Skip to content

[lldb] Support disassembling RISC-V proprietary instructions #145793

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: main
Choose a base branch
from

Conversation

tedwoodward
Copy link

@tedwoodward tedwoodward commented Jun 25, 2025

RISC-V supports proprietary extensions, where the TD files don't know about certain instructions, and the disassembler can't disassemble them. Internal users want to be able to disassemble these instructions in LLDB.

With llvm-objdump, the solution is to pipe the output of the disassembly through a filter program. This patch modifies LLDB's disassembly to look more like llvm-objdump's, and includes an example python script that adds a command "fdis" that will disassemble, then pipe the output through a specified filter program. This has been tested with crustfilt, a sample filter located at https://github.com/quic/crustfilt .

Changes in this PR:

  • Decouple "can't disassemble" with "instruction size". DisassemblerLLVMC::MCDisasmInstance::GetMCInst now returns a bool for valid disassembly, and has the size as an out paramter. Use the size even if the disassembly is invalid. Disassemble if disassemby is valid.

  • Always print out the opcode when -b is specified. Previously it wouldn't print out the opcode if it couldn't disassemble.

  • Print out RISC-V opcodes the way llvm-objdump does. Add DumpRISCV method based on RISC-V pretty printer in llvm-objdump.cpp.

  • Print for instructions that can't be disassembled, matching llvm-objdump, instead of printing nothing.

  • Update max riscv32 and riscv64 instruction size to 8.

  • Add example "fdis" command script.

RISC-V supports proprietary extensions, where the TD files don't know
about certain instructions, and the disassembler can't disassemble them.
Internal users want to be able to disassemble these instructions.

With llvm-objdump, the solution is to pipe the output of the disassembly
through a filter program. This patch modifies LLDB's disassembly to look
more like llvm-objdump's, and includes an example python script that adds
a command "fdis" that will disassemble, then pipe the output through a
specified filter program. This has been tested with crustfilt, a sample
filter located at https://github.com/quic/crustfilt .

Changes in this PR:
- Decouple "can't disassemble" with "instruction size".
  DisassemblerLLVMC::MCDisasmInstance::GetMCInst now returns a bool for
    valid disassembly, and has the size as an out paramter.
  Use the size even if the disassembly is invalid.
  Disassemble if disassemby is valid.

- Always print out the opcode when -b is specified.
  Previously it wouldn't print out the opcode if it couldn't disassemble.

- Print out RISC-V opcodes the way llvm-objdump does.
  Add DumpRISCV method based on RISC-V pretty printer in llvm-objdump.cpp.

- Print <unknown> for instructions that can't be disassembled, matching
  llvm-objdump, instead of printing nothing.

- Update max riscv32 and riscv64 instruction size to 8.

- Add example "fdis" command script.

Change-Id: Ie5a359d9e87a12dde79a8b5c9c7a146440a550c5
@tedwoodward tedwoodward self-assigned this Jun 25, 2025
Copy link

Thank you for submitting a Pull Request (PR) to the LLVM Project!

This PR will be automatically labeled and the relevant teams will be notified.

If you wish to, you can add reviewers by using the "Reviewers" section on this page.

If this is not working for you, it is probably because you do not have write permissions for the repository. In which case you can instead tag reviewers by name in a comment by using @ followed by their GitHub username.

If you have received no comments on your PR for a week, you can request a review by "ping"ing the PR by adding a comment “Ping”. The common courtesy "ping" rate is once a week. Please remember that you are asking for valuable time from other developers.

If you have further questions, they may be answered by the LLVM GitHub User Guide.

You can also ask questions in a comment on this PR, on the LLVM Discord or on the forums.

@llvmbot llvmbot added the lldb label Jun 25, 2025
@llvmbot
Copy link
Member

llvmbot commented Jun 25, 2025

@llvm/pr-subscribers-lldb

Author: None (tedwoodward)

Changes

RISC-V supports proprietary extensions, where the TD files don't know about certain instructions, and the disassembler can't disassemble them. Internal users want to be able to disassemble these instructions in LLDB.

With llvm-objdump, the solution is to pipe the output of the disassembly through a filter program. This patch modifies LLDB's disassembly to look more like llvm-objdump's, and includes an example python script that adds a command "fdis" that will disassemble, then pipe the output through a specified filter program. This has been tested with crustfilt, a sample filter located at https://github.com/quic/crustfilt .

Changes in this PR:

  • Decouple "can't disassemble" with "instruction size". DisassemblerLLVMC::MCDisasmInstance::GetMCInst now returns a bool for valid disassembly, and has the size as an out paramter. Use the size even if the disassembly is invalid. Disassemble if disassemby is valid.

  • Always print out the opcode when -b is specified. Previously it wouldn't print out the opcode if it couldn't disassemble.

  • Print out RISC-V opcodes the way llvm-objdump does. Add DumpRISCV method based on RISC-V pretty printer in llvm-objdump.cpp.

  • Print <unknown> for instructions that can't be disassembled, matching llvm-objdump, instead of printing nothing.

  • Update max riscv32 and riscv64 instruction size to 8.

  • Add example "fdis" command script.

Change-Id: Ie5a359d9e87a12dde79a8b5c9c7a146440a550c5


Full diff: https://github.com/llvm/llvm-project/pull/145793.diff

6 Files Affected:

  • (added) lldb/examples/python/filter_disasm.py (+87)
  • (modified) lldb/include/lldb/Core/Opcode.h (+1)
  • (modified) lldb/source/Core/Disassembler.cpp (+11-3)
  • (modified) lldb/source/Core/Opcode.cpp (+38)
  • (modified) lldb/source/Plugins/Disassembler/LLVMC/DisassemblerLLVMC.cpp (+21-18)
  • (modified) lldb/source/Utility/ArchSpec.cpp (+2-2)
diff --git a/lldb/examples/python/filter_disasm.py b/lldb/examples/python/filter_disasm.py
new file mode 100644
index 0000000000000..adb3455209055
--- /dev/null
+++ b/lldb/examples/python/filter_disasm.py
@@ -0,0 +1,87 @@
+"""
+Defines a command, fdis, that does filtered disassembly. The command does the
+lldb disassemble command with -b and any other arguments passed in, and
+pipes that through a provided filter program.
+
+The intention is to support disassembly of RISC-V proprietary instructions.
+This is handled with llvm-objdump by piping the output of llvm-objdump through
+a filter program. This script is intended to mimic that workflow.
+"""
+
+import lldb
+import subprocess
+
+filter_program = "crustfilt"
+
+def __lldb_init_module(debugger, dict):
+    debugger.HandleCommand(
+        'command script add -f filter_disasm.fdis fdis')
+    print("Disassembly filter command (fdis) loaded")
+    print("Filter program set to %s" % filter_program)
+
+
+def fdis(debugger, args, result, dict):
+    """
+  Call the built in disassembler, then pass its output to a filter program
+  to add in disassembly for hidden opcodes.
+  Except for get and set, use the fdis command like the disassemble command.
+  By default, the filter program is crustfilt, from
+  https://github.com/quic/crustfilt . This can be changed by changing
+  the global variable filter_program.
+
+  Usage:
+    fdis [[get] [set <program>] [<disassembly options>]]
+
+    Choose one of the following:
+        get
+            Gets the current filter program
+
+        set <program>
+            Sets the current filter program. This can be an executable, which
+            will be found on PATH, or an absolute path.
+
+        <disassembly options>
+            If the first argument is not get or set, the args will be passed
+            to the disassemble command as is.
+
+    """
+
+    global filter_program
+    args_list = args.split(' ')
+    result.Clear()
+
+    if len(args_list) == 1 and args_list[0] == 'get':
+        result.PutCString(filter_program)
+        result.SetStatus(lldb.eReturnStatusSuccessFinishResult)
+        return
+
+    if len(args_list) == 2 and args_list[0] == 'set':
+        filter_program = args_list[1]
+        result.PutCString("Filter program set to %s" % filter_program)
+        result.SetStatus(lldb.eReturnStatusSuccessFinishResult)
+        return
+
+    res = lldb.SBCommandReturnObject()
+    debugger.GetCommandInterpreter().HandleCommand('disassemble -b ' + args, res)
+    if (len(res.GetError()) > 0):
+        result.SetError(res.GetError())
+        result.SetStatus(lldb.eReturnStatusFailed)
+        return
+    output = res.GetOutput()
+
+    try:
+        proc = subprocess.run([filter_program], capture_output=True, text=True, input=output)
+    except (subprocess.SubprocessError, OSError) as e:
+        result.PutCString("Error occurred. Original disassembly:\n\n" + output)
+        result.SetError(str(e))
+        result.SetStatus(lldb.eReturnStatusFailed)
+        return
+
+    print(proc.stderr)
+    if proc.stderr:
+        pass
+        #result.SetError(proc.stderr)
+        #result.SetStatus(lldb.eReturnStatusFailed)
+    else:
+        result.PutCString(proc.stdout)
+        result.SetStatus(lldb.eReturnStatusSuccessFinishResult)
diff --git a/lldb/include/lldb/Core/Opcode.h b/lldb/include/lldb/Core/Opcode.h
index f72f2687b54fe..88ef17093d3f3 100644
--- a/lldb/include/lldb/Core/Opcode.h
+++ b/lldb/include/lldb/Core/Opcode.h
@@ -200,6 +200,7 @@ class Opcode {
   }
 
