1 // SPDX-License-Identifier: GPL-2.0
2 #include <linux/perf_event.h>
3 #include <linux/types.h>
5 #include <asm/perf_event.h>
9 #include "../perf_event.h"
13 LBR_FORMAT_LIP
= 0x01,
14 LBR_FORMAT_EIP
= 0x02,
15 LBR_FORMAT_EIP_FLAGS
= 0x03,
16 LBR_FORMAT_EIP_FLAGS2
= 0x04,
17 LBR_FORMAT_INFO
= 0x05,
18 LBR_FORMAT_TIME
= 0x06,
19 LBR_FORMAT_MAX_KNOWN
= LBR_FORMAT_TIME
,
25 } lbr_desc
[LBR_FORMAT_MAX_KNOWN
+ 1] = {
26 [LBR_FORMAT_EIP_FLAGS
] = LBR_EIP_FLAGS
,
27 [LBR_FORMAT_EIP_FLAGS2
] = LBR_EIP_FLAGS
| LBR_TSX
,
31 * Intel LBR_SELECT bits
32 * Intel Vol3a, April 2011, Section 16.7 Table 16-10
34 * Hardware branch filter (not available on all CPUs)
36 #define LBR_KERNEL_BIT 0 /* do not capture at ring0 */
37 #define LBR_USER_BIT 1 /* do not capture at ring > 0 */
38 #define LBR_JCC_BIT 2 /* do not capture conditional branches */
39 #define LBR_REL_CALL_BIT 3 /* do not capture relative calls */
40 #define LBR_IND_CALL_BIT 4 /* do not capture indirect calls */
41 #define LBR_RETURN_BIT 5 /* do not capture near returns */
42 #define LBR_IND_JMP_BIT 6 /* do not capture indirect jumps */
43 #define LBR_REL_JMP_BIT 7 /* do not capture relative jumps */
44 #define LBR_FAR_BIT 8 /* do not capture far branches */
45 #define LBR_CALL_STACK_BIT 9 /* enable call stack */
48 * Following bit only exists in Linux; we mask it out before writing it to
49 * the actual MSR. But it helps the constraint perf code to understand
50 * that this is a separate configuration.
52 #define LBR_NO_INFO_BIT 63 /* don't read LBR_INFO. */
54 #define LBR_KERNEL (1 << LBR_KERNEL_BIT)
55 #define LBR_USER (1 << LBR_USER_BIT)
56 #define LBR_JCC (1 << LBR_JCC_BIT)
57 #define LBR_REL_CALL (1 << LBR_REL_CALL_BIT)
58 #define LBR_IND_CALL (1 << LBR_IND_CALL_BIT)
59 #define LBR_RETURN (1 << LBR_RETURN_BIT)
60 #define LBR_REL_JMP (1 << LBR_REL_JMP_BIT)
61 #define LBR_IND_JMP (1 << LBR_IND_JMP_BIT)
62 #define LBR_FAR (1 << LBR_FAR_BIT)
63 #define LBR_CALL_STACK (1 << LBR_CALL_STACK_BIT)
64 #define LBR_NO_INFO (1ULL << LBR_NO_INFO_BIT)
66 #define LBR_PLM (LBR_KERNEL | LBR_USER)
68 #define LBR_SEL_MASK 0x3ff /* valid bits in LBR_SELECT */
69 #define LBR_NOT_SUPP -1 /* LBR filter not supported */
70 #define LBR_IGN 0 /* ignored */
81 #define LBR_FROM_FLAG_MISPRED BIT_ULL(63)
82 #define LBR_FROM_FLAG_IN_TX BIT_ULL(62)
83 #define LBR_FROM_FLAG_ABORT BIT_ULL(61)
85 #define LBR_FROM_SIGNEXT_2MSB (BIT_ULL(60) | BIT_ULL(59))
88 * x86control flow change classification
89 * x86control flow changes include branches, interrupts, traps, faults
92 X86_BR_NONE
= 0, /* unknown */
94 X86_BR_USER
= 1 << 0, /* branch target is user */
95 X86_BR_KERNEL
= 1 << 1, /* branch target is kernel */
97 X86_BR_CALL
= 1 << 2, /* call */
98 X86_BR_RET
= 1 << 3, /* return */
99 X86_BR_SYSCALL
= 1 << 4, /* syscall */
100 X86_BR_SYSRET
= 1 << 5, /* syscall return */
101 X86_BR_INT
= 1 << 6, /* sw interrupt */
102 X86_BR_IRET
= 1 << 7, /* return from interrupt */
103 X86_BR_JCC
= 1 << 8, /* conditional */
104 X86_BR_JMP
= 1 << 9, /* jump */
105 X86_BR_IRQ
= 1 << 10,/* hw interrupt or trap or fault */
106 X86_BR_IND_CALL
= 1 << 11,/* indirect calls */
107 X86_BR_ABORT
= 1 << 12,/* transaction abort */
108 X86_BR_IN_TX
= 1 << 13,/* in transaction */
109 X86_BR_NO_TX
= 1 << 14,/* not in transaction */
110 X86_BR_ZERO_CALL
= 1 << 15,/* zero length call */
111 X86_BR_CALL_STACK
= 1 << 16,/* call stack */
112 X86_BR_IND_JMP
= 1 << 17,/* indirect jump */
114 X86_BR_TYPE_SAVE
= 1 << 18,/* indicate to save branch type */
118 #define X86_BR_PLM (X86_BR_USER | X86_BR_KERNEL)
119 #define X86_BR_ANYTX (X86_BR_NO_TX | X86_BR_IN_TX)
136 #define X86_BR_ALL (X86_BR_PLM | X86_BR_ANY)
138 #define X86_BR_ANY_CALL \
146 static void intel_pmu_lbr_filter(struct cpu_hw_events
*cpuc
);
149 * We only support LBR implementations that have FREEZE_LBRS_ON_PMI
150 * otherwise it becomes near impossible to get a reliable stack.
153 static void __intel_pmu_lbr_enable(bool pmi
)
155 struct cpu_hw_events
*cpuc
= this_cpu_ptr(&cpu_hw_events
);
156 u64 debugctl
, lbr_select
= 0, orig_debugctl
;
159 * No need to unfreeze manually, as v4 can do that as part
160 * of the GLOBAL_STATUS ack.
