arch/powerpc/perf: Check the instruction type before creating sample with perf_mem_data_src

JIRA: https://issues.redhat.com/browse/RHEL-80602

commit 2ffb26a
Author: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
Date:   Tue Jan 21 18:46:20 2025 +0530

    arch/powerpc/perf: Check the instruction type before creating sample with perf_mem_data_src

    perf mem report aborts as below sometimes (during some corner
    case) in powerpc:

       # ./perf mem report 1>out
       *** stack smashing detected ***: terminated
       Aborted (core dumped)

    The backtrace is as below:
       __pthread_kill_implementation ()
       raise ()
       abort ()
       __libc_message
       __fortify_fail
       __stack_chk_fail
       hist_entry.lvl_snprintf
       __sort__hpp_entry
       __hist_entry__snprintf
       hists.fprintf
       cmd_report
       cmd_mem

    Snippet of code which triggers the issue
    from tools/perf/util/sort.c

       static int hist_entry__lvl_snprintf(struct hist_entry *he, char *bf,
                                        size_t size, unsigned int width)
       {
            char out[64];

            perf_mem__lvl_scnprintf(out, sizeof(out), he->mem_info);
            return repsep_snprintf(bf, size, "%-*s", width, out);
       }

    The value of "out" is filled from perf_mem_data_src value.
    Debugging this further showed that for some corner cases, the
    value of "data_src" was pointing to wrong value. This resulted
    in bigger size of string and causing stack check fail.

    The perf mem data source values are captured in the sample via
    isa207_get_mem_data_src function. The initial check is to fetch
    the type of sampled instruction. If the type of instruction is
    not valid (not a load/store instruction), the function returns.

    Since 'commit e16fd7f ("perf: Use sample_flags for data_src")',
    data_src field is not initialized by the perf_sample_data_init()
    function. If the PMU driver doesn't set the data_src value to zero if
    type is not valid, this will result in uninitailised value for data_src.
    The uninitailised value of data_src resulted in stack check fail
    followed by abort for "perf mem report".

    When requesting for data source information in the sample, the
    instruction type is expected to be load or store instruction.
    In ISA v3.0, due to hardware limitation, there are corner cases
    where the instruction type other than load or store is observed.
    In ISA v3.0 and before values "0" and "7" are considered reserved.
    In ISA v3.1, value "7" has been used to indicate "larx/stcx".
    Drop the sample if instruction type has reserved values for this
    field with a ISA version check. Initialize data_src to zero in
    isa207_get_mem_data_src if the instruction type is not load/store.

    Reported-by: Disha Goel <disgoel@linux.vnet.ibm.com>
    Signed-off-by: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
    Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
    Link: https://patch.msgid.link/20250121131621.39054-1-atrajeev@linux.vnet.ibm.com

Signed-off-by: Mamatha Inamdar <minamdar@redhat.com>

Author: Mamatha Inamdar

arch/powerpc/perf/core-book3s.c

@@ -2212,6 +2212,10 @@ static struct pmu power_pmu = {
 #define PERF_SAMPLE_ADDR_TYPE  (PERF_SAMPLE_ADDR |		\
 				PERF_SAMPLE_PHYS_ADDR |		\
 				PERF_SAMPLE_DATA_PAGE_SIZE)
+
+#define SIER_TYPE_SHIFT	15
+#define SIER_TYPE_MASK	(0x7ull << SIER_TYPE_SHIFT)
+
 /*
  * A counter has overflowed; update its count and record
  * things if requested.  Note that interrupts are hard-disabled
@@ -2280,6 +2284,22 @@ static void record_and_restart(struct perf_event *event, unsigned long val,
 	    is_kernel_addr(mfspr(SPRN_SIAR)))
 		record = 0;
 
+	/*
+	 * SIER[46-48] presents instruction type of the sampled instruction.
+	 * In ISA v3.0 and before values "0" and "7" are considered reserved.
+	 * In ISA v3.1, value "7" has been used to indicate "larx/stcx".
+	 * Drop the sample if "type" has reserved values for this field with a
+	 * ISA version check.
+	 */
+	if (event->attr.sample_type & PERF_SAMPLE_DATA_SRC &&
+			ppmu->get_mem_data_src) {
+		val = (regs->dar & SIER_TYPE_MASK) >> SIER_TYPE_SHIFT;
+		if (val == 0 || (val == 7 && !cpu_has_feature(CPU_FTR_ARCH_31))) {
+			record = 0;
+			atomic64_inc(&event->lost_samples);
+		}
+	}
+
 	/*
 	 * Finally record data if requested.
 	 */

arch/powerpc/perf/isa207-common.c

@@ -321,8 +321,10 @@ void isa207_get_mem_data_src(union perf_mem_data_src *dsrc, u32 flags,
 
 	sier = mfspr(SPRN_SIER);
 	val = (sier & ISA207_SIER_TYPE_MASK) >> ISA207_SIER_TYPE_SHIFT;
-	if (val != 1 && val != 2 && !(val == 7 && cpu_has_feature(CPU_FTR_ARCH_31)))
+	if (val != 1 && val != 2 && !(val == 7 && cpu_has_feature(CPU_FTR_ARCH_31))) {
+		dsrc->val = 0;
 		return;
+	}
 
 	idx = (sier & ISA207_SIER_LDST_MASK) >> ISA207_SIER_LDST_SHIFT;
 	sub_idx = (sier & ISA207_SIER_DATA_SRC_MASK) >> ISA207_SIER_DATA_SRC_SHIFT;