From nobody Tue Sep 29 09:09:21 2026 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E0E7A39BFEC; Mon, 10 Aug 2026 10:29:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=193.142.43.55 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786357784; cv=none; b=GXHfYOSJ/JpM/gFO7cta2chy8Nx4X+zcTHU508Em9QzTDxoe8gsHvhgn40KjL1XeDM6E2pFq85Ggnlcc9DPtbhAa8iN5AKs1Rs0xamgEs+cKVMn/aO9KurqfmExSJg8tnyfoIoka0Lxo0fQZ/rQLk47gaxAGMxRoJHoYjhDbkxU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786357784; c=relaxed/simple; bh=N3UMKzIP4S1f231fk5amU5EGuFjSH88AS4npg3cqEL4=; h=Date:From:To:Subject:Cc:In-Reply-To:References:MIME-Version: Message-ID:Content-Type; b=PR4trEupwLwUkHi9Y86DGzcamjyw2XFcf0ECchZJdDw/exXG2WLwHRJC1TAPS0BR/C6/BOtLIYBrnAOPLjlVyiqLw5hhMceGTrTNuawOvkWn622BKqbDVUrGkyFoa2bLK836dzi30DqmspWVyWU8lfUVav/86vmquAo/jyf/OII= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de; spf=pass smtp.mailfrom=linutronix.de; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=j6e6mT7H; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=Oxay2d8a; arc=none smtp.client-ip=193.142.43.55 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linutronix.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="j6e6mT7H"; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="Oxay2d8a" Date: Mon, 10 Aug 2026 10:29:37 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1786357779; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=4gSaKYJzEhjiIacBnnunbqzRe4FOxmeBVD3GGHqJaII=; b=j6e6mT7HHNnJ7n/exVHvvcuvHW9XBx3FfecKSDsjsGCJ17dKWVUGYeuX/W7H54hh4vCanS iiaAHDKyRBtV5H4+jhXNze41d9IDUF+kBdl8hM1x13gvQoiyUogmf8CunrIOf9+8qIvIo3 ByPSlS40iyWTguaY2IlM7J1f7HuP3uji7cX3usxJDBJhqLDBjKPww0j07Uux+6u1EBkJE+ LeTehsniVOtQHYfcAbhqMJbea9bRvk7g95XE5hrhGosYBCqnlDFsAuFb+cqSzXURda/Q3x M/NjF7X7bEz4epAsOZgIeEZfEsaFDk6ieFOPtGODFAXF0Oh5B5GLoZ7jR9pBLA== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1786357779; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=4gSaKYJzEhjiIacBnnunbqzRe4FOxmeBVD3GGHqJaII=; b=Oxay2d8alyqiWvgLqEYAlbGJ+SkTHBhSxhXwOVCbew89MPJP2ZoxPwPIikAO5hFjFCFjcn aFRwdNdLCTguCXCw== From: "tip-bot2 for Adrian Hunter" Sender: tip-bot2@linutronix.de Reply-to: linux-kernel@vger.kernel.org To: linux-tip-commits@vger.kernel.org Subject: [tip: perf/core] perf/x86/intel/pt: Fix stop/start with no update Cc: Adrian Hunter , "Peter Zijlstra (Intel)" , Yi Lai , x86@kernel.org, linux-kernel@vger.kernel.org In-Reply-To: <20260721070254.13557-4-adrian.hunter@intel.com> References: <20260721070254.13557-4-adrian.hunter@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-ID: <178635777784.442315.17370501525918489099.tip-bot2@tip-bot2> Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails Precedence: bulk Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable The following commit has been merged into the perf/core branch of tip: Commit-ID: 2e17bf3a469a41457a3bc31b1f8fd66b6ce94a6d Gitweb: https://git.kernel.org/tip/2e17bf3a469a41457a3bc31b1f8fd66b6= ce94a6d Author: Adrian Hunter AuthorDate: Tue, 21 Jul 2026 10:02:54 +03:00 Committer: Peter Zijlstra CommitterDate: Fri, 07 Aug 2026 18:27:06 +02:00 perf/x86/intel/pt: Fix stop/start with no update If pt_event_stop() is called without PERF_EF_UPDATE flag, then perf_aux_output_end() is not called. A subsequent call to pt_event_start() will call perf_aux_output_begin() again which violates the rule against nesting and triggers a WARNING in perf_aux_output_begin(). Originally, pt_event_stop() was never called without PERF_EF_UPDATE, because the only code paths to do so are from event overflow, and Intel PT does not do that. However the introduction of group throttling by commit 9734e25fbf5ae ("perf: Fix the throttle logic for a group") meant that an Intel PT event could be throttled if it was part of a group. Throttling calls PMU ->stop() / ->start() callbacks without flags. An example is when AUX area sampling is used. The following commands hit the issue: echo 10000 > /proc/sys/kernel/perf_event_max_sample_rate perf record -F32000 --aux-sample -e '{intel_pt//u,cycles:u}' \ -- bash -c 'for i in `seq 1 100000` ; do true ; done' Use PERF_HES_UPTODATE to track whether perf_aux_output_begin() and perf_aux_output_end() are balanced. A cleared PERF_HES_UPTODATE bit indicates that an AUX output context is still open. Amend