162 if (pmi
&& x86_pmu
.version
>= 4)
166 * No need to reprogram LBR_SELECT in a PMI, as it
170 lbr_select
= cpuc
->lbr_sel
->config
& x86_pmu
.lbr_sel_mask
;
171 if (!pmi
&& cpuc
->lbr_sel
)
172 wrmsrl(MSR_LBR_SELECT
, lbr_select
);
174 rdmsrl(MSR_IA32_DEBUGCTLMSR
, debugctl
);
175 orig_debugctl
= debugctl
;
176 debugctl
|= DEBUGCTLMSR_LBR
;
178 * LBR callstack does not work well with FREEZE_LBRS_ON_PMI.
179 * If FREEZE_LBRS_ON_PMI is set, PMI near call/return instructions
180 * may cause superfluous increase/decrease of LBR_TOS.
182 if (!(lbr_select
& LBR_CALL_STACK
))
183 debugctl
|= DEBUGCTLMSR_FREEZE_LBRS_ON_PMI
;
184 if (orig_debugctl
!= debugctl
)
185 wrmsrl(MSR_IA32_DEBUGCTLMSR
, debugctl
);
188 static void __intel_pmu_lbr_disable(void)
192 rdmsrl(MSR_IA32_DEBUGCTLMSR
, debugctl
);
193 debugctl
&= ~(DEBUGCTLMSR_LBR
| DEBUGCTLMSR_FREEZE_LBRS_ON_PMI
);
194 wrmsrl(MSR_IA32_DEBUGCTLMSR
, debugctl
);
197 static void intel_pmu_lbr_reset_32(void)
201 for (i
= 0; i
< x86_pmu
.lbr_nr
; i
++)
202 wrmsrl(x86_pmu
.lbr_from
+ i
, 0);
205 static void intel_pmu_lbr_reset_64(void)
209 for (i
= 0; i
< x86_pmu
.lbr_nr
; i
++) {
210 wrmsrl(x86_pmu
.lbr_from
+ i
, 0);
211 wrmsrl(x86_pmu
.lbr_to
+ i
, 0);
212 if (x86_pmu
.intel_cap
.lbr_format
== LBR_FORMAT_INFO
)
213 wrmsrl(MSR_LBR_INFO_0
+ i
, 0);
217 void intel_pmu_lbr_reset(void)
219 struct cpu_hw_events
*cpuc
= this_cpu_ptr(&cpu_hw_events
);
224 if (x86_pmu
.intel_cap
.lbr_format
== LBR_FORMAT_32
)
225 intel_pmu_lbr_reset_32();
227 intel_pmu_lbr_reset_64();
229 cpuc
->last_task_ctx
= NULL
;
230 cpuc
->last_log_id
= 0;
234 * TOS = most recently recorded branch
236 static inline u64
intel_pmu_lbr_tos(void)
240 rdmsrl(x86_pmu
.lbr_tos
, tos
);
250 * For formats with LBR_TSX flags (e.g. LBR_FORMAT_EIP_FLAGS2), bits 61:62 in
251 * MSR_LAST_BRANCH_FROM_x are the TSX flags when TSX is supported, but when
252 * TSX is not supported they have no consistent behavior:
254 * - For wrmsr(), bits 61:62 are considered part of the sign extension.
255 * - For HW updates (branch captures) bits 61:62 are always OFF and are not
256 * part of the sign extension.
260 * 1) LBR has TSX format
261 * 2) CPU has no TSX support enabled
263 * ... then any value passed to wrmsr() must be sign extended to 63 bits and any
264 * value from rdmsr() must be converted to have a 61 bits sign extension,
265 * ignoring the TSX flags.
267 static inline bool lbr_from_signext_quirk_needed(void)
269 int lbr_format
= x86_pmu
.intel_cap
.lbr_format
;
270 bool tsx_support
= boot_cpu_has(X86_FEATURE_HLE
) ||
271 boot_cpu_has(X86_FEATURE_RTM
);
273 return !tsx_support
&& (lbr_desc
[lbr_format
] & LBR_TSX
);
276 static DEFINE_STATIC_KEY_FALSE(lbr_from_quirk_key
);
278 /* If quirk is enabled, ensure sign extension is 63 bits: */
279 inline u64
lbr_from_signext_quirk_wr(u64 val
)
281 if (static_branch_unlikely(&lbr_from_quirk_key
)) {
283 * Sign extend into bits 61:62 while preserving bit 63.
285 * Quirk is enabled when TSX is disabled. Therefore TSX bits
286 * in val are always OFF and must be changed to be sign
287 * extension bits. Since bits 59:60 are guaranteed to be
288 * part of the sign extension bits, we can just copy them
291 val
|= (LBR_FROM_SIGNEXT_2MSB
& val
) << 2;
297 * If quirk is needed, ensure sign extension is 61 bits:
299 static u64
lbr_from_signext_quirk_rd(u64 val
)
301 if (static_branch_unlikely(&lbr_from_quirk_key
)) {
303 * Quirk is on when TSX is not enabled. Therefore TSX
304 * flags must be read as OFF.
