Re: [PATCH v6 00/26] perf arm64: Support data type profiling

[Arnaldo Melo <arnaldo.melo@gmail.com>]

On September 19, 2026 4:10:46 AM GMT-03:00, Namhyung Kim <namhyung@kernel.org> wrote:
>Hello,
>
>On Wed, Sep 16, 2026 at 01:29:14AM +0000, Tengda Wu wrote:
>> This patch series implements data type profiling support for arm64,
>> enabling 'perf annotate --data-type' to resolve memory locations and
>> variable types on arm64 platforms.
>> 
>> The main changes since v5 include:
>> v5: https://lore.kernel.org/all/cover.1788872630.git.wutengda@huaweicloud.com/
>> 
>> * __get_dwarf_regnum_arm64 optimization: compute directly based on character
>>   judgment, avoiding strtol calls. (Ian Rogers)
>> 
>> * extract_op_location_arm64 issue fix: support parsing instructions such as
>>   'cmp x0, x1, lsl #3'.
>> 
>> * Instruction tracking part, fixing issues pointed out by Sashiko, including:
>>   - adding TSR_KIND_POINTER handling for ldr.
>>   - premature returns in add and ldr causing percpu handling to be skipped.
>>   - adding a reg != -1 check for stack type propagation, etc.
>> 
>> Patch organization
>> ==================
>> 
>> The series is organized as follows:
>> 
>> 1. Fix disassembly mismatches (Patches 01-02)
>>    Current perf annotate supports three disassembly backends: llvm,
>>    capstone, and objdump. On arm64, inconsistencies between the output
>>    of these backends (specifically llvm/capstone vs. objdump) often
>>    prevent the tracker from correctly identifying registers and offsets.
>>    These patches resolve these mismatches, ensuring consistent instruction
>>    parsing across all supported backends.
>> 
>> 2. Infrastructure for arm64 operand parsing (Patches 03-09)
>>    These patches establish the necessary infrastructure for arm64-specific
>>    operand handling. This includes implementing new callbacks and data
>>    structures to manage arm64's unique addressing modes and register sets.
>>    This foundation is essential for the subsequent type-tracking logic.
>> 
>> 3. ARM SPE event handling (Patches 10-11)
>>    Patch 10 automatically deduplicates overlapping ARM SPE events (e.g.,
>>    l1d-miss, tlb-access) in 'perf annotate' by retaining only the
>>    "instructions" event when data type profiling is enabled. Patch 11
>>    defaults  the synthesized event period to 1 for ARM SPE to fix zero
>>    'Percent' values in annotate output.
>
>Thanks for working on this!
>
>I think it's ready to merge up to this point. 

You mean patches 1-11? 

- Arnaldo

 The instruction tracking
>part needs more review.  I'll do that later but it'd be nice if ARM
>folks and Shuai could review it too.
>
>Thanks,
>Namhyung
>
>> 
>> 4. Core instruction tracking (Patches 12-26)
>>    These patches implement the core logic for type tracking on arm64,
>>    covering several key types of instructions, including:
>>    * Memory Access: ldr/str variants (including stack-based access).
>>    * Arithmetic & Data Processing: mov, add, and adrp.
>>    * Special Access: System register access (mrs) and per-cpu variable
>>      tracking.
>> 
>> The implementation draws inspiration from the existing x86 logic while
>> adapting it to the nuances of the AArch64 ISA [2][3]. With these changes,
>> perf annotate can successfully resolve memory locations and register types,
>> providing basic support for data type profiling on arm64 platforms.
>> 
>> Example Result
>> ==============
>> 
>> # perf mem record -a -K -- sleep 1
>> # perf annotate --data-type --stdio --type-stat
>> Annotate data type stats:
>> total 1138, ok 852 (74.9%), bad 286 (25.1%)
>> -----------------------------------------------------------
>>          6 : no_sym
>>         42 : no_var
>>        230 : no_typeinfo
>>          8 : bad_offset
>>        213 : insn_track
>> 
>> Annotate type: 'struct page' in [kernel.kallsyms] (66948 samples):
>> ============================================================================
>>  Percent     offset       size  field
>>   100.00          0       0x40  struct page      {
>>     9.01          0        0x8      long unsigned int   flags;
>>    57.99        0x8       0x28      union        {
>>    57.99        0x8       0x28          struct   {
>>    33.00        0x8       0x10              union        {
>>    33.00        0x8       0x10                  struct list_head        lru {
>>    33.00        0x8        0x8                      struct list_head*   next;
>>     0.00       0x10        0x8                      struct list_head*   prev;
>>                                                 };
>>    33.00        0x8       0x10                  struct   {
>>    33.00        0x8        0x8                      void*       __filler;
>>     0.00       0x10        0x4                      unsigned int        mlock_count;
>>    ...
