1/*
2 * Performance events ring-buffer code:
3 *
4 *  Copyright (C) 2008 Thomas Gleixner <tglx@linutronix.de>
5 *  Copyright (C) 2008-2011 Red Hat, Inc., Ingo Molnar
6 *  Copyright (C) 2008-2011 Red Hat, Inc., Peter Zijlstra <pzijlstr@redhat.com>
7 *  Copyright  ©  2009 Paul Mackerras, IBM Corp. <paulus@au1.ibm.com>
8 *
9 * For licensing details see kernel-base/COPYING
10 */
11
12#include <linux/perf_event.h>
13#include <linux/vmalloc.h>
14#include <linux/slab.h>
15#include <linux/circ_buf.h>
16#include <linux/poll.h>
17
18#include "internal.h"
19
20static void perf_output_wakeup(struct perf_output_handle *handle)
21{
22	atomic_set(&handle->rb->poll, POLLIN);
23
24	handle->event->pending_wakeup = 1;
25	irq_work_queue(&handle->event->pending);
26}
27
28/*
29 * We need to ensure a later event_id doesn't publish a head when a former
30 * event isn't done writing. However since we need to deal with NMIs we
31 * cannot fully serialize things.
32 *
33 * We only publish the head (and generate a wakeup) when the outer-most
34 * event completes.
35 */
36static void perf_output_get_handle(struct perf_output_handle *handle)
37{
38	struct ring_buffer *rb = handle->rb;
39
40	preempt_disable();
41	local_inc(&rb->nest);
42	handle->wakeup = local_read(&rb->wakeup);
43}
44
45static void perf_output_put_handle(struct perf_output_handle *handle)
46{
47	struct ring_buffer *rb = handle->rb;
48	unsigned long head;
49
50again:
51	head = local_read(&rb->head);
52
53	/*
54	 * IRQ/NMI can happen here, which means we can miss a head update.
55	 */
56
57	if (!local_dec_and_test(&rb->nest))
58		goto out;
59
60	/*
61	 * Since the mmap() consumer (userspace) can run on a different CPU:
62	 *
63	 *   kernel				user
64	 *
65	 *   if (LOAD ->data_tail) {		LOAD ->data_head
66	 *			(A)		smp_rmb()	(C)
67	 *	STORE $data			LOAD $data
68	 *	smp_wmb()	(B)		smp_mb()	(D)
69	 *	STORE ->data_head		STORE ->data_tail
70	 *   }
71	 *
72	 * Where A pairs with D, and B pairs with C.
73	 *
74	 * In our case (A) is a control dependency that separates the load of
75	 * the ->data_tail and the stores of $data. In case ->data_tail
76	 * indicates there is no room in the buffer to store $data we do not.
77	 *
78	 * D needs to be a full barrier since it separates the data READ
79	 * from the tail WRITE.
80	 *
81	 * For B a WMB is sufficient since it separates two WRITEs, and for C
82	 * an RMB is sufficient since it separates two READs.
83	 *
84	 * See perf_output_begin().
85	 */
86	smp_wmb(); /* B, matches C */
87	rb->user_page->data_head = head;
88
89	/*
90	 * Now check if we missed an update -- rely on previous implied
91	 * compiler barriers to force a re-read.
92	 */
93	if (unlikely(head != local_read(&rb->head))) {
94		local_inc(&rb->nest);
95		goto again;
96	}
97
98	if (handle->wakeup != local_read(&rb->wakeup))
99		perf_output_wakeup(handle);
100
101out:
102	preempt_enable();
103}
104
105int perf_output_begin(struct perf_output_handle *handle,
106		      struct perf_event *event, unsigned int size)
107{
108	struct ring_buffer *rb;
109	unsigned long tail, offset, head;
110	int have_lost, page_shift;
111	struct {
112		struct perf_event_header header;
113		u64			 id;
114		u64			 lost;
115	} lost_event;
116
117	rcu_read_lock();
118	/*
119	 * For inherited events we send all the output towards the parent.
