[PATCH 0/9] coresight: Fix assorted bugs reported by Sashiko

[PATCH 0/9] coresight: Fix assorted bugs reported by Sashiko

[James Clark]

Small fixes for bugs in the CoreSight drivers that were found by
Sashiko. Mostly reference and resource leaks on error paths, plus a
deadlock, a missing lock, and a sysfs store that should return -EBUSY
while a sysfs session is enabled.

This series depends on "coresight: Prevent per-thread events from
sharing a sink" v4 [1]. That series takes coresight_mutex for perf AUX
setup and adds coresight_release_path_locked(), which the
etm_setup_aux() and coresight_build_path() fixes here are based on.

[1]: https://lore.kernel.org/r/20261016-james-cs-multiple-per-threads-v4-0-dedf961aca0e@linaro.org/

Signed-off-by: James Clark <james.clark@linaro.org>
---
James Clark (9):
      coresight: cpu-debug: Fix PM usage counter leak in debug_enable_func()
      coresight: etm4x: Remove perf symlink if config registration fails
      coresight: etm4x: Fix truncation of nr_ext_inp
      coresight: etm-perf: Fix sink device reference leak in etm_setup_aux()
      coresight: syscfg: Take csdev lock when removing owned features
      coresight: syscfg: Fix deadlock in cscfg_create_device() error path
      coresight: Fix resource leaks on coresight_build_path() errors
      coresight: etm3x: Don't ignore etm_parse_event_config() errors
      coresight: etm3x: Prohibit modifying seq_curr_state while session is enabled

 drivers/hwtracing/coresight/coresight-core.c        | 6 ++++--
 drivers/hwtracing/coresight/coresight-cpu-debug.c   | 4 ++--
 drivers/hwtracing/coresight/coresight-etm-perf.c    | 4 ++++
 drivers/hwtracing/coresight/coresight-etm3x-core.c  | 6 +++++-
 drivers/hwtracing/coresight/coresight-etm3x-sysfs.c | 5 +++++
 drivers/hwtracing/coresight/coresight-etm4x-core.c  | 1 +
 drivers/hwtracing/coresight/coresight-etm4x.h       | 2 +-
 drivers/hwtracing/coresight/coresight-syscfg.c      | 8 +++++++-
 8 files changed, 29 insertions(+), 7 deletions(-)
---
base-commit: 343cfcbb3ecfdb80aa576a428cfa3b65ad783842
change-id: 20261027-james-cs-sashiko-easy-fixes-1-692d80016a89
prerequisite-message-id: <20261016-james-cs-multiple-per-threads-v4-0-dedf961aca0e@linaro.org>
prerequisite-patch-id: 81acda380ba25acd3845eb58d5ded812175b9631
prerequisite-patch-id: 430caddc9c87948d4e9a0d1967bf3d8a50bca06b
prerequisite-patch-id: 633377150141300f7578b265fcc02eba52e592a8
prerequisite-patch-id: 9a82ffe5d705ac1fdf1250ff6bf242cfcd9d8fbf
prerequisite-patch-id: cf211801575d6bd0aa7fc0f6e19c3b90cea446a0
prerequisite-patch-id: d22fee48bf4aa3e01536e4683ccd797b3dbe1c91
prerequisite-patch-id: 55eeffb37cae55a1f47c2827899e0512b47a6efa
prerequisite-patch-id: c542d74cd4bc76158d5872bab12b8bd7a00f0c27
prerequisite-patch-id: 71cd37ed83d3e01d7a0321cdfa5cfc5ee113fe7b
prerequisite-patch-id: 74c1e3ed6dba4e25bfd3c39f06d43b079eed45e1

Best regards,
--  
James Clark <james.clark@linaro.org>

[PATCH 1/9] coresight: cpu-debug: Fix PM usage counter leak in debug_enable_func()

[James Clark]

pm_runtime_get_sync() increments the usage counter even when it fails,
but the failing CPU isn't added to the rollback mask, so its reference
is never dropped. Use pm_runtime_resume_and_get() which drops the
reference itself on failure.