306 val
&= ~(LBR_FROM_FLAG_IN_TX
| LBR_FROM_FLAG_ABORT
);
311 static inline void wrlbr_from(unsigned int idx
, u64 val
)
313 val
= lbr_from_signext_quirk_wr(val
);
314 wrmsrl(x86_pmu
.lbr_from
+ idx
, val
);
317 static inline void wrlbr_to(unsigned int idx
, u64 val
)
319 wrmsrl(x86_pmu
.lbr_to
+ idx
, val
);
322 static inline u64
rdlbr_from(unsigned int idx
)
326 rdmsrl(x86_pmu
.lbr_from
+ idx
, val
);
328 return lbr_from_signext_quirk_rd(val
);
331 static inline u64
rdlbr_to(unsigned int idx
)
335 rdmsrl(x86_pmu
.lbr_to
+ idx
, val
);
340 static void __intel_pmu_lbr_restore(struct x86_perf_task_context
*task_ctx
)
342 struct cpu_hw_events
*cpuc
= this_cpu_ptr(&cpu_hw_events
);
344 unsigned lbr_idx
, mask
;
347 if (task_ctx
->lbr_callstack_users
== 0 ||
348 task_ctx
->lbr_stack_state
== LBR_NONE
) {
349 intel_pmu_lbr_reset();
355 * Does not restore the LBR registers, if
356 * - No one else touched them, and
359 if ((task_ctx
== cpuc
->last_task_ctx
) &&
360 (task_ctx
->log_id
== cpuc
->last_log_id
) &&
362 task_ctx
->lbr_stack_state
= LBR_NONE
;
366 mask
= x86_pmu
.lbr_nr
- 1;
367 for (i
= 0; i
< task_ctx
->valid_lbrs
; i
++) {
368 lbr_idx
= (tos
- i
) & mask
;
369 wrlbr_from(lbr_idx
, task_ctx
->lbr_from
[i
]);
370 wrlbr_to (lbr_idx
, task_ctx
->lbr_to
[i
]);
372 if (x86_pmu
.intel_cap
.lbr_format
== LBR_FORMAT_INFO
)
373 wrmsrl(MSR_LBR_INFO_0
+ lbr_idx
, task_ctx
->lbr_info
[i
]);
376 for (; i
< x86_pmu
.lbr_nr
; i
++) {
377 lbr_idx
= (tos
- i
) & mask
;
378 wrlbr_from(lbr_idx
, 0);
379 wrlbr_to(lbr_idx
, 0);
380 if (x86_pmu
.intel_cap
.lbr_format
== LBR_FORMAT_INFO
)
381 wrmsrl(MSR_LBR_INFO_0
+ lbr_idx
, 0);
384 wrmsrl(x86_pmu
.lbr_tos
, tos
);
385 task_ctx
->lbr_stack_state
= LBR_NONE
;
388 static void __intel_pmu_lbr_save(struct x86_perf_task_context
*task_ctx
)
390 struct cpu_hw_events
*cpuc
= this_cpu_ptr(&cpu_hw_events
);
391 unsigned lbr_idx
, mask
;
395 if (task_ctx
->lbr_callstack_users
== 0) {
396 task_ctx
->lbr_stack_state
= LBR_NONE
;
400 mask
= x86_pmu
.lbr_nr
- 1;
401 tos
= intel_pmu_lbr_tos();
402 for (i
= 0; i
< x86_pmu
.lbr_nr
; i
++) {
403 lbr_idx
= (tos
- i
) & mask
;
404 from
= rdlbr_from(lbr_idx
);
407 task_ctx
->lbr_from
[i
] = from
;
408 task_ctx
->lbr_to
[i
] = rdlbr_to(lbr_idx
);
409 if (x86_pmu
.intel_cap
.lbr_format
== LBR_FORMAT_INFO
)
410 rdmsrl(MSR_LBR_INFO_0
+ lbr_idx
, task_ctx
->lbr_info
[i
]);
412 task_ctx
->valid_lbrs
= i
;
414 task_ctx
->lbr_stack_state
= LBR_VALID
;
416 cpuc
->last_task_ctx
= task_ctx
;
417 cpuc
->last_log_id
= ++task_ctx
->log_id
;
420 void intel_pmu_lbr_swap_task_ctx(struct perf_event_context
*prev
,
421 struct perf_event_context
*next
)
423 struct x86_perf_task_context
*prev_ctx_data
, *next_ctx_data
;
425 swap(prev
->task_ctx_data
, next
->task_ctx_data
);
428 * Architecture specific synchronization makes sense in
429 * case both prev->task_ctx_data and next->task_ctx_data
430 * pointers are allocated.
433 prev_ctx_data
= next
->task_ctx_data
;
434 next_ctx_data
= prev
->task_ctx_data
;
436 if (!prev_ctx_data
|| !next_ctx_data
)
439 swap(prev_ctx_data
->lbr_callstack_users
,
440 next_ctx_data
->lbr_callstack_users
);
443 void intel_pmu_lbr_sched_task(struct perf_event_context
*ctx
, bool sched_in
)
445 struct cpu_hw_events
*cpuc
= this_cpu_ptr(&cpu_hw_events
);
446 struct x86_perf_task_context
*task_ctx
;
448 if (!cpuc
->lbr_users
)
452 * If LBR callstack feature is enabled and the stack was saved when
453 * the task was scheduled out, restore the stack. Otherwise flush
456 task_ctx
= ctx
? ctx
->task_ctx_data
: NULL
;
459 __intel_pmu_lbr_restore(task_ctx
);
461 __intel_pmu_lbr_save(task_ctx
);
466 * Since a context switch can flip the address space and LBR entries
467 * are not tagged with an identifier, we need to wipe the LBR, even for
468 * per-cpu events. You simply cannot resolve the branches from the old
472 intel_pmu_lbr_reset();
475 static inline bool branch_user_callstack(unsigned br_sel
)
477 return (br_sel
& X86_BR_USER
) && (br_sel
& X86_BR_CALL_STACK
);
480 void intel_pmu_lbr_add(struct perf_event
*event
)
482 struct cpu_hw_events
*cpuc
= this_cpu_ptr(&cpu_hw_events
);
483 struct x86_perf_task_context
*task_ctx
;
488 cpuc
->br_sel
= event
->hw
.branch_reg
.reg
;
490 if (branch_user_callstack(cpuc
->br_sel
) && event
->ctx
->task_ctx_data
) {
491 task_ctx
= event
->ctx
->task_ctx_data
;
492 task_ctx
->lbr_callstack_users
++;
496 * Request pmu::sched_task() callback, which will fire inside the
497 * regular perf event scheduling, so that call will:
499 * - restore or wipe; when LBR-callstack,
502 * when this is from __perf_event_task_sched_in().
504 * However, if this is from perf_install_in_context(), no such callback
505 * will follow and we'll need to reset the LBR here if this is the
508 * The problem is, we cannot tell these cases apart... but we can
509 * exclude the biggest chunk of cases by looking at
510 * event->total_time_running. An event that has accrued runtime cannot
511 * be 'new'. Conversely, a new event can get installed through the
512 * context switch path for the first time.
