From b899fd3487b0d4066d60ebcf5b73e77c9617de54 Mon Sep 17 00:00:00 2001 From: Dave Jiang Date: Wed, 5 Aug 2026 08:59:07 -0700 Subject: [PATCH] perf/cxl: Don't share the overflow interrupt, and keep it pinned The PMU pins its overflow interrupt to info->on_cpu in the hotplug callbacks, but requests it with only IRQF_SHARED | IRQF_NO_THREAD. Without IRQF_NOBALANCING, irqbalance or a userspace smp_affinity write can move it elsewhere, and cxl_pmu_irq() then runs local64_cmpxchg() and local64_add() on hwc->prev_count and event->count at the same time as the managing CPU. local64_t is only atomic against same-CPU access, so the counts corrupt. The flag alone does not fix that while the line is shared. __setup_irq() only acts on it for the first action on a line, and a co-owner has no reason to want our affinity - it would keep taking the interrupt wherever its own points, running our handler on the wrong CPU. Drop IRQF_SHARED and add IRQF_NOBALANCING. The spec only recommends a distinct Interrupt Message Number per CPMU instance (CXL r4.0 8.2.7.1.1), so a device may put several on one vector, or share with the mailbox or event log. Such a device now loses a PMU rather than silently miscounting - and only the PMU, since the preceding patch adds the CPMUs after the event configuration. Fixes: 5d7107c72796 ("perf: CXL Performance Monitoring Unit driver") Reported-by: sashiko-bot@kernel.org Closes: https://sashiko.dev/#/patchset/20260715191454.459673-1-dave@stgolabs.net?part=1 Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Jonathan Cameron Reviewed-by: Davidlohr Bueso Signed-off-by: Dave Jiang Link: https://sashiko.dev/#/patchset/20260715191454.459673-1-dave@stgolabs.net?part=1 Signed-off-by: Will Deacon --- drivers/perf/cxl_pmu.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/drivers/perf/cxl_pmu.c b/drivers/perf/cxl_pmu.c index 1b1bdb485d7c..f6c4a1b598d8 100644 --- a/drivers/perf/cxl_pmu.c +++ b/drivers/perf/cxl_pmu.c @@ -896,7 +896,7 @@ static irqreturn_t cxl_pmu_irq(int irq, void *data) overflowed = readq(base + CXL_PMU_OVERFLOW_REG); - /* Interrupt may be shared, so maybe it isn't ours */ + /* Nothing overflowed, so the device did not raise this */ if (!overflowed) return IRQ_NONE; @@ -999,7 +999,14 @@ static int cxl_pmu_probe(struct device *dev) if (!irq_name) return -ENOMEM; - rc = devm_request_irq(dev, irq, cxl_pmu_irq, IRQF_SHARED | IRQF_NO_THREAD, + /* + * The handler must run on info->on_cpu, so the interrupt cannot be + * shared - IRQF_NOBALANCING is only honoured for the first action on a + * line, and a co-owner would keep taking the interrupt wherever its own + * affinity points. + */ + rc = devm_request_irq(dev, irq, cxl_pmu_irq, + IRQF_NO_THREAD | IRQF_NOBALANCING, irq_name, info); if (rc) return rc;