Fixes: 2227b7c74634 ("coresight: add support for CPU debug module")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/bug/linux-2ff60e6d-33ac-4a69-9c62-63eb482f1913
Signed-off-by: James Clark <james.clark@linaro.org>
---
 drivers/hwtracing/coresight/coresight-cpu-debug.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/hwtracing/coresight/coresight-cpu-debug.c b/drivers/hwtracing/coresight/coresight-cpu-debug.c
index 3a806c1d50ea..06e55dfa6b91 100644
--- a/drivers/hwtracing/coresight/coresight-cpu-debug.c
+++ b/drivers/hwtracing/coresight/coresight-cpu-debug.c
@@ -429,7 +429,7 @@ static int debug_enable_func(void)
 		if (!drvdata)
 			continue;
 
-		ret = pm_runtime_get_sync(drvdata->dev);
+		ret = pm_runtime_resume_and_get(drvdata->dev);
 		if (ret < 0)
 			goto err;
 		else
@@ -440,7 +440,7 @@ static int debug_enable_func(void)
 
 err:
 	/*
-	 * If pm_runtime_get_sync() has failed, need rollback on
+	 * If pm_runtime_resume_and_get() has failed, need rollback on
 	 * all the other CPUs that have been enabled before that.
 	 */
 	for_each_cpu(cpu, &mask) {

-- 
2.43.0

[PATCH 2/9] coresight: etm4x: Remove perf symlink if config registration fails

[James Clark]

If etm4_cscfg_register() fails, the perf symlink created just before it
is left behind in the etm_pmu device's directory. Remove it in the same
way as etm4_remove_dev() does.

Fixes: 810ac401db1f ("coresight: etm4x: Add complex configuration handlers to etmv4")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/bug/linux-5a385158-37fb-48f1-a8c7-28e86e07848a
Signed-off-by: James Clark <james.clark@linaro.org>
---
 drivers/hwtracing/coresight/coresight-etm4x-core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
index e21be6468e95..ba21fe12870b 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
+++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
@@ -2258,6 +2258,7 @@ static int etm4_add_coresight_dev(struct etm4_init_arg *init_arg)
 	/* register with config infrastructure & load any current features */
 	ret = etm4_cscfg_register(drvdata->csdev);
 	if (ret) {
+		etm_perf_symlink(drvdata->csdev, false);
 		coresight_unregister(drvdata->csdev);
 		return ret;
 	}

-- 
2.43.0

[PATCH 3/9] coresight: etm4x: Fix truncation of nr_ext_inp

[James Clark]

TRCIDR5.NUMEXTIN is a 9 bit field but it's stored in a u8, so values of
256 or more are truncated. Make nr_ext_inp a u16.

Fixes: 2e1cdfe184b5 ("coresight-etm4x: Adding CoreSight ETM4x driver")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/bug/linux-b3468d48-ff08-49c9-9ed8-fb6af6979e1e
Signed-off-by: James Clark <james.clark@linaro.org>
---
 drivers/hwtracing/coresight/coresight-etm4x.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h
index 5417280cdb27..8628dd4e15db 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x.h
+++ b/drivers/hwtracing/coresight/coresight-etm4x.h
@@ -874,7 +874,7 @@ struct etmv4_caps {
 	u8	nr_pe_cmp;
 	u8	nr_addr_cmp;
 	u8	nr_cntr;
-	u8	nr_ext_inp;
+	u16	nr_ext_inp;
 	u8	numcidc;
 	u8	numextinsel;
 	u8	numvmidc;

-- 
2.43.0

[PATCH 4/9] coresight: etm-perf: Fix sink device reference leak in etm_setup_aux()

[James Clark]

coresight_get_sink_by_id() returns the sink with a reference taken by
bus_find_device(), but etm_setup_aux() never drops it. The paths built
for each CPU take their own references on the sink, so drop the lookup
reference before returning on both the success and error paths.

