linux-stable.git/tools/perf/arch, branch linux-6.18.y

perf annotate: Use jump__delete when freeing LoongArch jumps

2026-05-07T04:11:53+00:00

[ Upstream commit a355eefc36c4481188249b067832b40a2c45fa5c ]

Currently, the initialization of loongarch_jump_ops does not contain an
assignment to its .free field. This causes disasm_line__free() to fall
through to ins_ops__delete() for LoongArch jump instructions.

ins_ops__delete() will free ins_operands.source.raw and
ins_operands.source.name, and these fields overlaps with
ins_operands.jump.raw_comment and ins_operands.jump.raw_func_start.
Since in loongarch_jump__parse(), these two fields are populated by
strchr()-ing the same buffer, trying to free them will lead to undefined
behavior.

This invalid free usually leads to crashes:

        Process 1712902 (perf) of user 1000 dumped core.
        Stack trace of thread 1712902:
        #0  0x00007fffef155c58 n/a (libc.so.6 + 0x95c58)
        #1  0x00007fffef0f7a94 raise (libc.so.6 + 0x37a94)
        #2  0x00007fffef0dd6a8 abort (libc.so.6 + 0x1d6a8)
        #3  0x00007fffef145490 n/a (libc.so.6 + 0x85490)
        #4  0x00007fffef1646f4 n/a (libc.so.6 + 0xa46f4)
        #5  0x00007fffef164718 n/a (libc.so.6 + 0xa4718)
        #6  0x00005555583a6764 __zfree (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x106764)
        #7  0x000055555854fb70 disasm_line__free (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x2afb70)
        #8  0x000055555853d618 annotated_source__purge (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x29d618)
        #9  0x000055555852300c __hist_entry__tui_annotate (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x28300c)
        #10 0x0000555558526718 do_annotate (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x286718)
        #11 0x000055555852ed94 evsel__hists_browse (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x28ed94)
        #12 0x000055555831fdd0 cmd_report (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x7fdd0)
        #13 0x000055555839b644 handle_internal_command (/home/csmantle/dist/linux-arch/tools/perf/perf + 0xfb644)
        #14 0x00005555582fe6ac main (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x5e6ac)
        #15 0x00007fffef0ddd90 n/a (libc.so.6 + 0x1dd90)
        #16 0x00007fffef0ddf0c __libc_start_main (libc.so.6 + 0x1df0c)
        #17 0x00005555582fed10 _start (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x5ed10)
        ELF object binary architecture: LoongArch

... and it can be confirmed with Valgrind:

        ==1721834== Invalid free() / delete / delete[] / realloc()
        ==1721834==    at 0x4EA9014: free (in /usr/lib/valgrind/vgpreload_memcheck-loongarch64-linux.so)
        ==1721834==    by 0x4106287: __zfree (zalloc.c:13)
        ==1721834==    by 0x42ADC8F: disasm_line__free (in /home/csmantle/dist/linux-arch/tools/perf/perf)
        ==1721834==    by 0x429B737: annotated_source__purge (in /home/csmantle/dist/linux-arch/tools/perf/perf)
        ==1721834==    by 0x42811EB: __hist_entry__tui_annotate (in /home/csmantle/dist/linux-arch/tools/perf/perf)
        ==1721834==    by 0x42848D7: do_annotate (in /home/csmantle/dist/linux-arch/tools/perf/perf)
        ==1721834==    by 0x428CF33: evsel__hists_browse (in /home/csmantle/dist/linux-arch/tools/perf/perf)
        ==1721834==  Address 0x7d34303 is 35 bytes inside a block of size 62 alloc'd
        ==1721834==    at 0x4EA59B8: malloc (in /usr/lib/valgrind/vgpreload_memcheck-loongarch64-linux.so)
        ==1721834==    by 0x6B80B6F: strdup (strdup.c:42)
        ==1721834==    by 0x42AD917: disasm_line__new (in /home/csmantle/dist/linux-arch/tools/perf/perf)
        ==1721834==    by 0x42AE5A3: symbol__disassemble_objdump (in /home/csmantle/dist/linux-arch/tools/perf/perf)
        ==1721834==    by 0x42AF0A7: symbol__disassemble (in /home/csmantle/dist/linux-arch/tools/perf/perf)
        ==1721834==    by 0x429B3CF: symbol__annotate (in /home/csmantle/dist/linux-arch/tools/perf/perf)
        ==1721834==    by 0x429C233: symbol__annotate2 (in /home/csmantle/dist/linux-arch/tools/perf/perf)
        ==1721834==    by 0x42804D3: __hist_entry__tui_annotate (in /home/csmantle/dist/linux-arch/tools/perf/perf)
        ==1721834==    by 0x42848D7: do_annotate (in /home/csmantle/dist/linux-arch/tools/perf/perf)
        ==1721834==    by 0x428CF33: evsel__hists_browse (in /home/csmantle/dist/linux-arch/tools/perf/perf)