120	 */
121	if (event->parent)
122		event = event->parent;
123
124	rb = rcu_dereference(event->rb);
125	if (unlikely(!rb))
126		goto out;
127
128	if (unlikely(!rb->nr_pages))
129		goto out;
130
131	handle->rb    = rb;
132	handle->event = event;
133
134	have_lost = local_read(&rb->lost);
135	if (unlikely(have_lost)) {
136		size += sizeof(lost_event);
137		if (event->attr.sample_id_all)
138			size += event->id_header_size;
139	}
140
141	perf_output_get_handle(handle);
142
143	do {
144		tail = ACCESS_ONCE(rb->user_page->data_tail);
145		offset = head = local_read(&rb->head);
146		if (!rb->overwrite &&
147		    unlikely(CIRC_SPACE(head, tail, perf_data_size(rb)) < size))
148			goto fail;
149
150		/*
151		 * The above forms a control dependency barrier separating the
152		 * @tail load above from the data stores below. Since the @tail
153		 * load is required to compute the branch to fail below.
154		 *
155		 * A, matches D; the full memory barrier userspace SHOULD issue
156		 * after reading the data and before storing the new tail
157		 * position.
158		 *
159		 * See perf_output_put_handle().
160		 */
161
162		head += size;
163	} while (local_cmpxchg(&rb->head, offset, head) != offset);
164
165	/*
166	 * We rely on the implied barrier() by local_cmpxchg() to ensure
167	 * none of the data stores below can be lifted up by the compiler.
168	 */
169
170	if (unlikely(head - local_read(&rb->wakeup) > rb->watermark))
171		local_add(rb->watermark, &rb->wakeup);
172
173	page_shift = PAGE_SHIFT + page_order(rb);
174
175	handle->page = (offset >> page_shift) & (rb->nr_pages - 1);
176	offset &= (1UL << page_shift) - 1;
177	handle->addr = rb->data_pages[handle->page] + offset;
178	handle->size = (1UL << page_shift) - offset;
179
180	if (unlikely(have_lost)) {
181		struct perf_sample_data sample_data;
182
183		lost_event.header.size = sizeof(lost_event);
184		lost_event.header.type = PERF_RECORD_LOST;
185		lost_event.header.misc = 0;
186		lost_event.id          = event->id;
187		lost_event.lost        = local_xchg(&rb->lost, 0);
188
189		perf_event_header__init_id(&lost_event.header,
190					   &sample_data, event);
191		perf_output_put(handle, lost_event);
192		perf_event__output_id_sample(event, handle, &sample_data);
193	}
194
195	return 0;
196
197fail:
198	local_inc(&rb->lost);
199	perf_output_put_handle(handle);
200out:
201	rcu_read_unlock();
202
203	return -ENOSPC;
204}
205
206unsigned int perf_output_copy(struct perf_output_handle *handle,
207		      const void *buf, unsigned int len)
208{
209	return __output_copy(handle, buf, len);
210}
211
212unsigned int perf_output_skip(struct perf_output_handle *handle,
213			      unsigned int len)
214{
215	return __output_skip(handle, NULL, len);
216}
217
218void perf_output_end(struct perf_output_handle *handle)
219{
220	perf_output_put_handle(handle);
221	rcu_read_unlock();
222}
223
224static void rb_irq_work(struct irq_work *work);
225
226static void
227ring_buffer_init(struct ring_buffer *rb, long watermark, int flags)
228{
229	long max_size = perf_data_size(rb);
230
231	if (watermark)
232		rb->watermark = min(max_size, watermark);
233
234	if (!rb->watermark)
235		rb->watermark = max_size / 2;
236
237	if (flags & RING_BUFFER_WRITABLE)
238		rb->overwrite = 0;
239	else
240		rb->overwrite = 1;
241
242	atomic_set(&rb->refcount, 1);
243
244	INIT_LIST_HEAD(&rb->event_list);
245	spin_lock_init(&rb->event_lock);
246	init_irq_work(&rb->irq_work, rb_irq_work);
247}
248
249static void ring_buffer_put_async(struct ring_buffer *rb)
250{
251	if (!atomic_dec_and_test(&rb->refcount))
252		return;
253
254	rb->rcu_head.next = (void *)rb;
255	irq_work_queue(&rb->irq_work);
256}
257
258/*
259 * This is called before hardware starts writing to the AUX area to
260 * obtain an output handle and make sure there's room in the buffer.
