* [PATCH v8 01/15] perf annotate-data: Extract invalidate_reg_state() as a common helper
2026-10-20 13:44 [PATCH v8 00/15] perf annotate arm64: Support instruction tracking for data type profiling Tengda Wu
@ 2026-10-20 13:44 ` Tengda Wu
2026-10-20 13:57 ` sashiko-bot
2026-10-20 13:44 ` [PATCH v8 02/15] perf annotate-arm64: Enable instruction tracking support Tengda Wu
` (14 subsequent siblings)
15 siblings, 1 reply; 35+ messages in thread
From: Tengda Wu @ 2026-10-20 13:44 UTC (permalink / raw)
To: Namhyung Kim, james.clark, xueshuai, Arnaldo Carvalho de Melo
Cc: Peter Zijlstra, leo.yan, Li Huafei, Ian Rogers, Kim Phillips,
Mark Rutland, Ingo Molnar, Bill Wendling, Nick Desaulniers,
Alexander Shishkin, Adrian Hunter, Zecheng Li, linux-perf-users,
linux-kernel, llvm, Tengda Wu
The invalidate_reg_state() function is currently static and only used
within the x86 data type profiling implementation. To prepare for adding
arm64 instruction tracking support, extract it as a common helper that
can be shared across architectures.
No functional change intended.
Reviewed-by: Shuai Xue <xueshuai@linux.alibaba.com>
Reviewed-by: Ian Rogers <irogers@google.com>
Reviewed-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Tengda Wu <wutengda@huaweicloud.com>
---
tools/perf/util/annotate-arch/annotate-x86.c | 9 ---------
tools/perf/util/annotate-data.c | 9 +++++++++
tools/perf/util/annotate-data.h | 1 +
3 files changed, 10 insertions(+), 9 deletions(-)
diff --git a/tools/perf/util/annotate-arch/annotate-x86.c b/tools/perf/util/annotate-arch/annotate-x86.c
index 1acf31a2c759..aa381d25a63b 100644
--- a/tools/perf/util/annotate-arch/annotate-x86.c
+++ b/tools/perf/util/annotate-arch/annotate-x86.c
@@ -207,15 +207,6 @@ static int x86__cpuid_parse(struct arch *arch, const char *cpuid)
}
#ifdef HAVE_LIBDW_SUPPORT
-static void invalidate_reg_state(struct type_state_reg *reg)
-{
- reg->kind = TSR_KIND_INVALID;
- reg->ok = false;
- reg->lifetime_active = false;
- reg->lifetime_end = 0;
- reg->copied_from = -1;
-}
-
static void update_insn_state_x86(struct type_state *state,
struct data_loc_info *dloc, Dwarf_Die *cu_die,
struct disasm_line *dl)
diff --git a/tools/perf/util/annotate-data.c b/tools/perf/util/annotate-data.c
index 19a6ecd67f28..32af1be4e451 100644
--- a/tools/perf/util/annotate-data.c
+++ b/tools/perf/util/annotate-data.c
@@ -748,6 +748,15 @@ struct type_state_stack *findnew_stack_state(struct type_state *state,
return stack;
}
+void invalidate_reg_state(struct type_state_reg *reg)
+{
+ reg->kind = TSR_KIND_INVALID;
+ reg->ok = false;
+ reg->lifetime_active = false;
+ reg->lifetime_end = 0;
+ reg->copied_from = -1;
+}
+
/* Maintain a cache for quick global variable lookup */
struct global_var_entry {
struct rb_node node;
diff --git a/tools/perf/util/annotate-data.h b/tools/perf/util/annotate-data.h
index bbf4fd35c1d7..d0dc056fb13a 100644
--- a/tools/perf/util/annotate-data.h
+++ b/tools/perf/util/annotate-data.h
@@ -267,6 +267,7 @@ void set_stack_state(struct type_state_stack *stack, int offset, u8 kind,
Dwarf_Die *type_die, int ptr_offset);
struct type_state_stack *find_stack_state(struct type_state *state,
int offset);
+void invalidate_reg_state(struct type_state_reg *reg);
bool get_global_var_type(Dwarf_Die *cu_die, struct data_loc_info *dloc,
u64 ip, u64 var_addr, int *var_offset,
Dwarf_Die *type_die);
--
2.34.1
^ permalink raw reply related [flat|nested] 35+ messages in thread* [PATCH v8 02/15] perf annotate-arm64: Enable instruction tracking support
2026-10-20 13:44 [PATCH v8 00/15] perf annotate arm64: Support instruction tracking for data type profiling Tengda Wu
2026-10-20 13:44 ` [PATCH v8 01/15] perf annotate-data: Extract invalidate_reg_state() as a common helper Tengda Wu
@ 2026-10-20 13:44 ` Tengda Wu
2026-10-20 14:05 ` sashiko-bot
2026-10-20 13:44 ` [PATCH v8 03/15] perf annotate-data: Add arch_get_reg_offset helper Tengda Wu
` (13 subsequent siblings)
15 siblings, 1 reply; 35+ messages in thread
From: Tengda Wu @ 2026-10-20 13:44 UTC (permalink / raw)
To: Namhyung Kim, james.clark, xueshuai, Arnaldo Carvalho de Melo
Cc: Peter Zijlstra, leo.yan, Li Huafei, Ian Rogers, Kim Phillips,
Mark Rutland, Ingo Molnar, Bill Wendling, Nick Desaulniers,
Alexander Shishkin, Adrian Hunter, Zecheng Li, linux-perf-users,
linux-kernel, llvm, Tengda Wu
Enable basic instruction tracking for arm64 by implementing three
essential functions in the find_data_type_block() call path:
find_data_type_block
-> arch_supports_insn_tracking (1)
-> find_data_type_insn
-> init_type_state (2)
-> update_var_state
-> update_insn_state (3)
Changes:
* arch_supports_insn_tracking(): add arm64 to the list of supported
architectures, allowing find_data_type_block() to proceed with data
type analysis.
* init_type_state(): correctly identify ret_reg, stack_reg, and
caller-saved registers for arm64 during type state initialization.
* update_insn_state(): add the update_insn_state_arm64() callback with
conservative register invalidation for call instructions and those with
destination register(s), preventing stale type propagation.
For now the invalidation path does not treat special instructions
individually; doing so for every such instruction up front would be
costly. A TODO is therefore left in invalidate_unhandled_insn_regs()
marking where per-instruction invalidation handling is to be extended
in future patches.
With these changes, arm64 gains support for basic variable type
inference during instruction tracking.
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Li Huafei <lihuafei1@huawei.com>
Signed-off-by: Tengda Wu <wutengda@huaweicloud.com>
---
.../perf/util/annotate-arch/annotate-arm64.c | 87 +++++++++++++++++++
tools/perf/util/annotate-data.c | 15 +++-
2 files changed, 101 insertions(+), 1 deletion(-)
diff --git a/tools/perf/util/annotate-arch/annotate-arm64.c b/tools/perf/util/annotate-arch/annotate-arm64.c
index 6549535961a9..d591d556ad40 100644
--- a/tools/perf/util/annotate-arch/annotate-arm64.c
+++ b/tools/perf/util/annotate-arch/annotate-arm64.c
@@ -9,6 +9,10 @@
#include <regex.h>
#include "../annotate.h"
#include "../disasm.h"
+#include "../annotate-data.h"
+#include "../debug.h"
+#include "../map.h"
+#include "../symbol.h"
struct arch_arm64 {
struct arch arch;
@@ -448,6 +452,86 @@ static void extract_op_location_arm64(const struct arch *arch,
}
}
+#ifdef HAVE_LIBDW_SUPPORT
+/* Check if the instruction is read-only (does not modify register state). */
+static bool is_readonly_insn(const char *name)
+{
+ return !strncmp(name, "cb", 2) || !strncmp(name, "tb", 2) ||
+ !strcmp(name, "tst") || !strcmp(name, "teq") ||
+ !strcmp(name, "cmp") || !strcmp(name, "cmn") ||
+ !strcmp(name, "ccmp") || !strcmp(name, "ccmn");
+}
+
+static void update_call_insn_state(struct type_state *state,
+ struct data_loc_info *dloc,
+ struct disasm_line *dl)
+{
+ struct symbol *func = dl->ops.target.sym;
+ const char *call_name;
+ u64 call_addr;
+ u32 insn_offset = dl->al.offset;
+
+ call_name = func ? func->name : dl->ops.target.name;
+ pr_debug_dtp("call [%x] %s\n", insn_offset, call_name ?: "<unknown>");
+
+ /* Invalidate caller-saved registers after call */
+ call_addr = map__rip_2objdump(dloc->ms->map,
+ dloc->ms->sym->start + dl->al.offset);
+ for (unsigned int i = 0; i < ARRAY_SIZE(state->regs); i++) {
+ struct type_state_reg *reg = &state->regs[i];
+
+ if (!reg->caller_saved)
+ continue;
+ /* Keep register valid within DWARF location lifetime */
+ if (reg->lifetime_active && call_addr < reg->lifetime_end)
+ continue;
+ invalidate_reg_state(reg);
+ }
+}
+
+/* Invalidate registers explicitly written by an unhandled instruction. */
+static void invalidate_unhandled_insn_regs(struct type_state *state,
+ struct disasm_line *dl,
+ struct annotated_op_loc *dst)
+{
+ u32 insn_offset = dl->al.offset;
+
+ /* Invalidate destination registers */
+ if (has_reg_type(state, dst->reg1) && !dst->mem_ref) {
+ pr_debug_dtp("%s [%x] invalidate reg%d",
+ dl->ins.name, insn_offset, dst->reg1);
+ invalidate_reg_state(&state->regs[dst->reg1]);
+
+ if (dst->multi_regs && has_reg_type(state, dst->reg2)) {
+ pr_debug_dtp(" and reg%d", dst->reg2);
+ invalidate_reg_state(&state->regs[dst->reg2]);
+ }
+ pr_debug_dtp("\n");
+ }
+
+ /* TODO: Extend invalidation support to more special instructions. */
+}
+
+static void update_insn_state_arm64(struct type_state *state,
+ struct data_loc_info *dloc, Dwarf_Die *cu_die __maybe_unused,
+ struct disasm_line *dl)
+{
+ struct annotated_insn_loc loc;
+ struct annotated_op_loc *dst = &loc.ops[INSN_OP_TARGET];
+
+ if (is_readonly_insn(dl->ins.name))
+ return;
+
+ if (annotate_get_insn_location(dloc->arch, dl, &loc) < 0)
+ return;
+
+ if (ins__is_call(&dl->ins))
+ update_call_insn_state(state, dloc, dl);
+ else
+ invalidate_unhandled_insn_regs(state, dl, dst);
+}
+#endif
+
const struct arch *arch__new_arm64(const struct e_machine_and_e_flags *id,
const char *cpuid __maybe_unused)
{
@@ -467,6 +551,9 @@ const struct arch *arch__new_arm64(const struct e_machine_and_e_flags *id,
arch->objdump.imm_char = '#';
arch->associate_instruction_ops = arm64__associate_instruction_ops;
arch->extract_op_location = extract_op_location_arm64;
+#ifdef HAVE_LIBDW_SUPPORT
+ arch->update_insn_state = update_insn_state_arm64;
+#endif
/* bl, blr */
err = regcomp(&arm->call_insn, "^blr?$", REG_EXTENDED);
diff --git a/tools/perf/util/annotate-data.c b/tools/perf/util/annotate-data.c
index 32af1be4e451..398795ba3694 100644
--- a/tools/perf/util/annotate-data.c
+++ b/tools/perf/util/annotate-data.c
@@ -29,6 +29,7 @@
/* register number of the stack pointer */
#define X86_REG_SP 7
+#define ARM64_REG_SP 31
static void delete_var_types(struct die_var_type *var_types);
@@ -179,6 +180,17 @@ static void init_type_state(struct type_state *state, const struct arch *arch)
state->regs[11].caller_saved = true;
state->ret_reg = 0;
state->stack_reg = X86_REG_SP;
+ } else if (arch__is_arm64(arch)) {
+ /*
+ * Mark x0..x18 as caller-saved. x30 (LR) is intentionally
+ * omitted from the caller_saved set: it is clobbered by
+ * calls, but holds only the return address and is not used
+ * to carry data type information.
+ */
+ for (int i = 0; i < 19; i++)
+ state->regs[i].caller_saved = true;
+ state->ret_reg = 0;
+ state->stack_reg = ARM64_REG_SP;
}
}
@@ -1543,7 +1555,8 @@ static enum type_match_result find_data_type_insn(struct data_loc_info *dloc,
static int arch_supports_insn_tracking(struct data_loc_info *dloc)
{
- if ((arch__is_x86(dloc->arch)) || (arch__is_powerpc(dloc->arch)))
+ if (arch__is_x86(dloc->arch) || arch__is_powerpc(dloc->arch) ||
+ arch__is_arm64(dloc->arch))
return 1;
return 0;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 35+ messages in thread* [PATCH v8 03/15] perf annotate-data: Add arch_get_reg_offset helper
2026-10-20 13:44 [PATCH v8 00/15] perf annotate arm64: Support instruction tracking for data type profiling Tengda Wu
2026-10-20 13:44 ` [PATCH v8 01/15] perf annotate-data: Extract invalidate_reg_state() as a common helper Tengda Wu
2026-10-20 13:44 ` [PATCH v8 02/15] perf annotate-arm64: Enable instruction tracking support Tengda Wu
@ 2026-10-20 13:44 ` Tengda Wu
2026-10-20 14:13 ` sashiko-bot
2026-10-20 13:45 ` [PATCH v8 04/15] perf annotate-arm64: Track return type after call instructions Tengda Wu
` (12 subsequent siblings)
15 siblings, 1 reply; 35+ messages in thread
From: Tengda Wu @ 2026-10-20 13:44 UTC (permalink / raw)
To: Namhyung Kim, james.clark, xueshuai, Arnaldo Carvalho de Melo
Cc: Peter Zijlstra, leo.yan, Li Huafei, Ian Rogers, Kim Phillips,
Mark Rutland, Ingo Molnar, Bill Wendling, Nick Desaulniers,
Alexander Shishkin, Adrian Hunter, Zecheng Li, linux-perf-users,
linux-kernel, llvm, Tengda Wu
Add a helper to compute the effective offset from a base register
for instruction operands. Currently handles arm64 addressing modes
including post-indexed, single-register, SIB-style indexed with
shift/extension, and constant-offset register pairs.
Fallback to instruction's raw offset for other architectures.
Reviewed-by: Ian Rogers <irogers@google.com>
Reviewed-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Tengda Wu <wutengda@huaweicloud.com>
---
tools/perf/util/annotate-data.c | 115 ++++++++++++++++++++++++++------
tools/perf/util/annotate-data.h | 4 +-
2 files changed, 98 insertions(+), 21 deletions(-)
diff --git a/tools/perf/util/annotate-data.c b/tools/perf/util/annotate-data.c
index 398795ba3694..24d82739b2ec 100644
--- a/tools/perf/util/annotate-data.c
+++ b/tools/perf/util/annotate-data.c
@@ -1241,6 +1241,74 @@ static void setup_stack_canary(struct data_loc_info *dloc)
}
}
+int arch_get_reg_offset(const struct arch *arch, struct annotated_op_loc *op_loc,
+ int breg, struct type_state *state, bool apply_index,
+ int *offset)
+{
+ if (arch__is_arm64(arch)) {
+ int reg2;
+
+ /* Post-indexed addressing: offset is 0 when not applying index */
+ if (op_loc->addr_mode == PERF_AAM_POST_INDEX && !apply_index) {
+ *offset = 0;
+ return 0;
+ }
+
+ /* Single-register addressing: return the stored offset directly */
+ if (!op_loc->multi_regs) {
+ *offset = op_loc->offset;
+ return 0;
+ }
+
+ /*
+ * SIB (Scale-Index-Base) style indexed addressing, e.g.:
+ * Array element load: ldr dst, [base, index, lsl #3]
+ * Array element load: ldr dst, [base, index, uxtw #3]
+ * Array address calc: add dst, base, index lsl #3
+ *
+ * The index reg only computes element offset without modifying
+ * the underlying data type; the dst type is inherited from base.
+ * Therefore, the base reg offset can be treated as 0.
+ */
+ if (op_loc->extend_type || op_loc->shift_type) {
+ /* A memory reference implies breg is a pointer. */
+ if (op_loc->mem_ref) {
+ *offset = 0;
+ return 0;
+ }
+ /*
+ * Otherwise, require breg to be a known pointer to avoid
+ * treating integer arithmetic as indexed address calculation.
+ */
+ if (has_reg_type(state, breg) && state->regs[breg].ok &&
+ (state->regs[breg].kind == TSR_KIND_POINTER ||
+ (state->regs[breg].kind == TSR_KIND_TYPE &&
+ dwarf_tag(&state->regs[breg].type) == DW_TAG_pointer_type))) {
+ *offset = 0;
+ return 0;
+ }
+ return -1;
+ }
+
+ /*
+ * For register-based addressing without shift/extension,
+ * reg2 may be a constant offset. Use its value as the offset
+ * from the base register.
+ */
+ reg2 = op_loc->reg1 == breg ? op_loc->reg2 : op_loc->reg1;
+ if (has_reg_type(state, reg2) && state->regs[reg2].ok &&
+ state->regs[reg2].kind == TSR_KIND_CONST) {
+ *offset = (s64)state->regs[reg2].imm_value;
+ return 0;
+ }
+
+ return -1;
+ }
+
+ *offset = op_loc->offset;
+ return 0;
+}
+
/*
* It's at the target address, check if it has a matching type.
* It returns PERF_TMR_BAIL_OUT when it looks up per-cpu variables which
@@ -1254,18 +1322,25 @@ static enum type_match_result check_matching_type(struct type_state *state,
{
u32 insn_offset = dl->al.offset;
int reg = dloc->op->reg1;
- int offset = dloc->op->offset;
- const char *offset_sign = "";
+ int offset;
+ const char *offset_sign;
bool retry = true;
- if (offset < 0) {
- offset = -offset;
- offset_sign = "-";
+again:
+ if (arch_get_reg_offset(dloc->arch, dloc->op, reg, state, false, &offset)) {
+ /*
+ * Fall back to the instruction's offset. This prevents the
+ * register type of the instruction from being completely lost.
+ * Compared to dropping this type inference entirely, providing
+ * a rough type hint is likely more useful.
