Skip to content

[6.6][Intel-SIG] pmu uncore correctness fixes - #149

Open
quanxianwang wants to merge 33 commits into
openvelinux:opensource-lts_6_6_151_private_prepare-2026-08-31_14-52-33from
quanxianwang:velinux-pmu-uncore-correctness-fixes-6.6-official
Open

quanxianwang wants to merge 33 commits into
openvelinux:opensource-lts_6_6_151_private_prepare-2026-08-31_14-52-33from
quanxianwang:velinux-pmu-uncore-correctness-fixes-6.6-official

Conversation

@quanxianwang

Copy link
Copy Markdown

Description
This PR depends on PR#143. include all PR#143's updates.

https://lore.kernel.org/all/20260611160033.66760-1-zide.chen@intel.com/
perf/x86/intel/uncore: PMU setup robustness fixes

This series fixes correctness issues in Intel uncore PMU setup:

  • If all init_box() on a PMU fails, the PMU sysfs node may still exist,
    while perf events read zeros and silently report wrong data.
  • If init_box() fails on only some dies, perf may return partial
    non-zero counts, which is harder to diagnose.
  • CPU hotplug ref/unref ordering bugs can skip init_box() when the first
    CPU in a die comes online, and can call box_exit() prematurely when
    the second-to-last CPU goes offline.
  • PCI PMU cleanup on setup failure has activeboxes leaks and potential
    NULL pointer dereference in error paths.

To address this, the series introduces a PMU broken state to track setup
failures and switches MSR/MMIO PMUs to lazy registration, matching
existing PCI behavior.

To avoid merge conflicts, this series should be applied after:
https://lore.kernel.org/lkml/20260527151154.130505-1-zide.chen@intel.com/
(textual conflict, no logical dependency)

Test Results:
Test: PASS
LKVS PMU tests on DMR platform
pmu_tests.sh -t basic - PASS
pmu_tests.sh -t uncore - PASS
pmu_tests.sh -t uncore_dmesg - PASS
pmu_tests.sh -t uncore_events - PASS

ls /sys/devices/ | grep uncore
uncore_d2d_dda_0
uncore_d2d_dda_1
uncore_d2d_dda_2
uncore_d2d_dda_3
uncore_d2d_sb2ucie_0
uncore_d2d_sb2ucie_1
uncore_d2d_ula_0
uncore_d2d_ula_1
uncore_d2d_ula_2
uncore_d2d_ula_3
uncore_sbo_0
uncore_sbo_1
uncore_sbo_2
uncore_sbo_3
uncore_sncu

aegl and others added 30 commits September 3, 2026 03:55
commit 9828a1c upstream.

New CPU #defines encode vendor and family as well as model.

  [ bp: Squash *three* uncore patches into one. ]

Intel-SIG: commit 9828a1c perf/x86/intel/uncore: Switch to new Intel CPU model defines.
DMR PMU uncore enabling

Signed-off-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/all/20240424181501.41557-1-tony.luck%40intel.com
[ Quanxian Wang: amend commit log ]
Signed-off-by: Quanxian Wang <quanxian.wang@intel.com>
commit efb0c9c upstream.

Some uncore PMON registers are located in the MMIO space. For the client
machine, the MMIO space is usually located at D0:F0 but in a different
BAR. For example, some uncore PMON registers are located in the SAF BAR,
not the MCHBAR in the Lunar Lake.

The current __uncore_imc_init_box() hard code the BAR information.
Factor out the uncore_get_box_mmio_addr() which uses the BAR information
as a parameter.
The only change is the error output message. The hardcode name 'MCHBAR'
is replaced by the offset of a BAR.

Add a new macro, MMIO_UNCORE_COMMON_OPS(), since the MMIO ops functions
are usually the same among different generations.

Intel-SIG: commit efb0c9c perf/x86/intel/uncore: Factor out common MMIO init and ops functions.
DMR PMU uncore enabling

Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lore.kernel.org/r/20240731141353.759643-2-kan.liang@linux.intel.com
[ Quanxian Wang: amend commit log ]
Signed-off-by: Quanxian Wang <quanxian.wang@intel.com>
commit 9bd7dfe upstream.

The uncore subsystem for Lunar Lake is similar to the previous
Meteor Lake. The uncore PerfMon registers are located at both
MSR and MMIO space.

The ARB and iMC are kept. There is no difference from the Meteor Lake.
Move the global control initialization to the first box of the CBOX.

The sNCU is moved to the MMIO space.

The HBO is newly added and only be accessed from the MMIO space.

