[v3,1/6] perf cs-etm: Fix unsigned variable comparison to zero

Message ID 20191005091614.11635-2-leo.yan@linaro.org
State New
Headers show
Series
  • perf cs-etm: Support thread stack and callchain
Related show

Commit Message

Leo Yan Oct. 5, 2019, 9:16 a.m.
If the u64 variable 'offset' is a negative integer, comparison it with
bigger than zero is always going to be true because it is unsigned.
Fix this by using s64 type for variable 'offset'.

Signed-off-by: Leo Yan <leo.yan@linaro.org>

---
 tools/perf/util/cs-etm.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

-- 
2.17.1

Comments

Mathieu Poirier Oct. 11, 2019, 8:16 p.m. | #1
On Sat, Oct 05, 2019 at 05:16:09PM +0800, Leo Yan wrote:
> If the u64 variable 'offset' is a negative integer, comparison it with

> bigger than zero is always going to be true because it is unsigned.

> Fix this by using s64 type for variable 'offset'.

> 

> Signed-off-by: Leo Yan <leo.yan@linaro.org>

> ---

>  tools/perf/util/cs-etm.c | 4 ++--

>  1 file changed, 2 insertions(+), 2 deletions(-)

> 

> diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c

> index 4ba0f871f086..4bc2d9709d4f 100644

> --- a/tools/perf/util/cs-etm.c

> +++ b/tools/perf/util/cs-etm.c

> @@ -940,7 +940,7 @@ u64 cs_etm__last_executed_instr(const struct cs_etm_packet *packet)

>  static inline u64 cs_etm__instr_addr(struct cs_etm_queue *etmq,

>  				     u64 trace_chan_id,

>  				     const struct cs_etm_packet *packet,

> -				     u64 offset)

> +				     s64 offset)


In Suzuki's reply there was two choices, 1) move the while(offset > 0) to
while (offset) or change the type of @offset to an s64.  Here we know offset
can't be negative because of the 
        tidq->period_instructions >= etm->instructions_sample_period 

in function cs_etm__sample().  As such I think option #1 is the right way to
deal with this rather than changing the type of the variable.

Mathieu

>  {

>  	if (packet->isa == CS_ETM_ISA_T32) {

>  		u64 addr = packet->start_addr;

> @@ -1372,7 +1372,7 @@ static int cs_etm__sample(struct cs_etm_queue *etmq,

>  		 * sample is reported as though instruction has just been

>  		 * executed, but PC has not advanced to next instruction)

>  		 */

> -		u64 offset = (instrs_executed - instrs_over - 1);

> +		s64 offset = (instrs_executed - instrs_over - 1);

>  		u64 addr = cs_etm__instr_addr(etmq, trace_chan_id,

>  					      tidq->packet, offset);

>  

> -- 

> 2.17.1

>
Leo Yan Oct. 22, 2019, 5:10 a.m. | #2
Hi Mathieu,

On Fri, Oct 11, 2019 at 02:16:06PM -0600, Mathieu Poirier wrote:
> On Sat, Oct 05, 2019 at 05:16:09PM +0800, Leo Yan wrote:

> > If the u64 variable 'offset' is a negative integer, comparison it with

> > bigger than zero is always going to be true because it is unsigned.

> > Fix this by using s64 type for variable 'offset'.

> > 

> > Signed-off-by: Leo Yan <leo.yan@linaro.org>

> > ---

> >  tools/perf/util/cs-etm.c | 4 ++--

> >  1 file changed, 2 insertions(+), 2 deletions(-)

> > 

> > diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c

> > index 4ba0f871f086..4bc2d9709d4f 100644

> > --- a/tools/perf/util/cs-etm.c

> > +++ b/tools/perf/util/cs-etm.c

> > @@ -940,7 +940,7 @@ u64 cs_etm__last_executed_instr(const struct cs_etm_packet *packet)

> >  static inline u64 cs_etm__instr_addr(struct cs_etm_queue *etmq,

> >  				     u64 trace_chan_id,

> >  				     const struct cs_etm_packet *packet,

> > -				     u64 offset)

> > +				     s64 offset)

> 

> In Suzuki's reply there was two choices, 1) move the while(offset > 0) to

> while (offset) or change the type of @offset to an s64.  Here we know offset

> can't be negative because of the 

>         tidq->period_instructions >= etm->instructions_sample_period 

> 

> in function cs_etm__sample().  As such I think option #1 is the right way to

> deal with this rather than changing the type of the variable.


