New attempt at adding an disassembler to perf

A native disassembler in perf is very useful, in particular with perf script to trace instruction streams, but also for other analysis. Previously I attempted to do this using the udis86 library, but that was rejected because:
- udis86 was not maintained anymore and lacking recent instructions
- udis86 is dynamically linked and gives a runtime dependency.
Doing this needs a full disassembler, not just a decoder, so the existing instruction decoder cannot be used without major changes.

This patchkit addresses these issues. Intel recently released an open source version of the XED disassembler library, which is used in many other Intel software. It is very well maintained, uptodate, and supports static linking, so there is no runtime dependency. This version adds XED support to perf, and uses it to implement assembler output in perf script. It also fixes a range of issues in the previous version, see the individual change logs.

Available in
git://git.kernel.org/pub/scm/linux/kernel/git/ak/linux-misc.git perf/xed-3

v1: First post of XED version

-Andi

From: Andi Kleen <[email protected]>

Add autoprobing for the xed disassembler library.

Can be downloaded from https://github.com/intelxed/xed

---
 tools/build/Makefile.feature   | 6 ++++--
 tools/build/feature/Makefile   | 8 ++++++--
 tools/build/feature/test-all.c | 5 +++++
 tools/build/feature/test-xed.c | 9 +++++++++
 tools/perf/Makefile.config     | 5 +++++
 5 files changed, 29 insertions(+), 4 deletions(-)
 create mode 100644 tools/build/feature/test-xed.c

index e3fb5ecbdcb6..25183fa39963 100644
@@ -63,7 +63,8 @@ FEATURE_TESTS_BASIC :=                  \
         lzma                            \
         get_cpuid                       \
         bpf                             \
-        sdt
+	sdt				\
+	xed
 
 # FEATURE_TESTS_BASIC + FEATURE_TESTS_EXTRA is the complete list
 # of all feature tests

@@ -105,7 +106,8 @@ FEATURE_DISPLAY ?=              \
          zlib                   \
          lzma                   \
          get_cpuid              \
-         bpf
+	 bpf			\
+	 xed
 
 # Set FEATURE_CHECK_(C|LD)FLAGS-all for all FEATURE_TESTS features.
 # If in the future we need per-feature checks/flags for features not

index b564a2eea039..a1275965c67d 100644
@@ -48,7 +48,8 @@ FILES=                                          \
          test-get_cpuid.bin                     \
          test-sdt.bin                           \
          test-cxx.bin                           \
-         test-jvmti.bin
+         test-jvmti.bin				\
+         test-xed.bin
 
 FILES := $(addprefix $(OUTPUT),$(FILES))
 

@@ -68,7 +69,7 @@ __BUILDXX = $(CXX) $(CXXFLAGS) -Wall -Werror -o $@ $(patsubst %.bin,%.cpp,$(@F))
 ###############################
 
 $(OUTPUT)test-all.bin:
-	$(BUILD) -fstack-protector-all -O2 -D_FORTIFY_SOURCE=2 -ldw -lelf -lnuma -lelf -laudit -I/usr/include/slang -lslang $(shell $(PKG_CONFIG) --libs --cflags gtk+-2.0 2>/dev/null) $(FLAGS_PERL_EMBED) $(FLAGS_PYTHON_EMBED) -DPACKAGE='"perf"' -lbfd -ldl -lz -llzma
+	$(BUILD) -fstack-protector-all -O2 -D_FORTIFY_SOURCE=2 -ldw -lelf -lnuma -lelf -laudit -I/usr/include/slang -lslang $(shell $(PKG_CONFIG) --libs --cflags gtk+-2.0 2>/dev/null) $(FLAGS_PERL_EMBED) $(FLAGS_PYTHON_EMBED) -DPACKAGE='"perf"' -lbfd -ldl -lz -llzma -lxed
 
 $(OUTPUT)test-hello.bin:
 	$(BUILD)

@@ -123,6 +124,9 @@ $(OUTPUT)test-numa_num_possible_cpus.bin:
 $(OUTPUT)test-libunwind.bin:
 	$(BUILD) -lelf
 
+$(OUTPUT)test-xed.bin:
+	$(BUILD) -lxed
+
 $(OUTPUT)test-libunwind-debug-frame.bin:
 	$(BUILD) -lelf
 $(OUTPUT)test-libunwind-x86.bin:

index 699e43627397..4a6dd1d1ff49 100644
@@ -149,6 +149,10 @@
 # include "test-sdt.c"
 #undef main
 
