Re: [PATCH v9 5/9] perf cs-etm: Use thread-stack for last branch entries

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Cross-CPU state corruption when flushing shared thread stacks on local trace discontinuity
--

commit abf6f97a0108ff607c740e49b61365089d433985
Author: Leo Yan <leo.yan@arm.com>

perf cs-etm: Use thread-stack for last branch entries

CS ETM maintains its own circular array for last branch entries, with
local helpers to update, copy and reset the branch stack. This
duplicates logic already provided by the common code.

> diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c
> index 6827ef8871a8f..51b05a0bc1898 100644
> --- a/tools/perf/util/cs-etm.c
> +++ b/tools/perf/util/cs-etm.c
[ ... ]
> @@ -2025,7 +1965,7 @@ static int cs_etm__flush(struct cs_etm_queue *etmq,
>  
>  	/* Reset last branches after flush the trace */
>  	if (etm->synth_opts.last_branch)
> -		cs_etm__reset_last_branch_rb(tidq);
> +		thread_stack__flush(tidq->frontend_thread);

[Severity: High]
Can this cause cross-CPU state corruption when flushing shared thread stacks?

When cs_etm__flush() is called due to a local trace discontinuity or the end of
a block on a specific trace queue (CPU), it calls thread_stack__flush() on
the frontend_thread.

If the traced thread is shared across multiple CPUs (such as the global idle
thread pid == 0), thread_stack__flush() will iterate over ts->arr_sz and
reset the branch stacks for all CPUs associated with that thread:

tools/perf/util/thread-stack.c:thread_stack__flush() {
	...
	for (pos = 0; pos < ts->arr_sz; pos++) {
		int ret = __thread_stack__flush(thread, ts + pos);
	...
}

This replaces the previously safe localized reset for the trace queue with a
global flush. Could a localized discontinuity on CPU A silently wipe out the
active branch stack and callchain history of the shared thread executing
concurrently on CPU B?

>  
>  	return err;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260616-b4-arm_cs_callchain_support_v1-v9-0-f8fad931c413@arm.com?part=5