Re: [PATCH v3 19/21] perf annotate-arm64: Support 'adrp' instruction to track global variables

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Stale `type` field in register state causes `TSR_KIND_GLOBAL_ADDR` to be corrupted across stack spills.
--

commit ddfb698eef878cf476210d72e082d8b79c811ecd
Author: Tengda Wu <wutengda@huaweicloud.com>

perf annotate-arm64: Support 'adrp' instruction to track global variables

This patch extends update_insn_state() for arm64 to track global variable
types calculated via page-relative addressing. It introduces
TSR_KIND_GLOBAL_ADDR to represent the partial page-aligned target address
produced by adrp instructions. The address is later combined with the offset
from a subsequent add or ldr instruction to resolve the variable's type.

> diff --git a/tools/perf/util/annotate-arch/annotate-arm64.c b/tools/perf/util/annotate-arch/annotate-arm64.c
> index 1fed188117192..6f96e75d313dd 100644
> --- a/tools/perf/util/annotate-arch/annotate-arm64.c
> +++ b/tools/perf/util/annotate-arch/annotate-arm64.c
[ ... ]
> @@ -656,8 +700,37 @@ static void update_add_insn_state(struct type_state *state,
>  	}
>  }
>  
> +static void update_adrp_insn_state(struct type_state *state,
> +				   struct disasm_line *dl,
> +				   struct annotated_op_loc *dst)
> +{
> +	struct type_state_reg *tsr;
> +	u32 insn_offset = dl->al.offset;
> +	int dreg = dst->reg1;
> +
> +	if (!has_reg_type(state, dreg))
> +		return;
> +
> +	tsr = &state->regs[dreg];
> +	tsr->copied_from = -1;
> +
> +	if (!dl->ops.source.addr) {
> +		invalidate_reg_state(tsr);
> +		return;
> +	}
> +
> +	tsr->kind = TSR_KIND_GLOBAL_ADDR;
> +	/* Partial page-relative address, finalized in next 'add/ldr' */
> +	tsr->addr = dl->ops.source.addr;
> +	tsr->offset = 0;
> +	tsr->ok = true;

[Severity: Medium]
Does this leave tsr->type containing a stale Dwarf_Die?

If the register previously held a structure or union type, the type field
isn't cleared here when switching to TSR_KIND_GLOBAL_ADDR.

If this register is later spilled to the stack, set_stack_state() will
evaluate the stale type_die. Since the type_die tag is DW_TAG_structure_type,
it will erroneously set stack->compound = true.

When the register is loaded back via ldr, update_load_insn_state() will then
branch into the compound type handling (die_get_member_type()) instead of
restoring the TSR_KIND_GLOBAL_ADDR state. 

Could this destroy the tracking state and cause perf annotate to fail resolving
the global variable's type?

> +
> +	pr_debug_dtp("adrp [%x] global addr=%#"PRIx64" -> reg%d\n",
> +		     insn_offset, tsr->addr, dreg);
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260701035355.752944-1-wutengda@huaweicloud.com?part=19