[PATCH v3 0/5] Fix traceNoC probe issue on multiple QCOM platforms

[PATCH v3 0/5] Fix traceNoC probe issue on multiple QCOM platforms

[Jie Gan]

The CoreSight TNOC (Trace Network-On-Chip) binding so far only allowed the
two-string AMBA form "qcom,coresight-tnoc", "arm,primecell". That form
forces the device onto the AMBA bus, where the driver must read the
peripheral ID from the device registers during probe. On several QCOM
platforms this AMBA peripheral-ID probing fails, so the traceNoC device
never probes and its trace path is unavailable.

This series introduces a standalone "qcom,coresight-agtnoc" compatible
that describes the Aggregator TNOC as a plain platform device. Without
"arm,primecell" the device is created on the platform bus and probes
through the platform driver, bypassing the AMBA peripheral-ID read while
remaining a fully functional Aggregator TNOC that allocates a system
trace ID (ATID).

The series is organized as: binding first, then the driver support for the
new compatible, followed by the per-platform DT fixes that switch the
affected nodes over to it.

- Patch 1 (dt-bindings) converts the compatible to a oneOf and adds the
standalone qcom,coresight-agtnoc form alongside the existing AMBA form,
updates the select block, and adds an example node.
- Patch 2 (driver) adds qcom,coresight-agtnoc to the platform driver's
match table and renames the itnoc-specific names to generic tnoc names,
since the platform driver now serves both the Interconnect and Aggregator
TNOC. It also restricts the ATID-unsupported handling to
qcom,coresight-itnoc only, so the standalone Aggregator TNOC is no longer
wrongly covered and correctly allocates a trace ID.
- Patches 3-4 (kaanapali, sm8750) switch the traceNoC nodes from the AMBA
form to the standalone qcom,coresight-agtnoc compatible, fixing the probe
failure on those platforms.
- Patch 5 (glymur) switches the node from qcom,coresight-itnoc to
qcom,coresight-agtnoc. This node is actually an Aggregator TNOC (its
tn_ag_* endpoints show aggregation), so it should expose a system trace
ID rather than being treated as an Interconnect TNOC.

Signed-off-by: Jie Gan <jie.gan@oss.qualcomm.com>
---
Changes in v3:
- add standalone compatible for AG traceNoC device, allow it to be
  probed with platform driver.
- add fix patches for sm8750 and Glymur platforms
- Link to v2: https://lore.kernel.org/r/20260624-fix-tracenoc-probe-issue-v2-0-786520f62f21@oss.qualcomm.com

Changes in v2:
- address the ATID issue reported by Sashiko.
- update binding to accept arm,primecell-periphid property.
- Link to v1: https://lore.kernel.org/r/20260624-fix-tracenoc-probe-issue-v1-1-bcc785198fc5@oss.qualcomm.com

---
Jie Gan (5):
      dt-bindings: arm: coresight-tnoc: Add standalone qcom,coresight-agtnoc compatible
      coresight: tnoc: Add AG tnoc standalone compatible to the platform driver
      arm64: dts: qcom: kaanapali: fix traceNoC probe issue
      arm64: dts: qcom: sm8750: fix traceNoC probe issue
      arm64: dts: qcom: glymur: use Aggregator TNOC compatible

 .../bindings/arm/qcom,coresight-tnoc.yaml          | 39 ++++++++++++++++++++--
 arch/arm64/boot/dts/qcom/glymur.dtsi               |  6 ++--
 arch/arm64/boot/dts/qcom/kaanapali.dtsi            |  2 +-
 arch/arm64/boot/dts/qcom/sm8750.dtsi               |  2 +-
 drivers/hwtracing/coresight/coresight-tnoc.c       | 35 +++++++++----------
 5 files changed, 59 insertions(+), 25 deletions(-)
---
base-commit: 4e5dfb7c84012007c3c7061126491bbc92d71bf1
change-id: 20260624-fix-tracenoc-probe-issue-c6429da28df4

Best regards,
-- 
Jie Gan <jie.gan@oss.qualcomm.com>

[PATCH v3 1/5] dt-bindings: arm: coresight-tnoc: Add standalone qcom,coresight-agtnoc compatible

[Jie Gan]

The TNOC compatible previously only allowed the two-string AMBA form
"qcom,coresight-tnoc", "arm,primecell", which forces the device onto the
AMBA bus.

