On Wed, Sep 16, 2026 at 11:04:20AM +0800, Jie Gan wrote:
[...]
> > From: Min Chen <min.chen(a)siengine.com>
> >
> > The flat ETR buffer comes from dma_alloc_noncoherent(), which zeroes it
> > with CPU stores. The DMA API requires the caller to sync the buffer for
> > the device before the device writes into it, but the TMC driver only
> > ever syncs for the CPU afterwards. On a non-coherent sink the zero fill
> > is therefore still dirty in cache when the ETR starts writing, and its
> > write-back lands on top of the trace data.
Good catch! I'm curious how you observed the dirty cache lines
overwriting trace data in DDR and causing corruption.
> Agree, without the sync, the dirty data may overwrites the trace data.
> > Add a sync_for_device() buffer operation and call it from
> > __tmc_etr_enable_hw() just before the TMC is enabled.
I don't think __tmc_etr_enable_hw() is the best place for the sync, as
it can be called frequently when an event is enabled, e.g. when a task
is scheduled in or migrated between CPUs. We should be able to sync
once after dma_alloc_noncoherent() instead.
The issue is not limited to buffer init. The driver also injects barrier
packets into the bounce buffer, which can race with the sink. Even
worse, the barrier packet write may collide with trace data when they
share a cache line.
I think we should consider writing barrier packets directly into the
AUX buffer. This would avoid stale cache data from barrier packet writes
and simplify the flow without additional sync operations.
Would you mind if I pick up this patch (keeping you as the author) and
add a second patch to address the barrier packet issue? That part may
need some several rounds refactoring so can have better shape, I think
it would be easier to consolidate the fixes on my side.
Thanks,
Leo
P.s. Please CC me on future CoreSight patches. If you're using the
mainline ./scripts/get_maintainer.pl, it should add me automatically.
I didn't receive this patch directly, which is why I'm replying to
Jie's email (also thanks Jie's review).
Fix a few issues with per-thread mode:
- With TRBE, thread migrations hit a queue without a decoder assert
- On nVHE, everything looks like guest trace instead of host
- Tracing multiple threads didn't really work
After adding a tests for those, it turns out there were some snapshot
bugs not picked up by the other snapshot tests. That showed that the
different snapshot searches for Intel BTS and Arm SPE were inconsistent
and I think all tracers can benefit from using the same pointer fixup
logic, so that gets refactored into the common auxtrace.c. Then SPE can
just share the Intel BTS search as it was obviously copied from it
originally. IntelPT keeps the more advanced duplicate data search, but
in the future that could probably be made the common one and all tracers
would benefit from using it (except maybe BTS if it always has a very
small buffer, but I doubt the overhead of the duplicate search would be
an issue). For now this is more of a refactor rather than behavioral
change so don't do that yet.
Signed-off-by: James Clark <james.clark(a)linaro.org>
---
James Clark (14):
perf cs-etm: Fix nVHE per-thread decoding
perf cs-etm: Warn for invalid timestamp option
perf cs-etm: Turn on context packet timestamps in per-thread mode
perf cs-etm: Use per-CPU queues for per-thread mode
perf cs-etm: Increase default timestamp generation period
perf auxtrace: Turn Intel BTS snapshot search into a generic one
perf arm-spe: Use generic snapshot search
perf auxtrace: intel-pt: Use new snapshot_has_wrapped callback
perf cs-etm: Queue partial AUX records
perf cs-etm: Don't print missing buffers in snapshot mode
perf auxtrace: cs-etm: Capture wrapped snapshots
perf test: Allow infinite named_thread loops
perf test: Add test for per-thread mode
perf cs-etm: Test multiple per-thread threads
Documentation/userspace-api/perf_ring_buffer.rst | 6 +-
tools/perf/Documentation/perf-test.txt | 2 +-
tools/perf/arch/arm/util/cs-etm.c | 30 ++++-
tools/perf/arch/arm64/util/arm-spe.c | 147 +--------------------
tools/perf/arch/x86/util/intel-bts.c | 115 +---------------
tools/perf/arch/x86/util/intel-pt.c | 58 +++-----
.../perf/tests/shell/coresight/per-thread-multi.sh | 78 +++++++++++
tools/perf/tests/shell/coresight/per-thread.sh | 48 +++++++
.../perf/tests/shell/coresight/raw_dump_stress.sh | 5 -
tools/perf/tests/workloads/named_threads.c | 7 +-
tools/perf/util/auxtrace.c | 136 +++++++++++++++++--
tools/perf/util/auxtrace.h | 20 ++-
tools/perf/util/cs-etm.c | 98 ++++++++++----
13 files changed, 382 insertions(+), 368 deletions(-)
---
base-commit: bf10e6ee2ac3034c9068e03eed418fd16961984e
change-id: 20260605-james-cs-unformatted-per-thread-fix-50e723aa7f0e
Best regards,
--
James Clark <james.clark(a)linaro.org>
All CoreSight compliant components have an implementation defined number
of 0 to 8 claim tag bits in the claim tag registers.