+ */
+ offset = dloc->op->offset;
}
-again:
+ offset_sign = offset < 0 ? "-" : "";
+
pr_debug_dtp("chk [%x] reg%d offset=%s%#x ok=%d kind=%d ",
- insn_offset, reg, offset_sign, offset,
+ insn_offset, reg, offset_sign, abs(offset),
state->regs[reg].ok, state->regs[reg].kind);
if (!state->regs[reg].ok)
@@ -1288,7 +1363,7 @@ static enum type_match_result check_matching_type(struct type_state *state,
*/
ptr_type = die_get_pointer_type(&state->regs[reg].type, &ptr_die);
if (!ptr_type) {
- if (dloc->op->offset < 0 && reg != state->stack_reg)
+ if (offset < 0 && reg != state->stack_reg)
goto check_kernel;
return PERF_TMR_NO_POINTER;
@@ -1298,7 +1373,7 @@ static enum type_match_result check_matching_type(struct type_state *state,
if (__die_get_real_type(ptr_type, type_die) == NULL)
return PERF_TMR_NO_POINTER;
- dloc->type_offset = dloc->op->offset + state->regs[reg].offset;
+ dloc->type_offset = offset + state->regs[reg].offset;
if (dwarf_tag(type_die) == DW_TAG_typedef)
die_get_real_type(type_die, &sized_type);
@@ -1322,7 +1397,7 @@ static enum type_match_result check_matching_type(struct type_state *state,
*/
*type_die = state->regs[reg].type;
- dloc->type_offset = dloc->op->offset + state->regs[reg].offset;
+ dloc->type_offset = offset + state->regs[reg].offset;
return check_type_offset(type_die, dloc->type_offset);
}
@@ -1336,7 +1411,7 @@ static enum type_match_result check_matching_type(struct type_state *state,
*/
*type_die = state->regs[reg].type;
- dloc->type_offset = dloc->op->offset;
+ dloc->type_offset = offset;
if (check_type_offset(type_die, dloc->type_offset) != PERF_TMR_OK)
return PERF_TMR_BAIL_OUT;
@@ -1358,7 +1433,7 @@ static enum type_match_result check_matching_type(struct type_state *state,
}
if (state->regs[reg].kind == TSR_KIND_PERCPU_BASE) {
- u64 var_addr = dloc->op->offset;
+ u64 var_addr = (s64) offset;
int var_offset;
pr_debug_dtp("percpu var");
@@ -1385,7 +1460,7 @@ static enum type_match_result check_matching_type(struct type_state *state,
if (state->regs[reg].kind == TSR_KIND_CONST &&
dso__kernel(map__dso(dloc->ms->map))) {
- if (dloc->op->offset < 0 && reg != state->stack_reg && reg != dloc->fbreg)
+ if (offset < 0 && reg != state->stack_reg && reg != dloc->fbreg)
goto check_kernel;
}
check_non_register:
@@ -1394,7 +1469,7 @@ static enum type_match_result check_matching_type(struct type_state *state,
pr_debug_dtp("%s", reg == dloc->fbreg ? "fbreg" : "stack");
- stack = find_stack_state(state, dloc->type_offset);
+ stack = find_stack_state(state, offset);
if (stack == NULL) {
if (retry) {
pr_debug_dtp(" : retry\n");
@@ -1417,7 +1492,7 @@ static enum type_match_result check_matching_type(struct type_state *state,
*type_die = stack->type;
/* Update the type offset from the start of slot */
- dloc->type_offset -= stack->offset;
+ dloc->type_offset = offset - stack->offset;
return PERF_TMR_OK;
}
@@ -1435,7 +1510,7 @@ static enum type_match_result check_matching_type(struct type_state *state,
if (reg != fbreg)
return PERF_TMR_NO_TYPE;
- stack = find_stack_state(state, dloc->type_offset - fboff);
+ stack = find_stack_state(state, offset - fboff);
if (stack == NULL) {
if (retry) {
pr_debug_dtp(" : retry\n");
@@ -1458,7 +1533,7 @@ static enum type_match_result check_matching_type(struct type_state *state,
*type_die = stack->type;
/* Update the type offset from the start of slot */
- dloc->type_offset -= fboff + stack->offset;
+ dloc->type_offset = offset - fboff - stack->offset;
return PERF_TMR_OK;
}
@@ -1472,7 +1547,7 @@ static enum type_match_result check_matching_type(struct type_state *state,
arch__is_x86(dloc->arch)) {
pr_debug_dtp("this-cpu var");
- addr = dloc->op->offset;
+ addr = (s64) offset;
if (get_global_var_type(cu_die, dloc, dloc->ip, addr,
&offset, type_die)) {
@@ -1483,8 +1558,8 @@ static enum type_match_result check_matching_type(struct type_state *state,
}
/* Access to global variable like "-0x7dcf0500(,%rdx,8)" */
- if (dloc->op->offset < 0 && reg != state->stack_reg) {
- addr = (s64) dloc->op->offset;
+ if (offset < 0 && reg != state->stack_reg) {
+ addr = (s64) offset;
if (get_global_var_type(cu_die, dloc, dloc->ip, addr,
&offset, type_die)) {
diff --git a/tools/perf/util/annotate-data.h b/tools/perf/util/annotate-data.h
index d0dc056fb13a..453efdf6afa6 100644
--- a/tools/perf/util/annotate-data.h
+++ b/tools/perf/util/annotate-data.h
@@ -274,7 +274,9 @@ bool get_global_var_type(Dwarf_Die *cu_die, struct data_loc_info *dloc,
bool get_global_var_info(struct data_loc_info *dloc, u64 addr,
const char **var_name, int *var_offset);
void pr_debug_type_name(Dwarf_Die *die, enum type_state_kind kind);
-
+int arch_get_reg_offset(const struct arch *arch, struct annotated_op_loc *op_loc,
+ int breg, struct type_state *state, bool apply_index,
+ int *offset);
#else /* HAVE_LIBDW_SUPPORT */
static inline struct annotated_data_type *
--
2.34.1
^ permalink raw reply related [flat|nested] 35+ messages in thread* [PATCH v8 04/15] perf annotate-arm64: Track return type after call instructions
2026-10-20 13:44 [PATCH v8 00/15] perf annotate arm64: Support instruction tracking for data type profiling Tengda Wu
` (2 preceding siblings ...)
2026-10-20 13:44 ` [PATCH v8 03/15] perf annotate-data: Add arch_get_reg_offset helper Tengda Wu
@ 2026-10-20 13:45 ` Tengda Wu
2026-10-20 14:15 ` sashiko-bot
2026-10-20 13:45 ` [PATCH v8 05/15] perf annotate-arm64: Support load instruction tracking Tengda Wu
` (11 subsequent siblings)
15 siblings, 1 reply; 35+ messages in thread
From: Tengda Wu @ 2026-10-20 13:45 UTC (permalink / raw)
To: Namhyung Kim, james.clark, xueshuai, Arnaldo Carvalho de Melo
Cc: Peter Zijlstra, leo.yan, Li Huafei, Ian Rogers, Kim Phillips,
Mark Rutland, Ingo Molnar, Bill Wendling, Nick Desaulniers,
Alexander Shishkin, Adrian Hunter, Zecheng Li, linux-perf-users,
linux-kernel, llvm, Tengda Wu
Enable data type profiling to track function return values in arm64
annotations by looking up the DWARF return type of called functions.
Reviewed-by: Ian Rogers <irogers@google.com>
Reviewed-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Tengda Wu <wutengda@huaweicloud.com>
---
.../perf/util/annotate-arch/annotate-arm64.c | 21 ++++++++++++++++---
1 file changed, 18 insertions(+), 3 deletions(-)
diff --git a/tools/perf/util/annotate-arch/annotate-arm64.c b/tools/perf/util/annotate-arch/annotate-arm64.c
index d591d556ad40..c4cc8bca85cc 100644
--- a/tools/perf/util/annotate-arch/annotate-arm64.c
+++ b/tools/perf/util/annotate-arch/annotate-arm64.c
@@ -463,12 +463,14 @@ static bool is_readonly_insn(const char *name)
}
static void update_call_insn_state(struct type_state *state,
- struct data_loc_info *dloc,
+ struct data_loc_info *dloc, Dwarf_Die *cu_die,
struct disasm_line *dl)
{
struct symbol *func = dl->ops.target.sym;
const char *call_name;
u64 call_addr;
+ struct type_state_reg *tsr;
+ Dwarf_Die type_die;
u32 insn_offset = dl->al.offset;
call_name = func ? func->name : dl->ops.target.name;
@@ -487,6 +489,19 @@ static void update_call_insn_state(struct type_state *state,
continue;
invalidate_reg_state(reg);
}
+
+ /* Update register with the return type (if any) */
+ if (call_name && die_find_func_rettype(cu_die, call_name, &type_die)) {
+ tsr = &state->regs[state->ret_reg];
+ invalidate_reg_state(tsr);
+ tsr->type = type_die;
+ tsr->kind = TSR_KIND_TYPE;
+ tsr->offset = 0;
+ tsr->ok = true;
+
+ pr_debug_dtp("call [%x] return -> reg%d", insn_offset, state->ret_reg);
+ pr_debug_type_name(&type_die, tsr->kind);
+ }
}
/* Invalidate registers explicitly written by an unhandled instruction. */
@@ -513,7 +528,7 @@ static void invalidate_unhandled_insn_regs(struct type_state *state,
}
static void update_insn_state_arm64(struct type_state *state,
- struct data_loc_info *dloc, Dwarf_Die *cu_die __maybe_unused,
+ struct data_loc_info *dloc, Dwarf_Die *cu_die,
struct disasm_line *dl)
{
struct annotated_insn_loc loc;
@@ -526,7 +541,7 @@ static void update_insn_state_arm64(struct type_state *state,
return;
if (ins__is_call(&dl->ins))
- update_call_insn_state(state, dloc, dl);
+ update_call_insn_state(state, dloc, cu_die, dl);
else
invalidate_unhandled_insn_regs(state, dl, dst);
}
--
2.34.1
^ permalink raw reply related [flat|nested] 35+ messages in thread* [PATCH v8 05/15] perf annotate-arm64: Support load instruction tracking
2026-10-20 13:44 [PATCH v8 00/15] perf annotate arm64: Support instruction tracking for data type profiling Tengda Wu
` (3 preceding siblings ...)
2026-10-20 13:45 ` [PATCH v8 04/15] perf annotate-arm64: Track return type after call instructions Tengda Wu
@ 2026-10-20 13:45 ` Tengda Wu
2026-10-20 14:36 ` sashiko-bot
2026-10-20 13:45 ` [PATCH v8 06/15] perf annotate-arm64: Support store " Tengda Wu
` (10 subsequent siblings)
15 siblings, 1 reply; 35+ messages in thread
From: Tengda Wu @ 2026-10-20 13:45 UTC (permalink / raw)
To: Namhyung Kim, james.clark, xueshuai, Arnaldo Carvalho de Melo
Cc: Peter Zijlstra, leo.yan, Li Huafei, Ian Rogers, Kim Phillips,
Mark Rutland, Ingo Molnar, Bill Wendling, Nick Desaulniers,
Alexander Shishkin, Adrian Hunter, Zecheng Li, linux-perf-users,
linux-kernel, llvm, Tengda Wu
Extend update_insn_state_arm64() to handle load instructions, tracking
register state changes when data is loaded from memory to registers.
Two main categories are considered: standard load (e.g, ldr variants)
and load pair (ldp), for example:
ldr dst, [src, #imm]
ldp dst1, dst2, [src, #imm]
For data type propagation, a load pair can be treated as two standard
loads combined, first loading dst1 and then dst2. The difference is
that when loading dst2, an additional memory spacing 'mem_spacing' after
the first load must be added. This mem_spacing can be derived from the
instruction mnemonic and the size of the dst register. Each load operation
is handled by introducing propagate_load_reg_state().
When processing a load pair, the case where dst and src registers are
the same (e.g., ldp x0, x1, [x0]) also needs to be considered. Therefore,
before propagating data types, a snapshot of the src register's state
must be saved and then passed to propagate_load_reg_state().
Finally, handle the side effects of pre-index and post-index addressing
via adjust_reg_index_state().
A real-world example is shown below:
ffff80008011f5b0 <pick_task_stop>:
ffff80008011f5b8: ldr x0, [x0, #2712] // x0: struct rq* -> task_struct*
* ffff80008011f5c0: ldr w1, [x0, #104]
Before this commit, the type of x0 was incorrectly inferred as 'struct rq':
find data type for 0x68(reg0) at pick_task_stop+0x10
var [8] reg0 offset 0 type='struct rq*'
chk [10] reg0 offset=0x68 ok=1 kind=1 (struct rq*) : Good!
final result: type='struct rq'
After this commit, the type of x0 is correctly inferred as 'struct task_struct':
find data type for 0x68(reg0) at pick_task_stop+0x10
var [8] reg0 offset 0 type='struct rq*'
ldr [8] 0xa98(reg0) -> reg0 type='struct task_struct*'
chk [10] reg0 offset=0x68 ok=1 kind=1 (struct task_struct*) : Good!
final result: type='struct task_struct'
Reviewed-by: Ian Rogers <irogers@google.com>
Reviewed-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Li Huafei <lihuafei1@huawei.com>
Signed-off-by: Tengda Wu <wutengda@huaweicloud.com>
---
.../perf/util/annotate-arch/annotate-arm64.c | 204 ++++++++++++++++++
1 file changed, 204 insertions(+)
diff --git a/tools/perf/util/annotate-arch/annotate-arm64.c b/tools/perf/util/annotate-arch/annotate-arm64.c
index c4cc8bca85cc..0b5d1abbc575 100644
--- a/tools/perf/util/annotate-arch/annotate-arm64.c
+++ b/tools/perf/util/annotate-arch/annotate-arm64.c
@@ -527,11 +527,212 @@ static void invalidate_unhandled_insn_regs(struct type_state *state,
/* TODO: Extend invalidation support to more special instructions. */
}
+static int arm64__reg_size(const char *reg)
+{
+ if (!reg || !*reg || !arm64__is_reg(reg))
+ return -1;
+
+ if (reg[0] == 'w')
+ return 4;
+
+ if (reg[0] == 'x' || !strncmp(reg, "sp", 2))
+ return 8;
+
+ return -1;
+}
+
+/* Apply addressing mode (pre-index, post-index) to register state */
+static void adjust_reg_index_state(struct type_state *state,
+ struct data_loc_info *dloc,
+ struct disasm_line *dl,
+ struct annotated_op_loc *op_loc)
+{
+ struct type_state_reg *tsr;
+ int reg = op_loc->reg1;
+ int offset;
+
+ if (op_loc->addr_mode != PERF_AAM_PRE_INDEX &&
+ op_loc->addr_mode != PERF_AAM_POST_INDEX)
+ return;
+
+ if (!has_reg_type(state, reg) || !state->regs[reg].ok)
+ return;
+
+ tsr = &state->regs[reg];
+ tsr->copied_from = -1;
+
+ if (arch_get_reg_offset(dloc->arch, op_loc, reg, state, true, &offset)) {
+ invalidate_reg_state(tsr);
+ return;
+ }
+
+ tsr->offset += offset;
+
+ pr_debug_dtp("%s [%x] %s-index %#x(reg%d) -> reg%d", dl->ins.name,
+ (u32) dl->al.offset, op_loc->addr_mode == PERF_AAM_PRE_INDEX ?
+ "pre" : "post", offset, reg, reg);
+ pr_debug_type_name(&tsr->type, tsr->kind);
+}
+
+/*
+ * Match standard load variants (ldr, ldur, ldar, ldp) that follow
+ * straightforward load semantics: memory source on the right
+ * and target registers on the left (written). Excludes exclusive loads
+ * (ldxr, ldxp, etc.) and acquire/exclusive combination variants.
+ */
+static bool is_standard_load_insn(const char *name)
+{
+ return !strncmp(name, "ldr", 3) || /* ldr, ldrb, ldrh, ldrsb, ldrsh, ldrsw */
+ !strncmp(name, "ldur", 4) || /* ldur, ldurb, ldurh, ldursb, ldursh, ldursw */
+ !strncmp(name, "ldar", 4) || /* ldar, ldarb, ldarh */
+ !strncmp(name, "ldp", 3); /* ldp, ldpsw */
+}
+
+/*
+ * For load insns: propagate type from source reg state @src_states to @dreg.
+ *
+ * @mem_spacing accounts for the additional in-memory spacing between the two
+ * loads when handling multi-reg loads (e.g. the second target reg in 'ldp'),
+ * which is added to the reg offset.
+ */
+static int propagate_load_reg_state(struct type_state *state,
+ struct data_loc_info *dloc,
+ struct disasm_line *dl, int dreg,
+ struct annotated_op_loc *src,
+ struct type_state_reg **src_states,
+ int mem_spacing)
+{
+ struct type_state_reg *tsr;
+ struct type_state_reg *src_tsr = src_states[0];
+ Dwarf_Die type_die;
+ u32 insn_offset = dl->al.offset;
+ int sreg = src->reg1;
+ int reg_offset;
+
+ if (!has_reg_type(state, dreg))
+ return -1;
+
+ tsr = &state->regs[dreg];
+ tsr->copied_from = -1;
+ tsr->lifetime_active = false;
+ tsr->lifetime_end = 0;
+
+retry:
+ if (arch_get_reg_offset(dloc->arch, src, sreg, state, false, ®_offset))
+ goto load_non_regoff;
+
+ reg_offset += mem_spacing;
+
+ if (!src_tsr || !src_tsr->ok)
+ return -1;
+
+ /* Dereference the pointer if it has one */
+ if (src_tsr->kind == TSR_KIND_TYPE &&
+ die_deref_ptr_type(&src_tsr->type,
+ src_tsr->offset + reg_offset, &type_die)) {
+ tsr->type = type_die;
+ tsr->kind = TSR_KIND_TYPE;
+ tsr->offset = 0;
+ tsr->ok = true;
+
+ pr_debug_dtp("%s [%x] %#x(reg%d) -> reg%d",
+ dl->ins.name, insn_offset, reg_offset, sreg, dreg);
+ pr_debug_type_name(&tsr->type, tsr->kind);
+ return 0;
+ }
+
+ /* Handle dereference of TSR_KIND_POINTER registers */
+ if (src_tsr->kind == TSR_KIND_POINTER &&
+ die_get_member_type(&src_tsr->type,
+ src_tsr->offset + reg_offset, &type_die)) {
+ tsr->type = src_tsr->type;
+ tsr->kind = TSR_KIND_TYPE;
+ tsr->offset = src_tsr->offset + reg_offset;
+ tsr->imm_value = 0;
+ tsr->ok = true;
+
+ pr_debug_dtp("%s [%x] addr %#x(reg%d) -> reg%d",
+ dl->ins.name, insn_offset, reg_offset, sreg, dreg);
+ pr_debug_type_name(&tsr->type, tsr->kind);
+ return 0;
+ }
+
+load_non_regoff:
+ /* Try another register if any */
+ if (src->multi_regs && src->reg1 != src->reg2 && sreg != src->reg2 &&
+ !(src->extend_type || src->shift_type)) {
+ sreg = src->reg2;
+ src_tsr = src_states[1];
+ goto retry;
+ }
+
+ return -1;
+}
+
+static void update_load_insn_state(struct type_state *state,
+ struct data_loc_info *dloc,
+ struct disasm_line *dl,
+ struct annotated_op_loc *src,
+ struct annotated_op_loc *dst)
+{
+ struct type_state_reg snapshots[2];
+ struct type_state_reg *src_states[2] = {};
+ int mem_spacing = 0;
+
+ if (!src->mem_ref || /* exclude PC-relative loads */
+ !has_reg_type(state, src->reg1)) {
+ /* Invalidate tracked destination registers */
+ if (has_reg_type(state, dst->reg1))
+ invalidate_reg_state(&state->regs[dst->reg1]);
+ if (dst->multi_regs && has_reg_type(state, dst->reg2))
+ invalidate_reg_state(&state->regs[dst->reg2]);
+ goto out_adjust;
+ }
+
+ /*
+ * Snapshot source register states before updating destination registers.
+ * This preserves the original source state for aliased loads (e.g.,
+ * ldp x0, x1, [x0]), where updating the first destination may overwrite
+ * the source register.
+ */
+ snapshots[0] = state->regs[src->reg1];
+ src_states[0] = &snapshots[0];
+ if (src->multi_regs && has_reg_type(state, src->reg2)) {
+ snapshots[1] = state->regs[src->reg2];
+ src_states[1] = &snapshots[1];
+ }
+
+ /* Handle the first destination register */
+ if (has_reg_type(state, dst->reg1)) {
+ if (propagate_load_reg_state(state, dloc, dl, dst->reg1,
+ src, src_states, mem_spacing))
+ invalidate_reg_state(&state->regs[dst->reg1]);
+ }
+
+ if (!dst->multi_regs || !has_reg_type(state, dst->reg2))
+ goto out_adjust;
+
+ /* Handle the second destination register */
+ if (!strcmp(dl->ins.name, "ldpsw"))
+ mem_spacing = 4; /* ldpsw loads two 32-bit signed words (4-byte spacing) */
+ else
+ mem_spacing = arm64__reg_size(dl->ops.target.raw);
+
+ if (mem_spacing < 0 ||
+ propagate_load_reg_state(state, dloc, dl, dst->reg2,
+ src, src_states, mem_spacing))
+ invalidate_reg_state(&state->regs[dst->reg2]);
+
+out_adjust:
+ adjust_reg_index_state(state, dloc, dl, src);
+}
+
static void update_insn_state_arm64(struct type_state *state,
struct data_loc_info *dloc, Dwarf_Die *cu_die,
struct disasm_line *dl)
{
struct annotated_insn_loc loc;
+ struct annotated_op_loc *src = &loc.ops[INSN_OP_SOURCE];
struct annotated_op_loc *dst = &loc.ops[INSN_OP_TARGET];
if (is_readonly_insn(dl->ins.name))
@@ -542,6 +743,9 @@ static void update_insn_state_arm64(struct type_state *state,
if (ins__is_call(&dl->ins))
update_call_insn_state(state, dloc, cu_die, dl);
+ /* Memory to register transfers */
+ else if (is_standard_load_insn(dl->ins.name))
+ update_load_insn_state(state, dloc, dl, src, dst);
else
invalidate_unhandled_insn_regs(state, dl, dst);
}
--
2.34.1
^ permalink raw reply related [flat|nested] 35+ messages in thread* Re: [PATCH v8 05/15] perf annotate-arm64: Support load instruction tracking
2026-10-20 13:45 ` [PATCH v8 05/15] perf annotate-arm64: Support load instruction tracking Tengda Wu
@ 2026-10-20 14:36 ` sashiko-bot
2026-10-21 1:58 ` Tengda Wu
0 siblings, 1 reply; 35+ messages in thread
From: sashiko-bot @ 2026-10-20 14:36 UTC (permalink / raw)
To: Tengda Wu; +Cc: linux-perf-users
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [Medium] perf annotate-arm64: unused type_die in propagate_load_reg_state()
- [Medium] perf annotate-arm64: missing reg2 extraction in ldp when reg1 is xzr/wzr
--
commit d4331cee155820a433821da388de2a7297699e0e
Author: Tengda Wu <wutengda@huaweicloud.com>
perf annotate-arm64: Support load instruction tracking
This commit extends update_insn_state_arm64() to track register state
changes across standard load and load-pair instructions, including
pre-index and post-index addressing modes.
