call_chain & dump_trace

调用链是剖析工具中常备的一种显示方式，可以为用户呈现明确的函数调用关系，在perf中，可以根据调用链分析主函数的sample分布到了哪些子函数中。在内核调试中，根据调用链可以得到出错函数的上层调用者是谁。

调用链的实现其实很简单，就是遍历函数栈，在x86中，bp寄存器指向的内存位置存放的是旧栈帧基地址，这个位置之上(高地址处)是函数返回地址，因此在函数返回时pop %ebp，就是把旧栈帧地址置放到bp寄存器中，然后pop %eip，会把函数返回地址放到程序计数器中。在进入一个新函数之前，call func，会把函数返回地址放到填入栈，并跳转到func，这时就进入了一个新栈帧，push %ebp，把函数调用者的栈帧基地址压栈，mov %ebp, %esp，这就让bp指向了新栈帧的底部，下面sp就可以动态变化改动栈空间大小了。

这么看来在新旧两个栈的边界处分别是指令返回地址和栈返回地址，旧栈底部是函数返回指令地址，新栈顶部是栈返回地址。因此在内核中定义栈帧：

/* The form of the top of the frame on the stack */struct stack_frame {struct stack_frame *next_frame;unsigned long return_address;};

由于栈的增长是由高到低，所以高地址就是函数指令返回地址return_address，低地址就是栈返回地址next_frame，regs->bp指向当前栈的底部，也就是这个结构体的起始地址，如果从regs->bp处读取一个stack_frame结构体，那么就可以得到上下栈帧边界处信息，包括，函数返回指令地址以及下一个栈帧地址bp。

static struct perf_callchain_entry *perf_callchain(struct pt_regs *regs){int rctx;struct perf_callchain_entry *entry;entry = get_callchain_entry(&rctx);if (rctx == -1)return NULL;if (!entry)goto exit_put;entry->nr = 0;if (!user_mode(regs)) {perf_callchain_store(entry, PERF_CONTEXT_KERNEL);perf_callchain_kernel(entry, regs);if (current->mm)regs = task_pt_regs(current);elseregs = NULL;}if (regs) {perf_callchain_store(entry, PERF_CONTEXT_USER);perf_callchain_user(entry, regs);}exit_put:put_callchain_entry(rctx);return entry;}

在perf_callchain()中，只需要一个pt_regs *参数，判定指令地址是否处于用户态user_mode(regs) => return !!(regs->cs & 3)，对于内核态地址，要遍历内核态栈，perf_callchain_kernel()实际就是dump_trace()，x86_64有三种内核栈：process stack、interrupt stack、severe exception (double fault, nmi, stack fault, debug, mce)hardware stack。

/* * x86-64 can have up to three kernel stacks: * process stack * interrupt stack * severe exception (double fault, nmi, stack fault, debug, mce) hardware stack */void dump_trace(struct task_struct *task, struct pt_regs *regs,unsigned long *stack, unsigned long bp,const struct stacktrace_ops *ops, void *data){const unsigned cpu = get_cpu();unsigned long *irq_stack_end = (unsigned long *)per_cpu(irq_stack_ptr, cpu);unsigned used = 0;struct thread_info *tinfo;int graph = 0;unsigned long dummy;if (!task)task = current;if (!stack) {stack = &dummy;if (task && task != current)stack = (unsigned long *)task->thread.sp;}if (!bp)bp = stack_frame(task, regs);/* * Print function call entries in all stacks, starting at the * current stack address. If the stacks consist of nested exceptions */tinfo = task_thread_info(task);for (;;) {char *id;unsigned long *estack_end;estack_end = in_exception_stack(cpu, (unsigned long)stack, &used, &id);if (estack_end) {if (ops->stack(data, id) < 0)break;bp = ops->walk_stack(tinfo, stack, bp, ops, data, estack_end, &graph);ops->stack(data, "<EOE>");/* We link to the next stack via the second-to-last pointer (index -2 to end) in the exception stack: */stack = (unsigned long *) estack_end[-2];continue;}if (irq_stack_end) {unsigned long *irq_stack;irq_stack = irq_stack_end - (IRQ_STACK_SIZE - 64) / sizeof(*irq_stack);if (in_irq_stack(stack, irq_stack, irq_stack_end)) {if (ops->stack(data, "IRQ") < 0)break;bp = ops->walk_stack(tinfo, stack, bp, ops, data, irq_stack_end, &graph);/* * We link to the next stack (which would be the process * stack normally) the last pointer (index -1 to end) in the IRQ stack: */stack = (unsigned long *) (irq_stack_end[-1]);bp = fixup_bp_irq_link(bp, stack, irq_stack, irq_stack_end);irq_stack_end = NULL;ops->stack(data, "EOI");continue;}}break;}/* This handles the process stack: */bp = ops->walk_stack(tinfo, stack, bp, ops, data, NULL, &graph);put_cpu();}

其中ops->walk_stack()就是遍历内核栈操作，在perf_event中是调用print_context_stack_bp()实现的，这个递归调用直至跳出内核地址空间。

unsigned longprint_context_stack_bp(struct thread_info *tinfo,       unsigned long *stack, unsigned long bp,       const struct stacktrace_ops *ops, void *data,       unsigned long *end, int *graph){struct stack_frame *frame = (struct stack_frame *)bp;unsigned long *ret_addr = &frame->return_address;while (valid_stack_ptr(tinfo, ret_addr, sizeof(*ret_addr), end)) {unsigned long addr = *ret_addr;if (!__kernel_text_address(addr))break;ops->address(data, addr, 1);frame = frame->next_frame;ret_addr = &frame->return_address;print_ftrace_graph_addr(addr, data, ops, tinfo, graph);}return (unsigned long)frame;}

在遍历完内核栈后，判断当前进程是否是内核线程(内核线程的task->mm == NULL)，对于一般进程，通过系统调用或发生异常或中断进入内核栈，这时

#define task_pt_regs(tsk)((struct pt_regs *)(tsk)->thread.sp0 - 1)

然后递归打印打印用户态栈信息perf_callchain_user()，这里copy_from_user_nmi(&frame, fp, sizeof(frame));就从bp寄存器指向内存地址处拷贝一个stack_frame信息，据此递归用户态栈，直至fp < regs->sp???

voidperf_callchain_user(struct perf_callchain_entry *entry, struct pt_regs *regs){struct stack_frame frame;const void __user *fp;fp = (void __user *)regs->bp;perf_callchain_store(entry, regs->ip);while (entry->nr < PERF_MAX_STACK_DEPTH) {unsigned long bytes;frame.next_frame = NULL;frame.return_address = 0;bytes = copy_from_user_nmi(&frame, fp, sizeof(frame));if (bytes != sizeof(frame))break;if ((unsigned long)fp < regs->sp)break;perf_callchain_store(entry, frame.return_address);fp = frame.next_frame;}}