Intel-SIG: commit 9bd7dfe perf/x86/intel/uncore: Add Lunar Lake support.
DMR PMU uncore enabling

Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lore.kernel.org/r/20240731141353.759643-3-kan.liang@linux.intel.com
[ Quanxian Wang: amend commit log ]
Signed-off-by: Quanxian Wang <quanxian.wang@intel.com>
commit 64ad6d6ede0cff2997e707dcb051bd4987508c27 upstream.

The Panther Lake supports CBOX, MC, sNCU, and HBO uncore PMON.

The CBOX is similar to Lunar Lake. The only difference is the number of
CBOX.

The other three uncore PMON can be retrieved from the discovery table.
The global control register resides in the sNCU. The global freeze bit
is set by default. It must be cleared before monitoring any uncore
counters.

Intel-SIG: commit 64ad6d6ede0c perf/x86/intel/uncore: Add Panther Lake support.
DMR PMU uncore enabling

Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Link: https://lore.kernel.org/r/20250707201750.616527-4-kan.liang@linux.intel.com
[ Quanxian Wang: amend commit log ]
Signed-off-by: Quanxian Wang <quanxian.wang@intel.com>
commit 098fe55a450b280d8a8584b2511634e1236ba96d upstream.

The discovery base MSR or PCI device is platform-specific and must be
defined statically in the per-platform init table and passed to the
discovery code.

Move the definition of struct intel_uncore_init_fun to uncore.h so it
can be accessed by discovery code, and rename it to reflect that it
now carries more than just init callbacks.

Shorten intel_uncore_has_discovery_tables[_pci/msr] to
uncore_discovery[_pci/msr] for improved readability and alignment.

Drop the `intel_` prefix from new names since the code is under the
intel directory and long identifiers make alignment harder.  Further
cleanups will continue removing `intel_` prefixes.

No functional change intended.

Intel-SIG: commit 098fe55a450b perf/x86/intel/uncore: Move uncore discovery init struct to header.
DMR PMU uncore enabling

Signed-off-by: Zide Chen <zide.chen@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Link: https://patch.msgid.link/20251231224233.113839-2-zide.chen@intel.com
[ Quanxian Wang: amend commit log ]
Signed-off-by: Quanxian Wang <quanxian.wang@intel.com>
commit e75462f6c7eaa5affd922c9a14591cdd5e3ab63d upstream.

On DMR platforms, IMH discovery tables are enumerated via PCI, while
CBB domains use MSRs, unlike earlier platforms which relied on either
PCI or MSR exclusively.

DMR also uses different MSRs and PCI devices, requiring support for
multiple, platform-specific discovery bases.

Introduce struct uncore_discovery_domain to hold the discovery base and
other domain-specific configuration.

Move uncore_units_ignore into uncore_discovery_domain so a single
structure can be passed to uncore_discovery_[pci/msr].

No functional change intended.

Co-developed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Intel-SIG: commit e75462f6c7ea perf/x86/intel/uncore: Support per-platform discovery base devices.
DMR PMU uncore enabling

Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Zide Chen <zide.chen@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Link: https://patch.msgid.link/20251231224233.113839-3-zide.chen@intel.com
[ Quanxian Wang: amend commit log ]
Signed-off-by: Quanxian Wang <quanxian.wang@intel.com>
commit 1897336728b4ab0229fb73bb6f1e94cfe914afa9 upstream.

In the !x86_match_cpu() fallback path, has_generic_discovery_table()
is removed because it does not handle multiple PCI devices.  Instead,
use PCI_ANY_ID in generic_uncore_init[] to probe all PCI devices.

For MSR portals, only probe MSR 0x201e to keep the fallback simple, as
this path is best-effort only.

Intel-SIG: commit 1897336728b4 perf/x86/intel/uncore: Remove has_generic_discovery_table().
DMR PMU uncore enabling

Signed-off-by: Zide Chen <zide.chen@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Link: https://patch.msgid.link/20251231224233.113839-4-zide.chen@intel.com
[ Quanxian Wang: amend commit log ]
Signed-off-by: Quanxian Wang <quanxian.wang@intel.com>
commit 6daf2c35b835da211bf70606e9f74d1af98613a9 upstream.

DMR supports IMH PMON units for PCU, UBox, iMC, and CXL:
- PCU and UBox are same with SPR.
- iMC is similar to SPR but uses different offsets for fixed registers.
- CXL introduces a new port_enable field and changes the position of
  the threshold field.

