[PATCH v5 24/26] perf annotate-arm64: Support 'adrp' instruction to track global variables
From: Tengda Wu
Date: Tue Sep 08 2026 - 09:40:07 EST
Extend update_insn_state_arm64() to track global variable types
calculated via page-relative addressing.
On arm64, global variables are typically accessed by first calculating
the page address using 'adrp', followed by an 'add' or 'ldr' to get the
specific symbol address. Without tracking 'adrp', the instruction
tracker loses the base address, making it impossible to resolve
global symbols and their associated DWARF types.
Introduce TSR_KIND_GLOBAL_ADDR to represent a partial global address
state. When encountering 'adrp', store the page-aligned target address
in the register's type state. Upon a subsequent 'add' or 'ldr'
instruction that references a TSR_KIND_GLOBAL_ADDR register, combine
the page address with the immediate offset.
A real-world example is shown below:
ffff80008032e008 <folios_put_refs>:
ffff80008032e048: adrp x24, ffff80008202f000 <nr_cpu_ids>
ffff80008032e050: add x24, x24, #0xd40
* ffff80008032e078: ldr x0, [x24]
Before this commit, x24 was unknown, leading to no type information:
chk [70] reg24 offset=0 ok=0 kind=0 cfa : no type information
final result: no type information
After this commit, the tracker correctly follows the adrp/add flow:
adrp [40] global addr=0xffff80008202f000 -> reg24
add [48] global 0xd40(reg24) -> reg24
chk [70] reg24 offset=0 ok=1 kind=7 global addr : Good!
final result: type='struct folio*'
Signed-off-by: Li Huafei <lihuafei1@xxxxxxxxxx>
Signed-off-by: Tengda Wu <wutengda@xxxxxxxxxxxxxxx>
---
.../perf/util/annotate-arch/annotate-arm64.c | 83 +++++++++++++++++--
tools/perf/util/annotate-data.c | 25 +++++-
tools/perf/util/annotate-data.h | 1 +
3 files changed, 99 insertions(+), 10 deletions(-)
diff --git a/tools/perf/util/annotate-arch/annotate-arm64.c b/tools/perf/util/annotate-arch/annotate-arm64.c
index e237b9142684..9daf95905545 100644
--- a/tools/perf/util/annotate-arch/annotate-arm64.c
+++ b/tools/perf/util/annotate-arch/annotate-arm64.c
@@ -524,7 +524,7 @@ static bool is_standard_load_insn(const char *name)
* loads (e.g. second target reg in 'ldp'), which is added to the reg offset.
*/
static int propagate_load_reg_state(struct type_state *state,
- struct data_loc_info *dloc,
+ struct data_loc_info *dloc, Dwarf_Die *cu_die,
struct disasm_line *dl, int dreg,
struct annotated_op_loc *src,
struct type_state_reg **src_states,
@@ -622,6 +622,33 @@ static int propagate_load_reg_state(struct type_state *state,
return 0;
}
+ /* Or check if it's a global variable */
+ if (src_tsr->kind == TSR_KIND_GLOBAL_ADDR) {
+ u64 ip = dloc->ms->sym->start + dl->al.offset;
+ u64 addr = src_tsr->imm_value + reg_offset;
+ int offset;
+
+ if (!get_global_var_type(cu_die, dloc, ip, addr, &offset, &type_die) ||
+ !die_get_member_type(&type_die, offset, &type_die))
+ return -1;
+
+ tsr->type = type_die;
+ tsr->kind = TSR_KIND_TYPE;
+ tsr->offset = 0;
+ tsr->imm_value = 0;
+ tsr->ok = true;
+
+ if (src->multi_regs) {
+ pr_debug_dtp("%s [%x] global (reg%d, reg%d) -> reg%d",
+ dl->ins.name, insn_offset, src->reg1, src->reg2, dreg);
+ } else {