514 if (x86_pmu
.intel_cap
.pebs_baseline
&& event
->attr
.precise_ip
> 0)
515 cpuc
->lbr_pebs_users
++;
516 perf_sched_cb_inc(event
->ctx
->pmu
);
517 if (!cpuc
->lbr_users
++ && !event
->total_time_running
)
518 intel_pmu_lbr_reset();
521 void intel_pmu_lbr_del(struct perf_event
*event
)
523 struct cpu_hw_events
*cpuc
= this_cpu_ptr(&cpu_hw_events
);
524 struct x86_perf_task_context
*task_ctx
;
529 if (branch_user_callstack(cpuc
->br_sel
) &&
530 event
->ctx
->task_ctx_data
) {
531 task_ctx
= event
->ctx
->task_ctx_data
;
532 task_ctx
->lbr_callstack_users
--;
535 if (x86_pmu
.intel_cap
.pebs_baseline
&& event
->attr
.precise_ip
> 0)
536 cpuc
->lbr_pebs_users
--;
538 WARN_ON_ONCE(cpuc
->lbr_users
< 0);
539 WARN_ON_ONCE(cpuc
->lbr_pebs_users
< 0);
540 perf_sched_cb_dec(event
->ctx
->pmu
);
543 void intel_pmu_lbr_enable_all(bool pmi
)
545 struct cpu_hw_events
*cpuc
= this_cpu_ptr(&cpu_hw_events
);
548 __intel_pmu_lbr_enable(pmi
);
551 void intel_pmu_lbr_disable_all(void)
553 struct cpu_hw_events
*cpuc
= this_cpu_ptr(&cpu_hw_events
);
556 __intel_pmu_lbr_disable();
559 static void intel_pmu_lbr_read_32(struct cpu_hw_events
*cpuc
)
561 unsigned long mask
= x86_pmu
.lbr_nr
- 1;
562 u64 tos
= intel_pmu_lbr_tos();
565 for (i
= 0; i
< x86_pmu
.lbr_nr
; i
++) {
566 unsigned long lbr_idx
= (tos
- i
) & mask
;
575 rdmsrl(x86_pmu
.lbr_from
+ lbr_idx
, msr_lastbranch
.lbr
);
577 cpuc
->lbr_entries
[i
].from
= msr_lastbranch
.from
;
578 cpuc
->lbr_entries
[i
].to
= msr_lastbranch
.to
;
579 cpuc
->lbr_entries
[i
].mispred
= 0;
580 cpuc
->lbr_entries
[i
].predicted
= 0;
581 cpuc
->lbr_entries
[i
].in_tx
= 0;
582 cpuc
->lbr_entries
[i
].abort
= 0;
583 cpuc
->lbr_entries
[i
].cycles
= 0;
584 cpuc
->lbr_entries
[i
].type
= 0;
585 cpuc
->lbr_entries
[i
].reserved
= 0;
587 cpuc
->lbr_stack
.nr
= i
;
591 * Due to lack of segmentation in Linux the effective address (offset)
592 * is the same as the linear address, allowing us to merge the LIP and EIP
595 static void intel_pmu_lbr_read_64(struct cpu_hw_events
*cpuc
)
597 bool need_info
= false, call_stack
= false;
598 unsigned long mask
= x86_pmu
.lbr_nr
- 1;
599 int lbr_format
= x86_pmu
.intel_cap
.lbr_format
;
600 u64 tos
= intel_pmu_lbr_tos();
603 int num
= x86_pmu
.lbr_nr
;
606 need_info
= !(cpuc
->lbr_sel
->config
& LBR_NO_INFO
);
607 if (cpuc
->lbr_sel
->config
& LBR_CALL_STACK
)
611 for (i
= 0; i
< num
; i
++) {
612 unsigned long lbr_idx
= (tos
- i
) & mask
;
613 u64 from
, to
, mis
= 0, pred
= 0, in_tx
= 0, abort
= 0;
616 int lbr_flags
= lbr_desc
[lbr_format
];
618 from
= rdlbr_from(lbr_idx
);
619 to
= rdlbr_to(lbr_idx
);
622 * Read LBR call stack entries
623 * until invalid entry (0s) is detected.
625 if (call_stack
&& !from
)
628 if (lbr_format
== LBR_FORMAT_INFO
&& need_info
) {
631 rdmsrl(MSR_LBR_INFO_0
+ lbr_idx
, info
);
632 mis
= !!(info
& LBR_INFO_MISPRED
);
634 in_tx
= !!(info
& LBR_INFO_IN_TX
);
635 abort
= !!(info
& LBR_INFO_ABORT
);
636 cycles
= (info
& LBR_INFO_CYCLES
);
639 if (lbr_format
== LBR_FORMAT_TIME
) {
640 mis
= !!(from
& LBR_FROM_FLAG_MISPRED
);
643 cycles
= ((to
>> 48) & LBR_INFO_CYCLES
);
645 to
= (u64
)((((s64
)to
) << 16) >> 16);
648 if (lbr_flags
& LBR_EIP_FLAGS
) {
649 mis
= !!(from
& LBR_FROM_FLAG_MISPRED
);
653 if (lbr_flags
& LBR_TSX
) {
654 in_tx
= !!(from
& LBR_FROM_FLAG_IN_TX
);
655 abort
= !!(from
& LBR_FROM_FLAG_ABORT
);
658 from
= (u64
)((((s64
)from
) << skip
) >> skip
);
661 * Some CPUs report duplicated abort records,
662 * with the second entry not having an abort bit set.
663 * Skip them here. This loop runs backwards,
664 * so we need to undo the previous record.
665 * If the abort just happened outside the window
666 * the extra entry cannot be removed.
668 if (abort
&& x86_pmu
.lbr_double_abort
&& out
> 0)
671 cpuc
->lbr_entries
[out
].from
= from
;
672 cpuc
->lbr_entries
[out
].to
= to
;
673 cpuc
->lbr_entries
[out
].mispred
= mis
;
674 cpuc
->lbr_entries
[out
].predicted
= pred
;
675 cpuc
->lbr_entries
[out
].in_tx
= in_tx
;
676 cpuc
->lbr_entries
[out
].abort
= abort
;
677 cpuc
->lbr_entries
[out
].cycles
= cycles
;
678 cpuc
->lbr_entries
[out
].type
= 0;
679 cpuc
->lbr_entries
[out
].reserved
= 0;
682 cpuc
->lbr_stack
.nr
= out
;
685 void intel_pmu_lbr_read(void)
687 struct cpu_hw_events
*cpuc
= this_cpu_ptr(&cpu_hw_events
);
690 * Don't read when all LBRs users are using adaptive PEBS.
