summaryrefslogtreecommitdiff
path: root/drivers/perf
AgeCommit message (Collapse)Author
34 hoursMerge tag 'riscv-for-linus-7.4-mw1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V updates from Paul Walmsley: - Add support for crash hotplug - Improve user copy performance on cores with fast misaligned accesses - Optimize code paths involving pgtable_l{4,5}_enabled() by patching in the return values during early boot (since these don't change during runtime), or by specifying the return values directly in Kconfig files (for purpose-built kernels) - Change the PCIe bus reassignment behavior to depend on the PCI_REASSIGN_ALL_BUS PCI flag (as ARM64 does) - Avoid an unnecessary sstatus CSR read during context switch - Make the sbi_ecall() macro variadic, improving code clarity - Refactor __switch_to_vector() to prepare for upcoming vector context switch optimizations - Add a kselftest for vectorized user copy - Add bounds checking on the shadow stack restore token address to avoid it being used as an attack vector - Fix the shadow stack and indirect branch landing pad control functions to only update the CPU's envcfg CSR when operating on the current task - For MIPS RISC-V systems, add support for early boot-applied errata; and for P8700 RISC-V systems, avoid WFI usage in the kernel (since it is buggy) - Add the "B" RISC-V ISA extension to hwcap and hwprobe reporting - Add support for specifying and reporting the "Zic64b" RISC-V ISA extension, and add it to the SpacemiT K1, K3, and Sophgo SG2044 DT files - Require the block size of cache management operations to be specified in DT schema validation for the RISC-V ISA extensions Zicbom, Zicbop, and Zicboz - Some miscellaneous fixes: fix an incorrect bitfield width in the RVG_SYSTEM_CSR_MASK bitmask macro; make RISCV_ALTERNATIVE mandatory, now that XIP kernel support has been removed; and remove some unnecessary includes in kernel/smp.c * tag 'riscv-for-linus-7.4-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: (28 commits) riscv: mm: unexport _pgtable_l4_enabled and _pgtable_l5_enabled riscv: introduce RISCV_ISA_SV48 and RISCV_ISA_SV57 riscv: support early isa ext and use it to optimize pgtable_l4|l5_enabled riscv: convert pgtable_l4|l5_enabled to inline function riscv: remove RISCV_ALTERNATIVE Kconfig option riscv: Add a getter for user PMLEN support riscv: dts: sophgo: sg2044: Add Zic64b ISA extension riscv: dts: spacemit: k1: Add Zic64b ISA extension riscv: dts: spacemit: k3: Add Zic64b ISA extension riscv: Add Zic64b to cpufeature and hwprobe dt-bindings: riscv: Add Zic64b extension description dt-bindings: riscv: Require block-size for Zicbom, Zicbop, and Zicboz riscv: Add B to hwcap and hwprobe riscv: remove unused profile.h includes riscv: cfi: Only write envcfg CSR when task is current riscv: cfi: Bounds check restore token before swap riscv: Add ERRATA_MIPS_P8700_WFI to replace WFI with mips.pause selftest: riscv: test vectorized user copy riscv: vector: refactor context switch for kernel-mode vector riscv: do not read csr in vector context switch ...
9 daysMerge tag 'driver-core-7.4-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core Pull driver core updates from Danilo Krummrich: "Core: - Add TAINT_FORCED_BIND to taint the kernel and driver module before manual sysfs bind/unbind operations; make add_taint_module() available to driver core and update taint decoding tools and documentation - Constify device_show/store_*() attribute parameters and adapt x86 MCE and perf users to prepare for const dev_ext_attribute instances - Fix UAF in NUMA access node registration failure handling by dropping the device reference with put_device() instead of directly freeing the node debugfs: - Make debugfs_create_str() read-only to eliminate double-free races between concurrent writers; reject writable modes; convert interconnect and SoundWire users to local file operations with mutex-protected strings kobject: - Fix out-of-bounds access in kobject_action_type() when parsing action strings containing embedded NUL bytes - Fix the kobject_set_name() reference in kset_register() kernel-doc Rust: - DMA: - Tie Coherent, CoherentBox and CoherentHandle to the device's bound lifetime to prevent retaining DMA allocations beyond driver unbind; propagate the lifetime through nova-core and the DMA sample driver - I/O: - Require explicit base types for registers and replace relative registers with typed subregion projections; reimplement register!() as a proc macro, support registers using existing types without inline bitfields, and convert nova-core, Tyr and the PCI sample; add AsRepr/AsReprMut and transmute helpers with deferred size checks for representation conversions - Wrap ResourceSize in a transparent newtype with explicit conversions, including checked conversion to usize - PCI: - Add typed PCIe extended capability lookup and SR-IOV accessors for the First VF Offset and decoded VF BAR addresses and widths, keeping raw SR-IOV registers private to preserve PCI core ownership of their state - scatterlist: - Honor the device's maximum segment size as well as the DMA mapping limit when constructing SG tables - Return u32 from SGEntry::dma_len() to match the C segment length type - misc: - Validate auxiliary DeviceId name length explicitly to improve compile-time diagnostics for oversized device ID table entries - Drop unnecessary 'static bounds from debugfs ScopedDir file creation methods to support data containing non-'static references, including DMA buffers Misc: - Add Johan Hovold as driver core maintainer - Simplify platform_device_alloc() by returning early on allocation failure - Fix typos in driver core and kernfs comments" * tag 'driver-core-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: (41 commits) rust: pci: add extended capability and SR-IOV support kobject: Fix the kobj_set_name reference in kset_register() kernel-doc rust: io: convert ResourceSize into a transparent newtype rust: scatterlist: return u32 from SGEntry::dma_len() MAINTAINERS: add myself as driver core maintainer debugfs: make debugfs_create_str() read-only soundwire: debugfs: replace writable string helper interconnect: debugfs: replace writable string helper docs: admin-guide: Handle TAINT_FORCED_BIND when parsing /proc/sys/kernel/tainted driver core: platform: Simplify platform_device_alloc() kobject: fix out-of-bounds access in kobject_action_type() rust: scatterlist: honor the device's maximum segment size driver core: add TAINT_FORCED_BIND for when userspace manually messes with devices and drivers module: fix up documentation for add_taint() and add_taint_module() module: pull out add_taint_module() to be public driver core: Constify the signature of device_show/store_*() drivers: perf: Use __DEVICE_ATTR() macro to initialize dev_ext_attribute x86/mce: Use __DEVICE_ATTR() macro to initialize dev_ext_attribute rust: auxiliary: validate DeviceId name length driver core: fix typos in comments ...
