From nobody Thu Sep 24 17:55:41 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 48E6C23BCED; Tue, 22 Sep 2026 01:13:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790039610; cv=none; b=jKR+HsbV5YiFTqLH67Jvn6foHgU3MpoKMiWeZPE+2Hp/O55woRy1PRgkbBOwrHbm2qPT7wXYFmrd3nwbzJYDT1+IRjMKTzibLWhj+vT2qnoOodAgXdIFATu2Kkn3eKWH61wkFoDgwnohQ4CJRKxz9OGIFO+8Lag6h4GjcxY5wu4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790039610; c=relaxed/simple; bh=YXL9stNuFSe0druMEK4OBXRkQjvEGxpipLAr1y5OXtc=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=mtMzFa0EX+kBxxO1hzCOe6Comavzuny7qHcAr1uEbOY2nIS/GR6Tq1xPOwKiiMZB4NkX4UEz2cSaHrAUyd3NRFHwg7W56kSMDMIwnLng2ihzawlR3HtFJnmuI+8iCSwgsZmiI9CJ0dKtAn4t+wpzCX07WwdkEF04+J+7QzeAu1U= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=rjRVPBCs; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="rjRVPBCs" Received: by smtp.kernel.org (Postfix) with ESMTPS id EC4D1C2BCF6; Tue, 22 Sep 2026 01:13:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1790039610; bh=YXL9stNuFSe0druMEK4OBXRkQjvEGxpipLAr1y5OXtc=; h=From:Date:Subject:References:In-Reply-To:To:Cc:Reply-To:From; b=rjRVPBCsGj/b9M3MvgIMfdgtRfsQOG3OG5ZgCFquGbWRvwyBUFvdER+noZhfDKb4M R3lSEU+ZT1fy3Io2lCAoaEQ8ZxeNGtkpQHKMsV/UHlexInowrT7vv7v+p3awlL3AXZ zVm9AMFlLBOciOa6E+CB2icCXnTOzi6e8+8hstuVn9Fzd0UPmrZYFKJFzVLVHNY9TR d5u3xmBc7tnK53ELcNPOiFW2sm8Xu0V0tTeK4ljGTJTm7iWt1IzRJ1qQn7YygrXSvh 2pGqSNLy8VQOgsxJRhaRQIEjdsuqxTiXlvKRcLsArHb1XTJfMxaGGC4b6FZb9Gc1Se +FJgL8dj2arhg== Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id CA1F0C982F0; Tue, 22 Sep 2026 01:13:29 +0000 (UTC) From: Jaidev Shastri via B4 Relay Date: Mon, 21 Sep 2026 21:13:24 -0400 Subject: [PATCH 1/3] perf/core: publish the aux_event link with release semantics Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260921-mb-perf-core-v1-1-ac56a719c02b@vt.edu> References: <20260921-mb-perf-core-v1-0-ac56a719c02b@vt.edu> In-Reply-To: <20260921-mb-perf-core-v1-0-ac56a719c02b@vt.edu> To: Peter Zijlstra , Ingo Molnar , Arnaldo Carvalho de Melo , Namhyung Kim , Mark Rutland , Alexander Shishkin , Jiri Olsa , Ian Rogers , Adrian Hunter , James Clark Cc: linux-perf-users@vger.kernel.org, linux-kernel@vger.kernel.org, Jaidev Shastri X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=ed25519-sha256; t=1790039609; l=2045; i=jaidevshastri@vt.edu; s=20260921; h=from:subject:message-id; bh=Hy0/fktxi3buuF66+I6+QW/1V+ole54AgH7uVyKIW/c=; b=qTk3z/ml5HJ1ZgNOvAaiiTN6s5dcMJurLA/dd6L/hXaZ5pFrdMDyzkTnWMC/UqtkzGQ5YsYKr h/0ZpyMn9NrCpIXOgzFsu8ubcFfW+7EAoeqsiAm7lTCfZ/Hmttj+k1c X-Developer-Key: i=jaidevshastri@vt.edu; a=ed25519; pk=J7+xYJRlTPds+pv5hbqFFRqGCpDeJDzmZT1ggRwj7/0= X-Endpoint-Received: by B4 Relay for jaidevshastri@vt.edu/20260921 with auth_id=1044 X-Original-From: Jaidev Shastri Reply-To: jaidevshastri@vt.edu From: Jaidev Shastri perf_get_aux_event() links an aux_output event to its group leader with a plain store to event->aux_event once the leader has been validated. perf_aux_output_begin() and the AUX sample path read the link with plain loads, from the PMU interrupt on the CPU the event is scheduled on. Store the link with smp_store_release() and read it with smp_load_acquire(), so that a reader that sees the link also sees the state of the leader it points at. Found with MBCheck, a static herd7-based memory consistency checker. Signed-off-by: Jaidev Shastri --- kernel/events/core.