692 * This could be smarter and actually check the event,
693 * but this simple approach seems to work for now.
695 if (!cpuc
->lbr_users
|| cpuc
->lbr_users
== cpuc
->lbr_pebs_users
)
698 if (x86_pmu
.intel_cap
.lbr_format
== LBR_FORMAT_32
)
699 intel_pmu_lbr_read_32(cpuc
);
701 intel_pmu_lbr_read_64(cpuc
);
703 intel_pmu_lbr_filter(cpuc
);
708 * - in case there is no HW filter
709 * - in case the HW filter has errata or limitations
711 static int intel_pmu_setup_sw_lbr_filter(struct perf_event
*event
)
713 u64 br_type
= event
->attr
.branch_sample_type
;
716 if (br_type
& PERF_SAMPLE_BRANCH_USER
)
719 if (br_type
& PERF_SAMPLE_BRANCH_KERNEL
)
720 mask
|= X86_BR_KERNEL
;
722 /* we ignore BRANCH_HV here */
724 if (br_type
& PERF_SAMPLE_BRANCH_ANY
)
727 if (br_type
& PERF_SAMPLE_BRANCH_ANY_CALL
)
728 mask
|= X86_BR_ANY_CALL
;
730 if (br_type
& PERF_SAMPLE_BRANCH_ANY_RETURN
)
731 mask
|= X86_BR_RET
| X86_BR_IRET
| X86_BR_SYSRET
;
733 if (br_type
& PERF_SAMPLE_BRANCH_IND_CALL
)
734 mask
|= X86_BR_IND_CALL
;
736 if (br_type
& PERF_SAMPLE_BRANCH_ABORT_TX
)
737 mask
|= X86_BR_ABORT
;
739 if (br_type
& PERF_SAMPLE_BRANCH_IN_TX
)
740 mask
|= X86_BR_IN_TX
;
742 if (br_type
& PERF_SAMPLE_BRANCH_NO_TX
)
743 mask
|= X86_BR_NO_TX
;
745 if (br_type
& PERF_SAMPLE_BRANCH_COND
)
748 if (br_type
& PERF_SAMPLE_BRANCH_CALL_STACK
) {
749 if (!x86_pmu_has_lbr_callstack())
751 if (mask
& ~(X86_BR_USER
| X86_BR_KERNEL
))
753 mask
|= X86_BR_CALL
| X86_BR_IND_CALL
| X86_BR_RET
|
757 if (br_type
& PERF_SAMPLE_BRANCH_IND_JUMP
)
758 mask
|= X86_BR_IND_JMP
;
760 if (br_type
& PERF_SAMPLE_BRANCH_CALL
)
761 mask
|= X86_BR_CALL
| X86_BR_ZERO_CALL
;
763 if (br_type
& PERF_SAMPLE_BRANCH_TYPE_SAVE
)
764 mask
|= X86_BR_TYPE_SAVE
;
767 * stash actual user request into reg, it may
768 * be used by fixup code for some CPU
770 event
->hw
.branch_reg
.reg
= mask
;
775 * setup the HW LBR filter
776 * Used only when available, may not be enough to disambiguate
777 * all branches, may need the help of the SW filter
779 static int intel_pmu_setup_hw_lbr_filter(struct perf_event
*event
)
781 struct hw_perf_event_extra
*reg
;
782 u64 br_type
= event
->attr
.branch_sample_type
;
786 for (i
= 0; i
< PERF_SAMPLE_BRANCH_MAX_SHIFT
; i
++) {
787 if (!(br_type
& (1ULL << i
)))
790 v
= x86_pmu
.lbr_sel_map
[i
];
791 if (v
== LBR_NOT_SUPP
)
798 reg
= &event
->hw
.branch_reg
;
799 reg
->idx
= EXTRA_REG_LBR
;
802 * The first 9 bits (LBR_SEL_MASK) in LBR_SELECT operate
803 * in suppress mode. So LBR_SELECT should be set to
804 * (~mask & LBR_SEL_MASK) | (mask & ~LBR_SEL_MASK)
805 * But the 10th bit LBR_CALL_STACK does not operate
808 reg
->config
= mask
^ (x86_pmu
.lbr_sel_mask
& ~LBR_CALL_STACK
);
810 if ((br_type
& PERF_SAMPLE_BRANCH_NO_CYCLES
) &&
811 (br_type
& PERF_SAMPLE_BRANCH_NO_FLAGS
) &&
812 (x86_pmu
.intel_cap
.lbr_format
== LBR_FORMAT_INFO
))
813 reg
->config
|= LBR_NO_INFO
;
818 int intel_pmu_setup_lbr_filter(struct perf_event
*event
)
829 * setup SW LBR filter
831 ret
= intel_pmu_setup_sw_lbr_filter(event
);
836 * setup HW LBR filter, if any
838 if (x86_pmu
.lbr_sel_map
)
839 ret
= intel_pmu_setup_hw_lbr_filter(event
);
845 * return the type of control flow change at address "from"
846 * instruction is not necessarily a branch (in case of interrupt).
848 * The branch type returned also includes the priv level of the
849 * target of the control flow change (X86_BR_USER, X86_BR_KERNEL).
851 * If a branch type is unknown OR the instruction cannot be
852 * decoded (e.g., text page not present), then X86_BR_NONE is
855 static int branch_type(unsigned long from
, unsigned long to
, int abort
)
859 int bytes_read
, bytes_left
;
860 int ret
= X86_BR_NONE
;
861 int ext
, to_plm
, from_plm
;
862 u8 buf
[MAX_INSN_SIZE
];
865 to_plm
= kernel_ip(to
) ? X86_BR_KERNEL
: X86_BR_USER
;
866 from_plm
= kernel_ip(from
) ? X86_BR_KERNEL
: X86_BR_USER
;
869 * maybe zero if lbr did not fill up after a reset by the time
870 * we get a PMU interrupt
872 if (from
== 0 || to
== 0)
876 return X86_BR_ABORT
| to_plm
;
878 if (from_plm
== X86_BR_USER
) {
880 * can happen if measuring at the user level only
881 * and we interrupt in a kernel thread, e.g., idle.
