[PATCH 1/8] perf/x86/intel: Remove anythread_deprecated bit from perf_capabilities

[PATCH 1/8] perf/x86/intel: Remove anythread_deprecated bit from perf_capabilities

[Dapeng Mi]

AnyThread mode deprecation is enumerated by CPUID.0AH:EDX[15] instead of
PERF_CAPABILITIES MSR. It's not a good practice to define a bit to
represent "anythread deprecation" in perf_capabilities. It leads to the
anythread_deprecated bit could be overwritten by the real value of
PERF_CAPABILITIES MSR, just like the below code in update_pmu_cap() does.

```
if (!intel_pmu_broken_perf_cap()) {
	/* Perf Metric (Bit 15) and PEBS via PT (Bit 16) are hybrid enumeration */
	rdmsrq(MSR_IA32_PERF_CAPABILITIES, hybrid(pmu, intel_cap).capabilities);
}
```

It leads to the anythread_deprecated bit is cleared to 0 and the "any"
attribute is incorrectly shown in the /sys/devices/cpu/format/ folder on
these support Perfmon v6 platforms, like Clearwater Forest.

```
$grep . /sys/devices/cpu/format/*
/sys/devices/cpu/format/acr_mask:config2:0-63
/sys/devices/cpu/format/any:config:21
/sys/devices/cpu/format/cmask:config:24-31
```

So remove the anythread_deprecated bit from perf_capabilities structure
and directly depends on CPUID.0AH:EDX[15] to judge if anythread is
deprecated.

Cc: stable@vger.kernel.org
Reported-by: Namhyung Kim <namhyung@kernel.org>
Fixes: cadbaa039b99 ("perf/x86/intel: Make anythread filter support conditional")
Acked-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Reviewed-by: Zide Chen <zide.chen@intel.com>
---

Original patch link:
https://lore.kernel.org/all/20260423053306.3033331-1-dapeng1.mi@linux.intel.com/

 arch/x86/events/intel/core.c | 10 +++-------
 arch/x86/events/perf_event.h |  2 +-
 2 files changed, 4 insertions(+), 8 deletions(-)

diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index 0217e701aeeb..ea3ab3050a3b 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -7946,12 +7946,6 @@ __init int intel_pmu_init(void)
 
 	x86_add_quirk(intel_arch_events_quirk); /* Install first, so it runs last */
 
-	if (version >= 5) {
-		x86_pmu.intel_cap.anythread_deprecated = edx.split.anythread_deprecated;
-		if (x86_pmu.intel_cap.anythread_deprecated)
-			pr_cont(" AnyThread deprecated, ");
-	}
-
 	/* The perf side of core PMU is ready to support the mediated vPMU. */
 	x86_get_pmu(smp_processor_id())->capabilities |= PERF_PMU_CAP_MEDIATED_VPMU;
 
@@ -8828,8 +8822,10 @@ __init int intel_pmu_init(void)
 				      &x86_pmu.intel_ctrl);
 
 	/* AnyThread may be deprecated on arch perfmon v5 or later */
-	if (x86_pmu.intel_cap.anythread_deprecated)
+	if (version >= 5 && edx.split.anythread_deprecated) {
 		x86_pmu.format_attrs = intel_arch_formats_attr;
+		pr_cont("AnyThread deprecated, ");
+	}
 
 	intel_pmu_check_event_constraints_all(NULL);
 
diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h
index eae24bb35dc1..5902a297daa1 100644
--- a/arch/x86/events/perf_event.h
+++ b/arch/x86/events/perf_event.h
@@ -668,7 +668,7 @@ union perf_capabilities {
 		u64	perf_metrics:1;
 		u64	pebs_output_pt_available:1;
 		u64	pebs_timing_info:1;
-		u64	anythread_deprecated:1;
+		u64	__reserved:1;
 		u64	rdpmc_metrics_clear:1;
 	};
 	u64	capabilities;
-- 
2.34.1

Re: [PATCH 1/8] perf/x86/intel: Remove anythread_deprecated bit from perf_capabilities

[Falcon, Thomas]