I took sometime to use formulas to prove that 'offset' is possible to
be a negative value :)

Just paste the updated commit log at here for review:

  Pi: period_instructions
  Ie: instrs_executed
  Io: instrs_over
  Ip: instructions_sample_period

  Pi' = Pi + Ie   -> New period_instructions equals to the old
                     period_instructions + instrs_executed
  Io  = Pi' - Ip  -> period_instructions - instructions_sample_period

  offset = Ie - Io - 1
         = Ie - (Pi' - Ip) -1
	 = Ie - (Pi + Ie - Ip) -1
	 = Ip - Pi - 1

In theory, if Ip (instructions_sample_period) is small enough and Pi
(period_instructions) is bigger than Ip, then it will lead to the
negative value for 'offset'.

So let's see below command:

  perf inject --itrace=i1il128 -i perf.data -o perf.data.new

With this command, 'offset' is very easily to be a negative value when
handling packets; this is because if use the inject option 'i1', then
instructions_sample_period equals to 1; so:

  offset = 1 - Pi - 1
         = -Pi

Any Pi bigger than zero leads 'offset' to a negative value.

Thanks,
Leo Yan

> >  {

> >  	if (packet->isa == CS_ETM_ISA_T32) {

> >  		u64 addr = packet->start_addr;

> > @@ -1372,7 +1372,7 @@ static int cs_etm__sample(struct cs_etm_queue *etmq,

> >  		 * sample is reported as though instruction has just been

> >  		 * executed, but PC has not advanced to next instruction)

> >  		 */

> > -		u64 offset = (instrs_executed - instrs_over - 1);

> > +		s64 offset = (instrs_executed - instrs_over - 1);

> >  		u64 addr = cs_etm__instr_addr(etmq, trace_chan_id,

> >  					      tidq->packet, offset);

> >  

> > -- 

> > 2.17.1

> >
Mike Leach Oct. 22, 2019, 11:36 p.m. | #3
Hi Leo,

Two points here - both related.

On Tue, 22 Oct 2019 at 06:10, Leo Yan <leo.yan@linaro.org> wrote:
>

> Hi Mathieu,

>

> On Fri, Oct 11, 2019 at 02:16:06PM -0600, Mathieu Poirier wrote:

> > On Sat, Oct 05, 2019 at 05:16:09PM +0800, Leo Yan wrote:

> > > If the u64 variable 'offset' is a negative integer, comparison it with

> > > bigger than zero is always going to be true because it is unsigned.

> > > Fix this by using s64 type for variable 'offset'.

> > >

> > > Signed-off-by: Leo Yan <leo.yan@linaro.org>

> > > ---

> > >  tools/perf/util/cs-etm.c | 4 ++--

> > >  1 file changed, 2 insertions(+), 2 deletions(-)

> > >

> > > diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c

> > > index 4ba0f871f086..4bc2d9709d4f 100644

> > > --- a/tools/perf/util/cs-etm.c

> > > +++ b/tools/perf/util/cs-etm.c

> > > @@ -940,7 +940,7 @@ u64 cs_etm__last_executed_instr(const struct cs_etm_packet *packet)

> > >  static inline u64 cs_etm__instr_addr(struct cs_etm_queue *etmq,

> > >                                  u64 trace_chan_id,

> > >                                  const struct cs_etm_packet *packet,

> > > -                                u64 offset)

> > > +                                s64 offset)

> >

Issue 1:

OK - it appears that cs_etm__instr_addr() is supposed to be returning
the address within the current trace sample of the instruction related
to offset.
For T32 - then if offset < 0, packet->start_addr is returned - not
good but at least within the current trace range
For A32/A64 - if offset < 0 then an address _before_
packet->start_addr is returned - clearly wrong and possibly a
completely invalid address that was never actually traced.