Fixes: 226443925887 ("coresight: Use event attributes for sink selection")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/bug/linux-89fe1ee7-7e2f-4c78-a8e6-93a1a260015b
Signed-off-by: James Clark <james.clark@linaro.org>
---
 drivers/hwtracing/coresight/coresight-etm-perf.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/hwtracing/coresight/coresight-etm-perf.c b/drivers/hwtracing/coresight/coresight-etm-perf.c
index 5261061e4dd4..6946058b5401 100644
--- a/drivers/hwtracing/coresight/coresight-etm-perf.c
+++ b/drivers/hwtracing/coresight/coresight-etm-perf.c
@@ -519,10 +519,14 @@ static void *etm_setup_aux(struct perf_event *event, void **pages,
 	if (!event_data->snk_config)
 		goto err;
 
+	if (user_sink)
+		put_device(&user_sink->dev);
 	mutex_unlock(&coresight_mutex);
 	return event_data;
 
 err:
+	if (user_sink)
+		put_device(&user_sink->dev);
 	mutex_unlock(&coresight_mutex);
 	etm_free_aux(event_data);
 	return NULL;

-- 
2.43.0

[PATCH 5/9] coresight: syscfg: Take csdev lock when removing owned features

[James Clark]

cscfg_remove_owned_csdev_features() modifies csdev->feature_csdev_list
without holding csdev->cscfg_csdev_lock, but other users of the list
like cscfg_csdev_reset_feats() take it. Take the lock in the same way
as cscfg_remove_owned_csdev_configs() already does for the config list.

Fixes: 02bd588e12df ("coresight: configuration: Update API to permit dynamic load/unload")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/bug/linux-6bcce2f2-5aba-40a4-8946-4d843ec84683
Signed-off-by: James Clark <james.clark@linaro.org>
---
 drivers/hwtracing/coresight/coresight-syscfg.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/hwtracing/coresight/coresight-syscfg.c b/drivers/hwtracing/coresight/coresight-syscfg.c
index 7e3c9844bc00..f93150a1bee4 100644
--- a/drivers/hwtracing/coresight/coresight-syscfg.c
+++ b/drivers/hwtracing/coresight/coresight-syscfg.c
@@ -415,6 +415,8 @@ static void cscfg_remove_owned_csdev_features(struct coresight_device *csdev, vo
 	if (list_empty(&csdev->feature_csdev_list))
 		return;
 
+	guard(raw_spinlock_irqsave)(&csdev->cscfg_csdev_lock);
+
 	list_for_each_entry_safe(feat_csdev, tmp, &csdev->feature_csdev_list, node) {
 		if (feat_csdev->feat_desc->load_owner == load_owner)
 			list_del(&feat_csdev->node);

-- 
2.43.0

[PATCH 6/9] coresight: syscfg: Fix deadlock in cscfg_create_device() error path

[James Clark]

If device_register() fails, put_device() is called with cscfg_mutex
held. This calls cscfg_dev_release() which takes cscfg_mutex again and
deadlocks. Drop the mutex before calling put_device().

Fixes: 199380decc5f ("coresight: configfs: Fix unload of configurations on module exit")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/bug/linux-e07a8e2f-c34e-4609-a667-9f294c6fcf29
Signed-off-by: James Clark <james.clark@linaro.org>
---
 drivers/hwtracing/coresight/coresight-syscfg.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/hwtracing/coresight/coresight-syscfg.c b/drivers/hwtracing/coresight/coresight-syscfg.c
index f93150a1bee4..92aef8b9c734 100644
--- a/drivers/hwtracing/coresight/coresight-syscfg.c
+++ b/drivers/hwtracing/coresight/coresight-syscfg.c
@@ -1217,8 +1217,12 @@ static int cscfg_create_device(void)
 	dev->init_name = "cs_system_cfg";
 
 	err = device_register(dev);
-	if (err)
+	if (err) {
+		/* cscfg_dev_release() takes cscfg_mutex */
+		mutex_unlock(&cscfg_mutex);
 		put_device(dev);
+		return err;
+	}
 
 create_dev_exit_unlock:
 	mutex_unlock(&cscfg_mutex);

