* [PATCH 1/9] coresight: cpu-debug: Fix PM usage counter leak in debug_enable_func()
2026-10-27 14:55 [PATCH 0/9] coresight: Fix assorted bugs reported by Sashiko James Clark
@ 2026-10-27 14:55 ` James Clark
2026-10-27 18:08 ` Leo Yan
2026-10-27 14:55 ` [PATCH 2/9] coresight: etm4x: Remove perf symlink if config registration fails James Clark
` (7 subsequent siblings)
8 siblings, 1 reply; 11+ messages in thread
From: James Clark @ 2026-10-27 14:55 UTC (permalink / raw)
To: Suzuki K Poulose, Mike Leach, Leo Yan, Yeoreum Yun
Cc: coresight, linux-kernel, James Clark, Sashiko
pm_runtime_get_sync() increments the usage counter even when it fails,
but the failing CPU isn't added to the rollback mask, so its reference
is never dropped. Use pm_runtime_resume_and_get() which drops the
reference itself on failure.
Fixes: 2227b7c74634 ("coresight: add support for CPU debug module")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/bug/linux-2ff60e6d-33ac-4a69-9c62-63eb482f1913
Signed-off-by: James Clark <james.clark@linaro.org>
---
drivers/hwtracing/coresight/coresight-cpu-debug.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/hwtracing/coresight/coresight-cpu-debug.c b/drivers/hwtracing/coresight/coresight-cpu-debug.c
index 3a806c1d50ea..06e55dfa6b91 100644
--- a/drivers/hwtracing/coresight/coresight-cpu-debug.c
+++ b/drivers/hwtracing/coresight/coresight-cpu-debug.c
@@ -429,7 +429,7 @@ static int debug_enable_func(void)
if (!drvdata)
continue;
- ret = pm_runtime_get_sync(drvdata->dev);
+ ret = pm_runtime_resume_and_get(drvdata->dev);
if (ret < 0)
goto err;
else
@@ -440,7 +440,7 @@ static int debug_enable_func(void)
err:
/*
- * If pm_runtime_get_sync() has failed, need rollback on
+ * If pm_runtime_resume_and_get() has failed, need rollback on
* all the other CPUs that have been enabled before that.
*/
for_each_cpu(cpu, &mask) {
--
2.43.0
^ permalink raw reply [flat|nested] 11+ messages in thread* Re: [PATCH 1/9] coresight: cpu-debug: Fix PM usage counter leak in debug_enable_func()
2026-10-27 14:55 ` [PATCH 1/9] coresight: cpu-debug: Fix PM usage counter leak in debug_enable_func() James Clark
@ 2026-10-27 18:08 ` Leo Yan
0 siblings, 0 replies; 11+ messages in thread
From: Leo Yan @ 2026-10-27 18:08 UTC (permalink / raw)
To: James Clark
Cc: Suzuki K Poulose, Mike Leach, Yeoreum Yun, coresight,
linux-kernel, Sashiko
On Tue, Oct 27, 2026 at 02:55:47PM +0000, James Clark wrote:
> pm_runtime_get_sync() increments the usage counter even when it fails,
> but the failing CPU isn't added to the rollback mask, so its reference
> is never dropped. Use pm_runtime_resume_and_get() which drops the
> reference itself on failure.
>
> Fixes: 2227b7c74634 ("coresight: add support for CPU debug module")
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://sashiko.dev/#/bug/linux-2ff60e6d-33ac-4a69-9c62-63eb482f1913
> Signed-off-by: James Clark <james.clark@linaro.org>
This duplicates with:
https://lore.kernel.org/linux-arm-kernel/20260911-b4-coresight-runtime-pm-failures-v1-1-acdf49756e11@qti.qualcomm.com/#r
I'd prefer to pick up that patch, as it has fixed all drivers in the
CoreSight directory.
Thanks,
Leo
^ permalink raw reply [flat|nested] 11+ messages in thread
* [PATCH 2/9] coresight: etm4x: Remove perf symlink if config registration fails
2026-10-27 14:55 [PATCH 0/9] coresight: Fix assorted bugs reported by Sashiko James Clark
2026-10-27 14:55 ` [PATCH 1/9] coresight: cpu-debug: Fix PM usage counter leak in debug_enable_func() James Clark
@ 2026-10-27 14:55 ` James Clark
2026-10-27 14:55 ` [PATCH 3/9] coresight: etm4x: Fix truncation of nr_ext_inp James Clark
` (6 subsequent siblings)
8 siblings, 0 replies; 11+ messages in thread
From: James Clark @ 2026-10-27 14:55 UTC (permalink / raw)
To: Suzuki K Poulose, Mike Leach, Leo Yan, Yeoreum Yun
Cc: coresight, linux-kernel, James Clark, Sashiko
If etm4_cscfg_register() fails, the perf symlink created just before it
is left behind in the etm_pmu device's directory. Remove it in the same
way as etm4_remove_dev() does.
