Its latest version merged from: ^/vendor/processor-trace/892e12c5a27bda5806d1e63269986bb4171b5a8b Sponsored by: DARPA, AFRL
3474 lines
88 KiB
C
3474 lines
88 KiB
C
/*
|
|
* Copyright (c) 2016-2019, Intel Corporation
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions are met:
|
|
*
|
|
* * Redistributions of source code must retain the above copyright notice,
|
|
* this list of conditions and the following disclaimer.
|
|
* * Redistributions in binary form must reproduce the above copyright notice,
|
|
* this list of conditions and the following disclaimer in the documentation
|
|
* and/or other materials provided with the distribution.
|
|
* * Neither the name of Intel Corporation nor the names of its contributors
|
|
* may be used to endorse or promote products derived from this software
|
|
* without specific prior written permission.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
|
|
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
|
|
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
|
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
|
|
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
|
|
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
|
|
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
|
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
|
* POSSIBILITY OF SUCH DAMAGE.
|
|
*/
|
|
|
|
#include "pt_block_decoder.h"
|
|
#include "pt_block_cache.h"
|
|
#include "pt_section.h"
|
|
#include "pt_image.h"
|
|
#include "pt_insn.h"
|
|
#include "pt_config.h"
|
|
#include "pt_asid.h"
|
|
#include "pt_compiler.h"
|
|
|
|
#include "intel-pt.h"
|
|
|
|
#include <string.h>
|
|
#include <stdlib.h>
|
|
|
|
|
|
static int pt_blk_proceed_trailing_event(struct pt_block_decoder *,
|
|
struct pt_block *);
|
|
|
|
|
|
static int pt_blk_status(const struct pt_block_decoder *decoder, int flags)
|
|
{
|
|
int status;
|
|
|
|
if (!decoder)
|
|
return -pte_internal;
|
|
|
|
status = decoder->status;
|
|
|
|
/* Indicate whether tracing is disabled or enabled.
|
|
*
|
|
* This duplicates the indication in struct pt_insn and covers the case
|
|
* where we indicate the status after synchronizing.
|
|
*/
|
|
if (!decoder->enabled)
|
|
flags |= pts_ip_suppressed;
|
|
|
|
/* Forward end-of-trace indications.
|
|
*
|
|
* Postpone it as long as we're still processing events, though.
|
|
*/
|
|
if ((status & pts_eos) && !decoder->process_event)
|
|
flags |= pts_eos;
|
|
|
|
return flags;
|
|
}
|
|
|
|
static void pt_blk_reset(struct pt_block_decoder *decoder)
|
|
{
|
|
if (!decoder)
|
|
return;
|
|
|
|
decoder->mode = ptem_unknown;
|
|
decoder->ip = 0ull;
|
|
decoder->status = 0;
|
|
decoder->enabled = 0;
|
|
decoder->process_event = 0;
|
|
decoder->speculative = 0;
|
|
decoder->process_insn = 0;
|
|
decoder->bound_paging = 0;
|
|
decoder->bound_vmcs = 0;
|
|
decoder->bound_ptwrite = 0;
|
|
|
|
memset(&decoder->event, 0, sizeof(decoder->event));
|
|
pt_retstack_init(&decoder->retstack);
|
|
pt_asid_init(&decoder->asid);
|
|
}
|
|
|
|
/* Initialize the query decoder flags based on our flags. */
|
|
|
|
static int pt_blk_init_qry_flags(struct pt_conf_flags *qflags,
|
|
const struct pt_conf_flags *flags)
|
|
{
|
|
if (!qflags || !flags)
|
|
return -pte_internal;
|
|
|
|
memset(qflags, 0, sizeof(*qflags));
|
|
qflags->variant.query.keep_tcal_on_ovf =
|
|
flags->variant.block.keep_tcal_on_ovf;
|
|
|
|
return 0;
|
|
}
|
|
|
|
int pt_blk_decoder_init(struct pt_block_decoder *decoder,
|
|
const struct pt_config *uconfig)
|
|
{
|
|
struct pt_config config;
|
|
int errcode;
|
|
|
|
if (!decoder)
|
|
return -pte_internal;
|
|
|
|
errcode = pt_config_from_user(&config, uconfig);
|
|
if (errcode < 0)
|
|
return errcode;
|
|
|
|
/* The user supplied decoder flags. */
|
|
decoder->flags = config.flags;
|
|
|
|
/* Set the flags we need for the query decoder we use. */
|
|
errcode = pt_blk_init_qry_flags(&config.flags, &decoder->flags);
|
|
if (errcode < 0)
|
|
return errcode;
|
|
|
|
errcode = pt_qry_decoder_init(&decoder->query, &config);
|
|
if (errcode < 0)
|
|
return errcode;
|
|
|
|
pt_image_init(&decoder->default_image, NULL);
|
|
decoder->image = &decoder->default_image;
|
|
|
|
errcode = pt_msec_cache_init(&decoder->scache);
|
|
if (errcode < 0)
|
|
return errcode;
|
|
|
|
pt_blk_reset(decoder);
|
|
|
|
return 0;
|
|
}
|
|
|
|
void pt_blk_decoder_fini(struct pt_block_decoder *decoder)
|
|
{
|
|
if (!decoder)
|
|
return;
|
|
|
|
pt_msec_cache_fini(&decoder->scache);
|
|
pt_image_fini(&decoder->default_image);
|
|
pt_qry_decoder_fini(&decoder->query);
|
|
}
|
|
|
|
struct pt_block_decoder *
|
|
pt_blk_alloc_decoder(const struct pt_config *config)
|
|
{
|
|
struct pt_block_decoder *decoder;
|
|
int errcode;
|
|
|
|
decoder = malloc(sizeof(*decoder));
|
|
if (!decoder)
|
|
return NULL;
|
|
|
|
errcode = pt_blk_decoder_init(decoder, config);
|
|
if (errcode < 0) {
|
|
free(decoder);
|
|
return NULL;
|
|
}
|
|
|
|
return decoder;
|
|
}
|
|
|
|
void pt_blk_free_decoder(struct pt_block_decoder *decoder)
|
|
{
|
|
if (!decoder)
|
|
return;
|
|
|
|
pt_blk_decoder_fini(decoder);
|
|
free(decoder);
|
|
}
|
|
|
|
/* Maybe synthesize a tick event.
|
|
*
|
|
* If we're not already processing events, check the current time against the
|
|
* last event's time. If it changed, synthesize a tick event with the new time.
|
|
*
|
|
* Returns zero if no tick event has been created.
|
|
* Returns a positive integer if a tick event has been created.
|
|
* Returns a negative error code otherwise.
|
|
*/
|
|
static int pt_blk_tick(struct pt_block_decoder *decoder, uint64_t ip)
|
|
{
|
|
struct pt_event *ev;
|
|
uint64_t tsc;
|
|
uint32_t lost_mtc, lost_cyc;
|
|
int errcode;
|
|
|
|
if (!decoder)
|
|
return -pte_internal;
|
|
|
|
/* We're not generating tick events if tracing is disabled. */
|
|
if (!decoder->enabled)
|
|
return -pte_internal;
|
|
|
|
/* Events already provide a timestamp so there is no need to synthesize
|
|
* an artificial tick event. There's no room, either, since this would
|
|
* overwrite the in-progress event.
|
|
*
|
|
* In rare cases where we need to proceed to an event location using
|
|
* trace this may cause us to miss a timing update if the event is not
|
|
* forwarded to the user.
|
|
*
|
|
* The only case I can come up with at the moment is a MODE.EXEC binding
|
|
* to the TIP IP of a far branch.
|
|
*/
|
|
if (decoder->process_event)
|
|
return 0;
|
|
|
|
errcode = pt_qry_time(&decoder->query, &tsc, &lost_mtc, &lost_cyc);
|
|
if (errcode < 0) {
|
|
/* If we don't have wall-clock time, we use relative time. */
|
|
if (errcode != -pte_no_time)
|
|
return errcode;
|
|
}
|
|
|
|
ev = &decoder->event;
|
|
|
|
/* We're done if time has not changed since the last event. */
|
|
if (tsc == ev->tsc)
|
|
return 0;
|
|
|
|
/* Time has changed so we create a new tick event. */
|
|
memset(ev, 0, sizeof(*ev));
|
|
ev->type = ptev_tick;
|
|
ev->variant.tick.ip = ip;
|
|
|
|
/* Indicate if we have wall-clock time or only relative time. */
|
|
if (errcode != -pte_no_time)
|
|
ev->has_tsc = 1;
|
|
ev->tsc = tsc;
|
|
ev->lost_mtc = lost_mtc;
|
|
ev->lost_cyc = lost_cyc;
|
|
|
|
/* We now have an event to process. */
|
|
decoder->process_event = 1;
|
|
|
|
return 1;
|
|
}
|
|
|
|
/* Query an indirect branch.
|
|
*
|
|
* Returns zero on success, a negative error code otherwise.
|
|
*/
|
|
static int pt_blk_indirect_branch(struct pt_block_decoder *decoder,
|
|
uint64_t *ip)
|
|
{
|
|
uint64_t evip;
|
|
int status, errcode;
|
|
|
|
if (!decoder)
|
|
return -pte_internal;
|
|
|
|
evip = decoder->ip;
|
|
|
|
status = pt_qry_indirect_branch(&decoder->query, ip);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
if (decoder->flags.variant.block.enable_tick_events) {
|
|
errcode = pt_blk_tick(decoder, evip);
|
|
if (errcode < 0)
|
|
return errcode;
|
|
}
|
|
|
|
return status;
|
|
}
|
|
|
|
/* Query a conditional branch.
|
|
*
|
|
* Returns zero on success, a negative error code otherwise.
|
|
*/
|
|
static int pt_blk_cond_branch(struct pt_block_decoder *decoder, int *taken)
|
|
{
|
|
int status, errcode;
|
|
|
|
if (!decoder)
|
|
return -pte_internal;
|
|
|
|
status = pt_qry_cond_branch(&decoder->query, taken);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
if (decoder->flags.variant.block.enable_tick_events) {
|
|
errcode = pt_blk_tick(decoder, decoder->ip);
|
|
if (errcode < 0)
|
|
return errcode;
|
|
}
|
|
|
|
return status;
|
|
}
|
|
|
|
static int pt_blk_start(struct pt_block_decoder *decoder, int status)
|
|
{
|
|
if (!decoder)
|
|
return -pte_internal;
|
|
|
|
if (status < 0)
|
|
return status;
|
|
|
|
decoder->status = status;
|
|
if (!(status & pts_ip_suppressed))
|
|
decoder->enabled = 1;
|
|
|
|
/* We will always have an event.
|
|
*
|
|
* If we synchronized onto an empty PSB+, tracing is disabled and we'll
|
|
* process events until the enabled event.
|
|
*
|
|
* If tracing is enabled, PSB+ must at least provide the execution mode,
|
|
* which we're going to forward to the user.
|
|
*/
|
|
return pt_blk_proceed_trailing_event(decoder, NULL);
|
|
}
|
|
|
|
static int pt_blk_sync_reset(struct pt_block_decoder *decoder)
|
|
{
|
|
if (!decoder)
|
|
return -pte_internal;
|
|
|
|
pt_blk_reset(decoder);
|
|
|
|
return 0;
|
|
}
|
|
|
|
int pt_blk_sync_forward(struct pt_block_decoder *decoder)
|
|
{
|
|
int errcode, status;
|
|
|
|
if (!decoder)
|
|
return -pte_invalid;
|
|
|
|
errcode = pt_blk_sync_reset(decoder);
|
|
if (errcode < 0)
|
|
return errcode;
|
|
|
|
status = pt_qry_sync_forward(&decoder->query, &decoder->ip);
|
|
|
|
return pt_blk_start(decoder, status);
|
|
}
|
|
|
|
int pt_blk_sync_backward(struct pt_block_decoder *decoder)
|
|
{
|
|
int errcode, status;
|
|
|
|
if (!decoder)
|
|
return -pte_invalid;
|
|
|
|
errcode = pt_blk_sync_reset(decoder);
|
|
if (errcode < 0)
|
|
return errcode;
|
|
|
|
status = pt_qry_sync_backward(&decoder->query, &decoder->ip);
|
|
|
|
return pt_blk_start(decoder, status);
|
|
}
|
|
|
|
int pt_blk_sync_set(struct pt_block_decoder *decoder, uint64_t offset)
|
|
{
|
|
int errcode, status;
|
|
|
|
if (!decoder)
|
|
return -pte_invalid;
|
|
|
|
errcode = pt_blk_sync_reset(decoder);
|
|
if (errcode < 0)
|
|
return errcode;
|
|
|
|
status = pt_qry_sync_set(&decoder->query, &decoder->ip, offset);
|
|
|
|
return pt_blk_start(decoder, status);
|
|
}
|
|
|
|
int pt_blk_get_offset(const struct pt_block_decoder *decoder, uint64_t *offset)
|
|
{
|
|
if (!decoder)
|
|
return -pte_invalid;
|
|
|
|
return pt_qry_get_offset(&decoder->query, offset);
|
|
}
|
|
|
|
int pt_blk_get_sync_offset(const struct pt_block_decoder *decoder,
|
|
uint64_t *offset)
|
|
{
|
|
if (!decoder)
|
|
return -pte_invalid;
|
|
|
|
return pt_qry_get_sync_offset(&decoder->query, offset);
|
|
}
|
|
|
|
struct pt_image *pt_blk_get_image(struct pt_block_decoder *decoder)
|
|
{
|
|
if (!decoder)
|
|
return NULL;
|
|
|
|
return decoder->image;
|
|
}
|
|
|
|
int pt_blk_set_image(struct pt_block_decoder *decoder, struct pt_image *image)
|
|
{
|
|
if (!decoder)
|
|
return -pte_invalid;
|
|
|
|
if (!image)
|
|
image = &decoder->default_image;
|
|
|
|
decoder->image = image;
|
|
return 0;
|
|
}
|
|
|
|
const struct pt_config *
|
|
pt_blk_get_config(const struct pt_block_decoder *decoder)
|
|
{
|
|
if (!decoder)
|
|
return NULL;
|
|
|
|
return pt_qry_get_config(&decoder->query);
|
|
}
|
|
|
|
int pt_blk_time(struct pt_block_decoder *decoder, uint64_t *time,
|
|
uint32_t *lost_mtc, uint32_t *lost_cyc)
|
|
{
|
|
if (!decoder || !time)
|
|
return -pte_invalid;
|
|
|
|
return pt_qry_time(&decoder->query, time, lost_mtc, lost_cyc);
|
|
}
|
|
|
|
int pt_blk_core_bus_ratio(struct pt_block_decoder *decoder, uint32_t *cbr)
|
|
{
|
|
if (!decoder || !cbr)
|
|
return -pte_invalid;
|
|
|
|
return pt_qry_core_bus_ratio(&decoder->query, cbr);
|
|
}
|
|
|
|
int pt_blk_asid(const struct pt_block_decoder *decoder, struct pt_asid *asid,
|
|
size_t size)
|
|
{
|
|
if (!decoder || !asid)
|
|
return -pte_invalid;
|
|
|
|
return pt_asid_to_user(asid, &decoder->asid, size);
|
|
}
|
|
|
|
/* Fetch the next pending event.