11 daysMerge tag 'arm64-upstream' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 updates from Catalin Marinas: "Here are the arm64 updates for 7.4. The more interesting bits are the removal of big-endian kernel support (already marked BROKEN for some time), preemptible this_cpu_*() operations and MPAM support for the firmware-backed (Fb) interface. CCA (Arm's confidential compute) is slowly trickling in with host RMI (Realm Management Interface) support and some refactoring, including a dedicated SMCCC bus to advertise firmware services. There are also the usual PMU updates for new hardware and a few fixes/cleanups. Core features: - Remove big-endian kernel support: CONFIG_CPU_BIG_ENDIAN has depended on BROKEN for a while, so drop the remaining code (BE hypervisor object, BPF JIT, assembly/crypto/library routines, endianness helper macros, selftests) and force a little-endian build - Add preemptible this_cpu_*() operations (read/write, RMW, xchg, cmpxchg and cmpxchg128) that no longer need to disable preemption around the per-CPU address generation and access - Preparation patches for implementing CONFIG_HOTPLUG_PARALLEL on arm64 Memory management: - Treat faults taken by EFI runtime firmware as kernel faults - Clear PTE_WRITE for EFI_MEMORY_RO mappings (with hardware dirty state management enabled, this is not truly read-only) - Raise the default ARCH_MMAP_RND_BITS for 48-bit and 52-bit VA configurations (28/26/24 bits for 4K/16K/64K pages) - Implement clear_page[s]() using memset() - Enable BBML2 no-abort (a.k.a. BBML3) for the NVIDIA Rigel CPU Perf and PMU: - Support for HiSilicon's ITS PMU - Add support for some new events: INST_SIMD_ALU_VEC for Apple PMUs and a cycle counter for the latest version of HiSilicon's MN PMU hardware - A bunch of fixes to the CXL PMU driver to address pre-existing issues from Sashiko - Fix generation of PERF_RECORD_ITRACE_START records for SPE and ETM drivers - Reduce excessive stack consumption in the Marvell DDR PMU driver - Minor driver updates and cleanups all over Arm Confidential Compute Architecture (CCA): - Add an Arm SMCCC bus for firmware services discovered through SMCCC and move the TRNG and CCA guest (TSM provider) drivers onto it, removing the dummy CCA platform device and adding a sysfs ABI for Realm guests - Move the Realm Service Interface (RSI) code out of arch/arm64/ into drivers/firmware/arm_rmm/ - Add the host side of the Realm Management Interface (RMI): detect, configure and activate the RMM, add SRO support and wrappers for the Realm RMI commands - Block hibernation (new arch hook in the PM core) and kexec while the RMM is active. To be revisited in the future with proper support for deactivation - Handle Granule Protection Faults (GPFs) taken by the host, caused by accesses to memory delegated to the RMM. In a future patch, the exception table lookup will be limited to is_kdump_kernel() cases MPAM (Memory Partitioning And Monitoring): - Add support for the MPAM firmware-backed (Fb) interface, allowing MSC accesses to be mediated by firmware - Fix a list of theoretical issues with the driver (MSC access error propagation, MBWU monitor save/restore and locking, resctrl class handling, error interrupt restore, maximum number of PARTIDs) - Add the mailing list and a missing file to the MAINTAINERS entry - Document when to set arm64.nompam Errata and CPU features: - Add the NXP i.MX8QM/8QP workaround for the Cortex-A53 cache coherency issue (ERR050104), using a new ARM64_CPUCAP_SOC_ERRATUM capability type for SoC-level errata Miscellaneous: - Mask debug exceptions (DAIF) around the hardware breakpoint register manipulations when called from generic kernel code - Don't zero the SVE state buffer when the SVE state is live - Return -EPERM instead of -EBUSY from the GCS prctl() locking failures (matching x86), with the selftest updated. Slight ABI change but no software deployment yet - kselftest: fix unsound MTE fault skipping by introducing MTE-safe memory accessors, avoid copying each signal test binary more than once - Update sysreg definitions (fix three enum values and two field names, mark architecturally dropped fields as RES0) and remove the TME transaction state check from the BRBE driver - Fix the description of ARM64_HAS_LPA2 and remove a redundant ID_AA64MMFR0 define" * tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: (144 commits) arm64: cpufeature: Enable BBML2 for NVIDIA Rigel arm64: cputype: Add NVIDIA Rigel definitions arm64: raise default ARCH_MMAP_RND_BITS for 48-bit and 52-bit VA arm64/debug: mask debug exceptions when called from common code kselftest/arm64: signal: copy each test binary only once kselftest/arm64: Check for -EPERM not -EBUSY in the locking test arm64: gcs: Return -EPERM not -EBUSY for prctl() locking failures perf: arm_brbe: Remove the check for TME transaction states arm64: sysreg: Mark fields the architecture dropped as RES0 arm64: sysreg: Fix the names of two misspelt fields arm64: sysreg: Fix three incorrect enum values arm64: smp: Defer RCU registration during secondary CPU bringup arm64: smp: Don't bother printing the I-cache policy for each CPU arm64: smp: Defer update of secondary CPU capabilities arm64: smp: Tidy up cpuinfo init and cpufeature updates arm64: smp: Tidy up smp_prepare_cpus() arm64: cpufeature: Store every ID register with its overrides applied arm64: cpufeature: Read MPAMIDR_EL1 in __cpuinfo_store_cpu() arm64: cpufeature: Add read_cpuid_with_overrides() arm64: cpufeature: Check arm64_ftr_regs[] before the first store ...
2026-10-15Merge branches 'for-next/misc', 'for-next/be-gone', 'for-next/smccc-bus', ↵Catalin Marinas
'for-next/preemptible-this-cpu', 'for-next/cpu-errata', 'for-next/mpam', 'for-next/kselftest', 'for-next/efi', 'for-next/secondary-boot-prep', 'for-next/sysreg' and 'for-next/gcs', remote-tracking branch 'arm64/for-next/perf' into for-next/core * arm64/for-next/perf: (22 commits) drivers/perf: apple_m1: Add macOS 27 M2 Event perf/marvell: cn10k_tad: Publish the OF module alias perf: xgene: initialize lock before requesting IRQ perf: marvell: avoid large stack variables perf/dwc_pcie: Fix PCI device reference leak in probe coresight: perf: Suppress ITRACE start records perf: arm_spe: Suppress redundant ITRACE start records perf/core: Export perf_event_itrace_started() perf/cxl: Clear stale overflow status before using a counter perf/cxl: Don't log through pmu.dev in the overflow interrupt handler perf/cxl: Validate the hardware-reported counter width perf/cxl: Unfreeze counters after handling an overflow interrupt perf/cxl: Don't share the overflow interrupt, and keep it pinned cxl/pci: Add the PMUs after configuring events perf/cxl: Split the MSI vector out of info->irq perf/cxl: Accept an overflow interrupt on MSI message number 0 perf/cxl: Fix the counter overflow delta fixup perf/cxl: Clear stale event fields before reprogramming a counter perf/cxl: Program the requested event group on configurable counters drivers/perf: hisi: Add cycle event for new MN PMU ... * for-next/misc: arm64: cpufeature: Enable BBML2 for NVIDIA Rigel arm64: cputype: Add NVIDIA Rigel definitions arm64: raise default ARCH_MMAP_RND_BITS for 48-bit and 52-bit VA arm64/debug: mask debug exceptions when called from common code arm64: clear_page[s] using memset arm64/sve: Don't zero the SVE state buffer when the SVE state is live arm64/cpufeature: Drop redundant define(ID_AA64MMFR0..._SUPPORTED_LPA2) arm64: Use proper include variant arm64: include: fix repeated word 'to' in comment selftests: arm64: fix typo "hander" in comment arm64: fix typos in comments docs: arm64: Fix typo "initalised" in booting.rst arm64: alternative: Remove 