[PATCH v3 0/8] perf tools amd ibs: Fixes + Zen6 enhancements

[PATCH v3 0/8] perf tools amd ibs: Fixes + Zen6 enhancements

[Ravi Bangoria]

o Fix kernel version check in perf IBS unit test.
o On Zen6 and newer platforms, skip perf unit test that assumes IBS don't
  have hardware-assisted privilege filter.
o Starting with Zen4, the validity of several IBS fields changes. Add
  the required dependency checks when decoding IBS MSRs.
o Zen6 and future platforms extends IBS OP with Streaming-Store and
  Remote-Socket indicators for load/store instructions. Add decoding
  support for these new bits.
o Document new IBS features in perf-amd-ibs man page 

IBS Zen6 enhancements doc:
  AMD64 Zen6 Instruction Based Sampling (IBS) Extensions and Features,
  Pub. 69205 Rev. 1.00 March 2026 
  https://bugzilla.kernel.org/attachment.cgi?id=310002

Patches are prepared on perf-tools-next/perf-tools-next (53bc03289278).

v2: https://lore.kernel.org/r/20260430061115.10266-1-ravi.bangoria@amd.com  
v2->v3:
 - Instead of removing the priv modifier unit test completely, skip
   it on platforms that supports hardware privilege filtering. (Namhyung)
 - Rebased the series on latest perf-tools-next/perf-tools-next.

Ravi Bangoria (8):
  perf test amd ibs: Fix incorrect kernel version check
  perf tool ibs: Sync AMD IBS header file
  perf test ibs: Skip privilege test on Zen6 and newer platforms
  perf amd ibs: Suppress bogus TlbRefillLat and DCPhysAd on Zen4+
  perf amd ibs: Make Fetch status bits dependent on PhyAddrValid for
    newer platforms
  perf amd ibs: Decode Remote-Socket flag in IBS OP raw dump
  perf amd ibs: Decode Streaming-store flag in IBS OP raw dump
  perf doc: Document new IBS capabilities in man page

 tools/arch/x86/include/asm/amd/ibs.h       |  4 +-
 tools/perf/Documentation/perf-amd-ibs.txt  | 39 ++++++++++
 tools/perf/arch/x86/tests/amd-ibs-period.c |  2 +-
 tools/perf/tests/shell/amd-ibs-swfilt.sh   | 37 ++++++++-
 tools/perf/util/amd-sample-raw.c           | 87 ++++++++++++++++++++--
 5 files changed, 156 insertions(+), 13 deletions(-)

-- 
2.43.0

[PATCH v3 1/8] perf test amd ibs: Fix incorrect kernel version check

[Ravi Bangoria]

"AMD IBS sample period" unit test is getting skipped on kernel v7.x. Fix
the kernel version >= v6.15 check.

Fixes: 21fb366b2f457 ("perf test amd: Skip amd-ibs-period test on kernel < v6.15")
Signed-off-by: Ravi Bangoria <ravi.bangoria@amd.com>
---
 tools/perf/arch/x86/tests/amd-ibs-period.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/perf/arch/x86/tests/amd-ibs-period.c b/tools/perf/arch/x86/tests/amd-ibs-period.c
index cee9e11c05e0..6a92b3a23ed7 100644
--- a/tools/perf/arch/x86/tests/amd-ibs-period.c
+++ b/tools/perf/arch/x86/tests/amd-ibs-period.c
@@ -932,7 +932,7 @@ static bool kernel_v6_15_or_newer(void)
 	endptr++;
 	minor = strtol(endptr, NULL, 10);
 
-	return major >= 6 && minor >= 15;
+	return major > 6 || (major == 6 && minor >= 15);
 }
 
 int test__amd_ibs_period(struct test_suite *test __maybe_unused,
-- 
2.43.0

[PATCH v3 2/8] perf tool ibs: Sync AMD IBS header file

[Ravi Bangoria]

IBS_OP_DATA2 register will have two more fields: strm_st and rmt_socket
in Zen6 and future AMD platforms. Kernel header file is already updated.
Add those fields in tools copy as well.