Fixes: 810ac401db1f ("coresight: etm4x: Add complex configuration handlers to etmv4")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/bug/linux-5a385158-37fb-48f1-a8c7-28e86e07848a
Signed-off-by: James Clark <james.clark@linaro.org>
---
drivers/hwtracing/coresight/coresight-etm4x-core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
index e21be6468e95..ba21fe12870b 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
+++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
@@ -2258,6 +2258,7 @@ static int etm4_add_coresight_dev(struct etm4_init_arg *init_arg)
/* register with config infrastructure & load any current features */
ret = etm4_cscfg_register(drvdata->csdev);
if (ret) {
+ etm_perf_symlink(drvdata->csdev, false);
coresight_unregister(drvdata->csdev);
return ret;
}
--
2.43.0
^ permalink raw reply [flat|nested] 11+ messages in thread* [PATCH 3/9] coresight: etm4x: Fix truncation of nr_ext_inp
2026-10-27 14:55 [PATCH 0/9] coresight: Fix assorted bugs reported by Sashiko James Clark
2026-10-27 14:55 ` [PATCH 1/9] coresight: cpu-debug: Fix PM usage counter leak in debug_enable_func() James Clark
2026-10-27 14:55 ` [PATCH 2/9] coresight: etm4x: Remove perf symlink if config registration fails James Clark
@ 2026-10-27 14:55 ` James Clark
2026-10-27 14:55 ` [PATCH 4/9] coresight: etm-perf: Fix sink device reference leak in etm_setup_aux() James Clark
` (5 subsequent siblings)
8 siblings, 0 replies; 11+ messages in thread
From: James Clark @ 2026-10-27 14:55 UTC (permalink / raw)
To: Suzuki K Poulose, Mike Leach, Leo Yan, Yeoreum Yun
Cc: coresight, linux-kernel, James Clark, Sashiko
TRCIDR5.NUMEXTIN is a 9 bit field but it's stored in a u8, so values of
256 or more are truncated. Make nr_ext_inp a u16.
Fixes: 2e1cdfe184b5 ("coresight-etm4x: Adding CoreSight ETM4x driver")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/bug/linux-b3468d48-ff08-49c9-9ed8-fb6af6979e1e
Signed-off-by: James Clark <james.clark@linaro.org>
---
drivers/hwtracing/coresight/coresight-etm4x.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h
index 5417280cdb27..8628dd4e15db 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x.h
+++ b/drivers/hwtracing/coresight/coresight-etm4x.h
@@ -874,7 +874,7 @@ struct etmv4_caps {
u8 nr_pe_cmp;
u8 nr_addr_cmp;
u8 nr_cntr;
- u8 nr_ext_inp;
+ u16 nr_ext_inp;
u8 numcidc;
u8 numextinsel;
u8 numvmidc;
--
2.43.0
^ permalink raw reply [flat|nested] 11+ messages in thread* [PATCH 4/9] coresight: etm-perf: Fix sink device reference leak in etm_setup_aux()
2026-10-27 14:55 [PATCH 0/9] coresight: Fix assorted bugs reported by Sashiko James Clark
` (2 preceding siblings ...)
2026-10-27 14:55 ` [PATCH 3/9] coresight: etm4x: Fix truncation of nr_ext_inp James Clark
@ 2026-10-27 14:55 ` James Clark
2026-10-27 14:55 ` [PATCH 5/9] coresight: syscfg: Take csdev lock when removing owned features James Clark
` (4 subsequent siblings)
8 siblings, 0 replies; 11+ messages in thread
From: James Clark @ 2026-10-27 14:55 UTC (permalink / raw)
To: Suzuki K Poulose, Mike Leach, Leo Yan, Yeoreum Yun
Cc: coresight, linux-kernel, James Clark, Sashiko
coresight_get_sink_by_id() returns the sink with a reference taken by
bus_find_device(), but etm_setup_aux() never drops it. The paths built
for each CPU take their own references on the sink, so drop the lookup
reference before returning on both the success and error paths.