|
|
*
|
|
* Checks for pending events. If an event is pending, fetches it (if not
|
|
* already in process).
|
|
*
|
|
* Returns zero if no event is pending.
|
|
* Returns a positive integer if an event is pending or in process.
|
|
* Returns a negative error code otherwise.
|
|
*/
|
|
static inline int pt_blk_fetch_event(struct pt_block_decoder *decoder)
|
|
{
|
|
int status;
|
|
|
|
if (!decoder)
|
|
return -pte_internal;
|
|
|
|
if (decoder->process_event)
|
|
return 1;
|
|
|
|
if (!(decoder->status & pts_event_pending))
|
|
return 0;
|
|
|
|
status = pt_qry_event(&decoder->query, &decoder->event,
|
|
sizeof(decoder->event));
|
|
if (status < 0)
|
|
return status;
|
|
|
|
decoder->process_event = 1;
|
|
decoder->status = status;
|
|
|
|
return 1;
|
|
}
|
|
|
|
static inline int pt_blk_block_is_empty(const struct pt_block *block)
|
|
{
|
|
if (!block)
|
|
return 1;
|
|
|
|
return !block->ninsn;
|
|
}
|
|
|
|
static inline int block_to_user(struct pt_block *ublock, size_t size,
|
|
const struct pt_block *block)
|
|
{
|
|
if (!ublock || !block)
|
|
return -pte_internal;
|
|
|
|
if (ublock == block)
|
|
return 0;
|
|
|
|
/* Zero out any unknown bytes. */
|
|
if (sizeof(*block) < size) {
|
|
memset(ublock + sizeof(*block), 0, size - sizeof(*block));
|
|
|
|
size = sizeof(*block);
|
|
}
|
|
|
|
memcpy(ublock, block, size);
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int pt_insn_false(const struct pt_insn *insn,
|
|
const struct pt_insn_ext *iext)
|
|
{
|
|
(void) insn;
|
|
(void) iext;
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* Determine the next IP using trace.
|
|
*
|
|
* Tries to determine the IP of the next instruction using trace and provides it
|
|
* in @pip.
|
|
*
|
|
* Not requiring trace to determine the IP is treated as an internal error.
|
|
*
|
|
* Does not update the return compression stack for indirect calls. This is
|
|
* expected to have been done, already, when trying to determine the next IP
|
|
* without using trace.
|
|
*
|
|
* Does not update @decoder->status. The caller is expected to do that.
|
|
*
|
|
* Returns a non-negative pt_status_flag bit-vector on success, a negative error
|
|
* code otherwise.
|
|
* Returns -pte_internal if @pip, @decoder, @insn, or @iext are NULL.
|
|
* Returns -pte_internal if no trace is required.
|
|
*/
|
|
static int pt_blk_next_ip(uint64_t *pip, struct pt_block_decoder *decoder,
|
|
const struct pt_insn *insn,
|
|
const struct pt_insn_ext *iext)
|
|
{
|
|
int status, errcode;
|
|
|
|
if (!pip || !decoder || !insn || !iext)
|
|
return -pte_internal;
|
|
|
|
/* We handle non-taken conditional branches, and compressed returns
|
|
* directly in the switch.
|
|
*
|
|
* All kinds of branches are handled below the switch.
|
|
*/
|
|
switch (insn->iclass) {
|
|
case ptic_cond_jump: {
|
|
uint64_t ip;
|
|
int taken;
|
|
|
|
status = pt_blk_cond_branch(decoder, &taken);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
ip = insn->ip + insn->size;
|
|
if (taken)
|
|
ip += (uint64_t) (int64_t)
|
|
iext->variant.branch.displacement;
|
|
|
|
*pip = ip;
|
|
return status;
|
|
}
|
|
|
|
case ptic_return: {
|
|
int taken;
|
|
|
|
/* Check for a compressed return. */
|
|
status = pt_blk_cond_branch(decoder, &taken);
|
|
if (status < 0) {
|
|
if (status != -pte_bad_query)
|
|
return status;
|
|
|
|
break;
|
|
}
|
|
|
|
/* A compressed return is indicated by a taken conditional
|
|
* branch.
|
|
*/
|
|
if (!taken)
|
|
return -pte_bad_retcomp;
|
|
|
|
errcode = pt_retstack_pop(&decoder->retstack, pip);
|
|
if (errcode < 0)
|
|
return errcode;
|
|
|
|
return status;
|
|
}
|
|
|
|
case ptic_jump:
|
|
case ptic_call:
|
|
/* A direct jump or call wouldn't require trace. */
|
|
if (iext->variant.branch.is_direct)
|
|
return -pte_internal;
|
|
|
|
break;
|
|
|
|
case ptic_far_call:
|
|
case ptic_far_return:
|
|
case ptic_far_jump:
|
|
break;
|
|
|
|
case ptic_ptwrite:
|
|
case ptic_other:
|
|
return -pte_internal;
|
|
|
|
case ptic_error:
|
|
return -pte_bad_insn;
|
|
}
|
|
|
|
/* Process an indirect branch.
|
|
*
|
|
* This covers indirect jumps and calls, non-compressed returns, and all
|
|
* flavors of far transfers.
|
|
*/
|
|
return pt_blk_indirect_branch(decoder, pip);
|
|
}
|
|
|
|
/* Proceed to the next IP using trace.
|
|
*
|
|
* We failed to proceed without trace. This ends the current block. Now use
|
|
* trace to do one final step to determine the start IP of the next block.
|
|
*
|
|
* Returns zero on success, a negative error code otherwise.
|
|
*/
|
|
static int pt_blk_proceed_with_trace(struct pt_block_decoder *decoder,
|
|
const struct pt_insn *insn,
|
|
const struct pt_insn_ext *iext)
|
|
{
|
|
int status;
|
|
|
|
if (!decoder)
|
|
return -pte_internal;
|
|
|
|
status = pt_blk_next_ip(&decoder->ip, decoder, insn, iext);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
/* Preserve the query decoder's response which indicates upcoming
|
|
* events.
|
|
*/
|
|
decoder->status = status;
|
|
|
|
/* We do need an IP in order to proceed. */
|
|
if (status & pts_ip_suppressed)
|
|
return -pte_noip;
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* Decode one instruction in a known section.
|
|
*
|
|
* Decode the instruction at @insn->ip in @msec assuming execution mode
|
|
* @insn->mode.
|
|
*
|
|
* Returns zero on success, a negative error code otherwise.
|
|
*/
|
|
static int pt_blk_decode_in_section(struct pt_insn *insn,
|
|
struct pt_insn_ext *iext,
|
|
const struct pt_mapped_section *msec)
|
|
{
|
|
int status;
|
|
|
|
if (!insn || !iext)
|
|
return -pte_internal;
|
|
|
|
/* We know that @ip is contained in @section.
|
|
*
|
|
* Note that we need to translate @ip into a section offset.
|
|
*/
|
|
status = pt_msec_read(msec, insn->raw, sizeof(insn->raw), insn->ip);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
/* We initialize @insn->size to the maximal possible size. It will be
|
|
* set to the actual size during instruction decode.
|
|
*/
|
|
insn->size = (uint8_t) status;
|
|
|
|
return pt_ild_decode(insn, iext);
|
|
}
|
|
|
|
/* Update the return-address stack if @insn is a near call.
|
|
*
|
|
* Returns zero on success, a negative error code otherwise.
|
|
*/
|
|
static inline int pt_blk_log_call(struct pt_block_decoder *decoder,
|
|
const struct pt_insn *insn,
|
|
const struct pt_insn_ext *iext)
|
|
{
|
|
if (!decoder || !insn || !iext)
|
|
return -pte_internal;
|
|
|
|
if (insn->iclass != ptic_call)
|
|
return 0;
|
|
|
|
/* Ignore direct calls to the next instruction that are used for
|
|
* position independent code.
|
|
*/
|
|
if (iext->variant.branch.is_direct &&
|
|
!iext->variant.branch.displacement)
|
|
return 0;
|
|
|
|
return pt_retstack_push(&decoder->retstack, insn->ip + insn->size);
|
|
}
|
|
|
|
/* Proceed by one instruction.
|
|
*
|
|
* Tries to decode the instruction at @decoder->ip and, on success, adds it to
|
|
* @block and provides it in @pinsn and @piext.
|
|
*
|
|
* The instruction will not be added if:
|
|
*
|
|
* - the memory could not be read: return error
|
|
* - it could not be decoded: return error
|
|
* - @block is already full: return zero
|
|
* - @block would switch sections: return zero
|
|
*
|
|
* Returns a positive integer if the instruction was added.
|
|
* Returns zero if the instruction didn't fit into @block.
|
|
* Returns a negative error code otherwise.
|
|
*/
|
|
static int pt_blk_proceed_one_insn(struct pt_block_decoder *decoder,
|
|
struct pt_block *block,
|
|
struct pt_insn *pinsn,
|
|
struct pt_insn_ext *piext)
|
|
{
|
|
struct pt_insn_ext iext;
|
|
struct pt_insn insn;
|
|
uint16_t ninsn;
|
|
int status;
|
|
|
|
if (!decoder || !block || !pinsn || !piext)
|
|
return -pte_internal;
|
|
|
|
/* There's nothing to do if there is no room in @block. */
|
|
ninsn = block->ninsn + 1;
|
|
if (!ninsn)
|
|
return 0;
|
|
|
|
/* The truncated instruction must be last. */
|
|
if (block->truncated)
|
|
return 0;
|
|
|
|
memset(&insn, 0, sizeof(insn));
|
|
memset(&iext, 0, sizeof(iext));
|
|
|
|
insn.mode = decoder->mode;
|
|
insn.ip = decoder->ip;
|
|
|
|
status = pt_insn_decode(&insn, &iext, decoder->image, &decoder->asid);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
/* We do not switch sections inside a block. */
|
|
if (insn.isid != block->isid) {
|
|
if (!pt_blk_block_is_empty(block))
|
|
return 0;
|
|
|
|
block->isid = insn.isid;
|
|
}
|
|
|
|
/* If we couldn't read @insn's memory in one chunk from @insn.isid, we
|
|
* provide the memory in @block.
|
|
*/
|
|
if (insn.truncated) {
|
|
memcpy(block->raw, insn.raw, insn.size);
|
|
block->size = insn.size;
|
|
block->truncated = 1;
|
|
}
|
|
|
|
/* Log calls' return addresses for return compression. */
|
|
status = pt_blk_log_call(decoder, &insn, &iext);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
/* We have a new instruction. */
|
|
block->iclass = insn.iclass;
|
|
block->end_ip = insn.ip;
|
|
block->ninsn = ninsn;
|
|
|
|
*pinsn = insn;
|
|
*piext = iext;
|
|
|
|
return 1;
|
|
}
|
|
|
|
|
|
/* Proceed to a particular type of instruction without using trace.
|
|
*
|
|
* Proceed until we reach an instruction for which @predicate returns a positive
|
|
* integer or until:
|
|
*
|
|
* - @predicate returns an error: return error
|
|
* - @block is full: return zero
|
|
* - @block would switch sections: return zero
|
|
* - we would need trace: return -pte_bad_query
|
|
*
|
|
* Provide the last instruction that was reached in @insn and @iext.
|
|
*
|
|
* Update @decoder->ip to point to the last IP that was reached. If we fail due
|
|
* to lack of trace or if we reach a desired instruction, this is @insn->ip;
|
|
* otherwise this is the next instruction's IP.
|
|
*
|
|
* Returns a positive integer if a suitable instruction was reached.
|
|
* Returns zero if no such instruction was reached.
|
|
* Returns a negative error code otherwise.
|
|
*/
|
|
static int pt_blk_proceed_to_insn(struct pt_block_decoder *decoder,
|
|
struct pt_block *block,
|
|
struct pt_insn *insn,
|
|
struct pt_insn_ext *iext,
|
|
int (*predicate)(const struct pt_insn *,
|
|
const struct pt_insn_ext *))
|
|
{
|
|
int status;
|
|
|
|
if (!decoder || !insn || !predicate)
|
|
return -pte_internal;
|
|
|
|
for (;;) {
|
|
status = pt_blk_proceed_one_insn(decoder, block, insn, iext);
|
|
if (status <= 0)
|
|
return status;
|
|
|
|
/* We're done if this instruction matches the spec (positive
|
|
* status) or we run into an error (negative status).
|
|
*/
|
|
status = predicate(insn, iext);
|
|
if (status != 0)
|
|
return status;
|
|
|
|
/* Let's see if we can proceed to the next IP without trace. */
|
|
status = pt_insn_next_ip(&decoder->ip, insn, iext);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
/* End the block if the user asked us to.
|
|
*
|
|
* We only need to take care about direct near branches.
|
|
* Indirect and far branches require trace and will naturally
|
|
* end a block.
|
|
*/
|
|
if ((decoder->flags.variant.block.end_on_call &&
|
|
(insn->iclass == ptic_call)) ||
|
|
(decoder->flags.variant.block.end_on_jump &&
|
|
(insn->iclass == ptic_jump)))
|
|
return 0;
|
|
}
|
|
}
|
|
|
|
/* Proceed to a particular IP without using trace.
|
|
*
|
|
* Proceed until we reach @ip or until:
|
|
*
|
|
* - @block is full: return zero
|
|
* - @block would switch sections: return zero
|
|
* - we would need trace: return -pte_bad_query
|
|
*
|
|
* Provide the last instruction that was reached in @insn and @iext. If we
|
|
* reached @ip, this is the instruction preceding it.
|
|
*
|
|
* Update @decoder->ip to point to the last IP that was reached. If we fail due
|
|
* to lack of trace, this is @insn->ip; otherwise this is the next instruction's
|
|
* IP.
|
|
*
|
|
* Returns a positive integer if @ip was reached.
|
|
* Returns zero if no such instruction was reached.
|
|
* Returns a negative error code otherwise.
