From nobody Sat Jul 25 05:59:34 2026 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BB97C3DEADB; Fri, 17 Jul 2026 08:09:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784275799; cv=none; b=TunE9KVAOImrfh6HuzC31WY/gXCyfqlEtOnEXgeByFG0j1btfUuk2ivKNpQ4HTMX3tx37Tb/BIZt2cvgPm3xN4qKOLqL21PZjsXo4lQbGVHKIhMpxNn69vZLe5WCdgPwiUx09C5SlYWYWIyVBMk4+8zUOGGbyvUBlNFDPQcltTA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784275799; c=relaxed/simple; bh=/eBA8mwA2KLwqa88QvafSzXhfeQ8OkdeIpQfhytMD3o=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=G6LaRO9LmIajhvjs5LGXPTvgmz+16m3Y/VBjupMCSQjoRHpvoeOr690jwwsiX+N2304ivpl9vQkxT56ECVFlT3CEivHA8WJZG8pbGwCE1iwFYTXgpAHj8QrVuQ13e7teZePle6isUuaH+F5gtNyji4TVt6LPjQC38SUGnlviuHk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com; spf=pass smtp.mailfrom=linux.intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=RLCd9Mgq; arc=none smtp.client-ip=192.198.163.18 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="RLCd9Mgq" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1784275798; x=1815811798; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=/eBA8mwA2KLwqa88QvafSzXhfeQ8OkdeIpQfhytMD3o=; b=RLCd9MgqB5DvL30wEmy6qeP3RkkwBjUCreOmdfyOLVWSky2jjkNYR+GH 3JOO0LWe6qVEaAhKOxQKYzdsKilq30CGbWo/3sKXOEpxSUqRosdqWips5 gcDWaKuetvBBKGz25DVIeBsRzAJoVDYNumqSjBd8eS147fRenQhPXFAtC QRPufOFZJkY9ejFeq6Fs9W6IgPpJNfeCBoJJqP3OTmlZJSWmLC0sCKjGH bDjVmGHMQFJHlpBNAN5/fveqPpTt+0fgytrmSZ+FmQ6WaTCwIkoBC0Yce vQPsAw+RJhSGvx5b/zLrA/O4bsbqCJyGPxKMyuwXSLEdeeodHQgoQbJMI Q==; X-CSE-ConnectionGUID: NV/7VwL4Re+hL3HjdxzNbQ== X-CSE-MsgGUID: hN1R8gcUT2mGUaSt+sz3pg== X-IronPort-AV: E=McAfee;i="6800,10657,11848"; a="84065492" X-IronPort-AV: E=Sophos;i="6.25,169,1779174000"; d="scan'208";a="84065492" Received: from fmviesa007.fm.intel.com ([10.60.135.147]) by fmvoesa112.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Jul 2026 01:09:58 -0700 X-CSE-ConnectionGUID: /hcbJVIkRY6pHyd9iSondw== X-CSE-MsgGUID: 25BuCvKGQU+Mxu10bL/xSg== X-Ironport-Invalid-End-Of-Message: True X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.25,169,1779174000"; d="scan'208";a="253315453" Received: from spr.sh.intel.com ([10.112.229.196]) by fmviesa007.fm.intel.com with ESMTP; 17 Jul 2026 01:09:54 -0700 From: Dapeng Mi To: Peter Zijlstra , Ingo Molnar , Arnaldo Carvalho de Melo , Namhyung Kim , Ian Rogers , Adrian Hunter , Alexander Shishkin , Andi Kleen , Eranian Stephane Cc: linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, Dapeng Mi , Zide Chen , Falcon Thomas , Xudong Hao , Dapeng Mi Subject: [Patch v3 1/8] perf/x86: Unregister PMI handler on PMU init failure Date: Fri, 17 Jul 2026 16:03:35 +0800 Message-Id: <20260717080342.1879573-2-dapeng1.mi@linux.intel.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260717080342.1879573-1-dapeng1.mi@linux.intel.com> References: <20260717080342.1879573-1-dapeng1.mi@linux.intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Fix an NMI handler leak in init_hw_perf_events(). When PMU initialization fails after register_nmi_handler(), the error path exits without calling unregister_nmi_handler(), leaving a stale NMI_LOCAL "PMI" handler registered. Add the missing call before clearing x86_pmu state. Signed-off-by: Dapeng Mi Reviewed-by: Thomas Falcon Reviewed-by: Zide Chen --- arch/x86/events/core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c index af0b67ffb43d..872d07a5fa80 100644 --- a/arch/x86/events/core.c +++ b/arch/x86/events/core.c @@ -2219,7 +2219,7 @@ static int __init init_hw_perf_events(void) err =3D cpuhp_setup_state(CPUHP_PERF_X86_PREPARE, "perf/x86:prepare", x86_pmu_prepare_cpu, x86_pmu_dead_cpu); if (err) - return err; + goto pmi_unregister; =20 err =3D cpuhp_setup_state(CPUHP_AP_PERF_X86_STARTING, "perf/x86:starting", x86_pmu_starting_cpu, @@ -2273,6 +2273,8 @@ static int __init init_hw_perf_events(void) cpuhp_remove_state(CPUHP_AP_PERF_X86_STARTING); out: cpuhp_remove_state(CPUHP_PERF_X86_PREPARE); +pmi_unregister: + unregister_nmi_handler(NMI_LOCAL, "PMI"); out_bad_pmu: memset(&x86_pmu, 0, sizeof(x86_pmu)); return err; --=20 2.34.1 From nobody Sat Jul 25 05:59:34 2026 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3E9D13E00B6; Fri, 17 Jul 2026 08:10:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784275802; cv=none; b=JMjPAFh81JWZ1sM8oPkp/7vb7pyU80SxgBzEGdEK+YeNpIIOZz/75A1o3E8nuASJ5RXcZCBSFBu3HhC90UULqRGfCtz0uVm1bMgi3oRMsXj8IEwkdO6A8n0N3xRwVFLUINMXX5ieA+0llrof178j6Q+sDBMCp8KO9wfmm8xhkn0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784275802; c=relaxed/simple; bh=yX9+N+DdmDF1QDMBR4DN+rdXvBk3lsq7f9U47rRl8zs=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=d2MwgK+UCnv+hBCcjMwrG/phWvZ9omxjMa7nnLQWtGJg6BO7uozwkB+OAfANkdx+GmsxEE+bUY+1v1b1JkeObf+rJvsJQVMKyp0OIuyjE9KkG9IECF0Heni6ZvK+PG311Q1SCIdamEmPvaGBNq0h9Y1oLDiHrUxFSj85DCEee9A= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com; spf=pass smtp.mailfrom=linux.intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=ZFpkymy0; arc=none smtp.client-ip=192.198.163.18 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="ZFpkymy0" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1784275801; x=1815811801; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=yX9+N+DdmDF1QDMBR4DN+rdXvBk3lsq7f9U47rRl8zs=; b=ZFpkymy0JJOLFKu5EjY6NoBHp2UOYN19f87+ztQBtR52dJXbZiox8ups 37U+UXFgkVCAh048RAXBBXyKlRxRtiNLEqY8daTPcOAgiFRgZ3CPJOMsB lJaKUU8oR6Hh2BTwCHyRktDP9/fj+ffaFTMEkzA+dHCdOtfOSrdAm0xP2 GbWQnMlG3PmK1qeYyANc+j0Dn99qHUU5HzFFrR3/6E4ZaO0Eu3mlQdKsX aq/J2fR19EXj6BQe0+xsrGCznflPRk6T+RkgSwhyBMWcH+4XcERRaW2vz 3j8N8uFQ0eyyyzagbc/eWgj+2kBVrumPj9n71qHx+qdhMgF4bJRAm6qCM A==; X-CSE-ConnectionGUID: N5Ia80XMS+q0g/DXixY8PQ== X-CSE-MsgGUID: EZOKIMPVQ3emB/aeifUW4A== X-IronPort-AV: E=McAfee;i="6800,10657,11848"; a="84065498" X-IronPort-AV: E=Sophos;i="6.25,169,1779174000"; d="scan'208";a="84065498" Received: from fmviesa007.fm.intel.com ([10.60.135.147]) by fmvoesa112.