Performance is generally considered to be an NFR category, though of course you're 100% correct that performance requirements are only meaningful when associated with specific pieces functionality.

One way to handle NFR categories like performance and security is to define specific categories of goal parameters, such as response times or access permissions , and have the various functional requirements point to the relevant value for each NFR as an attribute of the functional req.