+#define main main_test_xed
+#  include "test-xed.c"
+#endif
+
 int main(int argc, char *argv[])
 {
 	main_test_libpython();

@@ -183,6 +187,7 @@ int main(int argc, char *argv[])
 	main_test_bpf();
 	main_test_libcrypto();
 	main_test_sdt();
+	main_test_xed();
 
 	return 0;
 }

new file mode 100644
index 000000000000..ef9aebf1559d
@@ -0,0 +1,9 @@
+#include <xed/xed-interface.h>
+#include <xed/xed-decode.h>
+#include <xed/xed-decoded-inst-api.h>
+
+int main(void)
+{
+	xed_tables_init();
+	return 0;
+}

index 76c84f0eec52..41cc34ce81f8 100644
@@ -682,6 +682,11 @@ ifndef NO_ZLIB
   endif
 endif
 
+ifeq ($(feature-xed), 1)
+  EXTLIBS += -lxed
+  $(call detected,CONFIG_XED)
+endif
+
 ifndef NO_LZMA
   ifeq ($(feature-lzma), 1)
     CFLAGS += -DHAVE_LZMA_SUPPORT

2.9.3

It should be eventually packaged. How would people know they are missing it without displaying it? I think it has to, otherwise most people will miss out on the feature. Silent failure is bad.

-Andi

Em Tue, Jan 03, 2017 at 07:11:06AM -0800, Andi Kleen escreveu:

Right, you have a point, we should have some warning to the user for when features are not being automatically probed for, i.e. extra features may be enabled using special command line settings, read the docs to see how.

- Arnaldo

make VF=1 will show it

we could print out one line saying we did not detect all the features

jirka

Em Tue, Jan 03, 2017 at 03:58:54PM +0100, Jiri Olsa escreveu:

Right, I was going to point this out, the policy has been to not even try to build features that will likely fail due to not being widely available in distros.

So please do as with libbabeltrace, where it is only built if one explicitely asks it to be, see:

commit 6ab2b762befd192b90704c5c7898f5abf8ebb387

Author: Jiri Olsa <[email protected]>
Date:   Sat Mar 28 11:30:30 2015 +0100

perf build: Disable libbabeltrace check by default

Disabling libbabeltrace check by default and replacing the NO_LIBBABELTRACE make variable with LIBBABELTRACE.

Users wanting the libbabeltrace feature need to build via:

$ make LIBBABELTRACE=1

The reason for this is that the libababeltrace interface we use (version 1.3) hasn't been packaged/released yet, thus the failing feature check only slows down build and confuses other (non CTF) developers.

On Tue, Jan 03, 2017 at 01:00:26AM -0800, Andi Kleen wrote:

SNIP

On Tue, Jan 03, 2017 at 01:00:26AM -0800, Andi Kleen wrote:

SNIP

xed was fixed to support installation in /usr/local (mfile prefix=/usr/local install

But will add it

-Andi

From: Andi Kleen <[email protected]>

Add a generic disassembler function for x86 using the XED library, and a fallback function for architectures that don't implement one. Other architectures can implement their own disassembler functions.

The previous version of this patch used udis86, but was rejected because udis86 was unmaintained and a runtime dependency. Using the recently released xed avoids both of these problems:
- XED is well maintained, uptodate, and used by many Intel tools
- XED is linked statically so there is no runtime dependency.

The XED library can be downloaded from http://github.com/intelxed/xed

---
 tools/perf/arch/x86/util/Build |  1 +
 tools/perf/arch/x86/util/dis.c | 89 ++++++++++++++++++++++++++++++++++++++++++
 tools/perf/util/Build          |  1 +
 tools/perf/util/dis.c          | 15 +++++++
 tools/perf/util/dis.h          | 20 ++++++++++
 5 files changed, 126 insertions(+)
 create mode 100644 tools/perf/arch/x86/util/dis.c
 create mode 100644 tools/perf/util/dis.c
 create mode 100644 tools/perf/util/dis.h

index f95e6f46ef0d..93490009ea6a 100644
@@ -14,3 +14,4 @@ libperf-$(CONFIG_LIBDW_DWARF_UNWIND) += unwind-libdw.o
 libperf-$(CONFIG_AUXTRACE) += auxtrace.o
 libperf-$(CONFIG_AUXTRACE) += intel-pt.o
 libperf-$(CONFIG_AUXTRACE) += intel-bts.o
+libperf-$(CONFIG_XED) += dis.o

index 3840e3a87057..393000501579 100644
@@ -88,6 +88,7 @@ libperf-y += mem-events.o
 libperf-y += vsprintf.o
 libperf-y += drv_configs.o
 libperf-y += time-utils.o
+libperf-y += dis.o
 