Fixes: 226443925887 ("coresight: Use event attributes for sink selection")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/bug/linux-89fe1ee7-7e2f-4c78-a8e6-93a1a260015b
Signed-off-by: James Clark <james.clark@linaro.org>
---
drivers/hwtracing/coresight/coresight-etm-perf.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/hwtracing/coresight/coresight-etm-perf.c b/drivers/hwtracing/coresight/coresight-etm-perf.c
index 5261061e4dd4..6946058b5401 100644
--- a/drivers/hwtracing/coresight/coresight-etm-perf.c
+++ b/drivers/hwtracing/coresight/coresight-etm-perf.c
@@ -519,10 +519,14 @@ static void *etm_setup_aux(struct perf_event *event, void **pages,
if (!event_data->snk_config)
goto err;
+ if (user_sink)
+ put_device(&user_sink->dev);
mutex_unlock(&coresight_mutex);
return event_data;
err:
+ if (user_sink)
+ put_device(&user_sink->dev);
mutex_unlock(&coresight_mutex);
etm_free_aux(event_data);
return NULL;
--
2.43.0
^ permalink raw reply [flat|nested] 11+ messages in thread* [PATCH 5/9] coresight: syscfg: Take csdev lock when removing owned features
2026-10-27 14:55 [PATCH 0/9] coresight: Fix assorted bugs reported by Sashiko James Clark
` (3 preceding siblings ...)
2026-10-27 14:55 ` [PATCH 4/9] coresight: etm-perf: Fix sink device reference leak in etm_setup_aux() James Clark
@ 2026-10-27 14:55 ` James Clark
2026-10-27 14:55 ` [PATCH 6/9] coresight: syscfg: Fix deadlock in cscfg_create_device() error path James Clark
` (3 subsequent siblings)
8 siblings, 0 replies; 11+ messages in thread
From: James Clark @ 2026-10-27 14:55 UTC (permalink / raw)
To: Suzuki K Poulose, Mike Leach, Leo Yan, Yeoreum Yun
Cc: coresight, linux-kernel, James Clark, Sashiko
cscfg_remove_owned_csdev_features() modifies csdev->feature_csdev_list
without holding csdev->cscfg_csdev_lock, but other users of the list
like cscfg_csdev_reset_feats() take it. Take the lock in the same way
as cscfg_remove_owned_csdev_configs() already does for the config list.
Fixes: 02bd588e12df ("coresight: configuration: Update API to permit dynamic load/unload")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/bug/linux-6bcce2f2-5aba-40a4-8946-4d843ec84683
Signed-off-by: James Clark <james.clark@linaro.org>
---
drivers/hwtracing/coresight/coresight-syscfg.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/hwtracing/coresight/coresight-syscfg.c b/drivers/hwtracing/coresight/coresight-syscfg.c
index 7e3c9844bc00..f93150a1bee4 100644
--- a/drivers/hwtracing/coresight/coresight-syscfg.c
+++ b/drivers/hwtracing/coresight/coresight-syscfg.c
@@ -415,6 +415,8 @@ static void cscfg_remove_owned_csdev_features(struct coresight_device *csdev, vo
if (list_empty(&csdev->feature_csdev_list))
return;
+ guard(raw_spinlock_irqsave)(&csdev->cscfg_csdev_lock);
+
list_for_each_entry_safe(feat_csdev, tmp, &csdev->feature_csdev_list, node) {
if (feat_csdev->feat_desc->load_owner == load_owner)
list_del(&feat_csdev->node);
--
2.43.0
^ permalink raw reply [flat|nested] 11+ messages in thread* [PATCH 6/9] coresight: syscfg: Fix deadlock in cscfg_create_device() error path
2026-10-27 14:55 [PATCH 0/9] coresight: Fix assorted bugs reported by Sashiko James Clark
` (4 preceding siblings ...)
2026-10-27 14:55 ` [PATCH 5/9] coresight: syscfg: Take csdev lock when removing owned features James Clark
@ 2026-10-27 14:55 ` James Clark
2026-10-27 14:55 ` [PATCH 7/9] coresight: Fix resource leaks on coresight_build_path() errors James Clark
` (2 subsequent siblings)
8 siblings, 0 replies; 11+ messages in thread
From: James Clark @ 2026-10-27 14:55 UTC (permalink / raw)
To: Suzuki K Poulose, Mike Leach, Leo Yan, Yeoreum Yun
Cc: coresight, linux-kernel, James Clark, Sashiko
If device_register() fails, put_device() is called with cscfg_mutex
held. This calls cscfg_dev_release() which takes cscfg_mutex again and
deadlocks. Drop the mutex before calling put_device().
