[PATCH v1 0/12] perf coverage: A harness for perf, and the fixes it found

[PATCH v1 0/12] perf coverage: A harness for perf, and the fixes it found

[Arnaldo Carvalho de Melo]

From: Arnaldo Carvalho de Melo <acme@redhat.com>

Hi,

	Please consider merging,

Nothing measured how much of perf the test suite reaches.  Patch 1 adds
tools/perf/scripts/coverage.sh: it builds perf with clang source based
coverage, runs the complete perf test suite and reports line and function
coverage, optionally against a baseline, with --table and --html like
pahole's coverage_table.py.  Also as 'make -C tools/perf coverage',
'coverage-prep' and 'coverage-table'.

The rest is what the first runs found, in the code, the build and the
tests:

  - clang DWARF 5 describes globals with DW_OP_addrx, which was not
    resolved (patch 2).
  - The flexible array member had no test; one showed the struct row at
    0.00% while the member said 100.00% (patches 3-4).
  - A struct pointer that -O2 keeps in a register was not resolved from
    its DWARF location (patch 5).
  - --insn-stat was printed before the loop that accounts the samples,
    so --code-with-type showed zeros (patch 6).
  - The libbfd probe printed a missing bfd.h error five times per
    build-test run (patch 7).
  - FEATURE-DUMP didn't record llvm-perf and rust, disabling both in the
    build-test builds (patch 8).
  - GCC 16 caught an uninitialized T32 instruction buffer read in cs-etm
    (patch 9).
  - The Intel PT virtual LBR check lost every aux sample with a single
    data page (patch 10).
  - The dlfilter test kept samples whose IP the kernel now zeroes on a
    userspace-to-kernel skid (patch 11).
  - The LBR inline unwinding check failed instead of skipping when the
    AMD PMU rejects branch sampling (patch 12).

In a root run on this box the suite covered 49.16% of perf's 201,180
lines; three tests failed in code this series does not change (the
POLL_HUP tracepoint regression, the AMD BRS branch sampling rejection
and the lock contention count).

The harness and the tests were developed with an AI coding assistant
(OpenCode), which drafted the script and the tests and helped debug the
failures; I reviewed every change and reproduced each failure before
fixing it.

Best regards,

- Arnaldo

Arnaldo Carvalho de Melo (12):
  perf scripts: Add a coverage harness for perf
  perf annotate-data: Resolve DW_OP_addrx global variables
  perf tests: Exercise the flexible array member path
  perf annotate-data: Count flexible array accesses for the whole struct
  perf tests: Exercise data type resolution from a register
  perf annotate: Print the stats after the annotations
  perf tests: Silence the libbfd probe in build-test
  perf build: Record the display-only features in FEATURE-DUMP
  perf cs-etm: Fall back to the recorded instruction size on a failed read
  perf tests: Fix the Intel PT virtual LBR check
  perf test: Drop samples without an IP in the dlfilter test
  perf test: Skip the LBR inline unwinding check when unsupported

 tools/perf/.gitignore                         |   1 +
 tools/perf/Makefile                           |  11 +-
 tools/perf/Makefile.config                    |   4 +
 tools/perf/Makefile.perf                      |   4 +
 tools/perf/builtin-annotate.c                 |  10 +-
 tools/perf/scripts/coverage.sh                | 703 ++++++++++++++++++
 tools/perf/tests/make                         |   2 +-
 tools/perf/tests/shell/addr2line_inlines.sh   |   9 +-
 tools/perf/tests/shell/annotate_stats.sh      |  58 ++
 .../perf/tests/shell/data_type_flex_array.sh  | 142 ++++
 .../tests/shell/data_type_profiling_clang.sh  | 108 +++
 tools/perf/tests/shell/data_type_register.sh  | 120 +++
 tools/perf/tests/shell/script_dlfilter.sh     |   2 +-
 tools/perf/tests/shell/test_intel_pt.sh       |   9 +-
 tools/perf/util/annotate-data.c               |  24 +-
 tools/perf/util/cs-etm.c                      |   7 +-
 tools/perf/util/dwarf-aux.c                   |  42 +-
 17 files changed, 1234 insertions(+), 22 deletions(-)
 create mode 100755 tools/perf/scripts/coverage.sh
 create mode 100755 tools/perf/tests/shell/annotate_stats.sh
 create mode 100755 tools/perf/tests/shell/data_type_flex_array.sh
 create mode 100755 tools/perf/tests/shell/data_type_profiling_clang.sh
 create mode 100755 tools/perf/tests/shell/data_type_register.sh


base-commit: cc905a18a647a8e3ad42cd1596baa0e08fba26eb
-- 
2.56.0

[PATCH v1 09/12] perf cs-etm: Fall back to the recorded instruction size on a failed read

[Arnaldo Carvalho de Melo]

From: Arnaldo Carvalho de Melo <acme@redhat.com>

cs_etm__t32_instr_size() reads the instruction bytes from the traced
program's memory to tell a 16-bit from a 32-bit T32 instruction, but it
ignores cs_etm__frontend_mem_access() failing, which happens when the
DSO or its debug data is missing, and then reads the uninitialized
buffer.  GCC 16 warns about it and build-test fails with -Werror.