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index db7b76d6b..7cce3fc7c 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -2332,7 +2332,8 @@ static int perf_get_aux_event(struct perf_event *even= t, * group in torn down, the aux_output events loose their * link to the aux_event and can't schedule any more. */ - event->aux_event =3D group_leader; + /* Pairs with the smp_load_acquire() in the AUX output paths. */ + smp_store_release(&event->aux_event, group_leader); =20 return 1; } @@ -7974,7 +7975,8 @@ static unsigned long perf_prepare_sample_aux(struct p= erf_event *event, struct perf_sample_data *data, size_t size) { - struct perf_event *sampler =3D event->aux_event; + /* Pairs with the smp_store_release() in perf_get_aux_event(). */ + struct perf_event *sampler =3D smp_load_acquire(&event->aux_event); struct perf_buffer *rb; =20 data->aux_size =3D 0; @@ -8046,7 +8048,8 @@ static void perf_aux_sample_output(struct perf_event = *event, struct perf_output_handle *handle, struct perf_sample_data *data) { - struct perf_event *sampler =3D event->aux_event; + /* Pairs with the smp_store_release() in perf_get_aux_event(). */ + struct perf_event *sampler =3D smp_load_acquire(&event->aux_event); struct perf_buffer *rb; unsigned long pad; long size; --=20 2.43.0 From nobody Thu Sep 24 17:55:41 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 48EF03515CB; Tue, 22 Sep 2026 01:13:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790039610; cv=none; b=hyLBoQ2bjtTJHaePkb4RB1vNI6UOFzof3Av+LH5O/2XME4IQdfdFmtGFId+r+yVnjBZYoIKRrIwesz1049p/Vnd6sFvv1xXclGBJysZ9Q7zYnAS1smZaRwRw7SO8WVg8v9D7wumuyQrxhfHEKe/WxkCfp0BNqvyFif6vhPEHgF4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790039610; c=relaxed/simple; bh=UR5nFJwkj174M38Rf7pMCMXwi0EDVRjVxKZ8ctRigsw=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=JNTdO4qe4zRAdX3zYu2fbkxxJ2EQUfVAy1u6iU0pyxjwihhL/qSleUfAQR7b+AIz6H8p6WZ/bdOsl23Xzny+ELOFXEO6MwtwWpeLRXTKcmTFVVufVz2A+ThfeFQ9jy8GAWAfbeHij87cqCmHsW7nZR4r86HPRXQo1KkSBJ1R/7g= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=pNx8KIRq; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="pNx8KIRq" Received: by smtp.kernel.org (Postfix) with ESMTPS id 04C9EC2BCFB; Tue, 22 Sep 2026 01:13:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1790039610; bh=UR5nFJwkj174M38Rf7pMCMXwi0EDVRjVxKZ8ctRigsw=; h=From:Date:Subject:References:In-Reply-To:To:Cc:Reply-To:From; b=pNx8KIRq5ALClGkuXNf/Pylrxb+kncfvfj6ZkRKmiQ8J1Hor/se3sue30XyXf586M r7AoFeHbtGpw03X9mhFRONgOewY74ICh0AsAkkYhxTDi0UZ5wfkRAPNw/U4y1UJjoq qp7dj88Iopy2XroCgGs+7q8bjR6/sVREpXCc3Rqit8KITSofYHK+dUWH9Do+LQ8Wkb JaXg5SWEqn16jDL2Xs144A8RjLTNJdDJaNg/IJ7VtTdLcy2kEpjK3Yoq3c0PfIIdl/ WrTHQf+bAU6C14iJtgbzHE9R09MkyrU1n+sfgi8Awyzj3aarRPdjdObnmUcunYnw8u 9hZI3cIyq497A== Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D8A12C982E6; Tue, 22 Sep 2026 01:13:29 +0000 (UTC) From: Jaidev Shastri via B4 Relay Date: Mon, 21 Sep 2026 21:13:25 -0400 Subject: [PATCH 2/3] perf/core: install the guest callbacks before the guest_state gate Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260921-mb-perf-core-v1-2-ac56a719c02b@vt.edu> References: <20260921-mb-perf-core-v1-0-ac56a719c02b@vt.edu> In-Reply-To: <20260921-mb-perf-core-v1-0-ac56a719c02b@vt.edu> To: Peter Zijlstra , Ingo Molnar , Arnaldo Carvalho de Melo , Namhyung Kim , Mark Rutland , Alexander Shishkin , Jiri Olsa , Ian Rogers , Adrian Hunter , James Clark