Signed-off-by: Ravi Bangoria <ravi.bangoria@amd.com>
---
 tools/arch/x86/include/asm/amd/ibs.h | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tools/arch/x86/include/asm/amd/ibs.h b/tools/arch/x86/include/asm/amd/ibs.h
index d0777b597322..6f25074e669f 100644
--- a/tools/arch/x86/include/asm/amd/ibs.h
+++ b/tools/arch/x86/include/asm/amd/ibs.h
@@ -99,7 +99,9 @@ union ibs_op_data2 {
 			rmt_node:1,	/* 4: destination node */
 			cache_hit_st:1,	/* 5: cache hit state */
 			data_src_hi:2,	/* 6-7: data source high */
-			reserved1:56;	/* 8-63: reserved */
+			strm_st:1,	/* 8: streaming store */
+			rmt_socket:1,   /* 9: remote socket */
+			reserved1:54;   /* 10-63: reserved */
 	};
 };
 
-- 
2.43.0

[PATCH v3 3/8] perf test ibs: Skip privilege test on Zen6 and newer platforms

[Ravi Bangoria]

IBS on pre-Zen6 platforms lacked a hardware privilege filter, so the
kernel enabled swfilt=1. Zen6 and newer platforms provides privilege
filtering via the RIP[63] bit, making swfilt redundant. Skip the perf
unit test that assumes IBS has no hardware-assisted privilege filter
on Zen6 and newer platforms.

swfilt is ignored by kernel on platforms that support RIP[63] bit filter
i.e. all amd-ibs-swfilt.sh tests will test hardware assisted privilege
filter.

Without the patch on Zen6:

  # sudo ./perf test -vv 77
   77: AMD IBS software filtering:
  --- start ---
  test child forked, pid 30813
  check availability of IBS swfilt
  run perf record with modifier and swfilt
  [FAIL] IBS PMU should not accept exclude_kernel
  ---- end(-1) ----
   77: AMD IBS software filtering                            : FAILED!

With the patch:

  # ./perf test -vv 77
   77: AMD IBS software filtering:
  --- start ---
  test child forked, pid 30903
  check availability of IBS swfilt
  run perf record with modifier and swfilt
  [ perf record: Woken up 2 times to write data ]
  [ perf record: Captured and wrote 0.000 MB /dev/null ]
  [ perf record: Woken up 3 times to write data ]
  [ perf record: Captured and wrote 0.000 MB /dev/null ]
  [ perf record: Woken up 3 times to write data ]
  [ perf record: Captured and wrote 0.000 MB /dev/null ]
  [ perf record: Woken up 1 times to write data ]
  [ perf record: Captured and wrote 0.000 MB /dev/null ]
  check number of samples with swfilt
  [ perf record: Woken up 4 times to write data ]
  [ perf record: Captured and wrote 0.051 MB - ]
  [ perf record: Woken up 4 times to write data ]
  [ perf record: Captured and wrote 0.063 MB - ]
  ---- end(0) ----
   77: AMD IBS software filtering                            : Ok

Signed-off-by: Ravi Bangoria <ravi.bangoria@amd.com>
---
 tools/perf/tests/shell/amd-ibs-swfilt.sh | 37 +++++++++++++++++++++---
 1 file changed, 33 insertions(+), 4 deletions(-)

diff --git a/tools/perf/tests/shell/amd-ibs-swfilt.sh b/tools/perf/tests/shell/amd-ibs-swfilt.sh
index e7f66df05c4b..e3738436773e 100755
--- a/tools/perf/tests/shell/amd-ibs-swfilt.sh
+++ b/tools/perf/tests/shell/amd-ibs-swfilt.sh
@@ -1,6 +1,33 @@
 #!/bin/bash
 # AMD IBS software filtering
 
+cpu_family() {
+    grep -m1 '^cpu family[[:space:]]*:' /proc/cpuinfo \
+        | awk -F: '{gsub(/^[ \t]+/, "", $2); print $2}'
+}
+
+cpu_model() {
+    grep -m1 '^model[[:space:]]*:' /proc/cpuinfo \
+        | awk -F: '{gsub(/^[ \t]+/, "", $2); print $2}'
+}
+
+# IBS PMUs does not advertize privilege filtering capability. Rely
+# on Family / Model check.
+hw_priv_filter_supported() {
+    family=$(cpu_family)
+    model=$(cpu_model)
+
+    if (( family > 0x1a )) ||
+       { (( family == 0x1a )) &&
+         { { (( model >= 0x50 && model <= 0x5f )) ||
+             (( model >= 0x80 && model <= 0xaf )) ||
+             (( model >= 0xc0 && model <= 0xcf )); }; }; }; then
+        return 0 # True
+    else
+        return 1 # False
+    fi
+}
+
 ParanoidAndNotRoot() {
   [ "$(id -u)" != 0 ] && [ "$(cat /proc/sys/kernel/perf_event_paranoid)" -gt $1 ]
 }
@@ -23,10 +50,12 @@ echo "run perf record with modifier and swfilt"
 err=0
 
 # setting any modifiers should fail
-perf record -B -e ibs_op//u -o /dev/null true 2> /dev/null
-if [ $? -eq 0 ]; then
-    echo "[FAIL] IBS PMU should not accept exclude_kernel"
-    exit 1
+if ! hw_priv_filter_supported; then
+    perf record -B -e ibs_op//u -o /dev/null true 2> /dev/null
+    if [ $? -eq 0 ]; then
+        echo "[FAIL] IBS PMU should not accept exclude_kernel"
+        exit 1
+    fi
 fi
 