> diff --git a/tools/perf/util/annotate-arch/annotate-arm64.c b/tools/perf/util/annotate-arch/annotate-arm64.c
> index c4cc8bca85cc0..0b5d1abbc5755 100644
> --- a/tools/perf/util/annotate-arch/annotate-arm64.c
> +++ b/tools/perf/util/annotate-arch/annotate-arm64.c
> @@ -527,11 +527,212 @@ static void invalidate_unhandled_insn_regs(struct type_state *state,
> /* TODO: Extend invalidation support to more special instructions. */
> }
>
> +static int arm64__reg_size(const char *reg)
> +{
> + if (!reg || !*reg || !arm64__is_reg(reg))
> + return -1;
> +
> + if (reg[0] == 'w')
> + return 4;
> +
> + if (reg[0] == 'x' || !strncmp(reg, "sp", 2))
> + return 8;
> +
> + return -1;
> +}
[ ... ]
> +static int propagate_load_reg_state(struct type_state *state,
> + struct data_loc_info *dloc,
> + struct disasm_line *dl, int dreg,
> + struct annotated_op_loc *src,
> + struct type_state_reg **src_states,
> + int mem_spacing)
> +{
> + struct type_state_reg *tsr;
> + struct type_state_reg *src_tsr = src_states[0];
> + Dwarf_Die type_die;
> + u32 insn_offset = dl->al.offset;
> + int sreg = src->reg1;
> + int reg_offset;
> +
> + if (!has_reg_type(state, dreg))
> + return -1;
> +
> + tsr = &state->regs[dreg];
> + tsr->copied_from = -1;
> + tsr->lifetime_active = false;
> + tsr->lifetime_end = 0;
> +
> +retry:
> + if (arch_get_reg_offset(dloc->arch, src, sreg, state, false, ®_offset))
> + goto load_non_regoff;
> +
> + reg_offset += mem_spacing;
> +
> + if (!src_tsr || !src_tsr->ok)
> + return -1;
> +
> + /* Dereference the pointer if it has one */
> + if (src_tsr->kind == TSR_KIND_TYPE &&
> + die_deref_ptr_type(&src_tsr->type,
> + src_tsr->offset + reg_offset, &type_die)) {
> + tsr->type = type_die;
> + tsr->kind = TSR_KIND_TYPE;
> + tsr->offset = 0;
> + tsr->ok = true;
> +
> + pr_debug_dtp("%s [%x] %#x(reg%d) -> reg%d",
> + dl->ins.name, insn_offset, reg_offset, sreg, dreg);
> + pr_debug_type_name(&tsr->type, tsr->kind);
> + return 0;
> + }
> +
> + /* Handle dereference of TSR_KIND_POINTER registers */
> + if (src_tsr->kind == TSR_KIND_POINTER &&
> + die_get_member_type(&src_tsr->type,
> + src_tsr->offset + reg_offset, &type_die)) {
> + tsr->type = src_tsr->type;
> + tsr->kind = TSR_KIND_TYPE;
> + tsr->offset = src_tsr->offset + reg_offset;
[Severity: Medium]
Should tsr->type be assigned type_die and tsr->offset set to 0 here?
When DWARF describes a struct variable via a register-based memory
location (where var->is_reg_var_addr is true), update_var_state() sets
the base register to TSR_KIND_POINTER with reg->type set to the struct
DIE.
When a load instruction reads a member from that struct into dreg,
update_insn_state_arm64() -> update_load_insn_state() ->
propagate_load_reg_state() calls die_get_member_type() to resolve the
loaded member's type into type_die.
However, type_die is left unused, and tsr->type is set to src_tsr->type
(the outer struct DIE) with tsr->offset set to src_tsr->offset +
reg_offset and tsr->kind set to TSR_KIND_TYPE. When a subsequent
instruction dereferences dreg, check_matching_type() or
die_deref_ptr_type() inspects dreg->type, sees the outer struct type
instead of the member's pointer type, and fails with PERF_TMR_NO_POINTER.
> + tsr->imm_value = 0;
> + tsr->ok = true;
> +
> + pr_debug_dtp("%s [%x] addr %#x(reg%d) -> reg%d",
> + dl->ins.name, insn_offset, reg_offset, sreg, dreg);
> + pr_debug_type_name(&tsr->type, tsr->kind);
> + return 0;
> + }
> +
> +load_non_regoff:
> + /* Try another register if any */
> + if (src->multi_regs && src->reg1 != src->reg2 && sreg != src->reg2 &&
> + !(src->extend_type || src->shift_type)) {
> + sreg = src->reg2;
> + src_tsr = src_states[1];
> + goto retry;
> + }
> +
> + return -1;
> +}
> +
> +static void update_load_insn_state(struct type_state *state,
> + struct data_loc_info *dloc,
> + struct disasm_line *dl,
> + struct annotated_op_loc *src,
> + struct annotated_op_loc *dst)
> +{
> + struct type_state_reg snapshots[2];
> + struct type_state_reg *src_states[2] = {};
> + int mem_spacing = 0;
> +
> + if (!src->mem_ref || /* exclude PC-relative loads */
> + !has_reg_type(state, src->reg1)) {
> + /* Invalidate tracked destination registers */
> + if (has_reg_type(state, dst->reg1))
> + invalidate_reg_state(&state->regs[dst->reg1]);
> + if (dst->multi_regs && has_reg_type(state, dst->reg2))
> + invalidate_reg_state(&state->regs[dst->reg2]);
> + goto out_adjust;
> + }
> +
> + /*
> + * Snapshot source register states before updating destination registers.
> + * This preserves the original source state for aliased loads (e.g.,
> + * ldp x0, x1, [x0]), where updating the first destination may overwrite
> + * the source register.
> + */
> + snapshots[0] = state->regs[src->reg1];
> + src_states[0] = &snapshots[0];
> + if (src->multi_regs && has_reg_type(state, src->reg2)) {
> + snapshots[1] = state->regs[src->reg2];
> + src_states[1] = &snapshots[1];
> + }
> +
> + /* Handle the first destination register */
> + if (has_reg_type(state, dst->reg1)) {
> + if (propagate_load_reg_state(state, dloc, dl, dst->reg1,
> + src, src_states, mem_spacing))
> + invalidate_reg_state(&state->regs[dst->reg1]);
> + }
> +
> + if (!dst->multi_regs || !has_reg_type(state, dst->reg2))
> + goto out_adjust;
[Severity: Medium]
What happens here when an ldp instruction uses the zero register (xzr or
wzr) as its first destination operand, such as "ldp xzr, x19, [sp], #16"
or "ldp xzr, x1, [x0]"?
In update_load_insn_state(), dst->reg1 is guarded by has_reg_type(state,
dst->reg1) without returning early, and arm64__reg_size() recognizes
xzr/wzr via arm64__is_reg() so dst->reg2 can still be updated or
invalidated.
However, when update_insn_state_arm64() calls
annotate_get_insn_location() -> extract_op_location_arm64(),
arch__dwarf_regnum() returns -1 for xzr and wzr, and
extract_op_location_arm64() returns before parsing reg2:
tools/perf/util/annotate-arch/annotate-arm64.c:extract_op_location_arm64() {
...
/* Extract the primary register */
op_loc->reg1 = arch__dwarf_regnum(arch, s);
if (op_loc->reg1 == -1)
return;
s = next_operand_field(s);
if (s == NULL)
return;
/* Extract secondary register or immediate offset */
if (op_loc->multi_regs) {
op_loc->reg2 = arch__dwarf_regnum(arch, s);
...
}
Doesn't this leave dst->reg2 as -1, causing update_load_insn_state() (and
invalidate_unhandled_insn_regs()) to skip the second register instead of
propagating its type or invalidating its previous state?
> +
> + /* Handle the second destination register */
> + if (!strcmp(dl->ins.name, "ldpsw"))
> + mem_spacing = 4; /* ldpsw loads two 32-bit signed words (4-byte spacing) */
> + else
> + mem_spacing = arm64__reg_size(dl->ops.target.raw);
> +
> + if (mem_spacing < 0 ||
> + propagate_load_reg_state(state, dloc, dl, dst->reg2,
> + src, src_states, mem_spacing))
> + invalidate_reg_state(&state->regs[dst->reg2]);
> +
> +out_adjust:
> + adjust_reg_index_state(state, dloc, dl, src);
> +}
[ ... ]
>
--
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1792411435.git.wutengda@huaweicloud.com?part=5
^ permalink raw reply [flat|nested] 35+ messages in thread* Re: [PATCH v8 05/15] perf annotate-arm64: Support load instruction tracking
2026-10-20 14:36 ` sashiko-bot
@ 2026-10-21 1:58 ` Tengda Wu
0 siblings, 0 replies; 35+ messages in thread
From: Tengda Wu @ 2026-10-21 1:58 UTC (permalink / raw)
To: sashiko-reviews; +Cc: linux-perf-users
On 2026/10/20 22:36, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
> - [Medium] perf annotate-arm64: unused type_die in propagate_load_reg_state()
> - [Medium] perf annotate-arm64: missing reg2 extraction in ldp when reg1 is xzr/wzr
> --
>
> commit d4331cee155820a433821da388de2a7297699e0e
> Author: Tengda Wu <wutengda@huaweicloud.com>
>
> perf annotate-arm64: Support load instruction tracking
>
> This commit extends update_insn_state_arm64() to track register state
> changes across standard load and load-pair instructions, including
> pre-index and post-index addressing modes.
>
>> diff --git a/tools/perf/util/annotate-arch/annotate-arm64.c b/tools/perf/util/annotate-arch/annotate-arm64.c
>> index c4cc8bca85cc0..0b5d1abbc5755 100644
>> --- a/tools/perf/util/annotate-arch/annotate-arm64.c
>> +++ b/tools/perf/util/annotate-arch/annotate-arm64.c
>> @@ -527,11 +527,212 @@ static void invalidate_unhandled_insn_regs(struct type_state *state,
>> /* TODO: Extend invalidation support to more special instructions. */
>> }
>>
>> +static int arm64__reg_size(const char *reg)
>> +{
>> + if (!reg || !*reg || !arm64__is_reg(reg))
>> + return -1;
>> +
>> + if (reg[0] == 'w')
>> + return 4;
>> +
>> + if (reg[0] == 'x' || !strncmp(reg, "sp", 2))
>> + return 8;
>> +
>> + return -1;
>> +}
>
> [ ... ]
>
>> +static int propagate_load_reg_state(struct type_state *state,
>> + struct data_loc_info *dloc,
>> + struct disasm_line *dl, int dreg,
>> + struct annotated_op_loc *src,
>> + struct type_state_reg **src_states,
>> + int mem_spacing)
>> +{
>> + struct type_state_reg *tsr;
>> + struct type_state_reg *src_tsr = src_states[0];
>> + Dwarf_Die type_die;
>> + u32 insn_offset = dl->al.offset;
>> + int sreg = src->reg1;
>> + int reg_offset;
>> +
>> + if (!has_reg_type(state, dreg))
>> + return -1;
>> +
>> + tsr = &state->regs[dreg];
>> + tsr->copied_from = -1;
>> + tsr->lifetime_active = false;
>> + tsr->lifetime_end = 0;
>> +
>> +retry:
>> + if (arch_get_reg_offset(dloc->arch, src, sreg, state, false, ®_offset))
>> + goto load_non_regoff;
>> +
>> + reg_offset += mem_spacing;
>> +
>> + if (!src_tsr || !src_tsr->ok)
>> + return -1;
>> +
>> + /* Dereference the pointer if it has one */
>> + if (src_tsr->kind == TSR_KIND_TYPE &&
>> + die_deref_ptr_type(&src_tsr->type,
>> + src_tsr->offset + reg_offset, &type_die)) {
>> + tsr->type = type_die;
>> + tsr->kind = TSR_KIND_TYPE;
>> + tsr->offset = 0;
>> + tsr->ok = true;
>> +
>> + pr_debug_dtp("%s [%x] %#x(reg%d) -> reg%d",
>> + dl->ins.name, insn_offset, reg_offset, sreg, dreg);
>> + pr_debug_type_name(&tsr->type, tsr->kind);
>> + return 0;
>> + }
>> +
>> + /* Handle dereference of TSR_KIND_POINTER registers */
>> + if (src_tsr->kind == TSR_KIND_POINTER &&
>> + die_get_member_type(&src_tsr->type,
>> + src_tsr->offset + reg_offset, &type_die)) {
>> + tsr->type = src_tsr->type;
>> + tsr->kind = TSR_KIND_TYPE;
>> + tsr->offset = src_tsr->offset + reg_offset;
>
> [Severity: Medium]
> Should tsr->type be assigned type_die and tsr->offset set to 0 here?
>
> When DWARF describes a struct variable via a register-based memory
> location (where var->is_reg_var_addr is true), update_var_state() sets
> the base register to TSR_KIND_POINTER with reg->type set to the struct
> DIE.
>
> When a load instruction reads a member from that struct into dreg,
> update_insn_state_arm64() -> update_load_insn_state() ->
> propagate_load_reg_state() calls die_get_member_type() to resolve the
> loaded member's type into type_die.
>
> However, type_die is left unused, and tsr->type is set to src_tsr->type
> (the outer struct DIE) with tsr->offset set to src_tsr->offset +
> reg_offset and tsr->kind set to TSR_KIND_TYPE. When a subsequent
> instruction dereferences dreg, check_matching_type() or
> die_deref_ptr_type() inspects dreg->type, sees the outer struct type
> instead of the member's pointer type, and fails with PERF_TMR_NO_POINTER.
>
A similar issue was already clarified in v6 [1], and this part of the code
has been confirmed during actual debugging to resolve the data type
correctly, so I will keep it consistent with x86 and not modify it.
[1] https://lore.kernel.org/all/228cf99e-2b8a-42a8-aab6-45cc4823d3b7@huaweicloud.com/#t
>> + tsr->imm_value = 0;
>> + tsr->ok = true;
>> +
>> + pr_debug_dtp("%s [%x] addr %#x(reg%d) -> reg%d",
>> + dl->ins.name, insn_offset, reg_offset, sreg, dreg);
>> + pr_debug_type_name(&tsr->type, tsr->kind);
>> + return 0;
>> + }
>> +
>> +load_non_regoff:
>> + /* Try another register if any */
>> + if (src->multi_regs && src->reg1 != src->reg2 && sreg != src->reg2 &&
>> + !(src->extend_type || src->shift_type)) {
>> + sreg = src->reg2;
>> + src_tsr = src_states[1];
>> + goto retry;
>> + }
>> +
>> + return -1;
>> +}
>> +
>> +static void update_load_insn_state(struct type_state *state,
>> + struct data_loc_info *dloc,
>> + struct disasm_line *dl,
>> + struct annotated_op_loc *src,
>> + struct annotated_op_loc *dst)
>> +{
>> + struct type_state_reg snapshots[2];
>> + struct type_state_reg *src_states[2] = {};
>> + int mem_spacing = 0;
>> +
>> + if (!src->mem_ref || /* exclude PC-relative loads */
>> + !has_reg_type(state, src->reg1)) {
>> + /* Invalidate tracked destination registers */
>> + if (has_reg_type(state, dst->reg1))
>> + invalidate_reg_state(&state->regs[dst->reg1]);
>> + if (dst->multi_regs && has_reg_type(state, dst->reg2))
>> + invalidate_reg_state(&state->regs[dst->reg2]);
>> + goto out_adjust;
>> + }
>> +
>> + /*
>> + * Snapshot source register states before updating destination registers.
>> + * This preserves the original source state for aliased loads (e.g.,
>> + * ldp x0, x1, [x0]), where updating the first destination may overwrite
>> + * the source register.
>> + */
>> + snapshots[0] = state->regs[src->reg1];
>> + src_states[0] = &snapshots[0];
>> + if (src->multi_regs && has_reg_type(state, src->reg2)) {
>> + snapshots[1] = state->regs[src->reg2];
>> + src_states[1] = &snapshots[1];
>> + }
>> +
>> + /* Handle the first destination register */
>> + if (has_reg_type(state, dst->reg1)) {
>> + if (propagate_load_reg_state(state, dloc, dl, dst->reg1,
>> + src, src_states, mem_spacing))
>> + invalidate_reg_state(&state->regs[dst->reg1]);
>> + }
>> +
>> + if (!dst->multi_regs || !has_reg_type(state, dst->reg2))
>> + goto out_adjust;
>
> [Severity: Medium]
> What happens here when an ldp instruction uses the zero register (xzr or
> wzr) as its first destination operand, such as "ldp xzr, x19, [sp], #16"
> or "ldp xzr, x1, [x0]"?
>
> In update_load_insn_state(), dst->reg1 is guarded by has_reg_type(state,
> dst->reg1) without returning early, and arm64__reg_size() recognizes
> xzr/wzr via arm64__is_reg() so dst->reg2 can still be updated or
> invalidated.
>
> However, when update_insn_state_arm64() calls
> annotate_get_insn_location() -> extract_op_location_arm64(),
> arch__dwarf_regnum() returns -1 for xzr and wzr, and
> extract_op_location_arm64() returns before parsing reg2:
>
> tools/perf/util/annotate-arch/annotate-arm64.c:extract_op_location_arm64() {
> ...
> /* Extract the primary register */
> op_loc->reg1 = arch__dwarf_regnum(arch, s);
> if (op_loc->reg1 == -1)
> return;
>
> s = next_operand_field(s);
> if (s == NULL)
> return;
>
> /* Extract secondary register or immediate offset */
> if (op_loc->multi_regs) {
> op_loc->reg2 = arch__dwarf_regnum(arch, s);
> ...
> }
>
> Doesn't this leave dst->reg2 as -1, causing update_load_insn_state() (and
> invalidate_unhandled_insn_regs()) to skip the second register instead of
> propagating its type or invalidating its previous state?
>
So the root cause is that arch__dwarf_regnum does not currently support xzr/wzr;
it is not a problem with this patch.
I will take a targeted look at how to handle xzr/wzr in the future.
Thanks,
Tengda
>> +
>> + /* Handle the second destination register */
>> + if (!strcmp(dl->ins.name, "ldpsw"))
>> + mem_spacing = 4; /* ldpsw loads two 32-bit signed words (4-byte spacing) */
>> + else
>> + mem_spacing = arm64__reg_size(dl->ops.target.raw);
>> +
>> + if (mem_spacing < 0 ||
>> + propagate_load_reg_state(state, dloc, dl, dst->reg2,
>> + src, src_states, mem_spacing))
>> + invalidate_reg_state(&state->regs[dst->reg2]);
>> +
>> +out_adjust:
>> + adjust_reg_index_state(state, dloc, dl, src);
>> +}
>
> [ ... ]
>
>>
>
^ permalink raw reply [flat|nested] 35+ messages in thread
* [PATCH v8 06/15] perf annotate-arm64: Support store instruction tracking
2026-10-20 13:44 [PATCH v8 00/15] perf annotate arm64: Support instruction tracking for data type profiling Tengda Wu
` (4 preceding siblings ...)
