[PATCH v12 07/11] perf: RISC-V: support callchains with SSE delivery
Zhanpeng Zhang
zhangzhanpeng.jasper at bytedance.com
Thu Oct 29 00:48:49 PDT 2026
PMU overflow delivery through SSE enters Linux with a synthetic supervisor
context on a dedicated event stack. The perf unwinder must use the context
interrupted by the overflow rather than treating the SSE handler frame as
the sampled frame.
Use the interrupted pt_regs published by the RISC-V SSE entry path. Walk a
kernel callchain only when the interrupted PC, SP, and frame pointer are
consistent with the current task stack. For sensitive entry windows and
IRQ stacks whose bounds cannot be proven, retain the interrupted PC without
following an unsafe frame chain.
User callchains continue through the existing nofault RISC-V user unwinder.
If hstatus.SPV says the interrupted context was a guest, do not interpret
the guest stack through the host address space.
DWARF callchains additionally copy a raw user stack. Provide an SSE-aware
riscv_perf_out_copy_user() following x86's copy_from_user_nmi().
The copy runs under pagefault_disable(), so a non-resident source
page takes an exception-table handled fault that returns the number
of bytes not copied
instead of entering handle_mm_fault() or opening an interrupt window, and
perf truncates the user-stack dump accordingly. The SSE entry saves and
restores the interrupted task's stack metadata across that nested trap.
In SSE context also check access_ok(), require a user mm, and compare
the active page-table root with current->mm before copying. This rejects
a mismatched root, but does not exclude stale translations in the window
between a satp update and the following TLB flush. It is not a complete
equivalent of x86's nmi_uaccess_okay(). Outside SSE, retain the existing
inatomic copy with page faults disabled.
Susheng Yang reported this failure with perf callchain workloads.
Link: https://lore.kernel.org/r/as79MHtNYd-VbUug@hu-himchau-blr.qualcomm.com/
Reported-by: Susheng Yang <yang.susheng at zte.com.cn>
Signed-off-by: Zhanpeng Zhang <zhangzhanpeng.jasper at bytedance.com>
---
arch/riscv/include/asm/perf_event.h | 10 ++
arch/riscv/kernel/perf_callchain.c | 140 ++++++++++++++++++++++++++++
2 files changed, 150 insertions(+)
diff --git a/arch/riscv/include/asm/perf_event.h b/arch/riscv/include/asm/perf_event.h
index bcc928fd378..ddc40479475 100644
--- a/arch/riscv/include/asm/perf_event.h
+++ b/arch/riscv/include/asm/perf_event.h
@@ -18,6 +18,16 @@
(regs)->sp = current_stack_pointer; \
(regs)->status = SR_PP; \
}
+
+#ifdef CONFIG_RISCV_SBI_SSE
+/*
+ * Raw user-stack sampling can run in the NMI-like SSE context. Route it
+ * through an implementation that does not fault on a non-resident page.
+ */
+unsigned long riscv_perf_out_copy_user(void *dst, const void *src,
+ unsigned long n);
+#define arch_perf_out_copy_user riscv_perf_out_copy_user
+#endif
#endif
#endif /* _ASM_RISCV_PERF_EVENT_H */
diff --git a/arch/riscv/kernel/perf_callchain.c b/arch/riscv/kernel/perf_callchain.c
index b465bc9eb87..216f5bd14c0 100644
--- a/arch/riscv/kernel/perf_callchain.c
+++ b/arch/riscv/kernel/perf_callchain.c
@@ -1,9 +1,15 @@
// SPDX-License-Identifier: GPL-2.0
/* Copyright (C) 2019 Hangzhou C-SKY Microsystems co.,ltd. */
+#include <linux/kallsyms.h>
+#include <linux/mm.h>
#include <linux/perf_event.h>
+#include <linux/sched/task_stack.h>
+#include <linux/thread_info.h>
#include <linux/uaccess.h>
+#include <asm/csr.h>
+#include <asm/sse.h>
#include <asm/stacktrace.h>
static bool fill_callchain(void *entry, unsigned long pc)
@@ -11,6 +17,126 @@ static bool fill_callchain(void *entry, unsigned long pc)
return perf_callchain_store(entry, pc) == 0;
}
+#ifdef CONFIG_RISCV_SBI_SSE
+static bool sse_addr_on_task_stack(unsigned long addr, unsigned long size)
+{
+ unsigned long end = addr + size;
+ unsigned long stack;
+
+ if (end < addr)
+ return false;
+
+ stack = (unsigned long)task_stack_page(current);
+ if (addr >= stack && end <= stack + THREAD_SIZE)
+ return true;
+
+ return false;
+}
+
+static bool sse_kernel_regs_safe(struct pt_regs *regs)
+{
+ unsigned long fp = frame_pointer(regs);
+ unsigned long pc = instruction_pointer(regs);
+ unsigned long sp = user_stack_pointer(regs);
+
+ if (!__kernel_text_address(pc))
+ return false;
+ if (!sse_addr_on_task_stack(sp, sizeof(unsigned long)))
+ return false;
+ if (fp < sizeof(struct stackframe))
+ return false;
+
+ return sse_addr_on_task_stack(fp - sizeof(struct stackframe),
+ sizeof(struct stackframe));
+}
+
+static bool sse_callchain_is_guest(const struct riscv_sse_interrupted_context *context)
+{
+ return context && (context->hstatus & HSTATUS_SPV);
+}
+
+static bool sse_callchain_kernel(struct perf_callchain_entry_ctx *entry,
+ struct pt_regs *regs)
+{
+ const struct riscv_sse_interrupted_context *context;
+ unsigned long pc;
+
+ context = riscv_sse_get_interrupted_context();
+ if (!context || context->regs != regs)
+ return false;
+
+ /* A guest stack cannot be walked using the host kernel address space. */
+ if (sse_callchain_is_guest(context))
+ return true;
+
+ if (user_mode(regs))
+ return true;
+
+ if (sse_kernel_regs_safe(regs)) {
+ walk_stackframe(NULL, regs, fill_callchain, entry);
+ return true;
+ }
+
+ /*
+ * Keep the sample useful for sensitive entry paths and IRQ stacks. The
+ * generic walker does not take explicit IRQ stack bounds, and its
+ * THREAD_SIZE alignment assumption fails for non-vmapped IRQ stacks.