 # setting it with swfilt should be fine
-- 
2.43.0

[PATCH v3 4/8] perf amd ibs: Suppress bogus TlbRefillLat and DCPhysAd on Zen4+

[Ravi Bangoria]

On Zen4 (and future) CPUs, IBS_OP_DATA3[TlbRefillLat] is valid only if
IBS_OP_DATA3[DcPhyAddrValid] is set. Similarly, IBS_DC_PHYSADDR is valid
if IBS_OP_DATA3[DcLinAddrValid] is _also_ set. Add these checks while
decoding IBS MSRs.

When IBS is triggered by an unprivileged user, the kernel now zeroes
PhysAddr before storing raw IBS register values in the perf sample. The
perf tool, however, still outputs these zero physical addresses, which
serves no purpose. So avoid printing zero physical addresses.

Instead of explicit family/model checks use the !zen4_ibs_extensions as
a proxy flag to cover Zen 3 and earlier revisions.

Signed-off-by: Ravi Bangoria <ravi.bangoria@amd.com>
---
 tools/perf/util/amd-sample-raw.c | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/tools/perf/util/amd-sample-raw.c b/tools/perf/util/amd-sample-raw.c
index b084dee76b1a..385308c55f34 100644
--- a/tools/perf/util/amd-sample-raw.c
+++ b/tools/perf/util/amd-sample-raw.c
@@ -172,6 +172,7 @@ static void pr_ibs_op_data3(union ibs_op_data3 reg)
 	char dc_l1_l2tlb_miss_str[sizeof(" DcL1TlbMiss _ DcL2TlbMiss _")] = "";
 	char dc_l1tlb_hit_str[sizeof(" DcL1TlbHit2M _ DcL1TlbHit1G _")] = "";
 	char op_mem_width_str[sizeof(" OpMemWidth _____ bytes")] = "";
+	char tlb_refill_lat_str[sizeof(" TlbRefillLat _____")] = "";
 	char dc_l2tlb_hit_2m_str[sizeof(" DcL2TlbHit2M _")] = "";
 	char dc_l2tlb_hit_1g_str[sizeof(" DcL2TlbHit1G _")] = "";
 	char dc_page_size_str[sizeof(" DcPageSize ____")] = "";
@@ -214,17 +215,23 @@ static void pr_ibs_op_data3(union ibs_op_data3 reg)
 			 " DcL2TlbHit1G %d", reg.dc_l2_tlb_hit_1g);
 	}
 
+	/* Use !zen4_ibs_extensions as a proxy for Zen3 and earlier */
+	if (!zen4_ibs_extensions || reg.dc_phy_addr_valid) {
+		snprintf(tlb_refill_lat_str, sizeof(tlb_refill_lat_str),
+			 " TlbRefillLat %5d", reg.tlb_refill_lat);
+	}
+
 	printf("ibs_op_data3:\t%016llx LdOp %d StOp %d%s%s%s DcMiss %d DcMisAcc %d "
 		"DcWcMemAcc %d DcUcMemAcc %d DcLockedOp %d DcMissNoMabAlloc %d "
 		"DcLinAddrValid %d DcPhyAddrValid %d%s%s SwPf %d%s%s "
-		"DcMissLat %5d TlbRefillLat %5d\n",
+		"DcMissLat %5d%s\n",
 		reg.val, reg.ld_op, reg.st_op, dc_l1_l2tlb_miss_str,
 		dtlb_pgsize_cap ? dc_page_size_str : dc_l1tlb_hit_str,
 		dc_l2tlb_hit_2m_str, reg.dc_miss, reg.dc_mis_acc, reg.dc_wc_mem_acc,
 		reg.dc_uc_mem_acc, reg.dc_locked_op, reg.dc_miss_no_mab_alloc,
 		reg.dc_lin_addr_valid, reg.dc_phy_addr_valid, dc_l2tlb_hit_1g_str,
 		l2_miss_str, reg.sw_pf, op_mem_width_str, op_dc_miss_open_mem_reqs_str,
-		reg.dc_miss_lat, reg.tlb_refill_lat);
+		reg.dc_miss_lat, tlb_refill_lat_str);
 }
 