'cfg' parameter arm64: mte-kasan: Use IS_ENABLED() rather than ALTERNATIVE() 'cfg' parameter arm64/cpufeature: Change description for ARM64_HAS_LPA2 * for-next/be-gone: drivers: Kconfig: Simplify dependencies on ARM64 && !CPU_BIG_ENDIAN arm64: Kbuild: Remove vestigial big-endian support gve: Add explicit ARM64 dependency to Kconfig crypto: hisilicon/sec2: Remove check of CONFIG_CPU_LITTLE_ENDIAN arm64: Remove all usage of __AARCH64EB__ arm64: Remove all usage of CONFIG_CPU_BIG_ENDIAN KVM: arm64: Remove support for a big-endian hypervisor object arm64: vdso32: Always build compat vDSO object as little-endian arm64: assembler: Remove endianness helper macros arm64: lib: Assume a little-endian kernel in optimised string routines arm64: lib: Assume a little-endian kernel in custom library routines arm64: crypto: Assume a little-endian kernel arm64: bpf: Remove big-endian support from the JIT compiler selftests/arm64: Remove big-endian support * for-next/smccc-bus: : Switch Arm SMCCC firmware services to an SMCCC bus arm64: rsi: Correct type of realm_config::hash_algo firmware: smccc: Pass only the required device probe arguments firmware: arm_rmm: Add SPDX and sort the Kconfig and Makefile entries coco: guest: arm64: Remove dummy CCA platform device coco: guest: arm64: Add sysfs ABI for CCA Realm guests firmware: smccc: arm-cca-guest: Bind the TSM provider to an SMCCC device virt: coco: arm-cca-guest: Rename TSM report source file arm64: realm: Move Realm memory encryption ops to RSI code firmware: arm_rmm: Move RSI support out of arch/arm64 firmware: hwrng: arm_smccc_trng: Register as an SMCCC device firmware: smccc: Add an Arm SMCCC bus * for-next/preemptible-this-cpu: : Preemptible this_cpu_*() operations arm64: percpu: Remove _pcp_protect*() wrappers arm64: percpu: Implement preemptible CMPXCHG128 ops arm64: percpu: Implement preemptible CMPXCHG ops arm64: percpu: Implement preemptible XCHG ops arm64: percpu: Implement preemptible return RMW ops arm64: percpu: Implement preemptible void RMW ops arm64: percpu: Implement preemptible read/write ops arm64: percpu: Add infrastructure for preemptible this_cpu_*() ops arm64: entry: sdei: Make 'tsk' available arm64: entry: sdei: Restore all clobberable GPRs arm64: gpr-num: add __GPR_NUM() helper arm64: gpr-num: Add wxN aliases for wN registers arm64: percpu: Factor out percpu offset asm arm64: ptrace: Always inline pt_regs_{read,write}_reg() arm64: preempt: Treat should_resched() as unlikely arm64: preempt: Simplify and optimize __preempt_count_dec_and_test() arm64: cmpxchg128: LSE: Remove redundant operands arm64: cmpxchg: LL/SC: Avoid redundant extension * for-next/cpu-errata: : Various CPU errata workarounds arm64: errata: Add NXP i.MX8QM/8QP workaround for A53 cache coherency issue arm64: cpufeature: Add ARM64_CPUCAP_SOC_ERRATUM for SoC-level errata * for-next/mpam: (30 commits) : MPAM updates arm_mpam: make the mon_sel guard conditional only arm_mpam: On saving mbwu state read the monitors before clearing CFG_MBWU_CTL arm_mpam: detect and enable MPAM-Fb PCC support arm_mpam: change MPAM-Fb error IRQ to use a threaded IRQ handler arm_mpam: add MPAM-Fb MSC firmware access support arm_mpam: prepare mon_sel locking for MPAM-Fb arm_mpam: propagate MSC access errors in mpam_reset_class_locked() arm_mpam: propagate MSC access errors for interrupt control arm_mpam: propagate MSC access errors for mpam_reprogram_ris_partid() arm_mpam: propagate MSC access errors for state saving function arm_mpam: propagate MSC access errors for __ris_msmon_read() arm_mpam: propagate MSC access errors for msmon helpers arm_mpam: propagate MSC access errors for MBWU counters arm_mpam: propagate MSC access errors for hw_probe functions arm_mpam: let low level MSC accessors return an error MAINTAINERS: Use linux-arm-kernel list for the MPAM driver MAINTAINERS: Add mpam.rst to the MPAM DRIVER entry arm_mpam: resctrl: Don't stop early when tearing down a class arm_mpam: Switch to kvzmalloc_objs() for allocation of component cfg arm_mpam: Don't loop forever if there is the maximum possible amount of PARTIDs ... * for-next/kselftest: : arm64 kselftest updates kselftest/arm64: signal: copy each test binary only once kselftest/arm64/mte: Use MTE safe memory accessors kselftest/arm64/mte: Introduce MTE safe memory accessors kselftest/arm64: Extend gcs-locking to cover cases where enable is unlocked * for-next/efi: : arm64 EFI updates/fixes arm64/mm: Treat faults taken by EFI runtime firmware as kernel faults arm64/efi: Clear PTE_WRITE when applying EFI_MEMORY_RO * for-next/secondary-boot-prep: : cpuinfo cleanup in preparation for parallel secondary bring-up arm64: smp: Defer RCU registration during secondary CPU bringup arm64: smp: Don't bother printing the I-cache policy for each CPU arm64: smp: Defer update of secondary CPU capabilities arm64: smp: Tidy up cpuinfo init and cpufeature updates arm64: smp: Tidy up smp_prepare_cpus() arm64: cpufeature: Store every ID register with its overrides applied arm64: cpufeature: Read MPAMIDR_EL1 in __cpuinfo_store_cpu() arm64: cpufeature: Add read_cpuid_with_overrides() arm64: cpufeature: Check arm64_ftr_regs[] before the first store * for-next/sysreg: : sysreg updates perf: arm_brbe: Remove the check for TME transaction states arm64: sysreg: Mark fields the architecture dropped as RES0 arm64: sysreg: Fix the names of two misspelt fields arm64: sysreg: Fix three incorrect enum values * for-next/gcs: : GCS updates/fixes kselftest/arm64: Check for -EPERM not -EBUSY in the locking test arm64: gcs: Return -EPERM not -EBUSY for prctl() locking failures
2026-10-14perf: arm_brbe: Remove the check for TME transaction statesFuad Tabba
When an event samples branch flags, the BRBE driver warns once if a branch record has BRBINFx_EL1.T or LASTFAILED set, which its comment calls TME-related information. FEAT_TME has been withdrawn from the architecture, and both fields are RES0 in DDI0601 2026-09, so the check tests fields that no longer exist. Remove the check and its two accessors, which were the only users of the fields' defines, and mark both fields RES0 in the sysreg file. Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-10-05RISC-V: make use of variadic sbi_ecallRadim Krčmář
The new sbi_ecall doesn't have to list all 8 arguments anymore, so only pass the actual numbers of arguments for each SBI function. The remaining trailing 0 are intentional as they represent an argument. SBI 0.1 shouldn't be using the sbi_ecall, because it's only for 0.2+, but allow it by passing 0 is the reserved register. Signed-off-by: Radim Krčmář <rkrcmar@ventanamicro.com> Link: https://patch.msgid.link/20250619190315.2603194-3-rkrcmar@ventanamicro.com [pjw@kernel.org: updated to apply; fixed rv64 DBCN WRITE/READ per Radim] Cc: Radim Krčmář <rkrcmar@qti.qualcomm.com> Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-10-04drivers/perf: apple_m1: Add macOS 27 M2 EventMyria Sarvay
This patch adds another known PMU event that can be found under /usr/share/kpep on macOS 27 for M2 macs. INST_SIMD_ALU_VEC purports to count "Retired non-load/store vector Advanced SIMD instructions", and as we already noted, can only be registered on counter 7. Though this event only shows up on the M2 kpep records, it can be set on M1 CPUs, and records something. Link: https://github.com/0ax1/apmc/blob/9cff99a9df2ae055f1e3065c64f633e38bb6beec/counters/m2.md Signed-off-by: Myria Sarvay <myrialsarvay@gmail.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-10-04perf/marvell: cn10k_tad: Publish the OF module aliashpp.iscas
