1
linux/tools/perf/util/annotate-data.h
Namhyung Kim 1cfd01eb60 perf annotate-data: Copy back variable types after move
In some cases, compilers don't set the location expression in DWARF
precisely.  For instance, it may assign a variable to a register after
copying it from a different register.  Then it should use the register
for the new type but still uses the old register.  This makes hard to
track the type information properly.

This is an example I found in __tcp_transmit_skb().  The first argument
(sk) of this function is a pointer to sock and there's a variable (tp)
for tcp_sock.

  static int __tcp_transmit_skb(struct sock *sk, struct sk_buff *skb,
  				int clone_it, gfp_t gfp_mask, u32 rcv_nxt)
  {
  	...
  	struct tcp_sock *tp;

  	BUG_ON(!skb || !tcp_skb_pcount(skb));
  	tp = tcp_sk(sk);
  	prior_wstamp = tp->tcp_wstamp_ns;
  	tp->tcp_wstamp_ns = max(tp->tcp_wstamp_ns, tp->tcp_clock_cache);
  	...

So it basically calls tcp_sk(sk) to get the tcp_sock pointer from sk.
But it turned out to be the same value because tcp_sock embeds sock as
the first member.  The sk is located in reg5 (RDI) and tp is in reg3
(RBX).  The offset of tcp_wstamp_ns is 0x748 and tcp_clock_cache is
0x750.  So you need to use RBX (reg3) to access the fields in the
tcp_sock.  But the code used RDI (reg5) as it has the same value.

  $ pahole --hex -C tcp_sock vmlinux | grep -e 748 -e 750
	u64                tcp_wstamp_ns;        /* 0x748   0x8 */
	u64                tcp_clock_cache;      /* 0x750   0x8 */

And this is the disassembly of the part of the function.

  <__tcp_transmit_skb>:
  ...
  44:  mov    %rdi, %rbx
  47:  mov    0x748(%rdi), %rsi
  4e:  mov    0x750(%rdi), %rax
  55:  cmp    %rax, %rsi

Because compiler put the debug info to RBX, it only knows RDI is a
pointer to sock and accessing those two fields resulted in error
due to offset being beyond the type size.

  -----------------------------------------------------------
  find data type for 0x748(reg5) at __tcp_transmit_skb+0x63
  CU for net/ipv4/tcp_output.c (die:0x817f543)
  frame base: cfa=0 fbreg=6
  scope: [1/1] (die:81aac3e)
  bb: [0 - 30]
  var [0] -0x98(stack) type='struct tcp_out_options' size=0x28 (die:0x81af3df)
  var [5] reg8 type='unsigned int' size=0x4 (die:0x8180ed6)
  var [5] reg2 type='unsigned int' size=0x4 (die:0x8180ed6)
  var [5] reg1 type='int' size=0x4 (die:0x818059e)
  var [5] reg4 type='struct sk_buff*' size=0x8 (die:0x8181360)
  var [5] reg5 type='struct sock*' size=0x8 (die:0x8181a0c)                   <<<--- the first argument ('sk' at %RDI)
  mov [19] reg8 -> -0xa8(stack) type='unsigned int' size=0x4 (die:0x8180ed6)
  mov [20] stack canary -> reg0
  mov [29] reg0 -> -0x30(stack) stack canary
  bb: [36 - 3e]
  mov [36] reg4 -> reg15 type='struct sk_buff*' size=0x8 (die:0x8181360)
  bb: [44 - 63]
  mov [44] reg5 -> reg3 type='struct sock*' size=0x8 (die:0x8181a0c)          <<<--- calling tcp_sk()
  var [47] reg3 type='struct tcp_sock*' size=0x8 (die:0x819eead)              <<<--- new variable ('tp' at %RBX)
  var [4e] reg4 type='unsigned long long' size=0x8 (die:0x8180edd)
  mov [58] reg4 -> -0xc0(stack) type='unsigned long long' size=0x8 (die:0x8180edd)
  chk [63] reg5 offset=0x748 ok=1 kind=1 (struct sock*) : offset bigger than size    <<<--- access with old variable
  final result: offset bigger than size

While it's a fault in the compiler, we could work around this issue by
using the type of new variable when it's copied directly.  So I've added
copied_from field in the register state to track those direct register
to register copies.  After that new register gets a new type and the old
register still has the same type, it'll update (copy it back) the type
of the old register.