 /*
@@ -253,8 +260,12 @@ static void amd_dump_ibs_op(struct perf_sample *sample)
 	pr_ibs_op_data3(*op_data3);
 	if (op_data3->dc_lin_addr_valid)
 		printf("IbsDCLinAd:\t%016llx\n", *(rip + 4));
-	if (op_data3->dc_phy_addr_valid)
+
+	/* Use !zen4_ibs_extensions as a proxy for Zen3 and earlier */
+	if (op_data3->dc_phy_addr_valid && *(rip + 5) &&
+	    (!zen4_ibs_extensions || op_data3->dc_lin_addr_valid)) {
 		printf("IbsDCPhysAd:\t%016llx\n", *(rip + 5));
+	}
 	if (op_data->op_brn_ret && *(rip + 6))
 		printf("IbsBrTarget:\t%016llx\n", *(rip + 6));
 }
-- 
2.43.0

Re: [PATCH v3 4/8] perf amd ibs: Suppress bogus TlbRefillLat and DCPhysAd on Zen4+

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] The patch uses a value-based heuristic to suppress the output of IbsDCPhysAd if it is zero, which incorrectly hides valid memory accesses to physical address 0x0.
--

commit a0f442c06429e0cbb710a06da2ee24b2a327f365
Author: Ravi Bangoria <ravi.bangoria@amd.com>

perf amd ibs: Suppress bogus TlbRefillLat and DCPhysAd on Zen4+

This commit updates the decoding of IBS MSRs on Zen4+ to add validity
checks for TlbRefillLat and DCPhysAd. It also attempts to avoid printing
zeroed physical addresses that the kernel sanitizes for unprivileged users.

> diff --git a/tools/perf/util/amd-sample-raw.c b/tools/perf/util/amd-sample-raw.c
> index b084dee76b1a7..385308c55f347 100644
> --- a/tools/perf/util/amd-sample-raw.c
> +++ b/tools/perf/util/amd-sample-raw.c

[ ... ]

> @@ -253,8 +260,12 @@ static void amd_dump_ibs_op(struct perf_sample *sample)
>  	pr_ibs_op_data3(*op_data3);
>  	if (op_data3->dc_lin_addr_valid)
>  		printf("IbsDCLinAd:\t%016llx\n", *(rip + 4));
> -	if (op_data3->dc_phy_addr_valid)
> +
> +	/* Use !zen4_ibs_extensions as a proxy for Zen3 and earlier */
> +	if (op_data3->dc_phy_addr_valid && *(rip + 5) &&
> +	    (!zen4_ibs_extensions || op_data3->dc_lin_addr_valid)) {
>  		printf("IbsDCPhysAd:\t%016llx\n", *(rip + 5));
> +	}

Does checking *(rip + 5) here suppress valid memory accesses to physical
address 0x0?

While this successfully hides kernel-zeroed addresses for unprivileged users,
it seems like it cannot distinguish between software-zeroed values and actual
0x0 addresses. Could this silently discard valid diagnostic data during
privileged profiling sessions if an actual hardware access to physical page 0
occurs?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260508060004.2575-1-ravi.bangoria@amd.com?part=4

Re: [PATCH v3 4/8] perf amd ibs: Suppress bogus TlbRefillLat and DCPhysAd on Zen4+

[Ravi Bangoria]

>> @@ -253,8 +260,12 @@ static void amd_dump_ibs_op(struct perf_sample *sample)
>>       pr_ibs_op_data3(*op_data3);
>>       if (op_data3->dc_lin_addr_valid)
>>               printf("IbsDCLinAd:\t%016llx\n", *(rip + 4));
>> -     if (op_data3->dc_phy_addr_valid)
>> +
>> +     /* Use !zen4_ibs_extensions as a proxy for Zen3 and earlier */
>> +     if (op_data3->dc_phy_addr_valid && *(rip + 5) &&
>> +         (!zen4_ibs_extensions || op_data3->dc_lin_addr_valid)) {
>>               printf("IbsDCPhysAd:\t%016llx\n", *(rip + 5));
>> +     }
> 
> Does checking *(rip + 5) here suppress valid memory accesses to physical
> address 0x0?
> 
> While this successfully hides kernel-zeroed addresses for unprivileged users,
> it seems like it cannot distinguish between software-zeroed values and actual
> 0x0 addresses. Could this silently discard valid diagnostic data during
> privileged profiling sessions if an actual hardware access to physical page 0
> occurs?

This doesn't seem like a genuine concern. The first physical page is reserved
on x86 systems, so normal workload should never access it.

  $ head -1 /proc/iomem
  00000000-00000fff : Reserved

Thanks,
Ravi

[PATCH v3 5/8] perf amd ibs: Make Fetch status bits dependent on PhyAddrValid for newer platforms

[Ravi Bangoria]

On Zen6 and future platforms, IBS_FETCH_CTL status fields are valid only
if IBS_FETCH_CTL[IbsPhyAddrValid] is set. Same for IBS_FETCH_CTL_EXT.
Add these checks while decoding IBS MSRs.