|
|
*/
|
|
static int pt_blk_proceed_to_ip(struct pt_block_decoder *decoder,
|
|
struct pt_block *block, struct pt_insn *insn,
|
|
struct pt_insn_ext *iext, uint64_t ip)
|
|
{
|
|
int status;
|
|
|
|
if (!decoder || !insn)
|
|
return -pte_internal;
|
|
|
|
for (;;) {
|
|
/* We're done when we reach @ip. We may not even have to decode
|
|
* a single instruction in some cases.
|
|
*/
|
|
if (decoder->ip == ip)
|
|
return 1;
|
|
|
|
status = pt_blk_proceed_one_insn(decoder, block, insn, iext);
|
|
if (status <= 0)
|
|
return status;
|
|
|
|
/* Let's see if we can proceed to the next IP without trace. */
|
|
status = pt_insn_next_ip(&decoder->ip, insn, iext);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
/* End the block if the user asked us to.
|
|
*
|
|
* We only need to take care about direct near branches.
|
|
* Indirect and far branches require trace and will naturally
|
|
* end a block.
|
|
*
|
|
* The call at the end of the block may have reached @ip; make
|
|
* sure to indicate that.
|
|
*/
|
|
if ((decoder->flags.variant.block.end_on_call &&
|
|
(insn->iclass == ptic_call)) ||
|
|
(decoder->flags.variant.block.end_on_jump &&
|
|
(insn->iclass == ptic_jump))) {
|
|
return (decoder->ip == ip ? 1 : 0);
|
|
}
|
|
}
|
|
}
|
|
|
|
/* Proceed to a particular IP with trace, if necessary.
|
|
*
|
|
* Proceed until we reach @ip or until:
|
|
*
|
|
* - @block is full: return zero
|
|
* - @block would switch sections: return zero
|
|
* - we need trace: return zero
|
|
*
|
|
* Update @decoder->ip to point to the last IP that was reached.
|
|
*
|
|
* A return of zero ends @block.
|
|
*
|
|
* Returns a positive integer if @ip was reached.
|
|
* Returns zero if no such instruction was reached.
|
|
* Returns a negative error code otherwise.
|
|
*/
|
|
static int pt_blk_proceed_to_ip_with_trace(struct pt_block_decoder *decoder,
|
|
struct pt_block *block,
|
|
uint64_t ip)
|
|
{
|
|
struct pt_insn_ext iext;
|
|
struct pt_insn insn;
|
|
int status;
|
|
|
|
/* Try to reach @ip without trace.
|
|
*
|
|
* We're also OK if @block overflowed or we switched sections and we
|
|
* have to try again in the next iteration.
|
|
*/
|
|
status = pt_blk_proceed_to_ip(decoder, block, &insn, &iext, ip);
|
|
if (status != -pte_bad_query)
|
|
return status;
|
|
|
|
/* Needing trace is not an error. We use trace to determine the next
|
|
* start IP and end the block.
|
|
*/
|
|
return pt_blk_proceed_with_trace(decoder, &insn, &iext);
|
|
}
|
|
|
|
static int pt_insn_skl014(const struct pt_insn *insn,
|
|
const struct pt_insn_ext *iext)
|
|
{
|
|
if (!insn || !iext)
|
|
return 0;
|
|
|
|
switch (insn->iclass) {
|
|
default:
|
|
return 0;
|
|
|
|
case ptic_call:
|
|
case ptic_jump:
|
|
return iext->variant.branch.is_direct;
|
|
|
|
case ptic_other:
|
|
return pt_insn_changes_cr3(insn, iext);
|
|
}
|
|
}
|
|
|
|
/* Proceed to the location of a synchronous disabled event with suppressed IP
|
|
* considering SKL014.
|
|
*
|
|
* We have a (synchronous) disabled event pending. Proceed to the event
|
|
* location and indicate whether we were able to reach it.
|
|
*
|
|
* With SKL014 a TIP.PGD with suppressed IP may also be generated by a direct
|
|
* unconditional branch that clears FilterEn by jumping out of a filter region
|
|
* or into a TraceStop region. Use the filter configuration to determine the
|
|
* exact branch the event binds to.
|
|
*
|
|
* The last instruction that was reached is stored in @insn/@iext.
|
|
*
|
|
* Returns a positive integer if the event location was reached.
|
|
* Returns zero if the event location was not reached.
|
|
* Returns a negative error code otherwise.
|
|
*/
|
|
static int pt_blk_proceed_skl014(struct pt_block_decoder *decoder,
|
|
struct pt_block *block, struct pt_insn *insn,
|
|
struct pt_insn_ext *iext)
|
|
{
|
|
const struct pt_conf_addr_filter *addr_filter;
|
|
int status;
|
|
|
|
if (!decoder || !block || !insn || !iext)
|
|
return -pte_internal;
|
|
|
|
addr_filter = &decoder->query.config.addr_filter;
|
|
for (;;) {
|
|
uint64_t ip;
|
|
|
|
status = pt_blk_proceed_to_insn(decoder, block, insn, iext,
|
|
pt_insn_skl014);
|
|
if (status <= 0)
|
|
break;
|
|
|
|
/* The erratum doesn't apply if we can bind the event to a
|
|
* CR3-changing instruction.
|
|
*/
|
|
if (pt_insn_changes_cr3(insn, iext))
|
|
break;
|
|
|
|
/* Check the filter against the branch target. */
|
|
status = pt_insn_next_ip(&ip, insn, iext);
|
|
if (status < 0)
|
|
break;
|
|
|
|
status = pt_filter_addr_check(addr_filter, ip);
|
|
if (status <= 0) {
|
|
/* We need to flip the indication.
|
|
*
|
|
* We reached the event location when @ip lies inside a
|
|
* tracing-disabled region.
|
|
*/
|
|
if (!status)
|
|
status = 1;
|
|
|
|
break;
|
|
}
|
|
|
|
/* This is not the correct instruction. Proceed past it and try
|
|
* again.
|
|
*/
|
|
decoder->ip = ip;
|
|
|
|
/* End the block if the user asked us to.
|
|
*
|
|
* We only need to take care about direct near branches.
|
|
* Indirect and far branches require trace and will naturally
|
|
* end a block.
|
|
*/
|
|
if ((decoder->flags.variant.block.end_on_call &&
|
|
(insn->iclass == ptic_call)) ||
|
|
(decoder->flags.variant.block.end_on_jump &&
|
|
(insn->iclass == ptic_jump)))
|
|
break;
|
|
}
|
|
|
|
return status;
|
|
}
|
|
|
|
/* Proceed to the event location for a disabled event.
|
|
*
|
|
* We have a (synchronous) disabled event pending. Proceed to the event
|
|
* location and indicate whether we were able to reach it.
|
|
*
|
|
* The last instruction that was reached is stored in @insn/@iext.
|
|
*
|
|
* Returns a positive integer if the event location was reached.
|
|
* Returns zero if the event location was not reached.
|
|
* Returns a negative error code otherwise.
|
|
*/
|
|
static int pt_blk_proceed_to_disabled(struct pt_block_decoder *decoder,
|
|
struct pt_block *block,
|
|
struct pt_insn *insn,
|
|
struct pt_insn_ext *iext,
|
|
const struct pt_event *ev)
|
|
{
|
|
if (!decoder || !block || !ev)
|
|
return -pte_internal;
|
|
|
|
if (ev->ip_suppressed) {
|
|
/* Due to SKL014 the TIP.PGD payload may be suppressed also for
|
|
* direct branches.
|
|
*
|
|
* If we don't have a filter configuration we assume that no
|
|
* address filters were used and the erratum does not apply.
|
|
*
|
|
* We might otherwise disable tracing too early.
|
|
*/
|
|
if (decoder->query.config.addr_filter.config.addr_cfg &&
|
|
decoder->query.config.errata.skl014)
|
|
return pt_blk_proceed_skl014(decoder, block, insn,
|
|
iext);
|
|
|
|
/* A synchronous disabled event also binds to far branches and
|
|
* CPL-changing instructions. Both would require trace,
|
|
* however, and are thus implicitly handled by erroring out.
|
|
*
|
|
* The would-require-trace error is handled by our caller.
|
|
*/
|
|
return pt_blk_proceed_to_insn(decoder, block, insn, iext,
|
|
pt_insn_changes_cr3);
|
|
} else
|
|
return pt_blk_proceed_to_ip(decoder, block, insn, iext,
|
|
ev->variant.disabled.ip);
|
|
}
|
|
|
|
/* Set the expected resume address for a synchronous disable.
|
|
*
|
|
* On a synchronous disable, @decoder->ip still points to the instruction to
|
|
* which the event bound. That's not where we expect tracing to resume.
|
|
*
|
|
* For calls, a fair assumption is that tracing resumes after returning from the
|
|
* called function. For other types of instructions, we simply don't know.
|
|
*
|
|
* Returns zero on success, a negative pt_error_code otherwise.
|
|
*/
|
|
static int pt_blk_set_disable_resume_ip(struct pt_block_decoder *decoder,
|
|
const struct pt_insn *insn)
|
|
{
|
|
if (!decoder || !insn)
|
|
return -pte_internal;
|
|
|
|
switch (insn->iclass) {
|
|
case ptic_call:
|
|
case ptic_far_call:
|
|
decoder->ip = insn->ip + insn->size;
|
|
break;
|
|
|
|
default:
|
|
decoder->ip = 0ull;
|
|
break;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* Proceed to the event location for an async paging event.
|
|
*
|
|
* We have an async paging event pending. Proceed to the event location and
|
|
* indicate whether we were able to reach it. Needing trace in order to proceed
|
|
* is not an error in this case but ends the block.
|
|
*
|
|
* Returns a positive integer if the event location was reached.
|
|
* Returns zero if the event location was not reached.
|
|
* Returns a negative error code otherwise.
|
|
*/
|
|
static int pt_blk_proceed_to_async_paging(struct pt_block_decoder *decoder,
|
|
struct pt_block *block,
|
|
const struct pt_event *ev)
|
|
{
|
|
int status;
|
|
|
|
if (!decoder || !ev)
|
|
return -pte_internal;
|
|
|
|
/* Apply the event immediately if we don't have an IP. */
|
|
if (ev->ip_suppressed)
|
|
return 1;
|
|
|
|
status = pt_blk_proceed_to_ip_with_trace(decoder, block,
|
|
ev->variant.async_paging.ip);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
/* We may have reached the IP. */
|
|
return (decoder->ip == ev->variant.async_paging.ip ? 1 : 0);
|
|
}
|
|
|
|
/* Proceed to the event location for an async vmcs event.
|
|
*
|
|
* We have an async vmcs event pending. Proceed to the event location and
|
|
* indicate whether we were able to reach it. Needing trace in order to proceed
|
|
* is not an error in this case but ends the block.
|
|
*
|
|
* Returns a positive integer if the event location was reached.
|
|
* Returns zero if the event location was not reached.
|
|
* Returns a negative error code otherwise.
|
|
*/
|
|
static int pt_blk_proceed_to_async_vmcs(struct pt_block_decoder *decoder,
|
|
struct pt_block *block,
|
|
const struct pt_event *ev)
|
|
{
|
|
int status;
|
|
|
|
if (!decoder || !ev)
|
|
return -pte_internal;
|
|
|
|
/* Apply the event immediately if we don't have an IP. */
|
|
if (ev->ip_suppressed)
|
|
return 1;
|
|
|
|
status = pt_blk_proceed_to_ip_with_trace(decoder, block,
|
|
ev->variant.async_vmcs.ip);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
/* We may have reached the IP. */
|
|
return (decoder->ip == ev->variant.async_vmcs.ip ? 1 : 0);
|
|
}
|
|
|
|
/* Proceed to the event location for an exec mode event.
|
|
*
|
|
* We have an exec mode event pending. Proceed to the event location and
|
|
* indicate whether we were able to reach it. Needing trace in order to proceed
|
|
* is not an error in this case but ends the block.
|
|
*
|
|
* Returns a positive integer if the event location was reached.
|
|
* Returns zero if the event location was not reached.
|
|
* Returns a negative error code otherwise.
|
|
*/
|
|
static int pt_blk_proceed_to_exec_mode(struct pt_block_decoder *decoder,
|
|
struct pt_block *block,
|
|
const struct pt_event *ev)
|
|
{
|
|
int status;
|
|
|
|
if (!decoder || !ev)
|
|
return -pte_internal;
|
|
|
|
/* Apply the event immediately if we don't have an IP. */
|
|
if (ev->ip_suppressed)
|
|
return 1;
|
|
|
|
status = pt_blk_proceed_to_ip_with_trace(decoder, block,
|
|
ev->variant.exec_mode.ip);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
/* We may have reached the IP. */
|
|
return (decoder->ip == ev->variant.exec_mode.ip ? 1 : 0);
|
|
}
|
|
|
|
/* Proceed to the event location for a ptwrite event.
|
|
*
|
|
* We have a ptwrite event pending. Proceed to the event location and indicate
|
|
* whether we were able to reach it.
|
|
*
|
|
* In case of the event binding to a ptwrite instruction, we pass beyond that
|
|
* instruction and update the event to provide the instruction's IP.
|
|
*
|
|
* In the case of the event binding to an IP provided in the event, we move
|
|
* beyond the instruction at that IP.
|
|
*
|
|
* Returns a positive integer if the event location was reached.
|
|
* Returns zero if the event location was not reached.
|
|
* Returns a negative error code otherwise.
|
|
*/
|
|
static int pt_blk_proceed_to_ptwrite(struct pt_block_decoder *decoder,
|
|
struct pt_block *block,
|
|
struct pt_insn *insn,
|
|
struct pt_insn_ext *iext,
|
|
struct pt_event *ev)
|
|
{
|
|
int status;
|
|
|
|
if (!insn || !ev)
|
|
return -pte_internal;
|
|
|
|
/* If we don't have an IP, the event binds to the next PTWRITE
|
|
* instruction.
|
|
*
|
|
* If we have an IP it still binds to the next PTWRITE instruction but
|
|
* now the IP tells us where that instruction is. This makes most sense
|
|
* when tracing is disabled and we don't have any other means of finding
|
|
* the PTWRITE instruction. We nevertheless distinguish the two cases,
|
|
* here.
|
|
*
|
|
* In both cases, we move beyond the PTWRITE instruction, so it will be
|
|
* the last instruction in the current block and @decoder->ip will point
|
|
* to the instruction following it.
|
|
*/
|
|
if (ev->ip_suppressed) {
|
|
status = pt_blk_proceed_to_insn(decoder, block, insn, iext,
|
|
pt_insn_is_ptwrite);
|
|
if (status <= 0)
|
|
return status;
|
|
|
|
/* We now know the IP of the PTWRITE instruction corresponding
|
|
* to this event. Fill it in to make it more convenient for the
|
|
* user to process the event.
