Re: [PATCH v6 10/13] alpha/perf: report the data source of ProfileMe memory accesses

[Magnus Lindholm]

Hi Matt,

On Wed, Nov 4, 2026 at 7:49 PM Matt Turner <mattst88@xxxxxxxxx> wrote:
>
> Whether a ProfileMe sample's memory access missed the DTB is only in the
> PERF_SAMPLE_RAW data, as a DTB miss trap.
>
> Set PERF_SAMPLE_DATA_SRC for the samples of memory instructions, so that
> the memory sort keys see them. One that trapped on a DTB miss gets an L1
> miss in mem_dtlb. PALcode fills the DTB, so one that retired without
> that trap hit it, and gets an L1 hit. mem_op comes from the opcode, as
> I_STAT does not say whether the access was a load or a store. A load
> into $31 or $f31 is a prefetch, except for ldq_u, a UNOP that is left
> out. Samples that fall back to the interrupted PC get none.
>
> On an EV7, a loop that loads one word from each page of 64 MB in random
> order had as many DTB hit samples on the load as misses: the miss trap
> aborts the load, and its refetch hits. A prefetch into $31 takes the
> same trap, and its samples are reported as PFETCH misses and hits.
>
> I_STAT[TRP] is ignored for an instruction killed before it was mapped. On
> an EV7, TRP and MIS were seen set for killed instructions that are not
> even branches.
>
> Suggested-by: Ian Rogers <irogers@xxxxxxxxxx>
> Assisted-by: Claude:claude-opus-5-5
> Signed-off-by: Matt Turner <mattst88@xxxxxxxxx>
> ---
>  arch/alpha/include/asm/wrperfmon.h | 12 ++++++
>  arch/alpha/kernel/perf_event.c     | 86 ++++++++++++++++++++++++++++++++++++++
>  2 files changed, 98 insertions(+)
>
> diff --git a/arch/alpha/include/asm/wrperfmon.h b/arch/alpha/include/asm/wrperfmon.h
> index 7fbbfd74926a..dc24c7cb45db 100644
> --- a/arch/alpha/include/asm/wrperfmon.h
> +++ b/arch/alpha/include/asm/wrperfmon.h
> @@ -100,6 +100,18 @@
>  /* ProfileMe status, from the EV67/EV68 Hardware Reference Manuals. */
>  #define EV67_I_STAT_OVR_SHIFT 30
>  #define EV67_I_STAT_OVR_MASK 0x7UL
> +#define EV67_I_STAT_TRAP_TYPE_SHIFT 34
> +#define EV67_I_STAT_TRAP_TYPE_MASK 0xfUL
> +#define EV67_I_STAT_TRP (1UL<<39)
> +#define EV67_I_STAT_MIS (1UL<<40)
> +
> +/* I_STAT[TRAP_TYPE] values */
> +#define EV67_TRAP_DTB_DOUBLE_3 2
> +#define EV67_TRAP_DTB_DOUBLE_4 3
> +#define EV67_TRAP_DTB_SINGLE 6
> +
> +#define EV67_PCTR_VAL (1UL<<1)
> +#define EV67_PCTR_PM_KILLED_BM (1UL<<26)
>
>  /* PMPC bits 63:2 hold the profiled PC. Bit 0 set means a PALmode address. */
>  #define EV67_PMPC_PAL (1UL<<0)
> diff --git a/arch/alpha/kernel/perf_event.c b/arch/alpha/kernel/perf_event.c
> index c9ab40ff76ad..0723e1042145 100644
> --- a/arch/alpha/kernel/perf_event.c
> +++ b/arch/alpha/kernel/perf_event.c
> @@ -20,6 +20,7 @@
>  #include <linux/overflow.h>
>  #include <linux/prandom.h>
>  #include <linux/sched/task_stack.h>
> +#include <linux/uaccess.h>
>
>  #include <asm/hwrpb.h>
>  #include <linux/atomic.h>
> @@ -1053,6 +1054,88 @@ static void alpha_profileme_set_regs_user(struct perf_event *event,
>                                   sizeof(u64);
>  }
>
> +/* TRP, and MIS with it, are stale for an insn killed before it was mapped. */
> +static bool alpha_profileme_trp(unsigned long i_stat, unsigned long pctr_ctl)
> +{
> +       return !(pctr_ctl & EV67_PCTR_PM_KILLED_BM) && (i_stat & EV67_I_STAT_TRP);
> +}
> +
> +/* What the memory instruction at pc does, or PERF_MEM_OP_NA. */
> +static u64 alpha_profileme_mem_op(unsigned long pc)
> +{
> +       u32 insn;
> +       bool r31;
> +
> +       if (pc < TASK_SIZE) {
> +               if (copy_from_user_nofault(&insn, (const void __user *)pc,
> +                                          sizeof(insn)))
> +                       return PERF_MEM_OP_NA;