On Fri, 2026-06-05 at 09:11 +0800, Dapeng Mi wrote:
> AnyThread mode deprecation is enumerated by CPUID.0AH:EDX[15] instead
> of
> PERF_CAPABILITIES MSR. It's not a good practice to define a bit to
> represent "anythread deprecation" in perf_capabilities. It leads to
> the
> anythread_deprecated bit could be overwritten by the real value of
> PERF_CAPABILITIES MSR, just like the below code in update_pmu_cap()
> does.
> 
> ```
> if (!intel_pmu_broken_perf_cap()) {
> 	/* Perf Metric (Bit 15) and PEBS via PT (Bit 16) are hybrid
> enumeration */
> 	rdmsrq(MSR_IA32_PERF_CAPABILITIES, hybrid(pmu,
> intel_cap).capabilities);
> }
> ```
> 
> It leads to the anythread_deprecated bit is cleared to 0 and the
> "any"
> attribute is incorrectly shown in the /sys/devices/cpu/format/ folder
> on
> these support Perfmon v6 platforms, like Clearwater Forest.
> 
> ```
> $grep . /sys/devices/cpu/format/*
> /sys/devices/cpu/format/acr_mask:config2:0-63
> /sys/devices/cpu/format/any:config:21
> /sys/devices/cpu/format/cmask:config:24-31
> ```
> 
> So remove the anythread_deprecated bit from perf_capabilities
> structure
> and directly depends on CPUID.0AH:EDX[15] to judge if anythread is
> deprecated.
> 
> Cc: stable@vger.kernel.org
> Reported-by: Namhyung Kim <namhyung@kernel.org>
> Fixes: cadbaa039b99 ("perf/x86/intel: Make anythread filter support
> conditional")
> Acked-by: Namhyung Kim <namhyung@kernel.org>
> Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
> Reviewed-by: Zide Chen <zide.chen@intel.com>
> ---
> 
> Original patch link:
> https://lore.kernel.org/all/20260423053306.3033331-1-dapeng1.mi@linux.intel.com/
> 
>  arch/x86/events/intel/core.c | 10 +++-------
>  arch/x86/events/perf_event.h |  2 +-
>  2 files changed, 4 insertions(+), 8 deletions(-)
> 
> diff --git a/arch/x86/events/intel/core.c
> b/arch/x86/events/intel/core.c
> index 0217e701aeeb..ea3ab3050a3b 100644
> --- a/arch/x86/events/intel/core.c
> +++ b/arch/x86/events/intel/core.c
> @@ -7946,12 +7946,6 @@ __init int intel_pmu_init(void)
>  
>  	x86_add_quirk(intel_arch_events_quirk); /* Install first, so
> it runs last */
>  
> -	if (version >= 5) {
> -		x86_pmu.intel_cap.anythread_deprecated =
> edx.split.anythread_deprecated;
> -		if (x86_pmu.intel_cap.anythread_deprecated)
> -			pr_cont(" AnyThread deprecated, ");
> -	}
> -
>  	/* The perf side of core PMU is ready to support the
> mediated vPMU. */
>  	x86_get_pmu(smp_processor_id())->capabilities |=
> PERF_PMU_CAP_MEDIATED_VPMU;
>  
> @@ -8828,8 +8822,10 @@ __init int intel_pmu_init(void)
>  				      &x86_pmu.intel_ctrl);
>  
>  	/* AnyThread may be deprecated on arch perfmon v5 or later
> */
> -	if (x86_pmu.intel_cap.anythread_deprecated)
> +	if (version >= 5 && edx.split.anythread_deprecated) {
>  		x86_pmu.format_attrs = intel_arch_formats_attr;
> +		pr_cont("AnyThread deprecated, ");

Is there a reason the leading space is missing here? Other than that,
LGTM.