   int Dump(Stream *s, uint32_t min_byte_width);
+  int DumpRISCV(Stream *s, uint32_t min_byte_width);
 
   const void *GetOpcodeBytes() const {
     return ((m_type == Opcode::eTypeBytes) ? m_data.inst.bytes : nullptr);
diff --git a/lldb/source/Core/Disassembler.cpp b/lldb/source/Core/Disassembler.cpp
index 833e327579a29..f95e446448036 100644
--- a/lldb/source/Core/Disassembler.cpp
+++ b/lldb/source/Core/Disassembler.cpp
@@ -658,8 +658,13 @@ void Instruction::Dump(lldb_private::Stream *s, uint32_t max_opcode_byte_size,
       // the byte dump to be able to always show 15 bytes (3 chars each) plus a
       // space
       if (max_opcode_byte_size > 0)
-        m_opcode.Dump(&ss, max_opcode_byte_size * 3 + 1);
-      else
+        // make RISC-V opcode dump look like llvm-objdump
+        if (exe_ctx &&
+            exe_ctx->GetTargetSP()->GetArchitecture().GetTriple().isRISCV())
+          m_opcode.DumpRISCV(&ss, max_opcode_byte_size * 3 + 1);
+        else
+          m_opcode.Dump(&ss, max_opcode_byte_size * 3 + 1);
+       else
         m_opcode.Dump(&ss, 15 * 3 + 1);
     } else {
       // Else, we have ARM or MIPS which can show up to a uint32_t 0x00000000
@@ -685,10 +690,13 @@ void Instruction::Dump(lldb_private::Stream *s, uint32_t max_opcode_byte_size,
     }
   }
   const size_t opcode_pos = ss.GetSizeOfLastLine();
-  const std::string &opcode_name =
+  std::string &opcode_name =
       show_color ? m_markup_opcode_name : m_opcode_name;
   const std::string &mnemonics = show_color ? m_markup_mnemonics : m_mnemonics;
 
+  if (opcode_name.empty())
+    opcode_name = "<unknown>";
+
   // The default opcode size of 7 characters is plenty for most architectures
   // but some like arm can pull out the occasional vqrshrun.s16.  We won't get
   // consistent column spacing in these cases, unfortunately. Also note that we
diff --git a/lldb/source/Core/Opcode.cpp b/lldb/source/Core/Opcode.cpp
index 3e30d98975d8a..dbcd18cc0d8d2 100644
--- a/lldb/source/Core/Opcode.cpp
+++ b/lldb/source/Core/Opcode.cpp
@@ -78,6 +78,44 @@ lldb::ByteOrder Opcode::GetDataByteOrder() const {
   return eByteOrderInvalid;
 }
 
+// make RISC-V byte dumps look like llvm-objdump, instead of just dumping bytes
+int Opcode::DumpRISCV(Stream *s, uint32_t min_byte_width) {
+  const uint32_t previous_bytes = s->GetWrittenBytes();
+  // if m_type is not bytes, call Dump
+  if (m_type != Opcode::eTypeBytes)
+    return Dump(s, min_byte_width);
+
+  // from RISCVPrettyPrinter in llvm-objdump.cpp
+  // if size % 4 == 0, print as 1 or 2 32 bit values (32 or 64 bit inst)
+  // else if size % 2 == 0, print as 1 or 3 16 bit values (16 or 48 bit inst)
+  // else fall back and print bytes
+  for (uint32_t i = 0; i < m_data.inst.length;) {
+    if (i > 0)
+      s->PutChar(' ');
+    if (!(m_data.inst.length % 4)) {
+      s->Printf("%2.2x%2.2x%2.2x%2.2x", m_data.inst.bytes[i + 3],
+                                        m_data.inst.bytes[i + 2],
+                                        m_data.inst.bytes[i + 1],
+                                        m_data.inst.bytes[i + 0]);
+      i += 4;
+    } else if (!(m_data.inst.length % 2)) {
+      s->Printf("%2.2x%2.2x", m_data.inst.bytes[i + 1],
+                              m_data.inst.bytes[i + 0]);
+      i += 2;
+    } else {
+      s->Printf("%2.2x", m_data.inst.bytes[i]);
+      ++i;
+    }
+  }
+
+  uint32_t bytes_written_so_far = s->GetWrittenBytes() - previous_bytes;
+  // Add spaces to make sure bytes display comes out even in case opcodes aren't
+  // all the same size.
+  if (bytes_written_so_far < min_byte_width)
+    s->Printf("%*s", min_byte_width - bytes_written_so_far, "");
+  return s->GetWrittenBytes() - previous_bytes;
+}
+
 uint32_t Opcode::GetData(DataExtractor &data) const {
   uint32_t byte_size = GetByteSize();
   uint8_t swap_buf[8];
diff --git a/lldb/source/Plugins/Disassembler/LLVMC/DisassemblerLLVMC.cpp b/lldb/source/Plugins/Disassembler/LLVMC/DisassemblerLLVMC.cpp
index ed6047f8f4ef3..eeb6020abd73a 100644
--- a/lldb/source/Plugins/Disassembler/LLVMC/DisassemblerLLVMC.cpp
+++ b/lldb/source/Plugins/Disassembler/LLVMC/DisassemblerLLVMC.cpp
@@ -61,6 +61,8 @@ class DisassemblerLLVMC::MCDisasmInstance {
 
   uint64_t GetMCInst(const uint8_t *opcode_data, size_t opcode_data_len,
                      lldb::addr_t pc, llvm::MCInst &mc_inst) const;
+  bool GetMCInst(const uint8_t *opcode_data, size_t opcode_data_len,
+                 lldb::addr_t pc, llvm::MCInst &mc_inst, size_t &size) const;
   void PrintMCInst(llvm::MCInst &mc_inst, lldb::addr_t pc,
                    std::string &inst_string, std::string &comments_string);
   void SetStyle(bool use_hex_immed, HexImmediateStyle hex_style);
@@ -524,11 +526,11 @@ class InstructionLLVMC : public lldb_private::Instruction {
           const addr_t pc = m_address.GetFileAddress();
           llvm::MCInst inst;
 
-          const size_t inst_size =
-              mc_disasm_ptr->GetMCInst(opcode_data, opcode_data_len, pc, inst);
-          if (inst_size == 0)
-            m_opcode.Clear();
-          else {
+          size_t inst_size = 0;
+          m_is_valid = mc_disasm_ptr->GetMCInst(opcode_data, opcode_data_len,
+                                                pc, inst, inst_size);
+          m_opcode.Clear();
+          if (inst_size != 0) {
             m_opcode.SetOpcodeBytes(opcode_data, inst_size);
             m_is_valid = true;
           }
@@ -604,10 +606,11 @@ class InstructionLLVMC : public lldb_private::Instruction {
         const uint8_t *opcode_data = data.GetDataStart();
         const size_t opcode_data_len = data.GetByteSize();
         llvm::MCInst inst;
-        size_t inst_size =
-            mc_disasm_ptr->GetMCInst(opcode_data, opcode_data_len, pc, inst);
-
-        if (inst_size > 0) {
+        size_t inst_size = 0;
+        bool valid = mc_disasm_ptr->GetMCInst(opcode_data, opcode_data_len, pc,
+                                             inst, inst_size);
+ 
+        if (valid && inst_size > 0) {
           mc_disasm_ptr->SetStyle(use_hex_immediates, hex_style);
 
           const bool saved_use_color = mc_disasm_ptr->GetUseColor();
@@ -1206,9 +1209,10 @@ class InstructionLLVMC : public lldb_private::Instruction {
     const uint8_t *opcode_data = data.GetDataStart();
     const size_t opcode_data_len = data.GetByteSize();
     llvm::MCInst inst;
-    const size_t inst_size =
-        mc_disasm_ptr->GetMCInst(opcode_data, opcode_data_len, pc, inst);
-    if (inst_size == 0)
+    size_t inst_size = 0;
+    const bool valid = mc_disasm_ptr->GetMCInst(opcode_data, opcode_data_len,
+                                                pc, inst, inst_size);
+    if (!valid)
       return;
 
     m_has_visited_instruction = true;
@@ -1337,19 +1341,18 @@ DisassemblerLLVMC::MCDisasmInstance::MCDisasmInstance(
          m_asm_info_up && m_context_up && m_disasm_up && m_instr_printer_up);
 }
 