> > In Suzuki's reply there was two choices, 1) move the while(offset > 0) to

> > while (offset) or change the type of @offset to an s64.  Here we know offset

> > can't be negative because of the

> >         tidq->period_instructions >= etm->instructions_sample_period

> >

> > in function cs_etm__sample().  As such I think option #1 is the right way to

> > deal with this rather than changing the type of the variable.

>

> I took sometime to use formulas to prove that 'offset' is possible to

> be a negative value :)

>

> Just paste the updated commit log at here for review:

>

>   Pi: period_instructions

>   Ie: instrs_executed

>   Io: instrs_over

>   Ip: instructions_sample_period

>

>   Pi' = Pi + Ie   -> New period_instructions equals to the old

>                      period_instructions + instrs_executed

>   Io  = Pi' - Ip  -> period_instructions - instructions_sample_period

>

>   offset = Ie - Io - 1

>          = Ie - (Pi' - Ip) -1

>          = Ie - (Pi + Ie - Ip) -1

>          = Ip - Pi - 1

>

> In theory, if Ip (instructions_sample_period) is small enough and Pi

> (period_instructions) is bigger than Ip, then it will lead to the

> negative value for 'offset'.

>

> So let's see below command:

>

>   perf inject --itrace=i1il128 -i perf.data -o perf.data.new

>

> With this command, 'offset' is very easily to be a negative value when

> handling packets; this is because if use the inject option 'i1', then

> instructions_sample_period equals to 1; so:

>

>   offset = 1 - Pi - 1

>          = -Pi

>

> Any Pi bigger than zero leads 'offset' to a negative value.

>

> Thanks,

> Leo Yan

>


Issue 2:

Assuming I have understood the logic of this code correctly - there is
an issue were sample_period < period_instructions as you say -
but I believe the problem is in the logic of the sampling function itself.

Suppose we have a sample_period of 4.

Now on an initial pass through the function, period_instructions must
be 0. (i.e. none left over from the previous pass.)
Suppose also that the number of instructions executed in this sample
is 10 - thus updating period_instructions.
Therefore:
instr_over = 10 - 4 -> 6
offset = 10 - 6 - 1 -> 3.
We therefore call cs_etm_instr_addr to find the address an offset of 3
instructions from the start of the trace sample and synthesize the
sample.
After this we set period_instructions to the instr_over value of 6.

Next pass, assume 10 instructions in the trace sample again.
period_instructions = 6 + 10 -> 16
instr_over = 16 - 4 -> 12
offset = 10 - 12 - 1 -> -3  - the negative value your formulae predict.

This implies that the sample we want is actually in the previous trace
packet - which I believe is in fact the case - as explained below.

My reading of the code is that cs_etm__sample() is called once per
trace range packet extracted from the decoder - and a trace range
packet represents N instructions_executed.
Further I am assuming that instructions_sample_period represents the
desired periodicity of the instruction samples - i.e. 1 sample every
instructions_sample_period number of instructions.

Thus my conclusion here is that where M = instructions_executed +
period_instructions, the function should generate quotient ( M /
instructions_sample_period ) samples and set period_instructions to M
mod instructions_sample_period on exit, ensuring period_instructions
is never larger than the sample_period.

i.e. loop to generate multiple samples until instr_over and therefore
the output value of period_instructions is less than the value of
instructions_sample_period - for the example above, with 10
instructions and a periodicity of 4, we generate 2 samples with a
remainder of 2 instructions carried forwards.

In short leave offset as unsigned and fix the logic of the
cs_etm__sample() function.

Regards

Mike

> > >  {

> > >     if (packet->isa == CS_ETM_ISA_T32) {

> > >             u64 addr = packet->start_addr;

> > > @@ -1372,7 +1372,7 @@ static int cs_etm__sample(struct cs_etm_queue *etmq,

> > >              * sample is reported as though instruction has just been

> > >              * executed, but PC has not advanced to next instruction)

> > >              */

> > > -           u64 offset = (instrs_executed - instrs_over - 1);

> > > +           s64 offset = (instrs_executed - instrs_over - 1);

> > >             u64 addr = cs_etm__instr_addr(etmq, trace_chan_id,

> > >                                           tidq->packet, offset);

> > >

> > > --

> > > 2.17.1

> > >




--
Mike Leach
Principal Engineer, ARM Ltd.
Manchester Design Centre. UK
Leo Yan Oct. 23, 2019, 6:49 a.m. | #4
Hi Mike,

On Wed, Oct 23, 2019 at 12:36:39AM +0100, Mike Leach wrote:
> Hi Leo,

> 

> Two points here - both related.