886 /* may fail if text not present */
887 bytes_left
= copy_from_user_nmi(buf
, (void __user
*)from
,
889 bytes_read
= MAX_INSN_SIZE
- bytes_left
;
896 * The LBR logs any address in the IP, even if the IP just
897 * faulted. This means userspace can control the from address.
898 * Ensure we don't blindy read any address by validating it is
899 * a known text address.
901 if (kernel_text_address(from
)) {
904 * Assume we can get the maximum possible size
905 * when grabbing kernel data. This is not
906 * _strictly_ true since we could possibly be
907 * executing up next to a memory hole, but
908 * it is very unlikely to be a problem.
910 bytes_read
= MAX_INSN_SIZE
;
917 * decoder needs to know the ABI especially
918 * on 64-bit systems running 32-bit apps
921 is64
= kernel_ip((unsigned long)addr
) || !test_thread_flag(TIF_IA32
);
923 insn_init(&insn
, addr
, bytes_read
, is64
);
924 insn_get_opcode(&insn
);
925 if (!insn
.opcode
.got
)
928 switch (insn
.opcode
.bytes
[0]) {
930 switch (insn
.opcode
.bytes
[1]) {
931 case 0x05: /* syscall */
932 case 0x34: /* sysenter */
933 ret
= X86_BR_SYSCALL
;
935 case 0x07: /* sysret */
936 case 0x35: /* sysexit */
939 case 0x80 ... 0x8f: /* conditional */
946 case 0x70 ... 0x7f: /* conditional */
949 case 0xc2: /* near ret */
950 case 0xc3: /* near ret */
951 case 0xca: /* far ret */
952 case 0xcb: /* far ret */
955 case 0xcf: /* iret */
958 case 0xcc ... 0xce: /* int */
961 case 0xe8: /* call near rel */
962 insn_get_immediate(&insn
);
963 if (insn
.immediate1
.value
== 0) {
964 /* zero length call */
965 ret
= X86_BR_ZERO_CALL
;
969 case 0x9a: /* call far absolute */
972 case 0xe0 ... 0xe3: /* loop jmp */
975 case 0xe9 ... 0xeb: /* jmp */
978 case 0xff: /* call near absolute, call far absolute ind */
979 insn_get_modrm(&insn
);
980 ext
= (insn
.modrm
.bytes
[0] >> 3) & 0x7;
982 case 2: /* near ind call */
983 case 3: /* far ind call */
984 ret
= X86_BR_IND_CALL
;
988 ret
= X86_BR_IND_JMP
;
996 * interrupts, traps, faults (and thus ring transition) may
997 * occur on any instructions. Thus, to classify them correctly,
998 * we need to first look at the from and to priv levels. If they
999 * are different and to is in the kernel, then it indicates
1000 * a ring transition. If the from instruction is not a ring
1001 * transition instr (syscall, systenter, int), then it means
1002 * it was a irq, trap or fault.
1004 * we have no way of detecting kernel to kernel faults.
1006 if (from_plm
== X86_BR_USER
&& to_plm
== X86_BR_KERNEL
1007 && ret
!= X86_BR_SYSCALL
&& ret
!= X86_BR_INT
)
1011 * branch priv level determined by target as
1012 * is done by HW when LBR_SELECT is implemented
1014 if (ret
!= X86_BR_NONE
)
1020 #define X86_BR_TYPE_MAP_MAX 16
1022 static int branch_map
[X86_BR_TYPE_MAP_MAX
] = {
1023 PERF_BR_CALL
, /* X86_BR_CALL */
1024 PERF_BR_RET
, /* X86_BR_RET */
1025 PERF_BR_SYSCALL
, /* X86_BR_SYSCALL */
1026 PERF_BR_SYSRET
, /* X86_BR_SYSRET */
1027 PERF_BR_UNKNOWN
, /* X86_BR_INT */
1028 PERF_BR_UNKNOWN
, /* X86_BR_IRET */
1029 PERF_BR_COND
, /* X86_BR_JCC */
1030 PERF_BR_UNCOND
, /* X86_BR_JMP */
1031 PERF_BR_UNKNOWN
, /* X86_BR_IRQ */
1032 PERF_BR_IND_CALL
, /* X86_BR_IND_CALL */
1033 PERF_BR_UNKNOWN
, /* X86_BR_ABORT */
1034 PERF_BR_UNKNOWN
, /* X86_BR_IN_TX */
1035 PERF_BR_UNKNOWN
, /* X86_BR_NO_TX */
1036 PERF_BR_CALL
, /* X86_BR_ZERO_CALL */
1037 PERF_BR_UNKNOWN
, /* X86_BR_CALL_STACK */
1038 PERF_BR_IND
, /* X86_BR_IND_JMP */
1042 common_branch_type(int type
)
1046 type
>>= 2; /* skip X86_BR_USER and X86_BR_KERNEL */
1050 if (i
< X86_BR_TYPE_MAP_MAX
)
1051 return branch_map
[i
];
1054 return PERF_BR_UNKNOWN
;
1058 * implement actual branch filter based on user demand.
1059 * Hardware may not exactly satisfy that request, thus
1060 * we need to inspect opcodes. Mismatched branches are
1061 * discarded. Therefore, the number of branches returned
1062 * in PERF_SAMPLE_BRANCH_STACK sample may vary.
