[PATCH 0/2] perf: Fix PERF_EVENT_IOC_REFRESH for tracepoints and breakpoints

[PATCH 0/2] perf: Fix PERF_EVENT_IOC_REFRESH for tracepoints and breakpoints

[Paolo Bertinetti]

Since commit 18dbcbfabfff ("perf: Fix the POLL_HUP delivery breakage"),
an event that reaches its PERF_EVENT_IOC_REFRESH limit is stopped with
pmu->stop() and disabled. Re-arming it adds it back with PERF_EF_START,
but perf_trace_add() and hw_breakpoint_add() never clear
PERF_HES_STOPPED. Tracepoint, kprobe, uprobe and breakpoint events
re-armed this way deliver only their first overflow. Francesco reported
it with the "Event re-armed with PERF_EVENT_IOC_REFRESH" perf test,
found through an async-profiler bug.

These patches make both PMUs set the state from PERF_EF_START on every
add, as perf_swevent_add() does. The pmu->stop() call stays, so the
POLL_HUP fix of 18dbcbfabfff is kept.

Leo's series [1] removes that pmu->stop() call instead, which also
avoids this, and is still pending. Either way, add() with PERF_EF_START
should start the event.

Tested in QEMU/KVM, x86_64, 4 vCPUs, v7.4-rc1 with PROVE_LOCKING:

- perf test "Event re-armed with PERF_EVENT_IOC_REFRESH": the tracepoint
  case goes from FAILED (count 1, 1 overflow) to Ok (count 1000, 1000
  POLL_HUP signals).

- A small test that re-arms each event from its signal handler and
  triggers it 200 times, overflows delivered:

                 v7.4-rc1   + patch 1   + patch 2
    tracepoint       1         200         200
    kprobe           1         200         200
    uprobe           1         200         200
    breakpoint       1           1         200

- The full perf test suite and tools/testing/selftests/perf_events give
  the same results before and after, apart from the REFRESH test. Many
  perf tests fail in my VM on both kernels, for setup reasons.

- No lockdep or other warnings in dmesg.

I can add kprobe, uprobe and breakpoint cases to the perf test if that
helps.

[1] https://lore.kernel.org/r/20260514-arm_cs_clean_perf_handle-v2-0-cbb29c3b3661@arm.com/

Paolo Bertinetti (2):
  tracing/perf: Clear stop state in perf_trace_add()
  perf/hw_breakpoint: Clear stop state in hw_breakpoint_add()

 kernel/events/hw_breakpoint.c   | 3 +--
 kernel/trace/trace_event_perf.c | 3 +--
 2 files changed, 2 insertions(+), 4 deletions(-)


base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
-- 
2.53.0

[PATCH 1/2] tracing/perf: Clear stop state in perf_trace_add()

[Paolo Bertinetti]

Since commit 18dbcbfabfff ("perf: Fix the POLL_HUP delivery breakage"),
__perf_event_overflow() stops the event with pmu->stop() and disables
it when the PERF_EVENT_IOC_REFRESH limit is reached. When userspace
re-arms the event with PERF_EVENT_IOC_REFRESH, the event is enabled
again and pmu->add() is called with PERF_EF_START.

perf_trace_add() sets PERF_HES_STOPPED when PERF_EF_START is missing,
but never clears it. The flag set by pmu->stop() stays, and
perf_tp_event_match() drops every later hit. A tracepoint, kprobe or
uprobe event re-armed this way delivers only its first overflow. This
breaks self-profilers such as async-profiler, and the "Event re-armed
with PERF_EVENT_IOC_REFRESH" perf test fails:

  1000 events, count 1, 1 overflows (1 POLL_HUP), re-arm errno 0
  Tracepoint event : FAILED!

Set the state from PERF_EF_START on every add, as perf_swevent_add()
does.

