linux-stable.git/tools/perf/util/intel-pt.c, branch linux-rolling-stable

perf inject: Fix itrace branch stack synthesis

2026-07-24T14:20:02+00:00

[ Upstream commit daac18e7c42c012e289bfd310503f9417e4a9481 ]

When using "perf inject --itrace=L" to synthesize branch stacks from
AUX data, several issues caused failures with the generated file:

1. The synthesized samples were delivered without the
   PERF_SAMPLE_BRANCH_STACK flag if it was not in the original event's
   sample_type. Fixed by using sample_type | evsel->synth_sample_type
   in intel_pt_do_synth_pebs_sample.

2. Modifying evsel->core.attr.sample_type early in __cmd_inject caused
   parse failures for subsequent records in the input file. Fixed by
   moving this modification to just before writing the header.

3. perf_event__repipe_sample was narrowed to only synthesize samples
   when branch stack injection was requested, and restored the use of
   perf_inject__cut_auxtrace_sample as a fallback to preserve
   functionality.

4. Potential Heap Overflow in perf_event__repipe_sample: Addressed by
   adding a check that prints an error and returns -EFAULT if the
   calculated event size exceeds PERF_SAMPLE_MAX_SIZE.

5. Header vs Payload Mismatch in __cmd_inject: Addressed by narrowing
   the condition so that HEADER_BRANCH_STACK is only set in the file
   header if add_last_branch was true.

6. NULL Pointer Dereference in intel-pt.c: When branch stack injection
   is requested (add_last_branch is true) but last_branch is false
   (e.g., perf inject --itrace=L), ptq->last_branch was not allocated.
   However, PEBS branch stack synthesis (via synth_sample_type) still
   forced LBR handling in do_synth_pebs_sample(), dereferencing the
   NULL ptq->last_branch pointer. Guarding the dereference is not
   sufficient because downstream sample size calculation and synthesis
   strictly require a non-NULL branch_stack when the bit is set.
   Fixed by ensuring ptq->last_branch is allocated in
   intel_pt_alloc_queue() when add_last_branch is requested.

7. Modifying event attributes in perf_event__repipe_attr in-place caused
   SIGSEGV on read-only mmap buffers in file mode and downstream parser
   breakage in pipe mode. Fixed by processing the unmodified attribute
   first, returning immediately in non-pipe mode, and correctly
   synthesizing a new attribute event for pipe output using
   perf_event__synthesize_attr. Also:
   - Added a size validation check and integer underflow protection when
     parsing n_ids.
   - Prevented Trailing ID memory corruption by zero-initializing the
     local attr copy and safely copying using min_t(size_t, sizeof(attr),
     event->attr.attr.size).
   - Resolved ID array parsing mismatch downstream by expanding attr.size
     to sizeof(struct perf_event_attr) before synthesis to guarantee
     perfect header/attribute size alignment.

8. Potential dangling pointer vulnerability in perf_event__repipe_sample:
   Addressed by restoring the original sample->branch_stack pointer
   before returning, including on early error return paths.

9. Off-by-one error in sample size check in perf_event__repipe_sample:
   Fixed by checking if sz >= PERF_SAMPLE_MAX_SIZE instead of >.

10. Unadvertised size field left in payload by cut_auxtrace_sample:
    Addressed by excluding the 8-byte size field from the copied
    payload to correctly match the cleared PERF_SAMPLE_AUX bit. Cut
    the AUX sample payload even if size is 0.

11. Inaccurate sample size calculation and uninitialized memory leaks in
    convert_sample_callchain: Fixed by replacing manual arithmetic with
    perf_event__sample_event_size and adding a bounds check against
    PERF_SAMPLE_MAX_SIZE.

12. Omission of branch_sample_type in file headers: Addressed by
    expanding older, smaller attributes to PERF_ATTR_SIZE_VER2 in
    __cmd_inject to ensure branch_sample_type is not silently omitted.