261 * When the capture completes, call perf_aux_output_end() to commit
262 * the recorded data to the buffer.
263 *
264 * The ordering is similar to that of perf_output_{begin,end}, with
265 * the exception of (B), which should be taken care of by the pmu
266 * driver, since ordering rules will differ depending on hardware.
267 */
268void *perf_aux_output_begin(struct perf_output_handle *handle,
269			    struct perf_event *event)
270{
271	struct perf_event *output_event = event;
272	unsigned long aux_head, aux_tail;
273	struct ring_buffer *rb;
274
275	if (output_event->parent)
276		output_event = output_event->parent;
277
278	/*
279	 * Since this will typically be open across pmu::add/pmu::del, we
280	 * grab ring_buffer's refcount instead of holding rcu read lock
281	 * to make sure it doesn't disappear under us.
282	 */
283	rb = ring_buffer_get(output_event);
284	if (!rb)
285		return NULL;
286
287	if (!rb_has_aux(rb) || !atomic_inc_not_zero(&rb->aux_refcount))
288		goto err;
289
290	/*
291	 * Nesting is not supported for AUX area, make sure nested
292	 * writers are caught early
293	 */
294	if (WARN_ON_ONCE(local_xchg(&rb->aux_nest, 1)))
295		goto err_put;
296
297	aux_head = local_read(&rb->aux_head);
298
299	handle->rb = rb;
300	handle->event = event;
301	handle->head = aux_head;
302	handle->size = 0;
303
304	/*
305	 * In overwrite mode, AUX data stores do not depend on aux_tail,
306	 * therefore (A) control dependency barrier does not exist. The
307	 * (B) <-> (C) ordering is still observed by the pmu driver.
308	 */
309	if (!rb->aux_overwrite) {
310		aux_tail = ACCESS_ONCE(rb->user_page->aux_tail);
311		handle->wakeup = local_read(&rb->aux_wakeup) + rb->aux_watermark;
312		if (aux_head - aux_tail < perf_aux_size(rb))
313			handle->size = CIRC_SPACE(aux_head, aux_tail, perf_aux_size(rb));
314
315		/*
316		 * handle->size computation depends on aux_tail load; this forms a
317		 * control dependency barrier separating aux_tail load from aux data
318		 * store that will be enabled on successful return
319		 */
320		if (!handle->size) { /* A, matches D */
321			event->pending_disable = 1;
322			perf_output_wakeup(handle);
323			local_set(&rb->aux_nest, 0);
324			goto err_put;
325		}
326	}
327
328	return handle->rb->aux_priv;
329
330err_put:
331	rb_free_aux(rb);
332
333err:
334	ring_buffer_put_async(rb);
335	handle->event = NULL;
336
337	return NULL;
338}
339
340/*
341 * Commit the data written by hardware into the ring buffer by adjusting
342 * aux_head and posting a PERF_RECORD_AUX into the perf buffer. It is the
343 * pmu driver's responsibility to observe ordering rules of the hardware,
344 * so that all the data is externally visible before this is called.
345 */
346void perf_aux_output_end(struct perf_output_handle *handle, unsigned long size,
347			 bool truncated)
348{
349	struct ring_buffer *rb = handle->rb;
350	bool wakeup = truncated;
351	unsigned long aux_head;
352	u64 flags = 0;
353
354	if (truncated)
355		flags |= PERF_AUX_FLAG_TRUNCATED;
356
357	/* in overwrite mode, driver provides aux_head via handle */
358	if (rb->aux_overwrite) {
359		flags |= PERF_AUX_FLAG_OVERWRITE;
360
361		aux_head = handle->head;
362		local_set(&rb->aux_head, aux_head);
363	} else {
364		aux_head = local_read(&rb->aux_head);
365		local_add(size, &rb->aux_head);
366	}
367
368	if (size || flags) {
369		/*
370		 * Only send RECORD_AUX if we have something useful to communicate
371		 */
372
373		perf_event_aux_event(handle->event, aux_head, size, flags);
374	}
375
376	aux_head = rb->user_page->aux_head = local_read(&rb->aux_head);
377
378	if (aux_head - local_read(&rb->aux_wakeup) >= rb->aux_watermark) {
379		wakeup = true;
380		local_add(rb->aux_watermark, &rb->aux_wakeup);
381	}
382
383	if (wakeup) {
384		if (truncated)
385			handle->event->pending_disable = 1;
386		perf_output_wakeup(handle);
387	}
388
389	handle->event = NULL;
390
391	local_set(&rb->aux_nest, 0);
392	rb_free_aux(rb);
393	ring_buffer_put_async(rb);
394}
395
396/*
397 * Skip over a given number of bytes in the AUX buffer, due to, for example,
398 * hardware's alignment constraints.