Unfortunately, there is no CPUID bit to indicate the change. Fallback
to Family/Model check.

Signed-off-by: Ravi Bangoria <ravi.bangoria@amd.com>
---
 tools/perf/util/amd-sample-raw.c | 42 ++++++++++++++++++++++++++++++--
 1 file changed, 40 insertions(+), 2 deletions(-)

diff --git a/tools/perf/util/amd-sample-raw.c b/tools/perf/util/amd-sample-raw.c
index 385308c55f34..ae005eb0363d 100644
--- a/tools/perf/util/amd-sample-raw.c
+++ b/tools/perf/util/amd-sample-raw.c
@@ -22,6 +22,29 @@ static bool zen4_ibs_extensions;
 static bool ldlat_cap;
 static bool dtlb_pgsize_cap;
 
+/*
+ * Status fields of IBS_FETCH_CTL and IBS_FETCH_CTL_EXT are valid only if
+ * IBS_FETCH_CTL[PhyAddrValid] is set.
+ */
+static int fetch_ctl_depends_on_phy_addr_valid(void)
+{
+	static int depends = -1; /* -1: Don't know, 1: Yes, 0: No */
+
+	if (depends != -1)
+		return depends;
+
+	depends = 0;
+	if (cpu_family > 0x1a ||
+	    (cpu_family == 0x1a && (
+	     (cpu_model >= 0x50 && cpu_model <= 0x5f) ||
+	     (cpu_model >= 0x80 && cpu_model <= 0xaf) ||
+	     (cpu_model >= 0xc0 && cpu_model <= 0xcf)))) {
+		depends = 1;
+	}
+
+	return depends;
+}
+
 static void pr_ibs_fetch_ctl(union ibs_fetch_ctl reg)
 {
 	const char * const ic_miss_strs[] = {
@@ -43,6 +66,18 @@ static void pr_ibs_fetch_ctl(union ibs_fetch_ctl reg)
 	const char *ic_miss_str = NULL;
 	const char *l1tlb_pgsz_str = NULL;
 	char l3_miss_str[sizeof(" L3MissOnly _ FetchOcMiss _ FetchL3Miss _")] = "";
+	char l3_miss_only_str[sizeof(" L3MissOnly _")] = "";
+
+	if (fetch_ctl_depends_on_phy_addr_valid() && !reg.phy_addr_valid) {
+		snprintf(l3_miss_only_str, sizeof(l3_miss_only_str),
+			 " L3MissOnly %d", reg.l3_miss_only);
+
+		printf("ibs_fetch_ctl:\t%016llx MaxCnt %7d Cnt %7d En %d Val %d Comp %d "
+		       "PhyAddrValid 0 RandEn %d%s\n", reg.val, reg.fetch_maxcnt << 4,
+		       reg.fetch_cnt << 4, reg.fetch_en, reg.fetch_val, reg.fetch_comp,
+		       reg.rand_en, l3_miss_only_str);
+		return;
+	}
 
 	if (cpu_family == 0x19 && cpu_model < 0x10) {
 		/*
@@ -72,8 +107,11 @@ static void pr_ibs_fetch_ctl(union ibs_fetch_ctl reg)
 		l3_miss_str);
 }
 
-static void pr_ic_ibs_extd_ctl(union ic_ibs_extd_ctl reg)
+static void pr_ic_ibs_extd_ctl(union ibs_fetch_ctl fetch_ctl, union ic_ibs_extd_ctl reg)
 {
+	if (fetch_ctl_depends_on_phy_addr_valid() && !fetch_ctl.phy_addr_valid)
+		return;
+
 	printf("ic_ibs_ext_ctl:\t%016llx IbsItlbRefillLat %3d\n", reg.val, reg.itlb_refill_lat);
 }
 
@@ -285,7 +323,7 @@ static void amd_dump_ibs_fetch(struct perf_sample *sample)
 	printf("IbsFetchLinAd:\t%016llx\n", *addr++);
 	if (fetch_ctl->phy_addr_valid)
 		printf("IbsFetchPhysAd:\t%016llx\n", *addr);
-	pr_ic_ibs_extd_ctl(*extd_ctl);
+	pr_ic_ibs_extd_ctl(*fetch_ctl, *extd_ctl);
 }
 
 /*
-- 
2.43.0

[PATCH v3 6/8] perf amd ibs: Decode Remote-Socket flag in IBS OP raw dump

[Ravi Bangoria]

IBS OP on Zen6 and future platform can mark a data source as coming from
a remote socket. When the PMU advertises this feature, interpret
IBS_OP_DATA2[9] bit as the Remote-Socket indicator and show it in the
raw dump output.