-uint64_t DisassemblerLLVMC::MCDisasmInstance::GetMCInst(
+bool DisassemblerLLVMC::MCDisasmInstance::GetMCInst(
     const uint8_t *opcode_data, size_t opcode_data_len, lldb::addr_t pc,
-    llvm::MCInst &mc_inst) const {
+    llvm::MCInst &mc_inst, size_t &size) const {
   llvm::ArrayRef<uint8_t> data(opcode_data, opcode_data_len);
   llvm::MCDisassembler::DecodeStatus status;
 
-  uint64_t new_inst_size;
-  status = m_disasm_up->getInstruction(mc_inst, new_inst_size, data, pc,
+  status = m_disasm_up->getInstruction(mc_inst, size, data, pc,
                                        llvm::nulls());
   if (status == llvm::MCDisassembler::Success)
-    return new_inst_size;
+    return true;
   else
-    return 0;
+    return false;
 }
 
 void DisassemblerLLVMC::MCDisasmInstance::PrintMCInst(
diff --git a/lldb/source/Utility/ArchSpec.cpp b/lldb/source/Utility/ArchSpec.cpp
index 70b9800f4dade..7c71aaae6bcf2 100644
--- a/lldb/source/Utility/ArchSpec.cpp
+++ b/lldb/source/Utility/ArchSpec.cpp
@@ -228,9 +228,9 @@ static const CoreDefinition g_core_definitions[] = {
     {eByteOrderLittle, 4, 4, 4, llvm::Triple::hexagon,
      ArchSpec::eCore_hexagon_hexagonv5, "hexagonv5"},
 
-    {eByteOrderLittle, 4, 2, 4, llvm::Triple::riscv32, ArchSpec::eCore_riscv32,
+    {eByteOrderLittle, 4, 2, 8, llvm::Triple::riscv32, ArchSpec::eCore_riscv32,
      "riscv32"},
-    {eByteOrderLittle, 8, 2, 4, llvm::Triple::riscv64, ArchSpec::eCore_riscv64,
+    {eByteOrderLittle, 8, 2, 8, llvm::Triple::riscv64, ArchSpec::eCore_riscv64,
      "riscv64"},
 
     {eByteOrderLittle, 4, 4, 4, llvm::Triple::loongarch32,

Copy link

github-actions bot commented Jun 25, 2025

⚠️ Python code formatter, darker found issues in your code. ⚠️

You can test this locally with the following command:
darker --check --diff -r HEAD~1...HEAD lldb/examples/python/filter_disasm.py
View the diff from darker here.
--- filter_disasm.py	2025-07-03 20:26:29.000000 +0000
+++ filter_disasm.py	2025-07-03 20:29:44.925067 +0000
@@ -11,74 +11,82 @@
 import lldb
 import subprocess
 
 filter_program = "crustfilt"
 
+
 def __lldb_init_module(debugger, dict):
-    debugger.HandleCommand(
-        'command script add -f filter_disasm.fdis fdis')
+    debugger.HandleCommand("command script add -f filter_disasm.fdis fdis")
     print("Disassembly filter command (fdis) loaded")
     print("Filter program set to %s" % filter_program)
 
 
 def fdis(debugger, args, exe_ctx, result, dict):
     """
-  Call the built in disassembler, then pass its output to a filter program
-  to add in disassembly for hidden opcodes.
-  Except for get and set, use the fdis command like the disassemble command.
-  By default, the filter program is crustfilt, from
-  https://github.com/quic/crustfilt . This can be changed by changing
-  the global variable filter_program.
+    Call the built in disassembler, then pass its output to a filter program
+    to add in disassembly for hidden opcodes.
+    Except for get and set, use the fdis command like the disassemble command.
+    By default, the filter program is crustfilt, from
+    https://github.com/quic/crustfilt . This can be changed by changing
+    the global variable filter_program.
 
-  Usage:
-    fdis [[get] [set <program>] [<disassembly options>]]
+    Usage:
+      fdis [[get] [set <program>] [<disassembly options>]]
 
-    Choose one of the following:
-        get
-            Gets the current filter program
+      Choose one of the following:
+          get
+              Gets the current filter program
 
-        set <program>
-            Sets the current filter program. This can be an executable, which
-            will be found on PATH, or an absolute path.
+          set <program>
+              Sets the current filter program. This can be an executable, which
+              will be found on PATH, or an absolute path.
 
-        <disassembly options>
-            If the first argument is not get or set, the args will be passed
-            to the disassemble command as is.
+          <disassembly options>
+              If the first argument is not get or set, the args will be passed
+              to the disassemble command as is.
 
     """
 
     global filter_program
-    args_list = args.split(' ')
+    args_list = args.split(" ")
     result.Clear()
 
-    if len(args_list) == 1 and args_list[0] == 'get':
+    if len(args_list) == 1 and args_list[0] == "get":
         result.PutCString(filter_program)
         result.SetStatus(lldb.eReturnStatusSuccessFinishResult)
         return
 
-    if len(args_list) == 2 and args_list[0] == 'set':
+    if len(args_list) == 2 and args_list[0] == "set":
         filter_program = args_list[1]
         result.PutCString("Filter program set to %s" % filter_program)
         result.SetStatus(lldb.eReturnStatusSuccessFinishResult)
         return
 
     res = lldb.SBCommandReturnObject()
-    debugger.GetCommandInterpreter().HandleCommand('disassemble -b ' + args, exe_ctx, res)
-    if (len(res.GetError()) > 0):
+    debugger.GetCommandInterpreter().HandleCommand(
+        "disassemble -b " + args, exe_ctx, res
+    )
+    if len(res.GetError()) > 0:
         result.SetError(res.GetError())
         result.SetStatus(lldb.eReturnStatusFailed)
         return
     output = res.GetOutput()
 
     try:
-        proc = subprocess.run([filter_program], capture_output=True, text=True, input=output)
+        proc = subprocess.run(
+            [filter_program], capture_output=True, text=True, input=output
+        )
     except (subprocess.SubprocessError, OSError) as e:
         result.PutCString("Error occurred. Original disassembly:\n\n" + output)
         result.SetError(str(e))
         result.SetStatus(lldb.eReturnStatusFailed)
         return
 
     if proc.returncode:
-        result.PutCString("warning: {} returned non-zero value {}".format(filter_program, proc.returncode))
+        result.PutCString(
+            "warning: {} returned non-zero value {}".format(
+                filter_program, proc.returncode
+            )
+        )
 
     result.PutCString(proc.stdout)
     result.SetStatus(lldb.eReturnStatusSuccessFinishResult)

Copy link

github-actions bot commented Jun 25, 2025

⚠️ C/C++ code formatter, clang-format found issues in your code. ⚠️

You can test this locally with the following command:
git-clang-format --diff HEAD~1 HEAD --extensions h,cpp -- lldb/include/lldb/Core/Opcode.h lldb/source/Core/Disassembler.cpp lldb/source/Core/Opcode.cpp lldb/source/Plugins/Disassembler/LLVMC/DisassemblerLLVMC.cpp lldb/source/Utility/ArchSpec.cpp
View the diff from clang-format here.
diff --git a/lldb/source/Core/Disassembler.cpp b/lldb/source/Core/Disassembler.cpp
index 5ee3fc628..7ca399199 100644
--- a/lldb/source/Core/Disassembler.cpp
+++ b/lldb/source/Core/Disassembler.cpp
@@ -665,7 +665,7 @@ void Instruction::Dump(lldb_private::Stream *s, uint32_t max_opcode_byte_size,
           m_opcode.DumpRISCV(&ss, max_byte_width);
         else
           m_opcode.Dump(&ss, max_byte_width);
-       else
+      else
         m_opcode.Dump(&ss, 15 * 3 + 1);
     } else {
       // Else, we have ARM or MIPS which can show up to a uint32_t 0x00000000
@@ -691,8 +691,7 @@ void Instruction::Dump(lldb_private::Stream *s, uint32_t max_opcode_byte_size,
     }
   }
   const size_t opcode_pos = ss.GetSizeOfLastLine();
-  std::string &opcode_name =
-      show_color ? m_markup_opcode_name : m_opcode_name;
+  std::string &opcode_name = show_color ? m_markup_opcode_name : m_opcode_name;
   const std::string &mnemonics = show_color ? m_markup_mnemonics : m_mnemonics;
 
