xref: /external/oprofile/TODO

This is an (incomplete) list of some of the stuff we want to look at doing.

If you're interested in hacking on any of these, please contact the list first
for some pointers and/or read HACKING and doc/CodingStyle.

1.0 release
-----------

(this is a minimal selection of stuff I think we need)

 o default to a vmlinux location: need agreement from kernel developers
 o default to --separate=library (with anon, =none, makes not much sense)
 o prettify image name for .jo files and allow lib-image: to specify it
 o gisle's fixes
 o opreport tgid:<tgid> doesn't work even if .jo files with that pid
 o Fix:

warning: [vdso] (tgid:9236 range:0x7fff98ffd000-0x7fff98fff000) could not be found.
warning: /no-vmlinux could not be found.
warning: /usr/lib64/libpanel-applet-2.so.0.2.27.#prelink#.sXCUK1 (deleted) could not be found.

 o amd64 32 bit build needs a sys32_lookup_dcookie() translator in the
   kernel
 o decide on -m tgid semantics for anon regions
 o if ev67 is not fixed, back it out
 o lapic : module should says "didn't find apic" if needed, FAQ and doc should
  speak a bit about lapic kernel option on x86 and recent kernel
 o see the big comment in db_insert.c, it's possible to allow unlimited
   amount of samples with a very minor change in libdb.
 o if oprofile doesn't recognize the processor selected by the kernel
   opcontrol could setup the module in timer mode (remove/reload prolly), and
   warn the user it must upgrade oprofile to get all the feature from its
   hardware.

Later
-----

 o remove 2.95/2.2 support so we can use boost multi index container in
   symbol/sample container
 o consider if we can improve anon mapping growing support

<movement> [moz@lambent pp]$ ./opreport -lf lib-image:/lib/tls/libc-2.3.2.so /bin/bash | grep vfprintf
<movement> 14        0.1301  6         0.0102  /lib/tls/libc-2.3.2.so   vfprintf
<movement> [moz@lambent pp]$ ./opreport -lf lib-image:/lib/tls/libc-2.3.2.so /usr/bin/vim | grep vfprintf
<movement> 176       2.0927  349       1.2552  /lib/tls/libc-2.3.2.so   vfprintf
<movement> [moz@lambent pp]$ ./opreport -lf lib-image:/lib/tls/libc-2.3.2.so { image:/bin/bash } { image:/usr/bin/vim } | grep vfprintf
<movement> 176      10.9657  +++       349       7.8888  +++       vfprintf
<movement> 14       ---      ---       6        ---      ---       vfprintf
<movement> it seems them as two separate symbols
<movement> but can we remove the app_name from rough_less and still be able to walk the two lists?
<movement> even if we could, it would still go wrong when we're profiling multiple apps

 o Java stuff??
 o with opreport -c I can get "warning: /no-vmlinux could not be found.".
   Should be smarter ?
 o opreport -c gives weird output for an image with no symbols:

    samples  %        symbol name
  15965    100.000  (no symbols)
253      100.000  (no symbols)
  15965    98.4400  (no symbols)
  253       1.5600  (no symbols) [self]

 o consider tagging opreport -c entries with a number like gprof
 o --details for opreport -c, or diff??
 o should [self] entries be ommitted if 0 ??
 o stress test opreport -c: compile a Big Application w/o frame pointer and look
   how driver and opreport -c react.
 o oparchive could fix up {kern} paths with -p (what about diff between
   archive and current though?)
 o can say more in opcontrol --status
 o consider a sort option for diff %
 o opannotate is silent about symbols missing debug info
 o oprofiled.log now contains various statistics about lost sample etc. from
  the driver. Post profile tools must parse that and warn eventually, warning
  must include a proposed work around. User need this: if nothing seems wrong
  people are unlikely to get a look in oprofiled.log (I ran oprofile on 2.6.1
  2 weeks before noticing at 30000 I lost a lot of samples, the profile seemed
  ok du to the randomization of lost samples). As developper we need that too,
  actually we have no clear idea of the behavior on different arch, NUMA etc.
  Not perfect because if the profiler is running the oprofiled.log will show
  those warning only after the first  alarm signal, I think we must dump the
  statistics information after each opcontrol --dump to avoid that.
 o odb_insert() can fail on ftruncate or mremap() in db_manage.c but we don't
  try to recover gracefully.
 o output column shortname headers for opreport -l
 o is relative_to_absolute_path guaranteeing a trailing '/' documented ?
 o move oprofiled.log to OP_SAMPLE_DIR/current ?
 o pp tools must handle samples count overflow (marked as (unsigned)-1)
 o the way we show kernel modules in 2.5 is not very obvious - "/oprofile"
 o oparchive will be more usefull with a --root= options to allow profiling
  on a small box, nfs mount / to another box and transfer sample file and
  binary on a bigger box for analysis. There is also a problem in oparchive
  you can use session: to get the right path to samples files but oprofiled.log
  and abi files path are hardcoded to /var/lib/oprofile.
 o callgraph patch: better way to skip ignored backtrace ?
 o lib-image: and image: behavior depend on --separate=, if --separate=library
  opreport "lib-image:*libc*" --merge=lib works but not
  opreport "image:*libc*" --merge=lib whilst the behavior is reversed if
  --separate==none. Must we take care ?
 o dependencies between profile_container.h symbol_container.h and
  sample_container.h become more and more ugly, I needed to include them
  in a specific order in some source (still true??)
 o add event aliases for common things like icache misses, we must start to
  think about metrics including simple like event alias mapped to two or more
  events and intepreted specially by user space tools like using the ratio
  of samples; more tricky will be to select an event used as call count (no
  cg on it) and  used to emulate the call count field in gprof. I think this is
  a after 1.0 thing but event aliases must be specified in a way allowing such
  extension
 o do we need an opreport like opreport -c (showing caller/callee at binary
  boundary not symbols) ?
 o we should notice an opcontrol config change (--separate etc.) and
   auto-restart the daemon if necessary (Run)
 o we can add lots more unit tests yet
 o Itanium event constraints are not implemented
 o GUI still has a physical-counter interface, should have a general one
   like opcontrol --event
 o I think we should have the ability to have *fixed* width headers, e.g. :

vma      samples  cum. samples  %           cum. %     symbol name             image name              app name
0804c350 64582    64582         35.0757     35.0757    odb_insert              /usr/loc...in/oprofiled /usr/local/oprofile-pp/bin/oprofiled

  Note the ellipsis
 o should we make the sighup handler re-read counter config and re-start profiling too ?
 o improve --smart-demangle
	o allow user to add it's own pattern in user.pat, document it.
	o hard code ${typename} regular definition to remove all current limitations (difficult, perhaps after 1.0 ?).
 o oprof_start dialog size is too small initially
 o i18n. We need a good formatter, and also remember format_percent()
 o opannotate --source --output-dir=~moz/op/ /usr/bin/oprofiled
   will fail because the ~ is not expanded (no space around it) (popt bug I say)
 o cpu names instead of numbers in 2.4 module/ ?
 o remove 1 and 2 magic numbers for oprof_ready
 o adapt Anton's patch for handling non-symbolled libraries ? (nowaday C++
  anon namespace symbol are static, 3.4 iirc, so with recent distro we are
  more likely to get problems with a "fallback to dynamic symbols" approch)
 o use standard C integer type <stdint.h> int32_t int16_t etc.
 o event multiplexing for real
 o randomizing of reset value
 o XML output
 o profile the NMI handler code
 o opannotate : I added this to the doc about difference between nr samples
  credited to a source function and total number of samples for this function:
   "The missing samples are not lost, they will be credited to another source
    location where the inlined function is defined. The inlined function will
    be credited from multiple call site and merged in one place in the
   annotated source file so there is no way to see from what call site are
   coming the samples for an inlined function."
  I think we can work around this: output multiple instances of inlined
  function like :
  inline foo() { foo: total 1500 30.00 ...
  ... annotated source from all call site
  inline foo() { foo (call site bar()): total 500 10.00
  .. annotated source from call site bar() etc.
  what about template..., can we do/must we do something like that
  template <class T> eat_cpu() and do a similar things, merging and annotating
  all instantation then annotating for each distinct instantation, this will
  break our "keep the source line number in annotated source file identical to
  the original source"
 o events/mips/34k/events, some events does not make sense, they get identical
  event number, um and counter nr so they overlap, currently commented
 o can we find a more efficient implementation for sparse_array ?
 o libpp/profile.cpp:is_spu_sample_file() can be simplified by using
  read_header()
 o while fixing #1819350 I needed to make extra_images per profile session
   rather than a global var so I think we need to revisit find_image_path(),
   extra_found_images, --image-path (-p).
   Actually we can't do something ala:
   opreport { archive:tmp1 search_path=/lib/modules/2.6.20 } { archive:tmp2 search_path=/.../2.6.20.9 }
   because search_path is specified through -p which is not a part of the
   profile spec. Fixing #1819350 covered all case except this one but w/o any
   user visible change. Another way will be to save the -p option used with
   oparchive in a file at the toplevel of the archive, use it with all tools
   when an archive: is specified on the command line and deprecate the use of
   -p in such case.
 o consider to make extra_images a ref counted object, it's copied by value
  a few time but can contain a lot of string. There is also some ugly public
  member extra_images to fix.
 o daemon bss size can be improved, grep for MAX_PATH to see where dynamic
   allocation can be used, try $ nm oprofiled --size-sort too.

Documentation
-------------

 o the docs should mention the default event for each arch somewhere
 o more discussion of problematic code needs to go in the "interpreting" section.
 o document gcc 2.95 and linenr info problems especially for inline functions
 o finish the internals manual

JIT support
-----------

 o We need a more dynamic structure to handle entries_address_ascending and
   entries_symbols_ascending, actually many scaling problem occur because they
   are array, this was perfect to get a first implementation focusing on
   handling overlap and all but the need to qsort/copy arrays at each iteration
   is a performance killer. Some sort of AVL tree will do the job.
 o Related to the previous, it's possible to do all processing in opjitconv.c
   in a single left to right walk of the jitentry list.
 o see the FIXME at parse_dump.c:parse_code_unload()
 o Increment JITHEADER_VERSION in jitdump.h to be sure that the new code only
   accepts dump file created by the new code.
 o opjitconv.c:replacement_name() should be enough clever to avoid name
   collision so we can remove the recursive call to disambiguate_symbol_names(),
   need a hash table or some sort of associative array to check quickly if a
   name exists, we will need some sort of avl tree so it's probably better
   to do not implement a hash table only for this purpose.
 o op_write_native_code() must accept one more parameter, the real code size
   which can be zero or equal to code_size, this will allow to create elf
   file w/o any code contents, only a symbol table and .text sections w/o
   contents (yes ELF format allow that). For dynamic binary translation it'll
   avoid to dump tons of code for little use, opannotate --assembly will not
   work on such elf file but it can be a real win. It'll need to add to
   jitrecord0 a real_size field, and some trickery when building the elf file,
   taking care about the case we mix zero code size with non zero code size.
   Perhaps we can use it too for java, filtering native method etc. Actually
   we allow a simplified form of this feature by allowing to disable/enable
   code dumping but at the whole dump level not on a symbol basis, quite
   possible sufficient. [mpj: We're backing away from the idea of dumping
   JIT records without code.  Since BFD asymbol type does not include symbol size,
   the op_bfd technique for determining symbol size relies on knowing the true
   file size; and if code is not included in the .jo file, we don't have true size.]
 o The pipe used for triggering JIT dump conversion should be used for normal
   dumping too.
 o See FIXME in agents/jvmti/libjvmti_oprofile.c:
   If enablement to get line number info would be configurable through command line,
   what should be the default on/off?
 o See FIXME in opjitconv/debug_line.c
 o The way to use the pipe should be made more secure to avoid denial of service
   attacks. We have to think about it.
 o Callgraph does not work properly for the .jo files the JIT support creates.
   See section Chapter 4, sect 2.3.2 "Callgraph and JIT support". Try to figure
   out a way to correlate an anonymous sample callgraph entry with
   the .jo file that may exist for the anonymous code.
 o see mail from Gisle Dankel:
   "JIT_SUPPORT: Adding support for file-backed non-ELF JIT code"
   -> should be changed (if useful) before next release
 o See FIXME in op_header.cpp:
   The check for header.mtime of JIT sample files is not correct because currently
   this mtime value is set to zero due to missing cookie setting for JIT sample files.
   Some additional check/setting to header.mtime should be made for JIT sample files.
 o Mono JIT support:

   2007-11-08: with callgraph massi got
   <massi> oparchive error: parse_filename() invalid filename: /var/lib/oprofile/samples/current/{root}/var/lib/oprofile/samples/current/{root}/home/massi/mono/amd64/bin/mono/{dep}/{anon:anon}/32432.0x40a26000.0x40a36000/CPU_CLK_UNHALTED.100000.0.all.all.all/{dep}/{root}/var/lib/oprofile/samples/current/{root}/home/massi/mono/amd64/bin/mono/{dep}/{anon:anon}/32432.0x40a26000.0x40a36000/CPU_CLK_UNHALTED.100000.0.all.all.all/{cg}/{root}/usr/oprofile/bin/oprofiled/CPU_CLK_

   Massi added Mono JIT support, code on the stack is never unloaded and there is
   no byte code, code is always compiled to native machine code, this mean than
   for mono at least we can do callgraph if we can fix this samples filename
   problem.

General checks to make
----------------------

 o rgrep FIXME
 o valgrind (--show-reachable=yes --leak-check=yes)
 o audit to track unnecessary include <>
 o gcc 3.0/3.x compile
 o Qt2/3 check, no Qt check
 o verify builds (modversions, kernel versions, athlon etc.). I have the
  necessary stuff to check kernel versions/configurations on PIII core (Phil)
 o use nm and a little script to track unused function
 o test it to hell and back
 o compile all C++ programs with STL_port and test them (gcc 3.4 contain a
   debug mode too but std::string iterator are not checked)
 o There is probably place of post profile tools where looking at errno will give better error messages.