The TAD PMU platform driver has ACPI and OF match tables, but only the ACPI table is published. A Device Tree platform device emits an OF modalias, so the ACPI alias does not select this module for it. Publish the OF table inside CONFIG_OF and retain ACPI support. Fixes: 036a7584bede ("drivers: perf: Add LLC-TAD perf counter support") Signed-off-by: hpp.iscas <hppiscas@163.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-10-04perf: xgene: initialize lock before requesting IRQRunyu Xiao
xgene_pmu_probe() requests the PMU IRQ before initializing xgene_pmu->lock. request_irq() enables IRQ handling before it returns, so xgene_pmu_isr() can run in this window and acquire the uninitialized raw spinlock. Initialize the lock before requesting the IRQ so the handler always sees a valid lock. Fixes: 832c927d119b ("perf: xgene: Add APM X-Gene SoC Performance Monitoring Unit driver") Cc: stable@vger.kernel.org Assisted-by: Codex:GPT-5 Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn> Signed-off-by: Will Deacon <will@kernel.org>
2026-10-04perf: marvell: avoid large stack variablesArnd Bergmann
The probe function in this driver constructs multiple large structures on the stack, which ends up causing a size warning: drivers/perf/marvell_cn10k_ddr_pmu.c:1168:12: error: stack frame size (1296) exceeds limit (1280) in 'cn10k_ddr_perf_probe' [-Werror,-Wframe-larger-than] 1168 | static int cn10k_ddr_perf_probe(struct platform_device *pdev) | ^ Avoid this warning and simplify the code by turning these into static const structures and directly assigning them without the extra copy. Fixes: 9b551a2446b2 ("perf: marvell: Add CN20K DDR PMU support") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Will Deacon <will@kernel.org>
2026-10-04perf/dwc_pcie: Fix PCI device reference leak in probeRuoyu Wang
pci_get_domain_bus_and_slot() returns a referenced PCI device. When the subsequent RAS DES capability lookup fails, dwc_pcie_pmu_probe() returns -ENODEV without releasing that reference. Repeated failed probes can therefore keep the PCI device allocated after removal. Declare the looked-up device with __free(pci_dev_put), so the temporary reference is released on every return path. Keeping the reference scoped to the whole probe also covers all later uses of the device during initialization. This issue was found by a static analysis checker and confirmed by manual source review. Fixes: 7f35b429802a ("perf/dwc_pcie: fix duplicate pci_dev devices") Suggested-by: Markus Elfring <Markus.Elfring@web.de> Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-10-04perf: arm_spe: Suppress redundant ITRACE start recordsLeo Yan
PERF_RECORD_ITRACE_START establishes the initial thread context at the beginning of a trace. Afterwards, decoders track the thread context using context packets or recorded sched_switch events. Call perf_event_itrace_started() when event starts to prevent perf core from emitting redundant PERF_RECORD_ITRACE_START records on later schedule-ins. Signed-off-by: Leo Yan <leo.yan@arm.com> Reviewed-by: James Clark <james.clark@linaro.org> Signed-off-by: Will Deacon <will@kernel.org>
2026-10-04perf/cxl: Clear stale overflow status before using a counterDave Jiang
cxl_pmu_event_stop() leaves the counter's bit set in the overflow status register and only cxl_pmu_irq() ever clears it, so a counter handed from one event to the next starts with the previous owner's overflow pending. The perf core stops and starts back to back with interrupts off, so an interrupt latched over the handover lands on the new event. prev_count is 0 by then, so the read path adds a full period: 2^counter_width phantom counts. Clear the bit in cxl_pmu_event_start(), before the config write arms Interrupt on Overflow. Clear the whole register at probe too, for counters no event ever owns - the driver never touched it, so firmware or a previous kernel can leave a bit set there. Fixes: 5d7107c72796 ("perf: CXL Performance Monitoring Unit driver") Reported-by: Richard Cheng <icheng@nvidia.com> Closes: https://lore.kernel.org/linux-cxl/anAVpO--i5heVfz9@MWDK4CY14F/ Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Dave Jiang <dave.jiang@intel.com> Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-10-04perf/cxl: Don't log through pmu.dev in the overflow interrupt handlerDave Jiang
perf_pmu_unregister() frees pmu->dev without clearing the pointer, and cxl_pmu_probe() orders its devm actions so that teardown runs it before free_irq(). Nothing in between masks the interrupt, and cxl_pmu_event_stop() leaves the overflow status bit set, so an overflow taken just before teardown is still delivered and still reaches the dev_dbg() in the !event branch - by which point info->pmu.dev is freed. Log through info->pmu.parent instead, which is devm-managed and outlives every teardown action. Fixes: 5d7107c72796 ("perf: CXL Performance Monitoring Unit driver") Reported-by: sashiko-bot@kernel.org Closes: https://sashiko.dev/#/patchset/20260715191454.459673-1-dave@stgolabs.net?part=1 Assisted-by: Claude:claude-opus-4-8 Acked-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com> Signed-off-by: Dave Jiang <dave.jiang@intel.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-10-04perf/cxl: Validate the hardware-reported counter widthDave Jiang
cxl_pmu_parse_caps() takes the Counter Width straight from the CPMU Capability register without a bounds check. The Counter Data register is 64 bits wide, so a device reporting 0 or more than 64 is reporting nonsense, and GENMASK_ULL(width - 1, 0) in the read path then shifts out of range. That is undefined behaviour, and a UBSAN splat where it is enabled. Reject a counter width outside 1..64 at probe. Fixes: 5d7107c72796 ("perf: CXL Performance Monitoring Unit driver") Reported-by: sashiko-bot@kernel.org Closes: https://sashiko.dev/#/patchset/20260715191454.459673-1-dave@stgolabs.net?part=1 Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com> Signed-off-by: Dave Jiang <dave.jiang@intel.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-10-04perf/cxl: Unfreeze counters after handling an overflow interruptDave Jiang
The counters run with Freeze on Overflow set, so one overflow freezes every counter in the block (CXL r4.0 8.2.7.2.1), and a frozen counter "remains frozen until explicitly unfrozen by software" (8.2.7.1.3, Table 8-183). cxl_pmu_irq() reads the overflowed counters and clears the overflow status but never unfreezes, so everything stays frozen until the next pmu_enable() and events in that window are lost. Unfreeze after clearing the status, unless the PMU has been disabled in the meantime - cxl_pmu_disable() freezes the block deliberately. Track the enabled state and leave it frozen in that case. Fixes: 5d7107c72796 ("perf: CXL Performance Monitoring Unit driver") Reported-by: sashiko-bot@kernel.org Closes: https://sashiko.dev/#/patchset/20260715191454.459673-1-dave@stgolabs.net?part=1 Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com> Signed-off-by: Dave Jiang <dave.jiang@intel.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-10-04perf/cxl: Don't share the overflow interrupt, and keep it pinnedDave Jiang