2026-10-20 13:45 ` [PATCH v8 05/15] perf annotate-arm64: Support load instruction tracking Tengda Wu
@ 2026-10-20 13:45 ` Tengda Wu
2026-10-20 14:39 ` sashiko-bot
2026-10-20 13:45 ` [PATCH v8 07/15] perf annotate-data: Expand type_state_reg imm_value to u64 Tengda Wu
` (9 subsequent siblings)
15 siblings, 1 reply; 35+ messages in thread
From: Tengda Wu @ 2026-10-20 13:45 UTC (permalink / raw)
To: Namhyung Kim, james.clark, xueshuai, Arnaldo Carvalho de Melo
Cc: Peter Zijlstra, leo.yan, Li Huafei, Ian Rogers, Kim Phillips,
Mark Rutland, Ingo Molnar, Bill Wendling, Nick Desaulniers,
Alexander Shishkin, Adrian Hunter, Zecheng Li, linux-perf-users,
linux-kernel, llvm, Tengda Wu
Extend update_insn_state_arm64() to handle standard store instructions
(str, stur, stlr, stp). Exclusive stores (e.g., stxr, stxp) are excluded
from this path since their operand semantics differ.
Unlike load instructions, a store instruction writes a value into the
memory location addressed by the destination register, without changing
that register's type. As a result, no type transfer is needed here.
The only thing to keep in mind is that store instructions support
pre-index and post-index addressing modes, so adjust_reg_index_state()
still needs to be called to handle their addressing.
In addition, exclusive stores (stxr, stxp, stlxr, stlxp, etc.) write
their execution status (0 or 1) into the status register, which is
parsed into src->reg1. Invalidate this status register in
invalidate_unhandled_insn_regs() so that stale types are not propagated.
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Tengda Wu <wutengda@huaweicloud.com>
---
.../perf/util/annotate-arch/annotate-arm64.c | 50 ++++++++++++++++++-
1 file changed, 49 insertions(+), 1 deletion(-)
diff --git a/tools/perf/util/annotate-arch/annotate-arm64.c b/tools/perf/util/annotate-arch/annotate-arm64.c
index 0b5d1abbc575..e0bb37d8b353 100644
--- a/tools/perf/util/annotate-arch/annotate-arm64.c
+++ b/tools/perf/util/annotate-arch/annotate-arm64.c
@@ -507,6 +507,7 @@ static void update_call_insn_state(struct type_state *state,
/* Invalidate registers explicitly written by an unhandled instruction. */
static void invalidate_unhandled_insn_regs(struct type_state *state,
struct disasm_line *dl,
+ struct annotated_op_loc *src,
struct annotated_op_loc *dst)
{
u32 insn_offset = dl->al.offset;
@@ -524,6 +525,21 @@ static void invalidate_unhandled_insn_regs(struct type_state *state,
pr_debug_dtp("\n");
}
+ /*
+ * Exclusive store instructions (stxr, stxp, stlxr, stlxp, etc.)
+ * write their execution status (0 or 1) into the status register
+ * (parsed into src->reg1). Invalidate this status register to prevent
+ * stale type propagation.
+ */
+ if (!strncmp(dl->ins.name, "stx", 3) || /* stxr, stxp, stxrb, stxrh */
+ !strncmp(dl->ins.name, "stlx", 4)) { /* stlxr, stlxp, stlxrb, stlxrh */
+ if (has_reg_type(state, src->reg1)) {
+ pr_debug_dtp("%s [%x] invalidate reg%d\n",
+ dl->ins.name, insn_offset, src->reg1);
+ invalidate_reg_state(&state->regs[src->reg1]);
+ }
+ }
+
/* TODO: Extend invalidation support to more special instructions. */
}
@@ -727,6 +743,35 @@ static void update_load_insn_state(struct type_state *state,
adjust_reg_index_state(state, dloc, dl, src);
}
+/*
+ * Match standard store variants (str, stur, stlr, stp) that follow
+ * straightforward store semantics: source registers on the left (read-only)
+ * and memory target on the right. Excludes exclusive stores (stxr, stxp, etc.)
+ * which have status/result register side effects.
+ */
+static bool is_standard_store_insn(const char *name)
+{
+ return !strncmp(name, "str", 3) || /* str, strb, strh */
+ !strncmp(name, "stur", 4) || /* stur, sturb, sturh */
+ !strncmp(name, "stlr", 4) || /* stlr, stlrb, stlrh */
+ !strncmp(name, "stp", 3); /* stp */
+}
+
+static void update_store_insn_state(struct type_state *state,
+ struct data_loc_info *dloc,
+ struct disasm_line *dl,
+ struct annotated_op_loc *dst)
+{
+ /*
+ * Ignore transfers since it'd set a value in a struct
+ * and won't change the type.
+ *
+ * Needs to update the pre-index and post-index addressing
+ * modes for the destination register.
+ */
+ adjust_reg_index_state(state, dloc, dl, dst);
+}
+
static void update_insn_state_arm64(struct type_state *state,
struct data_loc_info *dloc, Dwarf_Die *cu_die,
struct disasm_line *dl)
@@ -746,8 +791,11 @@ static void update_insn_state_arm64(struct type_state *state,
/* Memory to register transfers */
else if (is_standard_load_insn(dl->ins.name))
update_load_insn_state(state, dloc, dl, src, dst);
+ /* Register to memory transfers */
+ else if (is_standard_store_insn(dl->ins.name))
+ update_store_insn_state(state, dloc, dl, dst);
else
- invalidate_unhandled_insn_regs(state, dl, dst);
+ invalidate_unhandled_insn_regs(state, dl, src, dst);
}
#endif
--
2.34.1
^ permalink raw reply related [flat|nested] 35+ messages in thread* Re: [PATCH v8 06/15] perf annotate-arm64: Support store instruction tracking
2026-10-20 13:45 ` [PATCH v8 06/15] perf annotate-arm64: Support store " Tengda Wu
@ 2026-10-20 14:39 ` sashiko-bot
0 siblings, 0 replies; 35+ messages in thread
From: sashiko-bot @ 2026-10-20 14:39 UTC (permalink / raw)
To: Tengda Wu; +Cc: linux-perf-users
> Extend update_insn_state_arm64() to handle standard store instructions
> (str, stur, stlr, stp). Exclusive stores (e.g., stxr, stxp) are excluded
> from this path since their operand semantics differ.
>
> Unlike load instructions, a store instruction writes a value into the
> memory location addressed by the destination register, without changing
> that register's type. As a result, no type transfer is needed here.
>
> The only thing to keep in mind is that store instructions support
> pre-index and post-index addressing modes, so adjust_reg_index_state()
> still needs to be called to handle their addressing.
>
> In addition, exclusive stores (stxr, stxp, stlxr, stlxp, etc.) write
> their execution status (0 or 1) into the status register, which is
> parsed into src->reg1. Invalidate this status register in
> invalidate_unhandled_insn_regs() so that stale types are not propagated.
>
> Reviewed-by: Ian Rogers <irogers@google.com>
> Signed-off-by: Tengda Wu <wutengda@huaweicloud.com>
Sashiko has reviewed this patch and found no issues.
--
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1792411435.git.wutengda@huaweicloud.com?part=6
^ permalink raw reply [flat|nested] 35+ messages in thread
* [PATCH v8 07/15] perf annotate-data: Expand type_state_reg imm_value to u64
2026-10-20 13:44 [PATCH v8 00/15] perf annotate arm64: Support instruction tracking for data type profiling Tengda Wu
` (5 preceding siblings ...)
2026-10-20 13:45 ` [PATCH v8 06/15] perf annotate-arm64: Support store " Tengda Wu
@ 2026-10-20 13:45 ` Tengda Wu
2026-10-20 14:43 ` sashiko-bot
2026-10-20 13:45 ` [PATCH v8 08/15] perf annotate-data: Track imm_value for stack variables Tengda Wu
` (8 subsequent siblings)
15 siblings, 1 reply; 35+ messages in thread
From: Tengda Wu @ 2026-10-20 13:45 UTC (permalink / raw)
To: Namhyung Kim, james.clark, xueshuai, Arnaldo Carvalho de Melo
Cc: Peter Zijlstra, leo.yan, Li Huafei, Ian Rogers, Kim Phillips,
Mark Rutland, Ingo Molnar, Bill Wendling, Nick Desaulniers,
Alexander Shishkin, Adrian Hunter, Zecheng Li, linux-perf-users,
linux-kernel, llvm, Tengda Wu
The arm64 'adrp + add/ldr' instruction pair involves global variable address
calculation and passing, which requires storing the 64-bit address in
type_state_reg. Currently, there is no field in type_state_reg that can
hold such an address. The most likely candidate for reuse is imm_value,
but it is defined as u32, which limits the size of values it can carry.
To address this, expand imm_value from u32 to u64. Also update related
compilation warnings and fix the sign-extension issue introduced by this
change.
Reviewed-by: Ian Rogers <irogers@google.com>
Reviewed-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Tengda Wu <wutengda@huaweicloud.com>
---
tools/perf/util/annotate-arch/annotate-x86.c | 4 ++--
tools/perf/util/annotate-data.h | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/tools/perf/util/annotate-arch/annotate-x86.c b/tools/perf/util/annotate-arch/annotate-x86.c
index aa381d25a63b..f5e40cef08ab 100644
--- a/tools/perf/util/annotate-arch/annotate-x86.c
+++ b/tools/perf/util/annotate-arch/annotate-x86.c
@@ -536,11 +536,11 @@ static void update_insn_state_x86(struct type_state *state,
if (src->imm) {
tsr->kind = TSR_KIND_CONST;
- tsr->imm_value = src->offset;
+ tsr->imm_value = (s64)src->offset;
tsr->offset = 0;
tsr->ok = true;
- pr_debug_dtp("mov [%x] imm=%#x -> reg%d\n",
+ pr_debug_dtp("mov [%x] imm=%#"PRIx64" -> reg%d\n",
insn_offset, tsr->imm_value, dst->reg1);
return;
}
diff --git a/tools/perf/util/annotate-data.h b/tools/perf/util/annotate-data.h
index 453efdf6afa6..12b5b6db5f57 100644
--- a/tools/perf/util/annotate-data.h
+++ b/tools/perf/util/annotate-data.h
@@ -182,7 +182,7 @@ extern struct annotated_data_stat ann_data_stat;
*/
struct type_state_reg {
Dwarf_Die type;
- u32 imm_value;
+ u64 imm_value;
/*
* The offset within the struct that the register points to.
* A value of 0 means the register points to the beginning.
--
2.34.1
^ permalink raw reply related [flat|nested] 35+ messages in thread* [PATCH v8 08/15] perf annotate-data: Track imm_value for stack variables
2026-10-20 13:44 [PATCH v8 00/15] perf annotate arm64: Support instruction tracking for data type profiling Tengda Wu
` (6 preceding siblings ...)
2026-10-20 13:45 ` [PATCH v8 07/15] perf annotate-data: Expand type_state_reg imm_value to u64 Tengda Wu
@ 2026-10-20 13:45 ` Tengda Wu
2026-10-20 14:46 ` sashiko-bot
2026-10-20 13:45 ` [PATCH v8 09/15] perf annotate-x86: Delete stale stack state on store of untracked register Tengda Wu
` (7 subsequent siblings)
15 siblings, 1 reply; 35+ messages in thread
From: Tengda Wu @ 2026-10-20 13:45 UTC (permalink / raw)
To: Namhyung Kim, james.clark, xueshuai, Arnaldo Carvalho de Melo
Cc: Peter Zijlstra, leo.yan, Li Huafei, Ian Rogers, Kim Phillips,
Mark Rutland, Ingo Molnar, Bill Wendling, Nick Desaulniers,
Alexander Shishkin, Adrian Hunter, Zecheng Li, linux-perf-users,
linux-kernel, llvm, Tengda Wu
Currently, imm_value is tracked in registers but dropped when values
are saved to or loaded from stack variables during type profiling.
If a register of type TSR_KIND_CONST is stored to the stack, its value
will be lost.
Add an imm_value field to struct type_state_stack and update
set_stack_state() and findnew_stack_state() to accept and preserve the
immediate value when updating stack state.
Reviewed-by: Shuai Xue <xueshuai@linux.alibaba.com>
Reviewed-by: Ian Rogers <irogers@google.com>
Reviewed-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Tengda Wu <wutengda@huaweicloud.com>
---
tools/perf/util/annotate-arch/annotate-x86.c | 8 ++++++--
tools/perf/util/annotate-data.c | 13 +++++++------
tools/perf/util/annotate-data.h | 5 +++--
3 files changed, 16 insertions(+), 10 deletions(-)
diff --git a/tools/perf/util/annotate-arch/annotate-x86.c b/tools/perf/util/annotate-arch/annotate-x86.c
index f5e40cef08ab..21729e153fa0 100644
--- a/tools/perf/util/annotate-arch/annotate-x86.c
+++ b/tools/perf/util/annotate-arch/annotate-x86.c
@@ -591,6 +591,7 @@ static void update_insn_state_x86(struct type_state *state,
tsr->type = stack->type;
tsr->kind = stack->kind;
tsr->offset = stack->ptr_offset;
+ tsr->imm_value = stack->imm_value;
tsr->ok = true;
} else if (die_get_member_type(&stack->type,
offset - stack->offset,
@@ -598,6 +599,7 @@ static void update_insn_state_x86(struct type_state *state,
tsr->type = type_die;
tsr->kind = TSR_KIND_TYPE;
tsr->offset = 0;
+ tsr->imm_value = 0;
tsr->ok = true;
} else {
invalidate_reg_state(tsr);
@@ -773,10 +775,12 @@ static void update_insn_state_x86(struct type_state *state,
*/
if (!stack->compound)
set_stack_state(stack, offset, tsr->kind,
- &tsr->type, tsr->offset);
+ &tsr->type, tsr->offset,
+ tsr->imm_value);
} else {
findnew_stack_state(state, offset, tsr->kind,
- &tsr->type, tsr->offset);
+ &tsr->type, tsr->offset,
+ tsr->imm_value);
}
if (dst->reg1 == fbreg) {
diff --git a/tools/perf/util/annotate-data.c b/tools/perf/util/annotate-data.c
index 24d82739b2ec..9ed0780d6244 100644
--- a/tools/perf/util/annotate-data.c
+++ b/tools/perf/util/annotate-data.c
@@ -704,7 +704,7 @@ struct type_state_stack *find_stack_state(struct type_state *state,
}
void set_stack_state(struct type_state_stack *stack, int offset, u8 kind,
- Dwarf_Die *type_die, int ptr_offset)
+ Dwarf_Die *type_die, int ptr_offset, u64 imm_value)
{
int tag;
Dwarf_Word size;
@@ -721,8 +721,9 @@ void set_stack_state(struct type_state_stack *stack, int offset, u8 kind,
stack->offset = offset;
stack->ptr_offset = ptr_offset;
stack->kind = kind;
+ stack->imm_value = imm_value;
- if (kind == TSR_KIND_POINTER) {
+ if (kind == TSR_KIND_POINTER || kind == TSR_KIND_CONST) {
stack->compound = false;
return;
}
@@ -743,18 +744,18 @@ void set_stack_state(struct type_state_stack *stack, int offset, u8 kind,
struct type_state_stack *findnew_stack_state(struct type_state *state,
int offset, u8 kind,
Dwarf_Die *type_die,
- int ptr_offset)
+ int ptr_offset, u64 imm_value)
{
struct type_state_stack *stack = find_stack_state(state, offset);
if (stack) {
- set_stack_state(stack, offset, kind, type_die, ptr_offset);
+ set_stack_state(stack, offset, kind, type_die, ptr_offset, imm_value);
return stack;
}
stack = malloc(sizeof(*stack));
if (stack) {
- set_stack_state(stack, offset, kind, type_die, ptr_offset);
+ set_stack_state(stack, offset, kind, type_die, ptr_offset, imm_value);
list_add(&stack->list, &state->stack_vars);
}
return stack;
@@ -1058,7 +1059,7 @@ static void update_var_state(struct type_state *state, struct data_loc_info *dlo
continue;
findnew_stack_state(state, offset, TSR_KIND_TYPE,
- &mem_die, /*ptr_offset=*/0);
+ &mem_die, /*ptr_offset=*/0, /*imm_value=*/0);
if (var->reg == state->stack_reg) {
pr_debug_dtp("var [%"PRIx64"] %#x(reg%d)",
diff --git a/tools/perf/util/annotate-data.h b/tools/perf/util/annotate-data.h
index 12b5b6db5f57..dccd56759cea 100644
--- a/tools/perf/util/annotate-data.h
+++ b/tools/perf/util/annotate-data.h
@@ -208,6 +208,7 @@ struct type_state_stack {
int size;
bool compound;
u8 kind;
+ u64 imm_value;
};
/*
@@ -262,9 +263,9 @@ bool has_reg_type(struct type_state *state, int reg);
struct type_state_stack *findnew_stack_state(struct type_state *state,
int offset, u8 kind,
Dwarf_Die *type_die,
- int ptr_offset);
+ int ptr_offset, u64 imm_value);
void set_stack_state(struct type_state_stack *stack, int offset, u8 kind,
- Dwarf_Die *type_die, int ptr_offset);
+ Dwarf_Die *type_die, int ptr_offset, u64 imm_value);
struct type_state_stack *find_stack_state(struct type_state *state,
int offset);
void invalidate_reg_state(struct type_state_reg *reg);
--
2.34.1
^ permalink raw reply related [flat|nested] 35+ messages in thread* [PATCH v8 09/15] perf annotate-x86: Delete stale stack state on store of untracked register
2026-10-20 13:44 [PATCH v8 00/15] perf annotate arm64: Support instruction tracking for data type profiling Tengda Wu
` (7 preceding siblings ...)
2026-10-20 13:45 ` [PATCH v8 08/15] perf annotate-data: Track imm_value for stack variables Tengda Wu
@ 2026-10-20 13:45 ` Tengda Wu
2026-10-20 14:50 ` sashiko-bot
2026-10-20 13:45 ` [PATCH v8 10/15] perf annotate-arm64: Support stack variable tracking Tengda Wu
` (6 subsequent siblings)
15 siblings, 1 reply; 35+ messages in thread
From: Tengda Wu @ 2026-10-20 13:45 UTC (permalink / raw)
To: Namhyung Kim, james.clark, xueshuai, Arnaldo Carvalho de Melo
Cc: Peter Zijlstra, leo.yan, Li Huafei, Ian Rogers, Kim Phillips,
Mark Rutland, Ingo Molnar, Bill Wendling, Nick Desaulniers,
Alexander Shishkin, Adrian Hunter, Zecheng Li, linux-perf-users,
linux-kernel, llvm, Tengda Wu
When a register without a tracked type is stored to a stack slot that
previously held a valid type, the code currently performs an early return.
This leaves the old type information intact in the stack state.
As a result, a stale type bug occurs:
1. A tracked register is stored into a stack slot.
2. The register becomes untracked/invalid (e.g., across a function call).
3. The now-untracked register is stored into the same stack slot.
4. Subsequent loads from that slot erroneously pick up the old stale type
because the stack entry was never invalidated.
Fix this by introducing delete_stack_state() to search and free a stack
entry for a given offset. When storing an untracked or invalid source
register into a stack location, call delete_stack_state() to delete the
stale entry before returning.
Reviewed-by: Ian Rogers <irogers@google.com>
Reviewed-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Tengda Wu <wutengda@huaweicloud.com>
---
tools/perf/util/annotate-arch/annotate-x86.c | 17 +++++++++++++----
tools/perf/util/annotate-data.c | 10 ++++++++++
tools/perf/util/annotate-data.h | 1 +
3 files changed, 24 insertions(+), 4 deletions(-)
diff --git a/tools/perf/util/annotate-arch/annotate-x86.c b/tools/perf/util/annotate-arch/annotate-x86.c
index 21729e153fa0..3a6ea7e978e0 100644
--- a/tools/perf/util/annotate-arch/annotate-x86.c
+++ b/tools/perf/util/annotate-arch/annotate-x86.c
@@ -753,15 +753,24 @@ static void update_insn_state_x86(struct type_state *state,
}
/* Case 3. register to memory transfers */
if (!src->mem_ref && dst->mem_ref) {
- if (!has_reg_type(state, src->reg1) ||
- !state->regs[src->reg1].ok)
- return;
-
/* Check stack variables with offset */
if (dst->reg1 == fbreg || dst->reg1 == state->stack_reg) {
struct type_state_stack *stack;
int offset = dst->offset - fboff;
+ if (!has_reg_type(state, src->reg1) ||
+ !state->regs[src->reg1].ok) {
+ stack = find_stack_state(state, offset);
+ /*
+ * Preserve compound states when only a member
+ * is overwritten.