Fixes: 199380decc5f ("coresight: configfs: Fix unload of configurations on module exit")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/bug/linux-e07a8e2f-c34e-4609-a667-9f294c6fcf29
Signed-off-by: James Clark <james.clark@linaro.org>
---
drivers/hwtracing/coresight/coresight-syscfg.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/hwtracing/coresight/coresight-syscfg.c b/drivers/hwtracing/coresight/coresight-syscfg.c
index f93150a1bee4..92aef8b9c734 100644
--- a/drivers/hwtracing/coresight/coresight-syscfg.c
+++ b/drivers/hwtracing/coresight/coresight-syscfg.c
@@ -1217,8 +1217,12 @@ static int cscfg_create_device(void)
dev->init_name = "cs_system_cfg";
err = device_register(dev);
- if (err)
+ if (err) {
+ /* cscfg_dev_release() takes cscfg_mutex */
+ mutex_unlock(&cscfg_mutex);
put_device(dev);
+ return err;
+ }
create_dev_exit_unlock:
mutex_unlock(&cscfg_mutex);
--
2.43.0
^ permalink raw reply [flat|nested] 11+ messages in thread* [PATCH 7/9] coresight: Fix resource leaks on coresight_build_path() errors
2026-10-27 14:55 [PATCH 0/9] coresight: Fix assorted bugs reported by Sashiko James Clark
` (5 preceding siblings ...)
2026-10-27 14:55 ` [PATCH 6/9] coresight: syscfg: Fix deadlock in cscfg_create_device() error path James Clark
@ 2026-10-27 14:55 ` James Clark
2026-10-27 14:55 ` [PATCH 8/9] coresight: etm3x: Don't ignore etm_parse_event_config() errors James Clark
2026-10-27 14:55 ` [PATCH 9/9] coresight: etm3x: Prohibit modifying seq_curr_state while session is enabled James Clark
8 siblings, 0 replies; 11+ messages in thread
From: James Clark @ 2026-10-27 14:55 UTC (permalink / raw)
To: Suzuki K Poulose, Mike Leach, Leo Yan, Yeoreum Yun
Cc: coresight, linux-kernel, James Clark, Sashiko
If allocating the path node fails in _coresight_build_path(), the
references taken by coresight_grab_device() just before are leaked.
Drop them before returning.
Also, when _coresight_build_path() fails, nodes for devices further
along the path may have already been added and grabbed, but
coresight_build_path() only frees the path itself. Use
coresight_release_path_locked() to drop and free any nodes too.
Fixes: b3e94405941e ("coresight: associating path with session rather than tracer")
Fixes: 32b0707a4182 ("coresight: Add try_get_module() in coresight_grab_device()")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/bug/linux-fe264804-52b6-4b0d-a43e-184e228df19b
Signed-off-by: James Clark <james.clark@linaro.org>
---
drivers/hwtracing/coresight/coresight-core.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c
index fe64c509bf67..1d9c7ced39d2 100644
--- a/drivers/hwtracing/coresight/coresight-core.c
+++ b/drivers/hwtracing/coresight/coresight-core.c
@@ -1103,8 +1103,10 @@ static int _coresight_build_path(struct coresight_device *csdev,
return ret;
node = kzalloc_obj(struct coresight_node);
- if (!node)
+ if (!node) {
+ coresight_drop_device(csdev);
return -ENOMEM;
+ }
node->csdev = csdev;
list_add(&node->link, &path->path_list);
@@ -1131,7 +1133,7 @@ struct coresight_path *coresight_build_path(struct coresight_device *source,
rc = _coresight_build_path(source, source, sink, path);
if (rc) {
- kfree(path);
+ coresight_release_path_locked(path);
return ERR_PTR(rc);
}
--
2.43.0
^ permalink raw reply [flat|nested] 11+ messages in thread* [PATCH 8/9] coresight: etm3x: Don't ignore etm_parse_event_config() errors
2026-10-27 14:55 [PATCH 0/9] coresight: Fix assorted bugs reported by Sashiko James Clark
` (6 preceding siblings ...)
