[PATCH v7 14/15] perf annotate-arm64: Support per-cpu variable access tracking
From: Tengda Wu
Date: Tue Oct 13 2026 - 11:08:28 EST
Extend update_insn_state_arm64() to handle per-cpu variable addressing.
On arm64, per-cpu variables are accessed by adding a per-cpu offset
(typically from the '__per_cpu_offset' array) to the address of a global
variable or a structure field with '__percpu' modifier (e.g.,
's32 __percpu *counters' in struct percpu_counter). This results in
instruction patterns like:
ldr x0, [x6, x5] // Pattern A: direct load per-cpu instance
add x0, x6, x5 // Pattern B: compute per-cpu address
where x6 holds the per-cpu offset retrieved from:
adrp x4, <page>
add x4, x4, #offset // x4 = &__per_cpu_offset
ldr x6, [x4, w0, sxtw #3] // x6 = __per_cpu_offset[cpu]
And x5 holds the base address being offset, which can come from one of
two cases:
Case 1: global variable
adrp x5, <page>
add x5, x5, #offset // x5 = &global_var
Case 2: '__percpu' field embedded in a structure
ldr x5, [x25, #32] // x5 = &percpu_field
To handle such cases:
1. Identify per-cpu base initialization: Detect 'adrp + ldr' pairs that
resolve to the '__per_cpu_offset' symbol and mark the destination
register as TSR_KIND_PERCPU_BASE.
2. Propagate type information: During subsequent 'ldr' or 'add'
instructions, if one register is TSR_KIND_PERCPU_BASE, attempt to
resolve the type from the other register.
A real-world example is shown below:
ffff8000808f2d28 <cppc_set_perf>:
ffff8000808f2d38: adrp x2, ffff800082033000
ffff8000808f2d3c: add x5, x2, #0x3f8 // x5 = &__per_cpu_offset
ffff8000808f2d44: adrp x2, ffff800081f73000
ffff8000808f2d48: add x2, x2, #0x6b8 // x2 = &cpu_pcc_subspace_idx
ffff8000808f2d6c: ldr x5, [x5, w0, sxtw #3] // x5 = __per_cpu_offset[cpu]
* ffff8000808f2d80: ldr w23, [x5, x2] // per_cpu_var(cpu_pcc_subspace_idx)
Before this commit, the tracker could not link x5 back to a per-cpu
context, resulting in an incorrect data type resolution:
adrp [10] global addr=0xffff800082033000 -> reg2
add [14] global 0x3f8(reg2) -> reg5
adrp [1c] global addr=0xffff800081f73000 -> reg2
add [20] global 0x6b8(reg2) -> reg2
ldr [44] global (reg5, reg0) -> reg5 type='long unsigned int[]' size=0x1000
chk [58] reg5 offset=0 ok=1 kind=1 (long unsigned int[]) : Good!
found by insn track: 0(reg5, reg2) type-offset=0
final result: type='long unsigned int' size=0x8
After this commit, the tracker correctly identifies the per-cpu flow and
resolves the actual variable type:
ldr [44] global (reg5, reg0) -> reg5 percpu base
chk [58] reg5 offset=0 ok=1 kind=2 percpu var : retry
chk [58] reg2 offset=0 ok=1 kind=7 global addr : Good!