   if (opcode_name.empty())
diff --git a/lldb/source/Core/Opcode.cpp b/lldb/source/Core/Opcode.cpp
index 17b4f2d30..c4c6f9f82 100644
--- a/lldb/source/Core/Opcode.cpp
+++ b/lldb/source/Core/Opcode.cpp
@@ -92,16 +92,16 @@ int Opcode::DumpRISCV(Stream *s, uint32_t min_byte_width) {
     // if size % 4 == 0, print as 1 or 2 32 bit values (32 or 64 bit inst)
     if (!(m_data.inst.length % 4)) {
       s->Printf("%2.2x%2.2x%2.2x%2.2x", m_data.inst.bytes[i + 3],
-                                        m_data.inst.bytes[i + 2],
-                                        m_data.inst.bytes[i + 1],
-                                        m_data.inst.bytes[i + 0]);
+                m_data.inst.bytes[i + 2], m_data.inst.bytes[i + 1],
+                m_data.inst.bytes[i + 0]);
       i += 4;
-    // else if size % 2 == 0, print as 1 or 3 16 bit values (16 or 48 bit inst)
+      // else if size % 2 == 0, print as 1 or 3 16 bit values (16 or 48 bit
+      // inst)
     } else if (!(m_data.inst.length % 2)) {
       s->Printf("%2.2x%2.2x", m_data.inst.bytes[i + 1],
-                              m_data.inst.bytes[i + 0]);
+                m_data.inst.bytes[i + 0]);
       i += 2;
-    // else fall back and print bytes
+      // else fall back and print bytes
     } else {
       s->Printf("%2.2x", m_data.inst.bytes[i]);
       ++i;
diff --git a/lldb/source/Plugins/Disassembler/LLVMC/DisassemblerLLVMC.cpp b/lldb/source/Plugins/Disassembler/LLVMC/DisassemblerLLVMC.cpp
index eeb6020ab..ae780a0a5 100644
--- a/lldb/source/Plugins/Disassembler/LLVMC/DisassemblerLLVMC.cpp
+++ b/lldb/source/Plugins/Disassembler/LLVMC/DisassemblerLLVMC.cpp
@@ -608,8 +608,8 @@ public:
         llvm::MCInst inst;
         size_t inst_size = 0;
         bool valid = mc_disasm_ptr->GetMCInst(opcode_data, opcode_data_len, pc,
-                                             inst, inst_size);
- 
+                                              inst, inst_size);
+
         if (valid && inst_size > 0) {
           mc_disasm_ptr->SetStyle(use_hex_immediates, hex_style);
 
@@ -1341,14 +1341,15 @@ DisassemblerLLVMC::MCDisasmInstance::MCDisasmInstance(
          m_asm_info_up && m_context_up && m_disasm_up && m_instr_printer_up);
 }
 
-bool DisassemblerLLVMC::MCDisasmInstance::GetMCInst(
-    const uint8_t *opcode_data, size_t opcode_data_len, lldb::addr_t pc,
-    llvm::MCInst &mc_inst, size_t &size) const {
+bool DisassemblerLLVMC::MCDisasmInstance::GetMCInst(const uint8_t *opcode_data,
+                                                    size_t opcode_data_len,
+                                                    lldb::addr_t pc,
+                                                    llvm::MCInst &mc_inst,
+                                                    size_t &size) const {
   llvm::ArrayRef<uint8_t> data(opcode_data, opcode_data_len);
   llvm::MCDisassembler::DecodeStatus status;
 
-  status = m_disasm_up->getInstruction(mc_inst, size, data, pc,
-                                       llvm::nulls());
+  status = m_disasm_up->getInstruction(mc_inst, size, data, pc, llvm::nulls());
   if (status == llvm::MCDisassembler::Success)
     return true;
   else

@tedwoodward
Copy link
Author

tedwoodward commented Jun 25, 2025

Before this change, disassembly of the crustfilt test program looks like this:

(lldb) dis -b
riscv_filter_disasm`main:
    0x390 <+0>:  01 11        addi   sp, sp, -0x20
    0x392 <+2>:  06 ce        sw     ra, 0x1c(sp)
    0x394 <+4>:  22 cc        sw     s0, 0x18(sp)
    0x396 <+6>:  00 10        addi   s0, sp, 0x20
    0x398 <+8>:  01 45        li     a0, 0x0
    0x39a <+10>: 23 2a a4 fe  sw     a0, -0xc(s0)
->  0x39e <+14>: 23 28 a4 fe  sw     a0, -0x10(s0)
    0x3a2 <+18>: 13 05 00 02  li     a0, 0x20
    0x3a6 <+22>: 23 26 a4 fe  sw     a0, -0x14(s0)
    0x3aa <+26>: <invalid>           
    0x3ac <+28>: 40 09        addi   s0, sp, 0x94
    0x3ae <+30>: 20 00        addi   s0, sp, 0x8
    0x3b0 <+32>: 20 00        addi   s0, sp, 0x8
    0x3b2 <+34>: <invalid>           
    0x3b4 <+36>: 00 00        unimp  
    0x3b6 <+38>: 00 10        addi   s0, sp, 0x20
    0x3b8 <+40>: <invalid>           
    0x3ba <+42>: <invalid>           
    0x3bc <+44>: <invalid>           
    0x3be <+46>: <invalid>           
    0x3c0 <+48>: <invalid>           
    0x3c2 <+50>: <invalid>           
    0x3c4 <+52>: 03 25 04 ff  lw     a0, -0x10(s0)
    0x3c8 <+56>: 83 25 c4 fe  lw     a1, -0x14(s0)
    0x3cc <+60>: 33 05 b5 02  mul    a0, a0, a1
    0x3d0 <+64>: f2 40        lw     ra, 0x1c(sp)
    0x3d2 <+66>: 62 44        lw     s0, 0x18(sp)
    0x3d4 <+68>: 05 61        addi   sp, sp, 0x20
    0x3d6 <+70>: 82 80        ret    

Note that the instruction at 0x3aa is an 8 byte instruction, but lldb's disassembler is incorrectly treating it as a 2 byte instruction, then incorrectly disassembling the following addresses as 2 byte instructions.

After this change, disassembly looks like this:

(lldb) dis -b
riscv_filter_disasm`main:
    0x390 <+0>:  1101                     addi   sp, sp, -0x20
    0x392 <+2>:  ce06                     sw     ra, 0x1c(sp)
    0x394 <+4>:  cc22                     sw     s0, 0x18(sp)
    0x396 <+6>:  1000                     addi   s0, sp, 0x20
    0x398 <+8>:  4501                     li     a0, 0x0
    0x39a <+10>: fea42a23                 sw     a0, -0xc(s0)
->  0x39e <+14>: fea42823                 sw     a0, -0x10(s0)
    0x3a2 <+18>: 02000513                 li     a0, 0x20
    0x3a6 <+22>: fea42623                 sw     a0, -0x14(s0)
    0x3aa <+26>: 0940003f 00200020        <unknown>
    0x3b2 <+34>: 021f 0000 1000           <unknown>
    0x3b8 <+40>: 084f940b                 <unknown>
    0x3bc <+44>: b8f2                     <unknown>
    0x3be <+46>: 084f940b                 <unknown>
    0x3c2 <+50>: b8f2                     <unknown>
    0x3c4 <+52>: ff042503                 lw     a0, -0x10(s0)
    0x3c8 <+56>: fec42583                 lw     a1, -0x14(s0)
    0x3cc <+60>: 02b50533                 mul    a0, a0, a1
    0x3d0 <+64>: 40f2                     lw     ra, 0x1c(sp)
    0x3d2 <+66>: 4462                     lw     s0, 0x18(sp)
    0x3d4 <+68>: 6105                     addi   sp, sp, 0x20
    0x3d6 <+70>: 8082                     ret    

The instruction at 0x3aa is identified as a 64 bit instruction, the opcode is shown, and the instruction is marked as <unknown>.

The output from fdis looks like this:


riscv_filter_disasm`main:
    0x390 <+0>:  1101                     addi   sp, sp, -0x20
    0x392 <+2>:  ce06                     sw     ra, 0x1c(sp)
    0x394 <+4>:  cc22                     sw     s0, 0x18(sp)
    0x396 <+6>:  1000                     addi   s0, sp, 0x20
    0x398 <+8>:  4501                     li     a0, 0x0
    0x39a <+10>: fea42a23                 sw     a0, -0xc(s0)
->  0x39e <+14>: fea42823                 sw     a0, -0x10(s0)
    0x3a2 <+18>: 02000513                 li     a0, 0x20
    0x3a6 <+22>: fea42623                 sw     a0, -0x14(s0)
    0x3aa <+26>: 0940003f 00200020        Fake64
    0x3b2 <+34>: 021f 0000 1000           xqci.e.li 4, 268435456
    0x3b8 <+40>: 084f940b                 insbi x8, #0x1f, #0x4, #0x4
    0x3bc <+44>: b8f2                     CmPush {ra, s0-s11},-0
    0x3be <+46>: 084f940b                 insbi x8, #0x1f, #0x4, #0x4
    0x3c2 <+50>: b8f2                     CmPush {ra, s0-s11},-0
    0x3c4 <+52>: ff042503                 lw     a0, -0x10(s0)
    0x3c8 <+56>: fec42583                 lw     a1, -0x14(s0)
    0x3cc <+60>: 02b50533                 mul    a0, a0, a1
    0x3d0 <+64>: 40f2                     lw     ra, 0x1c(sp)
    0x3d2 <+66>: 4462                     lw     s0, 0x18(sp)
    0x3d4 <+68>: 6105                     addi   sp, sp, 0x20
    0x3d6 <+70>: 8082                     ret

The filter replaces the instructions with instructions that it can disassemble.

@apazos
Copy link
Contributor

apazos commented Jun 26, 2025

Thanks @tedwoodward!
This is useful for evaluating new instructions (as part of ISA evolution efforts) and for supporting proprietary custom instructions.

