Re: [PATCH v3 17/21] perf annotate-arm64: Support 'mov' instruction tracking

[Namhyung Kim <namhyung@kernel.org>]

On Wed, Jul 01, 2026 at 04:46:02PM +0800, Tengda Wu wrote:
> 
> 
> On 2026/7/1 12:21, sashiko-bot@kernel.org wrote:
> > Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> > - [Medium] Type state corruption due to DWARF register overloading for the stack pointer (`sp`) and zero registers (`xzr`/`wzr`).
> > --
> > 
> > commit 8b77f0fe5f1ec7e9d14eee63f44f48d6c55f7234
> > Author: Tengda Wu <wutengda@huaweicloud.com>
> > 
> > perf annotate-arm64: Support 'mov' instruction tracking
> > 
> > This commit extends update_insn_state() for arm64 to track register-to-register
> > and immediate-to-register 'mov' instructions. It propagates data type
> > information or immediate values to the destination register to improve type
> > inference.
> > 
> >> diff --git a/tools/perf/util/annotate-arch/annotate-arm64.c b/tools/perf/util/annotate-arch/annotate-arm64.c
> >> --- a/tools/perf/util/annotate-arch/annotate-arm64.c
> >> +++ b/tools/perf/util/annotate-arch/annotate-arm64.c
> > 
> > [ ... ]
> > 
> >> +static void update_mov_insn_state(struct type_state *state,
> >> +				  struct disasm_line *dl,
> >> +				  struct annotated_op_loc *src,
> >> +				  struct annotated_op_loc *dst)
> >> +{
> > 
> > [ ... ]
> > 
> >> +	if (!has_reg_type(state, sreg) || !state->regs[sreg].ok) {
> >> +		invalidate_reg_state(tsr);
> >> +		return;
> >> +	}
> >> +
> >> +	tsr->type = state->regs[sreg].type;
> > 
> > [Severity: Medium]
> > Will this code corrupt the stack pointer's type state if the zero register
> > (xzr or wzr) is used in a mov instruction?
> > 
> > Looking at tools/perf/util/dwarf-regs-arch/dwarf-regs-arm64.c, the function
> > __get_dwarf_regnum_arm64() maps sp, wzr, and xzr all to DWARF register 31:
> > 
> >     if (!strcmp(name, "sp") || !strcmp(name, "wzr") || !strcmp(name, "xzr"))
> >         return 31;
> > 
> > If a zero register is used as a destination (e.g., mov xzr, x0), does its
> > tracked state overwrite the tracked state of the stack pointer?
> > 
> > Conversely, if a zero register is used as a source (e.g., mov x0, xzr),
> > does the destination register incorrectly inherit the type of the stack
> > pointer instead of being treated as a constant 0?
> > 
> 
> I'll drop wzr/xzr register support to avoid this confusion.
 
Yep, that'd be right.

But I'm curious how we interpret 'mov x0, xzr' when x0 has a pointer
type.  Maybe intention of the source code is to initialize the pointer
to NULL, but this function may set it to const 0 and drop the type info.

Thanks,
Namhyung