Reviewed-by: Thomas Falcon <thomas.falcon@intel.com>

> +	}
>  
>  	intel_pmu_check_event_constraints_all(NULL);
>  
> diff --git a/arch/x86/events/perf_event.h
> b/arch/x86/events/perf_event.h
> index eae24bb35dc1..5902a297daa1 100644
> --- a/arch/x86/events/perf_event.h
> +++ b/arch/x86/events/perf_event.h
> @@ -668,7 +668,7 @@ union perf_capabilities {
>  		u64	perf_metrics:1;
>  		u64	pebs_output_pt_available:1;
>  		u64	pebs_timing_info:1;
> -		u64	anythread_deprecated:1;
> +		u64	__reserved:1;
>  		u64	rdpmc_metrics_clear:1;
>  	};
>  	u64	capabilities;

Re: [PATCH 1/8] perf/x86/intel: Remove anythread_deprecated bit from perf_capabilities

[Mi, Dapeng]

On 6/6/2026 1:04 AM, Falcon, Thomas wrote:
> On Fri, 2026-06-05 at 09:11 +0800, Dapeng Mi wrote:
>> AnyThread mode deprecation is enumerated by CPUID.0AH:EDX[15] instead
>> of
>> PERF_CAPABILITIES MSR. It's not a good practice to define a bit to
>> represent "anythread deprecation" in perf_capabilities. It leads to
>> the
>> anythread_deprecated bit could be overwritten by the real value of
>> PERF_CAPABILITIES MSR, just like the below code in update_pmu_cap()
>> does.
>>
>> ```
>> if (!intel_pmu_broken_perf_cap()) {
>> 	/* Perf Metric (Bit 15) and PEBS via PT (Bit 16) are hybrid
>> enumeration */
>> 	rdmsrq(MSR_IA32_PERF_CAPABILITIES, hybrid(pmu,
>> intel_cap).capabilities);
>> }
>> ```
>>
>> It leads to the anythread_deprecated bit is cleared to 0 and the
>> "any"
>> attribute is incorrectly shown in the /sys/devices/cpu/format/ folder
>> on
>> these support Perfmon v6 platforms, like Clearwater Forest.
>>
>> ```
>> $grep . /sys/devices/cpu/format/*
>> /sys/devices/cpu/format/acr_mask:config2:0-63
>> /sys/devices/cpu/format/any:config:21
>> /sys/devices/cpu/format/cmask:config:24-31
>> ```
>>
>> So remove the anythread_deprecated bit from perf_capabilities
>> structure
>> and directly depends on CPUID.0AH:EDX[15] to judge if anythread is
>> deprecated.
>>
>> Cc: stable@vger.kernel.org
>> Reported-by: Namhyung Kim <namhyung@kernel.org>
>> Fixes: cadbaa039b99 ("perf/x86/intel: Make anythread filter support
>> conditional")
>> Acked-by: Namhyung Kim <namhyung@kernel.org>
>> Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
>> Reviewed-by: Zide Chen <zide.chen@intel.com>
>> ---
>>
>> Original patch link:
>> https://lore.kernel.org/all/20260423053306.3033331-1-dapeng1.mi@linux.intel.com/
>>
>>  arch/x86/events/intel/core.c | 10 +++-------
>>  arch/x86/events/perf_event.h |  2 +-
>>  2 files changed, 4 insertions(+), 8 deletions(-)
>>
>> diff --git a/arch/x86/events/intel/core.c
>> b/arch/x86/events/intel/core.c
>> index 0217e701aeeb..ea3ab3050a3b 100644
>> --- a/arch/x86/events/intel/core.c
>> +++ b/arch/x86/events/intel/core.c
>> @@ -7946,12 +7946,6 @@ __init int intel_pmu_init(void)
>>  
>>  	x86_add_quirk(intel_arch_events_quirk); /* Install first, so
>> it runs last */
>>  
>> -	if (version >= 5) {
>> -		x86_pmu.intel_cap.anythread_deprecated =
>> edx.split.anythread_deprecated;
>> -		if (x86_pmu.intel_cap.anythread_deprecated)
>> -			pr_cont(" AnyThread deprecated, ");
>> -	}
>> -
>>  	/* The perf side of core PMU is ready to support the
>> mediated vPMU. */
>>  	x86_get_pmu(smp_processor_id())->capabilities |=
>> PERF_PMU_CAP_MEDIATED_VPMU;
>>  
>> @@ -8828,8 +8822,10 @@ __init int intel_pmu_init(void)
>>  				      &x86_pmu.intel_ctrl);
>>  
>>  	/* AnyThread may be deprecated on arch perfmon v5 or later
>> */
>> -	if (x86_pmu.intel_cap.anythread_deprecated)
>> +	if (version >= 5 && edx.split.anythread_deprecated) {
>>  		x86_pmu.format_attrs = intel_arch_formats_attr;
>> +		pr_cont("AnyThread deprecated, ");
> Is there a reason the leading space is missing here? Other than that,
> LGTM.