-- 
2.43.0

[PATCH 7/9] coresight: Fix resource leaks on coresight_build_path() errors

[James Clark]

If allocating the path node fails in _coresight_build_path(), the
references taken by coresight_grab_device() just before are leaked.
Drop them before returning.

Also, when _coresight_build_path() fails, nodes for devices further
along the path may have already been added and grabbed, but
coresight_build_path() only frees the path itself. Use
coresight_release_path_locked() to drop and free any nodes too.

Fixes: b3e94405941e ("coresight: associating path with session rather than tracer")
Fixes: 32b0707a4182 ("coresight: Add try_get_module() in coresight_grab_device()")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/bug/linux-fe264804-52b6-4b0d-a43e-184e228df19b
Signed-off-by: James Clark <james.clark@linaro.org>
---
 drivers/hwtracing/coresight/coresight-core.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c
index fe64c509bf67..1d9c7ced39d2 100644
--- a/drivers/hwtracing/coresight/coresight-core.c
+++ b/drivers/hwtracing/coresight/coresight-core.c
@@ -1103,8 +1103,10 @@ static int _coresight_build_path(struct coresight_device *csdev,
 		return ret;
 
 	node = kzalloc_obj(struct coresight_node);
-	if (!node)
+	if (!node) {
+		coresight_drop_device(csdev);
 		return -ENOMEM;
+	}
 
 	node->csdev = csdev;
 	list_add(&node->link, &path->path_list);
@@ -1131,7 +1133,7 @@ struct coresight_path *coresight_build_path(struct coresight_device *source,
 
 	rc = _coresight_build_path(source, source, sink, path);
 	if (rc) {
-		kfree(path);
+		coresight_release_path_locked(path);
 		return ERR_PTR(rc);
 	}
 

-- 
2.43.0

[PATCH 8/9] coresight: etm3x: Don't ignore etm_parse_event_config() errors

[James Clark]

etm_parse_event_config() can fail, for example if an invalid timestamp
level is requested, but etm_enable_perf() ignores the error and enables
the tracer anyway. Roll back to disabled mode and return the error
instead, like etm4_enable_perf() does.

Fixes: 882d5e112491 ("coresight: etm3x: implementing perf_enable/disable() API")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/bug/linux-bc35b336-f835-40fa-89d9-7a580efc3b53
Signed-off-by: James Clark <james.clark@linaro.org>
---
 drivers/hwtracing/coresight/coresight-etm3x-core.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/hwtracing/coresight/coresight-etm3x-core.c b/drivers/hwtracing/coresight/coresight-etm3x-core.c
index b670a324bb41..db8413522d72 100644
--- a/drivers/hwtracing/coresight/coresight-etm3x-core.c
+++ b/drivers/hwtracing/coresight/coresight-etm3x-core.c
@@ -487,7 +487,11 @@ static int etm_enable_perf(struct coresight_device *csdev,
 		return -EBUSY;
 
 	/* Configure the tracer based on the session's specifics */
-	etm_parse_event_config(drvdata, event);
+	ret = etm_parse_event_config(drvdata, event);
+	if (ret) {
+		coresight_set_mode(csdev, CS_MODE_DISABLED);
+		return ret;
+	}
 	drvdata->traceid = path->trace_id;
 
 	/* And enable it */

-- 
2.43.0

[PATCH 9/9] coresight: etm3x: Prohibit modifying seq_curr_state while session is enabled

[James Clark]

When a sysfs session is disabled, seq_curr_state is read back from the
hardware into sysfs_config, overwriting any value written while the
session was enabled. Return -EBUSY in that case.