found by insn track: 0(reg5, reg2) type-offset=0
final result: type='int' size=0x4
Signed-off-by: Tengda Wu <wutengda@xxxxxxxxxxxxxxx>
---
.../perf/util/annotate-arch/annotate-arm64.c | 25 ++++++++++++-
tools/perf/util/annotate-data.c | 36 +++++++++++++++----
2 files changed, 54 insertions(+), 7 deletions(-)
diff --git a/tools/perf/util/annotate-arch/annotate-arm64.c b/tools/perf/util/annotate-arch/annotate-arm64.c
index f34b944dd285..5683215f0770 100644
--- a/tools/perf/util/annotate-arch/annotate-arm64.c
+++ b/tools/perf/util/annotate-arch/annotate-arm64.c
@@ -12,6 +12,7 @@
#include "../disasm.h"
#include "../annotate-data.h"
#include "../debug.h"
+#include "../dso.h"
#include "../map.h"
#include "../symbol.h"
@@ -645,13 +646,23 @@ static int propagate_load_reg_state(struct type_state *state,
u64 ip = dloc->ms->sym->start + dl->al.offset;
u64 addr = src_tsr->imm_value + reg_offset;
int offset;
+ u8 kind;
+ const char *var_name = NULL;
+
+ /* it might be per-cpu offset */
+ if (dso__kernel(map__dso(dloc->ms->map)) &&
+ get_global_var_info(dloc, addr, &var_name, &offset) &&
+ !strcmp(var_name, "__per_cpu_offset"))
+ kind = TSR_KIND_PERCPU_BASE;
+ else
+ kind = TSR_KIND_TYPE;
if (!get_global_var_type(cu_die, dloc, ip, addr, &offset, &type_die) ||
!die_get_member_type(&type_die, offset, &type_die))
return -1;
tsr->type = type_die;
- tsr->kind = TSR_KIND_TYPE;
+ tsr->kind = kind;
tsr->offset = 0;
tsr->imm_value = 0;
tsr->ok = true;
@@ -667,6 +678,12 @@ static int propagate_load_reg_state(struct type_state *state,
return 0;
}
+ /*
+ * If src_tsr->kind is TSR_KIND_PERCPU_BASE, treat it as an array.
+ * No special handling is needed here; just fall through to retry
+ * and resolve the type from the second register.
+ */
+
load_non_regoff:
/* Try another register if any */
if (src->multi_regs && src->reg1 != src->reg2 && sreg != src->reg2 &&
@@ -964,6 +981,12 @@ static void update_add_insn_state(struct type_state *state,
return;
}
+ /*
+ * If src_tsr->kind is TSR_KIND_PERCPU_BASE, treat it as an array.
+ * No special handling is needed here; just fall through to retry
+ * and resolve the type from the second register.
+ */
+
add_non_regoff:
/* Try another register if any */
if (src->multi_regs && src->reg1 != src->reg2 && sreg != src->reg2 &&
diff --git a/tools/perf/util/annotate-data.c b/tools/perf/util/annotate-data.c
index 43cd09c0662a..b3de1ca688a2 100644
--- a/tools/perf/util/annotate-data.c
+++ b/tools/perf/util/annotate-data.c
@@ -1307,13 +1307,17 @@ int arch_get_reg_offset(const struct arch *arch, struct annotated_op_loc *op_loc
/*
* For register-based addressing without shift/extension,
- * reg2 may be a constant offset. Use its value as the offset
- * from the base register.
+ * derive the offset from the type of reg2.
*/
reg2 = op_loc->reg1 == breg ? op_loc->reg2 : op_loc->reg1;
- if (has_reg_type(state, reg2) && state->regs[reg2].ok &&
- state->regs[reg2].kind == TSR_KIND_CONST) {
- *offset = (s64)state->regs[reg2].imm_value;
+ if (has_reg_type(state, reg2) && state->regs[reg2].ok) {
+ if (state->regs[reg2].kind == TSR_KIND_CONST)
+ *offset = (s64)state->regs[reg2].imm_value;
+ else if (state->regs[reg2].kind == TSR_KIND_PERCPU_BASE)
+ *offset = 0; /* it does not contribute to the offset */
+ else
+ return -1;
+
return 0;
}
@@ -1448,11 +1452,31 @@ static enum type_match_result check_matching_type(struct type_state *state,
}
if (state->regs[reg].kind == TSR_KIND_PERCPU_BASE) {
- u64 var_addr = (s64) offset;
+ u64 var_addr;
int var_offset;
pr_debug_dtp("percpu var");
+ if (arch__is_arm64(dloc->arch)) {
+ int reg2;
+
+ if (!retry || !dloc->op->multi_regs ||
+ dloc->op->reg1 == dloc->op->reg2 ||
+ dloc->op->extend_type || dloc->op->shift_type)
+ return PERF_TMR_BAIL_OUT;
+
+ reg2 = dloc->op->reg2;
+ if (!has_reg_type(state, reg2) || !state->regs[reg2].ok)
+ return PERF_TMR_NO_TYPE;
+
+ pr_debug_dtp(" : retry\n");
+ retry = false;
+ reg = reg2;
+ goto again;
+ }
+
+ var_addr = (s64) offset;
+
if (dloc->op->multi_regs) {
int reg2 = dloc->op->reg2;
--
2.34.1