(a)linaro.org> >> Signed-off-by: Leo Yan <leo.yan(a)arm.com> >> Signed-off-by: James Clark <james.clark(a)linaro.org> >> --- >> tools/perf/util/cs-etm-decoder/cs-etm-decoder.c | 21 ++- >> tools/perf/util/cs-etm.c | 234 ++++++++++++++---------- >> tools/perf/util/cs-etm.h | 8 +- >> 3 files changed, 162 insertions(+), 101 deletions(-) >> >> diff --git a/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c b/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c >> index dee3020ceaa9..26940f1f1b0b 100644 >> --- a/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c >> +++ b/tools/perf/util/cs-etm-decoder/cs-etm-decoder.c >> @@ -402,6 +402,8 @@ cs_etm_decoder__buffer_packet(struct cs_etm_queue *etmq, >> packet_queue->packet_buffer[et].flags = 0; >> packet_queue->packet_buffer[et].exception_number = UINT32_MAX; >> packet_queue->packet_buffer[et].trace_chan_id = trace_chan_id; >> + packet_queue->packet_buffer[et].el = ocsd_EL_unknown; >> + packet_queue->packet_buffer[et].tid = -1; >> >> if (packet_queue->packet_count == CS_ETM_PACKET_MAX_BUFFER - 1) >> return OCSD_RESP_WAIT; >> @@ -449,6 +451,7 @@ cs_etm_decoder__buffer_range(struct cs_etm_queue *etmq, >> packet->last_instr_type = elem->last_i_type; >> packet->last_instr_subtype = elem->last_i_subtype; >> packet->last_instr_cond = elem->last_instr_cond; >> + packet->el = elem->context.exception_level; >> >> if (elem->last_i_type == OCSD_INSTR_BR || elem->last_i_type == OCSD_INSTR_BR_INDIRECT) >> packet->last_instr_taken_branch = elem->last_instr_exec; >> @@ -525,7 +528,9 @@ cs_etm_decoder__set_tid(struct cs_etm_queue *etmq, >> const ocsd_generic_trace_elem *elem, >> const uint8_t trace_chan_id) >> { >> + struct cs_etm_packet *packet; >> pid_t tid = -1; >> + int ret; >> >> /* >> * Process the PE_CONTEXT packets if we have a valid contextID or VMID. >> @@ -546,12 +551,18 @@ cs_etm_decoder__set_tid(struct cs_etm_queue *etmq, >> break; >> } >> >> - if (cs_etm__etmq_set_tid_el(etmq, tid, trace_chan_id, >> - elem->context.exception_level)) >> + if (cs_etm__etmq_update_decode_context(etmq, trace_chan_id, >> + elem->context.exception_level, tid)) >> return OCSD_RESP_FATAL_SYS_ERR; >> >> - if (tid == -1) >> - return OCSD_RESP_CONT; >> + ret = cs_etm_decoder__buffer_packet(etmq, packet_queue, trace_chan_id, >> + CS_ETM_CONTEXT); >> + if (ret != OCSD_RESP_CONT && ret != OCSD_RESP_WAIT) >> + return ret; >> + >> + packet = &packet_queue->packet_buffer[packet_queue->tail]; >> + packet->tid = tid; >> + packet->el = elem->context.exception_level; >> >> /* >> * A timestamp is generated after a PE_CONTEXT element so make sure >> @@ -559,7 +570,7 @@ cs_etm_decoder__set_tid(struct cs_etm_queue *etmq, >> */ >> cs_etm_decoder__reset_timestamp(packet_queue); >> >> - return OCSD_RESP_CONT; >> + return ret; >> } >> >> static ocsd_datapath_resp_t cs_etm_decoder__gen_trace_elem_printer( >> diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c >> index 40c6ddfa8c8d..ce570913669c 100644 >> --- a/tools/perf/util/cs-etm.c >> +++ b/tools/perf/util/cs-etm.c >> @@ -85,15 +85,22 @@ struct cs_etm_traceid_queue { >> u64 period_instructions; >> size_t last_branch_pos; >> union perf_event *event_buf; >> - struct thread *thread; >> - struct thread *prev_packet_thread; >> - ocsd_ex_level prev_packet_el; >> - ocsd_ex_level el; >> struct branch_stack *last_branch; >> struct branch_stack *last_branch_rb; >> struct cs_etm_packet *prev_packet; >> struct cs_etm_packet *packet; >> struct cs_etm_packet_queue packet_queue; >> + >> + struct thread *decode_thread; >> + ocsd_ex_level decode_el; >> + >> + /* >> + * The frontend accesses the EL from '[prev_]packet' because it needs >> + * previous EL for branch and current EL for instruction samples. It's >> + * not possible to change thread in a single branch sample so no need to >> + * store or access the thread through the packet. >> + */ >> + struct thread *frontend_thread; >> }; >> >> enum cs_etm_format { >> @@ -614,10 +621,11 @@ static int cs_etm__init_traceid_queue(struct cs_etm_queue *etmq, >> >> queue = &etmq->etm->queues.queue_array[etmq->queue_nr]; >> tidq->trace_chan_id = trace_chan_id; >> - tidq->el = tidq->prev_packet_el = ocsd_EL_unknown; >> - tidq->thread = machine__findnew_thread(&etm->session->machines.host, -1, >> + tidq->decode_el = ocsd_EL_unknown; >> + tidq->frontend_thread = machine__findnew_thread(&etm->session->machines.host, -1, >> + queue->tid); >> + tidq->decode_thread = machine__findnew_thread(&etm->session->machines.host, -1, >> queue->tid); >> - tidq->prev_packet_thread = machine__idle_thread(&etm->session->machines.host); >> >> tidq->packet = zalloc(sizeof(struct cs_etm_packet)); >> if (!tidq->packet) >> @@ -750,21 +758,10 @@ static void cs_etm__packet_swap(struct cs_etm_auxtrace *etm, >> /* >> * Swap PACKET with PREV_PACKET: PACKET becomes PREV_PACKET for >> * the next incoming packet. >> - * >> - * Threads and exception levels are also tracked for both the >> - * previous and current packets. This is because the previous >> - * packet is used for the 'from' IP for branch samples, so the >> - * thread at that time must also be assigned to that sample. >> - * Across discontinuity packets the thread can change, so by >> - * tracking the thread for the previous packet the branch sample >> - * will have the correct info. >> */ >> tmp = tidq->packet; >> tidq->packet = tidq->prev_packet; >> tidq->prev_packet = tmp; >> - tidq->prev_packet_el = tidq->el; >> - thread__put(tidq->prev_packet_thread); >> - tidq->prev_packet_thread = thread__get(tidq->thread); >> } >> } >> >> @@ -937,8 +934,8 @@ static void cs_etm__free_traceid_queues(struct cs_etm_queue *etmq) >> >> /* Free this traceid_queue from the array */ >> tidq = etmq->traceid_queues[idx]; >> - thread__zput(tidq->thread); >> - thread__zput(tidq->prev_packet_thread); >> + thread__zput(tidq->frontend_thread); >> + thread__zput(tidq->decode_thread); >> zfree(&tidq->event_buf); >> zfree(&tidq->last_branch); >> zfree(&tidq->last_branch_rb); >> @@ -1083,47 +1080,43 @@ static u8 cs_etm__cpu_mode(struct cs_etm_queue *etmq, u64 address, >> } >> } >> >> -static u32 cs_etm__mem_access(struct cs_etm_queue *etmq, u8 trace_chan_id, >> - u64 address, size_t size, u8 *buffer, >> - const ocsd_mem_space_acc_t mem_space) >> +static u32 __cs_etm__mem_access(struct cs_etm_queue *etmq, >> + u64 address, size_t size, u8 *buffer, >> + const ocsd_mem_space_acc_t