It's removed intentionally. The leading space is unnecessary and seems to
be long-term typo.

Thanks.


>
> Reviewed-by: Thomas Falcon <thomas.falcon@intel.com>
>
>> +	}
>>  
>>  	intel_pmu_check_event_constraints_all(NULL);
>>  
>> diff --git a/arch/x86/events/perf_event.h
>> b/arch/x86/events/perf_event.h
>> index eae24bb35dc1..5902a297daa1 100644
>> --- a/arch/x86/events/perf_event.h
>> +++ b/arch/x86/events/perf_event.h
>> @@ -668,7 +668,7 @@ union perf_capabilities {
>>  		u64	perf_metrics:1;
>>  		u64	pebs_output_pt_available:1;
>>  		u64	pebs_timing_info:1;
>> -		u64	anythread_deprecated:1;
>> +		u64	__reserved:1;
>>  		u64	rdpmc_metrics_clear:1;
>>  	};
>>  	u64	capabilities;

[PATCH 4/8] perf/x86/intel: Fix redundant branch type check in intel_pmu_lbr_filter()

[Dapeng Mi]

In intel_pmu_lbr_filter(), the 'type' variable is bitwise ORed with
'to_plm' (which contains X86_BR_USER and/or X86_BR_KERNEL bits). Because
of this, 'type' can never equal X86_BR_NONE (0) after the assignment.

As a result, the subsequent check 'if (type == X86_BR_NONE)' is dead code
and the entries with X86_BR_NONE type would not be skipped eventually.

Correct this by masking out the X86_BR_KERNEL and X86_BR_USER bits
before performing the X86_BR_NONE comparison.

Cc: stable@vger.kernel.org
Fixes: 47125db27e47 ("perf/x86/intel/lbr: Support Architectural LBR")
Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
---

Original patch link:
https://lore.kernel.org/all/20260414021440.928068-1-dapeng1.mi@linux.intel.com/

 arch/x86/events/intel/lbr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/events/intel/lbr.c b/arch/x86/events/intel/lbr.c
index 72f2adcda7c6..16977e4c6f8a 100644
--- a/arch/x86/events/intel/lbr.c
+++ b/arch/x86/events/intel/lbr.c
@@ -1245,7 +1245,7 @@ intel_pmu_lbr_filter(struct cpu_hw_events *cpuc)
 		}
 
 		/* if type does not correspond, then discard */
-		if (type == X86_BR_NONE || (br_sel & type) != type) {
+		if ((type & ~X86_BR_PLM) == X86_BR_NONE || (br_sel & type) != type) {
 			cpuc->lbr_entries[i].from = 0;
 			compress = true;
 		}
-- 
2.34.1

Re: [PATCH 4/8] perf/x86/intel: Fix redundant branch type check in intel_pmu_lbr_filter()

[Falcon, Thomas]

On Fri, 2026-06-05 at 09:11 +0800, Dapeng Mi wrote:
> In intel_pmu_lbr_filter(), the 'type' variable is bitwise ORed with
> 'to_plm' (which contains X86_BR_USER and/or X86_BR_KERNEL bits). Because
> of this, 'type' can never equal X86_BR_NONE (0) after the assignment.
> 
> As a result, the subsequent check 'if (type == X86_BR_NONE)' is dead code
> and the entries with X86_BR_NONE type would not be skipped eventually.
> 
> Correct this by masking out the X86_BR_KERNEL and X86_BR_USER bits
> before performing the X86_BR_NONE comparison.
> 
> Cc: stable@vger.kernel.org
> Fixes: 47125db27e47 ("perf/x86/intel/lbr: Support Architectural LBR")
> Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
> ---
> 
> Original patch link:
> https://lore.kernel.org/all/20260414021440.928068-1-dapeng1.mi@linux.intel.com/
> 
>  arch/x86/events/intel/lbr.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/arch/x86/events/intel/lbr.c b/arch/x86/events/intel/lbr.c
> index 72f2adcda7c6..16977e4c6f8a 100644
> --- a/arch/x86/events/intel/lbr.c
> +++ b/arch/x86/events/intel/lbr.c
> @@ -1245,7 +1245,7 @@ intel_pmu_lbr_filter(struct cpu_hw_events *cpuc)
>  		}
>  
>  		/* if type does not correspond, then discard */
> -		if (type == X86_BR_NONE || (br_sel & type) != type) {
> +		if ((type & ~X86_BR_PLM) == X86_BR_NONE || (br_sel & type) != type) {