Copy link
Collaborator

@DavidSpickett DavidSpickett left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see the idea but am a bit wary of making the output look like objdump as a general goal just because they are not used for the same thing, debuggers do sometimes have different goals. In this case I think it's OK because you're improving a part of the disassembly that wouldn't be useful anyway.

Is there a reason we couldn't handle this the same way for all targets?

(lldb) dis
test.o`main:
->  0xaaaaaaaaa714 <+0>:  adrp   x0, 17
    0xaaaaaaaaa718 <+4>:  add    x0, x0, #0x10 ; a
    0xaaaaaaaaa71c <+8>:  mov    w1, #0x2 ; =2 
    0xaaaaaaaaa720 <+12>: str    w1, [x0]
    0xaaaaaaaaa724 <+16>: adrp   x0, 17
    0xaaaaaaaaa728 <+20>: add    x0, x0, #0x10 ; a
    0xaaaaaaaaa72c <+24>: ldr    w0, [x0]
    0xaaaaaaaaa730 <+28>: ret    
(lldb) dis -b
test.o`main:
->  0xaaaaaaaaa714 <+0>:  0xb0000080   adrp   x0, 17
    0xaaaaaaaaa718 <+4>:  0x91004000   add    x0, x0, #0x10 ; a
    0xaaaaaaaaa71c <+8>:  0x52800041   mov    w1, #0x2 ; =2 
    0xaaaaaaaaa720 <+12>: 0xb9000001   str    w1, [x0]
    0xaaaaaaaaa724 <+16>: 0xb0000080   adrp   x0, 17
    0xaaaaaaaaa728 <+20>: 0x91004000   add    x0, x0, #0x10 ; a
    0xaaaaaaaaa72c <+24>: 0xb9400000   ldr    w0, [x0]
    0xaaaaaaaaa730 <+28>: 0xd65f03c0   ret

The missing part is knowing how to split up that encoding value isn't it. For AArch64 you'd just print it because we only have 32-bit, Intel you would roll dice to randomly decide what to do and RISC-V we have these 2/3 formats.

Arm M profile might benefit from it but I have never been asked to support such a thing. With the thumb 16 and 32-bit encodings plus the sort of custom instruction extension it has.

Because as usual, anything if certain architecture in generic code isn't great, but hiding that behind a virtual method is just the same thing with more steps.

So I'm not against this, and I agree that RISC-V is a special case in that it leans harder into custom instructions than other architecures. Arm M Profile has a sort of custom instruction thing, and you've been able to use coprocessor encodings for years on many architectures but no one bothered to add this to tools (which is not on you of course, that's their loss).

So this being RISC-V specific, kinda has to be. But it's one generic method away from being a generic "format in a way that's more useful", if we needed it to be in future.

I think you need to expand the comments in this formatting code to say both:

  • This is mimicking the objdump format and -
  • It is doing so because this is easier to read / substitute / whatever

Then I don't have to go look at what objdump does to figure out the goals of this code.

How standard are these ways of printing the byte encodings? Is it recommended / used by the spec, gnu objdump and llvm objdump? That's the ideal.

If it's non-standard my worry would be you doing this to fit one filtering application and another coming along and wanting it in a different format.

Also this needs tests.

  • See if we have tests for -b, if not, write some for something that is not RISC-V. Easy way to check is to mess up the formatting and see what fails.
  • Add some -b for RISC-V specifically, with all the different formats
  • Add tests for the filtering script that use another script that pretends to be a filtering program. As this script is less of a demo, more of a real feature for your customers at least.

Comment on lines 80 to 84
print(proc.stderr)
if proc.stderr:
pass
#result.SetError(proc.stderr)
#result.SetStatus(lldb.eReturnStatusFailed)
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I presume this needs to be swapped. Put stderr in the error so that the user will see it.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure the presence of data on stderr means a failure. I'll look into error handling more.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It looks like python's subprocess.run returns a subprocess.CompletedProcess object which has a returncode ivar, and the usual convention in Unix is 0 means success. I wouldn't treat the presence of stderr as indicative of an error by itself.

@DavidSpickett
Copy link
Collaborator

Few more things:

  • Assuming this were to land, there needs to be a release note for it.
  • What solutions exist for people using GDB, and are they along the same lines?

@DavidSpickett
Copy link
Collaborator

@asb Just pinging you on the chance you have heard discussions about doing this with other tools. What approaches, if any, did they take?

@tedwoodward
Copy link
Author

tedwoodward commented Jun 26, 2025

Is there a reason we couldn't handle this the same way for all targets?

The llvm disassembler returns the size, and the lldb disassembler sets the Opcode (class instantiation) to a certain type - 8 bit, 16 bit, 16 bit thumb, 32 bit, 64 bit, bytes. For RISC-V, it's set to bytes, which means it prints out 1 byte at a time. I didn't want to add a type, because "bytes" works well for RISC-V, except when it comes to print them out. That is an option, though, if we didn't want to have special pretty printers for the "this is a weird thing" cases.

I think you need to expand the comments in this formatting code to say both:

  • This is mimicking the objdump format and -
  • It is doing so because this is easier to read / substitute / whatever

Then I don't have to go look at what objdump does to figure out the goals of this code.

Sure, I'll do that.

How standard are these ways of printing the byte encodings? Is it recommended / used by the spec, gnu objdump and llvm objdump? That's the ideal.

For RISC-V, llvm-objdump mimics gnu objdump, so this change makes the RISC-V byte encodings match both.

If it's non-standard my worry would be you doing this to fit one filtering application and another coming along and wanting it in a different format.

That's one thing I'm trying to avoid - we don't want a filter app for objdump and another for the debugger. That's why I changed how the bytes are displayed, and changed "can't disassemble" from blank to "<unknown>", which matches llvm-objdump.

Also this needs tests.

  • See if we have tests for -b, if not, write some for something that is not RISC-V. Easy way to check is to mess up the formatting and see what fails.
  • Add some -b for RISC-V specifically, with all the different formats
  • Add tests for the filtering script that use another script that pretends to be a filtering program. As this script is less of a demo, more of a real feature for your customers at least.

Will do.

@tedwoodward
Copy link
Author

Few more things:

  • Assuming this were to land, there needs to be a release note for it.
  • What solutions exist for people using GDB, and are they along the same lines?

I think that's a good idea. Do you know how to add something to release notes? I've never done it upstream.

  • What solutions exist for people using GDB, and are they along the same lines?

I don't know what people are doing with GDB. Possibly nothing yet, since this is pretty new.

@DavidSpickett
Copy link
Collaborator

DavidSpickett commented Jun 26, 2025

For RISC-V, llvm-objdump mimics gnu objdump, so this change makes the RISC-V byte encodings match both.

Great, that's standard enough.

That's one thing I'm trying to avoid - we don't want a filter app for objdump and another for the debugger. That's why I changed how the bytes are displayed, and changed "can't disassemble" from blank to "", which matches llvm-objdump.

Yeah that makes sense, the glue between the tool and the filter may change a bit but a portable filter you can take between tools and toolchains is nice.

Which reminds me I didn't ask about the alternatives. I can think of a few, with their own positives and negatives:

  • Adding a shared object to llvm-mc at runtime with new instructions.
    • It "just works" (once you learn C++ and Tablegen)
    • Could load support for multiple extensions
    • You can use a prebuilt version of lldb/llvm with it
    • Except you can't because the C++ API may have changed, so you need one plugin per major version
    • I think I've heard this idea before and changing the backend structures at runtime was considered high difficulty.
  • Build an llvm that supports the instructions
    • See above basically
    • Maybe you already have done this to get llvm to generate code
    • Need to build it yourself
    • Can't compose extensions
    • Need to use tools from that build, can't use GDB if you like GDB, has to be the ones in that build
  • Write your own custom command that parses the original disassembler output format is, but given that it currently prints <invalid>, such a script would have to be magic.

Looking at it that way, I think another way to describe this proposal is:
Printing <invalid> is zero use to anyone, let's print the encoding at least, and if we're going to do that, do it in a way that can be easily parsed and read.

And that I definitely agree with.

Then you can multiply those pros and cons a bunch if you are a vendor, to public or private customers. You have the effort of telling them no you have to use <this path>/tool not <this other path>/tool (we used to have a switcher that would look at compiler options and do this for us, making one for lldb would be a lot more annoying).

But now I'm making your argument for you I think. You get the idea.

The only real "gotcha" question I can come up with is, wouldn't a user who is interested in custom instructions already have access to a compiler that produces them and that compiler is likely to be llvm, so is lldb from that llvm not within reach already?

Educate me on that, I don't know how folks approach developing these extensions. Maybe code generation is the last thing they do, after they know it's worth pursuing. So you've got a lot of hand written assembler and .inst <encoding> going on.

I think that's a good idea. Do you know how to add something to release notes? I've never done it upstream.

LLDB's release notes live in a section of LLVM's - https://github.com/llvm/llvm-project/blob/main/llvm/docs/ReleaseNotes.md#changes-to-lldb.