The PMU pins its overflow interrupt to info->on_cpu in the hotplug callbacks, but requests it with only IRQF_SHARED | IRQF_NO_THREAD. Without IRQF_NOBALANCING, irqbalance or a userspace smp_affinity write can move it elsewhere, and cxl_pmu_irq() then runs local64_cmpxchg() and local64_add() on hwc->prev_count and event->count at the same time as the managing CPU. local64_t is only atomic against same-CPU access, so the counts corrupt. The flag alone does not fix that while the line is shared. __setup_irq() only acts on it for the first action on a line, and a co-owner has no reason to want our affinity - it would keep taking the interrupt wherever its own points, running our handler on the wrong CPU. Drop IRQF_SHARED and add IRQF_NOBALANCING. The spec only recommends a distinct Interrupt Message Number per CPMU instance (CXL r4.0 8.2.7.1.1), so a device may put several on one vector, or share with the mailbox or event log. Such a device now loses a PMU rather than silently miscounting - and only the PMU, since the preceding patch adds the CPMUs after the event configuration. Fixes: 5d7107c72796 ("perf: CXL Performance Monitoring Unit driver") Reported-by: sashiko-bot@kernel.org Closes: https://sashiko.dev/#/patchset/20260715191454.459673-1-dave@stgolabs.net?part=1 Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com> Reviewed-by: Davidlohr Bueso <dave@stgolabs.net> Signed-off-by: Dave Jiang <dave.jiang@intel.com> Link: https://sashiko.dev/#/patchset/20260715191454.459673-1-dave@stgolabs.net?part=1 Signed-off-by: Will Deacon <will@kernel.org>
2026-10-04perf/cxl: Split the MSI vector out of info->irqDave Jiang
info->irq means two different things depending on how far probe has got. cxl_pmu_parse_caps() sets it to the MSI/MSI-X message number from the CPMU Capability register. cxl_pmu_probe() passes that to pci_irq_vector() and then overwrites it with the Linux virq, which is what the hotplug callbacks hand to irq_set_affinity(). Both are ints called irq, so nothing catches a mix-up, and the valid ranges differ. 0 is a fine message number but never a valid virq. Give the message number its own field. No functional change. Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Robin Murphy <robin.murphy@arm.com> Signed-off-by: Dave Jiang <dave.jiang@intel.com> Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-10-04perf/cxl: Accept an overflow interrupt on MSI message number 0Dave Jiang
cxl_pmu_probe() rejects the PMU when info->irq <= 0, but at that point the field still holds the MSI/MSI-X message number the device signals overflow on, not a Linux virq. That number is 0-based, and -1 means no interrupt support. Message number 0 is valid and pci_irq_vector() takes a 0-based index, so a compliant device signalling on the first vector fails to probe. Reject only the no-interrupt case, matching how the CXL mailbox and event interrupts handle it. Fixes: 5d7107c72796 ("perf: CXL Performance Monitoring Unit driver") Reported-by: sashiko-bot@kernel.org Closes: https://sashiko.dev/#/patchset/20260715191454.459673-1-dave@stgolabs.net?part=1 Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com> Reviewed-by: Davidlohr Bueso <dave@stgolabs.net> Acked-by: Richard Cheng <icheng@nvidia.com> Signed-off-by: Dave Jiang <dave.jiang@intel.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-10-04perf/cxl: Fix the counter overflow delta fixupDave Jiang
The counter is masked to counter_width, so the subtraction in __cxl_pmu_read() throws away the bit that records the wrap. A delta of one whole period reads back as 0, the same as no events at all, and only the overflow status tells the two apart - which is why __cxl_pmu_read() takes an overflow argument. The fixup keys off the delta rather than the operands: delta = (new_cnt - prev_cnt) & GENMASK_ULL(counter_width - 1, 0); if (overflow && delta < GENMASK_ULL(counter_width - 1, 0)) delta += (1UL << counter_width); so it cannot tell which of these it is looking at: event_start polled read wrap ctr = 0 .......... ctr = P/2 ......... mask -> 0 (+r) prev = 0 prev = P/2 IRQ reads new = r prev = 0 (no read yet): new >= prev, fell short -> add period prev = P/2 (polled): new < prev, spans wrap -> add nothing Both rows are the same interrupt and the old guard adds a period in both, so a mid-period read makes the event over-count. 'perf stat -I' hits that. Condition the fixup on new_cnt >= prev_cnt, the one case the subtraction cannot express. Dropping it outright would break the first row. It stays exact whatever the residual r is, which matters because some events increment by more than 1 per cycle (CXL r4.0 8.2.7.2.1, Threshold) and can step past 0 as they wrap. Use mask + 1 for the period rather than a shift. It is 0 for a 64-bit counter, and avoids the old 1UL << counter_width - undefined for width 64, and for >= 32 on 32-bit kernels. Fixes: 5d7107c72796 ("perf: CXL Performance Monitoring Unit driver") Reported-by: sashiko-bot@kernel.org Closes: https://sashiko.dev/#/patchset/20260715191454.459673-1-dave@stgolabs.net?part=1 Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Dave Jiang <dave.jiang@intel.com> Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-10-04perf/cxl: Clear stale event fields before reprogramming a counterDave Jiang
cxl_pmu_event_start() ORs the event group id, event mask, edge and invert selections into a configurable counter's config register without clearing them first, and cxl_pmu_event_stop() leaves them set. Reuse the counter for another event and the new selection lands on top of the old one, so the counter counts the wrong events with stale edge and invert behaviour. Use FIELD_MODIFY() so each field is replaced rather than accumulated. Fixes: 5d7107c72796 ("perf: CXL Performance Monitoring Unit driver") Reported-by: sashiko-bot@kernel.org Closes: https://sashiko.dev/#/patchset/20260715191454.459673-1-dave@stgolabs.net?part=1 Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Dave Jiang <dave.jiang@intel.com> Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com> Link: https://sashiko.dev/#/patchset/20260715191454.459673-1-dave@stgolabs.net?part=1 Signed-off-by: Will Deacon <will@kernel.org>
2026-10-04perf/cxl: Program the requested event group on configurable countersDave Jiang
cxl_pmu_get_event_idx() sets *counter_idx for a configurable counter but never *event_idx. hwc->event_base stays 0, so cxl_pmu_event_start() programs event group 0 no matter which group the user asked for. Return the matched capability's event_idx. Fixes: 5d7107c72796 ("perf: CXL Performance Monitoring Unit driver") Reported-by: sashiko-bot@kernel.org Closes: https://sashiko.dev/#/patchset/20260715191454.459673-1-dave@stgolabs.net?part=1 Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com> Signed-off-by: Dave Jiang <dave.jiang@intel.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-10-04drivers/perf: hisi: Add cycle event for new MN PMUYifan Wu
The HiSilicon new MN (Miscellaneous Node) PMU exposes a cycle event in addition to the existing event set. Add a v2 event list that includes the cycles event (0x0F) and a new hisi_mn_v2 dev_info matched by the new ACPI id HISI0224. Rename the existing event list, attribute group and attr_groups array to *_v1 so the two MN PMU versions can coexist. Signed-off-by: Yifan Wu <wuyifan50@huawei.com> Signed-off-by: Yushan Wang <wangyushan12@huawei.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-10-04drivers/perf: hisi: Add support for uncore ITS PMUYushan Wang
The Interrupt Translation Service (ITS) PMU counts interrupts routed to the ITS by category (LPI/SGI/PPI event counts and latencies) and also collects micro-op statistics for the ITS itself. Add a driver for the ITS PMU on the HiSilicon uncore PMU framework. Like the NoC PMU it has no overflow interrupt, so the interrupt enable/disable callbacks are empty stubs. The PMU supports filtering counters by a 32-bit interrupt id (int_id), composed of a 16-bit DeviceID/PEID in the upper half and a 16-bit EventID/IntID in the lower half. The INT_ID filter is global to the PMU instance, so only events with the same filter configuration may run at the same time; events with different filters will be time-multiplexed. Document the int_id and int_en format attributes in Documentation/admin-guide/perf/hisi-pmu.rst. Signed-off-by: Yushan Wang <wangyushan12@huawei.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-10-04drivers/perf: hisi: Consolidate uncore PMU cpuhp statesYushan Wang
