[RFC PATCH 0/3] RISC-V Sspesa: Linux perf precise sample attribution

[RFC PATCH 0/3] RISC-V Sspesa: Linux perf precise sample attribution

[Mayuresh Chitale]

This Linux series adds kernel support for the RISC-V Performance Event
Sampling extensions Sspesa (Precise Event Sample Attribution) and
Ssplcofi (Precise Local Counter Overflow Interrupt).

The first two patches add the DT binding and ISA-extension detection
(Ssplcofi depends on Sspesa). The third patch uses shpmspc to report the
sample PC via PERF_SAMPLE_IP in the SBI PMU overflow handler, and
exports shpmsdata as PERF_SAMPLE_RAW.

Reproducing the full setup:

Sspesa support requires three projects: OpenSBI, Linux and QEMU. The
matching branches are:

  OpenSBI: https://github.com/mdchitale/opensbi/tree/riscv_sspesa_rfc_v1
  Linux:   https://github.com/mdchitale/linux/tree/riscv_sspesa_rfc_v1
  QEMU:    https://github.com/mdchitale/qemu/tree/riscv_sspesa_rfc_v1

To test Sspesa, build OpenSBI, Linux and QEMU from the branches above,
then boot Linux with:

  qemu-system-riscv64 -nographic -machine virt -smp 2 -m 2G \
    -cpu rv64,sscofpmf=on,sspesa=on \
    -bios /path/to/fw_dynamic.bin -kernel /path/to/Image \
    -drive file=/path/to/rootfs.img,id=hd0,format=raw,if=none \
    -device virtio-blk-device,drive=hd0 \
    -append "root=/dev/vda rw console=ttyS0 earlycon=sbi"

With all three in place, a counter overflow (e.g. 'perf record -e
cycles -c 1000000 -- <workload>') is attributed using the
hardware-provided sample PC (shpmspc) and counter ID (shpmsdata)
instead of falling back to epc.

Mayuresh Chitale (3):
  dt-bindings: riscv: Add Sspesa and Ssplcofi extensions
  riscv: Add detection for Sspesa and Ssplcofi extensions
  perf/riscv: Use Sspesa for precise sample attribution

 .../devicetree/bindings/riscv/extensions.yaml | 19 ++++++++++++
 arch/riscv/include/asm/csr.h                  |  7 +++++
 arch/riscv/include/asm/hwcap.h                |  2 ++
 arch/riscv/kernel/cpufeature.c                | 12 ++++++++
 drivers/perf/riscv_pmu_sbi.c                  | 29 +++++++++++++++++++
 5 files changed, 69 insertions(+)

-- 
2.43.0

[RFC PATCH 3/3] perf/riscv: Use Sspesa for precise sample attribution

[Mayuresh Chitale]

When the Sspesa (Precise Event Sample Attribution) extension is
available and a counter overflows, the hardware records a sample PC in
shpmspc register and the counter ID and additional implementation-defined
data in shpmsdata register.

In the SBI PMU overflow handler, use shpmspc to report sample PC via
PERF_SAMPLE_IP for the counter that caused the overflow. Shpmsdata is
exported as raw data to userspace when events request PERF_SAMPLE_RAW
sample type and it assists in deriving the sample PC from shpmspc if
precise attribution is not supported for the event.

If sspesa is not available or for counters that don't match
shpmsdata.CNTRID, fallback to epc for PERF_SAMPLE_IP.

Signed-off-by: Mayuresh Chitale <mayuresh.chitale@oss.qualcomm.com>
---
 drivers/perf/riscv_pmu_sbi.c | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/drivers/perf/riscv_pmu_sbi.c b/drivers/perf/riscv_pmu_sbi.c
index dfc886dee5ad..1b0b1cc612de 100644
--- a/drivers/perf/riscv_pmu_sbi.c
+++ b/drivers/perf/riscv_pmu_sbi.c
@@ -63,6 +63,8 @@ PMU_FORMAT_ATTR(firmware, "config:62-63");
 
 static bool sbi_v2_available;
 static bool sbi_v3_available;
+static bool sspesa_available;
+
 static DEFINE_STATIC_KEY_FALSE(sbi_pmu_snapshot_available);
 #define sbi_pmu_snapshot_available() \
 	static_branch_unlikely(&sbi_pmu_snapshot_available)
@@ -1051,6 +1053,11 @@ static irqreturn_t pmu_sbi_ovf_handler(int irq, void *dev)
 	struct cpu_hw_events *cpu_hw_evt = dev;
 	u64 start_clock = sched_clock();
 	struct riscv_pmu_snapshot_data *sdata = cpu_hw_evt->snapshot_addr;
+	unsigned long sample_pc = 0;
+	unsigned long sample_data = 0;
+	int sample_cntrid = -1;
+	u64 raw_sample;
+	struct perf_raw_record raw = { 0 };
 
 	if (WARN_ON_ONCE(!cpu_hw_evt))
 		return IRQ_NONE;
@@ -1088,6 +1095,16 @@ static irqreturn_t pmu_sbi_ovf_handler(int irq, void *dev)
 		return IRQ_NONE;
 