These are used to claim the CoreSight resources by system agents.
ARM recommends implementions have 4 claim tag bits, though a valid
implementation can have 0 claim tags bits.
The CoreSight drivers implement a 2 claim tag bit protocol to allow
self hosted and external debug agents to manage access to the hardware.
However, if there are less than 2 claim tags available the protocol
incorrectly returns an error on device claim, as no checks are made.
If insufficient claim tags are present in a component then the protocol
must return success on claim / disclaim to allow components to be used
normally.
Add initialisation to read the CLAIMSET bits to establish the number of
available claim tag bits, and adjust the claim returns accordingly.
Cache the claimtag protocol availablity in the coresight_device to reduce
reads for the main claim/disclaim api.
changes since v3:
1) removed unneeded bool casts (Leo)
2) rebased to kernel 7.2 on coresight/next
changes since v2:
1) consolidated API to remove the API calls using just cs_access, which were
used purely to clear down stale self claim tags, replace with a normal
coresight_device API for initialisation, to match the claim/disclaim API.
This does both the check on availability and the stale tag clearance.
Updated all drivers to use the new init functionality
2) Added option for drivers to skip claim tag checking completely for devices
with no-compliant hardware, that do not implement registers at the claim tag
location, or do not operate correctly to indicate the correct number of
claim tags for the device.
changes since v1:
1) Added claim tag availability cache into coresight_device when using the
main coresight_claim_device() / coresight_disclaim_device() API.
Applies to coresight/next
Mike Leach (1):
coresight: fix issue where coresight component has no claimtags
drivers/hwtracing/coresight/coresight-catu.c | 6 +-
drivers/hwtracing/coresight/coresight-core.c | 139 ++++++++++++++++--
.../hwtracing/coresight/coresight-cti-core.c | 7 +-
drivers/hwtracing/coresight/coresight-etb10.c | 9 +-
.../coresight/coresight-etm3x-core.c | 8 +-
.../coresight/coresight-etm4x-core.c | 8 +-
.../hwtracing/coresight/coresight-funnel.c | 7 +-
drivers/hwtracing/coresight/coresight-priv.h | 7 +
.../coresight/coresight-replicator.c | 9 +-
.../hwtracing/coresight/coresight-tmc-core.c | 7 +-
include/linux/coresight.h | 23 ++-
11 files changed, 205 insertions(+), 25 deletions(-)
--
2.43.0
Hi Jie,
Thanks for fixing! It is shame that my single patch caused issues both
in driver's probe and remove - I have to admit that I don't understand
runtime PM's state machine.
TBC, this patch only fixes probe. The driver's remove is fixed in:
https://lore.kernel.org/linux-arm-kernel/20260710-fix-clock-refcount-unbala…
The series above and this patch should be picked up together so can
have complete fix.
> The probe wrapper then unconditionally calls pm_runtime_put()
> regardless of whether the inner probe succeeded, so on failure this
> also fires runtime_suspend() and disables the same clocks a first
> time.
pm_runtime_put() can be used for success case, but for the failure
case, we should disable the runtime PM but not release reference:
https://docs.kernel.org/power/runtime_pm.html#runtime-pm-initialization-dev…
> @@ -632,11 +632,14 @@ static int catu_platform_probe(struct platform_device *pdev)
> pm_runtime_enable(&pdev->dev);
>
> ret = __catu_probe(&pdev->dev, res);
> - pm_runtime_put(&pdev->dev);
> - if (ret)
> + if (ret) {
> + pm_runtime_put_noidle(&pdev->dev);
> pm_runtime_disable(&pdev->dev);
Nitpick: please reverse the sequence between pm_runtime_put_noidle()
and pm_runtime_disable(). As we need to first disable runtime PM for
the device, then release usage reference.