+ pr_debug_dtp("%s [%x] global (reg%d) -> reg%d",
+ dl->ins.name, insn_offset, sreg, dreg);
+ }
+ pr_debug_type_name(&tsr->type, tsr->kind);
+ return 0;
+ }
+
/* Or try another register if any */
if (src->multi_regs && src->reg1 != src->reg2 && sreg != src->reg2 &&
!(src->extend_type || src->shift_type)) {
@@ -634,7 +661,7 @@ static int propagate_load_reg_state(struct type_state *state,
}
static void update_load_insn_state(struct type_state *state,
- struct data_loc_info *dloc,
+ struct data_loc_info *dloc, Dwarf_Die *cu_die,
struct disasm_line *dl,
struct annotated_op_loc *src,
struct annotated_op_loc *dst)
@@ -663,7 +690,7 @@ static void update_load_insn_state(struct type_state *state,
}
/* Handle the first destination register */
- if (propagate_load_reg_state(state, dloc, dl, dst->reg1,
+ if (propagate_load_reg_state(state, dloc, cu_die, dl, dst->reg1,
src, src_states, /*mem_offset=*/0))
goto out_err_adjust;
@@ -681,7 +708,7 @@ static void update_load_insn_state(struct type_state *state,
mem_offset = arm64__reg_size(dl->ops.target.raw);
if (mem_offset < 0 ||
- propagate_load_reg_state(state, dloc, dl, dst->reg2,
+ propagate_load_reg_state(state, dloc, cu_die, dl, dst->reg2,
src, src_states, mem_offset))
goto out_err_adjust;
}
@@ -894,14 +921,16 @@ static void update_add_insn_state(struct type_state *state,
if (arch_get_reg_offset(dloc->arch, src, sreg, state, false, ®_offset))
goto try_other_reg;
- if (src_tsr.kind == TSR_KIND_CONST) {
+ if (src_tsr.kind == TSR_KIND_CONST || src_tsr.kind == TSR_KIND_GLOBAL_ADDR) {
tsr->kind = src_tsr.kind;
+ /* For 'adrp + add' pair: resolve the full global variable address. */
tsr->imm_value = src_tsr.imm_value + reg_offset;
tsr->offset = 0;
tsr->ok = src_tsr.ok;
- pr_debug_dtp("add [%x] imm %#x(reg%d) -> reg%d\n",
- insn_offset, reg_offset, sreg, dreg);
+ pr_debug_dtp("add [%x] %s %#x(reg%d) -> reg%d\n",
+ insn_offset, src_tsr.kind == TSR_KIND_CONST ?
+ "imm" : "global", reg_offset, sreg, dreg);
return;
}
@@ -930,6 +959,39 @@ static void update_add_insn_state(struct type_state *state,
invalidate_reg_state(tsr);
}
+static void update_adrp_insn_state(struct type_state *state,
+ struct disasm_line *dl,
+ struct annotated_op_loc *dst)
+{
+ struct type_state_reg *tsr;
+ u32 insn_offset = dl->al.offset;
+ int dreg = dst->reg1;
+
+ if (!has_reg_type(state, dreg))
+ return;
+
+ tsr = &state->regs[dreg];
+ tsr->copied_from = -1;
+
+ if (!dl->ops.source.addr) {
+ invalidate_reg_state(tsr);
+ return;
+ }
+
+ tsr->kind = TSR_KIND_GLOBAL_ADDR;
+ /*
+ * Stores a partial page-relative address. The full absolute address
+ * of the global variable will be resolved when a subsequent 'add' or
+ * 'ldr' instruction consumes this register.
+ */
+ tsr->imm_value = dl->ops.source.addr;
+ tsr->offset = 0;
+ tsr->ok = true;
+
+ pr_debug_dtp("adrp [%x] global addr=%#"PRIx64" -> reg%d\n",
+ insn_offset, tsr->imm_value, dreg);
+}
+
static void update_insn_state_arm64(struct type_state *state,
struct data_loc_info *dloc, Dwarf_Die *cu_die,
struct disasm_line *dl)
@@ -996,6 +1058,7 @@ static void update_insn_state_arm64(struct type_state *state,
* prevent stale type info from propagating to subsequent instructions.