For example, if we can update type of reg5 at __tcp_transmit_skb+0x47,
we can find the target type of the instruction at 0x63 like below:

  -----------------------------------------------------------
  find data type for 0x748(reg5) at __tcp_transmit_skb+0x63
  ...
  bb: [44 - 63]
  mov [44] reg5 -> reg3 type='struct sock*' size=0x8 (die:0x8181a0c)
  var [47] reg3 type='struct tcp_sock*' size=0x8 (die:0x819eead)
  var [47] copyback reg5 type='struct tcp_sock*' size=0x8 (die:0x819eead)     <<<--- here
  mov [47] 0x748(reg5) -> reg4 type='unsigned long long' size=0x8 (die:0x8180edd)
  mov [4e] 0x750(reg5) -> reg0 type='unsigned long long' size=0x8 (die:0x8180edd)
  mov [58] reg4 -> -0xc0(stack) type='unsigned long long' size=0x8 (die:0x8180edd)
  chk [63] reg5 offset=0x748 ok=1 kind=1 (struct tcp_sock*) : Good!           <<<--- new type
  found by insn track: 0x748(reg5) type-offset=0x748
  final result:  type='struct tcp_sock' size=0xa98 (die:0x819eeb2)

Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Kan Liang <kan.liang@linux.intel.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://lore.kernel.org/r/20240821232628.353177-5-namhyung@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2024-08-22 12:38:18 -03:00