Looking at intel_pmu_lbr_filter...

	if (static_cpu_has(X86_FEATURE_ARCH_LBR) &&
	    type <= ARCH_LBR_BR_TYPE_KNOWN_MAX) {
		to_plm = kernel_ip(to) ? X86_BR_KERNEL : X86_BR_USER;
		type = arch_lbr_br_type_map[type] | to_plm;
	} else
		type = branch_type(from, to, cpuc->lbr_entries[i].abort);

In the else case, it does look (branch_type -> get_branch_type) can return X86_BR_NONE without OR'ing it with X86_BR_KERNEL or X86_BR_USER, so the condition checking the type for X86_BR_NONE is not exactly "dead code."

One example:

static int get_branch_type(unsigned long from, unsigned long to, int abort,
			   bool fused, int *offset)
{
...
	 * maybe zero if lbr did not fill up after a reset by the time
	 * we get a PMU interrupt
	 */
	if (from == 0 || to == 0)
		return X86_BR_NONE;
...

Though in those cases, it doesn't seem like this change would make a difference. I guess it isn't clear to me what issue this change is fixing.

Thanks,
Tom

>  			cpuc->lbr_entries[i].from = 0;
>  			compress = true;
>  		}

Re: [PATCH 4/8] perf/x86/intel: Fix redundant branch type check in intel_pmu_lbr_filter()

[Mi, Dapeng]

On 6/6/2026 2:28 AM, Falcon, Thomas wrote:
> On Fri, 2026-06-05 at 09:11 +0800, Dapeng Mi wrote:
>> In intel_pmu_lbr_filter(), the 'type' variable is bitwise ORed with
>> 'to_plm' (which contains X86_BR_USER and/or X86_BR_KERNEL bits). Because
>> of this, 'type' can never equal X86_BR_NONE (0) after the assignment.
>>
>> As a result, the subsequent check 'if (type == X86_BR_NONE)' is dead code
>> and the entries with X86_BR_NONE type would not be skipped eventually.
>>
>> Correct this by masking out the X86_BR_KERNEL and X86_BR_USER bits
>> before performing the X86_BR_NONE comparison.
>>
>> Cc: stable@vger.kernel.org
>> Fixes: 47125db27e47 ("perf/x86/intel/lbr: Support Architectural LBR")
>> Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
>> ---
>>
>> Original patch link:
>> https://lore.kernel.org/all/20260414021440.928068-1-dapeng1.mi@linux.intel.com/
>>
>>  arch/x86/events/intel/lbr.c | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/arch/x86/events/intel/lbr.c b/arch/x86/events/intel/lbr.c
>> index 72f2adcda7c6..16977e4c6f8a 100644
>> --- a/arch/x86/events/intel/lbr.c
>> +++ b/arch/x86/events/intel/lbr.c
>> @@ -1245,7 +1245,7 @@ intel_pmu_lbr_filter(struct cpu_hw_events *cpuc)
>>  		}
>>  
>>  		/* if type does not correspond, then discard */
>> -		if (type == X86_BR_NONE || (br_sel & type) != type) {
>> +		if ((type & ~X86_BR_PLM) == X86_BR_NONE || (br_sel & type) != type) {
> Looking at intel_pmu_lbr_filter...
>
> 	if (static_cpu_has(X86_FEATURE_ARCH_LBR) &&
> 	    type <= ARCH_LBR_BR_TYPE_KNOWN_MAX) {
> 		to_plm = kernel_ip(to) ? X86_BR_KERNEL : X86_BR_USER;
> 		type = arch_lbr_br_type_map[type] | to_plm;
> 	} else
> 		type = branch_type(from, to, cpuc->lbr_entries[i].abort);
>
> In the else case, it does look (branch_type -> get_branch_type) can return X86_BR_NONE without OR'ing it with X86_BR_KERNEL or X86_BR_USER, so the condition checking the type for X86_BR_NONE is not exactly "dead code."
>
> One example:
>
> static int get_branch_type(unsigned long from, unsigned long to, int abort,
> 			   bool fused, int *offset)
> {
> ...
> 	 * maybe zero if lbr did not fill up after a reset by the time
> 	 * we get a PMU interrupt
> 	 */
> 	if (from == 0 || to == 0)
> 		return X86_BR_NONE;
> ...
>
> Though in those cases, it doesn't seem like this change would make a difference. I guess it isn't clear to me what issue this change is fixing.