This patch adds the missing free() specialization in loongarch_jump_ops,
which prevents disasm_line__free() from invoking the default cleanup
function.

Fixes: fb7fd2a14a503b9a ("perf annotate: Move raw_comment and raw_func_start fields out of 'struct ins_operands'")
Cc: stable@vger.kernel.org
Cc: WANG Rui 
Cc: Huacai Chen 
Cc: WANG Xuerui 
Cc: loongarch@lists.linux.dev
Signed-off-by: Rong Bao 
Tested-by: WANG Rui 
Signed-off-by: Namhyung Kim 
Signed-off-by: Sasha Levin

perf annotate: Fix args leak of map_symbol

2026-03-04T12:19:25+00:00

[ Upstream commit 00419892bac28bf148450d762bbff990a6bd5494 ]

map_symbol__exit() needs calling on an annotate_args.ms, however, rather
than introduce proper reference count handling to symbol__annotate()
just switch to passing the map_symbol pointer parameter around, making
the puts the caller's responsibility.

Fix a number of cases to ensure the map in a map_symbol has a
reference count increment and add the then necessary map_symbol_exits.

Fixes: 56e144fe98260a0f ("perf mem_info: Add and use map_symbol__exit and addr_map_symbol__exit")
Reviewed-by: James Clark 
Signed-off-by: Ian Rogers 
Cc: Aditya Bodkhe 
Cc: Adrian Hunter 
Cc: Albert Ou 
Cc: Alexander Shishkin 
Cc: Alexandre Ghiti 
Cc: Athira Rajeev 
Cc: Bill Wendling 
Cc: Dr. David Alan Gilbert 
Cc: Guo Ren 
Cc: Howard Chu 
Cc: Ian Rogers 
Cc: Ingo Molnar 
Cc: Jiri Olsa 
Cc: John Garry 
Cc: Julia Lawall 
Cc: Justin Stitt 
Cc: Krzysztof Łopatowski 
Cc: Leo Yan 
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux-csky@vger.kernel.org
Cc: linux-riscv@lists.infradead.org
Cc: Namhyung Kim 
Cc: Nathan Chancellor 
Cc: Nick Desaulniers 
Cc: Palmer Dabbelt 
Cc: Paul Walmsley 
Cc: Peter Zijlstra 
Cc: Sergei Trofimovich 
Cc: Shimin Guo 
Cc: Suchit Karunakaran 
Cc: Thomas Falcon 
Cc: Tianyou Li 
Cc: Will Deacon 
Cc: Zecheng Li 
Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: Sasha Levin

tools headers x86: Sync table due to introducion of uprobe syscall

2025-11-01T16:04:20+00:00

To pick the changes in this cset:

  56101b69c9190667 ("uprobes/x86: Add uprobe syscall to speed up uprobe")

That add support for this new 'uprobe' syscall in tools such as 'perf trace'.

Now it is possible to do a system wide 'perf trace' to look if this new
syscall is being used:

  root@number:~# perf trace -v -e uprobe
  
  event qualifier tracepoint filter: (common_pid != 33989) && (id == 336)
  ^C
  root@number#

  $ grep -w uprobe tools/perf/arch/x86/entry/syscalls/syscall_64.tbl
  336	common	uprobe			sys_uprobe
  $

This addresses these perf build warnings:

  Warning: Kernel ABI header differences:
    diff -u tools/perf/arch/x86/entry/syscalls/syscall_64.tbl arch/x86/entry/syscalls/syscall_64.tbl

Please see tools/include/uapi/README for further details.