Every HiSilicon uncore PMU driver allocates its own static cpuhp state even though they all register identical online/offline callbacks. This wastes slots in the cpuhp state enum and needlessly fragments the hotplug state space. Move the cpuhp state setup into the shared hisi_uncore_pmu framework: register a single dynamic state (CPUHP_AP_ONLINE_DYN) at framework module init and export it for all HiSilicon uncore PMU drivers to use. Drop the now-unused static CPUHP_AP_PERF_ARM_HISI_* entries from include/linux/cpuhotplug.h. The L3C PMU driver keeps a private dynamic state because it has its own hotplug callbacks for migrating multiple per-CPU interrupt affinities, but switches from its former static slot to CPUHP_AP_ONLINE_DYN for consistency. No intended functional changes. Signed-off-by: Yushan Wang <wangyushan12@huawei.com> Reviewed-by: Robin Murphy <robin.murphy@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-09-28Merge tag 'v7.3-rc5' into driver-core-nextDanilo Krummrich
We need the driver-core fixes in here as well to build on top of. Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-09-27Merge tag 'perf-urgent-2026-09-27' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf events fixes from Ingo Molnar: - Fixes for KVM guest PEBS virtualization (Sean Christopherson) - Fixes for various Intel PMUs related to PEBS data-source (Dapeng Mi) - Fix Intel Panther Cove event scheduling constraints (Dapeng Mi) - Fix Intel DMR/NVL OMR extra registers event scheduling (Dapeng Mi) - Rename two confusingly named PMU attributes (Dapeng Mi) - Fix a refcount leak in attach_perf_ctx_data() (Namhyung Kim) - Fix NULL pointer dereference crash in __perf_pmu_sched_task() (Puranjay Mohan) - Fix CPU-wide event scheduling (Puranjay Mohan) - Fix x86 LBR branch entry generation (Puranjay Mohan) * tag 'perf-urgent-2026-09-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/core: Fill branch entries with a single assignment perf/core: Run sched_task() for PMUs with only CPU-wide events perf/core: Fix NULL pmu_ctx passed to pmu->sched_task() perf/core: Fix a refcount leak in attach_perf_ctx_data() perf/x86/intel: Rename NVL offcore_rsp attribute to offmodule_rsp perf/x86/intel: Rename DMR offcore_rsp attribute to offmodule_rsp perf/x86/intel: Fix precise OMR event scheduling for DMR/NVL perf/x86/intel: Constrain Panther Cove UOPS_DISPATCHED events to PMCs 0-3 perf/x86/intel: Delete dead NVL PEBS data-source initcall perf/x86/intel: Fix Panther Cove PEBS data-source snoop states perf/x86/intel: Remove incorrect Panther Cove PEBS data-source constraints perf/x86/intel: Remove incorrect LionCove PEBS data-source constraints perf/x86/intel: Update arw_latency_data() mem-op direction handling perf/x86/intel: Fix DKT PEBS load/store direction for latency events, to fix sample classification perf/x86/intel: Fix CMT PEBS load/store direction for latency events, to fix sample classification perf/x86/intel: Fix GRT PEBS load/store direction for latency events, to fix sample classification perf/x86/intel: Make @data a mandatory param for intel_guest_get_msrs() perf/x86/intel: Don't pointlessly context switch DS_AREA (and PEBS config) if PEBS is unused perf/x86/intel: Don't write PEBS_ENABLED on host<=>guest xfers if CPU has PEBS isolation, to fix stuck PEBS_ENABLED perf/x86/intel: Ensure KVM guest PEBS path doesn't set unwanted PERF_GLOBAL_CTRL bits
2026-09-24Merge tag 'arm64-fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: - Fix the recently merged user ABI for the Arm CMN PMU driver filtering logic so that the ordering matches the hardware spec - Fix spurious warning when attempting to read PROT_NONE mappings of /dev/mem - Allow WFxT to be disabled on the command line, which is necessary for some configurations of recent Apple SoCs - Fix EL2 fine-grained trap configuration for the CPU PMU - Fix MIDR matching when applying CPU errata workarounds in a VM * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64/boot: Disable trapping of PMZR_EL0 writes to EL2 arm64: errata: match the target implementation CPU's own MIDR arm64: Add override for WFxT arm64: io: Reject non-user protection in ioremap_prot() perf/arm-cmn: Fix multi-filter encoding
2026-09-23perf/core: Fill branch entries with a single assignmentPuranjay Mohan
perf_clear_branch_entry_bitfields() clears the bitfields of struct perf_branch_entry one by one and leaves from/to alone, since callers overwrite those straight away. The list has to be kept in sync with the struct by hand and has already fallen behind: new_type and priv were added to perf_branch_entry and never added here. Only BRBE writes those two, and neither for every record. brbe_set_perf_entry_type() leaves new_type alone for a branch type it does not recognise, and priv is not set for source-only records. arm_pmuv3.c allocates the per-CPU branch stack with kmalloc(), so such a record reaches userspace with whatever the slot held: uninitialised kmalloc() data on the first pass over the buffer, the previous record's values after that. Nothing under arch/x86/events/ writes either field, so only arm64 is affected. Assign the whole entry at each site instead. Everything not named is then zero, and there is no list to keep in sync. The bitfields add up to exactly 64 bits, so the struct has no padding to leave undefined. perf_clear_branch_entry_bitfields() has no callers left, so remove it. perf_entry_from_brbe_regset() assigns an empty literal instead, since it fills from/to conditionally. PERF_BR_SPEC_NA is 0, so dropping the explicit spec assignment changes nothing. Fixes: b190bc4ac9e6 ("perf: Extend branch type classification") Fixes: 5402d25aa571 ("perf: Capture branch privilege information") Suggested-by: Peter Zijlstra <peterz@infradead.org> Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Tested-by: Yifan Wu <wuyifan50@huawei.com> Link: https://patch.msgid.link/20260810133540.1947118-4-puranjay@kernel.org
2026-09-18Merge tag 'arm64-fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "In this batch we've got a couple of hibernation fixes, a couple of minor MTE fixes, some per-cpu codegen fixes (which were found as part of Mark's series adding preemptible this_cpu_*() operations) and a fix for the Arm CMN PMU driver. Summary: - Fix hypercall arguments when resetting EL2 vectors during hibernation - Fix hibernation with 52-bit capable kernels on machines without 52-bit addressing, similarly to the recent kexec fix - Fix a bunch of clumsy codegen issues with our per-cpu accessors - Fix MTE ptrace documentation to reflect the de-facto ABI behaviour - Fix pthread_join() usage in MTE selftest - Fix port selection in the Arm CMN PMU driver" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation kselftest/arm64: Fix size of thread_data values for pthread_join() arm64: percpu: Fix LSE operations on {8,16}-bit types arm64: percpu: Fix this_cpu_and() mask generation arm64: percpu: Fix this_cpu_write() casting arm64: hibernate: clone only the linear map that exists at runtime perf/arm-cmn: Fix wp_dev_sel2 setting for multi-DTM configurations arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc
2026-09-18perf/arm-cmn: Fix multi-filter encodingRobin Murphy