|
|
*/
|
|
ev->variant.ptwrite.ip = insn->ip;
|
|
ev->ip_suppressed = 0;
|
|
} else {
|
|
status = pt_blk_proceed_to_ip(decoder, block, insn, iext,
|
|
ev->variant.ptwrite.ip);
|
|
if (status <= 0)
|
|
return status;
|
|
|
|
/* We reached the PTWRITE instruction and @decoder->ip points to
|
|
* it; @insn/@iext still contain the preceding instruction.
|
|
*
|
|
* Proceed beyond the PTWRITE to account for it. Note that we
|
|
* may still overflow the block, which would cause us to
|
|
* postpone both instruction and event to the next block.
|
|
*/
|
|
status = pt_blk_proceed_one_insn(decoder, block, insn, iext);
|
|
if (status <= 0)
|
|
return status;
|
|
}
|
|
|
|
return 1;
|
|
}
|
|
|
|
/* Try to work around erratum SKD022.
|
|
*
|
|
* If we get an asynchronous disable on VMLAUNCH or VMRESUME, the FUP that
|
|
* caused the disable to be asynchronous might have been bogous.
|
|
*
|
|
* Returns a positive integer if the erratum has been handled.
|
|
* Returns zero if the erratum does not apply.
|
|
* Returns a negative error code otherwise.
|
|
*/
|
|
static int pt_blk_handle_erratum_skd022(struct pt_block_decoder *decoder,
|
|
struct pt_event *ev)
|
|
{
|
|
struct pt_insn_ext iext;
|
|
struct pt_insn insn;
|
|
int errcode;
|
|
|
|
if (!decoder || !ev)
|
|
return -pte_internal;
|
|
|
|
insn.mode = decoder->mode;
|
|
insn.ip = ev->variant.async_disabled.at;
|
|
|
|
errcode = pt_insn_decode(&insn, &iext, decoder->image, &decoder->asid);
|
|
if (errcode < 0)
|
|
return 0;
|
|
|
|
switch (iext.iclass) {
|
|
default:
|
|
/* The erratum does not apply. */
|
|
return 0;
|
|
|
|
case PTI_INST_VMLAUNCH:
|
|
case PTI_INST_VMRESUME:
|
|
/* The erratum may apply. We can't be sure without a lot more
|
|
* analysis. Let's assume it does.
|
|
*
|
|
* We turn the async disable into a sync disable. Our caller
|
|
* will restart event processing.
|
|
*/
|
|
ev->type = ptev_disabled;
|
|
ev->variant.disabled.ip = ev->variant.async_disabled.ip;
|
|
|
|
return 1;
|
|
}
|
|
}
|
|
|
|
/* Postpone proceeding past @insn/@iext and indicate a pending event.
|
|
*
|
|
* There may be further events pending on @insn/@iext. Postpone proceeding past
|
|
* @insn/@iext until we processed all events that bind to it.
|
|
*
|
|
* Returns a non-negative pt_status_flag bit-vector indicating a pending event
|
|
* on success, a negative pt_error_code otherwise.
|
|
*/
|
|
static int pt_blk_postpone_insn(struct pt_block_decoder *decoder,
|
|
const struct pt_insn *insn,
|
|
const struct pt_insn_ext *iext)
|
|
{
|
|
if (!decoder || !insn || !iext)
|
|
return -pte_internal;
|
|
|
|
/* Only one can be active. */
|
|
if (decoder->process_insn)
|
|
return -pte_internal;
|
|
|
|
decoder->process_insn = 1;
|
|
decoder->insn = *insn;
|
|
decoder->iext = *iext;
|
|
|
|
return pt_blk_status(decoder, pts_event_pending);
|
|
}
|
|
|
|
/* Remove any postponed instruction from @decoder.
|
|
*
|
|
* Returns zero on success, a negative pt_error_code otherwise.
|
|
*/
|
|
static int pt_blk_clear_postponed_insn(struct pt_block_decoder *decoder)
|
|
{
|
|
if (!decoder)
|
|
return -pte_internal;
|
|
|
|
decoder->process_insn = 0;
|
|
decoder->bound_paging = 0;
|
|
decoder->bound_vmcs = 0;
|
|
decoder->bound_ptwrite = 0;
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* Proceed past a postponed instruction.
|
|
*
|
|
* If an instruction has been postponed in @decoder, proceed past it.
|
|
*
|
|
* Returns zero on success, a negative pt_error_code otherwise.
|
|
*/
|
|
static int pt_blk_proceed_postponed_insn(struct pt_block_decoder *decoder)
|
|
{
|
|
int status;
|
|
|
|
if (!decoder)
|
|
return -pte_internal;
|
|
|
|
/* There's nothing to do if we have no postponed instruction. */
|
|
if (!decoder->process_insn)
|
|
return 0;
|
|
|
|
/* There's nothing to do if tracing got disabled. */
|
|
if (!decoder->enabled)
|
|
return pt_blk_clear_postponed_insn(decoder);
|
|
|
|
status = pt_insn_next_ip(&decoder->ip, &decoder->insn, &decoder->iext);
|
|
if (status < 0) {
|
|
if (status != -pte_bad_query)
|
|
return status;
|
|
|
|
status = pt_blk_proceed_with_trace(decoder, &decoder->insn,
|
|
&decoder->iext);
|
|
if (status < 0)
|
|
return status;
|
|
}
|
|
|
|
return pt_blk_clear_postponed_insn(decoder);
|
|
}
|
|
|
|
/* Proceed to the next event.
|
|
*
|
|
* We have an event pending. Proceed to the event location and indicate the
|
|
* event to the user.
|
|
*
|
|
* On our way to the event location we may also be forced to postpone the event
|
|
* to the next block, e.g. if we overflow the number of instructions in the
|
|
* block or if we need trace in order to reach the event location.
|
|
*
|
|
* If we're not able to reach the event location, we return zero. This is what
|
|
* pt_blk_status() would return since:
|
|
*
|
|
* - we suppress pts_eos as long as we're processing events
|
|
* - we do not set pts_ip_suppressed since tracing must be enabled
|
|
*
|
|
* Returns a non-negative pt_status_flag bit-vector on success, a negative error
|
|
* code otherwise.
|
|
*/
|
|
static int pt_blk_proceed_event(struct pt_block_decoder *decoder,
|
|
struct pt_block *block)
|
|
{
|
|
struct pt_insn_ext iext;
|
|
struct pt_insn insn;
|
|
struct pt_event *ev;
|
|
int status;
|
|
|
|
if (!decoder || !decoder->process_event || !block)
|
|
return -pte_internal;
|
|
|
|
ev = &decoder->event;
|
|
switch (ev->type) {
|
|
case ptev_enabled:
|
|
break;
|
|
|
|
case ptev_disabled:
|
|
status = pt_blk_proceed_to_disabled(decoder, block, &insn,
|
|
&iext, ev);
|
|
if (status <= 0) {
|
|
/* A synchronous disable event also binds to the next
|
|
* indirect or conditional branch, i.e. to any branch
|
|
* that would have required trace.
|
|
*/
|
|
if (status != -pte_bad_query)
|
|
return status;
|
|
|
|
status = pt_blk_set_disable_resume_ip(decoder, &insn);
|
|
if (status < 0)
|
|
return status;
|
|
}
|
|
|
|
break;
|
|
|
|
case ptev_async_disabled:
|
|
status = pt_blk_proceed_to_ip(decoder, block, &insn, &iext,
|
|
ev->variant.async_disabled.at);
|
|
if (status <= 0)
|
|
return status;
|
|
|
|
if (decoder->query.config.errata.skd022) {
|
|
status = pt_blk_handle_erratum_skd022(decoder, ev);
|
|
if (status != 0) {
|
|
if (status < 0)
|
|
return status;
|
|
|
|
/* If the erratum hits, we modify the event.
|
|
* Try again.
|
|
*/
|
|
return pt_blk_proceed_event(decoder, block);
|
|
}
|
|
}
|
|
|
|
break;
|
|
|
|
case ptev_async_branch:
|
|
status = pt_blk_proceed_to_ip(decoder, block, &insn, &iext,
|
|
ev->variant.async_branch.from);
|
|
if (status <= 0)
|
|
return status;
|
|
|
|
break;
|
|
|
|
case ptev_paging:
|
|
if (!decoder->enabled)
|
|
break;
|
|
|
|
status = pt_blk_proceed_to_insn(decoder, block, &insn, &iext,
|
|
pt_insn_binds_to_pip);
|
|
if (status <= 0)
|
|
return status;
|
|
|
|
/* We bound a paging event. Make sure we do not bind further
|
|
* paging events to this instruction.
|
|
*/
|
|
decoder->bound_paging = 1;
|
|
|
|
return pt_blk_postpone_insn(decoder, &insn, &iext);
|
|
|
|
case ptev_async_paging:
|
|
status = pt_blk_proceed_to_async_paging(decoder, block, ev);
|
|
if (status <= 0)
|
|
return status;
|
|
|
|
break;
|
|
|
|
case ptev_vmcs:
|
|
if (!decoder->enabled)
|
|
break;
|
|
|
|
status = pt_blk_proceed_to_insn(decoder, block, &insn, &iext,
|
|
pt_insn_binds_to_vmcs);
|
|
if (status <= 0)
|
|
return status;
|
|
|
|
/* We bound a vmcs event. Make sure we do not bind further vmcs
|
|
* events to this instruction.
|
|
*/
|
|
decoder->bound_vmcs = 1;
|
|
|
|
return pt_blk_postpone_insn(decoder, &insn, &iext);
|
|
|
|
case ptev_async_vmcs:
|
|
status = pt_blk_proceed_to_async_vmcs(decoder, block, ev);
|
|
if (status <= 0)
|
|
return status;
|
|
|
|
break;
|
|
|
|
case ptev_overflow:
|
|
break;
|
|
|
|
case ptev_exec_mode:
|
|
status = pt_blk_proceed_to_exec_mode(decoder, block, ev);
|
|
if (status <= 0)
|
|
return status;
|
|
|
|
break;
|
|
|
|
case ptev_tsx:
|
|
if (ev->ip_suppressed)
|
|
break;
|
|
|
|
status = pt_blk_proceed_to_ip(decoder, block, &insn, &iext,
|
|
ev->variant.tsx.ip);
|
|
if (status <= 0)
|
|
return status;
|
|
|
|
break;
|
|
|
|
case ptev_stop:
|
|
break;
|
|
|
|
case ptev_exstop:
|
|
if (!decoder->enabled || ev->ip_suppressed)
|
|
break;
|
|
|
|
status = pt_blk_proceed_to_ip(decoder, block, &insn, &iext,
|
|
ev->variant.exstop.ip);
|
|
if (status <= 0)
|
|
return status;
|
|
|
|
break;
|
|
|
|
case ptev_mwait:
|
|
if (!decoder->enabled || ev->ip_suppressed)
|
|
break;
|
|
|
|
status = pt_blk_proceed_to_ip(decoder, block, &insn, &iext,
|
|
ev->variant.mwait.ip);
|
|
if (status <= 0)
|
|
return status;
|
|
|
|
break;
|
|
|
|
case ptev_pwre:
|
|
case ptev_pwrx:
|
|
break;
|
|
|
|
case ptev_ptwrite:
|
|
if (!decoder->enabled)
|
|
break;
|
|
|
|
status = pt_blk_proceed_to_ptwrite(decoder, block, &insn,
|
|
&iext, ev);
|
|
if (status <= 0)
|
|
return status;
|
|
|
|
/* We bound a ptwrite event. Make sure we do not bind further
|
|
* ptwrite events to this instruction.
|
|
*/
|
|
decoder->bound_ptwrite = 1;
|
|
|
|
return pt_blk_postpone_insn(decoder, &insn, &iext);
|
|
|
|
case ptev_tick:
|
|
case ptev_cbr:
|
|
case ptev_mnt:
|
|
break;
|
|
}
|
|
|
|
return pt_blk_status(decoder, pts_event_pending);
|
|
}
|
|
|
|
/* Proceed to the next decision point without using the block cache.
|
|
*
|
|
* Tracing is enabled and we don't have an event pending. Proceed as far as
|
|
* we get without trace. Stop when we either:
|
|
*
|
|
* - need trace in order to continue
|
|
* - overflow the max number of instructions in a block
|
|
*
|
|
* We actually proceed one instruction further to get the start IP for the next
|
|
* block. This only updates @decoder's internal state, though.
|
|
*
|
|
* Returns zero on success, a negative error code otherwise.
|
|
*/
|
|
static int pt_blk_proceed_no_event_uncached(struct pt_block_decoder *decoder,
|
|
struct pt_block *block)
|
|
{
|
|
struct pt_insn_ext iext;
|
|
struct pt_insn insn;
|
|
int status;
|
|
|
|
if (!decoder || !block)
|
|
return -pte_internal;
|
|
|
|
/* This is overly conservative, really. We shouldn't get a bad-query
|
|
* status unless we decoded at least one instruction successfully.
|
|
*/
|
|
memset(&insn, 0, sizeof(insn));
|
|
memset(&iext, 0, sizeof(iext));
|
|
|
|
/* Proceed as far as we get without trace. */
|
|
status = pt_blk_proceed_to_insn(decoder, block, &insn, &iext,
|
|
pt_insn_false);
|
|
if (status < 0) {
|
|
if (status != -pte_bad_query)
|
|
return status;
|
|
|
|
return pt_blk_proceed_with_trace(decoder, &insn, &iext);
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* Check if @ip is contained in @section loaded at @laddr.
|
|
*
|
|
* Returns non-zero if it is.
|
|
* Returns zero if it isn't or of @section is NULL.
|
|
*/
|
|
static inline int pt_blk_is_in_section(const struct pt_mapped_section *msec,
|
|
uint64_t ip)
|
|
{
|
|
uint64_t begin, end;
|
|
|
|
begin = pt_msec_begin(msec);
|
|
end = pt_msec_end(msec);
|
|
|
|
return (begin <= ip && ip < end);
|
|
}
|
|
|
|
/* Insert a trampoline block cache entry.
|
|
*
|
|
* Add a trampoline block cache entry at @ip to continue at @nip, where @nip
|
|
* must be the next instruction after @ip.
|
|
*
|
|
* Both @ip and @nip must be section-relative
|
|
*
|
|
* Returns zero on success, a negative error code otherwise.