1065 intel_pmu_lbr_filter(struct cpu_hw_events
*cpuc
)
1068 int br_sel
= cpuc
->br_sel
;
1070 bool compress
= false;
1072 /* if sampling all branches, then nothing to filter */
1073 if (((br_sel
& X86_BR_ALL
) == X86_BR_ALL
) &&
1074 ((br_sel
& X86_BR_TYPE_SAVE
) != X86_BR_TYPE_SAVE
))
1077 for (i
= 0; i
< cpuc
->lbr_stack
.nr
; i
++) {
1079 from
= cpuc
->lbr_entries
[i
].from
;
1080 to
= cpuc
->lbr_entries
[i
].to
;
1082 type
= branch_type(from
, to
, cpuc
->lbr_entries
[i
].abort
);
1083 if (type
!= X86_BR_NONE
&& (br_sel
& X86_BR_ANYTX
)) {
1084 if (cpuc
->lbr_entries
[i
].in_tx
)
1085 type
|= X86_BR_IN_TX
;
1087 type
|= X86_BR_NO_TX
;
1090 /* if type does not correspond, then discard */
1091 if (type
== X86_BR_NONE
|| (br_sel
& type
) != type
) {
1092 cpuc
->lbr_entries
[i
].from
= 0;
1096 if ((br_sel
& X86_BR_TYPE_SAVE
) == X86_BR_TYPE_SAVE
)
1097 cpuc
->lbr_entries
[i
].type
= common_branch_type(type
);
1103 /* remove all entries with from=0 */
1104 for (i
= 0; i
< cpuc
->lbr_stack
.nr
; ) {
1105 if (!cpuc
->lbr_entries
[i
].from
) {
1107 while (++j
< cpuc
->lbr_stack
.nr
)
1108 cpuc
->lbr_entries
[j
-1] = cpuc
->lbr_entries
[j
];
1109 cpuc
->lbr_stack
.nr
--;
1110 if (!cpuc
->lbr_entries
[i
].from
)
1117 void intel_pmu_store_pebs_lbrs(struct pebs_lbr
*lbr
)
1119 struct cpu_hw_events
*cpuc
= this_cpu_ptr(&cpu_hw_events
);
1122 cpuc
->lbr_stack
.nr
= x86_pmu
.lbr_nr
;
1123 for (i
= 0; i
< x86_pmu
.lbr_nr
; i
++) {
1124 u64 info
= lbr
->lbr
[i
].info
;
1125 struct perf_branch_entry
*e
= &cpuc
->lbr_entries
[i
];
1127 e
->from
= lbr
->lbr
[i
].from
;
1128 e
->to
= lbr
->lbr
[i
].to
;
1129 e
->mispred
= !!(info
& LBR_INFO_MISPRED
);
1130 e
->predicted
= !(info
& LBR_INFO_MISPRED
);
1131 e
->in_tx
= !!(info
& LBR_INFO_IN_TX
);
1132 e
->abort
= !!(info
& LBR_INFO_ABORT
);
1133 e
->cycles
= info
& LBR_INFO_CYCLES
;
1136 intel_pmu_lbr_filter(cpuc
);
1140 * Map interface branch filters onto LBR filters
1142 static const int nhm_lbr_sel_map
[PERF_SAMPLE_BRANCH_MAX_SHIFT
] = {
1143 [PERF_SAMPLE_BRANCH_ANY_SHIFT
] = LBR_ANY
,
1144 [PERF_SAMPLE_BRANCH_USER_SHIFT
] = LBR_USER
,
1145 [PERF_SAMPLE_BRANCH_KERNEL_SHIFT
] = LBR_KERNEL
,
1146 [PERF_SAMPLE_BRANCH_HV_SHIFT
] = LBR_IGN
,
1147 [PERF_SAMPLE_BRANCH_ANY_RETURN_SHIFT
] = LBR_RETURN
| LBR_REL_JMP
1148 | LBR_IND_JMP
| LBR_FAR
,
1150 * NHM/WSM erratum: must include REL_JMP+IND_JMP to get CALL branches
1152 [PERF_SAMPLE_BRANCH_ANY_CALL_SHIFT
] =
1153 LBR_REL_CALL
| LBR_IND_CALL
| LBR_REL_JMP
| LBR_IND_JMP
| LBR_FAR
,
1155 * NHM/WSM erratum: must include IND_JMP to capture IND_CALL
1157 [PERF_SAMPLE_BRANCH_IND_CALL_SHIFT
] = LBR_IND_CALL
| LBR_IND_JMP
,
1158 [PERF_SAMPLE_BRANCH_COND_SHIFT
] = LBR_JCC
,
1159 [PERF_SAMPLE_BRANCH_IND_JUMP_SHIFT
] = LBR_IND_JMP
,
1162 static const int snb_lbr_sel_map
[PERF_SAMPLE_BRANCH_MAX_SHIFT
] = {
1163 [PERF_SAMPLE_BRANCH_ANY_SHIFT
] = LBR_ANY
,
1164 [PERF_SAMPLE_BRANCH_USER_SHIFT
] = LBR_USER
,
1165 [PERF_SAMPLE_BRANCH_KERNEL_SHIFT
] = LBR_KERNEL
,
1166 [PERF_SAMPLE_BRANCH_HV_SHIFT
] = LBR_IGN
,
1167 [PERF_SAMPLE_BRANCH_ANY_RETURN_SHIFT
] = LBR_RETURN
| LBR_FAR
,
1168 [PERF_SAMPLE_BRANCH_ANY_CALL_SHIFT
] = LBR_REL_CALL
| LBR_IND_CALL
1170 [PERF_SAMPLE_BRANCH_IND_CALL_SHIFT
] = LBR_IND_CALL
,
1171 [PERF_SAMPLE_BRANCH_COND_SHIFT
] = LBR_JCC
,
1172 [PERF_SAMPLE_BRANCH_IND_JUMP_SHIFT
] = LBR_IND_JMP
,
1173 [PERF_SAMPLE_BRANCH_CALL_SHIFT
] = LBR_REL_CALL
,
1176 static const int hsw_lbr_sel_map
[PERF_SAMPLE_BRANCH_MAX_SHIFT
] = {
1177 [PERF_SAMPLE_BRANCH_ANY_SHIFT
] = LBR_ANY
,
1178 [PERF_SAMPLE_BRANCH_USER_SHIFT
] = LBR_USER
,
1179 [PERF_SAMPLE_BRANCH_KERNEL_SHIFT
] = LBR_KERNEL
,
1180 [PERF_SAMPLE_BRANCH_HV_SHIFT
] = LBR_IGN
,
1181 [PERF_SAMPLE_BRANCH_ANY_RETURN_SHIFT
] = LBR_RETURN