> 

> On Tue, 22 Oct 2019 at 06:10, Leo Yan <leo.yan@linaro.org> wrote:

> >

> > Hi Mathieu,

> >

> > On Fri, Oct 11, 2019 at 02:16:06PM -0600, Mathieu Poirier wrote:

> > > On Sat, Oct 05, 2019 at 05:16:09PM +0800, Leo Yan wrote:

> > > > If the u64 variable 'offset' is a negative integer, comparison it with

> > > > bigger than zero is always going to be true because it is unsigned.

> > > > Fix this by using s64 type for variable 'offset'.

> > > >

> > > > Signed-off-by: Leo Yan <leo.yan@linaro.org>

> > > > ---

> > > >  tools/perf/util/cs-etm.c | 4 ++--

> > > >  1 file changed, 2 insertions(+), 2 deletions(-)

> > > >

> > > > diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c

> > > > index 4ba0f871f086..4bc2d9709d4f 100644

> > > > --- a/tools/perf/util/cs-etm.c

> > > > +++ b/tools/perf/util/cs-etm.c

> > > > @@ -940,7 +940,7 @@ u64 cs_etm__last_executed_instr(const struct cs_etm_packet *packet)

> > > >  static inline u64 cs_etm__instr_addr(struct cs_etm_queue *etmq,

> > > >                                  u64 trace_chan_id,

> > > >                                  const struct cs_etm_packet *packet,

> > > > -                                u64 offset)

> > > > +                                s64 offset)

> > >

> Issue 1:

> 

> OK - it appears that cs_etm__instr_addr() is supposed to be returning

> the address within the current trace sample of the instruction related

> to offset.

> For T32 - then if offset < 0, packet->start_addr is returned - not

> good but at least within the current trace range

> For A32/A64 - if offset < 0 then an address _before_

> packet->start_addr is returned - clearly wrong and possibly a

> completely invalid address that was never actually traced.


Exactly, if offset < 0 it might output the incorrect trace.

> > > In Suzuki's reply there was two choices, 1) move the while(offset > 0) to

> > > while (offset) or change the type of @offset to an s64.  Here we know offset

> > > can't be negative because of the

> > >         tidq->period_instructions >= etm->instructions_sample_period

> > >

> > > in function cs_etm__sample().  As such I think option #1 is the right way to

> > > deal with this rather than changing the type of the variable.

> >

> > I took sometime to use formulas to prove that 'offset' is possible to

> > be a negative value :)

> >

> > Just paste the updated commit log at here for review:

> >

> >   Pi: period_instructions

> >   Ie: instrs_executed

> >   Io: instrs_over

> >   Ip: instructions_sample_period

> >

> >   Pi' = Pi + Ie   -> New period_instructions equals to the old

> >                      period_instructions + instrs_executed

> >   Io  = Pi' - Ip  -> period_instructions - instructions_sample_period

> >

> >   offset = Ie - Io - 1

> >          = Ie - (Pi' - Ip) -1

> >          = Ie - (Pi + Ie - Ip) -1

> >          = Ip - Pi - 1

> >

> > In theory, if Ip (instructions_sample_period) is small enough and Pi

> > (period_instructions) is bigger than Ip, then it will lead to the

> > negative value for 'offset'.

> >

> > So let's see below command:

> >

> >   perf inject --itrace=i1il128 -i perf.data -o perf.data.new

> >

> > With this command, 'offset' is very easily to be a negative value when

> > handling packets; this is because if use the inject option 'i1', then

> > instructions_sample_period equals to 1; so:

> >

> >   offset = 1 - Pi - 1

> >          = -Pi

> >

> > Any Pi bigger than zero leads 'offset' to a negative value.

> >

> > Thanks,

> > Leo Yan

> >

> 

> Issue 2:

> 

> Assuming I have understood the logic of this code correctly - there is

> an issue were sample_period < period_instructions as you say -

> but I believe the problem is in the logic of the sampling function itself.