Convert the compatible to a oneOf and add a standalone
"qcom,coresight-agtnoc" compatible alongside the existing AMBA form. The
standalone string carries no "arm,primecell" entry, so the device is
created on the platform bus instead of the AMBA bus.

Add "qcom,coresight-agtnoc" to the select block so the schema matches
nodes that use only the standalone compatible, and add an example node
demonstrating the standalone form.

Signed-off-by: Jie Gan <jie.gan@oss.qualcomm.com>
---
 .../bindings/arm/qcom,coresight-tnoc.yaml          | 39 ++++++++++++++++++++--
 1 file changed, 36 insertions(+), 3 deletions(-)

diff --git a/Documentation/devicetree/bindings/arm/qcom,coresight-tnoc.yaml b/Documentation/devicetree/bindings/arm/qcom,coresight-tnoc.yaml
index ef648a15b806..7e6e4b17a6c1 100644
--- a/Documentation/devicetree/bindings/arm/qcom,coresight-tnoc.yaml
+++ b/Documentation/devicetree/bindings/arm/qcom,coresight-tnoc.yaml
@@ -29,6 +29,7 @@ select:
       contains:
         enum:
           - qcom,coresight-tnoc
+          - qcom,coresight-agtnoc
   required:
     - compatible
 
@@ -37,9 +38,11 @@ properties:
     pattern: "^tn(@[0-9a-f]+)$"
 
   compatible:
-    items:
-      - const: qcom,coresight-tnoc
-      - const: arm,primecell
+    oneOf:
+      - items:
+          - const: qcom,coresight-tnoc
+          - const: arm,primecell
+      - const: qcom,coresight-agtnoc
 
   reg:
     maxItems: 1
@@ -110,4 +113,34 @@ examples:
         };
       };
     };
+
+  - |
+    tn@10980000  {
+      compatible = "qcom,coresight-agtnoc";
+      reg = <0x10980000 0x4200>;
+
+      clocks = <&aoss_qmp>;
+      clock-names = "apb_pclk";
+
+      in-ports {
+        #address-cells = <1>;
+        #size-cells = <0>;
+
+        port@0 {
+          reg = <0>;
+
+          tn_ag_in_tpdm_mss: endpoint {
+            remote-endpoint = <&tpdm_mss_out_tn_ag>;
+          };
+        };
+      };
+
+      out-ports {
+        port {
+          tn_ag_out_funnel_in2: endpoint {
+            remote-endpoint = <&funnel_in2_in_tn_ag>;
+          };
+        };
+      };
+    };
 ...

-- 
2.34.1

[PATCH v3 2/5] coresight: tnoc: Add AG tnoc standalone compatible to the platform driver

[Jie Gan]

The Aggregator TNOC can be described either as an AMBA device using the
"qcom,coresight-tnoc", "arm,primecell" compatible or as a standalone
platform device using the new "qcom,coresight-agtnoc" compatible. The
latter avoids the AMBA bus and the associated peripheral-ID probing.

Add "qcom,coresight-agtnoc" to the platform driver's match table so the
Aggregator TNOC can probe through the platform driver, and rename the
platform driver and its callbacks from the "itnoc"-specific names to
generic "tnoc" names, since the driver now serves both the Interconnect
and Aggregator TNOC. The platform driver name is updated to
"coresight-tnoc" accordingly.

Restrict the ATID-unsupported handling to the Interconnect TNOC. The
previous check disabled ATID for every non-AMBA device, which would
wrongly cover the standalone Aggregator TNOC. Only "qcom,coresight-itnoc"
lacks aggregation and ATID functionality, so key the check on that
compatible and let every other form allocate a trace ID.