399 */
400int perf_aux_output_skip(struct perf_output_handle *handle, unsigned long size)
401{
402	struct ring_buffer *rb = handle->rb;
403	unsigned long aux_head;
404
405	if (size > handle->size)
406		return -ENOSPC;
407
408	local_add(size, &rb->aux_head);
409
410	aux_head = rb->user_page->aux_head = local_read(&rb->aux_head);
411	if (aux_head - local_read(&rb->aux_wakeup) >= rb->aux_watermark) {
412		perf_output_wakeup(handle);
413		local_add(rb->aux_watermark, &rb->aux_wakeup);
414		handle->wakeup = local_read(&rb->aux_wakeup) +
415				 rb->aux_watermark;
416	}
417
418	handle->head = aux_head;
419	handle->size -= size;
420
421	return 0;
422}
423
424void *perf_get_aux(struct perf_output_handle *handle)
425{
426	/* this is only valid between perf_aux_output_begin and *_end */
427	if (!handle->event)
428		return NULL;
429
430	return handle->rb->aux_priv;
431}
432
433#define PERF_AUX_GFP	(GFP_KERNEL | __GFP_ZERO | __GFP_NOWARN | __GFP_NORETRY)
434
435static struct page *rb_alloc_aux_page(int node, int order)
436{
437	struct page *page;
438
439	if (order > MAX_ORDER)
440		order = MAX_ORDER;
441
442	do {
443		page = alloc_pages_node(node, PERF_AUX_GFP, order);
444	} while (!page && order--);
445
446	if (page && order) {
447		/*
448		 * Communicate the allocation size to the driver
449		 */
450		split_page(page, order);
451		SetPagePrivate(page);
452		set_page_private(page, order);
453	}
454
455	return page;
456}
457
458static void rb_free_aux_page(struct ring_buffer *rb, int idx)
459{
460	struct page *page = virt_to_page(rb->aux_pages[idx]);
461
462	ClearPagePrivate(page);
463	page->mapping = NULL;
464	__free_page(page);
465}
466
467int rb_alloc_aux(struct ring_buffer *rb, struct perf_event *event,
468		 pgoff_t pgoff, int nr_pages, long watermark, int flags)
469{
470	bool overwrite = !(flags & RING_BUFFER_WRITABLE);
471	int node = (event->cpu == -1) ? -1 : cpu_to_node(event->cpu);
472	int ret = -ENOMEM, max_order = 0;
473
474	if (!has_aux(event))
475		return -ENOTSUPP;
476
477	if (event->pmu->capabilities & PERF_PMU_CAP_AUX_NO_SG) {
478		/*
479		 * We need to start with the max_order that fits in nr_pages,
480		 * not the other way around, hence ilog2() and not get_order.
481		 */
482		max_order = ilog2(nr_pages);
483
484		/*
485		 * PMU requests more than one contiguous chunks of memory
486		 * for SW double buffering
487		 */
488		if ((event->pmu->capabilities & PERF_PMU_CAP_AUX_SW_DOUBLEBUF) &&
489		    !overwrite) {
490			if (!max_order)
491				return -EINVAL;
492
493			max_order--;
494		}
495	}
496
497	rb->aux_pages = kzalloc_node(nr_pages * sizeof(void *), GFP_KERNEL, node);
498	if (!rb->aux_pages)
499		return -ENOMEM;
500
501	rb->free_aux = event->pmu->free_aux;
502	for (rb->aux_nr_pages = 0; rb->aux_nr_pages < nr_pages;) {
503		struct page *page;
504		int last, order;
505
506		order = min(max_order, ilog2(nr_pages - rb->aux_nr_pages));
507		page = rb_alloc_aux_page(node, order);
508		if (!page)
509			goto out;
510
511		for (last = rb->aux_nr_pages + (1 << page_private(page));
512		     last > rb->aux_nr_pages; rb->aux_nr_pages++)
513			rb->aux_pages[rb->aux_nr_pages] = page_address(page++);
514	}
515
516	/*
517	 * In overwrite mode, PMUs that don't support SG may not handle more
518	 * than one contiguous allocation, since they rely on PMI to do double
519	 * buffering. In this case, the entire buffer has to be one contiguous
520	 * chunk.