 	regs = get_irq_regs();
+	/*
+	 * Sspesa records the PC and metadata of the overflowing counter in
+	 * hardware. The PC is precise only for events that support precise
+	 * attribution; otherwise it is best-effort.
+	 */
+	if (sspesa_available) {
+		sample_pc = csr_read(CSR_SHPMSPC);
+		sample_data = csr_read(CSR_SHPMSDATA);
+		sample_cntrid = sample_data & SHPMSDATA_CNTRID;
+	}
 
 	for_each_set_bit(lidx, cpu_hw_evt->used_hw_ctrs, RISCV_MAX_COUNTERS) {
 		struct perf_event *event = cpu_hw_evt->events[lidx];
@@ -1123,6 +1140,15 @@ static irqreturn_t pmu_sbi_ovf_handler(int irq, void *dev)
 		riscv_pmu_event_update(event);
 		hw_evt->state |= PERF_HES_UPTODATE;
 		perf_sample_data_init(&data, 0, hw_evt->last_period);
+		if (sspesa_available && hidx == sample_cntrid) {
+			data.ip = sample_pc;
+			data.sample_flags |= PERF_SAMPLE_IP;
+
+			raw_sample = sample_data;
+			raw.frag.size = sizeof(raw_sample);
+			raw.frag.data = &raw_sample;
+			perf_sample_save_raw_data(&data, event, &raw);
+		}
 		if (riscv_pmu_event_set_period(event)) {
 			/*
 			 * Unlike other ISAs, RISC-V don't have to disable interrupts
@@ -1194,6 +1220,9 @@ static int pmu_sbi_setup_irqs(struct riscv_pmu *pmu, struct platform_device *pde
 	struct cpu_hw_events __percpu *hw_events = pmu->hw_events;
 	struct irq_domain *domain = NULL;
 
+	if (riscv_isa_extension_available(NULL, SSPESA))
+		sspesa_available = true;
+
 	if (riscv_isa_extension_available(NULL, SSCOFPMF)) {
 		riscv_pmu_irq_num = RV_IRQ_PMU;
 		riscv_pmu_use_irq = true;
-- 
2.43.0

Re: [RFC PATCH 3/3] perf/riscv: Use Sspesa for precise sample attribution

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] Logical counter index is incorrectly compared against the physical hardware counter ID when SBI PMU snapshots are used.
- [Medium] Overriding `data.ip` without adjusting the privilege mode in `regs` causes misattribution of precise samples.
--

--- Patch [3]: [RFC PATCH 3/3] perf/riscv: Use Sspesa for precise sample attribution ---
commit b7b8e4e381234c44a7ea95a7ce26fb9dadf28f3a
Author: Mayuresh Chitale <mayuresh.chitale@oss.qualcomm.com>
Date:   Mon Aug 17 16:02:19 2026 +0000

perf/riscv: Use Sspesa for precise sample attribution

This commit adds support for the Sspesa extension to provide precise event
sample attribution on RISC-V. It uses the shpmspc and shpmsdata registers
to report accurate instruction pointers and raw sample data on counter
overflow.

> diff --git a/drivers/perf/riscv_pmu_sbi.c b/drivers/perf/riscv_pmu_sbi.c
> index dfc886dee5ad0..1b0b1cc612def 100644
> --- a/drivers/perf/riscv_pmu_sbi.c
> +++ b/drivers/perf/riscv_pmu_sbi.c

[ ... ]

> @@ -1123,6 +1140,15 @@ static irqreturn_t pmu_sbi_ovf_handler(int irq, void *dev)
>  		riscv_pmu_event_update(event);
>  		hw_evt->state |= PERF_HES_UPTODATE;
>  		perf_sample_data_init(&data, 0, hw_evt->last_period);
> +		if (sspesa_available && hidx == sample_cntrid) {

[Severity: High]
Earlier in pmu_sbi_ovf_handler(), hidx can be assigned the logical index:

    if (sbi_pmu_snapshot_available())
        hidx = lidx;

Since sample_cntrid represents a physical hardware index read from
CSR_SHPMSDATA, does comparing the logical hidx against the physical
sample_cntrid cause precise samples to be dropped or incorrectly attributed
when SBI PMU snapshots are enabled?

> +			data.ip = sample_pc;
> +			data.sample_flags |= PERF_SAMPLE_IP;
> +
> +			raw_sample = sample_data;
> +			raw.frag.size = sizeof(raw_sample);
> +			raw.frag.data = &raw_sample;
> +			perf_sample_save_raw_data(&data, event, &raw);
> +		}

[Severity: Medium]
When overriding data.ip with the precise PC (sample_pc), could we run into
privilege mode mismatches?

If an overflow occurs in user space but the interrupt skids into kernel space,
data.ip gets the precise user-space PC, but regs still reflects the skidded
kernel state.

Since perf_event_overflow() is called shortly after this block and relies on
perf_misc_flags(regs) to determine the privilege level, will this cause
userspace tools to attempt resolving user-space addresses against the kernel
symbol map?