Since the driver core will reset device's active state, AI told me that
calling pm_runtime_set_suspended() is redundant. It is still good to
explicitly call it for bookkeeping. This can be aligned with the change
in driver remove.
Thus, please update the flow:
pm_runtime_disable(&pdev->dev);
pm_runtime_set_suspended(dev);
pm_runtime_put_noidle(&pdev->dev);
With the update:
Reviewed-by: Leo Yan <leo.yan(a)arm.com>
On Tue, Aug 25, 2026 at 10:06:47AM +0800, yingchao wrote:
> From: Yingchao Deng <dengyingchao(a)kylinsec.com.cn>
>
> tpdm_probe() initializes drvdata->spinlock after coresight_register(), but
> the sysfs attributes registered by coresight_register() use the spinlock.
> This exposes a window where a concurrent sysfs write can lock an
> uninitialized spinlock.
>
> Initialize the spinlock before coresight_register().
>
> Fixes: b3c71626a933 ("Coresight: Add coresight TPDM source driver")
> Signed-off-by: Yingchao Deng <dengyingchao(a)kylinsec.com.cn>
Reviewed-by: Leo Yan <leo.yan(a)arm.com>
On Tue, Aug 25, 2026 at 09:47:17AM +0800, yingchao wrote:
> diff --git a/drivers/hwtracing/coresight/coresight-syscfg.c b/drivers/hwtracing/coresight/coresight-syscfg.c
> index 2bfdd7b45e49..d0e7e4720e46 100644
> --- a/drivers/hwtracing/coresight/coresight-syscfg.c
> +++ b/drivers/hwtracing/coresight/coresight-syscfg.c
> @@ -1210,8 +1210,14 @@ static int cscfg_create_device(void)
> dev->init_name = "cs_system_cfg";
>
> err = device_register(dev);
> - if (err)
> + if (err) {
> + /* put_device() triggers cscfg_dev_release() which takes
> + * cscfg_mutex, so drop the lock first to avoid deadlocking.
> + */
> + mutex_unlock(&cscfg_mutex);
> put_device(dev);
> + return err;
> + }
As module init and exit are serialized by the kernel, I don't think we
need the mutex to protect the allocation and freeing of cscfg_mgr.
The mutex should only be used for exclusively access cscfg_mgr.
So how about the change below?
---8<---
diff --git a/drivers/hwtracing/coresight/coresight-syscfg.c b/drivers/hwtracing/coresight/coresight-syscfg.c
index 2bfdd7b45e49..2dd0b29f44e4 100644
--- a/drivers/hwtracing/coresight/coresight-syscfg.c
+++ b/drivers/hwtracing/coresight/coresight-syscfg.c
@@ -1173,27 +1173,21 @@ struct device *cscfg_device(void)
/* Must have a release function or the kernel will complain on module unload */
static void cscfg_dev_release(struct device *dev)
{
- mutex_lock(&cscfg_mutex);
kfree(cscfg_mgr);
cscfg_mgr = NULL;
- mutex_unlock(&cscfg_mutex);
}
/* a device is needed to "own" some kernel elements such as sysfs entries. */
static int cscfg_create_device(void)
{
struct device *dev;
- int err = -ENOMEM;
-
- mutex_lock(&cscfg_mutex);
- if (cscfg_mgr) {
- err = -EINVAL;
- goto create_dev_exit_unlock;
- }
+ int err;
cscfg_mgr = kzalloc_obj(struct cscfg_manager);
if (!cscfg_mgr)
- goto create_dev_exit_unlock;
+ return -ENOMEM;
+
+ mutex_lock(&cscfg_mutex);
/* initialise the cscfg_mgr structure */
INIT_LIST_HEAD(&cscfg_mgr->csdev_desc_list);
@@ -1204,6 +1198,8 @@ static int cscfg_create_device(void)
cscfg_mgr->load_state = CSCFG_NONE;
raw_spin_lock_init(&cscfg_mgr->sysfs_store_lock);
+ mutex_unlock(&cscfg_mutex);
+
/* setup the device */
dev = cscfg_device();
dev->release = cscfg_dev_release;
@@ -1213,8 +1209,6 @@ static int cscfg_create_device(void)
if (err)
put_device(dev);
-create_dev_exit_unlock:
- mutex_unlock(&cscfg_mutex);
return err;
}