|
|
*/
|
|
static inline int pt_blk_add_trampoline(struct pt_block_cache *bcache,
|
|
uint64_t ip, uint64_t nip,
|
|
enum pt_exec_mode mode)
|
|
{
|
|
struct pt_bcache_entry bce;
|
|
int64_t disp;
|
|
|
|
/* The displacement from @ip to @nip for the trampoline. */
|
|
disp = (int64_t) (nip - ip);
|
|
|
|
memset(&bce, 0, sizeof(bce));
|
|
bce.displacement = (int32_t) disp;
|
|
bce.ninsn = 1;
|
|
bce.mode = mode;
|
|
bce.qualifier = ptbq_again;
|
|
|
|
/* If we can't reach @nip without overflowing the displacement field, we
|
|
* have to stop and re-decode the instruction at @ip.
|
|
*/
|
|
if ((int64_t) bce.displacement != disp) {
|
|
|
|
memset(&bce, 0, sizeof(bce));
|
|
bce.ninsn = 1;
|
|
bce.mode = mode;
|
|
bce.qualifier = ptbq_decode;
|
|
}
|
|
|
|
return pt_bcache_add(bcache, ip, bce);
|
|
}
|
|
|
|
/* Insert a decode block cache entry.
|
|
*
|
|
* Add a decode block cache entry at @ioff.
|
|
*
|
|
* Returns zero on success, a negative error code otherwise.
|
|
*/
|
|
static inline int pt_blk_add_decode(struct pt_block_cache *bcache,
|
|
uint64_t ioff, enum pt_exec_mode mode)
|
|
{
|
|
struct pt_bcache_entry bce;
|
|
|
|
memset(&bce, 0, sizeof(bce));
|
|
bce.ninsn = 1;
|
|
bce.mode = mode;
|
|
bce.qualifier = ptbq_decode;
|
|
|
|
return pt_bcache_add(bcache, ioff, bce);
|
|
}
|
|
|
|
enum {
|
|
/* The maximum number of steps when filling the block cache. */
|
|
bcache_fill_steps = 0x400
|
|
};
|
|
|
|
/* Proceed to the next instruction and fill the block cache for @decoder->ip.
|
|
*
|
|
* Tracing is enabled and we don't have an event pending. The current IP is not
|
|
* yet cached.
|
|
*
|
|
* Proceed one instruction without using the block cache, then try to proceed
|
|
* further using the block cache.
|
|
*
|
|
* On our way back, add a block cache entry for the IP before proceeding. Note
|
|
* that the recursion is bounded by @steps and ultimately by the maximum number
|
|
* of instructions in a block.
|
|
*
|
|
* Returns zero on success, a negative error code otherwise.
|
|
*/
|
|
static int
|
|
pt_blk_proceed_no_event_fill_cache(struct pt_block_decoder *decoder,
|
|
struct pt_block *block,
|
|
struct pt_block_cache *bcache,
|
|
const struct pt_mapped_section *msec,
|
|
size_t steps)
|
|
{
|
|
struct pt_bcache_entry bce;
|
|
struct pt_insn_ext iext;
|
|
struct pt_insn insn;
|
|
uint64_t nip, dip, ioff, noff;
|
|
int64_t disp;
|
|
int status;
|
|
|
|
if (!decoder || !steps)
|
|
return -pte_internal;
|
|
|
|
/* Proceed one instruction by decoding and examining it.
|
|
*
|
|
* Note that we also return on a status of zero that indicates that the
|
|
* instruction didn't fit into @block.
|
|
*/
|
|
status = pt_blk_proceed_one_insn(decoder, block, &insn, &iext);
|
|
if (status <= 0)
|
|
return status;
|
|
|
|
ioff = pt_msec_unmap(msec, insn.ip);
|
|
|
|
/* Let's see if we can proceed to the next IP without trace.
|
|
*
|
|
* If we can't, this is certainly a decision point.
|
|
*/
|
|
status = pt_insn_next_ip(&decoder->ip, &insn, &iext);
|
|
if (status < 0) {
|
|
if (status != -pte_bad_query)
|
|
return status;
|
|
|
|
memset(&bce, 0, sizeof(bce));
|
|
bce.ninsn = 1;
|
|
bce.mode = insn.mode;
|
|
bce.isize = insn.size;
|
|
|
|
/* Clear the instruction size in case of overflows. */
|
|
if ((uint8_t) bce.isize != insn.size)
|
|
bce.isize = 0;
|
|
|
|
switch (insn.iclass) {
|
|
case ptic_ptwrite:
|
|
case ptic_error:
|
|
case ptic_other:
|
|
return -pte_internal;
|
|
|
|
case ptic_jump:
|
|
/* A direct jump doesn't require trace. */
|
|
if (iext.variant.branch.is_direct)
|
|
return -pte_internal;
|
|
|
|
bce.qualifier = ptbq_indirect;
|
|
break;
|
|
|
|
case ptic_call:
|
|
/* A direct call doesn't require trace. */
|
|
if (iext.variant.branch.is_direct)
|
|
return -pte_internal;
|
|
|
|
bce.qualifier = ptbq_ind_call;
|
|
break;
|
|
|
|
case ptic_return:
|
|
bce.qualifier = ptbq_return;
|
|
break;
|
|
|
|
case ptic_cond_jump:
|
|
bce.qualifier = ptbq_cond;
|
|
break;
|
|
|
|
case ptic_far_call:
|
|
case ptic_far_return:
|
|
case ptic_far_jump:
|
|
bce.qualifier = ptbq_indirect;
|
|
break;
|
|
}
|
|
|
|
/* If the block was truncated, we have to decode its last
|
|
* instruction each time.
|
|
*
|
|
* We could have skipped the above switch and size assignment in
|
|
* this case but this is already a slow and hopefully infrequent
|
|
* path.
|
|
*/
|
|
if (block->truncated)
|
|
bce.qualifier = ptbq_decode;
|
|
|
|
status = pt_bcache_add(bcache, ioff, bce);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
return pt_blk_proceed_with_trace(decoder, &insn, &iext);
|
|
}
|
|
|
|
/* The next instruction's IP. */
|
|
nip = decoder->ip;
|
|
noff = pt_msec_unmap(msec, nip);
|
|
|
|
/* Even if we were able to proceed without trace, we might have to stop
|
|
* here for various reasons:
|
|
*
|
|
* - at near direct calls to update the return-address stack
|
|
*
|
|
* We are forced to re-decode @insn to get the branch displacement.
|
|
*
|
|
* Even though it is constant, we don't cache it to avoid increasing
|
|
* the size of a cache entry. Note that the displacement field is
|
|
* zero for this entry and we might be tempted to use it - but other
|
|
* entries that point to this decision point will have non-zero
|
|
* displacement.
|
|
*
|
|
* We could proceed after a near direct call but we migh as well
|
|
* postpone it to the next iteration. Make sure to end the block if
|
|
* @decoder->flags.variant.block.end_on_call is set, though.
|
|
*
|
|
* - at near direct backwards jumps to detect section splits
|
|
*
|
|
* In case the current section is split underneath us, we must take
|
|
* care to detect that split.
|
|
*
|
|
* There is one corner case where the split is in the middle of a
|
|
* linear sequence of instructions that branches back into the
|
|
* originating section.
|
|
*
|
|
* Calls, indirect branches, and far branches are already covered
|
|
* since they either require trace or already require us to stop
|
|
* (i.e. near direct calls) for other reasons. That leaves near
|
|
* direct backward jumps.
|
|
*
|
|
* Instead of the decode stop at the jump instruction we're using we
|
|
* could have made sure that other block cache entries that extend
|
|
* this one insert a trampoline to the jump's entry. This would
|
|
* have been a bit more complicated.
|
|
*
|
|
* - if we switched sections
|
|
*
|
|
* This ends a block just like a branch that requires trace.
|
|
*
|
|
* We need to re-decode @insn in order to determine the start IP of
|
|
* the next block.
|
|
*
|
|
* - if the block is truncated
|
|
*
|
|
* We need to read the last instruction's memory from multiple
|
|
* sections and provide it to the user.
|
|
*
|
|
* We could still use the block cache but then we'd have to handle
|
|
* this case for each qualifier. Truncation is hopefully rare and
|
|
* having to read the memory for the instruction from multiple
|
|
* sections is already slow. Let's rather keep things simple and
|
|
* route it through the decode flow, where we already have
|
|
* everything in place.
|
|
*/
|
|
switch (insn.iclass) {
|
|
case ptic_call:
|
|
return pt_blk_add_decode(bcache, ioff, insn.mode);
|
|
|
|
case ptic_jump:
|
|
/* An indirect branch requires trace and should have been
|
|
* handled above.
|
|
*/
|
|
if (!iext.variant.branch.is_direct)
|
|
return -pte_internal;
|
|
|
|
if (iext.variant.branch.displacement < 0 ||
|
|
decoder->flags.variant.block.end_on_jump)
|
|
return pt_blk_add_decode(bcache, ioff, insn.mode);
|
|
|
|
fallthrough;
|
|
default:
|
|
if (!pt_blk_is_in_section(msec, nip) || block->truncated)
|
|
return pt_blk_add_decode(bcache, ioff, insn.mode);
|
|
|
|
break;
|
|
}
|
|
|
|
/* We proceeded one instruction. Let's see if we have a cache entry for
|
|
* the next instruction.
|
|
*/
|
|
status = pt_bcache_lookup(&bce, bcache, noff);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
/* If we don't have a valid cache entry, yet, fill the cache some more.
|
|
*
|
|
* On our way back, we add a cache entry for this instruction based on
|
|
* the cache entry of the succeeding instruction.
|
|
*/
|
|
if (!pt_bce_is_valid(bce)) {
|
|
/* If we exceeded the maximum number of allowed steps, we insert
|
|
* a trampoline to the next instruction.
|
|
*
|
|
* The next time we encounter the same code, we will use the
|
|
* trampoline to jump directly to where we left off this time
|
|
* and continue from there.
|
|
*/
|
|
steps -= 1;
|
|
if (!steps)
|
|
return pt_blk_add_trampoline(bcache, ioff, noff,
|
|
insn.mode);
|
|
|
|
status = pt_blk_proceed_no_event_fill_cache(decoder, block,
|
|
bcache, msec,
|
|
steps);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
/* Let's see if we have more luck this time. */
|
|
status = pt_bcache_lookup(&bce, bcache, noff);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
/* If we still don't have a valid cache entry, we're done. Most
|
|
* likely, @block overflowed and we couldn't proceed past the
|
|
* next instruction.
|
|
*/
|
|
if (!pt_bce_is_valid(bce))
|
|
return 0;
|
|
}
|
|
|
|
/* We must not have switched execution modes.
|
|
*
|
|
* This would require an event and we're on the no-event flow.
|
|
*/
|
|
if (pt_bce_exec_mode(bce) != insn.mode)
|
|
return -pte_internal;
|
|
|
|
/* The decision point IP and the displacement from @insn.ip. */
|
|
dip = nip + (uint64_t) (int64_t) bce.displacement;
|
|
disp = (int64_t) (dip - insn.ip);
|
|
|
|
/* We may have switched sections if the section was split. See
|
|
* pt_blk_proceed_no_event_cached() for a more elaborate comment.
|
|
*
|
|
* We're not adding a block cache entry since this won't apply to the
|
|
* original section which may be shared with other decoders.
|
|
*
|
|
* We will instead take the slow path until the end of the section.
|
|
*/
|
|
if (!pt_blk_is_in_section(msec, dip))
|
|
return 0;
|
|
|
|
/* Let's try to reach @nip's decision point from @insn.ip.
|
|
*
|
|
* There are two fields that may overflow: @bce.ninsn and
|
|
* @bce.displacement.
|
|
*/
|
|
bce.ninsn += 1;
|
|
bce.displacement = (int32_t) disp;
|
|
|
|
/* If none of them overflowed, we're done.
|
|
*
|
|
* If one or both overflowed, let's try to insert a trampoline, i.e. we
|
|
* try to reach @dip via a ptbq_again entry to @nip.
|
|
*/
|
|
if (!bce.ninsn || ((int64_t) bce.displacement != disp))
|
|
return pt_blk_add_trampoline(bcache, ioff, noff, insn.mode);
|
|
|
|
/* We're done. Add the cache entry.
|
|
*
|
|
* There's a chance that other decoders updated the cache entry in the
|
|
* meantime. They should have come to the same conclusion as we,
|
|
* though, and the cache entries should be identical.
|
|
*
|
|
* Cache updates are atomic so even if the two versions were not
|
|
* identical, we wouldn't care because they are both correct.
|
|
*/
|
|
return pt_bcache_add(bcache, ioff, bce);
|
|
}
|
|
|
|
/* Proceed at a potentially truncated instruction.
|
|
*
|
|
* We were not able to decode the instruction at @decoder->ip in @decoder's
|
|
* cached section. This is typically caused by not having enough bytes.
|
|
*
|
|
* Try to decode the instruction again using the entire image. If this succeeds
|
|
* we expect to end up with an instruction that was truncated in the section it
|
|
* started. We provide the full instruction in this case and end the block.
|
|
*
|
|
* Returns zero on success, a negative error code otherwise.
|
|
*/
|
|
static int pt_blk_proceed_truncated(struct pt_block_decoder *decoder,
|
|
struct pt_block *block)
|
|
{
|
|
struct pt_insn_ext iext;
|
|
struct pt_insn insn;
|
|
int errcode;
|
|
|
|
if (!decoder || !block)
|
|
return -pte_internal;
|
|
|
|
memset(&iext, 0, sizeof(iext));
|
|
memset(&insn, 0, sizeof(insn));
|
|
|
|
insn.mode = decoder->mode;
|
|
insn.ip = decoder->ip;
|
|
|
|
errcode = pt_insn_decode(&insn, &iext, decoder->image, &decoder->asid);
|
|
if (errcode < 0)
|
|
return errcode;
|
|
|
|
/* We shouldn't use this function if the instruction isn't truncated. */
|
|
if (!insn.truncated)
|
|
return -pte_internal;
|
|
|
|
/* Provide the instruction in the block. This ends the block. */
|
|
memcpy(block->raw, insn.raw, insn.size);
|
|
block->iclass = insn.iclass;
|
|
block->size = insn.size;
|
|
block->truncated = 1;
|
|
|
|
/* Log calls' return addresses for return compression. */
|
|
errcode = pt_blk_log_call(decoder, &insn, &iext);
|
|
if (errcode < 0)
|
|
return errcode;
|
|
|
|
/* Let's see if we can proceed to the next IP without trace.
|
|
*
|
|
* The truncated instruction ends the block but we still need to get the
|
|
* next block's start IP.
|
|
*/
|
|
errcode = pt_insn_next_ip(&decoder->ip, &insn, &iext);
|
|
if (errcode < 0) {
|
|
if (errcode != -pte_bad_query)
|
|
return errcode;
|
|
|
|
return pt_blk_proceed_with_trace(decoder, &insn, &iext);
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* Proceed to the next decision point using the block cache.