>> 
>> Each patch's type profiling results are as follows:
>> 
>> Patch | Feature                    | no_sym | no_var | no_typeinfo | bad_offset | insn_track | ok(%)
>> ------+----------------------------+--------+--------+-------------+------------+------------+------
>> 0011  | base (default spe period)  | 6      | 493    | -           | -          | -          | 56.2%
>> 0013  | enable insn tracking       | 6      | 42     | 437         | 2          | 12         | 57.2%
>> 0016  | support 'load' insn        | 6      | 42     | 398         | 1          | 52         | 60.7%
>> 0017  | support 'store' insn       | 6      | 42     | 398         | 1          | 52         | 60.7%
>> 0021  | support stack variable     | 6      | 42     | 391         | 1          | 59         | 61.3%
>> 0022  | support 'mov' insn         | 6      | 42     | 372         | 3          | 76         | 62.8%
>> 0023  | support 'add' insn         | 6      | 42     | 318         | 7          | 126        | 67.2%
>> 0024  | support 'adrp' insn        | 6      | 42     | 238         | 8          | 205        | 74.2%
>> 0025  | support per-cpu variable   | 6      | 42     | 233         | 8          | 210        | 74.6%
>> 0026  | support 'mrs' insn         | 6      | 42     | 230         | 8          | 213        | 74.9%
>> 
>> Limitations
>> ===========
>> 
>> * SIMD/FP & SVE Vector Support:
>>   Data type profiling currently focuses on General-Purpose (GP) register
>>   operations. Vector/SIMD registers (v0-v31, d0-d31, q0-q31) and Scalable
>>   Vector Extension (SVE/SME) instructions are not tracked yet.
>> 
>> * Regular Instructions Only:
>>   Only regular instructions are currently supported. Instructions following
>>   special rules or non-standard patterns are not supported yet. For example,
>>   load/store tracking only matches standard variants (ldr/ldur/ldar/ldp and
>>   str/stur/stlr/stp) with straightforward semantics; exclusive loads/stores
>>   (ldxr, stxr, etc.) and acquire/exclusive combination variants are excluded.
>> 
>> * Compiler Prologue/Epilogue Code:
>>   As shown by the previous test results, approximately 14% of the failed
>>   type profiling results originate from compiler-generated prologue or
>>   epilogue code (e.g., ldp  x19, x20, [sp, #16]). These instructions manage
>>   callee-saved registers across function boundaries, propagating type
>>   context through these operations requires inter-procedural (cross-function)
>>   instruction analysis, which is currently unsupported by the local backward
>>   instruction tracker.
>> 
>> Testing
>> =======
>> 
>> Tested on arm64 (all passed):
>> 
>>   # perf test -v "perf data type profiling tests"
>>   81: perf data type profiling tests                                                                  : Ok
>> 
>>   === Test Summary ===
>>   Passed main tests : 1
>>   Passed subtests   : 0
>>   Skipped tests     : 0
>>   Failed tests      : 0
>> 
>> Tested on x86. The profiling results show no change before/after applying
>> this patch series:
>> 
>>   before : total 880, ok 711 (80.8%), bad 169 (19.2%)
>>   after  : total 880, ok 711 (80.8%), bad 169 (19.2%)
>> 
>> Changelog
>> =========
>> v5 -> v6:
>>   - v5: https://lore.kernel.org/all/cover.1788872630.git.wutengda@huaweicloud.com/
>>   - Fix a potential UAF issue with capstone sym_name.
>>   - Optimize __get_dwarf_regnum_arm64 to compute directly based on character
>>     judgment, avoiding strtol calls. (Ian Rogers)
>>   - Fix an issue in extract_op_location_arm64 when parsing instructions such as
>>     'cmp x0, x1, lsl #3'.