DMR also introduces additional PMON units: SCA, HAMVF, D2D_ULA, UBR,
PCIE4, CRS, CPC, ITC, OTC, CMS, and PCIE6.  Among these, PCIE4 and
PCIE6 use different unit types, but share the same config register
layout, and the generic PCIe PMON events apply to both.

Additionally, ignore the broken MSE unit.

Intel-SIG: commit 6daf2c35b835 perf/x86/intel/uncore: Add IMH PMON support for Diamond Rapids.
DMR PMU uncore enabling

Signed-off-by: Zide Chen <zide.chen@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/20251231224233.113839-5-zide.chen@intel.com
[ Quanxian Wang: amend commit log ]
Signed-off-by: Quanxian Wang <quanxian.wang@intel.com>
commit 66e2075426f3220857eb3987c803764c82cef851 upstream.

On DMR, PMON units inside the Core Building Block (CBB) are enumerated
separately from those in the Integrated Memory and I/O Hub (IMH).

A new per-CBB MSR (0x710) is introduced for discovery table enumeration.

For counter control registers, the tid_en bit (bit 16) exists on CBO,
SBO, and Santa, but it is not used by any events.  Mark this bit as
reserved.

Similarly, disallow extended umask (bits 32–63) on Santa and sNCU.

Additionally, ignore broken SB2UCIE unit.

Intel-SIG: commit 66e2075426f3 perf/x86/intel/uncore: Add CBB PMON support for Diamond Rapids.
DMR PMU uncore enabling

Signed-off-by: Zide Chen <zide.chen@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Link: https://patch.msgid.link/20251231224233.113839-6-zide.chen@intel.com
[ Quanxian Wang: amend commit log ]
Signed-off-by: Quanxian Wang <quanxian.wang@intel.com>
commit b575fc0e33574f3a476b68057e340ebe32d7b750 upstream.

In the Intel uncore self-describing mechanism, the Global Control
Register freeze_all bit is SoC-wide and propagates to all uncore PMUs.

On Diamond Rapids, this bit is set at power-on, unlike some prior
platforms.  Add a global_init callback to unfreeze all PMON units.

Intel-SIG: commit b575fc0e3357 perf/x86/intel/uncore: Add domain global init callback.
DMR PMU uncore enabling

Signed-off-by: Zide Chen <zide.chen@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Link: https://patch.msgid.link/20251231224233.113839-7-zide.chen@intel.com
[ Quanxian Wang: amend commit log ]
Signed-off-by: Quanxian Wang <quanxian.wang@intel.com>
commit 8a4bd1c0d6bb64ab4d9e94d83c40326356421a73 upstream.

Freerunning counter events are repetitive: the event code is fixed to
0xff, the unit is always "MiB", and the scale is identical across all
counters on a given PMON unit.

Introduce a new helper macro, INTEL_UNCORE_FR_EVENT_DESC(), to populate
the event, scale, and unit descriptor triplet. This reduces duplicated
lines and improves readability.

No functional change intended.

Intel-SIG: commit 8a4bd1c0d6bb perf/x86/intel/uncore: Add freerunning event descriptor helper macro.
DMR PMU uncore enabling

Signed-off-by: Zide Chen <zide.chen@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Link: https://patch.msgid.link/20251231224233.113839-8-zide.chen@intel.com
[ Quanxian Wang: amend commit log ]
Signed-off-by: Quanxian Wang <quanxian.wang@intel.com>
commit d8987048f6655b38453d00782a256179f082b79c upstream.

The free-running counters for IIO uncore blocks on Diamond Rapids are
similar to Sapphire Rapids IMC freecounters, with the following
differences:

- The counters are MMIO based.
- Only a subset of IP blocks implement free-running counters:
  HIOP0 (IP Base Addr: 2E7000h)
  HIOP1 (IP Base Addr: 2EF000h)
  HIOP3 (IP Base Addr: 2FF000h)
  HIOP4 (IP Base Addr: 307000h)
- IMH2 (Secondary IMH) does not provide free-running counters.

Intel-SIG: commit d8987048f665 perf/x86/intel/uncore: Support IIO free-running counters on DMR.
DMR PMU uncore enabling

Signed-off-by: Zide Chen <zide.chen@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Link: https://patch.msgid.link/20251231224233.113839-9-zide.chen@intel.com
[ Quanxian Wang: amend commit log ]
Signed-off-by: Quanxian Wang <quanxian.wang@intel.com>
commit aacb0718fddfe7060576c82e47bbda559c2f2d0d upstream.