Cc: linux-perf-users@vger.kernel.org, linux-kernel@vger.kernel.org, Jaidev Shastri X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=ed25519-sha256; t=1790039609; l=2132; i=jaidevshastri@vt.edu; s=20260921; h=from:subject:message-id; bh=EKbfAAEuHXRbqtIgqar7H0RYkgyyMtdCwdbGpT3bE1g=; b=ZpaU9ZI7WaXpXDJiGjpiEAoMai0KL5ezxVwvrrROvMJEBwc+0IBlyTwqSd1W2F0D6S/fniuMh wzTVRlQWoAoDYA3yPvj1G9kbXzDwywaxXX1uYJwID+O076zZvPR98hn X-Developer-Key: i=jaidevshastri@vt.edu; a=ed25519; pk=J7+xYJRlTPds+pv5hbqFFRqGCpDeJDzmZT1ggRwj7/0= X-Endpoint-Received: by B4 Relay for jaidevshastri@vt.edu/20260921 with auth_id=1044 X-Original-From: Jaidev Shastri Reply-To: jaidevshastri@vt.edu From: Jaidev Shastri perf_register_guest_info_callbacks() updates the __perf_guest_state static call first and __perf_guest_get_ip and the interrupt handlers afterwards. perf_instruction_pointer() and perf_misc_flags() test perf_guest_state() and then call perf_guest_get_ip(). Without CONFIG_HAVE_STATIC_CALL, which arm64 selects only under CFI, a static call is a plain load of key->func. A PMI on another CPU can then see the new state callback while get_ip still resolves to the RET0 default, and report an instruction pointer of zero for a guest sample. Install the callees first and the gate last, separated by smp_wmb(). The reader keeps its control dependency. Found with MBCheck, a static herd7-based memory consistency checker. Signed-off-by: Jaidev Shastri --- kernel/events/core.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index 7cce3fc7c..3b5c59263 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -7760,7 +7760,14 @@ void perf_register_guest_info_callbacks(struct perf_= guest_info_callbacks *cbs) return; =20 rcu_assign_pointer(perf_guest_cbs, cbs); - static_call_update(__perf_guest_state, cbs->state); + + /* + * perf_guest_state() is the gate the PMI paths test before they call + * perf_guest_get_ip() and the interrupt handlers. On architectures + * without inline static calls the updates are plain pointer stores, + * so install the callees first and the gate last, behind a write + * barrier. + */ static_call_update(__perf_guest_get_ip, cbs->get_ip); =20 /* Implementing ->handle_intel_pt_intr is optional. */ @@ -7771,6 +7778,10 @@ void perf_register_guest_info_callbacks(struct perf_= guest_info_callbacks *cbs) if (cbs->handle_mediated_pmi) static_call_update(__perf_guest_handle_mediated_pmi, cbs->handle_mediated_pmi); + + /* Order the callee updates above before the gate below. */ + smp_wmb(); + static_call_update(__perf_guest_state, cbs->state); } EXPORT_SYMBOL_GPL(perf_register_guest_info_callbacks); =20 --=20 2.43.0 From nobody Thu Sep 24 17:55:41 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4FEAE35C6B7; Tue, 22 Sep 2026 01:13:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790039610; cv=none; b=NfdcPX2zdUNa/d1jqez0aMdSi0ZDm02QrY9US4Rtrv8XykcYosb3denvEvcZMt476yRMsnwbT7YFHdeUZi2gCHWSXBk84keVOxj3SwU/TYUCxnf8jj+DA81XBhlsD3C4g8h8bV3PAVwkvVAhN7wT05xEQNXZ5B1PyohiDmWzPKQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790039610; c=relaxed/simple; bh=Ej+weExnuvVg70R3r/g50KjZGMf2VssZCojSw8Yq/vs=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=UywzmsL0rwikoU0nYhpXvvEPMxefZMX90TX0ewtQT06sTXVHxmCRHCvRQimR+lmyWJjNfSBFbykrIgQk5jj8iO1kxFYi4fqergSBTT/2wHvxCJ3QxjkSULY1cSLOzpBP1sw0yogpfs6qTgPuXhPgJCFesQ7EOBtBu3q+mtMDQ80= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=M+AKq3jn; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="M+AKq3jn" Received: by smtp.kernel.org (Postfix) with ESMTPS id 11E12C2BCFC; Tue, 22 Sep 2026 01:13:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1790039610; bh=Ej+weExnuvVg70R3r/g50KjZGMf2VssZCojSw8Yq/vs=; h=From:Date:Subject:References:In-Reply-To:To:Cc:Reply-To:From; b=M+AKq3jnswkOZ20GbUf6Umzl7HgKevNtShVxbz1NhWPCCfrLwfiGZVPK23YJlNbu2 efBTEwzrIRwXwbC4X2ROOzbtehV4M2V/naSpL0vV8S3OheDC90/YoDhMKfRr/qpMM4 n6pxtJq3PccHBgmU7tUP+w4rP7py/QdIc8iLGoMQ7pKn+f6HJFgiD4eI1UuMJmRPYl C8018zNjatXw6DfHIu+u1jnb7VZy1rmMdTU/FrQDi01HjN3zgMEV8NLAPScknrCkO7 EX3h/FlyOp/u2iXexXsBSkgRQNs0V6/h0i3Y7n3LxW3GEL3r+8lO9hZ2uQhBKuEopm 1AXk6wgwc9jwQ== Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E7259C982FD; Tue, 22 Sep 2026 01:13:29 +0000 (UTC) From: Jaidev Shastri via B4 Relay Date: Mon, 21 Sep 2026 21:13:26 -0400 Subject: [PATCH 3/3] perf/core: publish perf_event_cache with release semantics Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260921-mb-perf-core-v1-3-ac56a719c02b@vt.edu> References: <20260921-mb-perf-core-v1-0-ac56a719c02b@vt.edu> In-Reply-To: <20260921-mb-perf-core-v1-0-ac56a719c02b@vt.edu> To: Peter Zijlstra , Ingo Molnar , Arnaldo Carvalho de Melo , Namhyung Kim , Mark Rutland , Alexander Shishkin , Jiri Olsa , Ian Rogers , Adrian Hunter , James Clark Cc: linux-perf-users@vger.kernel.org, linux-kernel@vger.kernel.org, Jaidev Shastri X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=ed25519-sha256; t=1790039609; l=1494; i=jaidevshastri@vt.edu; s=20260921; h=from:subject:message-id; bh=9z+ZbfX8GmgFVzF7LoEQWgxvxhbbqsC/PXink/Dvp1s=; b=/70/JM8ao0JfXA+VcpOryBnR41mfWf9xjIYk3gz4OXDmfOP19Wd5NrCTzSFwjArTlKZ++Kqap tBzOO0xuW58CIFQyCix5JW7wg5t7AIPKjOJP6ASSRmcPYnqO7R4sO79 X-Developer-Key: i=jaidevshastri@vt.edu; a=ed25519; pk=J7+xYJRlTPds+pv5hbqFFRqGCpDeJDzmZT1ggRwj7/0= X-Endpoint-Received: by B4 Relay for jaidevshastri@vt.edu/20260921 with auth_id=1044 X-Original-From: Jaidev Shastri Reply-To: jaidevshastri@vt.edu From: Jaidev Shastri perf_event_init() creates perf_event_cache with a plain store, after the pmu_idr has been set up. free_event_rcu() reads the pointer with a plain load from an RCU callback on any CPU. Store it with smp_store_release() and read it with smp_load_acquire(). Found with MBCheck, a static herd7-based memory consistency checker. Signed-off-by: Jaidev Shastri --- kernel/events/core.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index 3b5c59263..74cfb13fe 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -5313,7 +5313,8 @@ static void free_event_rcu(struct rcu_head *head) put_pid_ns(event->ns); perf_event_free_filter(event); kfree(event->addr_filter_ranges); - kmem_cache_free(perf_event_cache, event); + /* Pairs with the smp_store_release() in perf_event_init(). */ + kmem_cache_free(smp_load_acquire(&perf_event_cache), event); } =20 static void ring_buffer_attach(struct perf_event *event, @@ -15404,7 +15405,8 @@ void __init perf_event_init(void) ret =3D init_hw_breakpoint(); WARN(ret, "hw_breakpoint initialization failed with: %d", ret); =20 - perf_event_cache =3D KMEM_CACHE(perf_event, SLAB_PANIC); + /* Pairs with the smp_load_acquire() in free_event_rcu(). */ + smp_store_release(&perf_event_cache, KMEM_CACHE(perf_event, SLAB_PANIC)); =20 /* * Build time assertion that we keep the data_head at the intended --=20 2.43.0