2026-10-27 14:55 ` [PATCH 7/9] coresight: Fix resource leaks on coresight_build_path() errors James Clark
@ 2026-10-27 14:55 ` James Clark
2026-10-27 14:55 ` [PATCH 9/9] coresight: etm3x: Prohibit modifying seq_curr_state while session is enabled James Clark
8 siblings, 0 replies; 11+ messages in thread
From: James Clark @ 2026-10-27 14:55 UTC (permalink / raw)
To: Suzuki K Poulose, Mike Leach, Leo Yan, Yeoreum Yun
Cc: coresight, linux-kernel, James Clark, Sashiko
etm_parse_event_config() can fail, for example if an invalid timestamp
level is requested, but etm_enable_perf() ignores the error and enables
the tracer anyway. Roll back to disabled mode and return the error
instead, like etm4_enable_perf() does.
Fixes: 882d5e112491 ("coresight: etm3x: implementing perf_enable/disable() API")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/bug/linux-bc35b336-f835-40fa-89d9-7a580efc3b53
Signed-off-by: James Clark <james.clark@linaro.org>
---
drivers/hwtracing/coresight/coresight-etm3x-core.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/hwtracing/coresight/coresight-etm3x-core.c b/drivers/hwtracing/coresight/coresight-etm3x-core.c
index b670a324bb41..db8413522d72 100644
--- a/drivers/hwtracing/coresight/coresight-etm3x-core.c
+++ b/drivers/hwtracing/coresight/coresight-etm3x-core.c
@@ -487,7 +487,11 @@ static int etm_enable_perf(struct coresight_device *csdev,
return -EBUSY;
/* Configure the tracer based on the session's specifics */
- etm_parse_event_config(drvdata, event);
+ ret = etm_parse_event_config(drvdata, event);
+ if (ret) {
+ coresight_set_mode(csdev, CS_MODE_DISABLED);
+ return ret;
+ }
drvdata->traceid = path->trace_id;
/* And enable it */
--
2.43.0
^ permalink raw reply [flat|nested] 11+ messages in thread* [PATCH 9/9] coresight: etm3x: Prohibit modifying seq_curr_state while session is enabled
2026-10-27 14:55 [PATCH 0/9] coresight: Fix assorted bugs reported by Sashiko James Clark
` (7 preceding siblings ...)
2026-10-27 14:55 ` [PATCH 8/9] coresight: etm3x: Don't ignore etm_parse_event_config() errors James Clark
@ 2026-10-27 14:55 ` James Clark
8 siblings, 0 replies; 11+ messages in thread
From: James Clark @ 2026-10-27 14:55 UTC (permalink / raw)
To: Suzuki K Poulose, Mike Leach, Leo Yan, Yeoreum Yun
Cc: coresight, linux-kernel, James Clark, Sashiko
When a sysfs session is disabled, seq_curr_state is read back from the
hardware into sysfs_config, overwriting any value written while the
session was enabled. Return -EBUSY in that case.
Do the mode check and the write under drvdata->spinlock. etm_enable_sysfs()
takes the mode before copying sysfs_config to curr_config under the same
lock, so either the new value is included in the copy, or the store sees
that the session is enabled. etm_disable_sysfs() does the read back before
releasing the mode, so a store can't succeed until it's done.
Fixes: a939fc5a71ad ("coresight-etm: add CoreSight ETM/PTM driver")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/bug/linux-d70beb3d-d997-429d-9828-d396e1bbfbb5
Signed-off-by: James Clark <james.clark@linaro.org>
---
drivers/hwtracing/coresight/coresight-etm3x-sysfs.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/hwtracing/coresight/coresight-etm3x-sysfs.c b/drivers/hwtracing/coresight/coresight-etm3x-sysfs.c
index d185fb8270e1..08c10fd146d5 100644
--- a/drivers/hwtracing/coresight/coresight-etm3x-sysfs.c
+++ b/drivers/hwtracing/coresight/coresight-etm3x-sysfs.c
@@ -1014,6 +1014,11 @@ static ssize_t seq_curr_state_store(struct device *dev,
if (val > ETM_SEQ_STATE_MAX_VAL)
return -EINVAL;
+ guard(spinlock)(&drvdata->spinlock);
+ if (IS_ERR_OR_NULL(drvdata->csdev) ||
+ coresight_get_mode(drvdata->csdev) == CS_MODE_SYSFS)
+ return -EBUSY;
+
sysfs_config->seq_curr_state = val;
return size;
--
2.43.0
^ permalink raw reply [flat|nested] 11+ messages in thread