Do the mode check and the write under drvdata->spinlock. etm_enable_sysfs()
takes the mode before copying sysfs_config to curr_config under the same
lock, so either the new value is included in the copy, or the store sees
that the session is enabled. etm_disable_sysfs() does the read back before
releasing the mode, so a store can't succeed until it's done.

Fixes: a939fc5a71ad ("coresight-etm: add CoreSight ETM/PTM driver")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/bug/linux-d70beb3d-d997-429d-9828-d396e1bbfbb5
Signed-off-by: James Clark <james.clark@linaro.org>
---
 drivers/hwtracing/coresight/coresight-etm3x-sysfs.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/hwtracing/coresight/coresight-etm3x-sysfs.c b/drivers/hwtracing/coresight/coresight-etm3x-sysfs.c
index d185fb8270e1..08c10fd146d5 100644
--- a/drivers/hwtracing/coresight/coresight-etm3x-sysfs.c
+++ b/drivers/hwtracing/coresight/coresight-etm3x-sysfs.c
@@ -1014,6 +1014,11 @@ static ssize_t seq_curr_state_store(struct device *dev,
 	if (val > ETM_SEQ_STATE_MAX_VAL)
 		return -EINVAL;
 
+	guard(spinlock)(&drvdata->spinlock);
+	if (IS_ERR_OR_NULL(drvdata->csdev) ||
+	    coresight_get_mode(drvdata->csdev) == CS_MODE_SYSFS)
+		return -EBUSY;
+
 	sysfs_config->seq_curr_state = val;
 
 	return size;

-- 
2.43.0

Re: [PATCH 1/9] coresight: cpu-debug: Fix PM usage counter leak in debug_enable_func()

[Leo Yan]

On Tue, Oct 27, 2026 at 02:55:47PM +0000, James Clark wrote:
> pm_runtime_get_sync() increments the usage counter even when it fails,
> but the failing CPU isn't added to the rollback mask, so its reference
> is never dropped. Use pm_runtime_resume_and_get() which drops the
> reference itself on failure.
> 
> Fixes: 2227b7c74634 ("coresight: add support for CPU debug module")
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://sashiko.dev/#/bug/linux-2ff60e6d-33ac-4a69-9c62-63eb482f1913
> Signed-off-by: James Clark <james.clark@linaro.org>

This duplicates with:
https://lore.kernel.org/linux-arm-kernel/20260911-b4-coresight-runtime-pm-failures-v1-1-acdf49756e11@qti.qualcomm.com/#r

I'd prefer to pick up that patch, as it has fixed all drivers in the
CoreSight directory.

Thanks,
Leo

Re: [PATCH 1/9] coresight: cpu-debug: Fix PM usage counter leak in debug_enable_func()

[James Clark]

On 27/10/2026 18:08, Leo Yan wrote:
> On Tue, Oct 27, 2026 at 02:55:47PM +0000, James Clark wrote:
>> pm_runtime_get_sync() increments the usage counter even when it fails,
>> but the failing CPU isn't added to the rollback mask, so its reference
>> is never dropped. Use pm_runtime_resume_and_get() which drops the
>> reference itself on failure.
>>
>> Fixes: 2227b7c74634 ("coresight: add support for CPU debug module")
>> Reported-by: Sashiko <sashiko-bot@kernel.org>
>> Closes: https://sashiko.dev/#/bug/linux-2ff60e6d-33ac-4a69-9c62-63eb482f1913
>> Signed-off-by: James Clark <james.clark@linaro.org>
> 
> This duplicates with:
> https://lore.kernel.org/linux-arm-kernel/20260911-b4-coresight-runtime-pm-failures-v1-1-acdf49756e11@qti.qualcomm.com/#r
> 
> I'd prefer to pick up that patch, as it has fixed all drivers in the
> CoreSight directory.
> 
> Thanks,
> Leo

Yep we should drop this one