| LBR_FAR
,
1182 [PERF_SAMPLE_BRANCH_ANY_CALL_SHIFT
] = LBR_REL_CALL
| LBR_IND_CALL
1184 [PERF_SAMPLE_BRANCH_IND_CALL_SHIFT
] = LBR_IND_CALL
,
1185 [PERF_SAMPLE_BRANCH_COND_SHIFT
] = LBR_JCC
,
1186 [PERF_SAMPLE_BRANCH_CALL_STACK_SHIFT
] = LBR_REL_CALL
| LBR_IND_CALL
1187 | LBR_RETURN
| LBR_CALL_STACK
,
1188 [PERF_SAMPLE_BRANCH_IND_JUMP_SHIFT
] = LBR_IND_JMP
,
1189 [PERF_SAMPLE_BRANCH_CALL_SHIFT
] = LBR_REL_CALL
,
1193 void __init
intel_pmu_lbr_init_core(void)
1196 x86_pmu
.lbr_tos
= MSR_LBR_TOS
;
1197 x86_pmu
.lbr_from
= MSR_LBR_CORE_FROM
;
1198 x86_pmu
.lbr_to
= MSR_LBR_CORE_TO
;
1201 * SW branch filter usage:
1202 * - compensate for lack of HW filter
1206 /* nehalem/westmere */
1207 void __init
intel_pmu_lbr_init_nhm(void)
1209 x86_pmu
.lbr_nr
= 16;
1210 x86_pmu
.lbr_tos
= MSR_LBR_TOS
;
1211 x86_pmu
.lbr_from
= MSR_LBR_NHM_FROM
;
1212 x86_pmu
.lbr_to
= MSR_LBR_NHM_TO
;
1214 x86_pmu
.lbr_sel_mask
= LBR_SEL_MASK
;
1215 x86_pmu
.lbr_sel_map
= nhm_lbr_sel_map
;
1218 * SW branch filter usage:
1219 * - workaround LBR_SEL errata (see above)
1220 * - support syscall, sysret capture.
1221 * That requires LBR_FAR but that means far
1222 * jmp need to be filtered out
1227 void __init
intel_pmu_lbr_init_snb(void)
1229 x86_pmu
.lbr_nr
= 16;
1230 x86_pmu
.lbr_tos
= MSR_LBR_TOS
;
1231 x86_pmu
.lbr_from
= MSR_LBR_NHM_FROM
;
1232 x86_pmu
.lbr_to
= MSR_LBR_NHM_TO
;
1234 x86_pmu
.lbr_sel_mask
= LBR_SEL_MASK
;
1235 x86_pmu
.lbr_sel_map
= snb_lbr_sel_map
;
1238 * SW branch filter usage:
1239 * - support syscall, sysret capture.
1240 * That requires LBR_FAR but that means far
1241 * jmp need to be filtered out
1246 void intel_pmu_lbr_init_hsw(void)
1248 x86_pmu
.lbr_nr
= 16;
1249 x86_pmu
.lbr_tos
= MSR_LBR_TOS
;
1250 x86_pmu
.lbr_from
= MSR_LBR_NHM_FROM
;
1251 x86_pmu
.lbr_to
= MSR_LBR_NHM_TO
;
1253 x86_pmu
.lbr_sel_mask
= LBR_SEL_MASK
;
1254 x86_pmu
.lbr_sel_map
= hsw_lbr_sel_map
;
1256 if (lbr_from_signext_quirk_needed())
1257 static_branch_enable(&lbr_from_quirk_key
);
1261 __init
void intel_pmu_lbr_init_skl(void)
1263 x86_pmu
.lbr_nr
= 32;
1264 x86_pmu
.lbr_tos
= MSR_LBR_TOS
;
1265 x86_pmu
.lbr_from
= MSR_LBR_NHM_FROM
;
1266 x86_pmu
.lbr_to
= MSR_LBR_NHM_TO
;
1268 x86_pmu
.lbr_sel_mask
= LBR_SEL_MASK
;
1269 x86_pmu
.lbr_sel_map
= hsw_lbr_sel_map
;
1272 * SW branch filter usage:
1273 * - support syscall, sysret capture.
1274 * That requires LBR_FAR but that means far
1275 * jmp need to be filtered out
1280 void __init
intel_pmu_lbr_init_atom(void)
1283 * only models starting at stepping 10 seems
1284 * to have an operational LBR which can freeze
1287 if (boot_cpu_data
.x86_model
== 28
1288 && boot_cpu_data
.x86_stepping
< 10) {
1289 pr_cont("LBR disabled due to erratum");
1294 x86_pmu
.lbr_tos
= MSR_LBR_TOS
;
1295 x86_pmu
.lbr_from
= MSR_LBR_CORE_FROM
;
1296 x86_pmu
.lbr_to
= MSR_LBR_CORE_TO
;
1299 * SW branch filter usage:
1300 * - compensate for lack of HW filter
1305 void __init
intel_pmu_lbr_init_slm(void)
1308 x86_pmu
.lbr_tos
= MSR_LBR_TOS
;
1309 x86_pmu
.lbr_from
= MSR_LBR_CORE_FROM
;
1310 x86_pmu
.lbr_to
= MSR_LBR_CORE_TO
;
1312 x86_pmu
.lbr_sel_mask
= LBR_SEL_MASK
;
1313 x86_pmu
.lbr_sel_map
= nhm_lbr_sel_map
;
1316 * SW branch filter usage:
1317 * - compensate for lack of HW filter
1319 pr_cont("8-deep LBR, ");
1322 /* Knights Landing */
1323 void intel_pmu_lbr_init_knl(void)
1326 x86_pmu
.lbr_tos
= MSR_LBR_TOS
;
1327 x86_pmu
.lbr_from
= MSR_LBR_NHM_FROM
;
1328 x86_pmu
.lbr_to
= MSR_LBR_NHM_TO
;
1330 x86_pmu
.lbr_sel_mask
= LBR_SEL_MASK
;
1331 x86_pmu
.lbr_sel_map
= snb_lbr_sel_map
;
1333 /* Knights Landing does have MISPREDICT bit */
1334 if (x86_pmu
.intel_cap
.lbr_format
== LBR_FORMAT_LIP
)
1335 x86_pmu
.intel_cap
.lbr_format
= LBR_FORMAT_EIP_FLAGS
;