+ */
+ if (stack && !stack->compound)
+ delete_stack_state(state, offset);
+
+ return;
+ }
+
tsr = &state->regs[src->reg1];
stack = find_stack_state(state, offset);
diff --git a/tools/perf/util/annotate-data.c b/tools/perf/util/annotate-data.c
index 9ed0780d6244..1d47db3a9dd9 100644
--- a/tools/perf/util/annotate-data.c
+++ b/tools/perf/util/annotate-data.c
@@ -761,6 +761,16 @@ struct type_state_stack *findnew_stack_state(struct type_state *state,
return stack;
}
+void delete_stack_state(struct type_state *state, int offset)
+{
+ struct type_state_stack *stack = find_stack_state(state, offset);
+
+ if (stack) {
+ list_del(&stack->list);
+ free(stack);
+ }
+}
+
void invalidate_reg_state(struct type_state_reg *reg)
{
reg->kind = TSR_KIND_INVALID;
diff --git a/tools/perf/util/annotate-data.h b/tools/perf/util/annotate-data.h
index dccd56759cea..425d9ddfad41 100644
--- a/tools/perf/util/annotate-data.h
+++ b/tools/perf/util/annotate-data.h
@@ -268,6 +268,7 @@ void set_stack_state(struct type_state_stack *stack, int offset, u8 kind,
Dwarf_Die *type_die, int ptr_offset, u64 imm_value);
struct type_state_stack *find_stack_state(struct type_state *state,
int offset);
+void delete_stack_state(struct type_state *state, int offset);
void invalidate_reg_state(struct type_state_reg *reg);
bool get_global_var_type(Dwarf_Die *cu_die, struct data_loc_info *dloc,
u64 ip, u64 var_addr, int *var_offset,
--
2.34.1
^ permalink raw reply related [flat|nested] 35+ messages in thread* Re: [PATCH v8 09/15] perf annotate-x86: Delete stale stack state on store of untracked register
2026-10-20 13:45 ` [PATCH v8 09/15] perf annotate-x86: Delete stale stack state on store of untracked register Tengda Wu
@ 2026-10-20 14:50 ` sashiko-bot
0 siblings, 0 replies; 35+ messages in thread
From: sashiko-bot @ 2026-10-20 14:50 UTC (permalink / raw)
To: Tengda Wu; +Cc: linux-perf-users
> When a register without a tracked type is stored to a stack slot that
> previously held a valid type, the code currently performs an early return.
> This leaves the old type information intact in the stack state.
>
> As a result, a stale type bug occurs:
> 1. A tracked register is stored into a stack slot.
> 2. The register becomes untracked/invalid (e.g., across a function call).
> 3. The now-untracked register is stored into the same stack slot.
> 4. Subsequent loads from that slot erroneously pick up the old stale type
> because the stack entry was never invalidated.
>
> Fix this by introducing delete_stack_state() to search and free a stack
> entry for a given offset. When storing an untracked or invalid source
> register into a stack location, call delete_stack_state() to delete the
> stale entry before returning.
>
> Reviewed-by: Ian Rogers <irogers@google.com>
> Reviewed-by: Namhyung Kim <namhyung@kernel.org>
> Signed-off-by: Tengda Wu <wutengda@huaweicloud.com>
Sashiko has reviewed this patch and found no issues.
--
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1792411435.git.wutengda@huaweicloud.com?part=9
^ permalink raw reply [flat|nested] 35+ messages in thread
* [PATCH v8 10/15] perf annotate-arm64: Support stack variable tracking
2026-10-20 13:44 [PATCH v8 00/15] perf annotate arm64: Support instruction tracking for data type profiling Tengda Wu
` (8 preceding siblings ...)
2026-10-20 13:45 ` [PATCH v8 09/15] perf annotate-x86: Delete stale stack state on store of untracked register Tengda Wu
@ 2026-10-20 13:45 ` Tengda Wu
2026-10-20 14:59 ` sashiko-bot
2026-10-20 13:45 ` [PATCH v8 11/15] perf annotate-arm64: Support 'mov' instruction tracking Tengda Wu
` (5 subsequent siblings)
15 siblings, 1 reply; 35+ messages in thread
From: Tengda Wu @ 2026-10-20 13:45 UTC (permalink / raw)
To: Namhyung Kim, james.clark, xueshuai, Arnaldo Carvalho de Melo
Cc: Peter Zijlstra, leo.yan, Li Huafei, Ian Rogers, Kim Phillips,
Mark Rutland, Ingo Molnar, Bill Wendling, Nick Desaulniers,
Alexander Shishkin, Adrian Hunter, Zecheng Li, linux-perf-users,
linux-kernel, llvm, Tengda Wu
Extend update_insn_state_arm64() to track data types stored on the
stack.
The implementation handles:
1. Stack Loads: Identify when a register is loaded from a stack
slot and update the register's type state based on the tracked
stack content or compound member types.
2. Stack Stores: Update or create new stack state entries when
a tracked register type is stored to the stack.
Similar to loads, stores also support saving one or two registers
(in the case of 'stp'). Therefore, propagate_store_reg_state() is
introduced.
With these changes, the instruction tracker can now follow data types
as they move between registers and memory, specifically for function
local variables and compiler-spilled values on arm64.
Reviewed-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Tengda Wu <wutengda@huaweicloud.com>
---
.../perf/util/annotate-arch/annotate-arm64.c | 153 +++++++++++++++++-
1 file changed, 145 insertions(+), 8 deletions(-)
diff --git a/tools/perf/util/annotate-arch/annotate-arm64.c b/tools/perf/util/annotate-arch/annotate-arm64.c
index e0bb37d8b353..e97a0cbe02fc 100644
--- a/tools/perf/util/annotate-arch/annotate-arm64.c
+++ b/tools/perf/util/annotate-arch/annotate-arm64.c
@@ -624,6 +624,8 @@ static int propagate_load_reg_state(struct type_state *state,
u32 insn_offset = dl->al.offset;
int sreg = src->reg1;
int reg_offset;
+ int fbreg = dloc->fbreg;
+ int fboff = 0;
if (!has_reg_type(state, dreg))
return -1;
@@ -633,12 +635,57 @@ static int propagate_load_reg_state(struct type_state *state,
tsr->lifetime_active = false;
tsr->lifetime_end = 0;
+ if (dloc->fb_cfa) {
+ u64 ip = dloc->ms->sym->start + dl->al.offset;
+ u64 pc = map__rip_2objdump(dloc->ms->map, ip);
+
+ if (die_get_cfa(dloc->di->dbg, pc, &fbreg, &fboff) < 0)
+ fbreg = -1;
+ }
+
retry:
if (arch_get_reg_offset(dloc->arch, src, sreg, state, false, ®_offset))
goto load_non_regoff;
reg_offset += mem_spacing;
+ /* Check stack variables with offset */
+ if (sreg != -1 && (sreg == fbreg || sreg == state->stack_reg)) {
+ struct type_state_stack *stack;
+ int offset = sreg == fbreg ? reg_offset - fboff : reg_offset;
+
+ stack = find_stack_state(state, offset);
+ if (stack == NULL) {
+ return -1;
+ } else if (!stack->compound) {
+ tsr->type = stack->type;
+ tsr->kind = stack->kind;
+ tsr->offset = stack->ptr_offset;
+ tsr->imm_value = stack->imm_value;
+ tsr->ok = true;
+ } else if (die_get_member_type(&stack->type,
+ offset - stack->offset,
+ &type_die)) {
+ tsr->type = type_die;
+ tsr->kind = TSR_KIND_TYPE;
+ tsr->offset = 0;
+ tsr->imm_value = 0;
+ tsr->ok = true;
+ } else {
+ return -1;
+ }
+
+ if (sreg == fbreg) {
+ pr_debug_dtp("%s [%x] -%#x(stack) -> reg%d",
+ dl->ins.name, insn_offset, -offset, dreg);
+ } else {
+ pr_debug_dtp("%s [%x] %#x(reg%d) -> reg%d",
+ dl->ins.name, insn_offset, offset, sreg, dreg);
+ }
+ pr_debug_type_name(&tsr->type, tsr->kind);
+ return 0;
+ }
+
if (!src_tsr || !src_tsr->ok)
return -1;
@@ -757,18 +804,108 @@ static bool is_standard_store_insn(const char *name)
!strncmp(name, "stp", 3); /* stp */
}
+/*
+ * For store insns: propagate type from @sreg to the memory location referenced
+ * by @dst, applying @mem_spacing to account for multi-regs stores (e.g. stp).
+ */
+static void propagate_store_reg_state(struct type_state *state,
+ struct data_loc_info *dloc,
+ struct disasm_line *dl, int sreg,
+ struct annotated_op_loc *dst,
+ int mem_spacing)
+{
+ struct type_state_reg *tsr;
+ u32 insn_offset = dl->al.offset;
+ int dreg = dst->reg1;
+ int reg_offset;
+ int fbreg = dloc->fbreg;
+ int fboff = 0;
+
+ if (arch_get_reg_offset(dloc->arch, dst, dreg, state, false, ®_offset))
+ return;
+
+ reg_offset += mem_spacing;
+
+ if (dloc->fb_cfa) {
+ u64 ip = dloc->ms->sym->start + dl->al.offset;
+ u64 pc = map__rip_2objdump(dloc->ms->map, ip);
+
+ if (die_get_cfa(dloc->di->dbg, pc, &fbreg, &fboff) < 0)
+ fbreg = -1;
+ }
+
+ /* Check stack variables with offset */
+ if (dreg != -1 && (dreg == fbreg || dreg == state->stack_reg)) {
+ struct type_state_stack *stack;
+ int offset = dreg == fbreg ? reg_offset - fboff : reg_offset;
+
+ if (!has_reg_type(state, sreg) || !state->regs[sreg].ok) {
+ stack = find_stack_state(state, offset);
+ /* Preserve compound states when only a member is overwritten. */
+ if (stack && !stack->compound)
+ delete_stack_state(state, offset);
+
+ return;
+ }
+
+ tsr = &state->regs[sreg];
+
+ stack = find_stack_state(state, offset);
+ if (stack) {
+ if (!stack->compound)
+ set_stack_state(stack, offset, tsr->kind, &tsr->type,
+ tsr->offset, tsr->imm_value);
+ /*
+ * If it's a compound type, it means attempting to
+ * write to a member value of the compound type without
+ * changing the compound type itself, so do nothing.
+ */
+ } else {
+ findnew_stack_state(state, offset, tsr->kind, &tsr->type,
+ tsr->offset, tsr->imm_value);
+ }
+
+ if (dreg == fbreg) {
+ pr_debug_dtp("%s [%x] reg%d -> -%#x(stack)",
+ dl->ins.name, insn_offset, sreg, -offset);
+ } else {
+ pr_debug_dtp("%s [%x] reg%d -> %#x(reg%d)",
+ dl->ins.name, insn_offset, sreg, offset, dreg);
+ }
+ if (tsr->offset != 0)
+ pr_debug_dtp(" reg%d offset %#x ->", sreg, tsr->offset);
+
+ pr_debug_type_name(&tsr->type, tsr->kind);
+ }
+ /*
+ * Ignore other transfers since it'd set a value in a struct
+ * and won't change the type.
+ */
+}
+
static void update_store_insn_state(struct type_state *state,
struct data_loc_info *dloc,
struct disasm_line *dl,
+ struct annotated_op_loc *src,
struct annotated_op_loc *dst)
{
- /*
- * Ignore transfers since it'd set a value in a struct
- * and won't change the type.
- *
- * Needs to update the pre-index and post-index addressing
- * modes for the destination register.
- */
+ int mem_spacing = 0;
+
+ if (!has_reg_type(state, dst->reg1))
+ return;
+
+ /* Handle the first source register */
+ propagate_store_reg_state(state, dloc, dl, src->reg1, dst, mem_spacing);
+
+ /* Handle the second source register (if any) */
+ if (src->multi_regs) {
+ mem_spacing = arm64__reg_size(dl->ops.source.raw);
+
+ if (mem_spacing >= 0)
+ propagate_store_reg_state(state, dloc, dl, src->reg2,
+ dst, mem_spacing);
+ }
+
adjust_reg_index_state(state, dloc, dl, dst);
}
@@ -793,7 +930,7 @@ static void update_insn_state_arm64(struct type_state *state,
update_load_insn_state(state, dloc, dl, src, dst);
/* Register to memory transfers */
else if (is_standard_store_insn(dl->ins.name))
- update_store_insn_state(state, dloc, dl, dst);
+ update_store_insn_state(state, dloc, dl, src, dst);
else
invalidate_unhandled_insn_regs(state, dl, src, dst);
}
--
2.34.1
^ permalink raw reply related [flat|nested] 35+ messages in thread* Re: [PATCH v8 10/15] perf annotate-arm64: Support stack variable tracking
2026-10-20 13:45 ` [PATCH v8 10/15] perf annotate-arm64: Support stack variable tracking Tengda Wu
@ 2026-10-20 14:59 ` sashiko-bot
0 siblings, 0 replies; 35+ messages in thread
From: sashiko-bot @ 2026-10-20 14:59 UTC (permalink / raw)
To: Tengda Wu; +Cc: linux-perf-users
> Extend update_insn_state_arm64() to track data types stored on the
> stack.
>
> The implementation handles:
> 1. Stack Loads: Identify when a register is loaded from a stack
> slot and update the register's type state based on the tracked
> stack content or compound member types.
> 2. Stack Stores: Update or create new stack state entries when
> a tracked register type is stored to the stack.
>
> Similar to loads, stores also support saving one or two registers
> (in the case of 'stp'). Therefore, propagate_store_reg_state() is
> introduced.
>
> With these changes, the instruction tracker can now follow data types
> as they move between registers and memory, specifically for function
> local variables and compiler-spilled values on arm64.
>
> Reviewed-by: Namhyung Kim <namhyung@kernel.org>
> Signed-off-by: Tengda Wu <wutengda@huaweicloud.com>
Sashiko has reviewed this patch and found no issues.
--
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1792411435.git.wutengda@huaweicloud.com?part=10
^ permalink raw reply [flat|nested] 35+ messages in thread
* [PATCH v8 11/15] perf annotate-arm64: Support 'mov' instruction tracking
2026-10-20 13:44 [PATCH v8 00/15] perf annotate arm64: Support instruction tracking for data type profiling Tengda Wu
` (9 preceding siblings ...)
2026-10-20 13:45 ` [PATCH v8 10/15] perf annotate-arm64: Support stack variable tracking Tengda Wu
@ 2026-10-20 13:45 ` Tengda Wu
2026-10-20 15:01 ` sashiko-bot
2026-10-20 13:45 ` [PATCH v8 12/15] perf annotate-arm64: Support 'add' " Tengda Wu
` (4 subsequent siblings)
15 siblings, 1 reply; 35+ messages in thread
From: Tengda Wu @ 2026-10-20 13:45 UTC (permalink / raw)
To: Namhyung Kim, james.clark, xueshuai, Arnaldo Carvalho de Melo
Cc: Peter Zijlstra, leo.yan, Li Huafei, Ian Rogers, Kim Phillips,
Mark Rutland, Ingo Molnar, Bill Wendling, Nick Desaulniers,
Alexander Shishkin, Adrian Hunter, Zecheng Li, linux-perf-users,
linux-kernel, llvm, Tengda Wu
Extend update_insn_state_arm64() to support register-to-register and
immediate-to-register 'mov' instructions.
For register-to-register 'mov' (e.g., mov dreg, sreg), propagate data type
information from the source register to the destination register.
For immediate-to-register 'mov' (e.g., mov dreg, #imm), store the immediate
value in the destination register's imm_value field and set its kind to
TSR_KIND_CONST, allowing subsequent instructions to resolve it as a
constant.
A real-world example is shown below:
ffff8000803eebf8 <get_vma_policy>:
ffff8000803eec20: mov x21, x0 // x0 (struct vm_area_struct*) -> x21
ffff8000803eec28: ldr x2, [x0, #112]
ffff8000803eec2c: cbz x2, ffff8000803eec94 <get_vma_policy+0x9c>
* ffff8000803eec94: ldr x0, [x21, #152]
Before this commit, the type of x21 was unknown, causing the subsequent
inference to fail:
var [0] reg0 offset 0 type='struct vm_area_struct*' size=0x8
chk [9c] reg21 offset=0x98 ok=0 kind=0 cfa : no type information
final result: no type information
After this commit, the type of x21 is correctly inferred as 'vm_area_struct':
var [0] reg0 offset 0 type='struct vm_area_struct*' size=0x8
mov [28] reg0 -> reg21 type='struct vm_area_struct*' size=0x8
chk [9c] reg21 offset=0x98 ok=1 kind=1 (struct vm_area_struct*) : Good!
found by insn track: 0x98(reg21) type-offset=0x98
final result: type='struct vm_area_struct' size=0xb0
Reviewed-by: Ian Rogers <irogers@google.com>
Reviewed-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Tengda Wu <wutengda@huaweicloud.com>
---
.../perf/util/annotate-arch/annotate-arm64.c | 53 +++++++++++++++++++
1 file changed, 53 insertions(+)
diff --git a/tools/perf/util/annotate-arch/annotate-arm64.c b/tools/perf/util/annotate-arch/annotate-arm64.c
index e97a0cbe02fc..38a9cb37c952 100644
--- a/tools/perf/util/annotate-arch/annotate-arm64.c
+++ b/tools/perf/util/annotate-arch/annotate-arm64.c
@@ -1,6 +1,7 @@
// SPDX-License-Identifier: GPL-2.0
#include <linux/compiler.h>
#include <errno.h>
+#include <inttypes.h>
#include <stdlib.h>
#include <string.h>
#include <linux/ctype.h>
@@ -696,6 +697,7 @@ static int propagate_load_reg_state(struct type_state *state,
tsr->type = type_die;
tsr->kind = TSR_KIND_TYPE;
tsr->offset = 0;
+ tsr->imm_value = 0;
tsr->ok = true;
pr_debug_dtp("%s [%x] %#x(reg%d) -> reg%d",
@@ -909,6 +911,54 @@ static void update_store_insn_state(struct type_state *state,
adjust_reg_index_state(state, dloc, dl, dst);
}
+static void update_mov_insn_state(struct type_state *state,
+ struct disasm_line *dl,
+ struct annotated_op_loc *src,
+ struct annotated_op_loc *dst)
+{
+ struct type_state_reg *tsr;
+ u32 insn_offset = dl->al.offset;
+ int sreg = src->reg1;
+ int dreg = dst->reg1;
+
+ if (!has_reg_type(state, dreg))
+ return;
+
+ tsr = &state->regs[dreg];
+ tsr->copied_from = -1;
+
+ if (src->imm) {
+ invalidate_reg_state(tsr);
+ tsr->kind = TSR_KIND_CONST;
+ tsr->imm_value = (s64)src->offset;
+ tsr->offset = 0;
+ tsr->ok = true;
+
+ pr_debug_dtp("mov [%x] imm=%#"PRIx64" -> reg%d\n",
+ insn_offset, tsr->imm_value, dreg);
+ return;
+ }
+
+ if (!has_reg_type(state, sreg) || !state->regs[sreg].ok) {
+ invalidate_reg_state(tsr);
+ return;
+ }
+
+ tsr->type = state->regs[sreg].type;
+ tsr->kind = state->regs[sreg].kind;
+ tsr->imm_value = state->regs[sreg].imm_value;
+ tsr->offset = state->regs[sreg].offset;
+ tsr->lifetime_active = state->regs[sreg].lifetime_active;
+ tsr->lifetime_end = state->regs[sreg].lifetime_end;
+ tsr->ok = state->regs[sreg].ok;
+
+ if (tsr->kind == TSR_KIND_TYPE || tsr->kind == TSR_KIND_POINTER)
+ tsr->copied_from = sreg;
+
+ pr_debug_dtp("mov [%x] reg%d -> reg%d", insn_offset, sreg, dreg);
+ pr_debug_type_name(&tsr->type, tsr->kind);
+}
+
static void update_insn_state_arm64(struct type_state *state,
struct data_loc_info *dloc, Dwarf_Die *cu_die,
struct disasm_line *dl)
@@ -925,6 +975,9 @@ static void update_insn_state_arm64(struct type_state *state,
if (ins__is_call(&dl->ins))
update_call_insn_state(state, dloc, cu_die, dl);
+ /* Register to register or imm value to register transfers */
+ else if (!strcmp(dl->ins.name, "mov"))
+ update_mov_insn_state(state, dl, src, dst);
/* Memory to register transfers */
else if (is_standard_load_insn(dl->ins.name))
update_load_insn_state(state, dloc, dl, src, dst);
--
2.34.1
^ permalink raw reply related [flat|nested] 35+ messages in thread* Re: [PATCH v8 11/15] perf annotate-arm64: Support 'mov' instruction tracking
2026-10-20 13:45 ` [PATCH v8 11/15] perf annotate-arm64: Support 'mov' instruction tracking Tengda Wu
@ 2026-10-20 15:01 ` sashiko-bot
0 siblings, 0 replies; 35+ messages in thread
From: sashiko-bot @ 2026-10-20 15:01 UTC (permalink / raw)
To: Tengda Wu; +Cc: linux-perf-users
> Extend update_insn_state_arm64() to support register-to-register and
> immediate-to-register 'mov' instructions.