Signed-off-by: Jie Gan <jie.gan@oss.qualcomm.com>
---
 drivers/hwtracing/coresight/coresight-tnoc.c | 35 ++++++++++++++--------------
 1 file changed, 18 insertions(+), 17 deletions(-)

diff --git a/drivers/hwtracing/coresight/coresight-tnoc.c b/drivers/hwtracing/coresight/coresight-tnoc.c
index 9e8de4323d28..8237467faba7 100644
--- a/drivers/hwtracing/coresight/coresight-tnoc.c
+++ b/drivers/hwtracing/coresight/coresight-tnoc.c
@@ -130,7 +130,7 @@ static int trace_noc_init_default_data(struct trace_noc_drvdata *drvdata)
 {
 	int atid;
 
-	if (!dev_is_amba(drvdata->dev)) {
+	if (of_device_is_compatible(drvdata->dev->of_node, "qcom,coresight-itnoc")) {
 		drvdata->atid = -EOPNOTSUPP;
 		return 0;
 	}
@@ -278,7 +278,7 @@ static struct amba_driver trace_noc_driver = {
 	.id_table	= trace_noc_ids,
 };
 
-static int itnoc_probe(struct platform_device *pdev)
+static int tnoc_platform_probe(struct platform_device *pdev)
 {
 	struct resource *res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	int ret;
@@ -295,7 +295,7 @@ static int itnoc_probe(struct platform_device *pdev)
 	return ret;
 }
 
-static void itnoc_remove(struct platform_device *pdev)
+static void tnoc_platform_remove(struct platform_device *pdev)
 {
 	struct trace_noc_drvdata *drvdata = platform_get_drvdata(pdev);
 
@@ -304,7 +304,7 @@ static void itnoc_remove(struct platform_device *pdev)
 }
 
 #ifdef CONFIG_PM
-static int itnoc_runtime_suspend(struct device *dev)
+static int tnoc_runtime_suspend(struct device *dev)
 {
 	struct trace_noc_drvdata *drvdata = dev_get_drvdata(dev);
 
@@ -313,7 +313,7 @@ static int itnoc_runtime_suspend(struct device *dev)
 	return 0;
 }
 
-static int itnoc_runtime_resume(struct device *dev)
+static int tnoc_runtime_resume(struct device *dev)
 {
 	struct trace_noc_drvdata *drvdata = dev_get_drvdata(dev);
 
@@ -321,35 +321,36 @@ static int itnoc_runtime_resume(struct device *dev)
 }
 #endif
 
-static const struct dev_pm_ops itnoc_dev_pm_ops = {
-	SET_RUNTIME_PM_OPS(itnoc_runtime_suspend, itnoc_runtime_resume, NULL)
+static const struct dev_pm_ops tnoc_dev_pm_ops = {
+	SET_RUNTIME_PM_OPS(tnoc_runtime_suspend, tnoc_runtime_resume, NULL)
 };
 
-static const struct of_device_id itnoc_of_match[] = {
+static const struct of_device_id tnoc_of_match[] = {
 	{ .compatible = "qcom,coresight-itnoc" },
+	{ .compatible = "qcom,coresight-agtnoc" },
 	{}
 };
-MODULE_DEVICE_TABLE(of, itnoc_of_match);
+MODULE_DEVICE_TABLE(of, tnoc_of_match);
 
-static struct platform_driver itnoc_driver = {
-	.probe = itnoc_probe,
-	.remove = itnoc_remove,
+static struct platform_driver tnoc_platform_driver = {
+	.probe = tnoc_platform_probe,
+	.remove = tnoc_platform_remove,
 	.driver = {
-		.name = "coresight-itnoc",
-		.of_match_table = itnoc_of_match,
+		.name = "coresight-tnoc",
+		.of_match_table = tnoc_of_match,
 		.suppress_bind_attrs = true,
-		.pm = &itnoc_dev_pm_ops,
+		.pm = &tnoc_dev_pm_ops,
 	},
 };
 
 static int __init tnoc_init(void)
 {
-	return coresight_init_driver("tnoc", &trace_noc_driver, &itnoc_driver);
+	return coresight_init_driver("tnoc", &trace_noc_driver, &tnoc_platform_driver);
 }
 
 static void __exit tnoc_exit(void)
 {
-	coresight_remove_driver(&trace_noc_driver, &itnoc_driver);
+	coresight_remove_driver(&trace_noc_driver, &tnoc_platform_driver);
 }
 module_init(tnoc_init);
 module_exit(tnoc_exit);

-- 
2.34.1

[PATCH v3 3/5] arm64: dts: qcom: kaanapali: fix traceNoC probe issue

[Jie Gan]

The traceNoC node used the "qcom,coresight-tnoc", "arm,primecell"
compatible, which places the device on the AMBA bus. The AMBA peripheral
ID probing fails on this platform, so the device never probes.