pt_event_start() / pt_event_stop() accordingly so that begin/end stay balanced: - In non-snapshot mode, stop() always closes the buffer (the buffer may have run out of space, and that accounting is done by the update), so a following start() opens a fresh one as before. - In snapshot/overwrite mode, stop() without PERF_EF_UPDATE leaves the buffer open so that pt_event_snapshot_aux() can still copy from it, and start() then only re-enables tracing instead of calling perf_aux_output_begin() again. Note that pt_event_del() calls pt_event_stop() with PERF_EF_UPDATE flag set (as is required by the documentation), so a final call to perf_aux_output_end() is assured. Fixes: 52ca9ced3f707 ("perf/x86/intel/pt: Add Intel PT PMU driver") Signed-off-by: Adrian Hunter Signed-off-by: Peter Zijlstra (Intel) Tested-by: Yi Lai Link: https://patch.msgid.link/20260721070254.13557-4-adrian.hunter@intel.c= om --- arch/x86/events/intel/pt.c | 45 +++++++++++++++++++++++++++++-------- 1 file changed, 36 insertions(+), 9 deletions(-) diff --git a/arch/x86/events/intel/pt.c b/arch/x86/events/intel/pt.c index 2163e5c..5754cd4 100644 --- a/arch/x86/events/intel/pt.c +++ b/arch/x86/events/intel/pt.c @@ -1540,6 +1540,8 @@ void intel_pt_interrupt(void) =20 perf_aux_output_end(&pt->handle, local_xchg(&buf->data_size, 0)); =20 + event->hw.state |=3D PERF_HES_UPTODATE; + if (!(event->hw.state & PERF_HES_STOPPED)) { int ret; =20 @@ -1561,6 +1563,8 @@ void intel_pt_interrupt(void) =20 pt_config_buffer(buf); pt_config_start(event); + + event->hw.state &=3D ~PERF_HES_UPTODATE; } } =20 @@ -1629,6 +1633,18 @@ static void pt_event_start(struct perf_event *event,= int mode) return; } =20 + /* + * Re-start subsequent to a call to pt_event_stop() without the + * PERF_EF_UPDATE flag. Absence of PERF_HES_UPTODATE indicates that + * perf_aux_output_begin() has already been called. This path can + * come about only in snapshot/overwrite mode - see pt_event_stop(). + */ + if (!(hwc->state & PERF_HES_UPTODATE)) { + hwc->state &=3D ~PERF_HES_STOPPED; + pt_config_enable(event); + return; + } + buf =3D perf_aux_output_begin(&pt->handle, event); if (!buf) goto fail_stop; @@ -1639,7 +1655,7 @@ static void pt_event_start(struct perf_event *event, = int mode) goto fail_end_stop; } =20 - hwc->state &=3D ~PERF_HES_STOPPED; + hwc->state &=3D ~(PERF_HES_STOPPED | PERF_HES_UPTODATE); =20 pt_config_buffer(buf); pt_config(event); @@ -1649,12 +1665,13 @@ static void pt_event_start(struct perf_event *event= , int mode) fail_end_stop: perf_aux_output_end(&pt->handle, 0); fail_stop: - hwc->state |=3D PERF_HES_STOPPED; + hwc->state |=3D PERF_HES_STOPPED | PERF_HES_UPTODATE; } =20 static void pt_event_stop(struct perf_event *event, int mode) { struct pt *pt =3D this_cpu_ptr(&pt_ctx); + struct pt_buffer *buf; =20 if (mode & PERF_EF_PAUSE) { if (READ_ONCE(pt->pause_allowed)) @@ -1680,17 +1697,24 @@ static void pt_event_stop(struct perf_event *event,= int mode) =20 pt_config_stop(event); =20 - if (event->hw.state & PERF_HES_STOPPED) - return; - event->hw.state |=3D PERF_HES_STOPPED; =20 - if (mode & PERF_EF_UPDATE) { - struct pt_buffer *buf =3D perf_get_aux(&pt->handle); + if (event->hw.state & PERF_HES_UPTODATE) + return; =20 - if (!buf) - return; + buf =3D perf_get_aux(&pt->handle); + if (!buf) + return; =20 + /* + * When not in snapshot/overwrite mode, there is a possibility that the + * buffer has run out of space. The accounting for that is handled by + * the update, so always update in that case. Snapshot/overwrite mode is + * treated differently to allow for pt_event_snapshot_aux() which can + * still get called if the AUX-sampling event is not stopped until after + * PT is stopped. + */ + if ((mode & PERF_EF_UPDATE) || !buf->snapshot) { if (WARN_ON_ONCE(pt->handle.event !=3D event)) return; =20 @@ -1705,6 +1729,7 @@ static void pt_event_stop(struct perf_event *event, i= nt mode) local_xchg(&buf->data_size, buf->nr_pages << PAGE_SHIFT); perf_aux_output_end(&pt->handle, local_xchg(&buf->data_size, 0)); + event->hw.state |=3D PERF_HES_UPTODATE; } } =20 @@ -1775,6 +1800,8 @@ static int pt_event_add(struct perf_event *event, int= mode) if (pt->handle.event) goto fail; =20 + event->hw.state |=3D PERF_HES_UPTODATE; + if (mode & PERF_EF_START) { pt_event_start(event, 0); ret =3D -EINVAL;