 libperf-$(CONFIG_LIBBPF) += bpf-loader.o
 libperf-$(CONFIG_BPF_PROLOGUE) += bpf-prologue.o

new file mode 100644
index 000000000000..a3929616dacd
@@ -0,0 +1,15 @@
+#include "perf.h"
+#include "util/dis.h"
+#include "util/util.h"
+
+/* Fallback for architectures with no disassembler */
+
+__weak char *disas_inst(struct perf_dis *x, uint64_t ip __maybe_unused,
+		u8 *inbuf __maybe_unused, int inlen __maybe_unused,
+		int *lenp)
+{
+	if (lenp)
+		*lenp = 0;
+	strcpy(x->out, "?");
+	return x->out;
+}

new file mode 100644
index 000000000000..ffda324cbc1a
@@ -0,0 +1,20 @@
+#ifndef DIS_H
+#define DIS_H 1
+
+#define MAXINSN 15
+
+struct perf_dis {
+	/* Initialized by callers: */
+	struct thread *thread;
+	u8 cpumode;
+	int cpu;
+	bool is64bit;
+	/* Temporary */
+	char out[256];
+};
+
+char *disas_inst(struct perf_dis *x, uint64_t ip, u8 *inbuf, int inlen,
+		 int *lenp);
+
+
+#endif

2.9.3

On Tue, Jan 03, 2017 at 01:00:27AM -0800, Andi Kleen wrote:

SNIP

From: Andi Kleen <[email protected]>

When dumping PT traces with perf script it is very useful to see the assembler for each sample, so that it is easily possible to follow the control flow.

As using objdump is difficult and inefficient from perf script this patch uses the Intel xed library to implement assembler output. The library can be downloaded from http://github.com/intelxed/xed

The previous version of this patch used udis86, but was rejected because udis86 was unmaintained and a runtime dependency. Using the recently released xed avoids both of these problems:
- XED is well maintained and used by many Intel tools
- XED is linked statically so there is no runtime dependency.

The library is probed as an external dependency in the usual way. Then perf script calls into it when needed, and handles callbacks to resolve symbols.

% perf record -e intel_pt//u true
% perf script -F sym,symoff,ip,asm --itrace=i0ns | head

     7fc7188b4190 _start+0x0	mov %rsp, %rdi
     7fc7188b4193 _start+0x3	call _dl_start
     7fc7188b7710 _dl_start+0x0	push %rbp
     7fc7188b7711 _dl_start+0x1	mov %rsp, %rbp
     7fc7188b7714 _dl_start+0x4	push %r15
     7fc7188b7716 _dl_start+0x6	push %r14
     7fc7188b7718 _dl_start+0x8	push %r13
     7fc7188b771a _dl_start+0xa	push %r12
     7fc7188b771c _dl_start+0xc	mov %rdi, %r12
     7fc7188b771f _dl_start+0xf	push %rbx

v2:
Converted to use XED instead of udis86.
Separate disassembler interface into separate arch specific file. Lots of cleanups and improvements.

---
 tools/perf/Documentation/perf-script.txt |  4 +-
 tools/perf/builtin-script.c              | 72 +++++++++++++++++++++++++++-----
 2 files changed, 64 insertions(+), 12 deletions(-)

index 5dc5c6a09ac4..863579b4d2e2 100644
@@ -116,7 +116,7 @@ OPTIONS
 --fields::
         Comma separated list of fields to print. Options are:
         comm, tid, pid, time, cpu, event, trace, ip, sym, dso, addr, symoff,
-        srcline, period, iregs, brstack, brstacksym, flags, bpf-output,
+        srcline, period, iregs, brstack, brstacksym, flags, bpf-output, asm.
         callindent, insn, insnlen. Field list can be prepended with the type, trace, sw or hw,
         to indicate to which event type the field list applies.
         e.g., -F sw:comm,tid,time,ip,sym  and -F trace:time,cpu,trace

@@ -198,6 +198,8 @@ OPTIONS
 
 	The brstacksym is identical to brstack, except that the FROM and TO addresses are printed in a symbolic form if possible.
 
+	When asm is specified the assembler instruction of each sample is printed in disassembled form.
+
 -k::
 --vmlinux=<file>::
         vmlinux pathname

2.9.3

From: Andi Kleen <[email protected]>

Implement printing full disassembled sequences for branch stacks in perf script. This allows to directly print hot paths for individual samples, together with branch misprediction and cycle count / IPC information if available (on Skylake systems)

% perf record -b ...
% perf script -F brstackasm
...