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Jul 2026 01:10:01 -0700 X-CSE-ConnectionGUID: fZMHA9qcTuWxycg80T86PQ== X-CSE-MsgGUID: pjo3KI1xSZ6wLbQRRAdeGA== X-Ironport-Invalid-End-Of-Message: True X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.25,169,1779174000"; d="scan'208";a="253315456" Received: from spr.sh.intel.com ([10.112.229.196]) by fmviesa007.fm.intel.com with ESMTP; 17 Jul 2026 01:09:57 -0700 From: Dapeng Mi To: Peter Zijlstra , Ingo Molnar , Arnaldo Carvalho de Melo , Namhyung Kim , Ian Rogers , Adrian Hunter , Alexander Shishkin , Andi Kleen , Eranian Stephane Cc: linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, Dapeng Mi , Zide Chen , Falcon Thomas , Xudong Hao , Dapeng Mi Subject: [Patch v3 2/8] perf/x86: Free hybrid state on PMU init failure Date: Fri, 17 Jul 2026 16:03:36 +0800 Message-Id: <20260717080342.1879573-3-dapeng1.mi@linux.intel.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260717080342.1879573-1-dapeng1.mi@linux.intel.com> References: <20260717080342.1879573-1-dapeng1.mi@linux.intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" If PMU initialization fails, for example in check_hw_exists(), hybrid state can be left partially initialized: x86_pmu.hybrid_pmu is not freed and perf_is_hybrid remains set. This can leak memory and leave stale hybrid state reachable after a failed init path. Add x86_pmu_free_hybrid() and use it on PMU init failure paths so all hybrid-related state is consistently reset. Signed-off-by: Dapeng Mi Reviewed-by: Thomas Falcon Reviewed-by: Zide Chen --- arch/x86/events/core.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c index 872d07a5fa80..6c63b27e11e6 100644 --- a/arch/x86/events/core.c +++ b/arch/x86/events/core.c @@ -2130,6 +2130,17 @@ void x86_pmu_show_pmu_cap(struct pmu *pmu) pr_info("... global_ctrl mask: %016llx\n", hybrid(pmu, intel_ctr= l)); } =20 +static void x86_pmu_free_hybrid(void) +{ + if (!x86_pmu.hybrid_pmu) + return; + + static_branch_disable(&perf_is_hybrid); + kfree(x86_pmu.hybrid_pmu); + x86_pmu.hybrid_pmu =3D NULL; + x86_pmu.num_hybrid_pmus =3D 0; +} + static int __init init_hw_perf_events(void) { struct x86_pmu_quirk *quirk; @@ -2258,9 +2269,6 @@ static int __init init_hw_perf_events(void) for (j =3D 0; j < i; j++) perf_pmu_unregister(&x86_pmu.hybrid_pmu[j].pmu); pr_warn("Failed to register hybrid PMUs\n"); - kfree(x86_pmu.hybrid_pmu); - x86_pmu.hybrid_pmu =3D NULL; - x86_pmu.num_hybrid_pmus =3D 0; goto out2; } } @@ -2276,6 +2284,7 @@ static int __init init_hw_perf_events(void) pmi_unregister: unregister_nmi_handler(NMI_LOCAL, "PMI"); out_bad_pmu: + x86_pmu_free_hybrid(); memset(&x86_pmu, 0, sizeof(x86_pmu)); return err; } --=20 2.34.1 From nobody Sat Jul 25 05:59:34 2026 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E304F3E00A5; Fri, 17 Jul 2026 08:10:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784275806; cv=none; b=rXiHzPkFvWUde7jFbjJBKuQxMBneI0Bdi2xc7FhVIDw8gSmS6RZY5/m+2nD6JzdJYkwVBUSYMz2E8Pq39VdvP1Xk9cEtzm0bQHLB0PgFHE4J+Bd2000IwZKTmfxym+YDZlHCIqSu0FAy3V+9KphYufQwCPTJUr9sYNSw9Nbo0FA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784275806; c=relaxed/simple; bh=ZjbnYeeSMu5T4wtc0P0mmdxflnjLI7lWhbwx0Um34as=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=IyvxdmHUvOv6MCyddWZ9SyW5r221lqg7Agd9LuIuDcGiLr0lyXAr4UsGO+N1TdTFolGwwlHrQlpD1FOfGet166FTu878F9k3jXvKCk6EGQnpy2oQaUMHZ4ka0xK1SIqMJsqdsH9u+PvNwBjdKzT2tqItJTB1az5pMG1fON+sGqM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com; spf=pass smtp.mailfrom=linux.intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=XUToFPAp; arc=none smtp.client-ip=192.198.163.18 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="XUToFPAp" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1784275805; x=1815811805; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=ZjbnYeeSMu5T4wtc0P0mmdxflnjLI7lWhbwx0Um34as=; b=XUToFPApwtYhaaE+bLyQReNEUuxP2LfI7mgivPlGutTpkwxJw+ibCWQi 1oEsmcjTd8f6+IxuJHo64Q3pUb/4YEJBZDn4G6Ef47sqEWEmDYph479+L IHLN+KziVKwn0s0yq3FWMTjzeBAfZuqbYIPBgXsfjhaCEds/leZkzV/yh 2nL3yc03j2whWWItlqqZ/PEfL7JDjay0X9s1hbWv9LPU+y3r/SkFREjeq EOZ+UleiUwCAA4ZbccewwZEQDzPyCluW5oipAoWFjFlTzLyyl2WvmCzB6 ygcxvVi5EKhyOOOBKRu/6GGmnajg2p3lZC6XEjU6msF9KCpW1pSUYuVyc Q==; X-CSE-ConnectionGUID: XidSekS/TLuVjjCRBLhcgg== X-CSE-MsgGUID: P7P/bt80QjmBTr3M9JR1Kw== X-IronPort-AV: E=McAfee;i="6800,10657,11848"; a="84065504" X-IronPort-AV: E=Sophos;i="6.25,169,1779174000"; d="scan'208";a="84065504" Received: from fmviesa007.fm.intel.com ([10.60.135.147]) by fmvoesa112.