Switch the node to the standalone "qcom,coresight-agtnoc" compatible.
Dropping "arm,primecell" makes the device probe through the platform
driver instead of the AMBA bus, which resolves the probe failure while
keeping it an Aggregator TNOC that retains ATID functionality.

Fixes: f73959d86c15 ("arm64: dts: qcom: kaanapali: add coresight nodes")
Signed-off-by: Jie Gan <jie.gan@oss.qualcomm.com>
---
 arch/arm64/boot/dts/qcom/kaanapali.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/qcom/kaanapali.dtsi b/arch/arm64/boot/dts/qcom/kaanapali.dtsi
index 7aa9653bd456..e98f4aa4b141 100644
--- a/arch/arm64/boot/dts/qcom/kaanapali.dtsi
+++ b/arch/arm64/boot/dts/qcom/kaanapali.dtsi
@@ -5004,7 +5004,7 @@ tpdm_pcie_rscc_out: endpoint {
 		};
 
 		tn@111b8000 {
-			compatible = "qcom,coresight-tnoc", "arm,primecell";
+			compatible = "qcom,coresight-agtnoc";
 			reg = <0x0 0x111b8000 0x0 0x4200>;
 
 			clocks = <&aoss_qmp>;

-- 
2.34.1

[PATCH v3 4/5] arm64: dts: qcom: sm8750: fix traceNoC probe issue

[Jie Gan]

The traceNoC node used the "qcom,coresight-tnoc", "arm,primecell"
compatible, which places the device on the AMBA bus. The AMBA peripheral
ID probing fails on this platform, so the device never probes.

Switch the node to the standalone "qcom,coresight-agtnoc" compatible.
Dropping "arm,primecell" makes the device probe through the platform
driver instead of the AMBA bus, which resolves the probe failure while
keeping it an Aggregator TNOC that retains ATID functionality.

Fixes: ebd1eb365cae ("arm64: qcom: dts: sm8750: add coresight nodes")
Signed-off-by: Jie Gan <jie.gan@oss.qualcomm.com>
---
 arch/arm64/boot/dts/qcom/sm8750.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/qcom/sm8750.dtsi b/arch/arm64/boot/dts/qcom/sm8750.dtsi
index fafed417c66f..d58483f9f93a 100644
--- a/arch/arm64/boot/dts/qcom/sm8750.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8750.dtsi
@@ -4687,7 +4687,7 @@ tpdm_rdpm_cmb2_out: endpoint {
 		};
 
 		tn@109ab000 {
-			compatible = "qcom,coresight-tnoc", "arm,primecell";
+			compatible = "qcom,coresight-agtnoc";
 			reg = <0x0 0x109ab000 0x0 0x4200>;
 
 			clocks = <&aoss_qmp>;

-- 
2.34.1

[PATCH v3 5/5] arm64: dts: qcom: glymur: use Aggregator TNOC compatible

[Jie Gan]

The traceNoC node used the "qcom,coresight-itnoc" compatible, which
describes an Interconnect TNOC. That device has no aggregation and no
ATID functionality, so the driver marks its trace ID as unsupported.
This node is actually an Aggregator TNOC, as shown by its tn_ag_*
endpoints, and should expose a system trace ID.

Switch the node to the standalone "qcom,coresight-agtnoc" compatible so
it probes as an Aggregator TNOC and allocates a system trace ID. Rename
the node to "tn" and use the "apb_pclk" clock name as required by the
Aggregator TNOC binding.