294 lines
7.6 KiB
C

/* SPDX-License-Identifier: GPL-2.0 */
#ifndef _PERF_ANNOTATE_DATA_H
#define _PERF_ANNOTATE_DATA_H
#include <errno.h>
#include <linux/compiler.h>
#include <linux/rbtree.h>
#include <linux/types.h>
#include "dwarf-regs.h"
#include "annotate.h"
#ifdef HAVE_DWARF_SUPPORT
#include "debuginfo.h"
#endif
struct annotated_op_loc;
struct debuginfo;
struct evsel;
struct hist_browser_timer;
struct hist_entry;
struct map_symbol;
struct thread;
#define pr_debug_dtp(fmt, ...) \
do { \
if (debug_type_profile) \
pr_info(fmt, ##__VA_ARGS__); \
else \
pr_debug3(fmt, ##__VA_ARGS__); \
} while (0)
enum type_state_kind {
TSR_KIND_INVALID = 0,
TSR_KIND_TYPE,
TSR_KIND_PERCPU_BASE,
TSR_KIND_CONST,
TSR_KIND_POINTER,
TSR_KIND_CANARY,
};
/**
* struct annotated_member - Type of member field
* @node: List entry in the parent list
* @children: List head for child nodes
* @type_name: Name of the member type
* @var_name: Name of the member variable
* @offset: Offset from the outer data type
* @size: Size of the member field
*
* This represents a member type in a data type.
*/
struct annotated_member {
struct list_head node;
struct list_head children;
char *type_name;
char *var_name;
int offset;
int size;
};
/**
* struct type_hist_entry - Histogram entry per offset
* @nr_samples: Number of samples
* @period: Count of event
*/
struct type_hist_entry {
int nr_samples;
u64 period;
};
/**
* struct type_hist - Type histogram for each event
* @nr_samples: Total number of samples in this data type
* @period: Total count of the event in this data type
* @offset: Array of histogram entry
*/
struct type_hist {
u64 nr_samples;
u64 period;
struct type_hist_entry addr[];
};
/**
* struct annotated_data_type - Data type to profile
* @node: RB-tree node for dso->type_tree
* @self: Actual type information
* @nr_histogram: Number of histogram entries
* @histograms: An array of pointers to histograms
*
* This represents a data type accessed by samples in the profile data.
*/
struct annotated_data_type {
struct rb_node node;
struct annotated_member self;
int nr_histograms;
struct type_hist **histograms;
};
extern struct annotated_data_type unknown_type;
extern struct annotated_data_type stackop_type;
extern struct annotated_data_type canary_type;
/**
* struct data_loc_info - Data location information
* @arch: CPU architecture info
* @thread: Thread info
* @ms: Map and Symbol info
* @ip: Instruction address
* @var_addr: Data address (for global variables)
* @cpumode: CPU execution mode
* @op: Instruction operand location (regs and offset)
* @di: Debug info
* @fbreg: Frame base register
* @fb_cfa: Whether the frame needs to check CFA
* @type_offset: Final offset in the type
*/
struct data_loc_info {
/* These are input field, should be filled by caller */
struct arch *arch;
struct thread *thread;
struct map_symbol *ms;
u64 ip;
u64 var_addr;
u8 cpumode;
struct annotated_op_loc *op;
struct debuginfo *di;
/* These are used internally */
int fbreg;
bool fb_cfa;
/* This is for the result */
int type_offset;
};
/**
* struct annotated_data_stat - Debug statistics
* @total: Total number of entry
* @no_sym: No symbol or map found
* @no_insn: Failed to get disasm line
* @no_insn_ops: The instruction has no operands
* @no_mem_ops: The instruction has no memory operands
* @no_reg: Failed to extract a register from the operand
* @no_dbginfo: The binary has no debug information
* @no_cuinfo: Failed to find a compile_unit
* @no_var: Failed to find a matching variable
* @no_typeinfo: Failed to get a type info for the variable
* @invalid_size: Failed to get a size info of the type
* @bad_offset: The access offset is out of the type
*/
struct annotated_data_stat {
int total;
int no_sym;
int no_insn;
int no_insn_ops;
int no_mem_ops;
int no_reg;
int no_dbginfo;
int no_cuinfo;
int no_var;
int no_typeinfo;
int invalid_size;
int bad_offset;
int insn_track;
};
extern struct annotated_data_stat ann_data_stat;
#ifdef HAVE_DWARF_SUPPORT
/*
* Type information in a register, valid when @ok is true.
* The @caller_saved registers are invalidated after a function call.
*/
struct type_state_reg {
Dwarf_Die type;
u32 imm_value;
bool ok;
bool caller_saved;
u8 kind;
u8 copied_from;
};
/* Type information in a stack location, dynamically allocated */
struct type_state_stack {
struct list_head list;
Dwarf_Die type;
int offset;
int size;
bool compound;
u8 kind;
};
/* FIXME: This should be arch-dependent */
#ifdef __powerpc__
#define TYPE_STATE_MAX_REGS 32
#else
#define TYPE_STATE_MAX_REGS 16
#endif
/*
* State table to maintain type info in each register and stack location.
* It'll be updated when new variable is allocated or type info is moved
* to a new location (register or stack). As it'd be used with the
* shortest path of basic blocks, it only maintains a single table.
*/
struct type_state {
/* state of general purpose registers */
struct type_state_reg regs[TYPE_STATE_MAX_REGS];
/* state of stack location */
struct list_head stack_vars;
/* return value register */
int ret_reg;
/* stack pointer register */
int stack_reg;
};
/* Returns data type at the location (ip, reg, offset) */
struct annotated_data_type *find_data_type(struct data_loc_info *dloc);
/* Update type access histogram at the given offset */
int annotated_data_type__update_samples(struct annotated_data_type *adt,
struct evsel *evsel, int offset,
int nr_samples, u64 period);
/* Release all data type information in the tree */
void annotated_data_type__tree_delete(struct rb_root *root);
/* Release all global variable information in the tree */
void global_var_type__tree_delete(struct rb_root *root);
int hist_entry__annotate_data_tty(struct hist_entry *he, struct evsel *evsel);
bool has_reg_type(struct type_state *state, int reg);
struct type_state_stack *findnew_stack_state(struct type_state *state,
int offset, u8 kind,
Dwarf_Die *type_die);
void set_stack_state(struct type_state_stack *stack, int offset, u8 kind,
Dwarf_Die *type_die);
struct type_state_stack *find_stack_state(struct type_state *state,
int offset);
bool get_global_var_type(Dwarf_Die *cu_die, struct data_loc_info *dloc,
u64 ip, u64 var_addr, int *var_offset,
Dwarf_Die *type_die);
bool get_global_var_info(struct data_loc_info *dloc, u64 addr,
const char **var_name, int *var_offset);
void pr_debug_type_name(Dwarf_Die *die, enum type_state_kind kind);
#else /* HAVE_DWARF_SUPPORT */
static inline struct annotated_data_type *
find_data_type(struct data_loc_info *dloc __maybe_unused)
{
return NULL;
}
static inline int
annotated_data_type__update_samples(struct annotated_data_type *adt __maybe_unused,
struct evsel *evsel __maybe_unused,
int offset __maybe_unused,
int nr_samples __maybe_unused,
u64 period __maybe_unused)
{
return -1;
}
static inline void annotated_data_type__tree_delete(struct rb_root *root __maybe_unused)
{
}
static inline void global_var_type__tree_delete(struct rb_root *root __maybe_unused)
{
}
static inline int hist_entry__annotate_data_tty(struct hist_entry *he __maybe_unused,
struct evsel *evsel __maybe_unused)
{
return -1;
}
#endif /* HAVE_DWARF_SUPPORT */
#ifdef HAVE_SLANG_SUPPORT
int hist_entry__annotate_data_tui(struct hist_entry *he, struct evsel *evsel,
struct hist_browser_timer *hbt);
#else
static inline int hist_entry__annotate_data_tui(struct hist_entry *he __maybe_unused,
struct evsel *evsel __maybe_unused,
struct hist_browser_timer *hbt __maybe_unused)
{
return -1;
}
#endif /* HAVE_SLANG_SUPPORT */
#endif /* _PERF_ANNOTATE_DATA_H */