mem_space, >> + ocsd_ex_level el, struct thread *thread) >> { >> u8 cpumode; >> u64 offset; >> int len; >> struct addr_location al; >> struct dso *dso; >> - struct cs_etm_traceid_queue *tidq; >> int ret = 0; >> >> if (!etmq) >> return 0; >> >> addr_location__init(&al); >> - tidq = cs_etm__etmq_get_traceid_queue(etmq, trace_chan_id); >> - if (!tidq) >> - goto out; >> >> /* >> - * We've already tracked EL along side the PID in cs_etm__set_thread() >> - * so double check that it matches what OpenCSD thinks as well. It >> - * doesn't distinguish between EL0 and EL1 for this mem access callback >> - * so we had to do the extra tracking. Skip validation if it's any of >> - * the 'any' values. >> + * We track EL for the frontend and the backend when receiving context >> + * and range packets. OpenCSD doesn't distinguish between EL0 and EL1 >> + * for this mem access callback so we had to do the extra tracking. Skip >> + * validation if it's any of the 'any' values. >> */ >> if (!(mem_space == OCSD_MEM_SPACE_ANY || >> mem_space == OCSD_MEM_SPACE_N || mem_space == OCSD_MEM_SPACE_S)) { >> if (mem_space & OCSD_MEM_SPACE_EL1N) { >> /* Includes both non secure EL1 and EL0 */ >> - assert(tidq->el == ocsd_EL1 || tidq->el == ocsd_EL0); >> + assert(el == ocsd_EL1 || el == ocsd_EL0); >> } else if (mem_space & OCSD_MEM_SPACE_EL2) >> - assert(tidq->el == ocsd_EL2); >> + assert(el == ocsd_EL2); >> else if (mem_space & OCSD_MEM_SPACE_EL3) >> - assert(tidq->el == ocsd_EL3); >> + assert(el == ocsd_EL3); >> } >> >> - cpumode = cs_etm__cpu_mode(etmq, address, tidq->el); >> + cpumode = cs_etm__cpu_mode(etmq, address, el); >> >> - if (!thread__find_map(tidq->thread, cpumode, address, &al)) >> + if (!thread__find_map(thread, cpumode, address, &al)) >> goto out; >> >> dso = map__dso(al.map); >> @@ -1138,7 +1131,7 @@ static u32 cs_etm__mem_access(struct cs_etm_queue *etmq, u8 trace_chan_id, >> >> map__load(al.map); >> >> - len = dso__data_read_offset(dso, maps__machine(thread__maps(tidq->thread)), >> + len = dso__data_read_offset(dso, maps__machine(thread__maps(thread)), >> offset, buffer, size); >> >> if (len <= 0) { >> @@ -1158,6 +1151,30 @@ static u32 cs_etm__mem_access(struct cs_etm_queue *etmq, u8 trace_chan_id, >> return ret; >> } >> >> +static u32 cs_etm__frontend_mem_access(struct cs_etm_queue *etmq, >> + struct cs_etm_traceid_queue *tidq, >> + struct cs_etm_packet *packet, >> + u64 address, size_t size, u8 *buffer) >> +{ >> + return __cs_etm__mem_access(etmq, address, size, buffer, 0, packet->el, >> + tidq->frontend_thread); >> +} >> + >> +static u32 cs_etm__decoder_mem_access(struct cs_etm_queue *etmq, u8 trace_chan_id, >> + u64 address, size_t size, u8 *buffer, >> + const ocsd_mem_space_acc_t mem_space) >> +{ >> + struct cs_etm_traceid_queue *tidq; >> + >> + tidq = cs_etm__etmq_get_traceid_queue(etmq, trace_chan_id); >> + if (!tidq) >> + return 0; >> + >> + return __cs_etm__mem_access(etmq, address, size, buffer, >> + mem_space, tidq->decode_el, >> + tidq->decode_thread); >> +} >> + >> static struct cs_etm_queue *cs_etm__alloc_queue(void) >> { >> struct cs_etm_queue *etmq = zalloc(sizeof(*etmq)); >> @@ -1333,12 +1350,13 @@ void cs_etm__reset_last_branch_rb(struct