|
|
*
|
|
* Tracing is enabled and we don't have an event pending. We already set
|
|
* @block's isid. All reads are done within @msec as we're not switching
|
|
* sections between blocks.
|
|
*
|
|
* Proceed as far as we get without trace. Stop when we either:
|
|
*
|
|
* - need trace in order to continue
|
|
* - overflow the max number of instructions in a block
|
|
*
|
|
* We actually proceed one instruction further to get the start IP for the next
|
|
* block. This only updates @decoder's internal state, though.
|
|
*
|
|
* Returns zero on success, a negative error code otherwise.
|
|
*/
|
|
static int pt_blk_proceed_no_event_cached(struct pt_block_decoder *decoder,
|
|
struct pt_block *block,
|
|
struct pt_block_cache *bcache,
|
|
const struct pt_mapped_section *msec)
|
|
{
|
|
struct pt_bcache_entry bce;
|
|
uint16_t binsn, ninsn;
|
|
uint64_t offset, nip;
|
|
int status;
|
|
|
|
if (!decoder || !block)
|
|
return -pte_internal;
|
|
|
|
offset = pt_msec_unmap(msec, decoder->ip);
|
|
status = pt_bcache_lookup(&bce, bcache, offset);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
/* If we don't find a valid cache entry, fill the cache. */
|
|
if (!pt_bce_is_valid(bce))
|
|
return pt_blk_proceed_no_event_fill_cache(decoder, block,
|
|
bcache, msec,
|
|
bcache_fill_steps);
|
|
|
|
/* If we switched sections, the origianl section must have been split
|
|
* underneath us. A split preserves the block cache of the original
|
|
* section.
|
|
*
|
|
* Crossing sections requires ending the block so we can indicate the
|
|
* proper isid for the entire block.
|
|
*
|
|
* Plus there's the chance that the new section that caused the original
|
|
* section to split changed instructions.
|
|
*
|
|
* This check will also cover changes to a linear sequence of code we
|
|
* would otherwise have jumped over as long as the start and end are in
|
|
* different sub-sections.
|
|
*
|
|
* Since we stop on every (backwards) branch (through an artificial stop
|
|
* in the case of a near direct backward branch) we will detect all
|
|
* section splits.
|
|
*
|
|
* Switch to the slow path until we reach the end of this section.
|
|
*/
|
|
nip = decoder->ip + (uint64_t) (int64_t) bce.displacement;
|
|
if (!pt_blk_is_in_section(msec, nip))
|
|
return pt_blk_proceed_no_event_uncached(decoder, block);
|
|
|
|
/* We have a valid cache entry. Let's first check if the way to the
|
|
* decision point still fits into @block.
|
|
*
|
|
* If it doesn't, we end the block without filling it as much as we
|
|
* could since this would require us to switch to the slow path.
|
|
*
|
|
* On the next iteration, we will start with an empty block, which is
|
|
* guaranteed to have enough room for at least one block cache entry.
|
|
*/
|
|
binsn = block->ninsn;
|
|
ninsn = binsn + (uint16_t) bce.ninsn;
|
|
if (ninsn < binsn)
|
|
return 0;
|
|
|
|
/* Jump ahead to the decision point and proceed from there.
|
|
*
|
|
* We're not switching execution modes so even if @block already has an
|
|
* execution mode, it will be the one we're going to set.
|
|
*/
|
|
decoder->ip = nip;
|
|
|
|
/* We don't know the instruction class so we should be setting it to
|
|
* ptic_error. Since we will be able to fill it back in later in most
|
|
* cases, we move the clearing to the switch cases that don't.
|
|
*/
|
|
block->end_ip = nip;
|
|
block->ninsn = ninsn;
|
|
block->mode = pt_bce_exec_mode(bce);
|
|
|
|
|
|
switch (pt_bce_qualifier(bce)) {
|
|
case ptbq_again:
|
|
/* We're not able to reach the actual decision point due to
|
|
* overflows so we inserted a trampoline.
|
|
*
|
|
* We don't know the instruction and it is not guaranteed that
|
|
* we will proceed further (e.g. if @block overflowed). Let's
|
|
* clear any previously stored instruction class which has
|
|
* become invalid when we updated @block->ninsn.
|
|
*/
|
|
block->iclass = ptic_error;
|
|
|
|
return pt_blk_proceed_no_event_cached(decoder, block, bcache,
|
|
msec);
|
|
|
|
case ptbq_cond:
|
|
/* We're at a conditional branch. */
|
|
block->iclass = ptic_cond_jump;
|
|
|
|
/* Let's first check whether we know the size of the
|
|
* instruction. If we do, we might get away without decoding
|
|
* the instruction.
|
|
*
|
|
* If we don't know the size we might as well do the full decode
|
|
* and proceed-with-trace flow we do for ptbq_decode.
|
|
*/
|
|
if (bce.isize) {
|
|
uint64_t ip;
|
|
int taken;
|
|
|
|
/* If the branch is not taken, we don't need to decode
|
|
* the instruction at @decoder->ip.
|
|
*
|
|
* If it is taken, we have to implement everything here.
|
|
* We can't use the normal decode and proceed-with-trace
|
|
* flow since we already consumed the TNT bit.
|
|
*/
|
|
status = pt_blk_cond_branch(decoder, &taken);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
/* Preserve the query decoder's response which indicates
|
|
* upcoming events.
|
|
*/
|
|
decoder->status = status;
|
|
|
|
ip = decoder->ip;
|
|
if (taken) {
|
|
struct pt_insn_ext iext;
|
|
struct pt_insn insn;
|
|
|
|
memset(&iext, 0, sizeof(iext));
|
|
memset(&insn, 0, sizeof(insn));
|
|
|
|
insn.mode = pt_bce_exec_mode(bce);
|
|
insn.ip = ip;
|
|
|
|
status = pt_blk_decode_in_section(&insn, &iext,
|
|
msec);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
ip += (uint64_t) (int64_t)
|
|
iext.variant.branch.displacement;
|
|
}
|
|
|
|
decoder->ip = ip + bce.isize;
|
|
break;
|
|
}
|
|
|
|
fallthrough;
|
|
case ptbq_decode: {
|
|
struct pt_insn_ext iext;
|
|
struct pt_insn insn;
|
|
|
|
/* We need to decode the instruction at @decoder->ip and decide
|
|
* what to do based on that.
|
|
*
|
|
* We already accounted for the instruction so we can't just
|
|
* call pt_blk_proceed_one_insn().
|
|
*/
|
|
|
|
memset(&iext, 0, sizeof(iext));
|
|
memset(&insn, 0, sizeof(insn));
|
|
|
|
insn.mode = pt_bce_exec_mode(bce);
|
|
insn.ip = decoder->ip;
|
|
|
|
status = pt_blk_decode_in_section(&insn, &iext, msec);
|
|
if (status < 0) {
|
|
if (status != -pte_bad_insn)
|
|
return status;
|
|
|
|
return pt_blk_proceed_truncated(decoder, block);
|
|
}
|
|
|
|
/* We just decoded @insn so we know the instruction class. */
|
|
block->iclass = insn.iclass;
|
|
|
|
/* Log calls' return addresses for return compression. */
|
|
status = pt_blk_log_call(decoder, &insn, &iext);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
/* Let's see if we can proceed to the next IP without trace.
|
|
*
|
|
* Note that we also stop due to displacement overflows or to
|
|
* maintain the return-address stack for near direct calls.
|
|
*/
|
|
status = pt_insn_next_ip(&decoder->ip, &insn, &iext);
|
|
if (status < 0) {
|
|
if (status != -pte_bad_query)
|
|
return status;
|
|
|
|
/* We can't, so let's proceed with trace, which
|
|
* completes the block.
|
|
*/
|
|
return pt_blk_proceed_with_trace(decoder, &insn, &iext);
|
|
}
|
|
|
|
/* End the block if the user asked us to.
|
|
*
|
|
* We only need to take care about direct near branches.
|
|
* Indirect and far branches require trace and will naturally
|
|
* end a block.
|
|
*/
|
|
if ((decoder->flags.variant.block.end_on_call &&
|
|
(insn.iclass == ptic_call)) ||
|
|
(decoder->flags.variant.block.end_on_jump &&
|
|
(insn.iclass == ptic_jump)))
|
|
break;
|
|
|
|
/* If we can proceed without trace and we stay in @msec we may
|
|
* proceed further.
|
|
*
|
|
* We're done if we switch sections, though.
|
|
*/
|
|
if (!pt_blk_is_in_section(msec, decoder->ip))
|
|
break;
|
|
|
|
return pt_blk_proceed_no_event_cached(decoder, block, bcache,
|
|
msec);
|
|
}
|
|
|
|
case ptbq_ind_call: {
|
|
uint64_t ip;
|
|
|
|
/* We're at a near indirect call. */
|
|
block->iclass = ptic_call;
|
|
|
|
/* We need to update the return-address stack and query the
|
|
* destination IP.
|
|
*/
|
|
ip = decoder->ip;
|
|
|
|
/* If we already know the size of the instruction, we don't need
|
|
* to re-decode it.
|
|
*/
|
|
if (bce.isize)
|
|
ip += bce.isize;
|
|
else {
|
|
struct pt_insn_ext iext;
|
|
struct pt_insn insn;
|
|
|
|
memset(&iext, 0, sizeof(iext));
|
|
memset(&insn, 0, sizeof(insn));
|
|
|
|
insn.mode = pt_bce_exec_mode(bce);
|
|
insn.ip = ip;
|
|
|
|
status = pt_blk_decode_in_section(&insn, &iext, msec);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
ip += insn.size;
|
|
}
|
|
|
|
status = pt_retstack_push(&decoder->retstack, ip);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
status = pt_blk_indirect_branch(decoder, &decoder->ip);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
/* Preserve the query decoder's response which indicates
|
|
* upcoming events.
|
|
*/
|
|
decoder->status = status;
|
|
break;
|
|
}
|
|
|
|
case ptbq_return: {
|
|
int taken;
|
|
|
|
/* We're at a near return. */
|
|
block->iclass = ptic_return;
|
|
|
|
/* Check for a compressed return. */
|
|
status = pt_blk_cond_branch(decoder, &taken);
|
|
if (status < 0) {
|
|
if (status != -pte_bad_query)
|
|
return status;
|
|
|
|
/* The return is not compressed. We need another query
|
|
* to determine the destination IP.
|
|
*/
|
|
status = pt_blk_indirect_branch(decoder, &decoder->ip);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
/* Preserve the query decoder's response which indicates
|
|
* upcoming events.
|
|
*/
|
|
decoder->status = status;
|
|
break;
|
|
}
|
|
|
|
/* Preserve the query decoder's response which indicates
|
|
* upcoming events.
|
|
*/
|
|
decoder->status = status;
|
|
|
|
/* A compressed return is indicated by a taken conditional
|
|
* branch.
|
|
*/
|
|
if (!taken)
|
|
return -pte_bad_retcomp;
|
|
|
|
return pt_retstack_pop(&decoder->retstack, &decoder->ip);
|
|
}
|
|
|
|
case ptbq_indirect:
|
|
/* We're at an indirect jump or far transfer.
|
|
*
|
|
* We don't know the exact instruction class and there's no
|
|
* reason to decode the instruction for any other purpose.
|
|
*
|
|
* Indicate that we don't know the instruction class and leave
|
|
* it to our caller to decode the instruction if needed.
|
|
*/
|
|
block->iclass = ptic_error;
|
|
|
|
/* This is neither a near call nor return so we don't need to
|
|
* touch the return-address stack.
|
|
*
|
|
* Just query the destination IP.
|
|
*/
|
|
status = pt_blk_indirect_branch(decoder, &decoder->ip);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
/* Preserve the query decoder's response which indicates
|
|
* upcoming events.
|
|
*/
|
|
decoder->status = status;
|
|
break;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int pt_blk_msec_fill(struct pt_block_decoder *decoder,
|
|
const struct pt_mapped_section **pmsec)
|
|
{
|
|
const struct pt_mapped_section *msec;
|
|
struct pt_section *section;
|
|
int isid, errcode;
|
|
|
|
if (!decoder || !pmsec)
|
|
return -pte_internal;
|
|
|
|
isid = pt_msec_cache_fill(&decoder->scache, &msec, decoder->image,
|
|
&decoder->asid, decoder->ip);
|
|
if (isid < 0)
|
|
return isid;
|
|
|
|
section = pt_msec_section(msec);
|
|
if (!section)
|
|
return -pte_internal;
|
|
|
|
*pmsec = msec;
|
|
|
|
errcode = pt_section_request_bcache(section);
|
|
if (errcode < 0)
|
|
return errcode;
|
|
|
|
return isid;
|
|
}
|
|
|
|
static inline int pt_blk_msec_lookup(struct pt_block_decoder *decoder,
|
|
const struct pt_mapped_section **pmsec)
|
|
{
|
|
int isid;
|
|
|
|
if (!decoder)
|
|
return -pte_internal;
|
|
|
|
isid = pt_msec_cache_read(&decoder->scache, pmsec, decoder->image,
|
|
decoder->ip);
|
|
if (isid < 0) {
|
|
if (isid != -pte_nomap)
|
|
return isid;
|
|
|
|
return pt_blk_msec_fill(decoder, pmsec);
|
|
}
|
|
|
|
return isid;
|
|
}
|
|
|
|
/* Proceed to the next decision point - try using the cache.
|
|
*
|
|
* Tracing is enabled and we don't have an event pending. Proceed as far as
|
|
* we get without trace. Stop when we either:
|
|
*
|
|
* - need trace in order to continue
|
|
* - overflow the max number of instructions in a block
|
|
*
|
|
* We actually proceed one instruction further to get the start IP for the next
|
|
* block. This only updates @decoder's internal state, though.
|
|
*
|
|
* Returns zero on success, a negative error code otherwise.
|
|
*/
|
|
static int pt_blk_proceed_no_event(struct pt_block_decoder *decoder,
|
|
struct pt_block *block)
|
|
{
|
|
const struct pt_mapped_section *msec;
|
|
struct pt_block_cache *bcache;
|
|
struct pt_section *section;
|
|
int isid;
|
|
|
|
if (!decoder || !block)
|
|
return -pte_internal;
|
|
|
|
isid = pt_blk_msec_lookup(decoder, &msec);
|
|
if (isid < 0) {
|
|
if (isid != -pte_nomap)
|
|
return isid;
|
|
|
|
/* Even if there is no such section in the image, we may still
|
|
* read the memory via the callback function.