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Jul 2026 01:10:05 -0700 X-CSE-ConnectionGUID: Nz7ZGnHtSI6phDHtGQiypA== X-CSE-MsgGUID: lh6w8WkYQ42gQirP2YIFaQ== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.25,169,1779174000"; d="scan'208";a="253315461" Received: from spr.sh.intel.com ([10.112.229.196]) by fmviesa007.fm.intel.com with ESMTP; 17 Jul 2026 01:10:01 -0700 From: Dapeng Mi To: Peter Zijlstra , Ingo Molnar , Arnaldo Carvalho de Melo , Namhyung Kim , Ian Rogers , Adrian Hunter , Alexander Shishkin , Andi Kleen , Eranian Stephane Cc: linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, Dapeng Mi , Zide Chen , Falcon Thomas , Xudong Hao , Dapeng Mi Subject: [Patch v3 3/8] perf/x86: Guard intel_pmu_cpu_dead() against invalid hybrid PMU casts Date: Fri, 17 Jul 2026 16:03:37 +0800 Message-Id: <20260717080342.1879573-4-dapeng1.mi@linux.intel.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260717080342.1879573-1-dapeng1.mi@linux.intel.com> References: <20260717080342.1879573-1-dapeng1.mi@linux.intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" In failure paths, cpuc->pmu can still point to the global static pmu instead of an embedded x86_hybrid_pmu::pmu. Calling hybrid_pmu() on that pointer causes an invalid container conversion and may lead to out-of-bounds access. This can happen in at least two cases: - init_hybrid_pmu() fails check_hw_exists() and leaves cpuc->pmu as-is. - CPU hotplug fails between CPUHP_PERF_X86_PREPARE and CPUHP_AP_PERF_X86_STARTING, and rollback invokes intel_pmu_cpu_dead(). Fix both paths by: - Clear cpuc->pmu to NULL when check_hw_exists() fails. - Validat that cpuc->pmu is not the global static pmu before calling hybrid_pmu() in intel_pmu_cpu_dead(). A new helper x86_get_static_pmu() is added to get the global static pmu. Signed-off-by: Dapeng Mi Reviewed-by: Thomas Falcon Reviewed-by: Zide Chen --- arch/x86/events/core.c | 5 +++++ arch/x86/events/intel/core.c | 7 +++++-- arch/x86/events/perf_event.h | 1 + 3 files changed, 11 insertions(+), 2 deletions(-) diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c index 6c63b27e11e6..a02f303a9151 100644 --- a/arch/x86/events/core.c +++ b/arch/x86/events/core.c @@ -790,6 +790,11 @@ int is_x86_event(struct perf_event *event) return false; } =20 +inline struct pmu *x86_get_static_pmu(void) +{ + return &pmu; +} + struct pmu *x86_get_pmu(unsigned int cpu) { struct cpu_hw_events *cpuc =3D &per_cpu(cpu_hw_events, cpu); diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c index b39c6ce0efb5..a991fc4f1575 100644 --- a/arch/x86/events/intel/core.c +++ b/arch/x86/events/intel/core.c @@ -6329,8 +6329,10 @@ static bool init_hybrid_pmu(int cpu) =20 intel_pmu_check_hybrid_pmus(pmu); =20 - if (!check_hw_exists(&pmu->pmu, pmu->cntr_mask, pmu->fixed_cntr_mask)) + if (!check_hw_exists(&pmu->pmu, pmu->cntr_mask, pmu->fixed_cntr_mask)) { + cpuc->pmu =3D NULL; return false; + } =20 pr_info("%s PMU driver: ", pmu->name); =20 @@ -6475,11 +6477,12 @@ void intel_cpuc_finish(struct cpu_hw_events *cpuc) static void intel_pmu_cpu_dead(int cpu) { struct cpu_hw_events *cpuc =3D &per_cpu(cpu_hw_events, cpu); + struct pmu *pmu =3D x86_get_static_pmu(); =20 release_arch_pebs_buf_on_cpu(cpu); intel_cpuc_finish(cpuc); =20 - if (is_hybrid() && cpuc->pmu) + if (is_hybrid() && cpuc->pmu && cpuc->pmu !=3D pmu) cpumask_clear_cpu(cpu, &hybrid_pmu(cpuc->pmu)->supported_cpus); } =20 diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h index a8afea8d38f0..01ae287cde16 100644 --- a/arch/x86/events/perf_event.h +++ b/arch/x86/events/perf_event.h @@ -1161,6 +1161,7 @@ static struct perf_pmu_format_hybrid_attr format_attr= _hybrid_##_name =3D {\ .pmu_type =3D _pmu, \ } =20 +struct pmu *x86_get_static_pmu(void); struct pmu *x86_get_pmu(unsigned int cpu); extern struct x86_pmu x86_pmu __read_mostly; =20 --=20 2.34.1 From nobody Sat Jul 25 05:59:34 2026 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 75F3C3E0C4F; Fri, 17 Jul 2026 08:10:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784275809; cv=none; b=T6/kiz0oOgyF7b6kxHsbhb2UgN3oE1izzozg+kKgq89LjXh8Rztl2a0tw92g9F2ISdcjTWY+VOSQF90AcJYzHCRPlfVJW4zvAYIo8Ib0hQMK4ZA4ef8QP1Sf6mzp4MClrn+rfdl15qOIWediLMO1Vj1l2ULSxwdrq+pxgawCGhM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784275809; c=relaxed/simple; bh=8fiYiM+Sjbpu3hg1mInSZ2lfu0AMkNALh66sKTZNISc=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=OCKP2YQYt0UH8OtoPFagQUdJZKqPFcOgEwARb6nmaSjk0DLbWBBMHXW6gLo7R1XPuT95ayW3sMrEbiDb25JCeYHf2JVjjkklMz/y2xM7t/pUzrEFw60VlwCT3Ni+NawYtS8nnwMfrUNwEs27WUR0MoJ8pswhbsJ24OZVmVDw3Sk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com; spf=pass smtp.mailfrom=linux.intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=iK8nWuBv; arc=none smtp.client-ip=192.198.163.18 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="iK8nWuBv" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1784275809; x=1815811809; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=8fiYiM+Sjbpu3hg1mInSZ2lfu0AMkNALh66sKTZNISc=; b=iK8nWuBv6/WjEzH5gONw1aXxs0iSMU0hL6v2NKngMqI1XrjGPulxHQNx 0Jl8KQ2zj+lAlWBdpQ7z9h6zt2GvKJdh9+Abl3XZtCVjqxnliF/sKXBCT yGhiy0Br5MJRGcdz3CB6yXHJZt+5qPzy5pBn+MXYlfpTJgPimstQG0xjo ZIrizHrrPZX6r8ShM4Jq/hPlNPFCV4nvRIR0UcWgSd8vjzTT35M+1Dl8d IdV1AtarHDGQZK0uzUUt3+5o58MaNxYVAglWdRkj1OKD/iqtYHcO6DWJ8 SMDHYiflyuGkbKWwBHuEfRi7DlESGpb/PWF+OsuikAyI7a8TWhbwzuPbA Q==; X-CSE-ConnectionGUID: 2aB1KKVaRmaiJ+bQH8lLiQ== X-CSE-MsgGUID: xemAsrvvT+mOjHvXqM/smA== X-IronPort-AV: E=McAfee;i="6800,10657,11848"; a="84065511" X-IronPort-AV: E=Sophos;i="6.25,169,1779174000"; d="scan'208";a="84065511" Received: from fmviesa007.fm.intel.com ([10.60.135.147]) by fmvoesa112.