>
> For register-to-register 'mov' (e.g., mov dreg, sreg), propagate data type
> information from the source register to the destination register.
>
> For immediate-to-register 'mov' (e.g., mov dreg, #imm), store the immediate
> value in the destination register's imm_value field and set its kind to
> TSR_KIND_CONST, allowing subsequent instructions to resolve it as a
> constant.
>
> A real-world example is shown below:
>
> ffff8000803eebf8 <get_vma_policy>:
> ffff8000803eec20: mov x21, x0 // x0 (struct vm_area_struct*) -> x21
> [ ... ]
> final result: type='struct vm_area_struct' size=0xb0
>
> Reviewed-by: Ian Rogers <irogers@google.com>
> Reviewed-by: Namhyung Kim <namhyung@kernel.org>
> Signed-off-by: Tengda Wu <wutengda@huaweicloud.com>
Sashiko has reviewed this patch and found no issues.
--
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1792411435.git.wutengda@huaweicloud.com?part=11
^ permalink raw reply [flat|nested] 35+ messages in thread
* [PATCH v8 12/15] perf annotate-arm64: Support 'add' instruction tracking
2026-10-20 13:44 [PATCH v8 00/15] perf annotate arm64: Support instruction tracking for data type profiling Tengda Wu
` (10 preceding siblings ...)
2026-10-20 13:45 ` [PATCH v8 11/15] perf annotate-arm64: Support 'mov' instruction tracking Tengda Wu
@ 2026-10-20 13:45 ` Tengda Wu
2026-10-20 15:05 ` sashiko-bot
2026-10-20 13:45 ` [PATCH v8 13/15] perf annotate-arm64: Support 'adrp' instruction to track global variables Tengda Wu
` (3 subsequent siblings)
15 siblings, 1 reply; 35+ messages in thread
From: Tengda Wu @ 2026-10-20 13:45 UTC (permalink / raw)
To: Namhyung Kim, james.clark, xueshuai, Arnaldo Carvalho de Melo
Cc: Peter Zijlstra, leo.yan, Li Huafei, Ian Rogers, Kim Phillips,
Mark Rutland, Ingo Molnar, Bill Wendling, Nick Desaulniers,
Alexander Shishkin, Adrian Hunter, Zecheng Li, linux-perf-users,
linux-kernel, llvm, Tengda Wu
Extend update_insn_state_arm64() to track 'add' instructions for
structure member address calculation.
Unlike x86, the arm64 'add' instruction has an extra base register among
its source operands. Therefore, in terms of propagating the data type,
it is essentially performing a 'mov', except that before the 'mov', it
first needs to be updated by adding the offset or reg2.
A real-world example is shown below:
ffff80008001c9a8 <flush_ptrace_hw_breakpoint>:
ffff80008001c9c4: add x19, x0, #0xeb8 // x0 (task_struct*) + 0xeb8 -> x19
* ffff80008001c9d0: ldr x0, [x19]
Before this commit, the type flow broke at the 'add' instruction,
leaving the subsequent load with no type information:
chk [28] reg19 offset=0 ok=0 kind=0 cfa : no type information
final result: no type information
After this commit, the tracker correctly follows the member address
calculation:
var [0] reg0 offset 0 type='struct task_struct*'
add [1c] address of 0xeb8(reg0) -> reg19 type='struct task_struct*'
chk [28] reg19 offset=0 ok=1 kind=1 (struct task_struct*) : Good!
found by insn track: 0(reg19) type-offset=0xeb8
final result: type='struct task_struct'
Reviewed-by: Ian Rogers <irogers@google.com>
Reviewed-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Tengda Wu <wutengda@huaweicloud.com>
---
.../perf/util/annotate-arch/annotate-arm64.c | 70 +++++++++++++++++++
1 file changed, 70 insertions(+)
diff --git a/tools/perf/util/annotate-arch/annotate-arm64.c b/tools/perf/util/annotate-arch/annotate-arm64.c
index 38a9cb37c952..61df9c4f4877 100644
--- a/tools/perf/util/annotate-arch/annotate-arm64.c
+++ b/tools/perf/util/annotate-arch/annotate-arm64.c
@@ -959,6 +959,74 @@ static void update_mov_insn_state(struct type_state *state,
pr_debug_type_name(&tsr->type, tsr->kind);
}
+static void update_add_insn_state(struct type_state *state,
+ struct data_loc_info *dloc,
+ struct disasm_line *dl,
+ struct annotated_op_loc *src,
+ struct annotated_op_loc *dst)
+{
+ struct type_state_reg *tsr;
+ struct type_state_reg src_tsr;
+ u32 insn_offset = dl->al.offset;
+ int sreg = src->reg1;
+ int dreg = dst->reg1;
+ int reg_offset;
+
+ if (!has_reg_type(state, dreg))
+ return;
+
+ tsr = &state->regs[dreg];
+ tsr->copied_from = -1;
+ tsr->lifetime_active = false;
+ tsr->lifetime_end = 0;
+
+retry:
+ if (!has_reg_type(state, sreg) || !state->regs[sreg].ok) {
+ invalidate_reg_state(tsr);
+ return;
+ }
+
+ src_tsr = state->regs[sreg];
+
+ if (arch_get_reg_offset(dloc->arch, src, sreg, state, false, ®_offset))
+ goto add_non_regoff;
+
+ if (src_tsr.kind == TSR_KIND_CONST) {
+ tsr->kind = src_tsr.kind;
+ tsr->imm_value = src_tsr.imm_value + reg_offset;
+ tsr->offset = 0;
+ tsr->ok = src_tsr.ok;
+
+ pr_debug_dtp("add [%x] imm %#x(reg%d) -> reg%d\n",
+ insn_offset, reg_offset, sreg, dreg);
+ return;
+ }
+
+ if (src_tsr.kind == TSR_KIND_POINTER ||
+ (src_tsr.kind == TSR_KIND_TYPE &&
+ dwarf_tag(&src_tsr.type) == DW_TAG_pointer_type)) {
+ tsr->type = src_tsr.type;
+ tsr->kind = src_tsr.kind;
+ tsr->imm_value = src_tsr.imm_value;
+ tsr->offset = src_tsr.offset + reg_offset;
+ tsr->ok = src_tsr.ok;
+
+ pr_debug_dtp("add [%x] address of %#x(reg%d) -> reg%d",
+ insn_offset, reg_offset, sreg, dreg);
+ pr_debug_type_name(&tsr->type, tsr->kind);
+ return;
+ }
+
+add_non_regoff:
+ /* Try another register if any */
+ if (src->multi_regs && src->reg1 != src->reg2 && sreg != src->reg2 &&
+ !(src->extend_type || src->shift_type)) {
+ sreg = src->reg2;
+ goto retry;
+ }
+ invalidate_reg_state(tsr);
+}
+
static void update_insn_state_arm64(struct type_state *state,
struct data_loc_info *dloc, Dwarf_Die *cu_die,
struct disasm_line *dl)
@@ -975,6 +1043,8 @@ static void update_insn_state_arm64(struct type_state *state,
if (ins__is_call(&dl->ins))
update_call_insn_state(state, dloc, cu_die, dl);
+ else if (!strcmp(dl->ins.name, "add"))
+ update_add_insn_state(state, dloc, dl, src, dst);
/* Register to register or imm value to register transfers */
else if (!strcmp(dl->ins.name, "mov"))
update_mov_insn_state(state, dl, src, dst);
--
2.34.1
^ permalink raw reply related [flat|nested] 35+ messages in thread* Re: [PATCH v8 12/15] perf annotate-arm64: Support 'add' instruction tracking
2026-10-20 13:45 ` [PATCH v8 12/15] perf annotate-arm64: Support 'add' " Tengda Wu
@ 2026-10-20 15:05 ` sashiko-bot
0 siblings, 0 replies; 35+ messages in thread
From: sashiko-bot @ 2026-10-20 15:05 UTC (permalink / raw)
To: Tengda Wu; +Cc: linux-perf-users
> Extend update_insn_state_arm64() to track 'add' instructions for
> structure member address calculation.
>
> Unlike x86, the arm64 'add' instruction has an extra base register among
> its source operands. Therefore, in terms of propagating the data type,
> it is essentially performing a 'mov', except that before the 'mov', it
> first needs to be updated by adding the offset or reg2.
>
> A real-world example is shown below:
>
> ffff80008001c9a8 <flush_ptrace_hw_breakpoint>:
> ffff80008001c9c4: add x19, x0, #0xeb8 // x0 (task_struct*) + 0xeb8 -> x19
> * ffff80008001c9d0: ldr x0, [x19]
>
> Before this commit, the type flow broke at the 'add' instruction,
> [ ... ]
> final result: type='struct task_struct'
>
> Reviewed-by: Ian Rogers <irogers@google.com>
> Reviewed-by: Namhyung Kim <namhyung@kernel.org>
> Signed-off-by: Tengda Wu <wutengda@huaweicloud.com>
Sashiko has reviewed this patch and found no issues.
--
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1792411435.git.wutengda@huaweicloud.com?part=12
^ permalink raw reply [flat|nested] 35+ messages in thread
* [PATCH v8 13/15] perf annotate-arm64: Support 'adrp' instruction to track global variables
2026-10-20 13:44 [PATCH v8 00/15] perf annotate arm64: Support instruction tracking for data type profiling Tengda Wu
` (11 preceding siblings ...)
2026-10-20 13:45 ` [PATCH v8 12/15] perf annotate-arm64: Support 'add' " Tengda Wu
@ 2026-10-20 13:45 ` Tengda Wu
2026-10-20 15:15 ` sashiko-bot
2026-10-20 13:45 ` [PATCH v8 14/15] perf annotate-arm64: Support per-cpu variable access tracking Tengda Wu
` (2 subsequent siblings)
15 siblings, 1 reply; 35+ messages in thread
From: Tengda Wu @ 2026-10-20 13:45 UTC (permalink / raw)
To: Namhyung Kim, james.clark, xueshuai, Arnaldo Carvalho de Melo
Cc: Peter Zijlstra, leo.yan, Li Huafei, Ian Rogers, Kim Phillips,
Mark Rutland, Ingo Molnar, Bill Wendling, Nick Desaulniers,
Alexander Shishkin, Adrian Hunter, Zecheng Li, linux-perf-users,
linux-kernel, llvm, Tengda Wu
Extend update_insn_state_arm64() to track global variable types
calculated via page-relative addressing.
On arm64, global variables are typically accessed by first calculating
the page address using 'adrp', followed by an 'add' or 'ldr' to get the
specific symbol address. Without tracking 'adrp', the instruction
tracker loses the base address, making it impossible to resolve
global symbols and their associated DWARF types.
Introduce TSR_KIND_GLOBAL_ADDR to represent a partial global address
state. When encountering 'adrp', store the page-aligned target address
in the register's type state. Upon a subsequent 'add' or 'ldr'
instruction that references a TSR_KIND_GLOBAL_ADDR register, combine
the page address with the immediate offset.
A real-world example is shown below:
ffff80008032e008 <folios_put_refs>:
ffff80008032e048: adrp x24, ffff80008202f000 <nr_cpu_ids>
ffff80008032e050: add x24, x24, #0xd40
* ffff80008032e078: ldr x0, [x24]
Before this commit, x24 was unknown, leading to no type information:
chk [70] reg24 offset=0 ok=0 kind=0 cfa : no type information
final result: no type information
After this commit, the tracker correctly follows the adrp/add flow:
adrp [40] global addr=0xffff80008202f000 -> reg24
add [48] global 0xd40(reg24) -> reg24
chk [70] reg24 offset=0 ok=1 kind=7 global addr : Good!
final result: type='struct folio*'
Reviewed-by: Ian Rogers <irogers@google.com>
Reviewed-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Li Huafei <lihuafei1@huawei.com>
Signed-off-by: Tengda Wu <wutengda@huaweicloud.com>
---
.../perf/util/annotate-arch/annotate-arm64.c | 82 +++++++++++++++++--
tools/perf/util/annotate-data.c | 25 +++++-
tools/perf/util/annotate-data.h | 1 +
3 files changed, 99 insertions(+), 9 deletions(-)
diff --git a/tools/perf/util/annotate-arch/annotate-arm64.c b/tools/perf/util/annotate-arch/annotate-arm64.c
index 61df9c4f4877..bd060a823b76 100644
--- a/tools/perf/util/annotate-arch/annotate-arm64.c
+++ b/tools/perf/util/annotate-arch/annotate-arm64.c
@@ -613,7 +613,7 @@ static bool is_standard_load_insn(const char *name)
* which is added to the reg offset.
*/
static int propagate_load_reg_state(struct type_state *state,
- struct data_loc_info *dloc,
+ struct data_loc_info *dloc, Dwarf_Die *cu_die,
struct disasm_line *dl, int dreg,
struct annotated_op_loc *src,
struct type_state_reg **src_states,
@@ -722,6 +722,33 @@ static int propagate_load_reg_state(struct type_state *state,
return 0;
}
+ /* Or check if it's a global variable */
+ if (src_tsr->kind == TSR_KIND_GLOBAL_ADDR) {
+ u64 ip = dloc->ms->sym->start + dl->al.offset;
+ u64 addr = src_tsr->imm_value + reg_offset;
+ int offset;
+
+ if (!get_global_var_type(cu_die, dloc, ip, addr, &offset, &type_die) ||
+ !die_get_member_type(&type_die, offset, &type_die))
+ return -1;
+
+ tsr->type = type_die;
+ tsr->kind = TSR_KIND_TYPE;
+ tsr->offset = 0;
+ tsr->imm_value = 0;
+ tsr->ok = true;
+
+ if (src->multi_regs) {
+ pr_debug_dtp("%s [%x] global (reg%d, reg%d) -> reg%d",
+ dl->ins.name, insn_offset, src->reg1, src->reg2, dreg);
+ } else {
+ pr_debug_dtp("%s [%x] global (reg%d) -> reg%d",
+ dl->ins.name, insn_offset, sreg, dreg);
+ }
+ pr_debug_type_name(&tsr->type, tsr->kind);
+ return 0;
+ }
+
load_non_regoff:
/* Try another register if any */
if (src->multi_regs && src->reg1 != src->reg2 && sreg != src->reg2 &&
@@ -735,7 +762,7 @@ static int propagate_load_reg_state(struct type_state *state,
}
static void update_load_insn_state(struct type_state *state,
- struct data_loc_info *dloc,
+ struct data_loc_info *dloc, Dwarf_Die *cu_die,
struct disasm_line *dl,
struct annotated_op_loc *src,
struct annotated_op_loc *dst)
@@ -769,7 +796,7 @@ static void update_load_insn_state(struct type_state *state,
/* Handle the first destination register */
if (has_reg_type(state, dst->reg1)) {
- if (propagate_load_reg_state(state, dloc, dl, dst->reg1,
+ if (propagate_load_reg_state(state, dloc, cu_die, dl, dst->reg1,
src, src_states, mem_spacing))
invalidate_reg_state(&state->regs[dst->reg1]);
}
@@ -784,7 +811,7 @@ static void update_load_insn_state(struct type_state *state,
mem_spacing = arm64__reg_size(dl->ops.target.raw);
if (mem_spacing < 0 ||
- propagate_load_reg_state(state, dloc, dl, dst->reg2,
+ propagate_load_reg_state(state, dloc, cu_die, dl, dst->reg2,
src, src_states, mem_spacing))
invalidate_reg_state(&state->regs[dst->reg2]);
@@ -991,14 +1018,16 @@ static void update_add_insn_state(struct type_state *state,
if (arch_get_reg_offset(dloc->arch, src, sreg, state, false, ®_offset))
goto add_non_regoff;
- if (src_tsr.kind == TSR_KIND_CONST) {
+ if (src_tsr.kind == TSR_KIND_CONST || src_tsr.kind == TSR_KIND_GLOBAL_ADDR) {
tsr->kind = src_tsr.kind;
+ /* For 'adrp + add' pair: resolve the full global variable address. */
tsr->imm_value = src_tsr.imm_value + reg_offset;
tsr->offset = 0;
tsr->ok = src_tsr.ok;
- pr_debug_dtp("add [%x] imm %#x(reg%d) -> reg%d\n",
- insn_offset, reg_offset, sreg, dreg);
+ pr_debug_dtp("add [%x] %s %#x(reg%d) -> reg%d\n",
+ insn_offset, src_tsr.kind == TSR_KIND_CONST ?
+ "imm" : "global", reg_offset, sreg, dreg);
return;
}
@@ -1027,6 +1056,41 @@ static void update_add_insn_state(struct type_state *state,
invalidate_reg_state(tsr);
}
+static void update_adrp_insn_state(struct type_state *state,
+ struct disasm_line *dl,
+ struct annotated_op_loc *dst)
+{
+ struct type_state_reg *tsr;
+ u32 insn_offset = dl->al.offset;
+ int dreg = dst->reg1;
+
+ if (!has_reg_type(state, dreg))
+ return;
+
+ tsr = &state->regs[dreg];
+ tsr->copied_from = -1;
+
+ if (!dl->ops.source.addr) {
+ invalidate_reg_state(tsr);
+ return;
+ }
+
+ tsr->kind = TSR_KIND_GLOBAL_ADDR;
+ /*
+ * Stores a partial page-relative address. The full absolute address
+ * of the global variable will be resolved when a subsequent 'add' or
+ * 'ldr' instruction consumes this register.
+ */
+ tsr->imm_value = dl->ops.source.addr;
+ tsr->offset = 0;
+ tsr->lifetime_active = false;
+ tsr->lifetime_end = 0;
+ tsr->ok = true;
+
+ pr_debug_dtp("adrp [%x] global addr=%#"PRIx64" -> reg%d\n",
+ insn_offset, tsr->imm_value, dreg);
+}
+
static void update_insn_state_arm64(struct type_state *state,
struct data_loc_info *dloc, Dwarf_Die *cu_die,
struct disasm_line *dl)
@@ -1043,6 +1107,8 @@ static void update_insn_state_arm64(struct type_state *state,
if (ins__is_call(&dl->ins))
update_call_insn_state(state, dloc, cu_die, dl);
+ else if (!strcmp(dl->ins.name, "adrp"))
+ update_adrp_insn_state(state, dl, dst);
else if (!strcmp(dl->ins.name, "add"))
update_add_insn_state(state, dloc, dl, src, dst);
/* Register to register or imm value to register transfers */
@@ -1050,7 +1116,7 @@ static void update_insn_state_arm64(struct type_state *state,
update_mov_insn_state(state, dl, src, dst);
/* Memory to register transfers */
else if (is_standard_load_insn(dl->ins.name))
- update_load_insn_state(state, dloc, dl, src, dst);
+ update_load_insn_state(state, dloc, cu_die, dl, src, dst);
/* Register to memory transfers */
else if (is_standard_store_insn(dl->ins.name))
update_store_insn_state(state, dloc, dl, src, dst);
diff --git a/tools/perf/util/annotate-data.c b/tools/perf/util/annotate-data.c
index 1d47db3a9dd9..43cd09c0662a 100644
--- a/tools/perf/util/annotate-data.c
+++ b/tools/perf/util/annotate-data.c
@@ -71,6 +71,9 @@ void pr_debug_type_name(Dwarf_Die *die, enum type_state_kind kind)
case TSR_KIND_CANARY:
pr_info(" stack canary\n");
return;
+ case TSR_KIND_GLOBAL_ADDR:
+ pr_info(" global address\n");
+ return;
case TSR_KIND_TYPE:
default:
break;
@@ -723,7 +726,8 @@ void set_stack_state(struct type_state_stack *stack, int offset, u8 kind,
stack->kind = kind;
stack->imm_value = imm_value;
- if (kind == TSR_KIND_POINTER || kind == TSR_KIND_CONST) {
+ if (kind == TSR_KIND_POINTER || kind == TSR_KIND_CONST ||
+ kind == TSR_KIND_GLOBAL_ADDR) {
stack->compound = false;
return;
}
@@ -1474,6 +1478,25 @@ static enum type_match_result check_matching_type(struct type_state *state,
if (offset < 0 && reg != state->stack_reg && reg != dloc->fbreg)
goto check_kernel;
}
+
+ if (state->regs[reg].kind == TSR_KIND_GLOBAL_ADDR) {
+ u64 var_addr = state->regs[reg].imm_value + offset;
+ int var_offset;
+
+ pr_debug_dtp("global addr");
+
+ /*
+ * The register holds the address of a global variable. Try to
+ * find the variable by the address and get its type.
