Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull perf fixes from Ingo Molnar:
 "A bit larger than what I'd wish for - half of it is due to hw driver
  updates to Intel Ivy-Bridge which info got recently released,
  cycles:pp should work there now too, amongst other things.  (but we
  are generally making exceptions for hardware enablement of this type.)

  There are also callchain fixes in it - responding to mostly
  theoretical (but valid) concerns.  The tooling side sports perf.data
  endianness/portability fixes which did not make it for the merge
  window - and various other fixes as well."

* 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (26 commits)
  perf/x86: Check user address explicitly in copy_from_user_nmi()
  perf/x86: Check if user fp is valid
  perf: Limit callchains to 127
  perf/x86: Allow multiple stacks
  perf/x86: Update SNB PEBS constraints
  perf/x86: Enable/Add IvyBridge hardware support
  perf/x86: Implement cycles:p for SNB/IVB
  perf/x86: Fix Intel shared extra MSR allocation
  x86/decoder: Fix bsr/bsf/jmpe decoding with operand-size prefix
  perf: Remove duplicate invocation on perf_event_for_each
  perf uprobes: Remove unnecessary check before strlist__delete
  perf symbols: Check for valid dso before creating map
  perf evsel: Fix 32 bit values endianity swap for sample_id_all header
  perf session: Handle endianity swap on sample_id_all header data
  perf symbols: Handle different endians properly during symbol load
  perf evlist: Pass third argument to ioctl explicitly
  perf tools: Update ioctl documentation for PERF_IOC_FLAG_GROUP
  perf tools: Make --version show kernel version instead of pull req tag
  perf tools: Check if callchain is corrupted
  perf callchain: Make callchain cursors TLS
  ...

8 files changed, 143 insertions, 62 deletions

diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
index 04cd6882308e..e1f3a17034fc 100644
--- a/arch/x86/include/asm/uaccess.h
+++ b/arch/x86/include/asm/uaccess.h
@@ -33,9 +33,8 @@
 #define segment_eq(a, b)        ((a).seg == (b).seg)
 
 #define user_addr_max() (current_thread_info()->addr_limit.seg)
-#define __addr_ok(addr)                                 \
-        ((unsigned long __force)(addr) <                \
-         (current_thread_info()->addr_limit.seg))
+#define __addr_ok(addr)         \
+        ((unsigned long __force)(addr) < user_addr_max())
 
 /*
  * Test whether a block of memory is a valid user space address.
@@ -47,14 +46,14 @@
  * This needs 33-bit (65-bit for x86_64) arithmetic. We have a carry...
  */
 
-#define __range_not_ok(addr, size)                                      \
+#define __range_not_ok(addr, size, limit)                               \
 ({                                                                      \
         unsigned long flag, roksum;                                     \
         __chk_user_ptr(addr);                                           \
         asm("add %3,%1 ; sbb %0,%0 ; cmp %1,%4 ; sbb $0,%0"             \
             : "=&r" (flag), "=r" (roksum)                               \
             : "1" (addr), "g" ((long)(size)),                           \
-              "rm" (current_thread_info()->addr_limit.seg));            \
+              "rm" (limit));                                            \
         flag;                                                           \
 })
 
@@ -77,7 +76,8 @@
  * checks that the pointer is in the user space range - after calling
  * this function, memory access functions may still return -EFAULT.
  */
-#define access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
+#define access_ok(type, addr, size) \
+        (likely(__range_not_ok(addr, size, user_addr_max()) == 0))
 
 /*
  * The exception table consists of pairs of addresses relative to the
diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
index e049d6da0183..c4706cf9c011 100644
--- a/arch/x86/kernel/cpu/perf_event.c
+++ b/arch/x86/kernel/cpu/perf_event.c
@@ -1496,6 +1496,7 @@ static struct cpu_hw_events *allocate_fake_cpuc(void)
                 if (!cpuc->shared_regs)
                         goto error;
         }
+        cpuc->is_fake = 1;
         return cpuc;
 error:
         free_fake_cpuc(cpuc);
@@ -1756,6 +1757,12 @@ perf_callchain_kernel(struct perf_callchain_entry *entry, struct pt_regs *regs)
         dump_trace(NULL, regs, NULL, 0, &backtrace_ops, entry);
 }
 
