From nobody Sat Feb 7 10:08:41 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A1C7017965E; Wed, 21 Aug 2024 23:26:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1724282790; cv=none; b=dFFEBeOcBLc0yyCKIY6kliq9BgdokK0OMEV8Fj14lcH51WK0C+87VQuxNVaEtzH27dAm/OnpIVuEm12zbijYdJ34xa9VfqzHrnoM7rFnPvR4HTrbAEXQN/R3tH6StiMoYttM4jjzYXusPhIjx4OjR+w9NNjXQ7PIoVPa74d7yp8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1724282790; c=relaxed/simple; bh=V9uUFtnCEofy9pZNCgLGWmzdiSL6s971iB5YFrDqJro=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Kj7t/sAEoeSHerFc1R4K5agdNMZwQ5e8M78/h11d7csNuM/js0Hi18WwynzL+lEC320tudhT4h5/PewZP7g5BGU2SERdRO8ooiSFP2NIJanvLOb8MWcZHO6DcHtGKqBLJVIvssJ2WfVor5JoIBFrlBEFhPDt8rwBZOI/8w782SY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=KAIGhEDS; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="KAIGhEDS" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C35CAC32782; Wed, 21 Aug 2024 23:26:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1724282790; bh=V9uUFtnCEofy9pZNCgLGWmzdiSL6s971iB5YFrDqJro=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KAIGhEDSkHbQhszZZczJGE7kVJkDSDTw2EzjSwWolGg2qfZaafyDgoxQO5HmQ5W7W C35Cox9UhnmpRY5X2St6LvdZCE1I0s62Q52m9QPVWsDlsP89b3P01p5AvfMfLSh4d+ y/QeuPrEn/Mog45AYAeNamBb0xteo2cdIHPkil4Vz0/7CeNkwNoA3DypOJ3vIX4UlT ByAyO3S/38SMsAVzc/3w3zZKcITN/nsjqf7YELPn/ZmAgFydENb5PzvjvI1IdDWOdF aH5PzFsan18rvb/WC5MO2zPCJAW5pgOYqSsTl/KQRrq1Dgem1pWxga7Cxkg3Y3xed8 s/zpkc3KXY0aA== From: Namhyung Kim To: Arnaldo Carvalho de Melo , Ian Rogers , Kan Liang Cc: Jiri Olsa , Adrian Hunter , Peter Zijlstra , Ingo Molnar , LKML , linux-perf-users@vger.kernel.org, Athira Rajeev , Masami Hiramatsu Subject: [PATCH 1/4] perf dwarf-aux: Handle bitfield members from pointer access Date: Wed, 21 Aug 2024 16:26:25 -0700 Message-ID: <20240821232628.353177-2-namhyung@kernel.org> X-Mailer: git-send-email 2.46.0.184.g6999bdac58-goog In-Reply-To: <20240821232628.353177-1-namhyung@kernel.org> References: <20240821232628.353177-1-namhyung@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The __die_find_member_offset_cb() missed to handle bitfield members which don't have DW_AT_data_member_location. Like in adding member types in __add_member_cb() it should fallback to check the bit offset when it resolves the member type for an offset. Fixes: 437683a994189 ("perf dwarf-aux: Handle type transfer for memory acce= ss") Cc: Masami Hiramatsu Signed-off-by: Namhyung Kim --- tools/perf/util/dwarf-aux.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c index 0151a8d14350..92eb9c8dc3e5 100644 --- a/tools/perf/util/dwarf-aux.c +++ b/tools/perf/util/dwarf-aux.c @@ -1977,8 +1977,15 @@ static int __die_find_member_offset_cb(Dwarf_Die *di= e_mem, void *arg) return DIE_FIND_CB_SIBLING; =20 /* Unions might not have location */ - if (die_get_data_member_location(die_mem, &loc) < 0) - loc =3D 0; + if (die_get_data_member_location(die_mem, &loc) < 0) { + Dwarf_Attribute attr; + + if (dwarf_attr_integrate(die_mem, DW_AT_data_bit_offset, &attr) && + dwarf_formudata(&attr, &loc) =3D=3D 0) + loc /=3D 8; + else + loc =3D 0; + } =20 if (offset =3D=3D loc) return DIE_FIND_CB_END; --=20 2.46.0.184.g6999bdac58-goog From nobody Sat Feb 7 10:08:41 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 038BA17C9F1; Wed, 21 Aug 2024 