+ */
+ if (get_global_var_type(cu_die, dloc, dloc->ip, var_addr,
+ &var_offset, type_die)) {
+ dloc->type_offset = var_offset;
+ return PERF_TMR_OK;
+ }
+ /* No need to retry global variables */
+ return PERF_TMR_BAIL_OUT;
+ }
check_non_register:
if (reg == dloc->fbreg || reg == state->stack_reg) {
struct type_state_stack *stack;
diff --git a/tools/perf/util/annotate-data.h b/tools/perf/util/annotate-data.h
index 425d9ddfad41..eee1f8dae3dc 100644
--- a/tools/perf/util/annotate-data.h
+++ b/tools/perf/util/annotate-data.h
@@ -37,6 +37,7 @@ enum type_state_kind {
TSR_KIND_PERCPU_POINTER,
TSR_KIND_POINTER,
TSR_KIND_CANARY,
+ TSR_KIND_GLOBAL_ADDR,
};
/**
--
2.34.1
^ permalink raw reply related [flat|nested] 35+ messages in thread* Re: [PATCH v8 13/15] perf annotate-arm64: Support 'adrp' instruction to track global variables
2026-10-20 13:45 ` [PATCH v8 13/15] perf annotate-arm64: Support 'adrp' instruction to track global variables Tengda Wu
@ 2026-10-20 15:15 ` sashiko-bot
2026-10-21 2:07 ` Tengda Wu
0 siblings, 1 reply; 35+ messages in thread
From: sashiko-bot @ 2026-10-20 15:15 UTC (permalink / raw)
To: Tengda Wu; +Cc: linux-perf-users
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] perf annotate-arm64: adjust_reg_index_state() drops global addr writeback
--
commit 329d013c0c7d0b8be3fe8f0ec1e0f669451e6cbd
Author: Tengda Wu <wutengda@huaweicloud.com>
perf annotate-arm64: Support 'adrp' instruction to track global variables
This commit extends arm64 data type profiling to track global variable
addresses calculated via page-relative adrp instructions. It introduces
TSR_KIND_GLOBAL_ADDR to store the page-aligned base address and resolves
the symbol address and DWARF type on subsequent add or load instructions.
> diff --git a/tools/perf/util/annotate-arch/annotate-arm64.c b/tools/perf/util/annotate-arch/annotate-arm64.c
> index 61df9c4f48776..bd060a823b765 100644
> --- a/tools/perf/util/annotate-arch/annotate-arm64.c
> +++ b/tools/perf/util/annotate-arch/annotate-arm64.c
[ ... ]
> @@ -722,6 +722,33 @@ static int propagate_load_reg_state(struct type_state *state,
> return 0;
> }
>
> + /* Or check if it's a global variable */
> + if (src_tsr->kind == TSR_KIND_GLOBAL_ADDR) {
> + u64 ip = dloc->ms->sym->start + dl->al.offset;
> + u64 addr = src_tsr->imm_value + reg_offset;
> + int offset;
> +
> + if (!get_global_var_type(cu_die, dloc, ip, addr, &offset, &type_die) ||
> + !die_get_member_type(&type_die, offset, &type_die))
> + return -1;
[ ... ]
> @@ -991,14 +1018,16 @@ static void update_add_insn_state(struct type_state *state,
> if (arch_get_reg_offset(dloc->arch, src, sreg, state, false, ®_offset))
> goto add_non_regoff;
>
> - if (src_tsr.kind == TSR_KIND_CONST) {
> + if (src_tsr.kind == TSR_KIND_CONST || src_tsr.kind == TSR_KIND_GLOBAL_ADDR) {
> tsr->kind = src_tsr.kind;
> + /* For 'adrp + add' pair: resolve the full global variable address. */
> tsr->imm_value = src_tsr.imm_value + reg_offset;
> tsr->offset = 0;
> tsr->ok = src_tsr.ok;
[Severity: Medium]
What happens when a pre-indexed or post-indexed load or store instruction
(for example, ldr x0, [x19, #0x40]! or ldr x0, [x19], #8) uses a
TSR_KIND_GLOBAL_ADDR register as its base?
Both update_load_insn_state() and update_store_insn_state() call
adjust_reg_index_state(), which adds the writeback offset to tsr->offset:
tools/perf/util/annotate-arch/annotate-arm64.c:adjust_reg_index_state() {
...
if (arch_get_reg_offset(dloc->arch, op_loc, reg, state, true, &offset)) {
invalidate_reg_state(tsr);
return;
}
tsr->offset += offset;
...
}
However, TSR_KIND_GLOBAL_ADDR stores the base address in tsr->imm_value,
and all consumers — propagate_load_reg_state(), update_add_insn_state(),
and check_matching_type() in tools/perf/util/annotate-data.c — compute the
target address from imm_value + reg_offset while ignoring tsr->offset (and
update_add_insn_state() resets tsr->offset to 0).
Should adjust_reg_index_state() update tsr->imm_value (or should the
consumers include tsr->offset) so that pre/post-index writeback updates on
global address registers are not lost on subsequent instructions?
[ ... ]
--
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1792411435.git.wutengda@huaweicloud.com?part=13
^ permalink raw reply [flat|nested] 35+ messages in thread* Re: [PATCH v8 13/15] perf annotate-arm64: Support 'adrp' instruction to track global variables
2026-10-20 15:15 ` sashiko-bot
@ 2026-10-21 2:07 ` Tengda Wu
0 siblings, 0 replies; 35+ messages in thread
From: Tengda Wu @ 2026-10-21 2:07 UTC (permalink / raw)
To: sashiko-reviews; +Cc: linux-perf-users
On 2026/10/20 23:15, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Medium] perf annotate-arm64: adjust_reg_index_state() drops global addr writeback
> --
>
> commit 329d013c0c7d0b8be3fe8f0ec1e0f669451e6cbd
> Author: Tengda Wu <wutengda@huaweicloud.com>
>
> perf annotate-arm64: Support 'adrp' instruction to track global variables
>
> This commit extends arm64 data type profiling to track global variable
> addresses calculated via page-relative adrp instructions. It introduces
> TSR_KIND_GLOBAL_ADDR to store the page-aligned base address and resolves
> the symbol address and DWARF type on subsequent add or load instructions.
>
>> diff --git a/tools/perf/util/annotate-arch/annotate-arm64.c b/tools/perf/util/annotate-arch/annotate-arm64.c
>> index 61df9c4f48776..bd060a823b765 100644
>> --- a/tools/perf/util/annotate-arch/annotate-arm64.c
>> +++ b/tools/perf/util/annotate-arch/annotate-arm64.c
> [ ... ]
>> @@ -722,6 +722,33 @@ static int propagate_load_reg_state(struct type_state *state,
>> return 0;
>> }
>>
>> + /* Or check if it's a global variable */
>> + if (src_tsr->kind == TSR_KIND_GLOBAL_ADDR) {
>> + u64 ip = dloc->ms->sym->start + dl->al.offset;
>> + u64 addr = src_tsr->imm_value + reg_offset;
>> + int offset;
>> +
>> + if (!get_global_var_type(cu_die, dloc, ip, addr, &offset, &type_die) ||
>> + !die_get_member_type(&type_die, offset, &type_die))
>> + return -1;
> [ ... ]
>> @@ -991,14 +1018,16 @@ static void update_add_insn_state(struct type_state *state,
>> if (arch_get_reg_offset(dloc->arch, src, sreg, state, false, ®_offset))
>> goto add_non_regoff;
>>
>> - if (src_tsr.kind == TSR_KIND_CONST) {
>> + if (src_tsr.kind == TSR_KIND_CONST || src_tsr.kind == TSR_KIND_GLOBAL_ADDR) {
>> tsr->kind = src_tsr.kind;
>> + /* For 'adrp + add' pair: resolve the full global variable address. */
>> tsr->imm_value = src_tsr.imm_value + reg_offset;
>> tsr->offset = 0;
>> tsr->ok = src_tsr.ok;
>
> [Severity: Medium]
> What happens when a pre-indexed or post-indexed load or store instruction
> (for example, ldr x0, [x19, #0x40]! or ldr x0, [x19], #8) uses a
> TSR_KIND_GLOBAL_ADDR register as its base?
>
> Both update_load_insn_state() and update_store_insn_state() call
> adjust_reg_index_state(), which adds the writeback offset to tsr->offset:
>
> tools/perf/util/annotate-arch/annotate-arm64.c:adjust_reg_index_state() {
> ...
> if (arch_get_reg_offset(dloc->arch, op_loc, reg, state, true, &offset)) {
> invalidate_reg_state(tsr);
> return;
> }
>
> tsr->offset += offset;
> ...
> }
>
> However, TSR_KIND_GLOBAL_ADDR stores the base address in tsr->imm_value,
> and all consumers — propagate_load_reg_state(), update_add_insn_state(),
> and check_matching_type() in tools/perf/util/annotate-data.c — compute the
> target address from imm_value + reg_offset while ignoring tsr->offset (and
> update_add_insn_state() resets tsr->offset to 0).
>
> Should adjust_reg_index_state() update tsr->imm_value (or should the
> consumers include tsr->offset) so that pre/post-index writeback updates on
> global address registers are not lost on subsequent instructions?
>
> [ ... ]
>
The compiler does not combine them this way. The purpose of adrp + add is to
compute the full address of a global variable into a register, so that the
variable or its members can subsequently be accessed via [reg, #offset]. Once
the address has been computed, there is no reason to use a pre-/post-indexed
writeback on the same register, that would clobber the just-computed base
address and misalign all subsequent accesses to the global variable. Unless
there is some special compiler optimization?
In any case, I will keep it unchanged.
Thanks,
Tengda
^ permalink raw reply [flat|nested] 35+ messages in thread
* [PATCH v8 14/15] perf annotate-arm64: Support per-cpu variable access tracking
2026-10-20 13:44 [PATCH v8 00/15] perf annotate arm64: Support instruction tracking for data type profiling Tengda Wu
` (12 preceding siblings ...)
2026-10-20 13:45 ` [PATCH v8 13/15] perf annotate-arm64: Support 'adrp' instruction to track global variables Tengda Wu
@ 2026-10-20 13:45 ` Tengda Wu
2026-10-20 15:24 ` sashiko-bot
2026-10-20 13:45 ` [PATCH v8 15/15] perf annotate-arm64: Support 'mrs' instruction to track 'current' pointer Tengda Wu
2026-10-21 2:25 ` [PATCH v8 00/15] perf annotate arm64: Support instruction tracking for data type profiling Tengda Wu
15 siblings, 1 reply; 35+ messages in thread
From: Tengda Wu @ 2026-10-20 13:45 UTC (permalink / raw)
To: Namhyung Kim, james.clark, xueshuai, Arnaldo Carvalho de Melo
Cc: Peter Zijlstra, leo.yan, Li Huafei, Ian Rogers, Kim Phillips,
Mark Rutland, Ingo Molnar, Bill Wendling, Nick Desaulniers,
Alexander Shishkin, Adrian Hunter, Zecheng Li, linux-perf-users,
linux-kernel, llvm, Tengda Wu
Extend update_insn_state_arm64() to handle per-cpu variable addressing.
On arm64, per-cpu variables are accessed by adding a per-cpu offset
(typically from the '__per_cpu_offset' array) to the address of a global
variable or a structure field with '__percpu' modifier (e.g.,
's32 __percpu *counters' in struct percpu_counter). This results in
instruction patterns like:
ldr x0, [x6, x5] // Pattern A: direct load per-cpu instance
add x0, x6, x5 // Pattern B: compute per-cpu address
where x6 holds the per-cpu offset retrieved from:
adrp x4, <page>
add x4, x4, #offset // x4 = &__per_cpu_offset
ldr x6, [x4, w0, sxtw #3] // x6 = __per_cpu_offset[cpu]
And x5 holds the base address being offset, which can come from one of
two cases:
Case 1: global variable
adrp x5, <page>
add x5, x5, #offset // x5 = &global_var
Case 2: '__percpu' field embedded in a structure
ldr x5, [x25, #32] // x5 = &percpu_field
To handle such cases:
1. Identify per-cpu base initialization: Detect 'adrp + ldr' pairs that
resolve to the '__per_cpu_offset' symbol and mark the destination
register as TSR_KIND_PERCPU_BASE.
2. Propagate type information: During subsequent 'ldr' or 'add'
instructions, if one register is TSR_KIND_PERCPU_BASE, attempt to
resolve the type from the other register.
A real-world example is shown below:
ffff8000808f2d28 <cppc_set_perf>:
ffff8000808f2d38: adrp x2, ffff800082033000
ffff8000808f2d3c: add x5, x2, #0x3f8 // x5 = &__per_cpu_offset
ffff8000808f2d44: adrp x2, ffff800081f73000
ffff8000808f2d48: add x2, x2, #0x6b8 // x2 = &cpu_pcc_subspace_idx
ffff8000808f2d6c: ldr x5, [x5, w0, sxtw #3] // x5 = __per_cpu_offset[cpu]
* ffff8000808f2d80: ldr w23, [x5, x2] // per_cpu_var(cpu_pcc_subspace_idx)
Before this commit, the tracker could not link x5 back to a per-cpu
context, resulting in an incorrect data type resolution:
adrp [10] global addr=0xffff800082033000 -> reg2
add [14] global 0x3f8(reg2) -> reg5
adrp [1c] global addr=0xffff800081f73000 -> reg2
add [20] global 0x6b8(reg2) -> reg2
ldr [44] global (reg5, reg0) -> reg5 type='long unsigned int[]' size=0x1000
chk [58] reg5 offset=0 ok=1 kind=1 (long unsigned int[]) : Good!
found by insn track: 0(reg5, reg2) type-offset=0
final result: type='long unsigned int' size=0x8
After this commit, the tracker correctly identifies the per-cpu flow and
resolves the actual variable type:
ldr [44] global (reg5, reg0) -> reg5 percpu base
chk [58] reg5 offset=0 ok=1 kind=2 percpu var : retry
chk [58] reg2 offset=0 ok=1 kind=7 global addr : Good!
found by insn track: 0(reg5, reg2) type-offset=0
final result: type='int' size=0x4
Reviewed-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Tengda Wu <wutengda@huaweicloud.com>
---
.../perf/util/annotate-arch/annotate-arm64.c | 25 ++++++++++++-
tools/perf/util/annotate-data.c | 36 +++++++++++++++----
2 files changed, 54 insertions(+), 7 deletions(-)
diff --git a/tools/perf/util/annotate-arch/annotate-arm64.c b/tools/perf/util/annotate-arch/annotate-arm64.c
index bd060a823b76..270f35876511 100644
--- a/tools/perf/util/annotate-arch/annotate-arm64.c
+++ b/tools/perf/util/annotate-arch/annotate-arm64.c
@@ -12,6 +12,7 @@
#include "../disasm.h"
#include "../annotate-data.h"
#include "../debug.h"
+#include "../dso.h"
#include "../map.h"
#include "../symbol.h"
@@ -727,13 +728,23 @@ static int propagate_load_reg_state(struct type_state *state,
u64 ip = dloc->ms->sym->start + dl->al.offset;
u64 addr = src_tsr->imm_value + reg_offset;
int offset;
+ u8 kind;
+ const char *var_name = NULL;
+
+ /* it might be per-cpu offset */
+ if (dso__kernel(map__dso(dloc->ms->map)) &&
+ get_global_var_info(dloc, addr, &var_name, &offset) &&
+ !strcmp(var_name, "__per_cpu_offset"))
+ kind = TSR_KIND_PERCPU_BASE;
+ else
+ kind = TSR_KIND_TYPE;
if (!get_global_var_type(cu_die, dloc, ip, addr, &offset, &type_die) ||
!die_get_member_type(&type_die, offset, &type_die))
return -1;
tsr->type = type_die;
- tsr->kind = TSR_KIND_TYPE;
+ tsr->kind = kind;
tsr->offset = 0;
tsr->imm_value = 0;
tsr->ok = true;
@@ -749,6 +760,12 @@ static int propagate_load_reg_state(struct type_state *state,
return 0;
}
+ /*
+ * If src_tsr->kind is TSR_KIND_PERCPU_BASE, treat it as an array.
+ * No special handling is needed here; just fall through to retry
+ * and resolve the type from the second register.
+ */
+
load_non_regoff:
/* Try another register if any */
if (src->multi_regs && src->reg1 != src->reg2 && sreg != src->reg2 &&
@@ -1046,6 +1063,12 @@ static void update_add_insn_state(struct type_state *state,
return;
}
+ /*
+ * If src_tsr->kind is TSR_KIND_PERCPU_BASE, treat it as an array.
+ * No special handling is needed here; just fall through to retry
+ * and resolve the type from the second register.
+ */
+
add_non_regoff:
/* Try another register if any */
if (src->multi_regs && src->reg1 != src->reg2 && sreg != src->reg2 &&
diff --git a/tools/perf/util/annotate-data.c b/tools/perf/util/annotate-data.c
index 43cd09c0662a..b3de1ca688a2 100644
--- a/tools/perf/util/annotate-data.c
+++ b/tools/perf/util/annotate-data.c
@@ -1307,13 +1307,17 @@ int arch_get_reg_offset(const struct arch *arch, struct annotated_op_loc *op_loc
/*
* For register-based addressing without shift/extension,
- * reg2 may be a constant offset. Use its value as the offset
- * from the base register.
+ * derive the offset from the type of reg2.
*/
reg2 = op_loc->reg1 == breg ? op_loc->reg2 : op_loc->reg1;
- if (has_reg_type(state, reg2) && state->regs[reg2].ok &&
- state->regs[reg2].kind == TSR_KIND_CONST) {
- *offset = (s64)state->regs[reg2].imm_value;
+ if (has_reg_type(state, reg2) && state->regs[reg2].ok) {
+ if (state->regs[reg2].kind == TSR_KIND_CONST)
+ *offset = (s64)state->regs[reg2].imm_value;
+ else if (state->regs[reg2].kind == TSR_KIND_PERCPU_BASE)
+ *offset = 0; /* it does not contribute to the offset */
+ else
+ return -1;
+
return 0;
}
@@ -1448,11 +1452,31 @@ static enum type_match_result check_matching_type(struct type_state *state,
}
if (state->regs[reg].kind == TSR_KIND_PERCPU_BASE) {
- u64 var_addr = (s64) offset;
+ u64 var_addr;
int var_offset;
pr_debug_dtp("percpu var");
+ if (arch__is_arm64(dloc->arch)) {
+ int reg2;
+
+ if (!retry || !dloc->op->multi_regs ||
+ dloc->op->reg1 == dloc->op->reg2 ||
+ dloc->op->extend_type || dloc->op->shift_type)
+ return PERF_TMR_BAIL_OUT;
+
+ reg2 = dloc->op->reg2;
+ if (!has_reg_type(state, reg2) || !state->regs[reg2].ok)
+ return PERF_TMR_NO_TYPE;
+
+ pr_debug_dtp(" : retry\n");
+ retry = false;
+ reg = reg2;
+ goto again;
+ }
+
+ var_addr = (s64) offset;
+
if (dloc->op->multi_regs) {
int reg2 = dloc->op->reg2;
--
2.34.1
^ permalink raw reply related [flat|nested] 35+ messages in thread* Re: [PATCH v8 14/15] perf annotate-arm64: Support per-cpu variable access tracking
2026-10-20 13:45 ` [PATCH v8 14/15] perf annotate-arm64: Support per-cpu variable access tracking Tengda Wu
@ 2026-10-20 15:24 ` sashiko-bot
0 siblings, 0 replies; 35+ messages in thread
From: sashiko-bot @ 2026-10-20 15:24 UTC (permalink / raw)
To: Tengda Wu; +Cc: linux-perf-users
> Extend update_insn_state_arm64() to handle per-cpu variable addressing.