Signed-off-by: Ravi Bangoria <ravi.bangoria@amd.com>
---
 tools/perf/util/amd-sample-raw.c | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/tools/perf/util/amd-sample-raw.c b/tools/perf/util/amd-sample-raw.c
index ae005eb0363d..3e5530008b14 100644
--- a/tools/perf/util/amd-sample-raw.c
+++ b/tools/perf/util/amd-sample-raw.c
@@ -21,6 +21,7 @@ static u32 cpu_family, cpu_model, ibs_fetch_type, ibs_op_type;
 static bool zen4_ibs_extensions;
 static bool ldlat_cap;
 static bool dtlb_pgsize_cap;
+static bool rmtsocket_cap;
 
 /*
  * Status fields of IBS_FETCH_CTL and IBS_FETCH_CTL_EXT are valid only if
@@ -164,8 +165,13 @@ static void pr_ibs_op_data2_extended(union ibs_op_data2 reg)
 		/* 13 to 31 are reserved. Avoid printing them. */
 	};
 	int data_src = (reg.data_src_hi << 3) | reg.data_src_lo;
+	char rmtsocket[sizeof("RmtSocket _ ")] = "";
 
-	printf("ibs_op_data2:\t%016llx %sRmtNode %d%s\n", reg.val,
+	if (rmtsocket_cap)
+		snprintf(rmtsocket, sizeof(rmtsocket), "RmtSocket %d ", reg.rmt_socket);
+
+	printf("ibs_op_data2:\t%016llx %s%sRmtNode %d%s\n", reg.val,
+		rmtsocket,
 		(data_src == 1 || data_src == 2 || data_src == 5) ?
 			(reg.cache_hit_st ? "CacheHitSt 1=O-State " : "CacheHitSt 0=M-state ") : "",
 		reg.rmt_node,
@@ -184,8 +190,13 @@ static void pr_ibs_op_data2_default(union ibs_op_data2 reg)
 		" DataSrc 6=(reserved)",
 		" DataSrc 7=Other"
 	};
+	char rmtsocket[sizeof("RmtSocket _ ")] = "";
+
+	if (rmtsocket_cap)
+		snprintf(rmtsocket, sizeof(rmtsocket), "RmtSocket %d ", reg.rmt_socket);
 
-	printf("ibs_op_data2:\t%016llx %sRmtNode %d%s\n", reg.val,
+	printf("ibs_op_data2:\t%016llx %s%sRmtNode %d%s\n", reg.val,
+	       rmtsocket,
 	       reg.data_src_lo == 2 ? (reg.cache_hit_st ? "CacheHitSt 1=O-State "
 						     : "CacheHitSt 0=M-state ") : "",
 	       reg.rmt_node, data_src_str[reg.data_src_lo]);
@@ -429,6 +440,9 @@ bool evlist__has_amd_ibs(struct evlist *evlist)
 	if (perf_env__find_pmu_cap(env, "ibs_op", "dtlb_pgsize"))
 		dtlb_pgsize_cap = 1;
 
+	if (perf_env__find_pmu_cap(env, "ibs_op", "rmtsocket"))
+		rmtsocket_cap = 1;
+
 	if (ibs_fetch_type || ibs_op_type) {
 		if (!cpu_family)
 			parse_cpuid(env);
-- 
2.43.0

[PATCH v3 7/8] perf amd ibs: Decode Streaming-store flag in IBS OP raw dump

[Ravi Bangoria]

IBS OP on Zen6 and future platform can tag IBS samples that originate from
streaming-store instruction. When the PMU advertises this feature,
interpret IBS_OP_DATA2[8] bit as the streaming store indicator and show
it in the raw dump output.

Signed-off-by: Ravi Bangoria <ravi.bangoria@amd.com>
---
 tools/perf/util/amd-sample-raw.c | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/tools/perf/util/amd-sample-raw.c b/tools/perf/util/amd-sample-raw.c
index 3e5530008b14..394c061fbeb3 100644
--- a/tools/perf/util/amd-sample-raw.c
+++ b/tools/perf/util/amd-sample-raw.c
@@ -22,6 +22,7 @@ static bool zen4_ibs_extensions;
 static bool ldlat_cap;
 static bool dtlb_pgsize_cap;
 static bool rmtsocket_cap;
+static bool strmst_cap;
 