@DavidSpickett
Copy link
Collaborator

@JDevlieghere / @jasonmolenda you have been in the RISC-V world lately, what do you think to this approach?

@DavidSpickett
Copy link
Collaborator

DavidSpickett commented Jun 26, 2025

Just doing some googling, mostly people talk about modifying the binutils in the gnu toolchain for custom instructions and rebuilding it.

This refers to some XML file, but I can't tell if they're talking about an upstream patch, or their own product based on GDB:

we have recently worked on a GDB patch to allow these custom instruction mnemonics
to be defined in an XML file which GDB can read and use to display the instruction (and parameters) in a
human-readable format.

Might be my search skills, but I only see references to XML for target descriptions in upstream GDB.

Anyway, that's another approach that I guess would require each tool to add an option to load that file. Rather than your proposal which wraps the filter around the tool (kind of, the custom command is still inside of lldb from the user's perspective).

You could build the filter options into the disassemble command, but that's more complicated and you can argue that this PR is simply making the output more useful. Which has the side effect of being suitable for filtering.

In future someone could come along and propose changing the builtin command.

@tedwoodward
Copy link
Author

The only real "gotcha" question I can come up with is, wouldn't a user who is interested in custom instructions already have access to a compiler that produces them and that compiler is likely to be llvm, so is lldb from that llvm not within reach already?

Educate me on that, I don't know how folks approach developing these extensions. Maybe code generation is the last thing they do, after they know it's worth pursuing. So you've got a lot of hand written assembler and .inst <encoding> going on.

This particular PR has to do with Qualcomm's push to be more open source. We don't want to provide custom toolchains for things with good upstream support. That's why we're pushing a bunch of our former downstream code upstream; Polly vectorizer changes, LLVM vectorizer changes, etc. It's made upstream clang performance much closer to downstream clang performance. We got the Xqci guys to open source their extension definition so we could upstream the TD files for it.

But...not everyone wants to upstream their extensions, and some people don't want to build a custom toolchain for every little extension. So they decided to use the .insn assembler directive (supported for at least 5 years, according to a quick google search), and a filter program to pipe objdump output through.

LLDB's release notes live in a section of LLVM's - https://github.com/llvm/llvm-project/blob/main/llvm/docs/ReleaseNotes.md#changes-to-lldb.

Thank you!

@lquinn2015
Copy link
Contributor

The only real "gotcha" question I can come up with is, wouldn't a user who is interested in custom instructions already have access to a compiler that produces them and that compiler is likely to be llvm, so is lldb from that llvm not within reach already?

Educate me on that, I don't know how folks approach developing these extensions. Maybe code generation is the last thing they do, after they know it's worth pursuing. So you've got a lot of hand written assembler and .inst <encoding> going on.

I built that crustfilt precisely because I did not have the ability to add to the compiler's disassembler especially on mass. The sideband decoder approach was much faster to support and was the only reason we were able to move most of our custom architecture to RISCV. It also still covers some of the custom DSP stuff we cannot share / wouldn't be generally useful for people.

I'd also argue a lot of RTL development happens in walled gardens now which increases the difficult of building fundamental tools. A python script has very few dependencies that the RTL team likely already has.

@lenary
Copy link
Member

lenary commented Jun 27, 2025

To chime in as one of the devisors and proponents on the toolchain side of this approach:

The only real "gotcha" question I can come up with is, wouldn't a user who is interested in custom instructions already have access to a compiler that produces them and that compiler is likely to be llvm, so is lldb from that llvm not within reach already?

Educate me on that, I don't know how folks approach developing these extensions. Maybe code generation is the last thing they do, after they know it's worth pursuing. So you've got a lot of hand written assembler and .inst <encoding> going on.

Precisely we do have a lot of .insn <encoding> going on (or RISC-V's special variants of that). I'll explain why and how.

Qualcomm's approach here is twofold:

  • We are upstreaming support for custom extensions where we can make the details of those extensions public enough to upstream (i.e., writing a full spec). We have been doing this with the Xqci family of RISC-V extensions, and the Xqccmp extension. These are supported by LLVM, and the MC-layer disassembler will disassemble these instructions correctly without any kind of filter.
  • We have custom extensions we can never describe publicly, and therefore will be unable to support upstream. For this we need another approach.

One approach is to have a downstream-only toolchain, which we control very carefully and which diverges slowly but inevitably from LLVM upstream. Upon realising that almost all of our custom extensions are only used in assembly, and we had no plans to implement code generation for most of the extensions we can't publicise, I realised that there was the ability for us to take a different approach.

This approach keeps assembly and disassembly support for their proprietary custom extensions outside the toolchain itself. I describe exactly how to follow the approach here: https://github.com/quic/crustfilt/blob/main/docs/supporting-external-instructions-on-llvm.md but broadly the idea (stolen from Luke Wren's Hazard3 docs (Chapter 4)) is to use assembly macros to hide the .insn invocations, so users get to write their <mnemonic> <operands> syntax that matches conventional RISC-V assembly. This is the main reason RISC-V's .insn directive got a bunch of work from me in the LLVM 20 release (and we made improvements for using these macros from inline assembly, work that is still continuing because LTO is always harder than you hope).

On the disassembly side, I agree there are a few different ways this could be supported, a real plugin "I failed to disassemble, can you manage?" interface is one approach, but has a lot of drawbacks compared to just passing the output of objdump through another text-based tool, which is where crustfilt comes in. This tradition of structuring a tool this way is effectively the same as the c++filt demangler. Note that crustfilt is deemed by us to be a "generic" tool, in that different teams will have different versions of crustfilt which support their own instructions, rather than re-centralising disassembly support in a single tool - if we were willing to centralise this, we would of course do it inside the toolchain.

This then gives us a few different advantages:

  • The approach is portable, it's using features supported by both GCC/Binutils and LLVM
  • Teams keep control of their own custom extensions when doing assembly and disassembly, allowing them to be in charge of the access to their custom extension information. This also makes the toolchain easier to distribute as we can reduce the quantity of non-public information it contains.
  • We improve the ability for teams to iterate on their extension design early on, when tool support often struggles to keep up. This applies not just to custom extensions, but also when prototyping support for future standard/open extensions.

And that's how we get here: filtering the output of objdump is fine, but it would be great to also support users inside their disassembler 😄

@lenary
Copy link
Member

lenary commented Jun 27, 2025

To also respond to something earlier in the thread, where there is a little complexity:

The missing part is knowing how to split up that encoding value isn't it. For AArch64 you'd just print it because we only have 32-bit, Intel you would roll dice to randomly decide what to do and RISC-V we have these 2/3 formats.

One "weird" bit of the approach is that we actually still rely on LLVM's MC-layer to understand the length of the instruction. RISC-V currently has only 2 ratified lengths (16 and 32-bit), but describes an encoding scheme for longer instructions which both GNU objdump and LLVM's MC-layer understand when disassembling. RISC-V does not, at the moment, have a maximum length of instruction, but our callback only implements the scheme up to 176-bit long instructions. On the assembler side, we can only assemble up to 64-bit instructions, so we ensure our teams keep to this lower limit.

There are two relevant callbacks on MC's MCDisassembler interface:

  • MCDisassembler::getInstruction which is the main interface, and interprets the uint64_t &Size whether it decodes an instruction or not. This is the only callback RISC-V implements.
  • MCDisassembler::suggestBytesToSkip, which the Arm/AArch64 backends use for realigning the disassembly flow. We maybe should implement this given we know the instruction alignment in RISC-V is either 2 or 4, but we don't at the moment.

@DavidSpickett
Copy link
Collaborator

DavidSpickett commented Jun 27, 2025

Upon realising that almost all of our custom extensions are only used in assembly

Which is surprising to me, but if I looked at all the assembly only extensions for Arm I'd find the the same thing. I just rarely have to deal with those.

And that's how we get here: filtering the output of objdump is fine, but it would be great to also support users inside their disassembler 😄

Yes I see how you'd get there.

Even if we want to be super reductive, printing the bytes out at least means you can decode by hand. Which you can't do today.

So I like the direction.

MCDisassembler::suggestBytesToSkip, which the Arm/AArch64 backends use for realigning the disassembly flow. We maybe should implement this given we know the instruction alignment in RISC-V is either 2 or 4, but we don't at the moment.

I should check how this ends up displaying in lldb. AArch64 unlikely to be a problem but Thumb is variable so I hope we at least show the bytes.

@tedwoodward I think this change might be more clearly pitched as:

  • Currently when an instruction is not decoded lldb prints nothing useful
  • You have made lldb print something useful in this situation, for humans and scripts
  • One of those scripts can support custom instructions

Which I think is a net positive.

Still unsure about if riscv in this generic code but if there's no other use case for it then it's fine. That's just a code organisation issue.

Arm M profile has https://developer.arm.com/Architectures/Arm%20Custom%20Instructions, I'll look into that and see if it would benefit from a change of output format too. Just in theory though, I don't think we shipped support for open source debuggers and I'm not about to implement it myself.