Fixes: 1f7d0c42a08d ("arm64: dts: qcom: glymur: add coresight nodes")
Signed-off-by: Jie Gan <jie.gan@oss.qualcomm.com>
---
 arch/arm64/boot/dts/qcom/glymur.dtsi | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/arm64/boot/dts/qcom/glymur.dtsi b/arch/arm64/boot/dts/qcom/glymur.dtsi
index 20b49af7298e..d612e8ed54c8 100644
--- a/arch/arm64/boot/dts/qcom/glymur.dtsi
+++ b/arch/arm64/boot/dts/qcom/glymur.dtsi
@@ -6038,12 +6038,12 @@ qm_tpdm_out: endpoint {
 			};
 		};
 
-		itnoc@11200000  {
-			compatible = "qcom,coresight-itnoc";
+		tn@11200000 {
+			compatible = "qcom,coresight-agtnoc";
 			reg = <0x0 0x11200000 0x0 0x3c00>;
 
 			clocks = <&aoss_qmp>;
-			clock-names = "apb";
+			clock-names = "apb_pclk";
 
 			in-ports {
 				#address-cells = <1>;

-- 
2.34.1

Re: [PATCH v3 2/5] coresight: tnoc: Add AG tnoc standalone compatible to the platform driver

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] System Trace ID is leaked on platform device removal for standalone Aggregator TNOC.
--

commit 060ed6649d8ad0bd7b6b53c7f626563782e801df
Author: Jie Gan <jie.gan@oss.qualcomm.com>

coresight: tnoc: Add AG tnoc standalone compatible to the platform driver

This commit adds the "qcom,coresight-agtnoc" compatible to allow the Aggregator
TNOC to probe as a standalone platform device. It updates the platform driver
and callback names to generic "tnoc" variants. It also modifies the default
data initialization so that only the Interconnect TNOC skips trace ID allocation.

> diff --git a/drivers/hwtracing/coresight/coresight-tnoc.c b/drivers/hwtracing/coresight/coresight-tnoc.c
> index 9e8de4323d285..8237467faba72 100644
> --- a/drivers/hwtracing/coresight/coresight-tnoc.c
> +++ b/drivers/hwtracing/coresight/coresight-tnoc.c
[ ... ]
> @@ -295,7 +295,7 @@ static int itnoc_probe(struct platform_device *pdev)
>  	return ret;
>  }
>  
> -static void itnoc_remove(struct platform_device *pdev)
> +static void tnoc_platform_remove(struct platform_device *pdev)
>  {
>  	struct trace_noc_drvdata *drvdata = platform_get_drvdata(pdev);
>  
>  	coresight_unregister(drvdata->csdev);
>  	pm_runtime_disable(&pdev->dev);
>  }

[Severity: High]
Does this code leak the allocated system trace ID on device removal?

Because trace_noc_init_default_data() now allocates a system trace ID via
coresight_trace_id_get_system_id() for the new "qcom,coresight-agtnoc"
devices, it appears tnoc_platform_remove() needs a corresponding call to
coresight_trace_id_put_system_id(drvdata->atid) when the driver is unbound.

Without this cleanup, repeated unbind and bind cycles could permanently
exhaust the finite system trace ID pool.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260630-fix-tracenoc-probe-issue-v3-0-7201e1841e94@oss.qualcomm.com?part=2

Re: [PATCH v3 2/5] coresight: tnoc: Add AG tnoc standalone compatible to the platform driver

[Jie Gan]

On 6/30/2026 6:57 PM, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] System Trace ID is leaked on platform device removal for standalone Aggregator TNOC.
> --
> 
> commit 060ed6649d8ad0bd7b6b53c7f626563782e801df
> Author: Jie Gan <jie.gan@oss.qualcomm.com>
> 
> coresight: tnoc: Add AG tnoc standalone compatible to the platform driver
> 
> This commit adds the "qcom,coresight-agtnoc" compatible to allow the Aggregator
> TNOC to probe as a standalone platform device. It updates the platform driver
> and callback names to generic "tnoc" variants. It also modifies the default
> data initialization so that only the Interconnect TNOC skips trace ID allocation.
> 
>> diff --git a/drivers/hwtracing/coresight/coresight-tnoc.c b/drivers/hwtracing/coresight/coresight-tnoc.c
>> index 9e8de4323d285..8237467faba72 100644
>> --- a/drivers/hwtracing/coresight/coresight-tnoc.c
>> +++ b/drivers/hwtracing/coresight/coresight-tnoc.c
> [ ... ]
>> @@ -295,7 +295,7 @@ static int itnoc_probe(struct platform_device *pdev)
>>   	return ret;
>>   }
>>   
>> -static void itnoc_remove(struct platform_device *pdev)
>> +static void tnoc_platform_remove(struct platform_device *pdev)
>>   {
>>   	struct trace_noc_drvdata *drvdata = platform_get_drvdata(pdev);
>>   
>>   	coresight_unregister(drvdata->csdev);
>>   	pm_runtime_disable(&pdev->dev);
>>   }
> 
> [Severity: High]
> Does this code leak the allocated system trace ID on device removal?
> 

