linux.git/tools/perf/util/intel-pt-decoder/intel-pt-insn-decoder.c, branch master

perf intel-pt: Fix snprintf size tracking bug in insn decoder

2026-06-10T21:56:01+00:00

dump_insn() tracks remaining buffer space with a 'left' variable,
but the loop subtracts the cumulative offset 'n' each iteration
instead of just the per-iteration delta:

    n += snprintf(x->out + n, left, "%02x ", inbuf[i]);
    left -= n;  /* BUG: n is cumulative, not the delta */

After two iterations left goes massively negative, wrapping to a
huge value when passed as size_t to snprintf(), disabling all bounds
checking for the rest of the loop.

Switch to scnprintf() accumulation using sizeof(x->out) - n as the
remaining space, which is always correct and eliminates the separate
'left' variable entirely.

Fixes: 48d02a1d5c137d36 ("perf script: Add 'brstackinsn' for branch stacks")
Reported-by: sashiko-bot 
Cc: Adrian Hunter 
Cc: Andi Kleen 
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo

x86/insn: Add XOP prefix instructions decoder support

2025-08-18T15:15:02+00:00

Support decoding AMD's XOP prefix encoded instructions.

These instructions are introduced for Bulldozer micro architecture, and not
supported on Intel's processors. But when compiling kernel with
CONFIG_X86_NATIVE_CPU on some AMD processor (e.g. -march=bdver2), these
instructions can be used.

Closes: https://lore.kernel.org/all/871pq06728.fsf@wylie.me.uk/
Reported-by: Alan J. Wylie 
Signed-off-by: Masami Hiramatsu (Google) 
Signed-off-by: Borislav Petkov (AMD) 
Tested-by: Alan J. Wylie 
Link: https://lore.kernel.org/175386161199.564247.597496379413236944.stgit@devnote2

perf x86: Define arch_fetch_insn in NO_AUXTRACE builds

2024-12-18T19:24:33+00:00

archinsn.c containing arch_fetch_insn was only enabled with
CONFIG_AUXTRACE, but this meant that a NO_AUXTRACE build on x86 would
use the empty weak version of arch_fetch_insn - weak symbols are a
frequent source of errors like this and are outside of the C
specification. Change it so that archinsn.c is always built on x86 and
make the weak symbol empty version of arch_fetch_insn a strong one
guarded by ifdefs.

arch_fetch_insn on x86 depends on insn_decode which is a function
included then built into intel-pt-insn-decoder.c.
intel-pt-insn-decoder.c isn't built in a NO_AUXTRACE=1 build. Separate
the insn_decode function from intel-pt-insn-decoder.c by just directly
compiling the relevant file. Guard this compilation to be for either
always on x86 (because of the use in arch_fetch_insn) or when auxtrace
is enabled. Apply the CFLAGS overrides as necessary, reducing the amount
of code where warnings are disabled.

Signed-off-by: Ian Rogers 
Tested-by: Adrian Hunter 
Tested-by: Arnaldo Carvalho de Melo 
Cc: Alexander Shishkin 
Cc: Andi Kleen 
Cc: Athira Rajeev 
Cc: Colin Ian King 
Cc: Dapeng Mi 
Cc: Howard Chu 
Cc: Ilya Leoshkevich 
Cc: Ingo Molnar 
Cc: James Clark 
Cc: Jiri Olsa 
Cc: Josh Poimboeuf 
Cc: Kan Liang 
Cc: Mark Rutland 
Cc: Michael Petlan 
Cc: Namhyung Kim 
Cc: Peter Zijlstra 
Cc: Thomas Richter 
Cc: Veronika Molnarova 
Cc: Weilin Wang 
Link: https://lore.kernel.org/r/20241119011644.971342-13-irogers@google.com
Signed-off-by: Arnaldo Carvalho de Melo

perf script: Minimize "not reaching sample" for '-F +brstackinsn'

2024-09-03T15:22:01+00:00

In some situations 'perf script -F +brstackinsn' sees a lot of "not
reaching sample" messages.

This happens when the last LBR block before the sample contains a branch
that is not in the LBR, and the instruction dumping stops.

  $ perf record -b  emacs -Q --batch '()'
  [ perf record: Woken up 1 times to write data ]
  [ perf record: Captured and wrote 0.396 MB perf.data (443 samples) ]
  $ perf script -F +brstackinsn
  ...
          00007f0ab2d171a4        insn: 41 0f 94 c0
          00007f0ab2d171a8        insn: 83 fa 01
          00007f0ab2d171ab        insn: 74 d3                     # PRED 6 cycles [313] 1.00 IPC
          00007f0ab2d17180        insn: 45 84 c0
          00007f0ab2d17183        insn: 74 28
          ... not reaching sample ...

  $ perf script -F +brstackinsn | grep -c reach
  136
  $

This is a problem for further analysis that wants to see the full code
upto the sample.