Add UNCORE_EVENT_CONSTRAINT_RANGE macro for uncore constraints,
similar to INTEL_EVENT_CONSTRAINT_RANGE, to reduce duplication when
defining consecutive uncore event constraints.

No functional change intended.

Intel-SIG: commit aacb0718fddf perf/x86/intel/uncore: Support uncore constraint ranges.
DMR PMU uncore enabling

Suggested-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Zide Chen <zide.chen@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Link: https://patch.msgid.link/20251231224233.113839-10-zide.chen@intel.com
[ Quanxian Wang: amend commit log ]
Signed-off-by: Quanxian Wang <quanxian.wang@intel.com>
commit 171b5292a82d04e6692f1b19573d15753f21e7fd upstream.

Update event constraints base on the latest DMR uncore event list.

Intel-SIG: commit 171b5292a82d perf/x86/intel/uncore: Update DMR uncore constraints preliminarily.
DMR PMU uncore enabling

Signed-off-by: Zide Chen <zide.chen@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Link: https://patch.msgid.link/20251231224233.113839-11-zide.chen@intel.com
[ Quanxian Wang: amend commit log ]
Signed-off-by: Quanxian Wang <quanxian.wang@intel.com>
commit 2246c24426fbc1069cb2a47e0624ccffe5f2627b upstream.

Diamond Rapids introduces two types of PCIe related uncore PMUs:
"uncore_pcie4_*" and "uncore_pcie6_*".

To ensure that generic PCIe events (e.g., UNC_PCIE_CLOCKTICKS) can match
and collect events from both PMU types, slightly relax the wildcard
matching logic in perf_pmu__match_wildcard().

This change allows a wildcard such as "pcie" to match PMU names that
include a numeric suffix, such as "pcie4_*" and "pcie6_*".

Co-developed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Intel-SIG: commit 2246c24426fb perf pmu: Relax uncore wildcard matching to allow numeric suffix.
DMR PMU uncore enabling

Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Zide Chen <zide.chen@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Link: https://patch.msgid.link/20251231224233.113839-12-zide.chen@intel.com
[ Quanxian Wang: amend commit log ]
Signed-off-by: Quanxian Wang <quanxian.wang@intel.com>
commit e2a39d1a88f00ed83ebc7a19b7673d4ffd50b173 upstream.

Kernel test robot reported:

Unverified Error/Warning (likely false positive, kindly check if
interested):
    arch/x86/events/intel/uncore_discovery.c:293:2-8:
    ERROR: missing iounmap; ioremap on line 288 and execution via
    conditional on line 292

If domain->global_init() fails in __parse_discovery_table(), the
ioremap'ed MMIO region is not released before returning, resulting
in an MMIO mapping leak.

Fixes: b575fc0e3357 ("perf/x86/intel/uncore: Add domain global init callback")
Reported-by: kernel test robot <lkp@intel.com>
Intel-SIG: commit e2a39d1a88f0 perf/x86/intel/uncore: Fix iounmap() leak on global_init failure.
DMR PMU uncore enabling

Signed-off-by: Zide Chen <zide.chen@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Link: https://patch.msgid.link/20260313174050.171704-2-zide.chen@intel.com
[ Quanxian Wang: amend commit log ]
Signed-off-by: Quanxian Wang <quanxian.wang@intel.com>
commit a16d1ec4dd0cdcf689f324adde6067083bce9099 upstream.

In snbep_pci2phy_map_init(), in the nr_node_ids > 8 path,
uncore_device_to_die() may return -1 when all CPUs associated
with the UBOX device are offline.

Remove the WARN_ON_ONCE(die_id == -1) check for two reasons:

- The current code breaks out of the loop. This is incorrect because
  pci_get_device() does not guarantee iteration in domain or bus order,
  so additional UBOX devices may be skipped during the scan.

- Returning -EINVAL is incorrect, since marking offline buses with
  die_id == -1 is expected and should not be treated as an error.

Separately, when NUMA is disabled on a NUMA-capable platform,
pcibus_to_node() returns NUMA_NO_NODE, causing uncore_device_to_die()
to return -1 for all PCI devices.  As a result,
spr_update_device_location(), used on Intel SPR and EMR, ignores the
corresponding PMON units and does not add them to the RB tree.

Fix this by using uncore_pcibus_to_dieid(), which retrieves topology
from the UBOX GIDNIDMAP register and works regardless of whether NUMA
is enabled in Linux.  This requires snbep_pci2phy_map_init() to be
added in spr_uncore_pci_init().