Cc: Jiri Olsa 
Cc: Peter Zijlstra 
Signed-off-by: Arnaldo Carvalho de Melo

perf record: Add ratio-to-prev term

2025-10-03T19:49:51+00:00

Provide ratio-to-prev term which allows the user to
set the event sample period of two events corresponding
to a desired ratio.

If using on an Intel x86 platform with Auto Counter Reload support, also
set corresponding event's config2 attribute with a bitmask which
counters to reset and which counters to sample if the desired ratio is
met or exceeded.

On other platforms, only the sample period is affected by the
ratio-to-prev term.

Reviewed-by: Ian Rogers 
Signed-off-by: Thomas Falcon 
Cc: Adrian Hunter 
Cc: Alexander Shishkin 
Cc: Andi Kleen 
Cc: Dapeng Mi 
Cc: Ingo Molnar 
Cc: Jiri Olsa 
Cc: Kan Liang 
Cc: Mark Rutland 
Cc: Namhyung Kim 
Cc: Peter Zijlstra 
Signed-off-by: Arnaldo Carvalho de Melo

perf annotate: Rename TSR_KIND_POINTER to TSR_KIND_PERCPU_POINTER

2025-10-03T19:49:51+00:00

TSR_KIND_POINTER only represents percpu pointers currently. Rename it to
TSR_KIND_PERCPU_POINTER so we can use the TSR_KIND_POINTER to represent
pointer to a type.

Reviewed-by: Namhyung Kim 
Signed-off-by: Zecheng Li 
Cc: Adrian Hunter 
Cc: Alexander Shishkin 
Cc: Ian Rogers 
Cc: Ingo Molnar 
Cc: Jiri Olsa 
Cc: Kan Liang 
Cc: Mark Rutland 
Cc: Masami Hiramatsu 
Cc: Peter Zijlstra 
Cc: Xu Liu 
Signed-off-by: Arnaldo Carvalho de Melo

perf tools kvm: Use "cycles" to sample guest for "kvm record" on Intel

2025-10-02T18:31:39+00:00

After KVM supports PEBS for guest on Intel platforms
(https://lore.kernel.org/all/20220411101946.20262-1-likexu@tencent.com/),
host loses the capability to sample guest with PEBS since all PEBS related
MSRs are switched to guest value after vm-entry, like IA32_DS_AREA MSR is
switched to guest GVA at vm-entry. This would lead to "perf kvm record"
fails to sample guest on Intel platforms since "cycles:P" event is used to
sample guest by default as below case shows.

sudo perf kvm record -a
^C[ perf record: Woken up 1 times to write data ]
[ perf record: Captured and wrote 0.787 MB perf.data.guest ]

So to ensure guest record can be sampled successfully, use "cycles"
instead of "cycles:P" to sample guest record by default on Intel
platforms. With this patch, the guest record can be sampled
successfully.

sudo perf kvm record -a
^C[ perf record: Woken up 1 times to write data ]
[ perf record: Captured and wrote 0.783 MB perf.data.guest (23 samples) ]

Fixes: cf8e55fe50df0c02 ("KVM: x86/pmu: Expose CPUIDs feature bits PDCM, DS, DTES64")
Reported-by: Kevin Tian 
Signed-off-by: Dapeng Mi 
Acked-by: Namhyung Kim 
Cc: Adrian Hunter 
Cc: Alexander Shishkin 
Cc: Ian Rogers 
Cc: Ingo Molnar 
Cc: Kan Liang 
Cc: Like Xu 
Cc: Paolo Bonzini 
Cc: Peter Zijlstra 
Signed-off-by: Arnaldo Carvalho de Melo

perf powerpc: Add basic CONFIG_AUXTRACE support for VPA pmu on powerpc

2025-10-01T14:22:04+00:00

The powerpc PMU collecting Dispatch Trace Log (DTL) entries makes use of
AUX support in perf infrastructure.

The PMU driver has the functionality to collect trace entries in the aux
buffer.

On the tools side, this data is made available as PERF_RECORD_AUXTRACE
records.

This record is generated by "perf record" command.

To enable the creation of PERF_RECORD_AUXTRACE, add functions to
initialize auxtrace records ie "auxtrace_record__init()".