@@ -658,8 +658,13 @@ void Instruction::Dump(lldb_private::Stream *s, uint32_t max_opcode_byte_size,
// the byte dump to be able to always show 15 bytes (3 chars each) plus a
// space
if (max_opcode_byte_size > 0)
m_opcode.Dump(&ss, max_opcode_byte_size * 3 + 1);
else
// make RISC-V opcode dump look like llvm-objdump
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If you say instead "Pretty print RISC-V opcodes in the same format that llvm-objdump uses." this hints at the motivation and what keywords to look for in llvm-objdump's source.

// make RISC-V opcode dump look like llvm-objdump
if (exe_ctx &&
exe_ctx->GetTargetSP()->GetArchitecture().GetTriple().isRISCV())
m_opcode.DumpRISCV(&ss, max_opcode_byte_size * 3 + 1);
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull the minimum size out into:

auto min_byte_width = max_opcode_byte_size * 3 + 1;

Then use it in both calls, so it's clear they use the same minimum.

@DavidSpickett
Copy link
Collaborator

DavidSpickett commented Jun 27, 2025

Arm M profile has https://developer.arm.com/Architectures/Arm%20Custom%20Instructions, I'll look into that and see if it would benefit from a change of output format too. Just in theory though, I don't think we shipped support for open source debuggers and I'm not about to implement it myself.

CDE works by assigning one of the co-processors to be the encodings for the custom instructions and it has a few fixed formats you can use. It's not like RISC-V where the layout can be anything you want. Which means that the disassembler would probably print some form, with encoding, and that can already be used to filter if you wanted to.

I also checked how AArch64 works:

$ cat /tmp/test.c
int main() {
  asm volatile(".inst 0x43214444");
  return 0;
}

objdump shows the bytes:

0000000000000714 <main>:
     714: d10043ff     	sub	sp, sp, #0x10
     718: 2a1f03e0     	mov	w0, wzr
     71c: b9000fff     	str	wzr, [sp, #0xc]
     720: 43214444     	<unknown>
     724: 910043ff     	add	sp, sp, #0x10
     728: d65f03c0     	ret

As does LLDB:

(lldb) dis -b
test.o`main:
    0xaaaaaaaaa714 <+0>:  0xd10043ff   sub    sp, sp, #0x10
    0xaaaaaaaaa718 <+4>:  0x2a1f03e0   mov    w0, wzr
    0xaaaaaaaaa71c <+8>:  0xb9000fff   str    wzr, [sp, #0xc]
->  0xaaaaaaaaa720 <+12>: 0x43214444                                    ; unknown opcode
    0xaaaaaaaaa724 <+16>: 0x910043ff   add    sp, sp, #0x10
    0xaaaaaaaaa728 <+20>: 0xd65f03c0   ret

So for AArch64 we happen to mostly match objdump's output, and it's useful enough for humans and scripts because it can only ever be 32-bit encodings.

Also having looked at the pretty printer system in llvm-objdump, I think if riscv is ok here. LLDB is effectively a selective objdumper and the only difference between what you're adding here and what llvm-objdump has is the framework around it. Which we do not need when only RISC-V wants this.

// from RISCVPrettyPrinter in llvm-objdump.cpp
// if size % 4 == 0, print as 1 or 2 32 bit values (32 or 64 bit inst)
// else if size % 2 == 0, print as 1 or 3 16 bit values (16 or 48 bit inst)
// else fall back and print bytes
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would put these comments next to the ifs they refer to, I have to read the code anyway so it makes more sense to me to have the commentary interleaved.

@DavidSpickett DavidSpickett changed the title Support disassembling RISC-V proprietary instructions [lldb] Support disassembling RISC-V proprietary instructions Jun 27, 2025
@jasonmolenda
Copy link
Collaborator

jasonmolenda commented Jul 1, 2025

Sorry for the late comment on this PR. I understand why the llvm lldb is built against may not know the encodings for proprietary instructions set extensions that are only implemented downstream. I didn't realize that the riscv instructions had a scheme for indicating their lengths, very convenient. I was disassembling a riscv binary that had a bexti instruction from the B extensions for bit manipulation, and until I enabled that feature in the disassembler, it simply stopped at that instruction. At the very least, using the encoded instruction size to move past an instruction like this would be a nice refinement when the cpu/features aren't exactly specified right.

The main question I have about this approach is -- the goal here is to have lldb's disassembler output resemble llvm-objdump. Should this simply be an argument to the disassemble command? What's riscv specific, beyond the way that the instruction bytes are printed when they're 48 bit long or whatever.

To be clear, what I'm asking is, should disassemble have an argument to have it match llvm-objdump's output style. The alternative is to force this into a Python command that can be loaded into lldb which operates on SBInstructions, basically an MCInst, and formats the fields in a particular way.

@jasonmolenda
Copy link
Collaborator

For that matter, given that you're already requiring the use of a python command fdis, is this something that could be formatted from the SBInstructions in fdis? It does mean that you need to parse the arguments instead of passing them to disassemble, get back the SBInstructionList, and then format it in the same way llvm-objdump does, for postprocessing in the other script. But it seems like this particular behavior could be contained entirely within the fdis command, and not have disassemble supporting two different output styles, its current one and llvm-objdump's.
I haven't looked at the contents of the SBInstruction to see if this is straightforward or if there are things like the comment field that are missing, but it's my first thought for accomplishing this.

(and if I'm honest, our disassembler's output is not the most helpful to people, I know many of us would like to dig in to this. Should it identify basic blocks? Should it have indications of the control flow graph for a function? Should it annotate registers with the types or variable names when we have debug info? All of this becomes more complicated if we're also outputting exactly what llvm-objdump outputs.)

@jasonmolenda
Copy link
Collaborator

jasonmolenda commented Jul 2, 2025

Note, mostly for me, who was curious how lldb prints bytes in -b mode: I know AArch64 -b disassembly will print 0xUInt32,

a.out[0x100000464] <+4>:  0xd10083ff   sub    sp, sp, #0x20

Intel disassembly prints the instruction's array of bytes UInt8 (1-15 of them iirc), like

a.out[0x100000470] <+0>:  55                    pushq  %rbp
a.out[0x100000471] <+1>:  48 89 e5              movq   %rsp, %rbp

but probably the best analogy today is arm+thumb code which prints as a mix of UInt16 and UInt32,

    0xbbb4 <+0>:   0xb5f0       push   {r4, r5, r6, r7, lr}
    0xbbb6 <+2>:   0xaf03       add    r7, sp, #0xc
    0xbbb8 <+4>:   0xe92d0df0   push.w {r4, r5, r6, r7, r8, r10, r11}

and today disassemble -b prints riscv instructions in the intel style, as an array of bytes. Doesn't seem the ideal format given that we have a known size, today most often 16/32/64, and I guess 48 for funsies.

@lenary
Copy link
Member

lenary commented Jul 2, 2025

Doesn't seem the ideal format given that we have a known size, today most often 16/32/64, and I guess 48 for funsies.

Standard instructions are right now only 16/32, but custom instructions can be any multiple of 16. This was the change to llvm-objdump to group bytes like gnu objdump does: b27f86b which was only a bit over a year ago.

@lenary
Copy link
Member

lenary commented Jul 2, 2025

I didn't realize that the riscv instructions had a scheme for indicating their lengths, very convenient.

It "doesn't". LLVM objdump implements the scheme described in the spec, but for >32-bit instructions, that scheme is not ratified so it could change in the future (the note about this is there but easy to miss). That said, Qualcomm's custom instructions have adopted the unratified scheme for 48-bit instructions.

... is this something that could be formatted from the SBInstructions in fdis? ...
I haven't looked at the contents of the SBInstruction to see if this is straightforward or if there are things like the comment field that are missing, but it's my first thought for accomplishing this.

IIRC, there's nothing to that provides the raw encoding bytes to pass off to another disassembler. Maybe I missed it, or it's not documented? That said, it would be great not to have to re-implement all of the disassemble command's argument handling, which looks fairly complex to me.

@jasonmolenda
Copy link
Collaborator

Doesn't seem the ideal format given that we have a known size, today most often 16/32/64, and I guess 48 for funsies.

Standard instructions are right now only 16/32, but custom instructions can be any multiple of 16. This was the change to llvm-objdump to group bytes like gnu objdump does: b27f86b which was only a bit over a year ago.

Thanks again for the helpful pointers and explanations. I'm surprised they gave up so many bits to help us distinguish opcodes! But we really should be using this in lldb as long as they're there.

I don't think there's any good reason to print riscv instructions like we do with the intel variable length instructions in lldb's disassembler. Printing as a UInt16, UInt32, UInt16 + UInt16 + UInt16, or UInt32 + UInt32 etc seems like a good change to make to lldb's disassembler style for riscv + -b.