+static inline int
+valid_user_frame(const void __user *fp, unsigned long size)
+{
+        return (__range_not_ok(fp, size, TASK_SIZE) == 0);
+}
+
 #ifdef CONFIG_COMPAT
 
 #include <asm/compat.h>
@@ -1780,7 +1787,7 @@ perf_callchain_user32(struct pt_regs *regs, struct perf_callchain_entry *entry)
                 if (bytes != sizeof(frame))
                         break;
 
-                if (fp < compat_ptr(regs->sp))
+                if (!valid_user_frame(fp, sizeof(frame)))
                         break;
 
                 perf_callchain_store(entry, frame.return_address);
@@ -1826,7 +1833,7 @@ perf_callchain_user(struct perf_callchain_entry *entry, struct pt_regs *regs)
                 if (bytes != sizeof(frame))
                         break;
 
-                if ((unsigned long)fp < regs->sp)
+                if (!valid_user_frame(fp, sizeof(frame)))
                         break;
 
                 perf_callchain_store(entry, frame.return_address);
diff --git a/arch/x86/kernel/cpu/perf_event.h b/arch/x86/kernel/cpu/perf_event.h
index 6638aaf54493..7241e2fc3c17 100644
--- a/arch/x86/kernel/cpu/perf_event.h
+++ b/arch/x86/kernel/cpu/perf_event.h
@@ -117,6 +117,7 @@ struct cpu_hw_events {
         struct perf_event       *event_list[X86_PMC_IDX_MAX]; /* in enabled order */
 
         unsigned int            group_flag;
+        int                     is_fake;
 
         /*
          * Intel DebugStore bits
@@ -364,6 +365,7 @@ struct x86_pmu {
         int             pebs_record_size;
         void            (*drain_pebs)(struct pt_regs *regs);
         struct event_constraint *pebs_constraints;
+        void            (*pebs_aliases)(struct perf_event *event);
 
         /*
          * Intel LBR
diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
index 166546ec6aef..187c294bc658 100644
--- a/arch/x86/kernel/cpu/perf_event_intel.c
+++ b/arch/x86/kernel/cpu/perf_event_intel.c
@@ -1119,27 +1119,33 @@ intel_bts_constraints(struct perf_event *event)
         return NULL;
 }
 
-static bool intel_try_alt_er(struct perf_event *event, int orig_idx)
+static int intel_alt_er(int idx)
 {
         if (!(x86_pmu.er_flags & ERF_HAS_RSP_1))
-                return false;
+                return idx;
 
-        if (event->hw.extra_reg.idx == EXTRA_REG_RSP_0) {
-                event->hw.config &= ~INTEL_ARCH_EVENT_MASK;
-                event->hw.config |= 0x01bb;
-                event->hw.extra_reg.idx = EXTRA_REG_RSP_1;
-                event->hw.extra_reg.reg = MSR_OFFCORE_RSP_1;
-        } else if (event->hw.extra_reg.idx == EXTRA_REG_RSP_1) {
+        if (idx == EXTRA_REG_RSP_0)
+                return EXTRA_REG_RSP_1;
+
+        if (idx == EXTRA_REG_RSP_1)
+                return EXTRA_REG_RSP_0;
+
+        return idx;
+}
+
+static void intel_fixup_er(struct perf_event *event, int idx)
+{
+        event->hw.extra_reg.idx = idx;
+
+        if (idx == EXTRA_REG_RSP_0) {
                 event->hw.config &= ~INTEL_ARCH_EVENT_MASK;
                 event->hw.config |= 0x01b7;
-                event->hw.extra_reg.idx = EXTRA_REG_RSP_0;
                 event->hw.extra_reg.reg = MSR_OFFCORE_RSP_0;
+        } else if (idx == EXTRA_REG_RSP_1) {
+                event->hw.config &= ~INTEL_ARCH_EVENT_MASK;