Re: [PATCH 1/2] perf cs-etm: Avoid bogus branch samples before async exceptions

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Restricting the `last_instr_taken_branch` fixup strictly to SVC instructions silently drops valid branch samples for all other exceptions, including asynchronous interrupts and other synchronous exceptions (SMC, HVC, aborts, breakpoints), breaking the control flow graph from user/kernel space into the exception handlers.
--

--- Patch [1]: [PATCH 1/2] perf cs-etm: Avoid bogus branch samples before async exceptions ---
commit d678304a350e693f048123702c01ddab5fbae8a5
Author: Leo Yan <leo.yan@arm.com>

perf cs-etm: Avoid bogus branch samples before async exceptions

This commit updates the CoreSight ETM decoder to avoid synthesizing bogus
branch samples before asynchronous exceptions. It does this by restricting
the fixup that forces the taken branch flag to true so that it only applies
to SVC (system call) exception entries.

> diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c
> index 95e3ec1171acc..05e698f666bbe 100644
> --- a/tools/perf/util/cs-etm.c
> +++ b/tools/perf/util/cs-etm.c
> @@ -1999,17 +1999,20 @@ static int cs_etm__context(struct cs_etm_queue *etmq,
>  static int cs_etm__exception(struct cs_etm_traceid_queue *tidq)
>  {
>  	/*
[ ... ]
>  	 */
> -	if (tidq->prev_packet->sample_type == CS_ETM_RANGE)
> +	if (tidq->prev_packet->sample_type == CS_ETM_RANGE &&
> +	    tidq->prev_packet->flags == (PERF_IP_FLAG_BRANCH |
> +					 PERF_IP_FLAG_CALL |
> +					 PERF_IP_FLAG_SYSCALLRET))
>  		tidq->prev_packet->last_instr_taken_branch = true;

[Severity: High]
Does this exact flag match inadvertently drop valid branch samples for other
synchronous exceptions like SMC, HVC, or data aborts?

These other exceptions use PERF_IP_FLAG_INTERRUPT and won't match the strict
mask introduced here. When tracing into hypervisors, secure monitors, or
exception handlers, the last_instr_taken_branch flag will remain false, which
prevents cs_etm__synth_branch_sample() from being called for the exception
entry.

Could this break the control flow graph for these traps by omitting their
entry branch samples?

>  
>  	return 0;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260713-perf_cs_etm_fix_non_taken-v1-0-4561607fc69f@arm.com?part=1