Fixes: 0f0aa5e0693ce400 ("perf inject: Add Instruction Tracing support")
Assisted-by: Gemini:gemini-3.1-pro-preview
Signed-off-by: Ian Rogers 
Cc: Adrian Hunter 
Cc: Dapeng Mi 
Cc: Ingo Molnar 
Cc: James Clark 
Cc: Leo Yan 
Cc: Namhyung Kim 
Cc: Peter Zijlstra 
Cc: Ravi Bangoria 
Cc: Thomas Falcon 
Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: Sasha Levin

perf event: Fix size of synthesized sample with branch stacks

2026-07-24T14:20:02+00:00

[ Upstream commit 059e9100d82aae2254f1b06835a55755936b1417 ]

Synthesizing branch stacks for Intel-PT highlighted an issue where
PERF_SAMPLE_BRANCH_HW_INDEX was assumed to always be set in the
perf_event_attr branch_sample_type. This caused an incorrect size
calculation.

Fix the writing of the nr and hw_idx values during sample event
synthesis by passing the branch_sample_type into the sample size
and synthesis functions. Also update hardware tracers (Intel PT,
ARM SPE, CS-ETM) to retrieve and pass their branch_sample_type
dynamically to prevent payload misalignment.

Fixes: d3f85437ad6a5511 ("perf evsel: Support PERF_SAMPLE_BRANCH_HW_INDEX")
Assisted-by: Gemini:gemini-3.1-pro-preview
Signed-off-by: Ian Rogers 
Acked-by: Namhyung Kim 
Cc: Adrian Hunter 
Cc: Dapeng Mi 
Cc: Ingo Molnar 
Cc: James Clark 
Cc: Kan Liang 
Cc: Leo Yan 
Cc: Peter Zijlstra 
Cc: Ravi Bangoria 
Cc: Thomas Falcon 
Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: Sasha Levin

perf auxtrace: Add auxtrace_synth_id_range_start() helper

2025-10-26T00:44:57+00:00

To avoid hardcoding the offset value for synthetic event IDs
in multiple auxtrace modules (arm-spe, cs-etm, intel-pt, etc.),
and to improve code reusability, this patch unifies
the handling of the ID offset via a dedicated helper function.

Signed-off-by: tanze 
Reviewed-by: Adrian Hunter 
Tested-by: Leo Yan 
Signed-off-by: Namhyung Kim

perf intel-pt: Fix PEBS-via-PT data_src

2025-05-12T17:18:09+00:00

The Fixes commit did not add support for decoding PEBS-via-PT data_src.
Fix by adding support.

PEBS-via-PT is a feature of some E-core processors, starting with
processors based on Tremont microarchitecture. Because the kernel only
supports Intel PT features that are on all processors, there is no support
for PEBS-via-PT on hybrids.

Currently that leaves processors based on Tremont, Gracemont and Crestmont,
however there are no events on Tremont that produce data_src information,
and for Gracemont and Crestmont there are only:

	mem-loads	event=0xd0,umask=0x5,ldlat=3
	mem-stores	event=0xd0,umask=0x6

Affected processors include Alder Lake N (Gracemont), Sierra Forest
(Crestmont) and Grand Ridge (Crestmont).

Example:

 # perf record -d -e intel_pt/branch=0/ -e mem-loads/aux-output/pp uname

 Before:

  # perf.before script --itrace=o -Fdata_src
            0 |OP No|LVL N/A|SNP N/A|TLB N/A|LCK No|BLK  N/A
            0 |OP No|LVL N/A|SNP N/A|TLB N/A|LCK No|BLK  N/A

 After:

  # perf script --itrace=o -Fdata_src
  10268100142 |OP LOAD|LVL L1 hit|SNP None|TLB L1 or L2 hit|LCK No|BLK  N/A
  10450100442 |OP LOAD|LVL L2 hit|SNP None|TLB L2 miss|LCK No|BLK  N/A

Fixes: 975846eddf907297 ("perf intel-pt: Add memory information to synthesized PEBS sample")
Reviewed-by: Kan Liang 
Signed-off-by: Adrian Hunter 
Cc: Alexander Shishkin 
Cc: Ian Rogers 
Cc: Jiri Olsa 
Cc: Namhyung Kim 
Link: https://lore.kernel.org/r/20250512093932.79854-2-adrian.hunter@intel.com
Signed-off-by: Arnaldo Carvalho de Melo

perf sample: Make user_regs and intr_regs optional

2025-02-13T04:06:11+00:00

The struct dump_regs contains 512 bytes of cache_regs, meaning the two
values in perf_sample contribute 1088 bytes of its total 1384 bytes
size. Initializing this much memory has a cost reported by Tavian
Barnes  as about 2.5% when running `perf
script --itrace=i0`:
https://lore.kernel.org/lkml/d841b97b3ad2ca8bcab07e4293375fb7c32dfce7.1736618095.git.tavianator@tavianator.com/

Adrian Hunter  replied that the zero
initialization was necessary and couldn't simply be removed.