Thanks for reporting. We need free the trace ID in remove path.

Thanks,
Jie

> Because trace_noc_init_default_data() now allocates a system trace ID via
> coresight_trace_id_get_system_id() for the new "qcom,coresight-agtnoc"
> devices, it appears tnoc_platform_remove() needs a corresponding call to
> coresight_trace_id_put_system_id(drvdata->atid) when the driver is unbound.
> 
> Without this cleanup, repeated unbind and bind cycles could permanently
> exhaust the finite system trace ID pool.
> 

Re: [PATCH v3 3/5] arm64: dts: qcom: kaanapali: fix traceNoC probe issue

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

New issues:
- [High] Trace ID (ATID) leak on driver unbind when using the `qcom,coresight-agtnoc` compatible with the platform driver.

Pre-existing issues:
- [High] Switching the device to the platform driver exposes an unbalanced clock disable during probe error paths and driver unbind due to a conflict between devm_clk_get_optional_enabled() and manual PM runtime clock management.
--

commit 6dd81dc5c2c5997c8cc48dc9206b866b99451df0
Author: Jie Gan <jie.gan@oss.qualcomm.com>

arm64: dts: qcom: kaanapali: fix traceNoC probe issue

The traceNoC node used the "qcom,coresight-tnoc", "arm,primecell" compatible,
which failed probing on the AMBA bus. This patch switches the node to the
"qcom,coresight-agtnoc" compatible so it probes through the platform driver.

> diff --git a/arch/arm64/boot/dts/qcom/kaanapali.dtsi b/arch/arm64/boot/dts/qcom/kaanapali.dtsi
> index 7aa9653bd456e..e98f4aa4b141a 100644
> --- a/arch/arm64/boot/dts/qcom/kaanapali.dtsi
> +++ b/arch/arm64/boot/dts/qcom/kaanapali.dtsi
> @@ -5004,7 +5004,7 @@ tpdm_pcie_rscc_out: endpoint {
>  		};
>  
>  		tn@111b8000 {
> -			compatible = "qcom,coresight-tnoc", "arm,primecell";
> +			compatible = "qcom,coresight-agtnoc";

[Severity: High]
This is a pre-existing issue, but switching to the platform driver exposes
an unbalanced clock disable during probe error paths and driver unbind.

When probe uses devm_clk_get_optional_enabled(), it queues a devres cleanup
action to call clk_disable_unprepare(). However, the driver also manually
disables the clock during runtime suspend:

drivers/hwtracing/coresight/coresight-tnoc.c:tnoc_runtime_suspend() {
    ...
	clk_disable_unprepare(drvdata->pclk);
	return 0;
}

When unbinding the platform driver, tnoc_platform_remove() doesn't wake the
device up before disabling PM runtime:

drivers/hwtracing/coresight/coresight-tnoc.c:tnoc_platform_remove() {
    ...
	coresight_unregister(drvdata->csdev);
	pm_runtime_disable(&pdev->dev);
}

If the device is runtime suspended during unbind, the clock is already
manually disabled. The devres cleanup will then run and double-disable the
clock. Does tnoc_platform_remove() need a pm_runtime_get_sync() call to
ensure the clock is enabled before devres takes over?


[Severity: High]
Does switching to the platform driver expose a trace ID (ATID) leak on
driver unbind?