I'm only skimming the patch to Opcode::Dump, but it looks like the existing code is relying on an enum when the Opcode object is constructed,

  enum Type {
    eTypeInvalid,
    eType8,
    eType16,
    eType16_2, // a 32-bit Thumb instruction, made up of two words
    eType32,
    eType64,
    eTypeBytes
  };

and the riscv instructions are constructed with the Opcode(uint8_t *bytes, size_t length) ctor so it gets eTypeBytes and it's printed that way. It looks like the InstructionLLVMC::Decode() function in DisassemblerLLVMC.cpp is creating these?

I think changing the way we print the bytes for the riscv disassembler -b is a very reasonable change, instead of printing an array of UInt8's, and it doesn't seem like we should need to break this apart into a separate Opcode::DumpRISCV method? Adding opcode_name = "<unknown>" i'm less immediately thrilled by, but I don't know what we'd print here that was useful as an alternative, maybe it's fine, would like to hear other opinions.

@jasonmolenda
Copy link
Collaborator

jasonmolenda commented Jul 2, 2025

So just to recap again as I think about this, the output style differences are:

  1. lldb currently prints riscv instruction bytes as an array of UInt8 like Intel.
  2. lldb does not print <unknown> as the opcode name on an unrecognized instruction, but MCInst gave us the instruction length so we could continue past it
  3. the UInt16/UInt32 combinations being proposed for output do not have a 0x prefix, where Opcode::Dump always prefixes the 8/16/32 values with that, unless it is an array of UInt8's which are printed without a prefix.

The Opcode objects are created by InstructionLLVMC::Decode in DisassemblerLLVMC.cpp, and there is already an arm/thumb architecture specific difference in how they are created in that case; having another architecture check here seems fine.

None of the Opcode formats (eType8, eType16, eType16_2, eType32, eType64, eTypeBytes) format the opcode in the proposed UInt16/UInt32 combination being proposed for riscv's dump format today.

Is the no-0x prefix a requirement for the augmentation tool? Or will it eat that and ignore it. To be honest, I don't think we should print the prefix for any of the targets - it's only helpful for people doing copy and paste into some tool. I've seen other tools which display the bytes of assembly in a function and I can't think of any cases where I've seen one include the prefix like this. It is a clear signal that these are the bytes in big endian order, not memory order on an LE target.

Should we have an eType1632Tuples (just throwing a name out there) which will format the bytes in the UInt16/UInt32 combined format shown in this PR? Could print "xxxx", "xxxxyyyy", "xxxxyyyy zzzz", "xxxxxyyyy zzzzaaaa" for 16/32/48/64.

@tedwoodward
Copy link
Author

For that matter, given that you're already requiring the use of a python command fdis, is this something that could be formatted from the SBInstructions in fdis? It does mean that you need to parse the arguments instead of passing them to disassemble, get back the SBInstructionList, and then format it in the same way llvm-objdump does, for postprocessing in the other script. But it seems like this particular behavior could be contained entirely within the fdis command, and not have disassemble supporting two different output styles, its current one and llvm-objdump's.

fdis is an optional filter, implemented as a python command. This change does all of the disassembly updates in c++ code, so we'd get the benefits of better opcode formatting for RISC-V, and <unknown> for the disassembly of unknown instructions, instead of a blank.

Is the no-0x prefix a requirement for the augmentation tool? Or will it eat that and ignore it. To be honest, I don't think we should print the prefix for any of the targets - it's only helpful for people doing copy and paste into some tool. I've seen other tools which display the bytes of assembly in a function and I can't think of any cases where I've seen one include the prefix like this. It is a clear signal that these are the bytes in big endian order, not memory order on an LE target.

I don't know if crustfilt requires no 0x, or if it will work with 0x. It's open source, and really an example, so it could be changed easily. The idea (as explained to me) is vendors would write their own filter program, and could use crustfilt as a guide.
I don't think we need 0x as a prefix; llvm-objdump doesn't do it for x86, risc-v or hexagon.

Should we have an eType1632Tuples (just throwing a name out there) which will format the bytes in the UInt16/UInt32 combined format shown in this PR? Could print "xxxx", "xxxxyyyy", "xxxxyyyy zzzz", "xxxxxyyyy zzzzaaaa" for 16/32/48/64.

We could do that. I didn't want to change the Opcode::Type from eTypeBytes in case it was used for something besides disassembly.

LLDB uses the LLVM disassembler to determine the size of instructions and
to do the actual disassembly. Currently, if the LLVM disassembler can't
disassemble an instruction, LLDB will ignore the instruction size, assume
the instruction size is the minimum size for that device, print no useful
opcode, and print nothing for the instruction.

This patch changes this behavior to separate the instruction size and
"can't disassemble". If the LLVM disassembler knows the size, but can't
dissasemble the instruction, LLDB will use that size. It will print out
the opcode, and will print "<unknown>" for the instruction. This is much
more useful to both a user and a script.

The impetus behind this change is to clean up RISC-V disassembly when
the LLVM disassembler doesn't understand all of the instructions.
RISC-V supports proprietary extensions, where the TD files don't know
about certain instructions, and the disassembler can't disassemble them.
Internal users want to be able to disassemble these instructions.

With llvm-objdump, the solution is to pipe the output of the disassembly
through a filter program. This patch modifies LLDB's disassembly to look
more like llvm-objdump's, and includes an example python script that adds
a command "fdis" that will disassemble, then pipe the output through a
specified filter program. This has been tested with crustfilt, a sample
filter located at https://github.com/quic/crustfilt .

Changes in this PR:
- Decouple "can't disassemble" with "instruction size".
  DisassemblerLLVMC::MCDisasmInstance::GetMCInst now returns a bool for
    valid disassembly, and has the size as an out paramter.
  Use the size even if the disassembly is invalid.
  Disassemble if disassemby is valid.

- Always print out the opcode when -b is specified.
  Previously it wouldn't print out the opcode if it couldn't disassemble.

- Print out RISC-V opcodes the way llvm-objdump does.
  Add DumpRISCV method based on RISC-V pretty printer in llvm-objdump.cpp.

- Print <unknown> for instructions that can't be disassembled, matching
  llvm-objdump, instead of printing nothing.

- Update max riscv32 and riscv64 instruction size to 8.

- Add example "fdis" command script.

Change-Id: Ie5a359d9e87a12dde79a8b5c9c7a146440a550c5
@tedwoodward
Copy link
Author

tedwoodward commented Jul 3, 2025

@DavidSpickett @jasonmolenda I uploaded a new change. It has:

  • Use the exe_ctx version of python command, and HandleCommand
  • Set a variable max_byte_width, and use that instead if "max_opcode_byte_size * 3 + 1" in 3 different places
  • Split up RISCVPrettyPrinter comment, putting a comment line for each if branch explaining what it does
  • Added an x86 disassemble -b test
  • Added a simple filter and a risc-v disassemble -b test that loads fdis with the simple filter
  • Added 2 lines of release notes to llvm/docs/ReleaseNotes.md
  • Changed filter_disam.py to check for filter_program non-0 return code and print a warning

It also changed the commit message to emphasize changing disassemble -b format

LLDB uses the LLVM disassembler to determine the size of instructions and
to do the actual disassembly. Currently, if the LLVM disassembler can't
disassemble an instruction, LLDB will ignore the instruction size, assume
the instruction size is the minimum size for that device, print no useful
opcode, and print nothing for the instruction.

This patch changes this behavior to separate the instruction size and
"can't disassemble". If the LLVM disassembler knows the size, but can't
dissasemble the instruction, LLDB will use that size. It will print out
the opcode, and will print "<unknown>" for the instruction. This is much
more useful to both a user and a script.

The impetus behind this change is to clean up RISC-V disassembly when
the LLVM disassembler doesn't understand all of the instructions.
RISC-V supports proprietary extensions, where the TD files don't know
about certain instructions, and the disassembler can't disassemble them.
Internal users want to be able to disassemble these instructions.

With llvm-objdump, the solution is to pipe the output of the disassembly
through a filter program. This patch modifies LLDB's disassembly to look
more like llvm-objdump's, and includes an example python script that adds
a command "fdis" that will disassemble, then pipe the output through a
specified filter program. This has been tested with crustfilt, a sample
filter located at https://github.com/quic/crustfilt .

Changes in this PR:
- Decouple "can't disassemble" with "instruction size".
  DisassemblerLLVMC::MCDisasmInstance::GetMCInst now returns a bool for
    valid disassembly, and has the size as an out paramter.
  Use the size even if the disassembly is invalid.
  Disassemble if disassemby is valid.

- Always print out the opcode when -b is specified.
  Previously it wouldn't print out the opcode if it couldn't disassemble.

- Print out RISC-V opcodes the way llvm-objdump does.
  Add DumpRISCV method based on RISC-V pretty printer in llvm-objdump.cpp.

- Print <unknown> for instructions that can't be disassembled, matching
  llvm-objdump, instead of printing nothing.

- Update max riscv32 and riscv64 instruction size to 8.

- Add example "fdis" command script.

Change-Id: Ie5a359d9e87a12dde79a8b5c9c7a146440a550c5
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

7 participants