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Jul 2026 01:10:08 -0700 X-CSE-ConnectionGUID: /hYu39P6Q2uJPcwuqeBlMw== X-CSE-MsgGUID: YbnbSQLERZWdtDDx2vFkAw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.25,169,1779174000"; d="scan'208";a="253315472" Received: from spr.sh.intel.com ([10.112.229.196]) by fmviesa007.fm.intel.com with ESMTP; 17 Jul 2026 01:10:04 -0700 From: Dapeng Mi To: Peter Zijlstra , Ingo Molnar , Arnaldo Carvalho de Melo , Namhyung Kim , Ian Rogers , Adrian Hunter , Alexander Shishkin , Andi Kleen , Eranian Stephane Cc: linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, Dapeng Mi , Zide Chen , Falcon Thomas , Xudong Hao , Dapeng Mi Subject: [Patch v3 4/8] perf/x86/intel: Unwind cpuc state if PEBS buffer setup fails Date: Fri, 17 Jul 2026 16:03:38 +0800 Message-Id: <20260717080342.1879573-5-dapeng1.mi@linux.intel.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260717080342.1879573-1-dapeng1.mi@linux.intel.com> References: <20260717080342.1879573-1-dapeng1.mi@linux.intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" intel_pmu_cpu_prepare() allocates per-CPU perf state first and then sets up the arch PEBS buffer. If alloc_arch_pebs_buf_on_cpu() fails, the previously allocated cpuc resources are left behind. Make the failure path call intel_cpuc_finish(cpuc) to release the per-CPU state allocated by intel_cpuc_prepare(). Signed-off-by: Dapeng Mi Reviewed-by: Thomas Falcon Reviewed-by: Zide Chen --- arch/x86/events/intel/core.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c index a991fc4f1575..b47d2f00ac13 100644 --- a/arch/x86/events/intel/core.c +++ b/arch/x86/events/intel/core.c @@ -5924,13 +5924,20 @@ int intel_cpuc_prepare(struct cpu_hw_events *cpuc, = int cpu) =20 static int intel_pmu_cpu_prepare(int cpu) { + struct cpu_hw_events *cpuc =3D &per_cpu(cpu_hw_events, cpu); int ret; =20 - ret =3D intel_cpuc_prepare(&per_cpu(cpu_hw_events, cpu), cpu); + ret =3D intel_cpuc_prepare(cpuc, cpu); if (ret) return ret; =20 - return alloc_arch_pebs_buf_on_cpu(cpu); + ret =3D alloc_arch_pebs_buf_on_cpu(cpu); + if (ret) { + intel_cpuc_finish(cpuc); + return ret; + } + + return 0; } =20 static void flip_smm_bit(void *data) --=20 2.34.1 From nobody Sat Jul 25 05:59:34 2026 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3B09E3E1689; Fri, 17 Jul 2026 08:10:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784275813; cv=none; b=kXmPWlve3y6svQ5imwRuONZs21iOn3/fofoO1i1ROMqaHblN2nNnBNOhxJePgNCrZnzUmW/6Xj5Et6Qvz+sLt5NsqMX1pQz6U8em/UC6NfhyUcNR0sv0A8v1HVqhHa0gmK+7bCzXZJ099XXfo3sYzbF4Evt+6LumjVLQ9Afniz8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784275813; c=relaxed/simple; bh=HwjgJLjRlwKIwl4eEGU7zw10nS7W2W+TDQh0FPdLizM=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=AECMRe5QiMz8wCQCHUJap/dlOju+K14d4d3URzwv4XtYCtlSDvu/0tNUhI5PuoxYaXfAgKpw7saAkOETFJyqGl3aG2BGHUxy8Swh/1U0a4uoS+61a3P4hxQ35Lm32sIMRBTXdw3kUo8V3yUVJGzEG4OClK30kba1dNvVTMJ3D1Y= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com; spf=pass smtp.mailfrom=linux.intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=eKCaak1O; arc=none smtp.client-ip=192.198.163.18 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="eKCaak1O" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1784275812; x=1815811812; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=HwjgJLjRlwKIwl4eEGU7zw10nS7W2W+TDQh0FPdLizM=; b=eKCaak1O1XCbtLtryUUUfKrL4LG6KTBh2RAYqRxeYY8LTd9w9ftz6WU4 THGwOTTxPMZrwzlijAyjcv9AhYS3QHbqZDALNHcCBLLgSaDXL45Erh6Vw cwEC9rUceeR4XgmCG6Ga9oE3+xypEVijzMOJfWb/wJtLN4KTcyu8Asi9C rhFe9BEm2Z4myvT8foyg/WHYUKQz9F3P/IRZgNU6cr6PSRDUl1+TtpqG/ GT32FpksKjtLuy8p5HZJy1uDNGXiPTMjjepqAhP/c7pKvZ/Mx4Oiz1s8V T39XNEWUisbP+NWRunW3HU6aSi7uJjxn85ffe+NOXFw9C98izaKOzdm8V w==; X-CSE-ConnectionGUID: 8mkTezqOS0iXec8LcbJPIw== X-CSE-MsgGUID: ypZ17b36QG6fpFyffGsC3w== X-IronPort-AV: E=McAfee;i="6800,10657,11848"; a="84065519" X-IronPort-AV: E=Sophos;i="6.25,169,1779174000"; d="scan'208";a="84065519" Received: from fmviesa007.fm.intel.com ([10.60.135.147]) by fmvoesa112.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Jul 2026 01:10:12 -0700 X-CSE-ConnectionGUID: AKp1zRUFQzyIHkNz+bdbaA== X-CSE-MsgGUID: 1FHynh75RvC4XHDjZfwlmQ== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.25,169,1779174000"; d="scan'208";a="253315476" Received: from spr.sh.intel.com ([10.112.229.196]) by fmviesa007.fm.intel.com with ESMTP; 17 Jul 2026 01:10:08 -0700 From: Dapeng Mi To: Peter Zijlstra , Ingo Molnar , Arnaldo Carvalho de Melo , Namhyung Kim , Ian Rogers , Adrian Hunter , Alexander Shishkin , Andi Kleen , Eranian Stephane Cc: linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, Dapeng Mi , Zide Chen , Falcon Thomas , Xudong Hao , Dapeng Mi Subject: [Patch v3 5/8] perf/x86: Remove stale fixed counter helper and fix hybrid PMU access Date: Fri, 17 Jul 2026 16:03:39 +0800 Message-Id: <20260717080342.1879573-6-dapeng1.mi@linux.intel.