>
> On arm64, per-cpu variables are accessed by adding a per-cpu offset
> (typically from the '__per_cpu_offset' array) to the address of a global
> variable or a structure field with '__percpu' modifier (e.g.,
> 's32 __percpu *counters' in struct percpu_counter). This results in
> instruction patterns like:
>
> ldr x0, [x6, x5] // Pattern A: direct load per-cpu instance
> add x0, x6, x5 // Pattern B: compute per-cpu address
>
> where x6 holds the per-cpu offset retrieved from:
>
> adrp x4, <page>
> add x4, x4, #offset // x4 = &__per_cpu_offset
> [ ... ]
> found by insn track: 0(reg5, reg2) type-offset=0
> final result: type='int' size=0x4
>
> Reviewed-by: Namhyung Kim <namhyung@kernel.org>
> Signed-off-by: Tengda Wu <wutengda@huaweicloud.com>
Sashiko has reviewed this patch and found no issues.
--
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1792411435.git.wutengda@huaweicloud.com?part=14
^ permalink raw reply [flat|nested] 35+ messages in thread
* [PATCH v8 15/15] perf annotate-arm64: Support 'mrs' instruction to track 'current' pointer
2026-10-20 13:44 [PATCH v8 00/15] perf annotate arm64: Support instruction tracking for data type profiling Tengda Wu
` (13 preceding siblings ...)
2026-10-20 13:45 ` [PATCH v8 14/15] perf annotate-arm64: Support per-cpu variable access tracking Tengda Wu
@ 2026-10-20 13:45 ` Tengda Wu
2026-10-20 15:30 ` sashiko-bot
2026-10-21 2:25 ` [PATCH v8 00/15] perf annotate arm64: Support instruction tracking for data type profiling Tengda Wu
15 siblings, 1 reply; 35+ messages in thread
From: Tengda Wu @ 2026-10-20 13:45 UTC (permalink / raw)
To: Namhyung Kim, james.clark, xueshuai, Arnaldo Carvalho de Melo
Cc: Peter Zijlstra, leo.yan, Li Huafei, Ian Rogers, Kim Phillips,
Mark Rutland, Ingo Molnar, Bill Wendling, Nick Desaulniers,
Alexander Shishkin, Adrian Hunter, Zecheng Li, linux-perf-users,
linux-kernel, llvm, Tengda Wu
Extend update_insn_state_arm64() to handle the 'mrs' instruction,
enabling the tracking of the 'current' task pointer in the kernel.
On arm64, the kernel uses the 'sp_el0' system register to store the
address of the currently executing 'struct task_struct'. This is
typically accessed via the 'get_current()' inline function, resulting
in the instruction 'mrs xN, sp_el0'.
To resolve the data type of the target register, first verify the
access is to 'sp_el0' within a kernel DSO. Then, locate the
'get_current()' inline function's DWARF Die at the current PC and
extract its return type (which should be 'struct task_struct*').
A real-world example is shown below:
ffff8000800deee8 <kthread_blkcg>:
ffff8000800deef0: mrs x0, sp_el0 // x0 = current
* ffff8000800deef4: ldr w1, [x0, #44]
Before this commit, the type flow starts with no information:
chk [c] reg0 offset=0x2c ok=0 kind=0 cfa : no type information
final result: no type information
After this commit, the tracker identifies the 'current' pointer
from the system register:
mrs [8] sp_el0 -> reg0 type='struct task_struct*'
chk [c] reg0 offset=0x2c ok=1 kind=1 (struct task_struct*) : Good!
found by insn track: 0x2c(reg0) type-offset=0x2c
final result: type='struct task_struct'
Reviewed-by: Ian Rogers <irogers@google.com>
Reviewed-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Li Huafei <lihuafei1@huawei.com>
Signed-off-by: Tengda Wu <wutengda@huaweicloud.com>
---
.../perf/util/annotate-arch/annotate-arm64.c | 71 +++++++++++++++++++
1 file changed, 71 insertions(+)
diff --git a/tools/perf/util/annotate-arch/annotate-arm64.c b/tools/perf/util/annotate-arch/annotate-arm64.c
index 270f35876511..81369ae47290 100644
--- a/tools/perf/util/annotate-arch/annotate-arm64.c
+++ b/tools/perf/util/annotate-arch/annotate-arm64.c
@@ -4,6 +4,7 @@
#include <inttypes.h>
#include <stdlib.h>
#include <string.h>
+#include <strings.h>
#include <linux/ctype.h>
#include <linux/string.h>
#include <linux/zalloc.h>
@@ -15,6 +16,7 @@
#include "../dso.h"
#include "../map.h"
#include "../symbol.h"
+#include "../strbuf.h"
struct arch_arm64 {
struct arch arch;
@@ -1114,6 +1116,73 @@ static void update_adrp_insn_state(struct type_state *state,
insn_offset, tsr->imm_value, dreg);
}
+static void update_mrs_insn_state(struct type_state *state,
+ struct data_loc_info *dloc, Dwarf_Die *cu_die,
+ struct disasm_line *dl,
+ struct annotated_op_loc *dst)
+{
+ struct type_state_reg *tsr;
+ Dwarf_Die type_die;
+ u32 insn_offset = dl->al.offset;
+ int dreg = dst->reg1;
+ Dwarf_Die func_die;
+ Dwarf_Attribute attr;
+ u64 ip, pc;
+ struct strbuf sb;
+ char *type_name;
+
+ if (!has_reg_type(state, dreg))
+ return;
+
+ tsr = &state->regs[dreg];
+ tsr->copied_from = -1;
+
+ /* Handle case difference: LLVM (SP_EL0) vs objdump (sp_el0) */
+ if (!dso__kernel(map__dso(dloc->ms->map)) ||
+ strcasecmp(dl->ops.source.raw, "sp_el0")) {
+ invalidate_reg_state(tsr);
+ return;
+ }
+
+ ip = dloc->ms->sym->start + dl->al.offset;
+ pc = map__rip_2objdump(dloc->ms->map, ip);
+
+ /*
+ * Find the inline function 'get_current()' Dwarf_Die and obtain its
+ * return value data type, which should be 'struct task_struct*'.
+ */
+ if (!die_find_inlinefunc(cu_die, pc, &func_die) ||
+ !die_compare_name(&func_die, "get_current") ||
+ !dwarf_attr_integrate(&func_die, DW_AT_type, &attr) ||
+ !dwarf_formref_die(&attr, &type_die)) {
+ invalidate_reg_state(tsr);
+ return;
+ }
+
+ strbuf_init(&sb, 32);
+ die_get_typename_from_type(&type_die, &sb);
+ type_name = strbuf_detach(&sb, NULL);
+
+ if (!type_name || strcmp(type_name, "struct task_struct*")) {
+ invalidate_reg_state(tsr);
+ goto out_free;
+ }
+
+ tsr->type = type_die;
+ tsr->kind = TSR_KIND_TYPE;
+ tsr->offset = 0;
+ tsr->imm_value = 0;
+ tsr->lifetime_active = false;
+ tsr->lifetime_end = 0;
+ tsr->ok = true;
+
+ pr_debug_dtp("mrs [%x] sp_el0 -> reg%d", insn_offset, dreg);
+ pr_debug_type_name(&type_die, tsr->kind);
+
+out_free:
+ free(type_name);
+}
+
static void update_insn_state_arm64(struct type_state *state,
struct data_loc_info *dloc, Dwarf_Die *cu_die,
struct disasm_line *dl)
@@ -1130,6 +1199,8 @@ static void update_insn_state_arm64(struct type_state *state,
if (ins__is_call(&dl->ins))
update_call_insn_state(state, dloc, cu_die, dl);
+ else if (!strcmp(dl->ins.name, "mrs"))
+ update_mrs_insn_state(state, dloc, cu_die, dl, dst);
else if (!strcmp(dl->ins.name, "adrp"))
update_adrp_insn_state(state, dl, dst);
else if (!strcmp(dl->ins.name, "add"))
--
2.34.1
^ permalink raw reply related [flat|nested] 35+ messages in thread* Re: [PATCH v8 15/15] perf annotate-arm64: Support 'mrs' instruction to track 'current' pointer
2026-10-20 13:45 ` [PATCH v8 15/15] perf annotate-arm64: Support 'mrs' instruction to track 'current' pointer Tengda Wu
@ 2026-10-20 15:30 ` sashiko-bot
0 siblings, 0 replies; 35+ messages in thread
From: sashiko-bot @ 2026-10-20 15:30 UTC (permalink / raw)
To: Tengda Wu; +Cc: linux-perf-users
> Extend update_insn_state_arm64() to handle the 'mrs' instruction,
> enabling the tracking of the 'current' task pointer in the kernel.
>
> On arm64, the kernel uses the 'sp_el0' system register to store the
> address of the currently executing 'struct task_struct'. This is
> typically accessed via the 'get_current()' inline function, resulting
> in the instruction 'mrs xN, sp_el0'.
>
> To resolve the data type of the target register, first verify the
> access is to 'sp_el0' within a kernel DSO. Then, locate the
> 'get_current()' inline function's DWARF Die at the current PC and
> extract its return type (which should be 'struct task_struct*').
>
> A real-world example is shown below:
>
> [ ... ]
>
> Reviewed-by: Ian Rogers <irogers@google.com>
> Reviewed-by: Namhyung Kim <namhyung@kernel.org>
> Signed-off-by: Li Huafei <lihuafei1@huawei.com>
> Signed-off-by: Tengda Wu <wutengda@huaweicloud.com>
Sashiko has reviewed this patch and found no issues.
--
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1792411435.git.wutengda@huaweicloud.com?part=15
^ permalink raw reply [flat|nested] 35+ messages in thread
* Re: [PATCH v8 00/15] perf annotate arm64: Support instruction tracking for data type profiling
2026-10-20 13:44 [PATCH v8 00/15] perf annotate arm64: Support instruction tracking for data type profiling Tengda Wu
` (14 preceding siblings ...)
2026-10-20 13:45 ` [PATCH v8 15/15] perf annotate-arm64: Support 'mrs' instruction to track 'current' pointer Tengda Wu
@ 2026-10-21 2:25 ` Tengda Wu
2026-10-23 21:10 ` Arnaldo Carvalho de Melo
15 siblings, 1 reply; 35+ messages in thread
From: Tengda Wu @ 2026-10-21 2:25 UTC (permalink / raw)
To: Namhyung Kim, james.clark, xueshuai, Arnaldo Carvalho de Melo
Cc: Peter Zijlstra, leo.yan, Li Huafei, Ian Rogers, Kim Phillips,
Mark Rutland, Ingo Molnar, Bill Wendling, Nick Desaulniers,
Alexander Shishkin, Adrian Hunter, Zecheng Li, linux-perf-users,
linux-kernel, llvm
Hi,
On 2026/10/20 21:44, Tengda Wu wrote:
> This series adds arm64 support to perf's data type profiling by
> implementing instruction tracking for the arm64 architecture.
>
> The main changes since v7 include:
> v7: https://lore.kernel.org/all/cover.1791629326.git.wutengda@huaweicloud.com/
>
> * Patch 02: Minor optimizations to update_insn_state_arm64 to facilitate
> future extension, including:
> - Encapsulating call instruction handling into update_call_insn_state()
> - Encapsulating invalidate dst regs handling into invalidate_unhandled_insn_regs()
> - Renaming is_readonly_branch_or_cmp() to is_readonly_insn()
> No functional changes.
>
> * Fix issues raised by Sashiko:
> - Patch 06: Complete the status register invalidation logic for
> exclusive stores.
> - Patch 13 & 15: Complete the lifetime invalidation logic for adrp
> and mrs instructions.
> Regarding the status register invalidation issue for instructions
> such as cas/swp as well, we plan to support this incrementally
> after the relevant instructions are refined; this patch temporarily
> ignores and does not handle it (a TODO marker has already been
> reserved in patch 02)
>
> Patch organization
> ==================
>
> Patches 1-3: Shared infrastructure. Extract invalidate_reg_state() as
> a common helper, add the arch_get_reg_offset() helper for
> computing operand base offsets, and wire up the arm64
> entry points (arch_supports_insn_tracking(),
> init_type_state(), and update_insn_state_arm64()).
>
> Patches 4-6: Core instruction tracking for arm64: function return
> types after calls, load instructions (ldr/ldp and their
> addressing modes), and store instructions (str/stp).
>
> Patches 7-9: Shared data structure improvements and an x86 fix.
> Expand type_state_reg.imm_value to u64 so 64-bit
> addresses can be tracked, preserve imm_value for stack
> variables, and delete stale stack state on store of an
> untracked register on x86.
>
> Patches 10-15: Remaining arm64 patterns: stack variable tracking,
> 'mov' (register and immediate forms), 'add' member
> address calculation, 'adrp' global variable tracking,
> per-cpu variable access, and 'mrs sp_el0' to resolve the
> 'current' pointer.
>
Just a quick note that this version of the patch series has addressed or
clarified all the Sashiko review comments. I would appreciate it if you
could take a look when you get a chance.
Thanks,
Tengda
> Each patch's type profiling results are as follows:
>
> Patch | Feature | no_sym | no_var | no_typeinfo | bad_offset | insn_track | ok(%)
> ------+----------------------------+--------+--------+-------------+------------+------------+------
> base | baseline | 6 | 493 | - | - | - | 56.2%
> 0002 | enable insn tracking | 6 | 42 | 437 | 2 | 12 | 57.2%
> 0005 | support 'load' insn | 6 | 42 | 398 | 1 | 52 | 60.7%
> 0006 | support 'store' insn | 6 | 42 | 398 | 1 | 52 | 60.7%
> 0010 | support stack variable | 6 | 42 | 391 | 1 | 59 | 61.3%
> 0011 | support 'mov' insn | 6 | 42 | 372 | 3 | 76 | 62.8%
> 0012 | support 'add' insn | 6 | 42 | 318 | 7 | 126 | 67.2%
> 0013 | support 'adrp' insn | 6 | 42 | 238 | 8 | 205 | 74.2%
> 0014 | support per-cpu variable | 6 | 42 | 233 | 8 | 210 | 74.6%
> 0015 | support 'mrs' insn | 6 | 42 | 230 | 8 | 213 | 74.9%
>
> Testing
> =======
>
> Tested on arm64 (all passed):
>
> # perf test -v "perf data type profiling tests"
> 81: perf data type profiling tests : Ok
>
> === Test Summary ===
> Passed main tests : 1
> Passed subtests : 0
> Skipped tests : 0
> Failed tests : 0
>
> Tested on x86. The profiling results show no change before/after applying
> this patch series:
>
> before : total 880, ok 711 (80.8%), bad 169 (19.2%)
> after : total 880, ok 711 (80.8%), bad 169 (19.2%)
>
> Changelog
> =========
> v7 -> v8:
> - v7: https://lore.kernel.org/all/cover.1791629326.git.wutengda@huaweicloud.com/
> - Encapsulate invalidate dst regs handling into invalidate_unhandled_insn_regs()
> - Encapsulate invalidate dst regs handling into invalidate_unhandled_insn_regs()
> - Rename is_readonly_branch_or_cmp() to is_readonly_insn()
> - Complete the status register invalidation logic for exclusive stores.
> - Complete the lifetime invalidation logic for adrp and mrs instructions.
> v6 -> v7:
> - v6: https://lore.kernel.org/all/cover.1789521520.git.wutengda@huaweicloud.com/
> - Invalidate lifetime in propagate_load_reg_state().
> - Remove the has_reg_type() guard in update_store_insn_state().
> - Fix the issue where TSR_KIND_PERCPU_BASE fails to retry as expected.
>
> Please let me know if you have any feedback.
>
> Thanks,
> Tengda
>
> Tengda Wu (15):
> perf annotate-data: Extract invalidate_reg_state() as a common helper
> perf annotate-arm64: Enable instruction tracking support
> perf annotate-data: Add arch_get_reg_offset helper
> perf annotate-arm64: Track return type after call instructions
> perf annotate-arm64: Support load instruction tracking
> perf annotate-arm64: Support store instruction tracking
> perf annotate-data: Expand type_state_reg imm_value to u64
> perf annotate-data: Track imm_value for stack variables
> perf annotate-x86: Delete stale stack state on store of untracked
> register
> perf annotate-arm64: Support stack variable tracking
> perf annotate-arm64: Support 'mov' instruction tracking
> perf annotate-arm64: Support 'add' instruction tracking
> perf annotate-arm64: Support 'adrp' instruction to track global
> variables
> perf annotate-arm64: Support per-cpu variable access tracking
> perf annotate-arm64: Support 'mrs' instruction to track 'current'
> pointer
>
> .../perf/util/annotate-arch/annotate-arm64.c | 774 ++++++++++++++++++
> tools/perf/util/annotate-arch/annotate-x86.c | 38 +-
> tools/perf/util/annotate-data.c | 209 ++++-
> tools/perf/util/annotate-data.h | 14 +-
> 4 files changed, 987 insertions(+), 48 deletions(-)
>
>
> base-commit: 2efb7a11f1aa4d2dc285fe2680cca22cb9f72f64
^ permalink raw reply [flat|nested] 35+ messages in thread* Re: [PATCH v8 00/15] perf annotate arm64: Support instruction tracking for data type profiling
2026-10-21 2:25 ` [PATCH v8 00/15] perf annotate arm64: Support instruction tracking for data type profiling Tengda Wu
@ 2026-10-23 21:10 ` Arnaldo Carvalho de Melo
0 siblings, 0 replies; 35+ messages in thread
From: Arnaldo Carvalho de Melo @ 2026-10-23 21:10 UTC (permalink / raw)
To: Tengda Wu
Cc: Namhyung Kim, james.clark, xueshuai, Peter Zijlstra, leo.yan,
Li Huafei, Ian Rogers, Kim Phillips, Mark Rutland, Ingo Molnar,
Bill Wendling, Nick Desaulniers, Alexander Shishkin,
Adrian Hunter, Zecheng Li, linux-perf-users, linux-kernel, llvm
On Wed, Oct 21, 2026 at 10:25:40AM +0800, Tengda Wu wrote:
> Hi,
>
> On 2026/10/20 21:44, Tengda Wu wrote:
> > This series adds arm64 support to perf's data type profiling by
> > implementing instruction tracking for the arm64 architecture.
> >
> > The main changes since v7 include:
> > v7: https://lore.kernel.org/all/cover.1791629326.git.wutengda@huaweicloud.com/
> >
> > * Patch 02: Minor optimizations to update_insn_state_arm64 to facilitate
> > future extension, including:
> > - Encapsulating call instruction handling into update_call_insn_state()
> > - Encapsulating invalidate dst regs handling into invalidate_unhandled_insn_regs()
> > - Renaming is_readonly_branch_or_cmp() to is_readonly_insn()
> > No functional changes.
> >
> > * Fix issues raised by Sashiko:
> > - Patch 06: Complete the status register invalidation logic for
> > exclusive stores.
> > - Patch 13 & 15: Complete the lifetime invalidation logic for adrp
> > and mrs instructions.
> > Regarding the status register invalidation issue for instructions
> > such as cas/swp as well, we plan to support this incrementally
> > after the relevant instructions are refined; this patch temporarily
> > ignores and does not handle it (a TODO marker has already been
> > reserved in patch 02)
> >
> > Patch organization
> > ==================
> >
> > Patches 1-3: Shared infrastructure. Extract invalidate_reg_state() as
> > a common helper, add the arch_get_reg_offset() helper for
> > computing operand base offsets, and wire up the arm64
> > entry points (arch_supports_insn_tracking(),
> > init_type_state(), and update_insn_state_arm64()).
> >
> > Patches 4-6: Core instruction tracking for arm64: function return
> > types after calls, load instructions (ldr/ldp and their
> > addressing modes), and store instructions (str/stp).
> >
> > Patches 7-9: Shared data structure improvements and an x86 fix.
> > Expand type_state_reg.imm_value to u64 so 64-bit
> > addresses can be tracked, preserve imm_value for stack
> > variables, and delete stale stack state on store of an
> > untracked register on x86.
> >
> > Patches 10-15: Remaining arm64 patterns: stack variable tracking,
> > 'mov' (register and immediate forms), 'add' member
> > address calculation, 'adrp' global variable tracking,
> > per-cpu variable access, and 'mrs sp_el0' to resolve the
> > 'current' pointer.
> >
>
> Just a quick note that this version of the patch series has addressed or
> clarified all the Sashiko review comments. I would appreciate it if you
> could take a look when you get a chance.
Merged now, test built and pushed to perf-tools-next/perf-tools-next for
further build testing with linux-next, early next week I intend to push
it out to Linus for 7.4.
- Arnaldo
^ permalink raw reply [flat|nested] 35+ messages in thread