Keep uncore_device_to_die() only for the nr_node_ids > 8 case, where
NUMA is expected to be enabled.

Fixes: 9a7832c ("perf/x86/intel/uncore: With > 8 nodes, get pci bus die id from NUMA info")
Fixes: 65248a9 ("perf/x86/uncore: Add a quirk for UPI on SPR")
Intel-SIG: commit a16d1ec4dd0c perf/x86/intel/uncore: Fix die ID init and look up bugs.
DMR PMU uncore enabling

Signed-off-by: Zide Chen <zide.chen@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Tested-by: Steve Wahl <steve.wahl@hpe.com>
Link: https://patch.msgid.link/20260313174050.171704-4-zide.chen@intel.com
[ Quanxian Wang: amend commit log ]
Signed-off-by: Quanxian Wang <quanxian.wang@intel.com>
commit 16bcbe6738bea7b4aee0a29324ce12c21c4b0ea0 upstream.

The third argument in INTEL_UNCORE_FR_EVENT_DESC() is subject to
__stringify(), and the extra double quote marks can result in the
expansion "3.814697266e-6" in the sysfs knobs, instead of
3.814697266e-6.

This is incorrect, though it may still work for perf, e.g.
perf stat -e uncore_iio_free_running_0/bw_in_port0/

Fixes: d8987048f665 ("perf/x86/intel/uncore: Support IIO free-running counters on DMR")
Closes: https://lore.kernel.org/all/20251231224233.113839-1-zide.chen@intel.com/
Reported-by: Chun-Tse Shao <ctshao@google.com>
Intel-SIG: commit 16bcbe6738be perf/x86/intel/uncore: Remove extra double quote mark.
DMR PMU uncore enabling

Signed-off-by: Zide Chen <zide.chen@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Chun-Tse Shao <ctshao@google.com>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Link: https://patch.msgid.link/20260313174050.171704-5-zide.chen@intel.com
[ Quanxian Wang: amend commit log ]
Signed-off-by: Quanxian Wang <quanxian.wang@intel.com>
commit fdd0410 upstream.

The same code is used for retrieving package ID procedure from GIDNIDMAP
register. Factor out topology_gidnid_map() to avoid code duplication.

Intel-SIG: commit fdd0410 perf/x86/intel/uncore: Factor out topology_gidnid_map().
Support DMR new CPU models

Signed-off-by: Alexander Antonov <alexander.antonov@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Kan Liang <kan.liang@linux.intel.com>
Link: https://lore.kernel.org/r/20231127185246.2371939-3-alexander.antonov@linux.intel.com

[ Wang Quanxian: amend commit log ]
Signed-off-by: Wang Quanxian <quanxian.wang@intel.com>
commit 63f48abd55d0417996bca86022925c853a2b436b upstream.

In uncore_find_add_unit(), PMON units with the same unit ID may be
added to the uncore discovery RB-tree for different dies. These units
are distinguished by node->die.

However, intel_generic_uncore_box_ctl() uses a fixed die ID of -1 when
looking up the discovery unit, which may retrieve the wrong node on
multi-die systems.

Use box->dieid instead so the correct discovery unit is selected.

No functional issue has been observed so far because currently supported
platforms happen to use the same unit control register for such units.

Remove WARN_ON_ONCE() because with the above change a NULL unit can be
expected, e.g. when a CPU die is offline during uncore enumeration and
the unit is not added to the RB-tree. In this case,
intel_uncore_find_discovery_unit() returns NULL once the die becomes
online, and it is expected that the PMU box is not functional for that
die.

Intel-SIG: commit 63f48abd55d0 perf/x86/intel/uncore: Fix discovery unit lookup for multi-die systems.
Support DMR new CPU models

Fixes: b1d9ea2 ("perf/x86/uncore: Apply the unit control RB tree to MSR uncore units")
Signed-off-by: Zide Chen <zide.chen@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Link: https://patch.msgid.link/20260602144908.263680-2-zide.chen@intel.com
[ Wang Quanxian: amend commit log ]
Signed-off-by: Wang Quanxian <quanxian.wang@intel.com>
commit 3c19ea24f02658c4b8ad364458fae4d77fdb3fae upstream.

Theoretically, intel_uncore_find_discovery_unit() could return NULL,
e.g., when a CPU die is offline during uncore enumeration and its PMU
units are not added to the discovery RB-tree.

Guard against a NULL return value and the resulting invalid box control
address (0) before accessing hardware.