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260717080342.1879573-1-dapeng1.mi@linux.intel.com> References: <20260717080342.1879573-1-dapeng1.mi@linux.intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" On hybrid systems, init_hw_perf_events() can call check_hw_exists() with the global PMU pointer after perf_is_hybrid is set. In that case, fixed_counter_disabled() uses hybrid() on a non-hybrid PMU object, so the intel_ctrl access is taken from the wrong layout and can read out of bounds. fixed_counter_disabled() was added in commit 32451614da2a ("perf/x86/intel: Support CPUID 10.ECX to disable fixed counters"), when fixed counters were tracked via num_fixed_counters. Today fixed counters are represented by fixed_cntr_mask, so this helper is obsolete. Remove fixed_counter_disabled() and its callers, and rely directly on the fixed-counter bitmask. With the helper gone, check_hw_exists() no longer needs a PMU argument, so drop that parameter as well. This removes the invalid hybrid access and closes the out-of-bounds read risk. Signed-off-by: Dapeng Mi Reviewed-by: Thomas Falcon Reviewed-by: Zide Chen --- arch/x86/events/core.c | 8 ++------ arch/x86/events/intel/core.c | 4 +--- arch/x86/events/perf_event.h | 9 +-------- 3 files changed, 4 insertions(+), 17 deletions(-) diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c index a02f303a9151..143a6e735d9e 100644 --- a/arch/x86/events/core.c +++ b/arch/x86/events/core.c @@ -265,7 +265,7 @@ static void release_pmc_hardware(void) {} =20 #endif =20 -bool check_hw_exists(struct pmu *pmu, unsigned long *cntr_mask, +bool check_hw_exists(unsigned long *cntr_mask, unsigned long *fixed_cntr_mask) { u64 val, val_fail =3D -1, val_new=3D ~0; @@ -297,8 +297,6 @@ bool check_hw_exists(struct pmu *pmu, unsigned long *cn= tr_mask, if (ret) goto msr_fail; for_each_set_bit(i, fixed_cntr_mask, X86_PMC_IDX_MAX) { - if (fixed_counter_disabled(i, pmu)) - continue; if (val & (0x03ULL << i*4)) { bios_fail =3D 1; val_fail =3D val; @@ -1618,8 +1616,6 @@ void perf_event_print_debug(void) cpu, idx, prev_left); } for_each_set_bit(idx, fixed_cntr_mask, X86_PMC_IDX_MAX) { - if (fixed_counter_disabled(idx, cpuc->pmu)) - continue; rdmsrq(x86_pmu_fixed_ctr_addr(idx), pmc_count); =20 pr_info("CPU#%d: fixed-PMC%d count: %016llx\n", @@ -2180,7 +2176,7 @@ static int __init init_hw_perf_events(void) pmu_check_apic(); =20 /* sanity check that the hardware exists or is emulated */ - if (!check_hw_exists(&pmu, x86_pmu.cntr_mask, x86_pmu.fixed_cntr_mask)) + if (!check_hw_exists(x86_pmu.cntr_mask, x86_pmu.fixed_cntr_mask)) goto out_bad_pmu; =20 pr_cont("%s PMU driver.\n", x86_pmu.name); diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c index b47d2f00ac13..c418176065f6 100644 --- a/arch/x86/events/intel/core.c +++ b/arch/x86/events/intel/core.c @@ -3713,8 +3713,6 @@ static void intel_pmu_reset(void) wrmsrq_safe(x86_pmu_event_addr(idx), 0ull); } for_each_set_bit(idx, fixed_cntr_mask, INTEL_PMC_MAX_FIXED) { - if (fixed_counter_disabled(idx, cpuc->pmu)) - continue; wrmsrq_safe(x86_pmu_fixed_ctr_addr(idx), 0ull); } =20 @@ -6336,7 +6334,7 @@ static bool init_hybrid_pmu(int cpu) =20 intel_pmu_check_hybrid_pmus(pmu); =20 - if (!check_hw_exists(&pmu->pmu, pmu->cntr_mask, pmu->fixed_cntr_mask)) { + if (!check_hw_exists(pmu->cntr_mask, pmu->fixed_cntr_mask)) { cpuc->pmu =3D NULL; return false; } diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h index 01ae287cde16..cc9cfaae4f01 100644 --- a/arch/x86/events/perf_event.h +++ b/arch/x86/events/perf_event.h @@ -1243,7 +1243,7 @@ static inline int x86_pmu_rdpmc_index(int index) return x86_pmu.rdpmc_index ? x86_pmu.rdpmc_index(index) : index; } =20 -bool check_hw_exists(struct pmu *pmu, unsigned long *cntr_mask, +bool check_hw_exists(unsigned long *cntr_mask, unsigned long *fixed_cntr_mask); =20 int x86_add_exclusive(unsigned int what); @@ -1456,13 +1456,6 @@ ssize_t events_hybrid_sysfs_show(struct device *dev, struct device_attribute *attr, char *page); =20 -static inline bool fixed_counter_disabled(int i, struct pmu *pmu) -{ - u64 intel_ctrl =3D hybrid(pmu, intel_ctrl); - - return !(intel_ctrl >> (i + INTEL_PMC_IDX_FIXED)); -} - #ifdef CONFIG_CPU_SUP_AMD =20 int amd_pmu_init(void); --=20 2.34.1 From nobody Sat Jul 25 05:59:34 2026 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E2DB53E3C5A; Fri, 17 Jul 2026 08:10:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784275817; cv=none; b=VzWQ3C745z+GfFkA+gOa3/ZGEsG/aSPe9lzweuLvW/RW/tIfLE1VplTiOS0Ux9P2UiJKNgfTXwR4gL7GBSEqLWgt1dhbL20EV8kvIhwJgjiSeO3N1p3IJxv+6nCtbTWR90hvFvnV7ZvG9cWIvf8yyUnTKM1BLKIXOvgAxrhUul8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784275817; c=relaxed/simple; bh=x0SRUQAN5Hb36s0gbXv08/7UvwF8Otz4PJRFUl96dFU=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=hhi1K0+TuapFvr4FCfvlbWsBLEi/3upWGB5nUzck6FjGWKgjxeawLGIpK1WMsUjLb6msKBmzb7Ahv9vjMotWH//gC5+bsG0CtoQcVlZmDEPfst1u5uvunb7u04BnQZa2m54/FZpOD7eD7I33iGjqIJ4inqKyp/J4witMUnR8C2o= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com; spf=pass smtp.mailfrom=linux.intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=hX2kJr8J; arc=none smtp.client-ip=192.198.163.18 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="hX2kJr8J" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1784275816; x=1815811816; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=x0SRUQAN5Hb36s0gbXv08/7UvwF8Otz4PJRFUl96dFU=; b=hX2kJr8JXZYYCFPektk0iDSQSI6UKZA1nsS8rHg8cMKqMxYN2WBROz1u JSBcTzTNi2ce7LOurI+3KujMz83iOqqmPwr2mxC4mF911hl5IJXpgNRva 9QIL3IwpQNJI4x/+elLOa+gY5YBBb+W2nTqWQDpnlUofjzdo+YsSXPIbb PeGzsKHwEVFoPqxrieQAtIdZ+IAULIIi/oFSPoYBJqtLwah6/H+RKtqFD N3ubFyDVRskGEwmmKX+plFlWX4HLr5goEXMexyP3kHXVmbACqrpkom3UB 0006kXU2J9UZf63VsntFemwT7s2gcccUW2s0UvPBpgYQxv85fD/0TVQlN w==; X-CSE-ConnectionGUID: vd6Ram+RR6O+dP4/AFevnw== X-CSE-MsgGUID: Xc0kBWVkRzywv+/yo9PSKg== X-IronPort-AV: E=McAfee;i="6800,10657,11848"; a="84065562" X-IronPort-AV: E=Sophos;i="6.25,169,1779174000"; d="scan'208";a="84065562" Received: from fmviesa007.fm.intel.com ([10.60.135.147]) by fmvoesa112.