+ * Conservatively avoid walking IRQ stacks in every configuration.
+ */
+ pc = instruction_pointer(regs);
+ if (__kernel_text_address(pc))
+ perf_callchain_store(entry, pc);
+
+ return true;
+}
+
+unsigned long riscv_perf_out_copy_user(void *dst, const void *src,
+ unsigned long n)
+{
+ unsigned long ret;
+
+ /*
+ * Raw user-stack sampling can run in the NMI-like SSE context. Mirror
+ * x86's copy_from_user_nmi(): the copy may take a page fault, but it
+ * must not fault a non-resident page in. pagefault_disable() keeps the
+ * RISC-V fault handler on the nofault exception-table fixup (no
+ * handle_mm_fault(), no interrupt window), and the SSE entry saves and
+ * restores the interrupted task's stack metadata across that nested
+ * trap. A fault therefore returns the number of bytes not copied, and
+ * perf truncates the user-stack dump accordingly.
+ *
+ * In SSE context also approximate x86's nmi_uaccess_okay(): only sample
+ * when the active page table root still matches current->mm, so we do
+ * not walk an unrelated address space after interrupting a KVM guest, a
+ * kernel thread, or a task whose mm is being swapped. This root check
+ * does not close the window inside switch_mm() between writing satp and
+ * flushing the local TLB (RISC-V has no LOADED_MM_SWITCHING marker like
+ * x86); that is a window between instructions, not within one. In that
+ * window a stale TLB entry may still resolve to the outgoing mapping, and
+ * with ASID reuse the residue can even belong to an unrelated address
+ * space. The nofault fixup only bounds faulting accesses; it cannot
+ * detect a successful hit on a stale translation. This is therefore a
+ * bounded sample-quality gap (a mis-attributed or truncated user-stack
+ * dump), not a memory-safety hazard: the copy target is the perf ring
+ * buffer and the length is bounded, so a stale read cannot corrupt an
+ * unrelated kernel object.
+ */
+ if (riscv_sse_get_interrupted_context()) {
+ if (!access_ok(src, n))
+ return n;
+ if (!current->mm ||
+ (csr_read(CSR_SATP) & SATP_PPN) != virt_to_pfn(current->mm->pgd))
+ return n;
+ }
+
+ pagefault_disable();
+ ret = __copy_from_user_inatomic(dst, src, n);
+ pagefault_enable();
+
+ return ret;
+}
+#endif
+
/*
* This will be called when the target is in user mode
* This function will only be called when we use
@@ -28,6 +154,15 @@ static bool fill_callchain(void *entry, unsigned long pc)
void perf_callchain_user(struct perf_callchain_entry_ctx *entry,
struct pt_regs *regs)
{
+#ifdef CONFIG_RISCV_SBI_SSE
+ const struct riscv_sse_interrupted_context *context;
+
+ context = riscv_sse_get_interrupted_context();
+ /* A guest stack cannot be walked using the host address space. */
+ if (sse_callchain_is_guest(context))
+ return;
+#endif
+
if (perf_guest_state()) {
/* TODO: We don't support guest os callchain now */
return;
@@ -39,6 +174,11 @@ void perf_callchain_user(struct perf_callchain_entry_ctx *entry,
void perf_callchain_kernel(struct perf_callchain_entry_ctx *entry,
struct pt_regs *regs)
{
+#ifdef CONFIG_RISCV_SBI_SSE
+ if (sse_callchain_kernel(entry, regs))
+ return;
+#endif
+
if (perf_guest_state()) {
/* TODO: We don't support guest os callchain now */
return;
--
2.50.1 (Apple Git-155)
More information about the linux-riscv
mailing list