Intel-SIG: commit 3c19ea24f026 perf/x86/intel/uncore: Guard against invalid box control address.
Support DMR new CPU models

Signed-off-by: Zide Chen <zide.chen@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Link: https://patch.msgid.link/20260602144908.263680-3-zide.chen@intel.com
[ Wang Quanxian: amend commit log ]
Signed-off-by: Wang Quanxian <quanxian.wang@intel.com>
commit 81ec618f59415bdcf3e8989e2691c1f240be27fb upstream.

pci_get_domain_bus_and_slot() increments the reference count of the
returned PCI device and therefore requires a matching pci_dev_put().

In skx_upi_topology_cb() and discover_upi_topology(), the lookup is
performed inside a loop, but pci_dev_put() is only called once after
the loop. As a result, references from all previous iterations are
leaked.

Move pci_dev_put(dev) into the if (dev) block immediately after
upi_fill_topology() returns.

Opportunistically, fix uninitialized variable in skx_upi_topology_cb().

Intel-SIG: commit 81ec618f5941 perf/x86/intel/uncore: Fix PCI device refcount leak in UPI discovery.
Support DMR new CPU models

Fixes: 4cfce57 ("perf/x86/intel/uncore: Enable UPI topology discovery for Skylake Server")
Fixes: f680b6e ("perf/x86/intel/uncore: Enable UPI topology discovery for Icelake Server")
Signed-off-by: Zide Chen <zide.chen@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Link: https://patch.msgid.link/20260602144908.263680-4-zide.chen@intel.com
[ Wang Quanxian: amend commit log ]
Signed-off-by: Wang Quanxian <quanxian.wang@intel.com>
commit ce044cfb7a365742b2e9229a4b70cf2a663d7270 upstream.

Move die_to_cpu() into uncore.c so it can be reused by the MSR
initialization path, preparing for the introduction of an MSR global
initialization callback.

Move the cpus_read_{lock,unlock}() out of the API, in order to make
it possible to be called when the lock is being held.

Add the uncore_ prefix for consistency with other uncore APIs.

Intel-SIG: commit ce044cfb7a36 perf/x86/intel/uncore: Move die_to_cpu() to uncore.c.
Support DMR new CPU models

Signed-off-by: Zide Chen <zide.chen@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Link: https://patch.msgid.link/20260602144908.263680-6-zide.chen@intel.com
[ Wang Quanxian: amend commit log ]
Signed-off-by: Wang Quanxian <quanxian.wang@intel.com>
commit 2aa7dacf8a3d928303df9c770c1bd7f50d1f8f2a upstream.

If the die is offline when uncore_die_to_cpu() is called, it silently
returns 0, which is misleading.  Return -1 in this case to indicate
that all CPUs on the die are offline and the caller can take care of
it accordingly.

Opportunistically, replace -EPERM with -ENODEV, as -ENODEV is
the appropriate error when no CPUs are online across all dies.

Intel-SIG: commit 2aa7dacf8a3d perf/x86/intel/uncore: Fix uncore_die_to_cpu() for offline dies.
Support DMR new CPU models

Signed-off-by: Zide Chen <zide.chen@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Link: https://patch.msgid.link/20260602144908.263680-7-zide.chen@intel.com
[ Wang Quanxian: amend commit log ]
Signed-off-by: Wang Quanxian <quanxian.wang@intel.com>
commit 1a308a168c9286a335a05926204ef3ebb68fba1c upstream.

On Sierra Forest and Clearwater Forest, the FRZ_ALL bit in the global
control register defaults to 0 at boot, but UBOX PMON units do not
work until the global control register is explicitly written with 0
to trigger hardware initialization properly.

Implement the generic uncore_msr_global_init() callback and add it to
gnr_uncore_init[], which is shared by GNR, GRR, SRF, and CWF.

Intel-SIG: commit 1a308a168c92 perf/x86/intel/uncore: Implement global init callback for GNR uncore.
Support DMR new CPU models

Fixes: 632c4bf ("perf/x86/intel/uncore: Support Granite Rapids")
Signed-off-by: Zide Chen <zide.chen@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Link: https://patch.msgid.link/20260602144908.263680-8-zide.chen@intel.com
[ Wang Quanxian: amend commit log ]
Signed-off-by: Wang Quanxian <quanxian.wang@intel.com>
commit 003267cb94e21d762eb72d6977d84f44f1705bb7 upstream.