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Jul 2026 01:10:16 -0700 X-CSE-ConnectionGUID: Gpi0miEWQKizsQ6dL+b7lg== X-CSE-MsgGUID: jhZDm7JIS3ql+UPE5m7Kxw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.25,169,1779174000"; d="scan'208";a="253315479" Received: from spr.sh.intel.com ([10.112.229.196]) by fmviesa007.fm.intel.com with ESMTP; 17 Jul 2026 01:10:12 -0700 From: Dapeng Mi To: Peter Zijlstra , Ingo Molnar , Arnaldo Carvalho de Melo , Namhyung Kim , Ian Rogers , Adrian Hunter , Alexander Shishkin , Andi Kleen , Eranian Stephane Cc: linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, Dapeng Mi , Zide Chen , Falcon Thomas , Xudong Hao , Dapeng Mi Subject: [Patch v3 6/8] perf/x86/intel: Fix intel_cap handling on hybrid PMUs Date: Fri, 17 Jul 2026 16:03:40 +0800 Message-Id: <20260717080342.1879573-7-dapeng1.mi@linux.intel.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260717080342.1879573-1-dapeng1.mi@linux.intel.com> References: <20260717080342.1879573-1-dapeng1.mi@linux.intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" intel_cap (IA32_PERF_CAPABILITIES) updates are currently tied to X86_FEATURE_ARCH_PERFMON_EXT, but these are independent feature paths. As a result, hybrid PMU capability state can be updated under the wrong condition. Also, intel_pmu_broken_perf_cap() is too narrow. Per RPL018, the missing PERF_METRICS_AVAILABLE bit affects both Raptor Lake and Meteor Lake parts, not only the currently covered subset. Move intel_cap updates out of the ARCH_PERFMON_EXT-gated path, extend intel_pmu_broken_perf_cap() coverage to both RPL and MTL families, and introduce intel_update_pmu_caps() to centralize PMU capability updates. Signed-off-by: Dapeng Mi Reviewed-by: Thomas Falcon Reviewed-by: Zide Chen --- arch/x86/events/intel/core.c | 41 ++++++++++++++++++++++++++---------- 1 file changed, 30 insertions(+), 11 deletions(-) diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c index c418176065f6..361f8e0ab36c 100644 --- a/arch/x86/events/intel/core.c +++ b/arch/x86/events/intel/core.c @@ -6147,8 +6147,15 @@ static void intel_pmu_check_extra_regs(struct extra_= reg *extra_regs); =20 static inline bool intel_pmu_broken_perf_cap(void) { - /* The Perf Metric (Bit 15) is always cleared */ - if (boot_cpu_data.x86_vfm =3D=3D INTEL_METEORLAKE || + /* + * The Perf Metric (Bit 15) is always cleared on P-core of + * RPL and MTL. Details can be found in RPL018 erratum. + * https://edc.intel.com/content/www/us/en/design/products/platforms/deta= ils/raptor-lake-s/13th-generation-core-processor-specification-update/errat= a-details/ + */ + if (boot_cpu_data.x86_vfm =3D=3D INTEL_RAPTORLAKE || + boot_cpu_data.x86_vfm =3D=3D INTEL_RAPTORLAKE_P || + boot_cpu_data.x86_vfm =3D=3D INTEL_RAPTORLAKE_S || + boot_cpu_data.x86_vfm =3D=3D INTEL_METEORLAKE || boot_cpu_data.x86_vfm =3D=3D INTEL_METEORLAKE_L) return true; =20 @@ -6183,7 +6190,7 @@ static inline void __intel_update_large_pebs_flags(st= ruct pmu *pmu) =20 #define counter_mask(_gp, _fixed) ((_gp) | ((u64)(_fixed) << INTEL_PMC_IDX= _FIXED)) =20 -static void update_pmu_cap(struct pmu *pmu) +static void update_pmu_cap_from_perfmonext(struct pmu *pmu) { unsigned int eax, ebx, ecx, edx; union cpuid35_eax eax_0; @@ -6241,10 +6248,24 @@ static void update_pmu_cap(struct pmu *pmu) WARN_ON(x86_pmu.arch_pebs =3D=3D 1); x86_pmu.arch_pebs =3D 0; } +} + +static void intel_update_pmu_caps(struct pmu *pmu) +{ + if (this_cpu_has(X86_FEATURE_ARCH_PERFMON_EXT)) + update_pmu_cap_from_perfmonext(pmu); =20 - if (!intel_pmu_broken_perf_cap()) { - /* Perf Metric (Bit 15) and PEBS via PT (Bit 16) are hybrid enumeration = */ - rdmsrq(MSR_IA32_PERF_CAPABILITIES, hybrid(pmu, intel_cap).capabilities); + if (is_hybrid() && this_cpu_has(X86_FEATURE_PDCM)) { + rdmsrq(MSR_IA32_PERF_CAPABILITIES, + hybrid(pmu, intel_cap).capabilities); + + /* + * Restore perf_metrics on platforms with broken + * perf_capablities. + */ + if (intel_pmu_broken_perf_cap() && + hybrid_pmu(pmu)->pmu_type =3D=3D hybrid_big) + hybrid(pmu, intel_cap).perf_metrics =3D 1; } } =20 @@ -6329,9 +6350,7 @@ static bool init_hybrid_pmu(int cpu) if (!cpumask_empty(&pmu->supported_cpus)) goto end; =20 - if (this_cpu_has(X86_FEATURE_ARCH_PERFMON_EXT)) - update_pmu_cap(&pmu->pmu); - + intel_update_pmu_caps(&pmu->pmu); intel_pmu_check_hybrid_pmus(pmu); =20 if (!check_hw_exists(pmu->cntr_mask, pmu->fixed_cntr_mask)) { @@ -8828,8 +8847,8 @@ __init int intel_pmu_init(void) * from the leaf 0xa. The core specific update will be done later * when a new type is online. */ - if (!is_hybrid() && boot_cpu_has(X86_FEATURE_ARCH_PERFMON_EXT)) - update_pmu_cap(NULL); + if (!is_hybrid()) + intel_update_pmu_caps(NULL); =20 if (x86_pmu.arch_pebs) { static_call_update(intel_pmu_disable_event_ext, --=20 2.34.1 From nobody Sat Jul 25 05:59:34 2026 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 66C173E4C6B; Fri, 17 Jul 2026 08:10:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784275820; cv=none; b=Zb18t4UIRpqwu31XlhJV8U81oEhMtcW8LT4b0KuySbfSJYt4Go8rsNXDN6xc3iDItM2NFL4rCYimV6aNS0qz5IrInoQzfHpuADdiyARVrgwVyX9cl4x5EqXPAEtajJcR2VYJMgxQOm/TC2V3qgdNCxJ4IO2f7kspqq1NElP23nA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784275820; c=relaxed/simple; bh=2XoQz/r08PTbjhRF90PB9DNSQmS11LLXzQseGbyIEcY=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=j+M12Et2lC99cr5wS8cNIBfLyrwcGufdYkhn3f22SDkzUUqFkat1PqMw5lVNA44yJ+1jruRC88u7v9pR+2xUhPBG5zD2QMpB4IYH0FNLU3kddbLiyNKdVQkO+UrWgmtYnm7fM9RYh+h9bSp+I0PhGWdlmlWlVGqkYknRbYqiJ5s= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com; spf=pass