Yes, the "dead code" is not accurate. For hardware decoding (the if case),
the validation is some kind of dead code, but for the software decoding,
it's not. I would adjust the wording in next version. Thanks.


>
> Thanks,
> Tom
>
>>  			cpuc->lbr_entries[i].from = 0;
>>  			compress = true;
>>  		}

Re: [PATCH 4/8] perf/x86/intel: Fix redundant branch type check in intel_pmu_lbr_filter()

[Mi, Dapeng]

On 6/8/2026 9:56 AM, Mi, Dapeng wrote:
> On 6/6/2026 2:28 AM, Falcon, Thomas wrote:
>> On Fri, 2026-06-05 at 09:11 +0800, Dapeng Mi wrote:
>>> In intel_pmu_lbr_filter(), the 'type' variable is bitwise ORed with
>>> 'to_plm' (which contains X86_BR_USER and/or X86_BR_KERNEL bits). Because
>>> of this, 'type' can never equal X86_BR_NONE (0) after the assignment.
>>>
>>> As a result, the subsequent check 'if (type == X86_BR_NONE)' is dead code
>>> and the entries with X86_BR_NONE type would not be skipped eventually.
>>>
>>> Correct this by masking out the X86_BR_KERNEL and X86_BR_USER bits
>>> before performing the X86_BR_NONE comparison.
>>>
>>> Cc: stable@vger.kernel.org
>>> Fixes: 47125db27e47 ("perf/x86/intel/lbr: Support Architectural LBR")
>>> Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
>>> ---
>>>
>>> Original patch link:
>>> https://lore.kernel.org/all/20260414021440.928068-1-dapeng1.mi@linux.intel.com/
>>>
>>>  arch/x86/events/intel/lbr.c | 2 +-
>>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git a/arch/x86/events/intel/lbr.c b/arch/x86/events/intel/lbr.c
>>> index 72f2adcda7c6..16977e4c6f8a 100644
>>> --- a/arch/x86/events/intel/lbr.c
>>> +++ b/arch/x86/events/intel/lbr.c
>>> @@ -1245,7 +1245,7 @@ intel_pmu_lbr_filter(struct cpu_hw_events *cpuc)
>>>  		}
>>>  
>>>  		/* if type does not correspond, then discard */
>>> -		if (type == X86_BR_NONE || (br_sel & type) != type) {
>>> +		if ((type & ~X86_BR_PLM) == X86_BR_NONE || (br_sel & type) != type) {
>> Looking at intel_pmu_lbr_filter...
>>
>> 	if (static_cpu_has(X86_FEATURE_ARCH_LBR) &&
>> 	    type <= ARCH_LBR_BR_TYPE_KNOWN_MAX) {
>> 		to_plm = kernel_ip(to) ? X86_BR_KERNEL : X86_BR_USER;
>> 		type = arch_lbr_br_type_map[type] | to_plm;
>> 	} else
>> 		type = branch_type(from, to, cpuc->lbr_entries[i].abort);
>>
>> In the else case, it does look (branch_type -> get_branch_type) can return X86_BR_NONE without OR'ing it with X86_BR_KERNEL or X86_BR_USER, so the condition checking the type for X86_BR_NONE is not exactly "dead code."
>>
>> One example:
>>
>> static int get_branch_type(unsigned long from, unsigned long to, int abort,
>> 			   bool fused, int *offset)
>> {
>> ...
>> 	 * maybe zero if lbr did not fill up after a reset by the time
>> 	 * we get a PMU interrupt
>> 	 */
>> 	if (from == 0 || to == 0)
>> 		return X86_BR_NONE;
>> ...
>>
>> Though in those cases, it doesn't seem like this change would make a difference. I guess it isn't clear to me what issue this change is fixing.
> Yes, the "dead code" is not accurate. For hardware decoding (the if case),
> the validation is some kind of dead code, but for the software decoding,
> it's not. I would adjust the wording in next version. Thanks.