This patch aims to strike a middle ground of still zeroing the
perf_sample, but removing 79% of its size by make user_regs and
intr_regs optional pointers to zalloc-ed memory. To support the
allocation accessors are created for user_regs and intr_regs. To
support correct cleanup perf_sample__init and perf_sample__exit
functions are created and added throughout the code base.

Signed-off-by: Ian Rogers 
Link: https://lore.kernel.org/r/20250113194345.1537821-1-irogers@google.com
Signed-off-by: Namhyung Kim

perf tools: Fix typos Muliplier -> Multiplier

2024-11-13T19:27:35+00:00

There are some typos in fprintf messages.
Fix them via codespell.

Reviewed-by: Adrian Hunter 
Signed-off-by: Andrew Kreimer 
Cc: Alexander Shishkin 
Cc: Ian Rogers 
Cc: Ingo Molnar 
Cc: Jiri Olsa 
Cc: Kan Liang 
Cc: Mark Rutland 
Cc: Namhyung Kim 
Cc: Peter Zijlstra 
Link: https://lore.kernel.org/r/20241108134728.25515-1-algonell@gmail.com
Signed-off-by: Arnaldo Carvalho de Melo

perf color: Add printf format checking and resolve issues

2024-10-17T19:44:26+00:00

Add printf format checking to vararg printf routines in
color.h. Resolve build errors/bugs that are found through this
checking.

Signed-off-by: Ian Rogers 
Cc: Yicong Yang 
Cc: Weilin Wang 
Cc: Will Deacon 
Cc: James Clark 
Cc: Mike Leach 
Cc: Leo Yan 
Cc: Sumanth Korikkar 
Cc: Thomas Richter 
Cc: Tim Chen 
Cc: John Garry 
Link: https://lore.kernel.org/r/20241017175356.783793-2-irogers@google.com
Signed-off-by: Namhyung Kim

perf tool: Constify tool pointers

2024-08-12T21:05:14+00:00

The tool pointer (to a struct largely of function pointers) is passed
around but is unchanged except at initialization. Change parameter and
variable types to be const to lower the possibilities of what could
happen with a tool.

Reviewed-by: Adrian Hunter 
Signed-off-by: Ian Rogers 
Tested-by: Adrian Hunter 
Tested-by: Leo Yan 
Cc: Alexander Shishkin 
Cc: Anshuman Khandual 
Cc: Athira Rajeev 
Cc: Huacai Chen 
Cc: Ilkka Koskinen 
Cc: Ingo Molnar 
Cc: James Clark 
Cc: Jiri Olsa 
Cc: John Garry 
Cc: Jonathan Cameron 
Cc: Kan Liang 
Cc: Leo Yan 
Cc: Mark Rutland 
Cc: Mike Leach 
Cc: Namhyung Kim 
Cc: Nick Desaulniers 
Cc: Nick Terrell 
Cc: Oliver Upton 
Cc: Peter Zijlstra 
Cc: Song Liu 
Cc: Sun Haiyong 
Cc: Suzuki Poulouse 
Cc: Will Deacon 
Cc: Yanteng Si 
Cc: Yicong Yang 
Cc: linux-arm-kernel@lists.infradead.org
Link: https://lore.kernel.org/r/20240812204720.631678-4-irogers@google.com
Signed-off-by: Arnaldo Carvalho de Melo

perf auxtrace: Remove dummy tools

2024-08-12T21:04:36+00:00

Add perf_session__deliver_synth_attr_event that synthesizes a
perf_record_header_attr event with one id. Remove use of
perf_event__synthesize_attr that necessitates the use of the dummy
tool in order to pass the session.

Reviewed-by: Adrian Hunter 
Signed-off-by: Ian Rogers 
Tested-by: Adrian Hunter 
Tested-by: Leo Yan 
Cc: Alexander Shishkin 
Cc: Anshuman Khandual 
Cc: Athira Rajeev 
Cc: Huacai Chen 
Cc: Ilkka Koskinen 
Cc: Ingo Molnar 
Cc: James Clark 
Cc: Jiri Olsa 
Cc: John Garry 
Cc: Jonathan Cameron 
Cc: Kan Liang 
Cc: Leo Yan 
Cc: Mark Rutland 
Cc: Mike Leach 
Cc: Namhyung Kim 
Cc: Nick Desaulniers 
Cc: Nick Terrell 
Cc: Oliver Upton 
Cc: Peter Zijlstra 
Cc: Song Liu 
Cc: Sun Haiyong 
Cc: Suzuki Poulouse 
Cc: Will Deacon 
Cc: Yanteng Si 
Cc: Yicong Yang 
Cc: linux-arm-kernel@lists.infradead.org
Link: https://lore.kernel.org/r/20240812204720.631678-2-irogers@google.com
Signed-off-by: Arnaldo Carvalho de Melo

perf dso: Add reference count checking and accessor functions

2024-05-06T18:28:49+00:00

Add reference count checking to struct dso, this can help with
implementing correct reference counting discipline. To avoid
RC_CHK_ACCESS everywhere, add accessor functions for the variables in
struct dso.

The majority of the change is mechanical in nature and not easy to
split up.

Committer testing:

'perf test' up to this patch shows no regressions.

But:

  util/symbol.c: In function ‘dso__load_bfd_symbols’:
  util/symbol.c:1683:9: error: too few arguments to function ‘dso__set_adjust_symbols’
   1683 |         dso__set_adjust_symbols(dso);
        |         ^~~~~~~~~~~~~~~~~~~~~~~
  In file included from util/symbol.c:21:
  util/dso.h:268:20: note: declared here
    268 | static inline void dso__set_adjust_symbols(struct dso *dso, bool val)
        |                    ^~~~~~~~~~~~~~~~~~~~~~~
  make[6]: *** [/home/acme/git/perf-tools-next/tools/build/Makefile.build:106: /tmp/tmp.ZWHbQftdN6/util/symbol.o] Error 1
    MKDIR   /tmp/tmp.ZWHbQftdN6/tests/workloads/
  make[6]: *** Waiting for unfinished jobs....

This was updated:

  -       symbols__fixup_end(&dso->symbols, false);
  -       symbols__fixup_duplicate(&dso->symbols);
  -       dso->adjust_symbols = 1;
  +       symbols__fixup_end(dso__symbols(dso), false);
  +       symbols__fixup_duplicate(dso__symbols(dso));
  +       dso__set_adjust_symbols(dso);

But not build tested with BUILD_NONDISTRO and libbfd devel files installed
(binutils-devel on fedora).

Add the missing argument:

   	symbols__fixup_end(dso__symbols(dso), false);
   	symbols__fixup_duplicate(dso__symbols(dso));
  -	dso__set_adjust_symbols(dso);
  +	dso__set_adjust_symbols(dso, true);

Signed-off-by: Ian Rogers 
Tested-by: Arnaldo Carvalho de Melo 
Cc: Adrian Hunter 
Cc: Ahelenia Ziemiańska 
Cc: Alexander Shishkin 
Cc: Andi Kleen 
Cc: Athira Rajeev 
Cc: Ben Gainey 
Cc: Changbin Du 
Cc: Chengen Du 
Cc: Colin Ian King 
Cc: Dima Kogan 
Cc: Ilkka Koskinen 
Cc: Ingo Molnar 
Cc: James Clark 
Cc: Jiri Olsa 
Cc: K Prateek Nayak 
Cc: Kan Liang 
Cc: Leo Yan 
Cc: Li Dong 
Cc: Mark Rutland 
Cc: Masami Hiramatsu 
Cc: Namhyung Kim 
Cc: Paran Lee 
Cc: Peter Zijlstra 
Cc: Song Liu 
Cc: Sun Haiyong 
Cc: Thomas Richter 
Cc: Tiezhu Yang 
Cc: Yanteng Si 
Cc: zhaimingbing 
Link: https://lore.kernel.org/r/20240504213803.218974-6-irogers@google.com
Signed-off-by: Arnaldo Carvalho de Melo