[Patch v9 20/24] perf/x86: Support SSP sampling using sample_regs_* fields

From: Dapeng Mi

Date: Sun Jul 05 2026 - 22:05:16 EST


Support sampling of CET SSP register via the sample_regs_* fields.

To sample SSP, the sample_simd_regs_enabled field must be set. This
allows the spare space (reclaimed from the original XMM space) in the
sample_regs_* fields to be used for representing SSP.

Similar to eGPRs sampling, the perf_reg_value() function needs to
check if the PERF_SAMPLE_REGS_ABI_SIMD flag is set first, and then
determine whether to output SSP or legacy XMM registers to userspace.

Additionally, arch-PEBS supports sampling SSP, which is placed into the
GPRs group. Also enables arch-PEBS-based SSP sampling in this patch.

Currently, SSP sampling is only supported on the x86_64 architecture, as
CET is only available on x86_64 platforms.

SSP sampling will be enabled in a subsequent patch that sets
PERF_PMU_CAP_SIMD_REGS.

Co-developed-by: Kan Liang <kan.liang@xxxxxxxxxxxxxxx>
Signed-off-by: Kan Liang <kan.liang@xxxxxxxxxxxxxxx>
Signed-off-by: Dapeng Mi <dapeng1.mi@xxxxxxxxxxxxxxx>
---
arch/x86/events/core.c | 11 +++++++++++
arch/x86/events/intel/ds.c | 15 +++++++++++++--
arch/x86/events/perf_event.h | 16 ++++++++++++++++
arch/x86/include/asm/perf_event.h | 1 +
arch/x86/include/uapi/asm/perf_regs.h | 7 ++++---
arch/x86/kernel/perf_regs.c | 5 +++++
6 files changed, 50 insertions(+), 5 deletions(-)

diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
index f4f1f80ed6f4..323be08778d6 100644
--- a/arch/x86/events/core.c
+++ b/arch/x86/events/core.c
@@ -725,6 +725,9 @@ int x86_pmu_hw_config(struct perf_event *event)
if (event_needs_egprs(event) &&
!(x86_pmu.ext_regs_mask & XFEATURE_MASK_APX))
return -EINVAL;
+ if (event_needs_ssp(event) &&
+ !(x86_pmu.ext_regs_mask & XFEATURE_MASK_CET_USER))
+ return -EINVAL;
/* The vector registers set is not supported */
if (event_needs_xmm(event) &&
!(x86_pmu.ext_regs_mask & XFEATURE_MASK_SSE))
@@ -1799,11 +1802,13 @@ void x86_pmu_clear_perf_regs(struct pt_regs *regs)
perf_regs->h16zmm_regs = NULL;
perf_regs->opmask_regs = NULL;
perf_regs->egpr_regs = NULL;
+ perf_regs->ssp = NULL;
}

static void update_perf_regs(struct x86_perf_regs *perf_regs,
struct xregs_state *xsave, u64 bitmap)
{
+ struct cet_user_state *cet;
u64 mask;

if (!xsave)
@@ -1824,6 +1829,10 @@ static void update_perf_regs(struct x86_perf_regs *perf_regs,
perf_regs->opmask = get_xsave_addr(xsave, XFEATURE_OPMASK);
if (mask & XFEATURE_MASK_APX)
perf_regs->egpr = get_xsave_addr(xsave, XFEATURE_APX);
+ if (mask & XFEATURE_MASK_CET_USER) {
+ cet = get_xsave_addr(xsave, XFEATURE_CET_USER);
+ perf_regs->ssp = cet ? &cet->user_ssp : NULL;
+ }
}

/*
@@ -2025,6 +2034,8 @@ static void x86_pmu_sample_xregs(struct perf_event *event,
mask |= XFEATURE_MASK_OPMASK;
if (event_needs_egprs(event))
mask |= XFEATURE_MASK_APX;
+ if (event_needs_ssp(event))
+ mask |= XFEATURE_MASK_CET_USER;

mask &= x86_pmu.ext_regs_mask;
if ((sample_type & PERF_SAMPLE_REGS_USER) && data->regs_user.regs) {
diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c
index 24bfc3fb6060..54e6f73ffde4 100644
--- a/arch/x86/events/intel/ds.c
+++ b/arch/x86/events/intel/ds.c
@@ -1707,6 +1707,7 @@ static u64 pebs_update_adaptive_cfg(struct perf_event *event)
u64 sample_type = attr->sample_type;
u64 pebs_data_cfg = 0;
bool gprs, tsx_weight;
+ u64 xgprs_mask;

if (!(sample_type & ~(PERF_SAMPLE_IP|PERF_SAMPLE_TIME)) &&
attr->precise_ip > 1)
@@ -1721,10 +1722,13 @@ static u64 pebs_update_adaptive_cfg(struct perf_event *event)
* + precise_ip < 2 for the non event IP
* + For RTM TSX weight we need GPRs for the abort code.
*/
+ xgprs_mask = event->attr.sample_simd_regs_enabled ?
+ PEBS_GP_REGS | BIT_ULL(PERF_REG_X86_SSP) :
+ PEBS_GP_REGS;
gprs = ((sample_type & PERF_SAMPLE_REGS_INTR) &&
- (attr->sample_regs_intr & PEBS_GP_REGS)) ||
+ (attr->sample_regs_intr & xgprs_mask)) ||
((sample_type & PERF_SAMPLE_REGS_USER) &&
- (attr->sample_regs_user & PEBS_GP_REGS));
+ (attr->sample_regs_user & xgprs_mask));