Just look at the code again, the hardware decoding case would never return
X86_BR_NONE, so it looks this patch is unnecessary and would drop it in
next version. Thanks.


>
>
>> Thanks,
>> Tom
>>
>>>  			cpuc->lbr_entries[i].from = 0;
>>>  			compress = true;
>>>  		}

[PATCH 5/8] perf/x86/intel: Fix kernel address leakages in LBR stack

[Dapeng Mi]

Prior to the arch-LBR which supports CPL filtering, the kernel address
could be leaked to user space even PERF_SAMPLE_BRANCH_USER is required.

e.g., run below command on Intel Tigerlake platform,

```
$./perf record -e cycles:p -o - --branch-filter any,save_type,u -- \
 	./perf bench syscall basic --loop 1000 | \
	./perf script -i - --fields brstack|tr ' ' '\n'| \
	grep -E '0x[89a-f][0-9a-f]{15}'

    Total time: 0.000 [sec]

      0.219000 usecs/op
     4,566,210 ops/sec
[ perf record: Woken up 1 times to write data ]
[ perf record: Captured and wrote 0.551 MB - ]
0xffffffff93c001c8/0x7f12a2b1d647/P/-/-/16959/SYSRET/-
0xffffffff93c001c8/0x7f12a2b1d5c2/P/-/-/17535/SYSRET/-
0xffffffff93c01928/0x7f12a2861000/P/-/-/6719/ERET/-
0xffffffff93c01928/0x7f12a297a000/P/-/-/8575/ERET/-
```
The SYSRET/ERET branch calls are found the in the LBR stack, whose "from"
addresses are obviously kernel address.

Currently intel_pmu_lbr_filter() only filters out the LBR entries whose
"to" address is a kernel address but doesn't check the "from" address.

To fix the issue, extend the software filtering to both "from" and "to"
addresses.

Cc: stable@vger.kernel.org
Reported-by: Ian Rogers <irogers@google.com>
Fixes: 47125db27e47 ("perf/x86/intel/lbr: Support Architectural LBR")
Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
---

Original patch link:
https://lore.kernel.org/all/20260414021440.928068-2-dapeng1.mi@linux.intel.com/

 arch/x86/events/intel/lbr.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/arch/x86/events/intel/lbr.c b/arch/x86/events/intel/lbr.c
index 16977e4c6f8a..deef81c16571 100644
--- a/arch/x86/events/intel/lbr.c
+++ b/arch/x86/events/intel/lbr.c
@@ -1212,7 +1212,7 @@ intel_pmu_lbr_filter(struct cpu_hw_events *cpuc)
 {
 	u64 from, to;
 	int br_sel = cpuc->br_sel;
-	int i, j, type, to_plm;
+	int i, j, type, to_plm, from_plm;
 	bool compress = false;
 
 	/* if sampling all branches, then nothing to filter */
@@ -1244,8 +1244,15 @@ intel_pmu_lbr_filter(struct cpu_hw_events *cpuc)
 				type |= X86_BR_NO_TX;
 		}
 
-		/* if type does not correspond, then discard */
-		if ((type & ~X86_BR_PLM) == X86_BR_NONE || (br_sel & type) != type) {
+		from_plm = kernel_ip(from) ? X86_BR_KERNEL : X86_BR_USER;
+		/*
+		 * If type does not correspond, then discard.
+		 * Especially filter out the entries whose from or to address
+		 * is a kernel address while only X86_BR_USER is set. This prevents
+		 * kernel address from being leaked into a user-space-only LBR stack.
+		 */
+		if ((type & ~X86_BR_PLM) == X86_BR_NONE || (br_sel & type) != type ||
+		    (!(br_sel & X86_BR_KERNEL) && (from_plm & X86_BR_KERNEL))) {
 			cpuc->lbr_entries[i].from = 0;
 			compress = true;
 		}
-- 
2.34.1