> +       } else if (copy_from_kernel_nofault(&insn, (const void *)pc,
> +                                           sizeof(insn))) {
> +               return PERF_MEM_OP_NA;
> +       }
> +
> +       /* A load into $31 or $f31 is a prefetch, except for ldq_u: a UNOP. */
> +       r31 = ((insn >> 21) & 0x1f) == 31;
> +
> +       switch (insn >> 26) {
> +       case 0x0b:                                      /* ldq_u */
> +               return r31 ? PERF_MEM_OP_NA : PERF_MEM_OP_LOAD;
> +       case 0x0a: case 0x0c:                           /* ldbu, ldwu */
> +       case 0x20: case 0x21: case 0x22: case 0x23:     /* ldf, ldg, lds, ldt */
> +       case 0x28: case 0x29:                           /* ldl, ldq */
> +               return r31 ? PERF_MEM_OP_PFETCH : PERF_MEM_OP_LOAD;
> +       case 0x2a: case 0x2b:                           /* ldl_l, ldq_l */
> +               return PERF_MEM_OP_LOAD;
> +       case 0x0d: case 0x0e: case 0x0f:                /* stw, stb, stq_u */
> +       case 0x24: case 0x25: case 0x26: case 0x27:     /* stf, stg, sts, stt */
> +       case 0x2c: case 0x2d: case 0x2e: case 0x2f:     /* stl, stq, stl_c, stq_c */
> +               return PERF_MEM_OP_STORE;
> +       default:
> +               return PERF_MEM_OP_NA;
> +       }
> +}
> +
> +/*
> + * Report the DTB access of a memory instruction. PALcode fills the DTB, so
> + * one that retired without a DTB miss trap hit it.
> + */
> +static void alpha_profileme_data_src(struct perf_sample_data *data,
> +                                    unsigned long pc, unsigned long i_stat,
> +                                    unsigned long pctr_ctl)
> +{
> +       u64 op, dtlb;
> +
> +       if (alpha_profileme_trp(i_stat, pctr_ctl)) {
> +               if (i_stat & EV67_I_STAT_MIS)
> +                       return;
> +               switch ((i_stat >> EV67_I_STAT_TRAP_TYPE_SHIFT) &
> +                       EV67_I_STAT_TRAP_TYPE_MASK) {
> +               case EV67_TRAP_DTB_SINGLE:
> +               case EV67_TRAP_DTB_DOUBLE_3:
> +               case EV67_TRAP_DTB_DOUBLE_4:
> +                       dtlb = PERF_MEM_TLB_L1 | PERF_MEM_TLB_MISS;
> +                       break;
> +               default:
> +                       return;
> +               }
> +               op = alpha_profileme_mem_op(pc);
> +       } else if (!(pctr_ctl & EV67_PCTR_PM_KILLED_BM) &&
> +                  (pctr_ctl & EV67_PCTR_VAL)) {
> +               dtlb = PERF_MEM_TLB_L1 | PERF_MEM_TLB_HIT;
> +               op = alpha_profileme_mem_op(pc);
> +               if (op == PERF_MEM_OP_NA)
> +                       return;
> +       } else {
> +               return;
> +       }
> +
> +       data->data_src.val = PERF_MEM_NA;
> +       data->data_src.mem_op = op;
> +       data->data_src.mem_dtlb = dtlb;
> +       data->sample_flags |= PERF_SAMPLE_DATA_SRC;
> +}
> +
>  /*
>   * Handle the close of a ProfileMe window on PCTR0.
>   *
> @@ -1168,6 +1251,9 @@ static void alpha_perf_event_profileme(struct perf_event *event,
>                 data.sample_flags |= PERF_SAMPLE_WEIGHT_TYPE;
>         }
>
> +       if (exact && (event->attr.sample_type & PERF_SAMPLE_DATA_SRC))
> +               alpha_profileme_data_src(&data, pc, i_stat, pctr_ctl);
> +
>         if (!alpha_perf_event_set_period(event, hwc, 0))
>                 return;
>
>
> --
> 2.55.0
>

I tested this on my EV67 ES40 with a page-stride workload. At the
ldq into $31 I saw 89 PFETCH hits and 87 PFETCH misses. The load
and store sites also showed both DTB hits and misses. All 215 samples
at the ldq_u UNOP had no memory data source.

Reviewed-by: Magnus Lindholm <linmag7@xxxxxxxxx>
Tested-by: Magnus Lindholm <linmag7@xxxxxxxxx>