The current special-case for EVICT_STATE_SEL filtering effectively assigns the "filter" and "filter2" controls in the opposite order from how the CMN S3 r2 TRM states "Filtering is programmed in pmu_hbt_lbt_sel and pmu_evict_state_sel". On reflection, not only does this seem unnecessarily non-obvious to users, but it's also likely to be a problem for scaling to a full multi-filter abstraction in future. There is a logical order to filters based on their bitfield positions in the pmu_event_sel register, which the TRM descriptions allude to, and the cmn_filter_select enum already (almost) follows, so let's fix the UABI to follow suit while it's still unreleased. Fixes: 09178f536bb9 ("perf/arm-cmn: Plumb in new filter types") Signed-off-by: Robin Murphy <robin.murphy@arm.com> Reviewed-by: Ilkka Koskinen <ilkka@os.amperecomputing.com> Reviewed-by: Leo Yan <leo.yan@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-09-16drivers: perf: Use __DEVICE_ATTR() macro to initialize dev_ext_attributeThomas Weißschuh
The upcoming constification of the device_show_*() callback signatures requires the users to handle the transition automatically. Switch to the __DEVICE_ATTR() macro which can do this. Signed-off-by: Thomas Weißschuh <linux@weissschuh.net> Acked-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com> #for cxl_pmu Link: https://patch.msgid.link/20260907-sysfs-const-attr-dev_ext_attr-v2-2-bf53afe57071@weissschuh.net Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-09-11perf/arm-cmn: Fix wp_dev_sel2 setting for multi-DTM configurationsShouping Wang
When MXP_MULTIPLE_DTM_EN is TRUE, each DTM will monitor at most two device ports. In this case, {wp_dev_sel2, wp_dev_sel} will only use values 2'b00 and 2'b01 per DTM. Previously the setting allowed values beyond the supported range per DTM, which could cause each DTM to select invalid ports when MXP_MULTIPLE_DTM_EN is TRUE. Fix this by only setting CMN_DTM_WPn_CONFIG_WP_DEV_SEL2 when !multi_dtm. Fixes: 60d1504070c2 ("perf/arm-cmn: Support new IP features") Signed-off-by: Shouping Wang <allen.wang@hj-micro.com> Reviewed-by: Robin Murphy <robin.murphy@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-09-01perf: RISC-V: check cpu_hw_evt before dereference in overflow IRQXixin Liu
The overflow IRQ handler dereferences cpu_hw_evt before the null check. Move the check first. Defensive only; the cookie is valid on the normal path today. Fixes: a8625217a054 ("drivers/perf: riscv: Implement SBI PMU snapshot function") Assisted-by: DeepSeek:deepseek-v3 Signed-off-by: Xixin Liu <liuxixin@kylinos.cn> Link: https://patch.msgid.link/fdd42c791752.v2.1786420235.git.liuxixin@kylinos.cn Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-09-01perf: RISC-V: store available counter mask as bitmapXixin Liu
The available-counter mask was a single unsigned long, but iteration uses RISCV_MAX_COUNTERS, which is 64. On RV32 that reads past the object. Filling with an unsigned-long bit at index 32 and above is also wrong. Use DECLARE_BITMAP and set_bit/bitmap helpers. Walk each bitmap word into CFG_MATCH when checking events, when allocating an index, and when stopping all counters. Set the counter base to i times BITS_PER_LONG. Share the CFG_MATCH ecall through a small helper so the 32-bit argument split is not duplicated. On qemu-system-riscv32 the probe bitmap has bits above XLEN set, so the first word alone is not enough. Fixes: e9991434596f ("RISC-V: Add perf platform driver based on SBI PMU extension") Assisted-by: DeepSeek:deepseek-v3 Signed-off-by: Xixin Liu <liuxixin@kylinos.cn> Link: https://patch.msgid.link/prpmask02cmap.v2.1786434000.git.liuxixin@kylinos.cn Cc: stable@kernel.org [pjw@kernel.org: updated to apply; fixed checkpatch.pl issues] Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-08-31perf: RISC-V: use BIT_ULL for u64 overflow masksXixin Liu
Overflow status and restart masks are u64, but bits were built with BIT(). On RV32 that is an unsigned long shift, so indices >= 32 truncate or wrap and corrupt the mask. Use BIT_ULL() for those u64 bitops. Fixes: a8625217a054 ("drivers/perf: riscv: Implement SBI PMU snapshot function") Assisted-by: DeepSeek:deepseek-v3 Signed-off-by: Xixin Liu <liuxixin@kylinos.cn> Link: https://patch.msgid.link/prpmask01bitul.v2.1786434000.git.liuxixin@kylinos.cn Cc: stable@vger.kernel.org [pjw@kernel.org: updated to apply] Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-08-20Merge tag 'riscv-for-linus-7.3-mw1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V updates from Paul Walmsley - Add initial definitions and discovery for the Smcsrind, Sscsrind, Smcntrpmf, Ssccfg, Smcdeleg, Zicclsm, Ziccamoa, Ziccif, Ziccrse, Za64rs, and Ssqosid RISC-V ISA extensions - Improve the RISC-V update_mmu_cache_range() implementation by using flush-by-ASID, enabling performance improvements on microarchitectures that support related optimizations; and by taking advantage of the Svinval RISC-V ISA extension on microarchitectures that support it - Shrink CFI shadow stack allocation further (to 512MB) to save virtual address space (and physical memory on systems with strict overcommit policies) - Add initial CPU context switch support for QoS tagging (Ssqosid) - Change our vector misaligned access speed test code to be synchronous, avoiding a bunch of bugs related to unnecessary asynchronicity - Enable ARCH_HAS_ACPI_TABLE_UPGRADE for RISC-V to help with ACPI table debugging (similar to ARM64 and x86) - Extract vDSO section offsets at build time, rather than run time, to avoid the boot time overhead - Use assembler directives to control the use of instructions from the RISC-V ISA extensions Zacas and Zabha, rather than compiler -march flags that could affect the whole kernel (similar to ARM64) - Add a kselftest for kprobes support for the c.jal instruction on RISC-V - When UEFI runtime services are available, use them to restart and power off - Fix ARCH_HAS_ACPI_TABLE_UPGRADE for RISC-V by adding a missing include file to the ACPI code - Move contiguous DMA memory reservation later in the boot, to ensure that the correct global and per-node pools are allocated when CONFIG_CMA_SIZE_PERNUMA is enabled - Disallow probes on breakpoint handlers to avoid recursing indefinitely into do_trap_break() - Patch the compat vDSO during runtime alternatives processing, not only the standard vDSO - Remove some leftover XIP support elements missed by commit 9b3a2be84803 ("riscv: Remove support for XIP kernel") - Fix broadcast timer switching in ACPI LPI power states by implementing a RISC-V version of arch_get_idle_state_flags() - Miscellaneous fixes, including: vDSO makefile simplification; marking our default_power_off() as __noreturn; error path fixes in the PMU SBI perf driver; RISC-V extension capitalization consistency; the use of BIT() macros in one of our include files; and some documentation fixes * tag 'riscv-for-linus-7.3-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: (39 commits) RISC-V: hwprobe: Use BIT macro to avoid warnings riscv: alternative: Also patch the compat vDSO riscv: alternative: Use the statically extracted vDSO section offsets riscv: vdso: Add symbols for the alternative section boundaries riscv: Add Ziccamoa, Ziccif, Ziccrse, and Za64rs to cpufeature and hwprobe riscv: Add Zicclsm to cpufeature and hwprobe riscv: cpufeature: Clarify ISA spec version for canonical order riscv: Standardize extension capitalization riscv: kprobes: Prevent probes in breakpoint handlers riscv: cmpxchg: Use .option arch for Zacas and Zabha riscv: acpi: Handle LPI architectural context loss flags riscv: further remove XIP riscv: Add support for srmcfg CSR from Ssqosid extension riscv: Detect the Ssqosid extension dt-bindings: riscv: Add Ssqosid extension description dt-bindings: riscv: add Counter delegation ISA extensions description RISC-V: Add Ssccfg/Smcdeleg ISA extension definition and parsing RISC-V: Add Ssccfg extension CSR definition dt-bindings: riscv: add Smcntrpmf ISA extension description RISC-V: Add Smcntrpmf extension parsing ...