There are two common cases where the message is bogus:

- The LBR only logs taken branches, but the branch might be a
  conditional branch that is not taken (that is the most common case
  actually)

- The LBR sampling uses a filter ignoring some branches, but the perf
  script check checks for all branches.

This patch fixes these two conditions, by only checking for conditional
branches, as well as checking the perf_event_attr's branch filter
attributes.

For the test case above it fixes all the messages:

  $ ./perf script -F +brstackinsn | grep -c reach
  0

Note that there are still conditions when the message is hit --
sometimes there can be a unconditional branch that misses the LBR update
before the sample -- but they are much more rare now.

Signed-off-by: Andi Kleen 
Reviewed-by: Adrian Hunter 
Link: https://lore.kernel.org/r/20240229161828.386397-1-ak@linux.intel.com
Signed-off-by: Arnaldo Carvalho de Melo

perf intel pt: Add new JMPABS instruction to the Intel PT instruction decoder

2024-06-25T18:06:19+00:00

JMPABS is 64-bit absolute direct jump instruction, encoded with a mandatory
REX2 prefix. JMPABS is designed to be used in the procedure linkage table
(PLT) to replace indirect jumps, because it has better performance. In that
case the jump target will be amended at run time. To enable Intel PT to
follow the code, a TIP packet is always emitted when JMPABS is traced under
Intel PT.

Refer to the Intel Advanced Performance Extensions (Intel APX) Architecture
Specification for details.

Decode JMPABS as an indirect jump, because it has an associated TIP packet
the same as an indirect jump and the control flow should follow the TIP
packet payload, and not assume it is the same as the on-file object code
JMPABS target address.

Signed-off-by: Adrian Hunter 
Cc: Borislav Petkov 
Cc: Chang S. Bae 
Cc: Masami Hiramatsu 
Cc: Thomas Gleixner 
Cc: Dave Hansen 
Cc: Nikolay Borisov 
Cc: H. Peter Anvin 
Cc: x86@kernel.org
Signed-off-by: Namhyung Kim 
Link: https://lore.kernel.org/r/20240502105853.5338-10-adrian.hunter@intel.com

perf intel-pt: Add support for new branch instructions ERETS and ERETU

2023-03-20T22:25:40+00:00

Intel Flexible Return and Event Delivery (FRED) adds instructions ERETS
(return to supervisor) and ERETU (return to user). Intel PT instruction
decoder needs to know about these instructions because they are
branch instructions. Similar to IRET instructions, when the decoder
encounters one of these instructions it will match it to a TIP (target
instruction pointer) packet that informs what the branch destination is.

The existing "x86 instruction decoder - new instructions" test can be
used to test the result e.g.

  $ perf test -v ins |& grep eret
  Decoded ok: f2 0f 01 ca         erets
  Decoded ok: f3 0f 01 ca         eretu

Signed-off-by: Adrian Hunter 
Acked-by: Ian Rogers 
Cc: Jiri Olsa 
Cc: Namhyung Kim 
Link: https://lore.kernel.org/r/20230320183517.15099-2-adrian.hunter@intel.com
Signed-off-by: Arnaldo Carvalho de Melo

perf tools: Move 'struct perf_sample' to a separate header file to disentangle headers

2022-10-31T14:06:41+00:00

Some places were including event.h just to get 'struct perf_sample',
move it to a separate place so that we speed up a bit the build.

Signed-off-by: Arnaldo Carvalho de Melo

perf intel-pt: Add support for emulated ptwrite

2022-05-17T14:55:49+00:00

ptwrite is an Intel x86 instruction that writes arbitrary values into an
Intel PT trace. It is not supported on all hardware, so provide an
alternative that makes use of TNT packets to convey the payload data.
TNT packets encode Taken/Not-taken conditional branch information, so
taking branches based on the payload value will encode the value into
the TNT packet. Refer to the changes to the documentation file
perf-intel-pt.txt in this patch for an example.

Signed-off-by: Adrian Hunter 
Cc: Jiri Olsa 
Link: https://lore.kernel.org/r/20220509152400.376613-2-adrian.hunter@intel.com
Signed-off-by: Arnaldo Carvalho de Melo

perf tools: Use __BYTE_ORDER__

2021-11-07T15:27:38+00:00

Switch from the libc-defined __BYTE_ORDER to the compiler-defined
__BYTE_ORDER__ in order to make endianness detection more robust, like
it was done for libbpf.

Signed-off-by: Ilya Leoshkevich 
Suggested-by: Arnaldo Carvalho de Melo 
Cc: Heiko Carstens 
Cc: Thomas Richter 
Cc: Vasily Gorbik 
Link: https://lore.kernel.org/r/20211104132311.984703-1-iii@linux.ibm.com
Signed-off-by: Arnaldo Carvalho de Melo

tools/perf: Convert to insn_decode()

2021-03-15T11:41:26+00:00

Simplify code, no functional changes.

Signed-off-by: Borislav Petkov 
Cc: Arnaldo Carvalho de Melo 
Link: https://lkml.kernel.org/r/20210304174237.31945-20-bp@alien8.de