Re: [RFC PATCH 3/3] perf/riscv: Use Sspesa for precise sample attribution

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] Logical counter index is incorrectly compared against the physical hardware counter ID when SBI PMU snapshots are used.
- [Medium] Overriding `data.ip` without adjusting the privilege mode in `regs` causes misattribution of precise samples.
--

--- Patch [3]: [RFC PATCH 3/3] perf/riscv: Use Sspesa for precise sample attribution ---
commit b7b8e4e381234c44a7ea95a7ce26fb9dadf28f3a
Author: Mayuresh Chitale <mayuresh.chitale@oss.qualcomm.com>
Date:   Mon Aug 17 16:02:19 2026 +0000

perf/riscv: Use Sspesa for precise sample attribution

This commit adds support for the Sspesa extension to provide precise event
sample attribution on RISC-V. It uses the shpmspc and shpmsdata registers
to report accurate instruction pointers and raw sample data on counter
overflow.

> diff --git a/drivers/perf/riscv_pmu_sbi.c b/drivers/perf/riscv_pmu_sbi.c
> index dfc886dee5ad0..1b0b1cc612def 100644
> --- a/drivers/perf/riscv_pmu_sbi.c
> +++ b/drivers/perf/riscv_pmu_sbi.c

[ ... ]

> @@ -1123,6 +1140,15 @@ static irqreturn_t pmu_sbi_ovf_handler(int irq, void *dev)
>  		riscv_pmu_event_update(event);
>  		hw_evt->state |= PERF_HES_UPTODATE;
>  		perf_sample_data_init(&data, 0, hw_evt->last_period);
> +		if (sspesa_available && hidx == sample_cntrid) {

[Severity: High]
Earlier in pmu_sbi_ovf_handler(), hidx can be assigned the logical index:

    if (sbi_pmu_snapshot_available())
        hidx = lidx;

Since sample_cntrid represents a physical hardware index read from
CSR_SHPMSDATA, does comparing the logical hidx against the physical
sample_cntrid cause precise samples to be dropped or incorrectly attributed
when SBI PMU snapshots are enabled?

> +			data.ip = sample_pc;
> +			data.sample_flags |= PERF_SAMPLE_IP;
> +
> +			raw_sample = sample_data;
> +			raw.frag.size = sizeof(raw_sample);
> +			raw.frag.data = &raw_sample;
> +			perf_sample_save_raw_data(&data, event, &raw);
> +		}

[Severity: Medium]
When overriding data.ip with the precise PC (sample_pc), could we run into
privilege mode mismatches?

If an overflow occurs in user space but the interrupt skids into kernel space,
data.ip gets the precise user-space PC, but regs still reflects the skidded
kernel state.

Since perf_event_overflow() is called shortly after this block and relies on
perf_misc_flags(regs) to determine the privilege level, will this cause
userspace tools to attempt resolving user-space addresses against the kernel
symbol map?

>  		if (riscv_pmu_event_set_period(event)) {
>  			/*
>  			 * Unlike other ISAs, RISC-V don't have to disable interrupts

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260817160222.3313295-1-mayuresh.chitale@oss.qualcomm.com?part=3