*/
if (has_reg_type(state, dst->reg1) && !dst->mem_ref &&
+ strcmp(dl->ins.name, "adrp") &&
strcmp(dl->ins.name, "add") && strcmp(dl->ins.name, "mov") &&
!is_standard_load_insn(dl->ins.name)) {
pr_debug_dtp("%s [%x] invalidate reg%d",
@@ -1009,14 +1072,16 @@ static void update_insn_state_arm64(struct type_state *state,
return;
}
- if (!strcmp(dl->ins.name, "add"))
+ if (!strcmp(dl->ins.name, "adrp"))
+ update_adrp_insn_state(state, dl, dst);
+ else if (!strcmp(dl->ins.name, "add"))
update_add_insn_state(state, dloc, dl, src, dst);
/* Register to register or imm value to register transfers */
else if (!strcmp(dl->ins.name, "mov"))
update_mov_insn_state(state, dl, src, dst);
/* Memory to register transfers */
else if (is_standard_load_insn(dl->ins.name))
- update_load_insn_state(state, dloc, dl, src, dst);
+ update_load_insn_state(state, dloc, cu_die, dl, src, dst);
/* Register to memory transfers */
else if (is_standard_store_insn(dl->ins.name))
update_store_insn_state(state, dloc, dl, src, dst);
diff --git a/tools/perf/util/annotate-data.c b/tools/perf/util/annotate-data.c
index 1936822c73f2..6897bd275e59 100644
--- a/tools/perf/util/annotate-data.c
+++ b/tools/perf/util/annotate-data.c
@@ -70,6 +70,9 @@ void pr_debug_type_name(Dwarf_Die *die, enum type_state_kind kind)
case TSR_KIND_CANARY:
pr_info(" stack canary\n");
return;
+ case TSR_KIND_GLOBAL_ADDR:
+ pr_info(" global address\n");
+ return;
case TSR_KIND_TYPE:
default:
break;
@@ -609,7 +612,8 @@ void set_stack_state(struct type_state_stack *stack, int offset, u8 kind,
stack->kind = kind;
stack->imm_value = imm_value;
- if (kind == TSR_KIND_POINTER || kind == TSR_KIND_CONST) {
+ if (kind == TSR_KIND_POINTER || kind == TSR_KIND_CONST ||
+ kind == TSR_KIND_GLOBAL_ADDR) {
stack->compound = false;
return;
}
@@ -1365,6 +1369,25 @@ static enum type_match_result check_matching_type(struct type_state *state,
if (offset < 0 && reg != state->stack_reg && reg != dloc->fbreg)
goto check_kernel;
}
+
+ if (state->regs[reg].kind == TSR_KIND_GLOBAL_ADDR) {
+ u64 var_addr = state->regs[reg].imm_value + offset;
+ int var_offset;
+
+ pr_debug_dtp("global addr");
+
+ /*
+ * The register holds the address of a global variable. Try to
+ * find the variable by the address and get its type.
+ */
+ if (get_global_var_type(cu_die, dloc, dloc->ip, var_addr,
+ &var_offset, type_die)) {
+ dloc->type_offset = var_offset;
+ return PERF_TMR_OK;
+ }
+ /* No need to retry global variables */
+ return PERF_TMR_BAIL_OUT;
+ }
check_non_register:
if (reg == dloc->fbreg || reg == state->stack_reg) {
struct type_state_stack *stack;
diff --git a/tools/perf/util/annotate-data.h b/tools/perf/util/annotate-data.h
index 02d5602c5e20..885d441e3768 100644
--- a/tools/perf/util/annotate-data.h
+++ b/tools/perf/util/annotate-data.h
@@ -37,6 +37,7 @@ enum type_state_kind {
TSR_KIND_PERCPU_POINTER,
TSR_KIND_POINTER,
TSR_KIND_CANARY,
+ TSR_KIND_GLOBAL_ADDR,
};
/**
--
2.34.1