From b61eb0fd4e68f3675b115e03c29300734dbfaad5 Mon Sep 17 00:00:00 2001 From: Tengda Wu Date: Tue, 20 Oct 2026 13:45:10 +0000 Subject: [PATCH] perf annotate-arm64: Support per-cpu variable access tracking Extend update_insn_state_arm64() to handle per-cpu variable addressing. On arm64, per-cpu variables are accessed by adding a per-cpu offset (typically from the '__per_cpu_offset' array) to the address of a global variable or a structure field with '__percpu' modifier (e.g., 's32 __percpu *counters' in struct percpu_counter). This results in instruction patterns like: ldr x0, [x6, x5] // Pattern A: direct load per-cpu instance add x0, x6, x5 // Pattern B: compute per-cpu address where x6 holds the per-cpu offset retrieved from: adrp x4, add x4, x4, #offset // x4 = &__per_cpu_offset ldr x6, [x4, w0, sxtw #3] // x6 = __per_cpu_offset[cpu] And x5 holds the base address being offset, which can come from one of two cases: Case 1: global variable adrp x5, add x5, x5, #offset // x5 = &global_var Case 2: '__percpu' field embedded in a structure ldr x5, [x25, #32] // x5 = &percpu_field To handle such cases: 1. Identify per-cpu base initialization: Detect 'adrp + ldr' pairs that resolve to the '__per_cpu_offset' symbol and mark the destination register as TSR_KIND_PERCPU_BASE. 2. Propagate type information: During subsequent 'ldr' or 'add' instructions, if one register is TSR_KIND_PERCPU_BASE, attempt to resolve the type from the other register. A real-world example is shown below: ffff8000808f2d28 : ffff8000808f2d38: adrp x2, ffff800082033000 ffff8000808f2d3c: add x5, x2, #0x3f8 // x5 = &__per_cpu_offset ffff8000808f2d44: adrp x2, ffff800081f73000 ffff8000808f2d48: add x2, x2, #0x6b8 // x2 = &cpu_pcc_subspace_idx ffff8000808f2d6c: ldr x5, [x5, w0, sxtw #3] // x5 = __per_cpu_offset[cpu] * ffff8000808f2d80: ldr w23, [x5, x2] // per_cpu_var(cpu_pcc_subspace_idx) Before this commit, the tracker could not link x5 back to a per-cpu context, resulting in an incorrect data type resolution: adrp [10] global addr=0xffff800082033000 -> reg2 add [14] global 0x3f8(reg2) -> reg5 adrp [1c] global addr=0xffff800081f73000 -> reg2 add [20] global 0x6b8(reg2) -> reg2 ldr [44] global (reg5, reg0) -> reg5 type='long unsigned int[]' size=0x1000 chk [58] reg5 offset=0 ok=1 kind=1 (long unsigned int[]) : Good! found by insn track: 0(reg5, reg2) type-offset=0 final result: type='long unsigned int' size=0x8 After this commit, the tracker correctly identifies the per-cpu flow and resolves the actual variable type: ldr [44] global (reg5, reg0) -> reg5 percpu base chk [58] reg5 offset=0 ok=1 kind=2 percpu var : retry chk [58] reg2 offset=0 ok=1 kind=7 global addr : Good! found by insn track: 0(reg5, reg2) type-offset=0 final result: type='int' size=0x4 Reviewed-by: Namhyung Kim Signed-off-by: Tengda Wu Signed-off-by: Arnaldo Carvalho de Melo --- .../perf/util/annotate-arch/annotate-arm64.c | 25 ++++++++++++- tools/perf/util/annotate-data.c | 36 +++++++++++++++---- 2 files changed, 54 insertions(+), 7 deletions(-) diff --git a/tools/perf/util/annotate-arch/annotate-arm64.c b/tools/perf/util/annotate-arch/annotate-arm64.c index bd060a823b76..270f35876511 100644 --- a/tools/perf/util/annotate-arch/annotate-arm64.c +++ b/tools/perf/util/annotate-arch/annotate-arm64.c @@ -12,6 +12,7 @@ #include "../disasm.h" #include "../annotate-data.h" #include "../debug.h" +#include "../dso.h" #include "../map.h" #include "../symbol.h" @@ -727,13 +728,23 @@ static int propagate_load_reg_state(struct type_state *state, u64 ip = dloc->ms->sym->start + dl->al.offset; u64 addr = src_tsr->imm_value + reg_offset; int offset; + u8 kind; + const char *var_name = NULL; + + /* it might be per-cpu offset */ + if (dso__kernel(map__dso(dloc->ms->map)) && + get_global_var_info(dloc, addr, &var_name, &offset) && + !strcmp(var_name, "__per_cpu_offset")) + kind = TSR_KIND_PERCPU_BASE; + else + kind = TSR_KIND_TYPE; if (!get_global_var_type(cu_die, dloc, ip, addr, &offset, &type_die) || !die_get_member_type(&type_die, offset, &type_die)) return -1; tsr->type = type_die; - tsr->kind = TSR_KIND_TYPE; + tsr->kind = kind; tsr->offset = 0; tsr->imm_value = 0; tsr->ok = true; @@ -749,6 +760,12 @@ static int propagate_load_reg_state(struct type_state *state, return 0; } + /* + * If src_tsr->kind is TSR_KIND_PERCPU_BASE, treat it as an array. + * No special handling is needed here; just fall through to retry + * and resolve the type from the second register. + */ + load_non_regoff: /* Try another register if any */ if (src->multi_regs && src->reg1 != src->reg2 && sreg != src->reg2 && @@ -1046,6 +1063,12 @@ static void update_add_insn_state(struct type_state *state, return; } + /* + * If src_tsr->kind is TSR_KIND_PERCPU_BASE, treat it as an array. + * No special handling is needed here; just fall through to retry + * and resolve the type from the second register. + */ + add_non_regoff: /* Try another register if any */ if (src->multi_regs && src->reg1 != src->reg2 && sreg != src->reg2 && diff --git a/tools/perf/util/annotate-data.c b/tools/perf/util/annotate-data.c index 43cd09c0662a..b3de1ca688a2 100644 --- a/tools/perf/util/annotate-data.c +++ b/tools/perf/util/annotate-data.c @@ -1307,13 +1307,17 @@ int arch_get_reg_offset(const struct arch *arch, struct annotated_op_loc *op_loc /* * For register-based addressing without shift/extension, - * reg2 may be a constant offset. Use its value as the offset - * from the base register. + * derive the offset from the type of reg2. */ reg2 = op_loc->reg1 == breg ? op_loc->reg2 : op_loc->reg1; - if (has_reg_type(state, reg2) && state->regs[reg2].ok && - state->regs[reg2].kind == TSR_KIND_CONST) { - *offset = (s64)state->regs[reg2].imm_value; + if (has_reg_type(state, reg2) && state->regs[reg2].ok) { + if (state->regs[reg2].kind == TSR_KIND_CONST) + *offset = (s64)state->regs[reg2].imm_value; + else if (state->regs[reg2].kind == TSR_KIND_PERCPU_BASE) + *offset = 0; /* it does not contribute to the offset */ + else + return -1; + return 0; } @@ -1448,11 +1452,31 @@ static enum type_match_result check_matching_type(struct type_state *state, } if (state->regs[reg].kind == TSR_KIND_PERCPU_BASE) { - u64 var_addr = (s64) offset; + u64 var_addr; int var_offset; pr_debug_dtp("percpu var"); + if (arch__is_arm64(dloc->arch)) { + int reg2; + + if (!retry || !dloc->op->multi_regs || + dloc->op->reg1 == dloc->op->reg2 || + dloc->op->extend_type || dloc->op->shift_type) + return PERF_TMR_BAIL_OUT; + + reg2 = dloc->op->reg2; + if (!has_reg_type(state, reg2) || !state->regs[reg2].ok) + return PERF_TMR_NO_TYPE; + + pr_debug_dtp(" : retry\n"); + retry = false; + reg = reg2; + goto again; + } + + var_addr = (s64) offset; + if (dloc->op->multi_regs) { int reg2 = dloc->op->reg2;