521	 */
522	if ((event->pmu->capabilities & PERF_PMU_CAP_AUX_NO_SG) &&
523	    overwrite) {
524		struct page *page = virt_to_page(rb->aux_pages[0]);
525
526		if (page_private(page) != max_order)
527			goto out;
528	}
529
530	rb->aux_priv = event->pmu->setup_aux(event->cpu, rb->aux_pages, nr_pages,
531					     overwrite);
532	if (!rb->aux_priv)
533		goto out;
534
535	ret = 0;
536
537	/*
538	 * aux_pages (and pmu driver's private data, aux_priv) will be
539	 * referenced in both producer's and consumer's contexts, thus
540	 * we keep a refcount here to make sure either of the two can
541	 * reference them safely.
542	 */
543	atomic_set(&rb->aux_refcount, 1);
544
545	rb->aux_overwrite = overwrite;
546	rb->aux_watermark = watermark;
547
548	if (!rb->aux_watermark && !rb->aux_overwrite)
549		rb->aux_watermark = nr_pages << (PAGE_SHIFT - 1);
550
551out:
552	if (!ret)
553		rb->aux_pgoff = pgoff;
554	else
555		rb_free_aux(rb);
556
557	return ret;
558}
559
560static void __rb_free_aux(struct ring_buffer *rb)
561{
562	int pg;
563
564	if (rb->aux_priv) {
565		rb->free_aux(rb->aux_priv);
566		rb->free_aux = NULL;
567		rb->aux_priv = NULL;
568	}
569
570	if (rb->aux_nr_pages) {
571		for (pg = 0; pg < rb->aux_nr_pages; pg++)
572			rb_free_aux_page(rb, pg);
573
574		kfree(rb->aux_pages);
575		rb->aux_nr_pages = 0;
576	}
577}
578
579void rb_free_aux(struct ring_buffer *rb)
580{
581	if (atomic_dec_and_test(&rb->aux_refcount))
582		irq_work_queue(&rb->irq_work);
583}
584
585static void rb_irq_work(struct irq_work *work)
586{
587	struct ring_buffer *rb = container_of(work, struct ring_buffer, irq_work);
588
589	if (!atomic_read(&rb->aux_refcount))
590		__rb_free_aux(rb);
591
592	if (rb->rcu_head.next == (void *)rb)
593		call_rcu(&rb->rcu_head, rb_free_rcu);
594}
595
596#ifndef CONFIG_PERF_USE_VMALLOC
597
598/*
599 * Back perf_mmap() with regular GFP_KERNEL-0 pages.