Use the instruction size recorded by the decoder, as the A32/A64 path
already does, when the read doesn't return the full two bytes.

Fixes: a7ee4d625ede4f62 ("perf cs-etm: Support for ARM A32/T32 instruction sets in CoreSight trace")
Cc: James Clark <james.clark@linaro.org>
Cc: Leo Yan <leo.yan@arm.com>
Cc: Mike Leach <mike.leach@arm.com>
Cc: Robert Walker <robert.walker@arm.com>
Cc: Suzuki K Poulose <suzuki.poulose@arm.com>
Cc: coresight@lists.linaro.org
Cc: linux-arm-kernel@lists.infradead.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
---
 tools/perf/util/cs-etm.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c
index 3e01b401ca6f3a08..5d53ed74ae8835a9 100644
--- a/tools/perf/util/cs-etm.c
+++ b/tools/perf/util/cs-etm.c
@@ -1370,9 +1370,12 @@ static inline int cs_etm__t32_instr_size(struct cs_etm_queue *etmq,
 					 struct cs_etm_packet *packet, u64 addr)
 {
 	u8 instrBytes[2];
+	u32 len;
 
-	cs_etm__frontend_mem_access(etmq, tidq, packet, addr,
-				    ARRAY_SIZE(instrBytes), instrBytes);
+	len = cs_etm__frontend_mem_access(etmq, tidq, packet, addr,
+					  ARRAY_SIZE(instrBytes), instrBytes);
+	if (len != ARRAY_SIZE(instrBytes))
+		return packet->last_instr_size;
 	/*
 	 * T32 instruction size is indicated by bits[15:11] of the first
 	 * 16-bit word of the instruction: 0b11101, 0b11110 and 0b11111
-- 
2.56.0

Re: [PATCH v1 09/12] perf cs-etm: Fall back to the recorded instruction size on a failed read

[Leo Yan]

Hi Arnaldo,

On Fri, Nov 13, 2026 at 12:05:50PM -0300, Arnaldo Carvalho de Melo wrote:
> From: Arnaldo Carvalho de Melo <acme@redhat.com>
> 
> cs_etm__t32_instr_size() reads the instruction bytes from the traced
> program's memory to tell a 16-bit from a 32-bit T32 instruction, but it
> ignores cs_etm__frontend_mem_access() failing, which happens when the
> DSO or its debug data is missing, and then reads the uninitialized
> buffer.  GCC 16 warns about it and build-test fails with -Werror.
> 
> Use the instruction size recorded by the decoder, as the A32/A64 path
> already does, when the read doesn't return the full two bytes.

This patch is duplicate with:

https://lore.kernel.org/linux-perf-users/20261113-perf_fix_gcc15_failure-v1-0-eae592c5ff64@arm.com/T/#m5f610e381705bc587a9ce3d31be4e1e0ed595506

I prefer that one, it handle cs_etm__frontend_mem_access() failure
throughly.

Re: [PATCH v1 09/12] perf cs-etm: Fall back to the recorded instruction size on a failed read

[Arnaldo Carvalho de Melo]

On Fri, Nov 13, 2026 at 03:15:49PM +0000, Leo Yan wrote:
> Hi Arnaldo,
> 
> On Fri, Nov 13, 2026 at 12:05:50PM -0300, Arnaldo Carvalho de Melo wrote:
> > From: Arnaldo Carvalho de Melo <acme@redhat.com>
> > 
> > cs_etm__t32_instr_size() reads the instruction bytes from the traced
> > program's memory to tell a 16-bit from a 32-bit T32 instruction, but it
> > ignores cs_etm__frontend_mem_access() failing, which happens when the
> > DSO or its debug data is missing, and then reads the uninitialized
> > buffer.  GCC 16 warns about it and build-test fails with -Werror.
> > 
> > Use the instruction size recorded by the decoder, as the A32/A64 path
> > already does, when the read doesn't return the full two bytes.
> 
> This patch is duplicate with:
> 
> https://lore.kernel.org/linux-perf-users/20261113-perf_fix_gcc15_failure-v1-0-eae592c5ff64@arm.com/T/#m5f610e381705bc587a9ce3d31be4e1e0ed595506
> 
> I prefer that one, it handle cs_etm__frontend_mem_access() failure
> throughly.

Ok, I'll replace it with yours,

- Arnaldo