 /*
  * Status fields of IBS_FETCH_CTL and IBS_FETCH_CTL_EXT are valid only if
@@ -166,12 +167,15 @@ static void pr_ibs_op_data2_extended(union ibs_op_data2 reg)
 	};
 	int data_src = (reg.data_src_hi << 3) | reg.data_src_lo;
 	char rmtsocket[sizeof("RmtSocket _ ")] = "";
+	char strmst[sizeof("StrmSt _ ")] = "";
 
 	if (rmtsocket_cap)
 		snprintf(rmtsocket, sizeof(rmtsocket), "RmtSocket %d ", reg.rmt_socket);
+	if (strmst_cap)
+		snprintf(strmst, sizeof(strmst), "StrmSt %d ", reg.strm_st);
 
-	printf("ibs_op_data2:\t%016llx %s%sRmtNode %d%s\n", reg.val,
-		rmtsocket,
+	printf("ibs_op_data2:\t%016llx %s%s%sRmtNode %d%s\n", reg.val,
+		rmtsocket, strmst,
 		(data_src == 1 || data_src == 2 || data_src == 5) ?
 			(reg.cache_hit_st ? "CacheHitSt 1=O-State " : "CacheHitSt 0=M-state ") : "",
 		reg.rmt_node,
@@ -191,12 +195,15 @@ static void pr_ibs_op_data2_default(union ibs_op_data2 reg)
 		" DataSrc 7=Other"
 	};
 	char rmtsocket[sizeof("RmtSocket _ ")] = "";
+	char strmst[sizeof("StrmSt _ ")] = "";
 
 	if (rmtsocket_cap)
 		snprintf(rmtsocket, sizeof(rmtsocket), "RmtSocket %d ", reg.rmt_socket);
+	if (strmst_cap)
+		snprintf(strmst, sizeof(strmst), "StrmSt %d ", reg.strm_st);
 
-	printf("ibs_op_data2:\t%016llx %s%sRmtNode %d%s\n", reg.val,
-	       rmtsocket,
+	printf("ibs_op_data2:\t%016llx %s%s%sRmtNode %d%s\n", reg.val,
+	       rmtsocket, strmst,
 	       reg.data_src_lo == 2 ? (reg.cache_hit_st ? "CacheHitSt 1=O-State "
 						     : "CacheHitSt 0=M-state ") : "",
 	       reg.rmt_node, data_src_str[reg.data_src_lo]);
@@ -443,6 +450,9 @@ bool evlist__has_amd_ibs(struct evlist *evlist)
 	if (perf_env__find_pmu_cap(env, "ibs_op", "rmtsocket"))
 		rmtsocket_cap = 1;
 
+	if (perf_env__find_pmu_cap(env, "ibs_op", "strmst"))
+		strmst_cap = 1;
+
 	if (ibs_fetch_type || ibs_op_type) {
 		if (!cpu_family)
 			parse_cpuid(env);
-- 
2.43.0

[PATCH v3 8/8] perf doc: Document new IBS capabilities in man page

[Ravi Bangoria]

Include examples of
o Privilege filter with Fetch and Op PMUs, including swfilt approach on
  Zen5 and older platforms and hardware assisted filter on Zen6 and newer
  platforms
o Streaming store filter with Op PMU
o Fetch latency filter with Fetch PMU

Signed-off-by: Ravi Bangoria <ravi.bangoria@amd.com>
---
 tools/perf/Documentation/perf-amd-ibs.txt | 39 +++++++++++++++++++++++
 1 file changed, 39 insertions(+)

diff --git a/tools/perf/Documentation/perf-amd-ibs.txt b/tools/perf/Documentation/perf-amd-ibs.txt
index 548549935760..253a7375c88a 100644
--- a/tools/perf/Documentation/perf-amd-ibs.txt
+++ b/tools/perf/Documentation/perf-amd-ibs.txt
@@ -69,6 +69,14 @@ Per-cpu profile (cpu10), cycles event, sampling period: 100000
 
 	# perf record -e ibs_op// -c 100000 -C 10
 
+Userspace only, per-cpu profile (cpu10), cycles event, sampling period: 100000
+
+	Zen6 onward (See NOTES):
+	# perf record -e ibs_op//u -c 100000 -C 10
+
+	Until Zen5:
+	# perf record -e ibs_op/swfilt=1/u -c 100000 -C 10
+
 Per-cpu profile (cpu10), cycles event, sampling freq: 1000
 
 	# perf record -e ibs_op// -F 1000 -C 10
@@ -94,6 +102,11 @@ onward)
 	Latency value which is a multiple of 128 incurs a little less profiling
 	overhead compared to other values.
 
