libipt, ild: fix SYSEXIT classification

A SYSEXIT instruction is incorrectly classified SYSENTER.  Fix it.

Add unit tests for SYSCALL, SYSRET, SYSENTER, SYSEXIT, INT3, INTn, and IRET.

Change-Id: I657a0b0f55b9b254445d928a58c900999bddc531
Signed-off-by: Markus Metzger <markus.t.metzger@intel.com>
libipt, ild: mark far branches

Add a new flag branch_far that is set for far branches and classify far
branches using the existing branch, call, and ret flags.

We exclude INT instructions since PT treats them as interrupts.

Add unit tests for far branches.

Change-Id: I22228cf15171231adb9353859f62cefb1bdbbf80
Signed-off-by: Markus Metzger <markus.t.metzger@intel.com>
libipt: only near returns are compressed

Exclude far calls and returns from return compression handling in proceed().

Change-Id: If2b9e77f0b2e3c6562d7cb77f2be90499584e110
Signed-off-by: Markus Metzger <markus.t.metzger@intel.com>
libipt: indicate far transfer instructions

With the previous change, we classified far transfers like SYSENTER and SYSEXIT
as (near) call and (near) return, respectively.

Add a new set of instruction classes for far transfers.

Change-Id: I15fe60f9dfde4ebf5267ee3d365c2c34190e2a4d
Signed-off-by: Markus Metzger <markus.t.metzger@intel.com>
test: add syscall/sysret like tests

Add tests for INT/IRET, SYSCALL/SYSRET, and SYSENTER/SYSEXIT.

For each instruction pair, we add tests without CPL filtering and with
CPL 0 and 3 filtered out, respectively.

Change-Id: Idca28fbfe57daba0c7ebdef09b3c1674f68bb5a6
Signed-off-by: Markus Metzger <markus.t.metzger@intel.com>