Fixes: 18dbcbfabfff ("perf: Fix the POLL_HUP delivery breakage")
Reported-by: Francesco Nigro <nigro.fra@gmail.com>
Closes: https://lore.kernel.org/r/20261021131006.2101248-1-nigro.fra@gmail.com/
Assisted-by: LLM
Signed-off-by: Paolo Bertinetti <paolobertinetti200f4@proton.me>
Cc: stable@vger.kernel.org
Link: https://github.com/async-profiler/async-profiler/issues/1813
---
 kernel/trace/trace_event_perf.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/kernel/trace/trace_event_perf.c b/kernel/trace/trace_event_perf.c
index 5b272856e5ab..a549897ee408 100644
--- a/kernel/trace/trace_event_perf.c
+++ b/kernel/trace/trace_event_perf.c
@@ -354,8 +354,7 @@ int perf_trace_add(struct perf_event *p_event, int flags)
 	struct trace_event_call *tp_event = p_event->tp_event;
 	struct hw_perf_event *hwc = &p_event->hw;
 
-	if (!(flags & PERF_EF_START))
-		p_event->hw.state = PERF_HES_STOPPED;
+	hwc->state = (flags & PERF_EF_START) ? 0 : PERF_HES_STOPPED;
 
 	if (is_sampling_event(p_event)) {
 		hwc->last_period = hwc->sample_period;
-- 
2.53.0

Re: [PATCH 1/2] tracing/perf: Clear stop state in perf_trace_add()

[sashiko-bot]

> Since commit 18dbcbfabfff ("perf: Fix the POLL_HUP delivery breakage"),
> __perf_event_overflow() stops the event with pmu->stop() and disables
> it when the PERF_EVENT_IOC_REFRESH limit is reached. When userspace
> re-arms the event with PERF_EVENT_IOC_REFRESH, the event is enabled
> again and pmu->add() is called with PERF_EF_START.
> 
> perf_trace_add() sets PERF_HES_STOPPED when PERF_EF_START is missing,
> but never clears it. The flag set by pmu->stop() stays, and
> perf_tp_event_match() drops every later hit. A tracepoint, kprobe or
> uprobe event re-armed this way delivers only its first overflow. This
> breaks self-profilers such as async-profiler, and the "Event re-armed
> with PERF_EVENT_IOC_REFRESH" perf test fails:
> 
>   1000 events, count 1, 1 overflows (1 POLL_HUP), re-arm errno 0
>   Tracepoint event : FAILED!
> 
> Set the state from PERF_EF_START on every add, as perf_swevent_add()
> does.
> 
> Fixes: 18dbcbfabfff ("perf: Fix the POLL_HUP delivery breakage")
> Reported-by: Francesco Nigro <nigro.fra@gmail.com>
> Closes: https://lore.kernel.org/r/20261021131006.2101248-1-nigro.fra@gmail.com/
> Assisted-by: LLM
> Signed-off-by: Paolo Bertinetti <paolobertinetti200f4@proton.me>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261103130732.764081-1-paolobertinetti200f4@proton.me?part=1

[PATCH 2/2] perf/hw_breakpoint: Clear stop state in hw_breakpoint_add()

[Paolo Bertinetti]

Since commit 18dbcbfabfff ("perf: Fix the POLL_HUP delivery breakage"),
__perf_event_overflow() stops the event with pmu->stop() and disables
it when the PERF_EVENT_IOC_REFRESH limit is reached. When userspace
re-arms the event with PERF_EVENT_IOC_REFRESH, the event is enabled
again and pmu->add() is called with PERF_EF_START.

hw_breakpoint_add() sets PERF_HES_STOPPED when PERF_EF_START is
missing, but never clears it. The flag set by pmu->stop() stays, and
perf_bp_event() drops every later hit, so a breakpoint re-armed this
way delivers only its first overflow.

Set the state from PERF_EF_START on every add, as perf_swevent_add()
does.

Fixes: 18dbcbfabfff ("perf: Fix the POLL_HUP delivery breakage")
Assisted-by: LLM
Signed-off-by: Paolo Bertinetti <paolobertinetti200f4@proton.me>
Cc: stable@vger.kernel.org
---
 kernel/events/hw_breakpoint.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/kernel/events/hw_breakpoint.c b/kernel/events/hw_breakpoint.c
index 789add0c185a..7a606213f33d 100644
--- a/kernel/events/hw_breakpoint.c
+++ b/kernel/events/hw_breakpoint.c
@@ -968,8 +968,7 @@ static int hw_breakpoint_event_init(struct perf_event *bp)
 
 static int hw_breakpoint_add(struct perf_event *bp, int flags)
 {
-	if (!(flags & PERF_EF_START))
-		bp->hw.state = PERF_HES_STOPPED;
+	bp->hw.state = (flags & PERF_EF_START) ? 0 : PERF_HES_STOPPED;
 
 	if (is_sampling_event(bp)) {
 		bp->hw.last_period = bp->hw.sample_period;
-- 
2.53.0