The platform driver allocates a system trace ID for agtnoc devices during
probe:

drivers/hwtracing/coresight/coresight-tnoc.c:trace_noc_init_default_data() {
    ...
	atid = coresight_trace_id_get_system_id();
	if (atid < 0)
		return atid;

	drvdata->atid = atid;
}

But the platform remove callback doesn't seem to free it, unlike the AMBA
driver's remove function:

drivers/hwtracing/coresight/coresight-tnoc.c:tnoc_platform_remove() {
    ...
	coresight_unregister(drvdata->csdev);
	pm_runtime_disable(&pdev->dev);
}

Could this exhaust the system trace ID pool if the device is repeatedly
unbound and bound?

>  			reg = <0x0 0x111b8000 0x0 0x4200>;
>  
>  			clocks = <&aoss_qmp>;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260630-fix-tracenoc-probe-issue-v3-0-7201e1841e94@oss.qualcomm.com?part=3

Re: [PATCH v3 4/5] arm64: dts: qcom: sm8750: fix traceNoC probe issue

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] Leaked coresight trace ID on driver unbind for platform devices.
- [Medium] Unconditional free of trace ID in AMBA remove triggers WARN on unallocated IDs.
--

commit 95ddd2ab120783ca669e4302a341bf092ecf6485
Author: Jie Gan <jie.gan@oss.qualcomm.com>

arm64: dts: qcom: sm8750: fix traceNoC probe issue

The traceNoC node used the "qcom,coresight-tnoc", "arm,primecell"
compatible, which places the device on the AMBA bus. The AMBA peripheral
ID probing fails on this platform, so the device never probes.

Switch the node to the standalone "qcom,coresight-agtnoc" compatible.
Dropping "arm,primecell" makes the device probe through the platform
driver instead of the AMBA bus, which resolves the probe failure while
keeping it an Aggregator TNOC that retains ATID functionality.

> diff --git a/arch/arm64/boot/dts/qcom/sm8750.dtsi b/arch/arm64/boot/dts/qcom/sm8750.dtsi
> --- a/arch/arm64/boot/dts/qcom/sm8750.dtsi
> +++ b/arch/arm64/boot/dts/qcom/sm8750.dtsi
> @@ -4687,7 +4687,7 @@ tpdm_rdpm_cmb2_out: endpoint {
>  		};
>  
>  		tn@109ab000 {
> -			compatible = "qcom,coresight-tnoc", "arm,primecell";
> +			compatible = "qcom,coresight-agtnoc";

[Severity: High]
Does switching to the platform driver probe path introduce a trace ID leak on
device unbind?

When the device probes via the platform driver due to this compatible string
change, _tnoc_probe() calls trace_noc_init_default_data() which successfully
allocates a trace ID via coresight_trace_id_get_system_id().

However, looking at the driver's platform remove callback:

drivers/hwtracing/coresight/coresight-tnoc.c:tnoc_platform_remove() {
	struct trace_noc_drvdata *drvdata = platform_get_drvdata(pdev);

	coresight_unregister(drvdata->csdev);
	pm_runtime_disable(&pdev->dev);
}

The allocated system trace ID is never released via
coresight_trace_id_put_system_id(). Will this eventually exhaust the globally
limited pool of hardware trace IDs if the driver is unbound?

[Severity: Medium]
For configurations that still probe via the AMBA bus (retaining the
"arm,primecell" compatible), does the AMBA remove callback unconditionally free
unallocated trace IDs?

If a device node uses a compatible that results in atid being assigned
-EOPNOTSUPP, the _tnoc_probe() error path safely checks if (drvdata->atid > 0)
before freeing it. However, trace_noc_remove() does not:

drivers/hwtracing/coresight/coresight-tnoc.c:trace_noc_remove() {
	struct trace_noc_drvdata *drvdata = dev_get_drvdata(&adev->dev);

	coresight_unregister(drvdata->csdev);
	coresight_trace_id_put_system_id(drvdata->atid);
}

Because coresight_trace_id_free() validates the ID and fires a kernel WARN if
it is invalid, will this trigger a warning during AMBA device unbind?