tsx_weight = (sample_type & PERF_SAMPLE_WEIGHT_TYPE) &&
((attr->config & INTEL_ARCH_EVENT_MASK) ==
@@ -2674,6 +2678,13 @@ static void setup_arch_pebs_sample_data(struct perf_event *event,
__setup_pebs_gpr_group(event, regs,
(struct pebs_gprs *)gprs,
sample_type);
+
+ /* Currently only user space mode enables SSP. */
+ if (user_mode(regs) && (sample_type &
+ (PERF_SAMPLE_REGS_INTR | PERF_SAMPLE_REGS_USER))) {
+ perf_regs->ssp = &gprs->ssp;
+ ignore_mask |= XFEATURE_MASK_CET_USER;
+ }
}

if (header->aux) {
diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h
index 840ef8a44b52..b1f9d17dddb6 100644
--- a/arch/x86/events/perf_event.h
+++ b/arch/x86/events/perf_event.h
@@ -238,6 +238,22 @@ static inline bool event_needs_egprs(struct perf_event *event)
return false;
}

+static inline bool event_needs_ssp(struct perf_event *event)
+{
+ if (!event->attr.sample_simd_regs_enabled)
+ return false;
+
+ if ((event->attr.sample_type & PERF_SAMPLE_REGS_USER) &&
+ (event->attr.sample_regs_user & BIT_ULL(PERF_REG_X86_SSP)))
+ return true;
+
+ if ((event->attr.sample_type & PERF_SAMPLE_REGS_INTR) &&
+ (event->attr.sample_regs_intr & BIT_ULL(PERF_REG_X86_SSP)))
+ return true;
+
+ return false;
+}
+
struct amd_nb {
int nb_id; /* NorthBridge id */
int refcnt; /* reference count */
diff --git a/arch/x86/include/asm/perf_event.h b/arch/x86/include/asm/perf_event.h
index bc05f8c17464..4302ef39c42e 100644
--- a/arch/x86/include/asm/perf_event.h
+++ b/arch/x86/include/asm/perf_event.h
@@ -753,6 +753,7 @@ struct x86_perf_regs {
u64 *egpr_regs;
struct apx_state *egpr;
};
+ u64 *ssp;
};

extern unsigned long perf_arch_instruction_pointer(struct pt_regs *regs);
diff --git a/arch/x86/include/uapi/asm/perf_regs.h b/arch/x86/include/uapi/asm/perf_regs.h
index 977831bd7a9d..faaa82df688d 100644
--- a/arch/x86/include/uapi/asm/perf_regs.h
+++ b/arch/x86/include/uapi/asm/perf_regs.h
@@ -30,10 +30,10 @@ enum perf_event_x86_regs {
PERF_REG_X86_R14,
PERF_REG_X86_R15,
/*
- * The eGPRs and XMM have overlaps. Only one can be used
+ * The eGPRs/SSP and XMM have overlaps. Only one can be used
* at a time. The ABI PERF_SAMPLE_REGS_ABI_SIMD is used to
* distinguish which one is used. If PERF_SAMPLE_REGS_ABI_SIMD
- * is set, then eGPRs is used, otherwise, XMM is used.
+ * is set, then eGPRs/SSP is used, otherwise, XMM is used.
*
* Extended GPRs (eGPRs)
*/
@@ -53,10 +53,11 @@ enum perf_event_x86_regs {
PERF_REG_X86_R29,
PERF_REG_X86_R30,
PERF_REG_X86_R31,
+ PERF_REG_X86_SSP,
/* These are the limits for the GPRs. */
PERF_REG_X86_32_MAX = PERF_REG_X86_GS + 1,
PERF_REG_X86_64_MAX = PERF_REG_X86_R15 + 1,
- PERF_REG_MISC_MAX = PERF_REG_X86_R31 + 1,
+ PERF_REG_MISC_MAX = PERF_REG_X86_SSP + 1,

/* These all need two bits set because they are 128bit */
PERF_REG_X86_XMM0 = 32,
diff --git a/arch/x86/kernel/perf_regs.c b/arch/x86/kernel/perf_regs.c
index b6f75196da02..7a0607b81846 100644
--- a/arch/x86/kernel/perf_regs.c
+++ b/arch/x86/kernel/perf_regs.c
@@ -72,6 +72,11 @@ u64 perf_reg_value(struct pt_regs *regs, int idx)
return 0;
return perf_regs->egpr_regs[idx - PERF_REG_X86_R16];
}
+ if (idx == PERF_REG_X86_SSP) {
+ if (!perf_regs->ssp)
+ return 0;
+ return *perf_regs->ssp;
+ }
} else {
if (idx >= PERF_REG_X86_XMM0 && idx < PERF_REG_X86_XMM_MAX) {
if (!perf_regs->xmm_regs)
--
2.34.1