smtp.mailfrom=linux.intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=CRdVErbf; arc=none smtp.client-ip=192.198.163.18 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="CRdVErbf" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1784275820; x=1815811820; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=2XoQz/r08PTbjhRF90PB9DNSQmS11LLXzQseGbyIEcY=; b=CRdVErbfgUYpZNbBnjCcmse7f/xmuej2y/MaCyH0gx8bHzbgEMrwOUCJ 6XMwekw+5fSPlAz1FQ4vLDxPvjzzHKvXPbm/JzwMMzBYehsi+jG2D3mML zNorbOCZB8HBkKXvECV8Pgk2Ujxi3ESmc+B2ebIH4ogRsJppa7kfdEPlN lXPDxy2woYhxvhXvj4oBmEKbWSPpPDJZ1qZIG7v+KW0mE2W/99Z/kqYwr X3jrTcUAAHe68ovhzHiVS6QZT3GEMP6cS2C8ZsM+8kgiW3lJAAcvs8fg7 t2g2dSQIY7sj+RmVcV4rR2TQ0jDp4c4d/Qn4Q1UdeeEuXamSe6UkglaWS g==; X-CSE-ConnectionGUID: zCKeMzz1RMuvCrqfKXC78w== X-CSE-MsgGUID: O7bXNtEbTVuzbUC4TXffoA== X-IronPort-AV: E=McAfee;i="6800,10657,11848"; a="84065582" X-IronPort-AV: E=Sophos;i="6.25,169,1779174000"; d="scan'208";a="84065582" Received: from fmviesa007.fm.intel.com ([10.60.135.147]) by fmvoesa112.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Jul 2026 01:10:19 -0700 X-CSE-ConnectionGUID: b9KdwjRcQgC1OJc1ErRR8Q== X-CSE-MsgGUID: 6yMxLjWARxCXLCgqRkAGFA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.25,169,1779174000"; d="scan'208";a="253315482" Received: from spr.sh.intel.com ([10.112.229.196]) by fmviesa007.fm.intel.com with ESMTP; 17 Jul 2026 01:10:15 -0700 From: Dapeng Mi To: Peter Zijlstra , Ingo Molnar , Arnaldo Carvalho de Melo , Namhyung Kim , Ian Rogers , Adrian Hunter , Alexander Shishkin , Andi Kleen , Eranian Stephane Cc: linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, Dapeng Mi , Zide Chen , Falcon Thomas , Xudong Hao , Dapeng Mi Subject: [Patch v3 7/8] perf/x86: Optimize ACR handling in match_prev_assignment() Date: Fri, 17 Jul 2026 16:03:41 +0800 Message-Id: <20260717080342.1879573-8-dapeng1.mi@linux.intel.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260717080342.1879573-1-dapeng1.mi@linux.intel.com> References: <20260717080342.1879573-1-dapeng1.mi@linux.intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" match_prev_assignment() currently forces a mismatch for ACR events, so ACR counter indices are reprogrammed on every scheduling pass. That causes avoidable overhead because disable and enable paths must touch multiple MSRs. The previous ACR assignment is already cached in acr_cfg_b[]. Use that state to compare the newly computed ACR counter indices in hwc->config1 against the cached value in acr_cfg_b[hwc->idx]. If they match, skip unnecessary disable and enable work. Also tighten is_acr_self_reload_event() so it first verifies the event is an ACR event before testing for the self-reload case. Signed-off-by: Dapeng Mi Reviewed-by: Thomas Falcon Reviewed-by: Zide Chen --- arch/x86/events/core.c | 13 ++++++++++++- arch/x86/events/perf_event.h | 2 +- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c index 143a6e735d9e..8b3ea0adb965 100644 --- a/arch/x86/events/core.c +++ b/arch/x86/events/core.c @@ -1297,6 +1297,17 @@ int x86_perf_rdpmc_index(struct perf_event *event) return event->hw.event_base_rdpmc; } =20 +static inline bool acr_match_prev_indices(struct perf_event *event, + struct cpu_hw_events *cpuc) +{ + struct hw_perf_event *hwc =3D &event->hw; + + if (!is_acr_event_group(event)) + return true; + /* ACR counter indices don't change. */ + return hwc->config1 =3D=3D cpuc->acr_cfg_b[hwc->idx]; +} + static inline int match_prev_assignment(struct perf_event *event, struct cpu_hw_events *cpuc, int i) @@ -1306,7 +1317,7 @@ static inline int match_prev_assignment(struct perf_e= vent *event, return hwc->idx =3D=3D cpuc->assign[i] && hwc->last_cpu =3D=3D smp_processor_id() && hwc->last_tag =3D=3D cpuc->tags[i] && - !is_acr_event_group(event); + acr_match_prev_indices(event, cpuc); } =20 static void x86_pmu_start(struct perf_event *event, int flags); diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h index cc9cfaae4f01..fa381110f7a7 100644 --- a/arch/x86/events/perf_event.h +++ b/arch/x86/events/perf_event.h @@ -141,7 +141,7 @@ static inline bool is_acr_self_reload_event(struct perf= _event *event) { struct hw_perf_event *hwc =3D &event->hw; =20 - if (hwc->idx < 0) + if (hwc->idx < 0 || !is_acr_event_group(event)) return false; =20 return test_bit(hwc->idx, (unsigned long *)&hwc->config1); --=20 2.34.1 From nobody Sat Jul 25 05:59:34 2026 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1802A3E00A7; Fri, 17 Jul 2026 08:10:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784275824; cv=none; b=pkrVcWLjDOB2ZjOPcwGJ1nU+SeoXtwdZOiZ4fD42pRcf1XKyTnx3X5a8ruMominRDBuuyQpk8oPwvcS9jgryTdemvotSoL8fQWXK39La0AZ7y92IN6Sd7usXdAy7QWhyGOmggpqLmSVuAIE3VeOD8Nf+Q28pM+WVwUxpTQXuqzM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784275824; c=relaxed/simple; bh=joy9KmE+zXckzB/IpdRag9bXM8lxCGCgXPq5Cj4nKus=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=P0OP+FqsP9r5wYz8s+gUV5s38/AsdNVbb0SfRAKbOM30xTs4yjf+Be87a0OLaMDbpFVIx3X+i9ILk66tZH1Jwf4/vO3soGN0p+Ea3KTWo7zmu6x7XpM/YEXZ6bWy3PictOb5LsT8j8vaiyD/PTE++d9hsBj/9pymEF/wB/MMV+k= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com; spf=pass