|
|
*/
|
|
return pt_blk_proceed_no_event_uncached(decoder, block);
|
|
}
|
|
|
|
/* We do not switch sections inside a block. */
|
|
if (isid != block->isid) {
|
|
if (!pt_blk_block_is_empty(block))
|
|
return 0;
|
|
|
|
block->isid = isid;
|
|
}
|
|
|
|
section = pt_msec_section(msec);
|
|
if (!section)
|
|
return -pte_internal;
|
|
|
|
bcache = pt_section_bcache(section);
|
|
if (!bcache)
|
|
return pt_blk_proceed_no_event_uncached(decoder, block);
|
|
|
|
return pt_blk_proceed_no_event_cached(decoder, block, bcache, msec);
|
|
}
|
|
|
|
/* Proceed to the next event or decision point.
|
|
*
|
|
* Returns a non-negative pt_status_flag bit-vector on success, a negative error
|
|
* code otherwise.
|
|
*/
|
|
static int pt_blk_proceed(struct pt_block_decoder *decoder,
|
|
struct pt_block *block)
|
|
{
|
|
int status;
|
|
|
|
status = pt_blk_fetch_event(decoder);
|
|
if (status != 0) {
|
|
if (status < 0)
|
|
return status;
|
|
|
|
return pt_blk_proceed_event(decoder, block);
|
|
}
|
|
|
|
/* If tracing is disabled we should either be out of trace or we should
|
|
* have taken the event flow above.
|
|
*/
|
|
if (!decoder->enabled) {
|
|
if (decoder->status & pts_eos)
|
|
return -pte_eos;
|
|
|
|
return -pte_no_enable;
|
|
}
|
|
|
|
status = pt_blk_proceed_no_event(decoder, block);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
return pt_blk_proceed_trailing_event(decoder, block);
|
|
}
|
|
|
|
enum {
|
|
/* The maximum number of steps to take when determining whether the
|
|
* event location can be reached.
|
|
*/
|
|
bdm64_max_steps = 0x100
|
|
};
|
|
|
|
/* Try to work around erratum BDM64.
|
|
*
|
|
* If we got a transaction abort immediately following a branch that produced
|
|
* trace, the trace for that branch might have been corrupted.
|
|
*
|
|
* Returns a positive integer if the erratum was handled.
|
|
* Returns zero if the erratum does not seem to apply.
|
|
* Returns a negative error code otherwise.
|
|
*/
|
|
static int pt_blk_handle_erratum_bdm64(struct pt_block_decoder *decoder,
|
|
const struct pt_block *block,
|
|
const struct pt_event *ev)
|
|
{
|
|
struct pt_insn_ext iext;
|
|
struct pt_insn insn;
|
|
int status;
|
|
|
|
if (!decoder || !block || !ev)
|
|
return -pte_internal;
|
|
|
|
/* This only affects aborts. */
|
|
if (!ev->variant.tsx.aborted)
|
|
return 0;
|
|
|
|
/* This only affects branches that require trace.
|
|
*
|
|
* If the erratum hits, that branch ended the current block and brought
|
|
* us to the trailing event flow.
|
|
*/
|
|
if (pt_blk_block_is_empty(block))
|
|
return 0;
|
|
|
|
insn.mode = block->mode;
|
|
insn.ip = block->end_ip;
|
|
|
|
status = pt_insn_decode(&insn, &iext, decoder->image, &decoder->asid);
|
|
if (status < 0)
|
|
return 0;
|
|
|
|
if (!pt_insn_is_branch(&insn, &iext))
|
|
return 0;
|
|
|
|
/* Let's check if we can reach the event location from here.
|
|
*
|
|
* If we can, let's assume the erratum did not hit. We might still be
|
|
* wrong but we're not able to tell.
|
|
*/
|
|
status = pt_insn_range_is_contiguous(decoder->ip, ev->variant.tsx.ip,
|
|
decoder->mode, decoder->image,
|
|
&decoder->asid, bdm64_max_steps);
|
|
if (status > 0)
|
|
return status;
|
|
|
|
/* We can't reach the event location. This could either mean that we
|
|
* stopped too early (and status is zero) or that the erratum hit.
|
|
*
|
|
* We assume the latter and pretend that the previous branch brought us
|
|
* to the event location, instead.
|
|
*/
|
|
decoder->ip = ev->variant.tsx.ip;
|
|
|
|
return 1;
|
|
}
|
|
|
|
/* Check whether a trailing TSX event should be postponed.
|
|
*
|
|
* This involves handling erratum BDM64.
|
|
*
|
|
* Returns a positive integer if the event is to be postponed.
|
|
* Returns zero if the event should be processed.
|
|
* Returns a negative error code otherwise.
|
|
*/
|
|
static inline int pt_blk_postpone_trailing_tsx(struct pt_block_decoder *decoder,
|
|
struct pt_block *block,
|
|
const struct pt_event *ev)
|
|
{
|
|
int status;
|
|
|
|
if (!decoder || !ev)
|
|
return -pte_internal;
|
|
|
|
if (ev->ip_suppressed)
|
|
return 0;
|
|
|
|
if (block && decoder->query.config.errata.bdm64) {
|
|
status = pt_blk_handle_erratum_bdm64(decoder, block, ev);
|
|
if (status < 0)
|
|
return 1;
|
|
}
|
|
|
|
if (decoder->ip != ev->variant.tsx.ip)
|
|
return 1;
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* Proceed with events that bind to the current decoder IP.
|
|
*
|
|
* This function is used in the following scenarios:
|
|
*
|
|
* - we just synchronized onto the trace stream
|
|
* - we ended a block and proceeded to the next IP
|
|
* - we processed an event that was indicated by this function
|
|
*
|
|
* Check if there is an event at the current IP that needs to be indicated to
|
|
* the user.
|
|
*
|
|
* Returns a non-negative pt_status_flag bit-vector on success, a negative error
|
|
* code otherwise.
|
|
*/
|
|
static int pt_blk_proceed_trailing_event(struct pt_block_decoder *decoder,
|
|
struct pt_block *block)
|
|
{
|
|
struct pt_event *ev;
|
|
int status;
|
|
|
|
if (!decoder)
|
|
return -pte_internal;
|
|
|
|
status = pt_blk_fetch_event(decoder);
|
|
if (status <= 0) {
|
|
if (status < 0)
|
|
return status;
|
|
|
|
status = pt_blk_proceed_postponed_insn(decoder);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
return pt_blk_status(decoder, 0);
|
|
}
|
|
|
|
ev = &decoder->event;
|
|
switch (ev->type) {
|
|
case ptev_disabled:
|
|
/* Synchronous disable events are normally indicated on the
|
|
* event flow.
|
|
*/
|
|
if (!decoder->process_insn)
|
|
break;
|
|
|
|
/* A sync disable may bind to a CR3 changing instruction. */
|
|
if (ev->ip_suppressed &&
|
|
pt_insn_changes_cr3(&decoder->insn, &decoder->iext))
|
|
return pt_blk_status(decoder, pts_event_pending);
|
|
|
|
/* Or it binds to the next branch that would require trace.
|
|
*
|
|
* Try to complete processing the current instruction by
|
|
* proceeding past it. If that fails because it would require
|
|
* trace, we can apply the disabled event.
|
|
*/
|
|
status = pt_insn_next_ip(&decoder->ip, &decoder->insn,
|
|
&decoder->iext);
|
|
if (status < 0) {
|
|
if (status != -pte_bad_query)
|
|
return status;
|
|
|
|
status = pt_blk_set_disable_resume_ip(decoder,
|
|
&decoder->insn);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
return pt_blk_status(decoder, pts_event_pending);
|
|
}
|
|
|
|
/* We proceeded past the current instruction. */
|
|
status = pt_blk_clear_postponed_insn(decoder);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
/* This might have brought us to the disable IP. */
|
|
if (!ev->ip_suppressed &&
|
|
decoder->ip == ev->variant.disabled.ip)
|
|
return pt_blk_status(decoder, pts_event_pending);
|
|
|
|
break;
|
|
|
|
case ptev_enabled:
|
|
/* This event does not bind to an instruction. */
|
|
status = pt_blk_proceed_postponed_insn(decoder);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
return pt_blk_status(decoder, pts_event_pending);
|
|
|
|
case ptev_async_disabled:
|
|
/* This event does not bind to an instruction. */
|
|
status = pt_blk_proceed_postponed_insn(decoder);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
if (decoder->ip != ev->variant.async_disabled.at)
|
|
break;
|
|
|
|
if (decoder->query.config.errata.skd022) {
|
|
status = pt_blk_handle_erratum_skd022(decoder, ev);
|
|
if (status != 0) {
|
|
if (status < 0)
|
|
return status;
|
|
|
|
/* If the erratum applies, the event is modified
|
|
* to a synchronous disable event that will be
|
|
* processed on the next pt_blk_proceed_event()
|
|
* call. We're done.
|
|
*/
|
|
break;
|
|
}
|
|
}
|
|
|
|
return pt_blk_status(decoder, pts_event_pending);
|
|
|
|
case ptev_async_branch:
|
|
/* This event does not bind to an instruction. */
|
|
status = pt_blk_proceed_postponed_insn(decoder);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
if (decoder->ip != ev->variant.async_branch.from)
|
|
break;
|
|
|
|
return pt_blk_status(decoder, pts_event_pending);
|
|
|
|
case ptev_paging:
|
|
/* We apply the event immediately if we're not tracing. */
|
|
if (!decoder->enabled)
|
|
return pt_blk_status(decoder, pts_event_pending);
|
|
|
|
/* Synchronous paging events are normally indicated on the event
|
|
* flow, unless they bind to the same instruction as a previous
|
|
* event.
|
|
*
|
|
* We bind at most one paging event to an instruction, though.
|
|
*/
|
|
if (!decoder->process_insn || decoder->bound_paging)
|
|
break;
|
|
|
|
/* We're done if we're not binding to the currently postponed
|
|
* instruction. We will process the event on the normal event
|
|
* flow in the next iteration.
|
|
*/
|
|
if (!pt_insn_binds_to_pip(&decoder->insn, &decoder->iext))
|
|
break;
|
|
|
|
/* We bound a paging event. Make sure we do not bind further
|
|
* paging events to this instruction.
|
|
*/
|
|
decoder->bound_paging = 1;
|
|
|
|
return pt_blk_status(decoder, pts_event_pending);
|
|
|
|
case ptev_async_paging:
|
|
/* This event does not bind to an instruction. */
|
|
status = pt_blk_proceed_postponed_insn(decoder);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
if (!ev->ip_suppressed &&
|
|
decoder->ip != ev->variant.async_paging.ip)
|
|
break;
|
|
|
|
return pt_blk_status(decoder, pts_event_pending);
|
|
|
|
case ptev_vmcs:
|
|
/* We apply the event immediately if we're not tracing. */
|
|
if (!decoder->enabled)
|
|
return pt_blk_status(decoder, pts_event_pending);
|
|
|
|
/* Synchronous vmcs events are normally indicated on the event
|
|
* flow, unless they bind to the same instruction as a previous
|
|
* event.
|
|
*
|
|
* We bind at most one vmcs event to an instruction, though.
|
|
*/
|
|
if (!decoder->process_insn || decoder->bound_vmcs)
|
|
break;
|
|
|
|
/* We're done if we're not binding to the currently postponed
|
|
* instruction. We will process the event on the normal event
|
|
* flow in the next iteration.
|
|
*/
|
|
if (!pt_insn_binds_to_vmcs(&decoder->insn, &decoder->iext))
|
|
break;
|
|
|
|
/* We bound a vmcs event. Make sure we do not bind further vmcs
|
|
* events to this instruction.
|
|
*/
|
|
decoder->bound_vmcs = 1;
|
|
|
|
return pt_blk_status(decoder, pts_event_pending);
|
|
|
|
case ptev_async_vmcs:
|
|
/* This event does not bind to an instruction. */
|
|
status = pt_blk_proceed_postponed_insn(decoder);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
if (!ev->ip_suppressed &&
|
|
decoder->ip != ev->variant.async_vmcs.ip)
|
|
break;
|
|
|
|
return pt_blk_status(decoder, pts_event_pending);
|
|
|
|
case ptev_overflow:
|
|
/* This event does not bind to an instruction. */
|
|
status = pt_blk_proceed_postponed_insn(decoder);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
return pt_blk_status(decoder, pts_event_pending);
|
|
|
|
case ptev_exec_mode:
|
|
/* This event does not bind to an instruction. */
|
|
status = pt_blk_proceed_postponed_insn(decoder);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
if (!ev->ip_suppressed &&
|
|
decoder->ip != ev->variant.exec_mode.ip)
|
|
break;
|
|
|
|
return pt_blk_status(decoder, pts_event_pending);
|
|
|
|
case ptev_tsx:
|
|
/* This event does not bind to an instruction. */
|
|
status = pt_blk_proceed_postponed_insn(decoder);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
status = pt_blk_postpone_trailing_tsx(decoder, block, ev);
|
|
if (status != 0) {
|
|
if (status < 0)
|
|
return status;
|
|
|
|
break;
|
|
}
|
|
|
|
return pt_blk_status(decoder, pts_event_pending);
|
|
|
|
case ptev_stop:
|
|
/* This event does not bind to an instruction. */
|
|
status = pt_blk_proceed_postponed_insn(decoder);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
return pt_blk_status(decoder, pts_event_pending);
|
|
|
|
case ptev_exstop:
|
|
/* This event does not bind to an instruction. */
|
|
status = pt_blk_proceed_postponed_insn(decoder);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
if (!ev->ip_suppressed && decoder->enabled &&
|
|
decoder->ip != ev->variant.exstop.ip)
|
|
break;
|
|
|
|
return pt_blk_status(decoder, pts_event_pending);
|
|
|
|
case ptev_mwait:
|
|
/* This event does not bind to an instruction. */
|
|
status = pt_blk_proceed_postponed_insn(decoder);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
if (!ev->ip_suppressed && decoder->enabled &&
|
|
decoder->ip != ev->variant.mwait.ip)
|
|
break;
|
|
|
|
return pt_blk_status(decoder, pts_event_pending);
|
|
|
|
case ptev_pwre:
|
|
case ptev_pwrx:
|
|
/* This event does not bind to an instruction. */
|
|
status = pt_blk_proceed_postponed_insn(decoder);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
return pt_blk_status(decoder, pts_event_pending);
|
|
|
|
case ptev_ptwrite:
|
|
/* We apply the event immediately if we're not tracing. */
|
|
if (!decoder->enabled)
|
|
return pt_blk_status(decoder, pts_event_pending);
|
|
|
|
/* Ptwrite events are normally indicated on the event flow,
|
|
* unless they bind to the same instruction as a previous event.