>  			reg = <0x0 0x109ab000 0x0 0x4200>;
>  
>  			clocks = <&aoss_qmp>;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260630-fix-tracenoc-probe-issue-v3-0-7201e1841e94@oss.qualcomm.com?part=4

Re: [PATCH v3 5/5] arm64: dts: qcom: glymur: use Aggregator TNOC compatible

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] System trace ID leak on device unbind or module removal for Aggregator TNOC platform devices because `tnoc_platform_remove` fails to free the allocated ID.
--

commit e1acaab1b46a7af95def9021d30728ac2de6b44a
Author: Jie Gan <jie.gan@oss.qualcomm.com>

arm64: dts: qcom: glymur: use Aggregator TNOC compatible

This commit updates the traceNoC node in the glymur device tree to use the
qcom,coresight-agtnoc compatible. This ensures the node probes as an 
Aggregator TNOC and properly allocates a system trace ID.

> diff --git a/arch/arm64/boot/dts/qcom/glymur.dtsi b/arch/arm64/boot/dts/qcom/glymur.dtsi
> --- a/arch/arm64/boot/dts/qcom/glymur.dtsi
> +++ b/arch/arm64/boot/dts/qcom/glymur.dtsi
> @@ -6038,12 +6038,12 @@ qm_tpdm_out: endpoint {
[ ... ]
> -		itnoc@11200000  {
> -			compatible = "qcom,coresight-itnoc";
> +		tn@11200000 {
> +			compatible = "qcom,coresight-agtnoc";

[Severity: High]
This is a pre-existing issue, but by switching this node to the
qcom,coresight-agtnoc compatible, does this expose a system trace ID leak on
device unbind?

When a platform device matching this compatible is bound, it allocates a
system trace ID. However, if the device is subsequently unbound via sysfs or
module unload, the current cleanup path fails to free the ID:

drivers/hwtracing/coresight/coresight-tnoc.c:tnoc_platform_remove() {
	struct trace_noc_drvdata *drvdata = platform_get_drvdata(pdev);

	coresight_unregister(drvdata->csdev);
	pm_runtime_disable(&pdev->dev);
}

Unlike the AMBA counterpart trace_noc_remove(), this platform removal function
lacks a call to coresight_trace_id_put_system_id(drvdata->atid). 

Since the global trace ID pool is strictly limited, could unbinding this newly
converted device repeatedly exhaust the system trace IDs and prevent further
CoreSight trace sessions from succeeding?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260630-fix-tracenoc-probe-issue-v3-0-7201e1841e94@oss.qualcomm.com?part=5

Re: [PATCH v3 3/5] arm64: dts: qcom: kaanapali: fix traceNoC probe issue

[Konrad Dybcio]

On 6/30/26 12:36 PM, Jie Gan wrote:
> The traceNoC node used the "qcom,coresight-tnoc", "arm,primecell"
> compatible, which places the device on the AMBA bus. The AMBA peripheral
> ID probing fails on this platform, so the device never probes.

An interested reader would immediately expect an answer to why that's
the case

> Switch the node to the standalone "qcom,coresight-agtnoc" compatible.
> Dropping "arm,primecell" makes the device probe through the platform
> driver instead of the AMBA bus, which resolves the probe failure while
> keeping it an Aggregator TNOC that retains ATID functionality.

This describes OS behavior. Move your message towards the other
compatible not depending on reading that ID register.

Konrad

Re: [PATCH v3 3/5] arm64: dts: qcom: kaanapali: fix traceNoC probe issue

[Jie Gan]

On 6/30/2026 8:53 PM, Konrad Dybcio wrote:
> On 6/30/26 12:36 PM, Jie Gan wrote:
>> The traceNoC node used the "qcom,coresight-tnoc", "arm,primecell"
>> compatible, which places the device on the AMBA bus. The AMBA peripheral
>> ID probing fails on this platform, so the device never probes.
> 
> An interested reader would immediately expect an answer to why that's
> the case
> 
>> Switch the node to the standalone "qcom,coresight-agtnoc" compatible.
>> Dropping "arm,primecell" makes the device probe through the platform
>> driver instead of the AMBA bus, which resolves the probe failure while
>> keeping it an Aggregator TNOC that retains ATID functionality.
> 
> This describes OS behavior. Move your message towards the other
> compatible not depending on reading that ID register.

Thanks for the suggestion, will rephrase the description.

Thanks,
Jie

> 
> Konrad