1 // SPDX-License-Identifier: GPL-2.0
2 #include <asm/insn.h>
3
4 #include "perf_event.h"
5
decode_branch_type(struct insn * insn)6 static int decode_branch_type(struct insn *insn)
7 {
8 int ext;
9
10 if (insn_get_opcode(insn))
11 return X86_BR_ABORT;
12
13 switch (insn->opcode.bytes[0]) {
14 case 0xf:
15 switch (insn->opcode.bytes[1]) {
16 case 0x05: /* syscall */
17 case 0x34: /* sysenter */
18 return X86_BR_SYSCALL;
19 case 0x07: /* sysret */
20 case 0x35: /* sysexit */
21 return X86_BR_SYSRET;
22 case 0x80 ... 0x8f: /* conditional */
23 return X86_BR_JCC;
24 }
25 return X86_BR_NONE;
26 case 0x70 ... 0x7f: /* conditional */
27 return X86_BR_JCC;
28 case 0xc2: /* near ret */
29 case 0xc3: /* near ret */
30 case 0xca: /* far ret */
31 case 0xcb: /* far ret */
32 return X86_BR_RET;
33 case 0xcf: /* iret */
34 return X86_BR_IRET;
35 case 0xcc ... 0xce: /* int */
36 return X86_BR_INT;
37 case 0xe8: /* call near rel */
38 if (insn_get_immediate(insn) || insn->immediate1.value == 0) {
39 /* zero length call */
40 return X86_BR_ZERO_CALL;
41 }
42 fallthrough;
43 case 0x9a: /* call far absolute */
44 return X86_BR_CALL;
45 case 0xe0 ... 0xe3: /* loop jmp */
46 return X86_BR_JCC;
47 case 0xe9 ... 0xeb: /* jmp */
48 return X86_BR_JMP;
49 case 0xff: /* call near absolute, call far absolute ind */
50 if (insn_get_modrm(insn))
51 return X86_BR_ABORT;
52
53 ext = (insn->modrm.bytes[0] >> 3) & 0x7;
54 switch (ext) {
55 case 2: /* near ind call */
56 case 3: /* far ind call */
57 return X86_BR_IND_CALL;
58 case 4:
59 case 5:
60 return X86_BR_IND_JMP;
61 }
62 return X86_BR_NONE;
63 }
64
65 return X86_BR_NONE;
66 }
67
68 /*
69 * return the type of control flow change at address "from"
70 * instruction is not necessarily a branch (in case of interrupt).
71 *
72 * The branch type returned also includes the priv level of the
73 * target of the control flow change (X86_BR_USER, X86_BR_KERNEL).
74 *
75 * If a branch type is unknown OR the instruction cannot be
76 * decoded (e.g., text page not present), then X86_BR_NONE is
77 * returned.
78 *
79 * While recording branches, some processors can report the "from"
80 * address to be that of an instruction preceding the actual branch
81 * when instruction fusion occurs. If fusion is expected, attempt to
82 * find the type of the first branch instruction within the next
83 * MAX_INSN_SIZE bytes and if found, provide the offset between the
84 * reported "from" address and the actual branch instruction address.
85 */
get_branch_type(unsigned long from,unsigned long to,int abort,bool fused,int * offset)86 static int get_branch_type(unsigned long from, unsigned long to, int abort,
87 bool fused, int *offset)
88 {
89 struct insn insn;
90 void *addr;
91 int bytes_read, bytes_left, insn_offset;
92 int ret = X86_BR_NONE;
93 int to_plm, from_plm;
94 u8 buf[MAX_INSN_SIZE];
95 int is64 = 0;
96
97 /* make sure we initialize offset */
98 if (offset)
99 *offset = 0;
100
101 to_plm = kernel_ip(to) ? X86_BR_KERNEL : X86_BR_USER;
102 from_plm = kernel_ip(from) ? X86_BR_KERNEL : X86_BR_USER;
103
104 /*
105 * maybe zero if lbr did not fill up after a reset by the time
106 * we get a PMU interrupt
107 */
108 if (from == 0 || to == 0)
109 return X86_BR_NONE;
110
111 if (abort)
112 return X86_BR_ABORT | to_plm;
113
114 if (from_plm == X86_BR_USER) {
115 /*
116 * can happen if measuring at the user level only
117 * and we interrupt in a kernel thread, e.g., idle.
118 */
119 if (!current->mm)
120 return X86_BR_NONE;
121
122 /* may fail if text not present */
123 bytes_left = copy_from_user_nmi(buf, (void __user *)from,
124 MAX_INSN_SIZE);
125 bytes_read = MAX_INSN_SIZE - bytes_left;
126 if (!bytes_read)
127 return X86_BR_NONE;
128
129 addr = buf;
130 } else {
131 /*
132 * The LBR logs any address in the IP, even if the IP just
133 * faulted. This means userspace can control the from address.