smtp.mailfrom=linux.intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=nvjWEaeJ; arc=none smtp.client-ip=192.198.163.18 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="nvjWEaeJ" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1784275823; x=1815811823; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=joy9KmE+zXckzB/IpdRag9bXM8lxCGCgXPq5Cj4nKus=; b=nvjWEaeJ65l3mwaCBQjbar9FlIiorntpXiCXfwcU6bXZ0C0P7dBuBw4j sEjPZMaTwhGy7Q30KeVy18lfELd6OZ2ZagO3ah0+RMNVo1L09dQM16pbW HkcZ7C6QcHu0zSeRftU7wL9LseDiM63JEwxeO5A5WjSzgayRzHBw+dRg4 8PfaP8XL+K3jFySC80crl4se0LH+rWGUBaRbYdwalA1fMHIEGgWLIi6Yi HeKkBJ2+HoeV6bJOEb+CHyv8wISgWR8V4SoYenserNGTqAXp/ZEJAU802 P+lFdNtx4xetgm6LqaLequqvKz8FxrlOSsRzNVZwyfi5II/SRkgkYvDLh A==; X-CSE-ConnectionGUID: RFBNuEEITPK2/hwL4ixdEg== X-CSE-MsgGUID: nltjhvxyQKay3niwKuZAiA== X-IronPort-AV: E=McAfee;i="6800,10657,11848"; a="84065592" X-IronPort-AV: E=Sophos;i="6.25,169,1779174000"; d="scan'208";a="84065592" Received: from fmviesa007.fm.intel.com ([10.60.135.147]) by fmvoesa112.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Jul 2026 01:10:23 -0700 X-CSE-ConnectionGUID: 5FWruUzyQIqZBsdyYO1HnQ== X-CSE-MsgGUID: ofZY702TQUqudCczxT1qHA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.25,169,1779174000"; d="scan'208";a="253315488" Received: from spr.sh.intel.com ([10.112.229.196]) by fmviesa007.fm.intel.com with ESMTP; 17 Jul 2026 01:10:19 -0700 From: Dapeng Mi To: Peter Zijlstra , Ingo Molnar , Arnaldo Carvalho de Melo , Namhyung Kim , Ian Rogers , Adrian Hunter , Alexander Shishkin , Andi Kleen , Eranian Stephane Cc: linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, Dapeng Mi , Zide Chen , Falcon Thomas , Xudong Hao , Dapeng Mi Subject: [Patch v3 8/8] perf/x86/intel: Prevent drain_pebs() reentry Date: Fri, 17 Jul 2026 16:03:42 +0800 Message-Id: <20260717080342.1879573-9-dapeng1.mi@linux.intel.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260717080342.1879573-1-dapeng1.mi@linux.intel.com> References: <20260717080342.1879573-1-dapeng1.mi@linux.intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The PEBS buffer is shared by all events on a CPU, so drain_pebs() must not run concurrently. If it is reentered, one instance may observe stale buffer state and potentially access out-of-bound memory. Most invocations happen in NMI context, which naturally prevents reentry. However, drain_pebs() is also reachable from process context via intel_pmu_drain_pebs_buffer(). In those paths, the PMU is often already disabled, but not guaranteed. For example, __intel_pmu_pebs_disable() only disables the target counter, so other active counters can still raise a PMI and interrupt an in-flight drain_pebs(). Introduce __intel_pmu_quiesce() and __intel_pmu_resume() helpers and use them in intel_pmu_drain_pebs_buffer() to disable the full PMU around the drain_pebs() call, preventing reentry. Signed-off-by: Dapeng Mi Reviewed-by: Zide Chen --- arch/x86/events/intel/core.c | 40 ++++++++++++++++++++++++++++-------- arch/x86/events/intel/ds.c | 7 ------- 2 files changed, 32 insertions(+), 15 deletions(-) diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c index 361f8e0ab36c..726b39b9bba9 100644 --- a/arch/x86/events/intel/core.c +++ b/arch/x86/events/intel/core.c @@ -3125,6 +3125,36 @@ static void intel_pmu_del_event(struct perf_event *e= vent) this_cpu_ptr(&cpu_hw_events)->n_late_setup--; } =20 +static inline void __intel_pmu_quiesce(bool pmu_enabled) +{ + struct cpu_hw_events *cpuc =3D this_cpu_ptr(&cpu_hw_events); + + cpuc->enabled =3D 0; + if (pmu_enabled) + intel_pmu_disable_all(); +} + +static inline void __intel_pmu_resume(bool pmu_enabled) +{ + struct cpu_hw_events *cpuc =3D this_cpu_ptr(&cpu_hw_events); + + cpuc->enabled =3D pmu_enabled; + if (pmu_enabled) + intel_pmu_enable_all(0); +} + +void intel_pmu_drain_pebs_buffer(void) +{ + struct cpu_hw_events *cpuc =3D this_cpu_ptr(&cpu_hw_events); + bool pmu_enabled =3D cpuc->enabled; + struct perf_sample_data data; + + /* Disable PMU so no new PMI can interrupt and re-enter drain_pebs(). */ + __intel_pmu_quiesce(pmu_enabled); + static_call(x86_pmu_drain_pebs)(NULL, &data); + __intel_pmu_resume(pmu_enabled); +} + static int icl_set_topdown_event_period(struct perf_event *event) { struct hw_perf_event *hwc =3D &event->hw; @@ -3322,10 +3352,7 @@ static void intel_pmu_read_event(struct perf_event *= event) if (is_metric_event(event) && (cpuc->txn_flags & PERF_PMU_TXN_READ)) return; =20 - cpuc->enabled =3D 0; - if (pmu_enabled) - intel_pmu_disable_all(); - + __intel_pmu_quiesce(pmu_enabled); /* * If the PEBS counters snapshotting is enabled, * the topdown event is available in PEBS records. @@ -3334,10 +3361,7 @@ static void intel_pmu_read_event(struct perf_event *= event) static_call(intel_pmu_update_topdown_event)(event, NULL); else intel_pmu_drain_pebs_buffer(); - - cpuc->enabled =3D pmu_enabled; - if (pmu_enabled) - intel_pmu_enable_all(0); + __intel_pmu_resume(pmu_enabled); =20 return; } diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c index e86e4ba91e1b..7f8b98d1837d 100644 --- a/arch/x86/events/intel/ds.c +++ b/arch/x86/events/intel/ds.c @@ -1240,13 +1240,6 @@ int intel_pmu_drain_bts_buffer(void) return 1; } =20 -void intel_pmu_drain_pebs_buffer(void) -{ - struct perf_sample_data data; - - static_call(x86_pmu_drain_pebs)(NULL, &data); -} - /* * PEBS */ --=20 2.34.1