>  		if (riscv_pmu_event_set_period(event)) {
>  			/*
>  			 * Unlike other ISAs, RISC-V don't have to disable interrupts

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260817160222.3313295-1-mayuresh.chitale@oss.qualcomm.com?part=3

Re: [RFC PATCH 3/3] perf/riscv: Use Sspesa for precise sample attribution

[Sandipan Das]

On 17-08-2026 21:32, Mayuresh Chitale wrote:
> When the Sspesa (Precise Event Sample Attribution) extension is
> available and a counter overflows, the hardware records a sample PC in
> shpmspc register and the counter ID and additional implementation-defined
> data in shpmsdata register.
> 
> In the SBI PMU overflow handler, use shpmspc to report sample PC via
> PERF_SAMPLE_IP for the counter that caused the overflow. Shpmsdata is
> exported as raw data to userspace when events request PERF_SAMPLE_RAW
> sample type and it assists in deriving the sample PC from shpmspc if
> precise attribution is not supported for the event.
> 
> If sspesa is not available or for counters that don't match
> shpmsdata.CNTRID, fallback to epc for PERF_SAMPLE_IP.
> 
> Signed-off-by: Mayuresh Chitale <mayuresh.chitale@oss.qualcomm.com>
> ---
>  drivers/perf/riscv_pmu_sbi.c | 29 +++++++++++++++++++++++++++++
>  1 file changed, 29 insertions(+)
> 
> diff --git a/drivers/perf/riscv_pmu_sbi.c b/drivers/perf/riscv_pmu_sbi.c
> index dfc886dee5ad..1b0b1cc612de 100644
> --- a/drivers/perf/riscv_pmu_sbi.c
> +++ b/drivers/perf/riscv_pmu_sbi.c
> @@ -63,6 +63,8 @@ PMU_FORMAT_ATTR(firmware, "config:62-63");
>  
>  static bool sbi_v2_available;
>  static bool sbi_v3_available;
> +static bool sspesa_available;
> +
>  static DEFINE_STATIC_KEY_FALSE(sbi_pmu_snapshot_available);
>  #define sbi_pmu_snapshot_available() \
>  	static_branch_unlikely(&sbi_pmu_snapshot_available)
> @@ -1051,6 +1053,11 @@ static irqreturn_t pmu_sbi_ovf_handler(int irq, void *dev)
>  	struct cpu_hw_events *cpu_hw_evt = dev;
>  	u64 start_clock = sched_clock();
>  	struct riscv_pmu_snapshot_data *sdata = cpu_hw_evt->snapshot_addr;
> +	unsigned long sample_pc = 0;
> +	unsigned long sample_data = 0;
> +	int sample_cntrid = -1;
> +	u64 raw_sample;
> +	struct perf_raw_record raw = { 0 };
>  
>  	if (WARN_ON_ONCE(!cpu_hw_evt))
>  		return IRQ_NONE;
> @@ -1088,6 +1095,16 @@ static irqreturn_t pmu_sbi_ovf_handler(int irq, void *dev)
>  		return IRQ_NONE;
>  
>  	regs = get_irq_regs();
> +	/*
> +	 * Sspesa records the PC and metadata of the overflowing counter in
> +	 * hardware. The PC is precise only for events that support precise
> +	 * attribution; otherwise it is best-effort.
> +	 */
> +	if (sspesa_available) {
> +		sample_pc = csr_read(CSR_SHPMSPC);
> +		sample_data = csr_read(CSR_SHPMSDATA);
> +		sample_cntrid = sample_data & SHPMSDATA_CNTRID;
> +	}
>  
>  	for_each_set_bit(lidx, cpu_hw_evt->used_hw_ctrs, RISCV_MAX_COUNTERS) {
>  		struct perf_event *event = cpu_hw_evt->events[lidx];
> @@ -1123,6 +1140,15 @@ static irqreturn_t pmu_sbi_ovf_handler(int irq, void *dev)
>  		riscv_pmu_event_update(event);
>  		hw_evt->state |= PERF_HES_UPTODATE;
>  		perf_sample_data_init(&data, 0, hw_evt->last_period);
> +		if (sspesa_available && hidx == sample_cntrid) {
> +			data.ip = sample_pc;

Does this need to be tied to event->attr.precise_ip?

> +			data.sample_flags |= PERF_SAMPLE_IP;
> +
> +			raw_sample = sample_data;
> +			raw.frag.size = sizeof(raw_sample);
> +			raw.frag.data = &raw_sample;
> +			perf_sample_save_raw_data(&data, event, &raw);
> +		}
>  		if (riscv_pmu_event_set_period(event)) {
>  			/*
>  			 * Unlike other ISAs, RISC-V don't have to disable interrupts
> @@ -1194,6 +1220,9 @@ static int pmu_sbi_setup_irqs(struct riscv_pmu *pmu, struct platform_device *pde
>  	struct cpu_hw_events __percpu *hw_events = pmu->hw_events;
>  	struct irq_domain *domain = NULL;
>  
> +	if (riscv_isa_extension_available(NULL, SSPESA))
> +		sspesa_available = true;
> +
>  	if (riscv_isa_extension_available(NULL, SSCOFPMF)) {
>  		riscv_pmu_irq_num = RV_IRQ_PMU;
>  		riscv_pmu_use_irq = true;