Fill in fields for other callbacks like info_priv_size, info_fill, free,
recording options etc.

Define auxtrace_type as PERF_AUXTRACE_VPA_DTL.  Add header file to
define vpa dtl pmu specific details.

Reviewed-by: Adrian Hunter 
Signed-off-by: Athira Rajeev 
Tested-by: Tejas Manhas 
Tested-by: Venkat Rao Bagalkote 
Cc: Aboorva Devarajan 
Cc: Aditya Bodkhe 
Cc: Hari Bathini 
Cc: Ian Rogers 
Cc: Jiri Olsa 
Cc: Madhavan Srinivasan 
Cc: Namhyung Kim 
Cc: Shrikanth Hegde 
Signed-off-by: Arnaldo Carvalho de Melo

perf arm_spe: Add "event_filter" entry in meta data

2025-09-19T15:14:28+00:00

Add a new "event_filter" entry in the meta data and dump it in raw data
mode.

After:

  # perf script -D
  ...

  0 0 0x470 [0x1f0]: PERF_RECORD_AUXTRACE_INFO type: 4
    Header version     :2
    Header size        :4
    PMU type v2        :11
    CPU number         :8
      Magic            :0x1010101010101010
      CPU #            :0
      Num of params    :4
      MIDR             :0x410fd0f0
      PMU Type         :11
      Min Interval     :256
      Event Filter     :0x3fe08fe

  ...

Reviewed-by: James Clark 
Signed-off-by: Leo Yan 
Cc: Adrian Hunter 
Cc: Alexander Shishkin 
Cc: Ali Saidi 
Cc: German Gomez 
Cc: Ian Rogers 
Cc: Jiri Olsa 
Cc: Mark Rutland 
Cc: Namhyung Kim 
Cc: Will Deacon 
Signed-off-by: Arnaldo Carvalho de Melo

perf evsel: Give warning for broken Intel topdown event grouping

2025-09-12T18:48:12+00:00

Extend arch_evsel__open_strerror() from just AMD IBS events to Intel
core PMU events, to give a message when a slots event isn't a group
leader or when a perf metric event is duplicated within an event
group.

As generating the warning happens after non-arch specific warnings are
generated, disable the missing system wide (-a) flag warning for the
core PMU.

This assumes core PMU events should support per-thread/process and
system-wide.

Reviewed-by: Dapeng Mi 
Signed-off-by: Ian Rogers 
Tested-by: Dapeng Mi 
Cc: Adrian Hunter 
Cc: Alexander Shishkin 
Cc: Andi Kleen 
Cc: Greg Kroah-Hartman 
Cc: Howard Chu 
Cc: Ingo Molnar 
Cc: James Clark 
Cc: Jiri Olsa 
Cc: Kan Liang 
Cc: Mark Rutland 
Cc: Namhyung Kim 
Cc: Peter Zijlstra 
Cc: Thomas Falcon 
Cc: Yoshihiro Furudera 
Signed-off-by: Arnaldo Carvalho de Melo

perf arm64: Sync ESR_ELx_EC_* macros in arm64_exception_types.h with esr.h

2025-09-12T18:37:57+00:00

Update perf util arm64_exception_types.h to match the exception class
macros defined in tools/arch/arm64/include/asm/esr.h.

This ensures consistency between perf tooling and the kernel header
definitions for ESR_ELx_EC_* values.

In v2, ESR_ELx_EC_OTHER and ESR_ELx_EC_GCS, which were missing in v1, were
included.

Reviewed-by: Leo Yan 
Signed-off-by: Yunseong Kim 
Cc: Adrian Hunter 
Cc: Alexander Shishkin 
Cc: Ian Rogers 
Cc: Ingo Molnar 
Cc: James Clark 
Cc: Jiri Olsa 
Cc: John Garry 
Cc: Kan Liang 
Cc: Leo Yan 
Cc: Levi Yun 
Cc: Mark Rutland 
Cc: Mike Leach 
Cc: Namhyung Kim 
Cc: Peter Zijlstra 
Cc: Will Deacon 
Link: https://lore.kernel.org/r/20250822145855.53071-2-ysk@kzalloc.com
Signed-off-by: Arnaldo Carvalho de Melo