134 * Ensure we don't blindly read any address by validating it is
135 * a known text address.
136 */
137 if (kernel_text_address(from)) {
138 addr = (void *)from;
139 /*
140 * Assume we can get the maximum possible size
141 * when grabbing kernel data. This is not
142 * _strictly_ true since we could possibly be
143 * executing up next to a memory hole, but
144 * it is very unlikely to be a problem.
145 */
146 bytes_read = MAX_INSN_SIZE;
147 } else {
148 return X86_BR_NONE;
149 }
150 }
151
152 /*
153 * decoder needs to know the ABI especially
154 * on 64-bit systems running 32-bit apps
155 */
156 #ifdef CONFIG_X86_64
157 is64 = kernel_ip((unsigned long)addr) || any_64bit_mode(current_pt_regs());
158 #endif
159 insn_init(&insn, addr, bytes_read, is64);
160 ret = decode_branch_type(&insn);
161 insn_offset = 0;
162
163 /* Check for the possibility of branch fusion */
164 while (fused && ret == X86_BR_NONE) {
165 /* Check for decoding errors */
166 if (insn_get_length(&insn) || !insn.length)
167 break;
168
169 insn_offset += insn.length;
170 bytes_read -= insn.length;
171 if (bytes_read < 0)
172 break;
173
174 insn_init(&insn, addr + insn_offset, bytes_read, is64);
175 ret = decode_branch_type(&insn);
176 }
177
178 if (offset)
179 *offset = insn_offset;
180
181 /*
182 * interrupts, traps, faults (and thus ring transition) may
183 * occur on any instructions. Thus, to classify them correctly,
184 * we need to first look at the from and to priv levels. If they
185 * are different and to is in the kernel, then it indicates
186 * a ring transition. If the from instruction is not a ring
187 * transition instr (syscall, systenter, int), then it means
188 * it was a irq, trap or fault.
189 *
190 * we have no way of detecting kernel to kernel faults.
191 */
192 if (from_plm == X86_BR_USER && to_plm == X86_BR_KERNEL
193 && ret != X86_BR_SYSCALL && ret != X86_BR_INT)
194 ret = X86_BR_IRQ;
195
196 /*
197 * branch priv level determined by target as
198 * is done by HW when LBR_SELECT is implemented
199 */
200 if (ret != X86_BR_NONE)
201 ret |= to_plm;
202
203 return ret;
204 }
205
branch_type(unsigned long from,unsigned long to,int abort)206 int branch_type(unsigned long from, unsigned long to, int abort)
207 {
208 return get_branch_type(from, to, abort, false, NULL);
209 }
210
branch_type_fused(unsigned long from,unsigned long to,int abort,int * offset)211 int branch_type_fused(unsigned long from, unsigned long to, int abort,
212 int *offset)
213 {
214 return get_branch_type(from, to, abort, true, offset);
215 }
216
217 #define X86_BR_TYPE_MAP_MAX 16
218
219 static int branch_map[X86_BR_TYPE_MAP_MAX] = {
220 PERF_BR_CALL, /* X86_BR_CALL */
221 PERF_BR_RET, /* X86_BR_RET */
222 PERF_BR_SYSCALL, /* X86_BR_SYSCALL */
223 PERF_BR_SYSRET, /* X86_BR_SYSRET */
224 PERF_BR_UNKNOWN, /* X86_BR_INT */
225 PERF_BR_ERET, /* X86_BR_IRET */
226 PERF_BR_COND, /* X86_BR_JCC */
227 PERF_BR_UNCOND, /* X86_BR_JMP */
228 PERF_BR_IRQ, /* X86_BR_IRQ */
229 PERF_BR_IND_CALL, /* X86_BR_IND_CALL */
230 PERF_BR_UNKNOWN, /* X86_BR_ABORT */
231 PERF_BR_UNKNOWN, /* X86_BR_IN_TX */
232 PERF_BR_NO_TX, /* X86_BR_NO_TX */
233 PERF_BR_CALL, /* X86_BR_ZERO_CALL */
234 PERF_BR_UNKNOWN, /* X86_BR_CALL_STACK */
235 PERF_BR_IND, /* X86_BR_IND_JMP */
236 };
237
common_branch_type(int type)238 int common_branch_type(int type)
239 {
240 int i;
241
242 type >>= 2; /* skip X86_BR_USER and X86_BR_KERNEL */
243
244 if (type) {
245 i = __ffs(type);
246 if (i < X86_BR_TYPE_MAP_MAX)
247 return branch_map[i];
248 }
249
250 return PERF_BR_UNKNOWN;
251 }
252