Re: [PATCH 2/2] perf/hw_breakpoint: Clear stop state in hw_breakpoint_add()

[sashiko-bot]

> Since commit 18dbcbfabfff ("perf: Fix the POLL_HUP delivery breakage"),
> __perf_event_overflow() stops the event with pmu->stop() and disables
> it when the PERF_EVENT_IOC_REFRESH limit is reached. When userspace
> re-arms the event with PERF_EVENT_IOC_REFRESH, the event is enabled
> again and pmu->add() is called with PERF_EF_START.
> 
> hw_breakpoint_add() sets PERF_HES_STOPPED when PERF_EF_START is
> missing, but never clears it. The flag set by pmu->stop() stays, and
> perf_bp_event() drops every later hit, so a breakpoint re-armed this
> way delivers only its first overflow.
> 
> Set the state from PERF_EF_START on every add, as perf_swevent_add()
> does.
> 
> Fixes: 18dbcbfabfff ("perf: Fix the POLL_HUP delivery breakage")
> Assisted-by: LLM
> Signed-off-by: Paolo Bertinetti <paolobertinetti200f4@proton.me>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261103130732.764081-1-paolobertinetti200f4@proton.me?part=2

[PATCH 2/2] perf/hw_breakpoint: Clear stop state in hw_breakpoint_add()

[Paolo Bertinetti]

Since commit 18dbcbfabfff ("perf: Fix the POLL_HUP delivery breakage"),
__perf_event_overflow() stops the event with pmu->stop() and disables
it when the PERF_EVENT_IOC_REFRESH limit is reached. When userspace
re-arms the event with PERF_EVENT_IOC_REFRESH, the event is enabled
again and pmu->add() is called with PERF_EF_START.

hw_breakpoint_add() sets PERF_HES_STOPPED when PERF_EF_START is
missing, but never clears it. The flag set by pmu->stop() stays, and
perf_bp_event() drops every later hit, so a breakpoint re-armed this
way delivers only its first overflow.

Set the state from PERF_EF_START on every add, as perf_swevent_add()
does.

Fixes: 18dbcbfabfff ("perf: Fix the POLL_HUP delivery breakage")
Assisted-by: LLM
Signed-off-by: Paolo Bertinetti <paolobertinetti200f4@proton.me>
Cc: stable@vger.kernel.org
---
 kernel/events/hw_breakpoint.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/kernel/events/hw_breakpoint.c b/kernel/events/hw_breakpoint.c
index 789add0c185a..7a606213f33d 100644
--- a/kernel/events/hw_breakpoint.c
+++ b/kernel/events/hw_breakpoint.c
@@ -968,8 +968,7 @@ static int hw_breakpoint_event_init(struct perf_event *bp)
 
 static int hw_breakpoint_add(struct perf_event *bp, int flags)
 {
-	if (!(flags & PERF_EF_START))
-		bp->hw.state = PERF_HES_STOPPED;
+	bp->hw.state = (flags & PERF_EF_START) ? 0 : PERF_HES_STOPPED;
 
 	if (is_sampling_event(bp)) {
 		bp->hw.last_period = bp->hw.sample_period;
-- 
2.53.0

Re: [PATCH 2/2] perf/hw_breakpoint: Clear stop state in hw_breakpoint_add()

[sashiko-bot]

> Since commit 18dbcbfabfff ("perf: Fix the POLL_HUP delivery breakage"),
> __perf_event_overflow() stops the event with pmu->stop() and disables
> it when the PERF_EVENT_IOC_REFRESH limit is reached. When userspace
> re-arms the event with PERF_EVENT_IOC_REFRESH, the event is enabled
> again and pmu->add() is called with PERF_EF_START.
> 
> hw_breakpoint_add() sets PERF_HES_STOPPED when PERF_EF_START is
> missing, but never clears it. The flag set by pmu->stop() stays, and
> perf_bp_event() drops every later hit, so a breakpoint re-armed this
> way delivers only its first overflow.
> 
> Set the state from PERF_EF_START on every add, as perf_swevent_add()
> does.
> 
> Fixes: 18dbcbfabfff ("perf: Fix the POLL_HUP delivery breakage")
> Assisted-by: LLM
> Signed-off-by: Paolo Bertinetti <paolobertinetti200f4@proton.me>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261103130859.764885-2-paolobertinetti200f4@proton.me?part=2