When uncore_pci_pmu_register() fails, pmu->boxes[die] is set to NULL
before returning.  In the uncore_pci_remove() path, this causes
uncore_pci_pmu_unregister() to be skipped entirely, leaking
pmu->activeboxes.  In the uncore_bus_notify() path,
uncore_pci_pmu_unregister() may still be called and must exit early
when pmu->boxes[die] is NULL to avoid a NULL pointer dereference, and
to ensure activeboxes is only decremented for a previously active box.

Additionally, since pci_get_drvdata() returns NULL on registration
failure, uncore_pci_remove() can no longer treat NULL drvdata as an
indicator of an auxiliary PCI device.  Remove the associated
WARN_ON_ONCE().

Intel-SIG: commit 003267cb94e2 perf/x86/intel/uncore: Fix PCI PMU cleanup on setup failure.
Support DMR new CPU models

Signed-off-by: Zide Chen <zide.chen@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Link: https://sashiko.dev/#/patchset/20260512233048.9577-1-zide.chen@intel.com?part=1
Link: https://patch.msgid.link/20260611160033.66760-2-zide.chen@intel.com
[ Wang Quanxian: amend commit log ]
Signed-off-by: Wang Quanxian <quanxian.wang@intel.com>
commit 7d3a9ff98898b3521eb5d7a3daf703b383f7935a upstream.

Fix typo UNCORE_BOX_FLAG_INITIATED to UNCORE_BOX_FLAG_INITIALIZED.

Rename the 'id' parameter in uncore_box_{ref,unref}() to 'die' to
reflect its actual meaning and be consistent with other functions.

box->refcnt is incremented in the PCI PMU register path but has never
been checked or decremented. Although for PCI PMUs box->refcnt
effectively tracks only a single user, add atomic_dec_return() in the
PCI PMU unregister path to make the reference counting complete and
consistent.

Intel-SIG: commit 7d3a9ff98898 perf/x86/intel/uncore: Fix refcnt and other cleanups.
Support DMR new CPU models

Signed-off-by: Zide Chen <zide.chen@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Link: https://patch.msgid.link/20260611160033.66760-3-zide.chen@intel.com
[ Wang Quanxian: amend commit log ]
Signed-off-by: Wang Quanxian <quanxian.wang@intel.com>
commit cbbc25209ce34f1baeec615553b93904a7a5d8cd upstream.

The init_box() callback currently returns void, so initialization
failures are silently ignored and the box is still marked initialized.

Change the callback to return int so platform code can report errors
back to the common uncore layer.

Update uncore_box_init() to set the initialized flag only when
init_box() succeeds.  Because box->refcnt guarantees that at most
one CPU calls uncore_box_init() for a given box at a time, plain
__set_bit() is safe for the initialized flag without atomic overhead.

Convert all init_box() implementations to return 0 on success or a
negative error code on failure.  This is a prerequisite for propagating
initialization errors to the caller so they can be handled properly.

Intel-SIG: commit cbbc25209ce3 perf/x86/intel/uncore: Let init_box() callback report failures.
Support DMR new CPU models

Signed-off-by: Zide Chen <zide.chen@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Ian Rogers <irogers@google.com>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Link: https://patch.msgid.link/20260611160033.66760-4-zide.chen@intel.com
[ Wang Quanxian: amend commit log ]
Signed-off-by: Wang Quanxian <quanxian.wang@intel.com>
commit 3012af7df3430788eddd30b3c6654d0a0a5f06c6 upstream.

uncore_event_cpu_online() returns -ENOMEM early when both the MSR and
MMIO box allocations fail.  This also aborts PCI uncore setup, even
though PCI PMUs are independent of the MSR/MMIO paths.

Remove the early return so PCI uncore setup always runs regardless
of whether MSR or MMIO box allocation succeeds.

Intel-SIG: commit 3012af7df343 perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails.
Support DMR new CPU models

Fixes: 3da04b8 ("perf/x86/intel/uncore: Support MMIO type uncore blocks")
Signed-off-by: Zide Chen <zide.chen@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Ian Rogers <irogers@google.com>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Link: https://patch.msgid.link/20260611160033.66760-5-zide.chen@intel.com
[ Wang Quanxian: amend commit log ]
Signed-off-by: Wang Quanxian <quanxian.wang@intel.com>
commit ae7ca8796ddac708db592c5a68555414c451afcc upstream.

The PCI uncore PMU path already implements a lazy registration model:
the PMU is registered when the first active box appears and
unregistered when the last active box is removed.

Factor this registration management into a shared helper, so the same
code can be reused by the MSR and MMIO paths in later changes.

No functional change intended.