> 

> Suppose we have a sample_period of 4.

> 

> Now on an initial pass through the function, period_instructions must

> be 0. (i.e. none left over from the previous pass.)

> Suppose also that the number of instructions executed in this sample

> is 10 - thus updating period_instructions.

> Therefore:

> instr_over = 10 - 4 -> 6

> offset = 10 - 6 - 1 -> 3.

> We therefore call cs_etm_instr_addr to find the address an offset of 3

> instructions from the start of the trace sample and synthesize the

> sample.

> After this we set period_instructions to the instr_over value of 6.

> 

> Next pass, assume 10 instructions in the trace sample again.

> period_instructions = 6 + 10 -> 16

> instr_over = 16 - 4 -> 12

> offset = 10 - 12 - 1 -> -3  - the negative value your formulae predict.

> 

> This implies that the sample we want is actually in the previous trace

> packet - which I believe is in fact the case - as explained below.

> 

> My reading of the code is that cs_etm__sample() is called once per

> trace range packet extracted from the decoder - and a trace range

> packet represents N instructions_executed.

> Further I am assuming that instructions_sample_period represents the

> desired periodicity of the instruction samples - i.e. 1 sample every

> instructions_sample_period number of instructions.


Good point.  Yeah, this is the root cause.

> Thus my conclusion here is that where M = instructions_executed +

> period_instructions, the function should generate quotient ( M /

> instructions_sample_period ) samples and set period_instructions to M

> mod instructions_sample_period on exit, ensuring period_instructions

> is never larger than the sample_period.


Totally agree with this; we should generate synthetic samples without
dropping trace data.

> i.e. loop to generate multiple samples until instr_over and therefore

> the output value of period_instructions is less than the value of

> instructions_sample_period - for the example above, with 10

> instructions and a periodicity of 4, we generate 2 samples with a

> remainder of 2 instructions carried forwards.

> 

> In short leave offset as unsigned and fix the logic of the

> cs_etm__sample() function.


Will follow up this suggestion.

Very appreciate your time to review and gave out much reasonable
solution!

Thanks,
Leo Yan

> > > >  {

> > > >     if (packet->isa == CS_ETM_ISA_T32) {

> > > >             u64 addr = packet->start_addr;

> > > > @@ -1372,7 +1372,7 @@ static int cs_etm__sample(struct cs_etm_queue *etmq,

> > > >              * sample is reported as though instruction has just been

> > > >              * executed, but PC has not advanced to next instruction)

> > > >              */

> > > > -           u64 offset = (instrs_executed - instrs_over - 1);

> > > > +           s64 offset = (instrs_executed - instrs_over - 1);

> > > >             u64 addr = cs_etm__instr_addr(etmq, trace_chan_id,

> > > >                                           tidq->packet, offset);

> > > >

> > > > --

> > > > 2.17.1

> > > >

> 

> 

> 

> --

> Mike Leach

> Principal Engineer, ARM Ltd.

> Manchester Design Centre. UK

Patch

diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c
index 4ba0f871f086..4bc2d9709d4f 100644
--- a/tools/perf/util/cs-etm.c
+++ b/tools/perf/util/cs-etm.c
@@ -940,7 +940,7 @@  u64 cs_etm__last_executed_instr(const struct cs_etm_packet *packet)
 static inline u64 cs_etm__instr_addr(struct cs_etm_queue *etmq,
 				     u64 trace_chan_id,
 				     const struct cs_etm_packet *packet,
-				     u64 offset)
+				     s64 offset)
 {
 	if (packet->isa == CS_ETM_ISA_T32) {
 		u64 addr = packet->start_addr;
@@ -1372,7 +1372,7 @@  static int cs_etm__sample(struct cs_etm_queue *etmq,
 		 * sample is reported as though instruction has just been
 		 * executed, but PC has not advanced to next instruction)
 		 */
-		u64 offset = (instrs_executed - instrs_over - 1);
+		s64 offset = (instrs_executed - instrs_over - 1);
 		u64 addr = cs_etm__instr_addr(etmq, trace_chan_id,
 					      tidq->packet, offset);