>>   - Fix several minor issues in instruction tracking. (Sashiko)
>> v4 -> v5:
>>   - v4: https://lore.kernel.org/all/20260808122400.2961238-1-wutengda@huaweicloud.com/
>>   - Introduce arch_get_reg_offset() to uniformly handle reg offset.
>>   - Add support for parsing extension type and shift amount in arm64 instructions.
>>   - Refine which instructions to track or skip. (Shuai Xue)
>>   - Rename dont_overlap to default_single_event_per_ip and use it in
>>     itrace_synth_opts__set_default(). (Adrian Hunter)
>>   - Introduce delete_stack_state() to clean up obsolete stack state. (Shuai Xue)
>>   - Normalize arch__dwarf_regnum() error return values. (Shuai Xue)
>>   - Drop canary support due to unresolved bugs.
>>   - Fix various minor issues, such as name memory leaks and header includes.
>> v3 -> v4:
>>   - v3: https://lore.kernel.org/all/20260701035355.752944-1-wutengda@huaweicloud.com/
>>   - Fix Capstone compilation failure.
>>   - Stop adding new pcrel_adrp_addr in LLVM; reuse pcrel_load_addr instead.
>>   - Fix parsing issue in arm64_mov__parse.
>>   - Add PC-relative load instruction parsing logic to arm64_ldst__parse,
>>     and introduce rstrip_space_and_comment to strip comments.
>>   - Remove wzr/xzr register parsing (not planning to handle this yet).
>>   - Add post-index addressing mode parsing for the '[base], reg' format.
>>   - Update built-in implementation of --itrace=i1i to deduplicate early
>>     during arm_spe_process_auxtrace_info.
>>   - Restrict the "default period to 1" behavior to ARM SPE, instead of
>>     applying it to all architectures.
>>   - Add register type tracking for function call instructions.
>>   - Add dual-register type tracking for load pair and store pair instructions.
>>   - Correct stack variable offset calculations.
>>   - Add type invalidation upon retry failure.
>>   - Reuse imm_value instead of introducing addr for 'adrp' instruction tracking.
>>   - Fix potential stale type resolution errors caused by TSR_KIND_GLOBAL_ADDR
>>     and TSR_KIND_CONST during stack passing.
>>   - Fix a strbuf memory leak during 'mrs' instruction tracking.
>>   - Fix stale dieoff issue when debug info changes.
>>   - Simplify add type propagation: only propagate offset/imm updates, leave
>>     type parsing to chk.
>> v2 -> v3:
>>   - v2: https://lore.kernel.org/all/20260403094800.1418825-1-wutengda@huaweicloud.com/
>>   - Instead of always parsing the left operand as src and the right operand as
>>     dst, set them based on the actual instruction definition. (Namhyung Kim)
>>   - Fix refcount leak in print_capstone_detail().
>>   - Remove useless '<' check when parsing 'addr <symbol>' in arm64_mov__parse().
>>   - Add example comments in arm64_ldst__parse().
>>   - Split arch__dwarf_regnum() changes into a separate commit.
>>   - Rename annotated_addr_mode enum: INSN_ADDR_* -> PERF_ADDR_MODE_*.
>>   - Set caller-saved registers in init_type_state().
>>   - For instructions with addressing mode, always goto adjust_reg_index_state()
>>     at the end to update the src register state.
>>   - Handle TSR_KIND_CONST registers for 'mov' and 'add' instructions.
>>   - Invalidate dst register for all other unsupported instructions.
>>   - Verify type DIE is task_struct pointer before caching globally.
>>   - Enable --itrace=i1i by default for ARM SPE data type profiling in 'perf annotate'
>>     to avoid overlapping event counting for the same instruction. (James Clark)
>>   - Fix global variable type resolving error in check_matching_type(). (James Clark)
>>   - Address review comments from sashiko [1]:
>>     - Fix unconditional call to arch->extract_op_location()
>>     - Handle multi_regs correctly
>>     - Fix invalid register state in error path
>>     - Other misc fixes
>> v1 -> v2:
>>   - v1: https://lore.kernel.org/all/20250314162137.528204-1-lihuafei1@huawei.com/
>>   - Fix inconsistencies in arm64 instruction output across llvm, capstone,
>>     and objdump disassembly backends.
>>   - Support arm64-specific addressing modes and operand formats. (Leo Yan)
>>   - Extend instruction tracking to support mov and add instructions,
>>     along with per-cpu and stack variables.