Intel-SIG: commit ae7ca8796dda perf/x86/intel/uncore: Factor out box setup code.
Support DMR new CPU models

Signed-off-by: Zide Chen <zide.chen@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Ian Rogers <irogers@google.com>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Link: https://patch.msgid.link/20260611160033.66760-6-zide.chen@intel.com
[ Wang Quanxian: amend commit log ]
Signed-off-by: Wang Quanxian <quanxian.wang@intel.com>
commit 30c0a1095652275768a5de67188ff888d1f5d190 upstream.

Replace the boolean 'registered' field in intel_uncore_pmu with an
unsigned long 'flags' field, and add a PMU_BROKEN flag to track box
setup failures. The broken flag is sticky, meaning it is cleared only
by a module reload or system reboot.

Broken PMUs are skipped in the CPU hotplug and box allocation paths.

When any box fails to initialize, the PMU is marked broken.  Broken
PMUs reject new event assignments and skip future box setup attempts.
If the PMU was already registered, it remains so to avoid disrupting
in-flight events on other boxes.

Intel-SIG: commit 30c0a1095652 perf/x86/intel/uncore: Introduce PMU flags and broken state.
Support DMR new CPU models

Signed-off-by: Zide Chen <zide.chen@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Link: https://patch.msgid.link/20260611160033.66760-7-zide.chen@intel.com
[ Wang Quanxian: amend commit log ]
Signed-off-by: Wang Quanxian <quanxian.wang@intel.com>
commit 174f0582e38abe03b88e15f04bfe58490f88cb19 upstream.

In uncore_event_cpu_online(), uncore_box_ref() was called before
uncore_change_context().  uncore_box_ref() gates on box->cpu >= 0,
but box->cpu is still -1 at that point because uncore_change_context()
has not run yet.  As a result, the box is never initialized on the
first CPU to come online in a die, leaving it permanently
uninitialized in the single-CPU-per-die case.

Thus, box->refcnt is one count below the true value, and in the CPU
offline path, the box will be torn down on the second-to-last CPU.

In uncore_event_cpu_offline(), uncore_box_unref() was called after
uncore_change_context(), so box->cpu is already -1 when the collector
CPU goes offline, which prevents it from tearing down the box.

Fix by swapping the call order in both paths so that
uncore_box_{ref,unref}() runs at the point where box->cpu reflects
the correct context.

Move allocate_boxes() out of uncore_box_ref() to enable this
reordering.

Intel-SIG: commit 174f0582e38a perf/x86/intel/uncore: Fix uncore_box ref/unref ordering.
Support DMR new CPU models

Fixes: c74443d ("perf/x86/uncore: Support per PMU cpumask")
Signed-off-by: Zide Chen <zide.chen@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Ian Rogers <irogers@google.com>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Link: https://patch.msgid.link/20260611160033.66760-8-zide.chen@intel.com
[ Wang Quanxian: amend commit log ]
Signed-off-by: Wang Quanxian <quanxian.wang@intel.com>
commit b25813b17944b4df532246cddae82201fb880481 upstream.

MSR and MMIO uncore PMUs are currently registered at module init time
and appear in sysfs even when no PMU boxes are functional.

Apply the same lazy registration model used by PCI uncore PMUs: the
PMU is registered when the first box is successfully initialized, and
unregistered when the last box exits.  If a box fails to initialize on
a subsequent die, the PMU is marked broken but remains registered to
avoid disrupting any in-flight perf events.

Box allocation and freeing remain at module init/exit time to avoid
repeated kfree/alloc cycles across CPU offline/online events.

Intel-SIG: commit b25813b17944 perf/x86/intel/uncore: Implement lazy setup for MSR/MMIO PMUs.
Support DMR new CPU models

Signed-off-by: Zide Chen <zide.chen@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Link: https://patch.msgid.link/20260611160033.66760-9-zide.chen@intel.com
[ Wang Quanxian: amend commit log ]
Signed-off-by: Wang Quanxian <quanxian.wang@intel.com>
@quanxianwang quanxianwang changed the title Velinux pmu uncore correctness fixes 6.6 official [6.6][Intel-SIG] Velinux pmu uncore correctness fixes 6.6 official Sep 16, 2026
@quanxianwang quanxianwang changed the title [6.6][Intel-SIG] Velinux pmu uncore correctness fixes 6.6 official [6.6][Intel-SIG] Velinux pmu uncore correctness fixes Sep 16, 2026
@quanxianwang quanxianwang changed the title [6.6][Intel-SIG] Velinux pmu uncore correctness fixes [6.6][Intel-SIG] pmu uncore correctness fixes Sep 16, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants