This is an (incomplete) list of some of the stuff we want to look at doing. If you're interested in hacking on any of these, please contact the list first for some pointers and/or read HACKING and doc/CodingStyle. 1.0 release ----------- (this is a minimal selection of stuff I think we need) o default to a vmlinux location: need agreement from kernel developers o default to --separate=library (with anon, =none, makes not much sense) o prettify image name for .jo files and allow lib-image: to specify it o gisle's fixes o opreport tgid: doesn't work even if .jo files with that pid o Fix: warning: [vdso] (tgid:9236 range:0x7fff98ffd000-0x7fff98fff000) could not be found. warning: /no-vmlinux could not be found. warning: /usr/lib64/libpanel-applet-2.so.0.2.27.#prelink#.sXCUK1 (deleted) could not be found. o amd64 32 bit build needs a sys32_lookup_dcookie() translator in the kernel o decide on -m tgid semantics for anon regions o if ev67 is not fixed, back it out o lapic : module should says "didn't find apic" if needed, FAQ and doc should speak a bit about lapic kernel option on x86 and recent kernel o see the big comment in db_insert.c, it's possible to allow unlimited amount of samples with a very minor change in libdb. o if oprofile doesn't recognize the processor selected by the kernel opcontrol could setup the module in timer mode (remove/reload prolly), and warn the user it must upgrade oprofile to get all the feature from its hardware. Later ----- o remove 2.95/2.2 support so we can use boost multi index container in symbol/sample container o consider if we can improve anon mapping growing support [moz@lambent pp]$ ./opreport -lf lib-image:/lib/tls/libc-2.3.2.so /bin/bash | grep vfprintf 14 0.1301 6 0.0102 /lib/tls/libc-2.3.2.so vfprintf [moz@lambent pp]$ ./opreport -lf lib-image:/lib/tls/libc-2.3.2.so /usr/bin/vim | grep vfprintf 176 2.0927 349 1.2552 /lib/tls/libc-2.3.2.so vfprintf [moz@lambent pp]$ ./opreport -lf lib-image:/lib/tls/libc-2.3.2.so { image:/bin/bash } { image:/usr/bin/vim } | grep vfprintf 176 10.9657 +++ 349 7.8888 +++ vfprintf 14 --- --- 6 --- --- vfprintf it seems them as two separate symbols but can we remove the app_name from rough_less and still be able to walk the two lists? even if we could, it would still go wrong when we're profiling multiple apps o Java stuff?? o with opreport -c I can get "warning: /no-vmlinux could not be found.". Should be smarter ? o opreport -c gives weird output for an image with no symbols: samples % symbol name 15965 100.000 (no symbols) 253 100.000 (no symbols) 15965 98.4400 (no symbols) 253 1.5600 (no symbols) [self] o consider tagging opreport -c entries with a number like gprof o --details for opreport -c, or diff?? o should [self] entries be ommitted if 0 ?? o stress test opreport -c: compile a Big Application w/o frame pointer and look how driver and opreport -c react. o oparchive could fix up {kern} paths with -p (what about diff between archive and current though?) o can say more in opcontrol --status o consider a sort option for diff % o opannotate is silent about symbols missing debug info o oprofiled.log now contains various statistics about lost sample etc. from the driver. Post profile tools must parse that and warn eventually, warning must include a proposed work around. User need this: if nothing seems wrong people are unlikely to get a look in oprofiled.log (I ran oprofile on 2.6.1 2 weeks before noticing at 30000 I lost a lot of samples, the profile seemed ok du to the randomization of lost samples). As developper we need that too, actually we have no clear idea of the behavior on different arch, NUMA etc. Not perfect because if the profiler is running the oprofiled.log will show those warning only after the first alarm signal, I think we must dump the statistics information after each opcontrol --dump to avoid that. o odb_insert() can fail on ftruncate or mremap() in db_manage.c but we don't try to recover gracefully. o output column shortname headers for opreport -l o is relative_to_absolute_path guaranteeing a trailing '/' documented ? o move oprofiled.log to OP_SAMPLE_DIR/current ? o pp tools must handle samples count overflow (marked as (unsigned)-1) o the way we show kernel modules in 2.5 is not very obvious - "/oprofile" o oparchive will be more usefull with a --root= options to allow profiling on a small box, nfs mount / to another box and transfer sample file and binary on a bigger box for analysis. There is also a problem in oparchive you can use session: to get the right path to samples files but oprofiled.log and abi files path are hardcoded to /var/lib/oprofile. o callgraph patch: better way to skip ignored backtrace ? o lib-image: and image: behavior depend on --separate=, if --separate=library opreport "lib-image:*libc*" --merge=lib works but not opreport "image:*libc*" --merge=lib whilst the behavior is reversed if --separate==none. Must we take care ? o dependencies between profile_container.h symbol_container.h and sample_container.h become more and more ugly, I needed to include them in a specific order in some source (still true??) o add event aliases for common things like icache misses, we must start to think about metrics including simple like event alias mapped to two or more events and intepreted specially by user space tools like using the ratio of samples; more tricky will be to select an event used as call count (no cg on it) and used to emulate the call count field in gprof. I think this is a after 1.0 thing but event aliases must be specified in a way allowing such extension o do we need an opreport like opreport -c (showing caller/callee at binary boundary not symbols) ? o we should notice an opcontrol config change (--separate etc.) and auto-restart the daemon if necessary (Run) o we can add lots more unit tests yet o Itanium event constraints are not implemented o GUI still has a physical-counter interface, should have a general one like opcontrol --event o I think we should have the ability to have *fixed* width headers, e.g. : vma samples cum. samples % cum. % symbol name image name app name 0804c350 64582 64582 35.0757 35.0757 odb_insert /usr/loc...in/oprofiled /usr/local/oprofile-pp/bin/oprofiled Note the ellipsis o should we make the sighup handler re-read counter config and re-start profiling too ? o improve --smart-demangle o allow user to add it's own pattern in user.pat, document it. o hard code ${typename} regular definition to remove all current limitations (difficult, perhaps after 1.0 ?). o oprof_start dialog size is too small initially o i18n. We need a good formatter, and also remember format_percent() o opannotate --source --output-dir=~moz/op/ /usr/bin/oprofiled will fail because the ~ is not expanded (no space around it) (popt bug I say) o cpu names instead of numbers in 2.4 module/ ? o remove 1 and 2 magic numbers for oprof_ready o adapt Anton's patch for handling non-symbolled libraries ? (nowaday C++ anon namespace symbol are static, 3.4 iirc, so with recent distro we are more likely to get problems with a "fallback to dynamic symbols" approch) o use standard C integer type int32_t int16_t etc. o event multiplexing for real o randomizing of reset value o XML output o profile the NMI handler code o opannotate : I added this to the doc about difference between nr samples credited to a source function and total number of samples for this function: "The missing samples are not lost, they will be credited to another source location where the inlined function is defined. The inlined function will be credited from multiple call site and merged in one place in the annotated source file so there is no way to see from what call site are coming the samples for an inlined function." I think we can work around this: output multiple instances of inlined function like : inline foo() { foo: total 1500 30.00 ... ... annotated source from all call site inline foo() { foo (call site bar()): total 500 10.00 .. annotated source from call site bar() etc. what about template..., can we do/must we do something like that template eat_cpu() and do a similar things, merging and annotating all instantation then annotating for each distinct instantation, this will break our "keep the source line number in annotated source file identical to the original source" o events/mips/34k/events, some events does not make sense, they get identical event number, um and counter nr so they overlap, currently commented o can we find a more efficient implementation for sparse_array ? o libpp/profile.cpp:is_spu_sample_file() can be simplified by using read_header() o while fixing #1819350 I needed to make extra_images per profile session rather than a global var so I think we need to revisit find_image_path(), extra_found_images, --image-path (-p). Actually we can't do something ala: opreport { archive:tmp1 search_path=/lib/modules/2.6.20 } { archive:tmp2 search_path=/.../2.6.20.9 } because search_path is specified through -p which is not a part of the profile spec. Fixing #1819350 covered all case except this one but w/o any user visible change. Another way will be to save the -p option used with oparchive in a file at the toplevel of the archive, use it with all tools when an archive: is specified on the command line and deprecate the use of -p in such case. o consider to make extra_images a ref counted object, it's copied by value a few time but can contain a lot of string. There is also some ugly public member extra_images to fix. o daemon bss size can be improved, grep for MAX_PATH to see where dynamic allocation can be used, try $ nm oprofiled --size-sort too. Documentation ------------- o the docs should mention the default event for each arch somewhere o more discussion of problematic code needs to go in the "interpreting" section. o document gcc 2.95 and linenr info problems especially for inline functions o finish the internals manual JIT support ----------- o We need a more dynamic structure to handle entries_address_ascending and entries_symbols_ascending, actually many scaling problem occur because they are array, this was perfect to get a first implementation focusing on handling overlap and all but the need to qsort/copy arrays at each iteration is a performance killer. Some sort of AVL tree will do the job. o Related to the previous, it's possible to do all processing in opjitconv.c in a single left to right walk of the jitentry list. o see the FIXME at parse_dump.c:parse_code_unload() o Increment JITHEADER_VERSION in jitdump.h to be sure that the new code only accepts dump file created by the new code. o opjitconv.c:replacement_name() should be enough clever to avoid name collision so we can remove the recursive call to disambiguate_symbol_names(), need a hash table or some sort of associative array to check quickly if a name exists, we will need some sort of avl tree so it's probably better to do not implement a hash table only for this purpose. o op_write_native_code() must accept one more parameter, the real code size which can be zero or equal to code_size, this will allow to create elf file w/o any code contents, only a symbol table and .text sections w/o contents (yes ELF format allow that). For dynamic binary translation it'll avoid to dump tons of code for little use, opannotate --assembly will not work on such elf file but it can be a real win. It'll need to add to jitrecord0 a real_size field, and some trickery when building the elf file, taking care about the case we mix zero code size with non zero code size. Perhaps we can use it too for java, filtering native method etc. Actually we allow a simplified form of this feature by allowing to disable/enable code dumping but at the whole dump level not on a symbol basis, quite possible sufficient. [mpj: We're backing away from the idea of dumping JIT records without code. Since BFD asymbol type does not include symbol size, the op_bfd technique for determining symbol size relies on knowing the true file size; and if code is not included in the .jo file, we don't have true size.] o The pipe used for triggering JIT dump conversion should be used for normal dumping too. o See FIXME in agents/jvmti/libjvmti_oprofile.c: If enablement to get line number info would be configurable through command line, what should be the default on/off? o See FIXME in opjitconv/debug_line.c o The way to use the pipe should be made more secure to avoid denial of service attacks. We have to think about it. o Callgraph does not work properly for the .jo files the JIT support creates. See section Chapter 4, sect 2.3.2 "Callgraph and JIT support". Try to figure out a way to correlate an anonymous sample callgraph entry with the .jo file that may exist for the anonymous code. o see mail from Gisle Dankel: "JIT_SUPPORT: Adding support for file-backed non-ELF JIT code" -> should be changed (if useful) before next release o See FIXME in op_header.cpp: The check for header.mtime of JIT sample files is not correct because currently this mtime value is set to zero due to missing cookie setting for JIT sample files. Some additional check/setting to header.mtime should be made for JIT sample files. o Mono JIT support: 2007-11-08: with callgraph massi got oparchive error: parse_filename() invalid filename: /var/lib/oprofile/samples/current/{root}/var/lib/oprofile/samples/current/{root}/home/massi/mono/amd64/bin/mono/{dep}/{anon:anon}/32432.0x40a26000.0x40a36000/CPU_CLK_UNHALTED.100000.0.all.all.all/{dep}/{root}/var/lib/oprofile/samples/current/{root}/home/massi/mono/amd64/bin/mono/{dep}/{anon:anon}/32432.0x40a26000.0x40a36000/CPU_CLK_UNHALTED.100000.0.all.all.all/{cg}/{root}/usr/oprofile/bin/oprofiled/CPU_CLK_ Massi added Mono JIT support, code on the stack is never unloaded and there is no byte code, code is always compiled to native machine code, this mean than for mono at least we can do callgraph if we can fix this samples filename problem. General checks to make ---------------------- o rgrep FIXME o valgrind (--show-reachable=yes --leak-check=yes) o audit to track unnecessary include <> o gcc 3.0/3.x compile o Qt2/3 check, no Qt check o verify builds (modversions, kernel versions, athlon etc.). I have the necessary stuff to check kernel versions/configurations on PIII core (Phil) o use nm and a little script to track unused function o test it to hell and back o compile all C++ programs with STL_port and test them (gcc 3.4 contain a debug mode too but std::string iterator are not checked) o There is probably place of post profile tools where looking at errno will give better error messages.