+System-wide profile, cycles event, sampling period: 100000, streaming store
+filter (Zen6 onward)
+
+	# perf record -e ibs_op/strmst=1/ -c 100000 -a
+
 Per process(upstream v6.2 onward), uOps event, sampling period: 100000
 
 	# perf record -e ibs_op/cnt_ctl=1/ -c 100000 -p 1234
@@ -150,6 +163,14 @@ System-wide profile, fetch ops event, sampling period: 100000
 
 	# perf record -e ibs_fetch// -c 100000 -a
 
+Userspace only, system-wide profile, fetch ops event, sampling period: 100000
+
+	Zen6 onward (See NOTES):
+	# perf record -e ibs_fetch//u -c 100000 -a
+
+	Until Zen5:
+	# perf record -e ibs_fetch/swfilt=1/u -c 100000 -a
+
 System-wide profile, fetch ops event, sampling period: 100000, Random enable
 
 	# perf record -e ibs_fetch/rand_en=1/ -c 100000 -a
@@ -158,6 +179,15 @@ System-wide profile, fetch ops event, sampling period: 100000, Random enable
 	helps in cases like long running loops where PMU is tagging the same
 	instruction over and over because of fixed sample period.
 
+System-wide profile, fetch ops event, sampling period: 10000, fetch latency
+filter (Zen6 onward)
+
+	# perf record -e ibs_fetch/fetchlat=128/ -c 10000 -a
+
+	Supported fetch latency threshold values are 128 to 1920 (both inclusive).
+	Latency value which is a multiple of 128 incurs a little less profiling
+	overhead compared to other values.
+
 etc.
 
 PERF MEM AND PERF C2C
@@ -216,6 +246,15 @@ sort keys.  For example:
 
 Please refer to their man page for more detail.
 
+NOTES
+-----
+Hardware privilege filtering uses bit 63 to distinguish between kernel
+and userspace addresses. Hardware privilege filtering is not supported
+on 32-bit systems. Also, the bit 63 convention is not universal and can
+fail in specific environments, such as, using 64-bit host IBS to profile
+a 32-bit guest, using 64-bit host IBS to profile non-Linux 64-bit guests
+that do not adhere to the bit 63 privilege standard etc.
+
 SEE ALSO
 --------
 
-- 
2.43.0

Re: [PATCH v3 0/8] perf tools amd ibs: Fixes + Zen6 enhancements

[Namhyung Kim]

Hello,

On Fri, May 08, 2026 at 05:59:56AM +0000, Ravi Bangoria wrote:
> o Fix kernel version check in perf IBS unit test.
> o On Zen6 and newer platforms, skip perf unit test that assumes IBS don't
>   have hardware-assisted privilege filter.
> o Starting with Zen4, the validity of several IBS fields changes. Add
>   the required dependency checks when decoding IBS MSRs.
> o Zen6 and future platforms extends IBS OP with Streaming-Store and
>   Remote-Socket indicators for load/store instructions. Add decoding
>   support for these new bits.
> o Document new IBS features in perf-amd-ibs man page 
> 
> IBS Zen6 enhancements doc:
>   AMD64 Zen6 Instruction Based Sampling (IBS) Extensions and Features,
>   Pub. 69205 Rev. 1.00 March 2026 
>   https://bugzilla.kernel.org/attachment.cgi?id=310002
> 
> Patches are prepared on perf-tools-next/perf-tools-next (53bc03289278).
> 
> v2: https://lore.kernel.org/r/20260430061115.10266-1-ravi.bangoria@amd.com  
> v2->v3:
>  - Instead of removing the priv modifier unit test completely, skip
>    it on platforms that supports hardware privilege filtering. (Namhyung)
>  - Rebased the series on latest perf-tools-next/perf-tools-next.
> 
> Ravi Bangoria (8):
>   perf test amd ibs: Fix incorrect kernel version check
>   perf tool ibs: Sync AMD IBS header file
>   perf test ibs: Skip privilege test on Zen6 and newer platforms
>   perf amd ibs: Suppress bogus TlbRefillLat and DCPhysAd on Zen4+
>   perf amd ibs: Make Fetch status bits dependent on PhyAddrValid for
>     newer platforms
>   perf amd ibs: Decode Remote-Socket flag in IBS OP raw dump
>   perf amd ibs: Decode Streaming-store flag in IBS OP raw dump
>   perf doc: Document new IBS capabilities in man page

Acked-by: Namhyung Kim <namhyung@kernel.org>

Thanks,
Namhyung

> 
>  tools/arch/x86/include/asm/amd/ibs.h       |  4 +-
>  tools/perf/Documentation/perf-amd-ibs.txt  | 39 ++++++++++
>  tools/perf/arch/x86/tests/amd-ibs-period.c |  2 +-
>  tools/perf/tests/shell/amd-ibs-swfilt.sh   | 37 ++++++++-
>  tools/perf/util/amd-sample-raw.c           | 87 ++++++++++++++++++++--
>  5 files changed, 156 insertions(+), 13 deletions(-)
> 
> -- 
> 2.43.0
>