600 */
601
602static struct page *
603__perf_mmap_to_page(struct ring_buffer *rb, unsigned long pgoff)
604{
605	if (pgoff > rb->nr_pages)
606		return NULL;
607
608	if (pgoff == 0)
609		return virt_to_page(rb->user_page);
610
611	return virt_to_page(rb->data_pages[pgoff - 1]);
612}
613
614static void *perf_mmap_alloc_page(int cpu)
615{
616	struct page *page;
617	int node;
618
619	node = (cpu == -1) ? cpu : cpu_to_node(cpu);
620	page = alloc_pages_node(node, GFP_KERNEL | __GFP_ZERO, 0);
621	if (!page)
622		return NULL;
623
624	return page_address(page);
625}
626
627struct ring_buffer *rb_alloc(int nr_pages, long watermark, int cpu, int flags)
628{
629	struct ring_buffer *rb;
630	unsigned long size;
631	int i;
632
633	size = sizeof(struct ring_buffer);
634	size += nr_pages * sizeof(void *);
635
636	rb = kzalloc(size, GFP_KERNEL);
637	if (!rb)
638		goto fail;
639
640	rb->user_page = perf_mmap_alloc_page(cpu);
641	if (!rb->user_page)
642		goto fail_user_page;
643
644	for (i = 0; i < nr_pages; i++) {
645		rb->data_pages[i] = perf_mmap_alloc_page(cpu);
646		if (!rb->data_pages[i])
647			goto fail_data_pages;
648	}
649
650	rb->nr_pages = nr_pages;
651
652	ring_buffer_init(rb, watermark, flags);
653
654	return rb;
655
656fail_data_pages:
657	for (i--; i >= 0; i--)
658		free_page((unsigned long)rb->data_pages[i]);
659
660	free_page((unsigned long)rb->user_page);
661
662fail_user_page:
663	kfree(rb);
664
665fail:
666	return NULL;
667}
668
669static void perf_mmap_free_page(unsigned long addr)
670{
671	struct page *page = virt_to_page((void *)addr);
672
673	page->mapping = NULL;
674	__free_page(page);
675}
676
677void rb_free(struct ring_buffer *rb)
678{
679	int i;
680
681	perf_mmap_free_page((unsigned long)rb->user_page);
682	for (i = 0; i < rb->nr_pages; i++)
683		perf_mmap_free_page((unsigned long)rb->data_pages[i]);
684	kfree(rb);
685}
686
687#else
688static int data_page_nr(struct ring_buffer *rb)
689{
690	return rb->nr_pages << page_order(rb);
691}
692
693static struct page *
694__perf_mmap_to_page(struct ring_buffer *rb, unsigned long pgoff)
695{
696	/* The '>' counts in the user page. */
697	if (pgoff > data_page_nr(rb))
698		return NULL;
699
700	return vmalloc_to_page((void *)rb->user_page + pgoff * PAGE_SIZE);
701}
702
703static void perf_mmap_unmark_page(void *addr)
704{
705	struct page *page = vmalloc_to_page(addr);
706
707	page->mapping = NULL;
708}
709
710static void rb_free_work(struct work_struct *work)
711{
712	struct ring_buffer *rb;
713	void *base;
714	int i, nr;
715
716	rb = container_of(work, struct ring_buffer, work);
717	nr = data_page_nr(rb);
718
719	base = rb->user_page;
720	/* The '<=' counts in the user page. */
721	for (i = 0; i <= nr; i++)
722		perf_mmap_unmark_page(base + (i * PAGE_SIZE));
723
724	vfree(base);
725	kfree(rb);
726}
727
728void rb_free(struct ring_buffer *rb)
729{
730	schedule_work(&rb->work);
731}
732
733struct ring_buffer *rb_alloc(int nr_pages, long watermark, int cpu, int flags)
734{
735	struct ring_buffer *rb;
736	unsigned long size;
737	void *all_buf;
738
739	size = sizeof(struct ring_buffer);
740	size += sizeof(void *);
741
742	rb = kzalloc(size, GFP_KERNEL);
743	if (!rb)
744		goto fail;
745
746	INIT_WORK(&rb->work, rb_free_work);
747
748	all_buf = vmalloc_user((nr_pages + 1) * PAGE_SIZE);
749	if (!all_buf)
750		goto fail_all_buf;
751
752	rb->user_page = all_buf;
753	rb->data_pages[0] = all_buf + PAGE_SIZE;
754	rb->page_order = ilog2(nr_pages);
755	rb->nr_pages = !!nr_pages;
756
757	ring_buffer_init(rb, watermark, flags);
758
759	return rb;
760
761fail_all_buf:
762	kfree(rb);
763
764fail:
765	return NULL;
766}
767
768#endif
769
770struct page *
771perf_mmap_to_page(struct ring_buffer *rb, unsigned long pgoff)
772{
773	if (rb->aux_nr_pages) {
774		/* above AUX space */
775		if (pgoff > rb->aux_pgoff + rb->aux_nr_pages)
776			return NULL;
777
778		/* AUX space */
779		if (pgoff >= rb->aux_pgoff)
780			return virt_to_page(rb->aux_pages[pgoff - rb->aux_pgoff]);
781	}
782
783	return __perf_mmap_to_page(rb, pgoff);
784}
785