|
|
*
|
|
* We bind at most one ptwrite event to an instruction, though.
|
|
*/
|
|
if (!decoder->process_insn || decoder->bound_ptwrite)
|
|
break;
|
|
|
|
/* We're done if we're not binding to the currently postponed
|
|
* instruction. We will process the event on the normal event
|
|
* flow in the next iteration.
|
|
*/
|
|
if (!ev->ip_suppressed ||
|
|
!pt_insn_is_ptwrite(&decoder->insn, &decoder->iext))
|
|
break;
|
|
|
|
/* We bound a ptwrite event. Make sure we do not bind further
|
|
* ptwrite events to this instruction.
|
|
*/
|
|
decoder->bound_ptwrite = 1;
|
|
|
|
return pt_blk_status(decoder, pts_event_pending);
|
|
|
|
case ptev_tick:
|
|
case ptev_cbr:
|
|
case ptev_mnt:
|
|
/* This event does not bind to an instruction. */
|
|
status = pt_blk_proceed_postponed_insn(decoder);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
return pt_blk_status(decoder, pts_event_pending);
|
|
}
|
|
|
|
/* No further events. Proceed past any postponed instruction. */
|
|
status = pt_blk_proceed_postponed_insn(decoder);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
return pt_blk_status(decoder, 0);
|
|
}
|
|
|
|
int pt_blk_next(struct pt_block_decoder *decoder, struct pt_block *ublock,
|
|
size_t size)
|
|
{
|
|
struct pt_block block, *pblock;
|
|
int errcode, status;
|
|
|
|
if (!decoder || !ublock)
|
|
return -pte_invalid;
|
|
|
|
pblock = size == sizeof(block) ? ublock : █
|
|
|
|
/* Zero-initialize the block in case of error returns. */
|
|
memset(pblock, 0, sizeof(*pblock));
|
|
|
|
/* Fill in a few things from the current decode state.
|
|
*
|
|
* This reflects the state of the last pt_blk_next() or pt_blk_start()
|
|
* call. Note that, unless we stop with tracing disabled, we proceed
|
|
* already to the start IP of the next block.
|
|
*
|
|
* Some of the state may later be overwritten as we process events.
|
|
*/
|
|
pblock->ip = decoder->ip;
|
|
pblock->mode = decoder->mode;
|
|
if (decoder->speculative)
|
|
pblock->speculative = 1;
|
|
|
|
/* Proceed one block. */
|
|
status = pt_blk_proceed(decoder, pblock);
|
|
|
|
errcode = block_to_user(ublock, size, pblock);
|
|
if (errcode < 0)
|
|
return errcode;
|
|
|
|
return status;
|
|
}
|
|
|
|
/* Process an enabled event.
|
|
*
|
|
* Returns zero on success, a negative error code otherwise.
|
|
*/
|
|
static int pt_blk_process_enabled(struct pt_block_decoder *decoder,
|
|
const struct pt_event *ev)
|
|
{
|
|
if (!decoder || !ev)
|
|
return -pte_internal;
|
|
|
|
/* This event can't be a status update. */
|
|
if (ev->status_update)
|
|
return -pte_bad_context;
|
|
|
|
/* We must have an IP in order to start decoding. */
|
|
if (ev->ip_suppressed)
|
|
return -pte_noip;
|
|
|
|
/* We must currently be disabled. */
|
|
if (decoder->enabled)
|
|
return -pte_bad_context;
|
|
|
|
decoder->ip = ev->variant.enabled.ip;
|
|
decoder->enabled = 1;
|
|
decoder->process_event = 0;
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* Process a disabled event.
|
|
*
|
|
* Returns zero on success, a negative error code otherwise.
|
|
*/
|
|
static int pt_blk_process_disabled(struct pt_block_decoder *decoder,
|
|
const struct pt_event *ev)
|
|
{
|
|
if (!decoder || !ev)
|
|
return -pte_internal;
|
|
|
|
/* This event can't be a status update. */
|
|
if (ev->status_update)
|
|
return -pte_bad_context;
|
|
|
|
/* We must currently be enabled. */
|
|
if (!decoder->enabled)
|
|
return -pte_bad_context;
|
|
|
|
/* We preserve @decoder->ip. This is where we expect tracing to resume
|
|
* and we'll indicate that on the subsequent enabled event if tracing
|
|
* actually does resume from there.
|
|
*/
|
|
decoder->enabled = 0;
|
|
decoder->process_event = 0;
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* Process an asynchronous branch event.
|
|
*
|
|
* Returns zero on success, a negative error code otherwise.
|
|
*/
|
|
static int pt_blk_process_async_branch(struct pt_block_decoder *decoder,
|
|
const struct pt_event *ev)
|
|
{
|
|
if (!decoder || !ev)
|
|
return -pte_internal;
|
|
|
|
/* This event can't be a status update. */
|
|
if (ev->status_update)
|
|
return -pte_bad_context;
|
|
|
|
/* We must currently be enabled. */
|
|
if (!decoder->enabled)
|
|
return -pte_bad_context;
|
|
|
|
/* Jump to the branch destination. We will continue from there in the
|
|
* next iteration.
|
|
*/
|
|
decoder->ip = ev->variant.async_branch.to;
|
|
decoder->process_event = 0;
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* Process a paging event.
|
|
*
|
|
* Returns zero on success, a negative error code otherwise.
|
|
*/
|
|
static int pt_blk_process_paging(struct pt_block_decoder *decoder,
|
|
const struct pt_event *ev)
|
|
{
|
|
uint64_t cr3;
|
|
int errcode;
|
|
|
|
if (!decoder || !ev)
|
|
return -pte_internal;
|
|
|
|
cr3 = ev->variant.paging.cr3;
|
|
if (decoder->asid.cr3 != cr3) {
|
|
errcode = pt_msec_cache_invalidate(&decoder->scache);
|
|
if (errcode < 0)
|
|
return errcode;
|
|
|
|
decoder->asid.cr3 = cr3;
|
|
}
|
|
|
|
decoder->process_event = 0;
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* Process a vmcs event.
|
|
*
|
|
* Returns zero on success, a negative error code otherwise.
|
|
*/
|
|
static int pt_blk_process_vmcs(struct pt_block_decoder *decoder,
|
|
const struct pt_event *ev)
|
|
{
|
|
uint64_t vmcs;
|
|
int errcode;
|
|
|
|
if (!decoder || !ev)
|
|
return -pte_internal;
|
|
|
|
vmcs = ev->variant.vmcs.base;
|
|
if (decoder->asid.vmcs != vmcs) {
|
|
errcode = pt_msec_cache_invalidate(&decoder->scache);
|
|
if (errcode < 0)
|
|
return errcode;
|
|
|
|
decoder->asid.vmcs = vmcs;
|
|
}
|
|
|
|
decoder->process_event = 0;
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* Process an overflow event.
|
|
*
|
|
* Returns zero on success, a negative error code otherwise.
|
|
*/
|
|
static int pt_blk_process_overflow(struct pt_block_decoder *decoder,
|
|
const struct pt_event *ev)
|
|
{
|
|
if (!decoder || !ev)
|
|
return -pte_internal;
|
|
|
|
/* This event can't be a status update. */
|
|
if (ev->status_update)
|
|
return -pte_bad_context;
|
|
|
|
/* If the IP is suppressed, the overflow resolved while tracing was
|
|
* disabled. Otherwise it resolved while tracing was enabled.
|
|
*/
|
|
if (ev->ip_suppressed) {
|
|
/* Tracing is disabled. It doesn't make sense to preserve the
|
|
* previous IP. This will just be misleading. Even if tracing
|
|
* had been disabled before, as well, we might have missed the
|
|
* re-enable in the overflow.
|
|
*/
|
|
decoder->enabled = 0;
|
|
decoder->ip = 0ull;
|
|
} else {
|
|
/* Tracing is enabled and we're at the IP at which the overflow
|
|
* resolved.
|
|
*/
|
|
decoder->enabled = 1;
|
|
decoder->ip = ev->variant.overflow.ip;
|
|
}
|
|
|
|
/* We don't know the TSX state. Let's assume we execute normally.
|
|
*
|
|
* We also don't know the execution mode. Let's keep what we have
|
|
* in case we don't get an update before we have to decode the next
|
|
* instruction.
|
|
*/
|
|
decoder->speculative = 0;
|
|
decoder->process_event = 0;
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* Process an exec mode event.
|
|
*
|
|
* Returns zero on success, a negative error code otherwise.
|
|
*/
|
|
static int pt_blk_process_exec_mode(struct pt_block_decoder *decoder,
|
|
const struct pt_event *ev)
|
|
{
|
|
enum pt_exec_mode mode;
|
|
|
|
if (!decoder || !ev)
|
|
return -pte_internal;
|
|
|
|
/* Use status update events to diagnose inconsistencies. */
|
|
mode = ev->variant.exec_mode.mode;
|
|
if (ev->status_update && decoder->enabled &&
|
|
decoder->mode != ptem_unknown && decoder->mode != mode)
|
|
return -pte_bad_status_update;
|
|
|
|
decoder->mode = mode;
|
|
decoder->process_event = 0;
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* Process a tsx event.
|
|
*
|
|
* Returns zero on success, a negative error code otherwise.
|
|
*/
|
|
static int pt_blk_process_tsx(struct pt_block_decoder *decoder,
|
|
const struct pt_event *ev)
|
|
{
|
|
if (!decoder || !ev)
|
|
return -pte_internal;
|
|
|
|
decoder->speculative = ev->variant.tsx.speculative;
|
|
decoder->process_event = 0;
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* Process a stop event.
|
|
*
|
|
* Returns zero on success, a negative error code otherwise.
|
|
*/
|
|
static int pt_blk_process_stop(struct pt_block_decoder *decoder,
|
|
const struct pt_event *ev)
|
|
{
|
|
if (!decoder || !ev)
|
|
return -pte_internal;
|
|
|
|
/* This event can't be a status update. */
|
|
if (ev->status_update)
|
|
return -pte_bad_context;
|
|
|
|
/* Tracing is always disabled before it is stopped. */
|
|
if (decoder->enabled)
|
|
return -pte_bad_context;
|
|
|
|
decoder->process_event = 0;
|
|
|
|
return 0;
|
|
}
|
|
|
|
int pt_blk_event(struct pt_block_decoder *decoder, struct pt_event *uevent,
|
|
size_t size)
|
|
{
|
|
struct pt_event *ev;
|
|
int status;
|
|
|
|
if (!decoder || !uevent)
|
|
return -pte_invalid;
|
|
|
|
/* We must currently process an event. */
|
|
if (!decoder->process_event)
|
|
return -pte_bad_query;
|
|
|
|
ev = &decoder->event;
|
|
switch (ev->type) {
|
|
case ptev_enabled:
|
|
/* Indicate that tracing resumes from the IP at which tracing
|
|
* had been disabled before (with some special treatment for
|
|
* calls).
|
|
*/
|
|
if (ev->variant.enabled.ip == decoder->ip)
|
|
ev->variant.enabled.resumed = 1;
|
|
|
|
status = pt_blk_process_enabled(decoder, ev);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
break;
|
|
|
|
case ptev_async_disabled:
|
|
if (decoder->ip != ev->variant.async_disabled.at)
|
|
return -pte_bad_query;
|
|
|
|
fallthrough;
|
|
case ptev_disabled:
|
|
|
|
status = pt_blk_process_disabled(decoder, ev);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
break;
|
|
|
|
case ptev_async_branch:
|
|
if (decoder->ip != ev->variant.async_branch.from)
|
|
return -pte_bad_query;
|
|
|
|
status = pt_blk_process_async_branch(decoder, ev);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
break;
|
|
|
|
case ptev_async_paging:
|
|
if (!ev->ip_suppressed &&
|
|
decoder->ip != ev->variant.async_paging.ip)
|
|
return -pte_bad_query;
|
|
|
|
fallthrough;
|
|
case ptev_paging:
|
|
status = pt_blk_process_paging(decoder, ev);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
break;
|
|
|
|
case ptev_async_vmcs:
|
|
if (!ev->ip_suppressed &&
|
|
decoder->ip != ev->variant.async_vmcs.ip)
|
|
return -pte_bad_query;
|
|
|
|
fallthrough;
|
|
case ptev_vmcs:
|
|
status = pt_blk_process_vmcs(decoder, ev);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
break;
|
|
|
|
case ptev_overflow:
|
|
status = pt_blk_process_overflow(decoder, ev);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
break;
|
|
|
|
case ptev_exec_mode:
|
|
if (!ev->ip_suppressed &&
|
|
decoder->ip != ev->variant.exec_mode.ip)
|
|
return -pte_bad_query;
|
|
|
|
status = pt_blk_process_exec_mode(decoder, ev);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
break;
|
|
|
|
case ptev_tsx:
|
|
if (!ev->ip_suppressed && decoder->ip != ev->variant.tsx.ip)
|
|
return -pte_bad_query;
|
|
|
|
status = pt_blk_process_tsx(decoder, ev);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
break;
|
|
|
|
case ptev_stop:
|
|
status = pt_blk_process_stop(decoder, ev);
|
|
if (status < 0)
|
|
return status;
|
|
|
|
break;
|
|
|
|
case ptev_exstop:
|
|
if (!ev->ip_suppressed && decoder->enabled &&
|
|
decoder->ip != ev->variant.exstop.ip)
|
|
return -pte_bad_query;
|
|
|
|
decoder->process_event = 0;
|
|
break;
|
|
|
|
case ptev_mwait:
|
|
if (!ev->ip_suppressed && decoder->enabled &&
|
|
decoder->ip != ev->variant.mwait.ip)
|
|
return -pte_bad_query;
|
|
|
|
decoder->process_event = 0;
|
|
break;
|
|
|
|
case ptev_pwre:
|
|
case ptev_pwrx:
|
|
case ptev_ptwrite:
|
|
case ptev_tick:
|
|
case ptev_cbr:
|
|
case ptev_mnt:
|
|
decoder->process_event = 0;
|
|
break;
|
|
}
|
|
|
|
/* Copy the event to the user. Make sure we're not writing beyond the
|
|
* memory provided by the user.
|
|
*
|
|
* We might truncate details of an event but only for those events the
|
|
* user can't know about, anyway.
|
|
*/
|
|
if (sizeof(*ev) < size)
|
|
size = sizeof(*ev);
|
|
|
|
memcpy(uevent, ev, size);
|
|
|
|
/* Indicate further events. */
|
|
return pt_blk_proceed_trailing_event(decoder, NULL);
|
|
}
|