cs_etm_traceid_queue *tidq) >> } >> >> static inline int cs_etm__t32_instr_size(struct cs_etm_queue *etmq, >> - u8 trace_chan_id, u64 addr) >> + struct cs_etm_traceid_queue *tidq, >> + struct cs_etm_packet *packet, u64 addr) >> { >> u8 instrBytes[2]; >> >> - cs_etm__mem_access(etmq, trace_chan_id, addr, ARRAY_SIZE(instrBytes), >> - instrBytes, 0); >> + cs_etm__frontend_mem_access(etmq, tidq, packet, addr, >> + ARRAY_SIZE(instrBytes), instrBytes); >> /* >> * T32 instruction size is indicated by bits[15:11] of the first >> * 16-bit word of the instruction: 0b11101, 0b11110 and 0b11111 >> @@ -1371,16 +1389,16 @@ u64 cs_etm__last_executed_instr(const struct cs_etm_packet *packet) >> } >> >> static inline u64 cs_etm__instr_addr(struct cs_etm_queue *etmq, >> - u64 trace_chan_id, >> - const struct cs_etm_packet *packet, >> + struct cs_etm_traceid_queue *tidq, >> + struct cs_etm_packet *packet, >> u64 offset) >> { >> if (packet->isa == CS_ETM_ISA_T32) { >> u64 addr = packet->start_addr; >> >> while (offset) { >> - addr += cs_etm__t32_instr_size(etmq, >> - trace_chan_id, addr); >> + addr += cs_etm__t32_instr_size(etmq, tidq, packet, >> + addr); >> offset--; >> } >> return addr; >> @@ -1490,34 +1508,51 @@ cs_etm__get_trace(struct cs_etm_queue *etmq) >> return etmq->buf_len; >> } >> >> -static void cs_etm__set_thread(struct cs_etm_queue *etmq, >> - struct cs_etm_traceid_queue *tidq, pid_t tid, >> - ocsd_ex_level el) >> +/* >> + * Convert a raw thread number to a thread struct and assign it to **thread. >> + */ >> +static int cs_etm__etmq_update_thread(struct cs_etm_queue *etmq, >> + ocsd_ex_level el, pid_t tid, >> + struct thread **thread) >> { >> struct machine *machine = cs_etm__get_machine(etmq, el); >> >> + if (!machine || !*thread) >> + return -EINVAL; >> + >> if (tid != -1) { >> - thread__zput(tidq->thread); >> - tidq->thread = machine__find_thread(machine, -1, tid); >> + thread__zput(*thread); >> + *thread = machine__find_thread(machine, -1, tid); >> } >> >> /* Couldn't find a known thread */ >> - if (!tidq->thread) >> - tidq->thread = machine__idle_thread(machine); >> + if (!*thread) >> + *thread = machine__idle_thread(machine); >> >> - tidq->el = el; >> + return 0; >> } >> >> -int cs_etm__etmq_set_tid_el(struct cs_etm_queue *etmq, pid_t tid, >> - u8 trace_chan_id, ocsd_ex_level el) >> +/* >> + * Set the thread and EL of the decode context which is ahead in time of the >> + * frontend context. >> + */ >> +int cs_etm__etmq_update_decode_context(struct cs_etm_queue *etmq, >> + u8 trace_chan_id, >> + ocsd_ex_level el, pid_t tid) >> { >> struct cs_etm_traceid_queue *tidq; >> + int ret; >> >> tidq = cs_etm__etmq_get_traceid_queue(etmq, trace_chan_id); >> if (!tidq) >> return -EINVAL; >> >> - cs_etm__set_thread(etmq, tidq, tid, el); >> + ret = cs_etm__etmq_update_thread(etmq, el, tid, >> + &tidq->decode_thread); >> + if (ret) >> + return ret; >> + >> + tidq->decode_el = el; >> return 0; >> } >> >> @@ -1527,8 +1562,8 @@ bool cs_etm__etmq_is_timeless(struct cs_etm_queue *etmq) >> } >> >> static void cs_etm__copy_insn(struct cs_etm_queue *etmq, >> - u64 trace_chan_id, >> - const struct cs_etm_packet *packet, >> + struct cs_etm_traceid_queue *tidq, >> + struct cs_etm_packet *packet, >> struct perf_sample *sample) >> { >> /* >> @@ -1545,14 +1580,14 @@ static void cs_etm__copy_insn(struct cs_etm_queue *etmq, >> * cs_etm__t32_instr_size(). >> */ >> if (packet->isa == CS_ETM_ISA_T32) >> - sample->insn_len = cs_etm__t32_instr_size(etmq, trace_chan_id, >> + sample->insn_len = cs_etm__t32_instr_size(etmq, tidq, packet, >> sample->ip); >> /* Otherwise, A64 and A32 instruction size are always 32-bit. */ >> else >> sample->insn_len = 4; >> >> - cs_etm__mem_access(etmq, trace_chan_id, sample->ip, sample->insn_len, >> - (void *)sample->insn, 0); >> + cs_etm__frontend_mem_access(etmq, tidq, packet, sample->ip, >> + sample->insn_len, (void *)sample->insn); >> } >> >> u64 cs_etm__convert_sample_time(struct cs_etm_queue *etmq, u64 cs_timestamp) >> @@ -1579,6 +1614,7 @@ static inline u64 cs_etm__resolve_sample_time(struct cs_etm_queue *etmq, >> >> static int cs_etm__synth_instruction_sample(struct cs_etm_queue *etmq, >> struct cs_etm_traceid_queue *tidq, >> + struct cs_etm_packet *packet, >> u64 addr, u64 period) >> { >> int ret = 0; >> @@ -1588,15 +1624,15 @@ static int cs_etm__synth_instruction_sample(struct cs_etm_queue *etmq, >> >> perf_sample__init(&sample, /*all=*/true); >> event->sample.header.type = PERF_RECORD_SAMPLE; >> - event->sample.header.misc = cs_etm__cpu_mode(etmq, addr, tidq->el); >> + event->sample.header.misc = cs_etm__cpu_mode(etmq, addr, packet->el); >> event->sample.header.size = sizeof(struct perf_event_header); >> >> /* Set time field based on etm auxtrace config. */ >> sample.time = cs_etm__resolve_sample_time(etmq, tidq); >> >> sample.ip = addr; >> - sample.pid = thread__pid(tidq->thread); >> - sample.tid = thread__tid(tidq->thread); >> + sample.pid = thread__pid(tidq->frontend_thread); >> + sample.tid = thread__tid(tidq->frontend_thread); >> sample.id = etmq->etm->instructions_id; >> sample.stream_id = etmq->etm->instructions_id; >> sample.period = period; >> @@ -1604,7 +1640,7 @@ static int cs_etm__synth_instruction_sample(struct cs_etm_queue *etmq, >> sample.flags = tidq->prev_packet->flags; >> sample.cpumode = event->sample.header.misc; >> >> - cs_etm__copy_insn(etmq, tidq->trace_chan_id, tidq->packet, &sample); >> + cs_etm__copy_insn(etmq, tidq, tidq->packet, &sample); >> >> if (etm->synth_opts.last_branch) >> sample.branch_stack = tidq->last_branch; >> @@ -1649,15 +1685,15 @@ static int cs_etm__synth_branch_sample(struct cs_etm_queue *etmq, >> >> event->sample.header.type = PERF_RECORD_SAMPLE; >> event->sample.header.misc = cs_etm__cpu_mode(etmq, ip, >> - tidq->prev_packet_el); >> + tidq->prev_packet->el); >> event->sample.header.size = sizeof(struct perf_event_header); >> >> /* Set time field based on etm auxtrace config. */ >> sample.time = cs_etm__resolve_sample_time(etmq, tidq); >> >> sample.ip = ip; >> - sample.pid = thread__pid(tidq->prev_packet_thread); >> - sample.tid = thread__tid(tidq->prev_packet_thread); >> + sample.pid = thread__pid(tidq->frontend_thread); >> + sample.tid = thread__tid(tidq->frontend_thread); >> sample.addr = cs_etm__first_executed_instr(tidq->packet); >> sample.id = etmq->etm->branches_id; >> sample.stream_id = etmq->etm->branches_id; >> @@ -1666,8 +1702,7 @@ static int cs_etm__synth_branch_sample(struct cs_etm_queue *etmq, >> sample.flags = tidq->prev_packet->flags; >> sample.cpumode = event->sample.header.misc; >> >> - cs_etm__copy_insn(etmq, tidq->trace_chan_id, tidq->prev_packet, >> - &sample); >> + cs_etm__copy_insn(etmq, tidq, tidq->prev_packet, &sample); >> >> /* >> * perf report cannot handle events without a branch stack >> @@ -1788,7 +1823,6 @@ static int cs_etm__sample(struct cs_etm_queue *etmq, >> { >> struct cs_etm_auxtrace *etm = etmq->etm; >> int ret; >> - u8 trace_chan_id = tidq->trace_chan_id; >> u64 instrs_prev; >> >> /* Get instructions remainder from previous packet */ >> @@ -1874,10 +1908,10 @@ static int cs_etm__sample(struct cs_etm_queue *etmq, >> * been executed, but PC has not advanced to next >> * instruction) >> */ >> - addr = cs_etm__instr_addr(etmq, trace_chan_id, >> - tidq->packet, offset - 1); >> + addr = cs_etm__instr_addr(etmq, tidq, tidq->packet, >> + offset - 1); >> ret = cs_etm__synth_instruction_sample( >> - etmq, tidq, addr, >> + etmq, tidq, tidq->packet, addr, >> etm->instructions_sample_period); >> if (ret) >> return ret; >> @@ -1959,7 +1993,7 @@ static int cs_etm__flush(struct cs_etm_queue *etmq, >> addr = cs_etm__last_executed_instr(tidq->prev_packet); >> >> err = cs_etm__synth_instruction_sample( >> - etmq, tidq, addr, >> + etmq, tidq, tidq->prev_packet, addr, >> tidq->period_instructions); >> if (err) >> return err; >> @@ -2014,7 +2048,7 @@ static int cs_etm__end_block(struct cs_etm_queue *etmq, >> addr = cs_etm__last_executed_instr(tidq->prev_packet); >> >> err = cs_etm__synth_instruction_sample( >> - etmq, tidq, addr, >> + etmq, tidq, tidq->prev_packet, addr, >> tidq->period_instructions); >> if (err) >> return err; >> @@ -2051,9 +2085,9 @@ static int cs_etm__get_data_block(struct cs_etm_queue *etmq) >> return etmq->buf_len; >> } >> >> -static bool cs_etm__is_svc_instr(struct cs_etm_queue *etmq, u8 trace_chan_id, >> - struct cs_etm_packet *packet, >> - u64 end_addr) >> +static bool cs_etm__is_svc_instr(struct cs_etm_queue *etmq, >> + struct cs_etm_traceid_queue *tidq, >> + struct cs_etm_packet *packet, u64 end_addr) >> { >> /* Initialise to keep compiler happy */ >> u16 instr16 = 0; >> @@ -2075,8 +2109,8 @@ static bool cs_etm__is_svc_instr(struct cs_etm_queue *etmq, u8 trace_chan_id, >> * so below only read 2 bytes as instruction size for T32. >> */ >> addr = end_addr - 2; >> - cs_etm__mem_access(etmq, trace_chan_id, addr, sizeof(instr16), >> - (u8 *)&instr16, 0); >> + cs_etm__frontend_mem_access(etmq, tidq, packet, addr, >> + sizeof(instr16), (u8 *)&instr16); >> if ((instr16 & 0xFF00) == 0xDF00) >> return true; >> >> @@ -2091,8 +2125,8 @@ static bool cs_etm__is_svc_instr(struct cs_etm_queue *etmq, u8 trace_chan_id, >> * +---------+---------+-------------------------+ >> */ >> addr = end_addr - 4; >> - cs_etm__mem_access(etmq, trace_chan_id, addr, sizeof(instr32), >> - (u8 *)&instr32, 0); >> + cs_etm__frontend_mem_access(etmq, tidq, packet, addr, >> + sizeof(instr32), (u8 *)&instr32); >> if ((instr32 & 0x0F000000) == 0x0F000000 && >> (instr32 & 0xF0000000) != 0xF0000000) >> return true; >> @@ -2108,8 +2142,8 @@ static bool cs_etm__is_svc_instr(struct cs_etm_queue *etmq, u8 trace_chan_id, >> * +-----------------------+---------+-----------+ >> */ >> addr = end_addr - 4; >> - cs_etm__mem_access(etmq, trace_chan_id, addr, sizeof(instr32), >> - (u8 *)&instr32, 0); >> + cs_etm__frontend_mem_access(etmq, tidq, packet, addr, >> + sizeof(instr32), (u8 *)&instr32); >> if ((instr32 & 0xFFE0001F) == 0xd4000001) >> return true; >> >> @@ -2125,7 +2159,6 @@ static bool cs_etm__is_svc_instr(struct cs_etm_queue *etmq, u8 trace_chan_id, >> static bool cs_etm__is_syscall(struct cs_etm_queue *etmq, >> struct cs_etm_traceid_queue *tidq, u64 magic) >> { >> - u8 trace_chan_id = tidq->trace_chan_id; >> struct cs_etm_packet *packet = tidq->packet; >> struct cs_etm_packet *prev_packet = tidq->prev_packet; >> >> @@ -2140,7 +2173,7 @@ static bool cs_etm__is_syscall(struct cs_etm_queue *etmq, >> */ >> if (magic == __perf_cs_etmv4_magic) { >> if (packet->exception_number == CS_ETMV4_EXC_CALL && >> - cs_etm__is_svc_instr(etmq, trace_chan_id, prev_packet, >> + cs_etm__is_svc_instr(etmq, tidq, prev_packet, >> prev_packet->end_addr)) >> return true; >> } >> @@ -2178,7 +2211,6 @@ static bool cs_etm__is_sync_exception(struct cs_etm_queue *etmq, >> struct cs_etm_traceid_queue *tidq, >> u64 magic) >> { >> - u8 trace_chan_id = tidq->trace_chan_id; >> struct cs_etm_packet *packet = tidq->packet; >> struct cs_etm_packet *prev_packet = tidq->prev_packet; >> >> @@ -2204,7 +2236,7 @@ static bool cs_etm__is_sync_exception(struct cs_etm_queue *etmq, >> * (SMC, HVC) are taken as sync exceptions. >> */ >> if (packet->exception_number == CS_ETMV4_EXC_CALL && >> - !cs_etm__is_svc_instr(etmq, trace_chan_id, prev_packet, >> + !cs_etm__is_svc_instr(etmq, tidq, prev_packet, >> prev_packet->end_addr)) >> return true; >> >> @@ -2228,7 +2260,6 @@ static int cs_etm__set_sample_flags(struct cs_etm_queue *etmq, >> { >> struct cs_etm_packet *packet = tidq->packet; >> struct cs_etm_packet *prev_packet = tidq->prev_packet; >> - u8 trace_chan_id = tidq->trace_chan_id; >> u64 magic; >> int ret; >> >> @@ -2309,11 +2340,11 @@ static int cs_etm__set_sample_flags(struct cs_etm_queue *etmq, >> if (prev_packet->flags == (PERF_IP_FLAG_BRANCH | >> PERF_IP_FLAG_RETURN | >> PERF_IP_FLAG_INTERRUPT) && >> - cs_etm__is_svc_instr(etmq, trace_chan_id, >> - packet, packet->start_addr)) >> + cs_etm__is_svc_instr(etmq, tidq, packet, packet->start_addr)) { >> prev_packet->flags = PERF_IP_FLAG_BRANCH | >> PERF_IP_FLAG_RETURN | >> PERF_IP_FLAG_SYSCALLRET; >> + } >> break; >> case CS_ETM_DISCONTINUITY: >> /* >> @@ -2394,6 +2425,7 @@ static int cs_etm__set_sample_flags(struct cs_etm_queue *etmq, >> PERF_IP_FLAG_RETURN | >> PERF_IP_FLAG_INTERRUPT; >> break; >> + case CS_ETM_CONTEXT: >> case CS_ETM_EMPTY: >> default: >> break; >> @@ -2469,6 +2501,19 @@ static int cs_etm__process_traceid_queue(struct cs_etm_queue *etmq, >> */ >> cs_etm__sample(etmq, tidq); >> break; >> + case CS_ETM_CONTEXT: >> + /* >> + * Update context but don't swap packet. Keep the >> + * previous one for branch source address info, if >> + * tracing the kernel the context packet will be emitted >> + * between two ranges. >> + */ >> + ret = cs_etm__etmq_update_thread(etmq, tidq->packet->el, >> + tidq->packet->tid, >> + &tidq->frontend_thread); >> + if (ret) >> + goto out; >> + break; >> case CS_ETM_EXCEPTION: >> case CS_ETM_EXCEPTION_RET: >> /* >> @@ -2497,6 +2542,7 @@ static int cs_etm__process_traceid_queue(struct cs_etm_queue *etmq, >> } >> } >> >> +out: >> return ret; >> } >> >> @@ -2620,7 +2666,7 @@ static int cs_etm__process_timeless_queues(struct cs_etm_auxtrace *etm, >> if (!tidq) >> continue; >> >> - if (tid == -1 || thread__tid(tidq->thread) == tid) >> + if (tid == -1 || thread__tid(tidq->frontend_thread) == tid) >> cs_etm__run_per_thread_timeless_decoder(etmq); >> } else >> cs_etm__run_per_cpu_timeless_decoder(etmq); >> @@ -3328,7 +3374,7 @@ static int cs_etm__create_queue_decoders(struct cs_etm_queue *etmq) >> */ >> if (cs_etm_decoder__add_mem_access_cb(etmq->decoder, >> 0x0L, ((u64) -1L), >> - cs_etm__mem_access)) >> + cs_etm__decoder_mem_access)) >> goto out_free_decoder; >> >> zfree(&t_params); >> diff --git a/tools/perf/util/cs-etm.h b/tools/perf/util/cs-etm.h >> index aa9bb4a32eca..b81099c2b301 100644 >> --- a/tools/perf/util/cs-etm.h >> +++ b/tools/perf/util/cs-etm.h >> @@ -158,6 +158,7 @@ enum cs_etm_sample_type { >> CS_ETM_DISCONTINUITY, >> CS_ETM_EXCEPTION, >> CS_ETM_EXCEPTION_RET, >> + CS_ETM_CONTEXT, >> }; >> >> enum cs_etm_isa { >> @@ -184,6 +185,8 @@ struct cs_etm_packet { >> u8 last_instr_size; >> u8 trace_chan_id; >> int cpu; >> + int el; >> + pid_t tid; >> }; >> >> #define CS_ETM_PACKET_MAX_BUFFER 1024 >> @@ -259,8 +262,9 @@ enum cs_etm_pid_fmt { >> #include <opencsd/ocsd_if_types.h> >> int cs_etm__get_cpu(struct cs_etm_queue *etmq, u8 trace_chan_id, int *cpu); >> enum cs_etm_pid_fmt cs_etm__get_pid_fmt(struct cs_etm_queue *etmq); >> -int cs_etm__etmq_set_tid_el(struct cs_etm_queue *etmq, pid_t tid, >> - u8 trace_chan_id, ocsd_ex_level el); >> +int cs_etm__etmq_update_decode_context(struct cs_etm_queue *etmq, >> + u8 trace_chan_id, ocsd_ex_level el, >> + pid_t tid); >> bool cs_etm__etmq_is_timeless(struct cs_etm_queue *etmq); >> void cs_etm__etmq_set_traceid_queue_timestamp(struct cs_etm_queue *etmq, >> u8 trace_chan_id); >> >> -- >> 2.34.1 >>

1 month, 3 weeks

Re: [PATCH] coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()

by Suzuki K Poulose

On Thu, 04 Jun 2026 15:34:25 +0800, Junrui Luo wrote: > When the SMB sink is used as a perf AUX sink, smb_update_buffer() calls > smb_sync_perf_buffer() to copy hardware trace data into the perf AUX ring > buffer pages. It derives pg_idx = head >> PAGE_SHIFT from @head, which is > handle->head, and indexes dst_pages[pg_idx]. The pg_idx %= nr_pages > normalization is only applied after the first loop iteration. > > This leaves the initial page index underived from the buffer size, which > can result in an out-of-bounds write past dst_pages[] when head exceeds > the AUX buffer size. > > [...] Applied, thanks! [1/1] coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() https://git.kernel.org/coresight/c/98495b5a4d77 Best regards, -- Suzuki K Poulose <suzuki.poulose(a)arm.com>

1 month, 3 weeks

← Newer
1
2
3
4
5
6
7
8
...
281
Older →

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

CoreSight