>>   - Include real-world examples in commit messages to demonstrate
>>     practical effects. (Namhyung Kim)
>>   - Improve type-tracking success rate (type stat) from 64.2% to 82.1%.
>> 
>> Please let me know if you have any feedback.
>> 
>> Thanks,
>> Tengda
>> 
>> [1] https://sashiko.dev/#/patchset/20260403094800.1418825-1-wutengda%40huaweicloud.com
>> [2] https://developer.arm.com/documentation/102374/0103
>> [3] https://github.com/flynd/asmsheets/releases/tag/v8
>> 
>> 
>> Tengda Wu (26):
>>   perf capstone: Symbolize address operands to match objdump on arm64
>>   perf llvm: Fix arm64 adrp instruction disassembly mismatch with
>>     objdump
>>   perf annotate-arm64: Generalize arm64_mov__parse to support more
>>     instructions
>>   perf annotate-arm64: Handle load and store instructions
>>   perf annotate: Normalize arch__dwarf_regnum() error return values
>>   perf annotate: Introduce extract_op_location callback for
>>     arch-specific parsing
>>   perf dwarf-regs: Adapt get_dwarf_regnum() for arm64
>>   perf annotate: Adapt arch__dwarf_regnum() for arm64
>>   perf annotate-arm64: Implement extract_op_location() callback
>>   perf annotate: Default to --itrace=i1i for data type profiling
>>   perf arm-spe: Set default synthesized event period to 1
>>   perf annotate-data: Extract invalidate_reg_state() as a common helper
>>   perf annotate-arm64: Enable instruction tracking support
>>   perf annotate-data: Add arch_get_reg_offset helper
>>   perf annotate-arm64: Track return type after call instructions
>>   perf annotate-arm64: Support load instruction tracking
>>   perf annotate-arm64: Support store instruction tracking
>>   perf annotate-data: Expand type_state_reg imm_value to u64
>>   perf annotate-data: Track imm_value for stack variables
>>   perf annotate-x86: Delete stale stack state on store of untracked
>>     register
>>   perf annotate-arm64: Support stack variable tracking
>>   perf annotate-arm64: Support 'mov' instruction tracking
>>   perf annotate-arm64: Support 'add' instruction tracking
>>   perf annotate-arm64: Support 'adrp' instruction to track global
>>     variables
>>   perf annotate-arm64: Support per-cpu variable access tracking
>>   perf annotate-arm64: Support 'mrs' instruction to track 'current'
>>     pointer
>> 
>>  tools/perf/builtin-annotate.c                 |    8 +
>>  .../perf/util/annotate-arch/annotate-arm64.c  | 1211 ++++++++++++++++-
>>  .../util/annotate-arch/annotate-powerpc.c     |    9 +
>>  tools/perf/util/annotate-arch/annotate-x86.c  |  117 +-
>>  tools/perf/util/annotate-data.c               |  205 ++-
>>  tools/perf/util/annotate-data.h               |   14 +-
>>  tools/perf/util/annotate.c                    |  108 +-
>>  tools/perf/util/annotate.h                    |   63 +
>>  tools/perf/util/arm-spe.c                     |   16 +-
>>  tools/perf/util/auxtrace.c                    |   12 +-
>>  tools/perf/util/auxtrace.h                    |    7 +-
>>  tools/perf/util/capstone.c                    |  186 ++-
>>  tools/perf/util/cs-etm.c                      |    2 +-
>>  tools/perf/util/disasm.c                      |    5 +
>>  tools/perf/util/disasm.h                      |    5 +
>>  .../util/dwarf-regs-arch/dwarf-regs-arm64.c   |   25 +
>>  tools/perf/util/dwarf-regs.c                  |    2 +-
>>  tools/perf/util/include/dwarf-regs.h          |    1 +
>>  tools/perf/util/intel-bts.c                   |    2 +-
>>  tools/perf/util/intel-pt.c                    |    3 +-
>>  tools/perf/util/llvm.c                        |   52 +-
>>  21 files changed, 1831 insertions(+), 222 deletions(-)
>> 
>> 
>> base-commit: e6e35979777d646fe3c7c94dca7dd32fb25d45f4
>> -- 
>> 2.34.1
>> 

- Arnaldo