2026-08-20Merge tag 'bitmap-for-7.3' of https://github.com/norov/linuxLinus Torvalds
Pull bitmap updates from Yury Norov: "The usual set of fixes, cleanups and performance improvements together with a couple of new tests: - bitmap_find_next_zero_area_off() optimization (Sunyi) - bitmap_find_next_zero_area_off(): return size when no zero area is found (Yury) - bitmap vs IDA vs Maple Tree performance test (Yury) - get rid of cpumap_print_to_pagebuf() (Yury) - use nr_node_ids in __nodemask_pr_numnodes() (Li RongQing) - bitops: make the *_bit_le functions use unsigned long (Benjamin) - bitmap scatter & gather test fix (Christophe) - use __ASSEMBLER__ in bitmap header files (Thomas)" * tag 'bitmap-for-7.3' of https://github.com/norov/linux: (25 commits) lib: test bitmap vs IDA vs Maple Tree performance for region allocations bitmap: Return size when no zero area is found media: s5p-mfc: Treat bitmap size as allocation failure crypto: ccp: Treat bitmap size as allocation failure powerpc/msi: Treat bitmap size as allocation failure ARM: dma-mapping: Treat bitmap size as allocation failure bitmap: drop bitmap_next_set_region() nodemask: reduce bitmap width to nr_node_ids in __nodemask_pr_numnodes() bitmap: Properly initialise destination bitmap for scatter & gather test lib/bitmap-str: get rid of cpumap_print_to_pagebuf() perf: Use sysfs_emit() for cpumask show callbacks PCI/sysfs: Use sysfs_emit() for cpumask show callbacks RDMA/hfi1: Use sysfs_emit() for cpumask show helper hwtracing: hisi_ptt: Use sysfs_emit() for cpumask show fpga: dfl-fme-perf: Use sysfs_emit() for cpumask show devfreq: Use sysfs_emit() for cpumask show callbacks cpu: Use sysfs_emit() for cpumask show callback x86/events: Use sysfs_emit() for cpumask show callbacks powerpc: Use sysfs_emit() for cpumask show callbacks arm: Use sysfs_emit() for cpumask show callbacks ...
2026-08-07RISC-V: perf: fix resource cleanup on driver probe failureAtish Patra
Sashiko pointed out various UAF and memory leak issues around pmu_sbi_device_probe() error paths. If the probe fails, here are list of cleanups needed. a. Already registered pmu must be freed b. per cpu IRQ must be released c. pmu_ctr_list data structure must be freed d. cpu hotplug state must be cleaned up only if added. Fix the resource cleanup by reorganizing the code around probe failure. Reported-by: Sashiko AI <sashiko-bot@kernel.org> Reviewed-by: Charlie Jenkins <thecharlesjenkins@gmail.com> Signed-off-by: Atish Patra <atishp@meta.com> Link: https://patch.msgid.link/20260807-counter_delegation-v9-1-58658104e487@meta.com Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-08-07perf: arm_pmuv3: Zero initialize hw_id branch stack fieldJames Clark
PERF_SAMPLE_BRANCH_HW_INDEX is supported by BRBE so hw_id is passed to userspace, but it's never set by the BRBE driver. Zero initialize it as it should be according to the docs: * For the architectures whose raw branch records are * already stored in age order, the hw_idx should be 0. It's probably too risky to remove PERF_SAMPLE_BRANCH_HW_INDEX from BRBE now in case anyone is setting it and reading the value, but zero initializing the whole struct also protects against the same issue with new fields that are added in the future. Fixes: 58074a0fce66 ("perf: arm_pmuv3: Add support for the Branch Record Buffer Extension (BRBE)") Signed-off-by: James Clark <james.clark@linaro.org> Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06perf/arm-cmn: Support CMN S3 r2Robin Murphy
If you were disappointed at how minimal the initial CMN S3 support looked compared to previous versions, then oh boy is it time to put your party hats on... The biggest batch of incompatible changes yet comes not with a new CMN product, but a point release of an existing one. We've got new filters, loads of changes to existing events, register fields moved around for no good reason, and much, much more! On the upside, we do at least gain a means of working around the isolation feature. As such, for the sake of sanity in the driver it is easiest to split it into a distict "model" for our internal abstractions despite it bearing the same part number as r0/r1. Signed-off-by: Robin Murphy <robin.murphy@arm.com> Reviewed-by: Ilkka Koskinen <ilkka@os.amperecomputing.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06perf/arm-cmn: Plumb in new filter typesRobin Murphy
Add the logic to handle events with the upcoming new filter controls. Since for now we will have the sole invariant of all EVICT_STATE_SEL events having HBT_LBT_SEL as a secondary filter, for the sake of simplicity we can just special-case that, and save the complication of a full multi-filter abstraction until unavoidably necessary. Reviewed-by: Leo Yan <leo.yan@arm.com> Signed-off-by: Robin Murphy <robin.murphy@arm.com> Reviewed-by: Ilkka Koskinen <ilkka@os.amperecomputing.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06perf/arm-cmn: Refactor event filter dataRobin Murphy
The ABI hole I have dug myself into requires the driver to know which event encodings are associated with which particular filter control. Since we will soon have a notion of multiple filters per event, refactor the event data to encapsulate filters in an explicit structure, which can then more easily scale as an array in future. Signed-off-by: Robin Murphy <robin.murphy@arm.com> Reviewed-by: Ilkka Koskinen <ilkka@os.amperecomputing.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06perf/arm-cmn: Refactor event filter programmingRobin Murphy
We're soon going to need to cope with events having multiple filters, plus the filter fields themselves moving around, wherein any more inline if/else logic will struggle to scale. Add a more general abstraction for the node-specific filter controls, and rejig the pmu_event_sel filter programming around it in a more extensible manner. Reviewed-by: Ilkka Koskinen <ilkka@os.amperecomputing.com> Signed-off-by: Robin Murphy <robin.murphy@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06perf/arm-cmn: Rename filter variables for clarityRobin Murphy
CMN has already grown many more event-specific filters than the original Occupancy ID, but since they are all independent of each other we've just overloaded them onto the same name. Before we add yet more, and they begin to overlap, rename all our "occupid" variables to "filter" so that things can be a bit clearer and more consistent (but leaving the format attribute itself, to avoid UAPI concerns). Reviewed-by: Ilkka Koskinen <ilkka@os.amperecomputing.com> Signed-off-by: Robin Murphy <robin.murphy@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06perf/arm_cspmu: Support 64-bit programmers' modelRobin Murphy
The 64-bit Programmers' model extension, now named FEAT_CSPMU_EXT64, makes all the non-counter registers 64-bit as well, of which we most need to care PMEVFILTR<n>, PMEVTYPER<n>, and PMCR since it changes location. Our event config fields are ready for this internally, but we need a few more tweaks to propagate 64-bit values properly from end to end. Since 64-bit events leave no room for our existing "cycles" encoding, and we don't really expect to see implementations of it anyway, we deliberately omit generic support for the architectural fixed cycle counter in this case to save some bother. At worst, vendor modules can still implement their own encoding if they really want to. Signed-off-by: Robin Murphy <robin.murphy@arm.com> Reviewed-by: Ilkka Koskinen <ilkka@os.amperecomputing.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-04drivers/perf: hisi: Remove redundant dev_err()/dev_err_probe()Pan Chuang
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() and dev_err_probe() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Acked-by: Yushan Wang <wangyushan12@huawei.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-04perf: arm_cspmu: Remove redundant dev_err()Pan Chuang
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Reviewed-by: Ilkka Koskinen <ilkka@os.amperecomputing.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-04perf: Remove redundant dev_err()/dev_err_probe()Pan Chuang
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() and dev_err_probe() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Reviewed-by: Shuai Xue <xueshuai@linux.alibaba.com> Acked-by: Frank Li <Frank.Li@kernel.org> Reviewed-by: Xu Yang <xu.yang_2@nxp.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-02perf: arm_pmu_acpi: Get rid of the edge-triggered interrupt oddityMarc Zyngier
The ACPI spec bizarrely indicates that the PMU interrupt can be edge-triggered, which contradicts the very basics of the PMU architecture (SW is required to clear the interrupt condition for the level to drop). Remove the code parsing this flag and always flag the interrupt as level triggered, no matter what firmware says. Signed-off-by: Marc Zyngier <maz@kernel.org> Reviewed-by: Zenghui Yu <yuzenghui@huawei.com> Signed-off-by: Will Deacon <will@kernel.org>