        000055b55d1147d0        pushq  %rbp
        000055b55d1147d1        pushq  %r15
        000055b55d1147d3        pushq  %r14
        000055b55d1147d5        pushq  %r13
        000055b55d1147d7        pushq  %r12
        000055b55d1147d9        pushq  %rbx
        000055b55d1147da        sub $0x18, %rsp
        000055b55d1147de        mov %r8, %r13
        000055b55d1147e1        mov %rcx, %rbp
        000055b55d1147e4        mov %rdx, %r14
        000055b55d1147e7        mov %rsi, %r15
        000055b55d1147ea        mov %rdi, %rbx
        000055b55d1147ed        movl  $0x0, 0xc(%rsp)
        000055b55d1147f5        movq  (%rbp), %rax
        000055b55d1147f9        test $0x1, %al
        000055b55d1147fb        jnz 0x55b55d114890              # PRED 4 cycles 3.75 IPC
        000055b55d114890        mov %eax, %ecx
        000055b55d114892        and $0x3, %ecx
        000055b55d114895        cmp $0x1, %rcx
        000055b55d114899        jnz 0x55b55d1148f8
        000055b55d11489b        movq  -0x1(%rax), %rcx
        000055b55d11489f        cmpb  $0x81, 0xb(%rcx)
        000055b55d1148a3        jnz 0x55b55d1148fe              # PRED 1 cycles 6.00 IPC

...

Open issues:
- Occasionally the path does not reach up to the sample IP, as the LBRs may be freezed earlier.

v2:
Use low level abstracted disassembler interface.
Print symbols and source lines as labels.
Print first jump in LBR too.
Patch up blocks with filtered ring transfers.
Show IPC
Lots of cleanups and improvements.

---
 tools/perf/Documentation/perf-script.txt |  13 +-
 tools/perf/builtin-script.c              | 262 +++++++++++++++++++++++++++++++
 2 files changed, 273 insertions(+), 2 deletions(-)

index 863579b4d2e2..9b3c0e58f315 100644
@@ -116,7 +116,7 @@ OPTIONS
 --fields::
         Comma separated list of fields to print. Options are:
         comm, tid, pid, time, cpu, event, trace, ip, sym, dso, addr, symoff,
-        srcline, period, iregs, brstack, brstacksym, flags, bpf-output, asm.
+	srcline, period, iregs, brstack, brstacksym, flags, bpf-output, asm, brstackasm,
         callindent, insn, insnlen. Field list can be prepended with the type, trace, sw or hw,
         to indicate to which event type the field list applies.
         e.g., -F sw:comm,tid,time,ip,sym  and -F trace:time,cpu,trace

@@ -189,17 +189,22 @@ OPTIONS
 	i.e., -F "" is not allowed.
 
 	The brstack output includes branch related information with raw addresses using the
-	/v/v/v/v/ syntax in the following order:
+	/v/v/v/v/cycles syntax in the following order:
 	FROM: branch source instruction
 	TO  : branch target instruction
         M/P/-: M=branch target mispredicted or branch direction was mispredicted, P=target predicted or direction predicted, -=not supported
 	X/- : X=branch inside a transactional region, -=not in transaction region or not supported
 	A/- : A=TSX abort entry, -=not aborted region or not supported
+	cycles
 
 	The brstacksym is identical to brstack, except that the FROM and TO addresses are printed in a symbolic form if possible.
 
 	When asm is specified the assembler instruction of each sample is printed in disassembled form.
 
+	When brstackasm is specified the full assembler sequences of branch sequences for each sample
+	is printed. This is the full execution path leading to the sample. This is only supported when the
+	sample was recorded with perf record -b or -j any.
+
 -k::
 --vmlinux=<file>::
         vmlinux pathname

@@ -301,6 +306,10 @@ include::itrace.txt[]
 	stop time is not given (i.e, time string is 'x.y,') then analysis goes
 	to end of file.
 
+--max-blocks::
+	Set the maximum number of program blocks to print with brstackasm for
+	each sample.
+
 SEE ALSO
 --------
 linkperf:perf-record[1], linkperf:perf-script-perl[1],

2.9.3

On Tue, Jan 03, 2017 at 01:00:29AM -0800, Andi Kleen wrote:

SNIP

This is the LBR filter exposed with the -j option (-j user or -j kernel)

-Andi

SNIP

I tested and it looks ok.. once the xed detection is sorted out I'd ack it

thanks,
jirka