23:26:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1724282791; cv=none; b=OTrI3rRWpfaV0S69hjbsQRW7eFSfT2PKADoIn1HeFhheIIggf9QluC6rY5AdcTZxouhL23uvqFX4cMMwSKfdNGgay9T1ZBxISw1sWEjD2GgbMexU5QjtU4zAH7CjNdt/KjLewfzI3LCVegw2UQ/sFxmKCwzy1MvOMGAyMz+n3bw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1724282791; c=relaxed/simple; bh=ehGIy2G1PqpxUByasBwgEQIXnGHN6kauN4u3RFWqWQ4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=C+8MhXlJcwoVRaaxyg/tKT58Kbc2YoUKaXXXdUJZpJ1NqzS1VYsBvCQmHnRePs6yy1SOY39nc/SWkrKarBP3T9ounBnvxRyajHR5qu2DXhl+PVkbCBckAdOYb1NktstbWyV61M8DrrePUlYpfKWevSGRXSI8xEKpSmxZ5Riir8k= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=um48zyWt; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="um48zyWt" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 483C7C4AF15; Wed, 21 Aug 2024 23:26:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1724282790; bh=ehGIy2G1PqpxUByasBwgEQIXnGHN6kauN4u3RFWqWQ4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=um48zyWt38IoLP+ITAu38D8q7bZ4OxTFBL3wuAlMvemFl4i+L+noOgv/DviAKqcUt Sl/m7q+hRVe47NUhrzkRAyIyYEufrlkPqiuX4LnJLYcpGYZ4kbYwmlboXl0KhcRAdF M1isBBWWimyHLnnIQVsCVBIapOIeaknN6lGgWMEgK4Uy74hcBZmr/MRtGTDF7YN7tp SJewq+tERPR2Ene4Wy/oBd3GQ1LdYVYv952RrdFGKHbsLSwrnpjOhi+BdLBW5bTrWk +KBxd9lCSJ8/bmEAcbjSdZmQ989A+YUXQwIJFla2cPrztNYif3LYStSGbM9bfffffu BPG9LXLBrHObg== From: Namhyung Kim To: Arnaldo Carvalho de Melo , Ian Rogers , Kan Liang Cc: Jiri Olsa , Adrian Hunter , Peter Zijlstra , Ingo Molnar , LKML , linux-perf-users@vger.kernel.org, Athira Rajeev Subject: [PATCH 2/4] perf annotate-data: Update debug messages Date: Wed, 21 Aug 2024 16:26:26 -0700 Message-ID: <20240821232628.353177-3-namhyung@kernel.org> X-Mailer: git-send-email 2.46.0.184.g6999bdac58-goog In-Reply-To: <20240821232628.353177-1-namhyung@kernel.org> References: <20240821232628.353177-1-namhyung@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" In check_matching_type(), it'd be easier to display the typename in question if it's available. For example, check out the line starts with 'chk'. ----------------------------------------------------------- find data type for 0x10(reg0) at cpuacct_charge+0x13 CU for kernel/sched/build_utility.c (die:0x137ee0b) frame base: cfa=3D1 fbreg=3D7 scope: [3/3] (die:13d9632) bb: [c - 13] var [c] reg5 type=3D'struct task_struct*' size=3D0x8 (die:0x1381230) mov [c] 0xdf8(reg5) -> reg0 type=3D'struct css_set*' size=3D0x8 (die:0x13= 85c56) chk [13] reg0 offset=3D0x10 ok=3D1 kind=3D1 (struct css_set*) : Good! = <<<--- here found by insn track: 0x10(reg0) type-offset=3D0x10 final result: type=3D'struct css_set' size=3D0x250 (die:0x1385b0e) Another example: ----------------------------------------------------------- find data type for 0x8(reg0) at menu_select+0x279 CU for drivers/cpuidle/governors/menu.c (die:0x7b0fe79) frame base: cfa=3D1 fbreg=3D7 scope: [2/2] (die:7b11010) bb: [273 - 277] bb: [279 - 279] chk [279] reg0 offset=3D0x8 ok=3D0 kind=3D0 cfa : no type information scope: [1/2] (die:7b10cbc) bb: [0 - 64] ... mov [26a] imm=3D0xffffffff -> reg15 bb: [273 - 277] bb: [279 - 279] chk [279] reg0 offset=3D0x8 ok=3D1 kind=3D1 (long long unsigned int) : no= /void pointer <<<--- here final result: no/void pointer Also change some places to print negative offsets properly. Before: ----------------------------------------------------------- find data type for 0xffffff40(reg6) at __tcp_transmit_skb+0x58 After: ----------------------------------------------------------- find data type for -0xc0(reg6) at __tcp_transmit_skb+0x58 Signed-off-by: Namhyung Kim --- tools/perf/util/annotate-data.c | 45 +++++++++++++++++++++++++-------- 1 file changed, 35 insertions(+), 10 deletions(-) diff --git a/tools/perf/util/annotate-data.c b/tools/perf/util/annotate-dat= a.c index f5eefcb71c4f..cedfe6edcd45 100644 --- a/tools/perf/util/annotate-data.c +++ b/tools/perf/util/annotate-data.c @@ -960,9 +960,16 @@ static enum type_match_result check_matching_type(stru= ct type_state *state, Dwarf_Word size; u32 insn_offset =3D dloc->ip - dloc->ms->sym->start; int reg =3D dloc->op->reg1; + int offset =3D dloc->op->offset; + const char *offset_sign =3D ""; =20 - pr_debug_dtp("chk [%x] reg%d offset=3D%#x ok=3D%d kind=3D%d ", - insn_offset, reg, dloc->op->offset, + if (offset < 0) { + offset =3D -offset; + offset_sign =3D "-"; + } + + pr_debug_dtp("chk [%x] reg%d offset=3D%s%#x ok=3D%d kind=3D%d ", + insn_offset, reg, offset_sign, offset, state->regs[reg].ok, state->regs[reg].kind); =20 if (!state->regs[reg].ok) @@ -970,6 +977,12 @@ static enum type_match_result check_matching_type(stru= ct type_state *state, =20 if (state->regs[reg].kind =3D=3D TSR_KIND_TYPE) { Dwarf_Die sized_type; + struct strbuf sb; + + strbuf_init(&sb, 32); + die_get_typename_from_type(&state->regs[reg].type, &sb); + pr_debug_dtp("(%s)", sb.buf); + strbuf_release(&sb); =20 /* * Normal registers should hold a pointer (or array) to @@ -1119,7 +1132,6 @@ static enum type_match_result check_matching_type(str= uct type_state *state, check_kernel: if (dso__kernel(map__dso(dloc->ms->map))) { u64 addr; - int offset; =20 /* Direct this-cpu access like "%gs:0x34740" */ if (dloc->op->segment =3D=3D INSN_SEG_X86_GS && dloc->op->imm && @@ -1271,6 +1283,13 @@ static enum type_match_result find_data_type_block(s= truct data_loc_info *dloc, cu_die, type_die); if (ret =3D=3D PERF_TMR_OK) { char buf[64]; + int offset =3D dloc->op->offset; + const char *offset_sign =3D ""; + + if (offset < 0) { + offset =3D -offset; + offset_sign =3D "-"; + } =20 if (dloc->op->multi_regs) snprintf(buf, sizeof(buf), "reg%d, reg%d", @@ -1278,8 +1297,8 @@ static enum type_match_result find_data_type_block(st= ruct data_loc_info *dloc, else snprintf(buf, sizeof(buf), "reg%d", dloc->op->reg1); =20 - pr_debug_dtp("found by insn track: %#x(%s) type-offset=3D%#x\n", - dloc->op->offset, buf, dloc->type_offset); + pr_debug_dtp("found by insn track: %s%#x(%s) type-offset=3D%#x\n", + offset_sign, offset, buf, dloc->type_offset); break; } =20 @@ -1302,7 +1321,7 @@ static int find_data_type_die(struct data_loc_info *d= loc, Dwarf_Die *type_die) struct annotated_op_loc *loc =3D dloc->op; Dwarf_Die cu_die, var_die; Dwarf_Die *scopes =3D NULL; - int reg, offset; + int reg, offset =3D loc->offset; int ret =3D -1; int i, nr_scopes; int fbreg =3D -1; @@ -1312,6 +1331,7 @@ static int find_data_type_die(struct data_loc_info *d= loc, Dwarf_Die *type_die) u64 pc; char buf[64]; enum type_match_result result =3D PERF_TMR_UNKNOWN; + const char *offset_sign =3D ""; =20 if (dloc->op->multi_regs) snprintf(buf, sizeof(buf), "reg%d, reg%d", dloc->op->reg1, dloc->op->reg= 2); @@ -1320,10 +1340,15 @@ static int find_data_type_die(struct data_loc_info = *dloc, Dwarf_Die *type_die) else snprintf(buf, sizeof(buf), "reg%d", dloc->op->reg1); =20 + if (offset < 0) { + offset =3D -offset; + offset_sign =3D "-"; + } + pr_debug_dtp("-----------------------------------------------------------= \n"); - pr_debug_dtp("find data type for %#x(%s) at %s+%#"PRIx64"\n", - dloc->op->offset, buf, dloc->ms->sym->name, - dloc->ip - dloc->ms->sym->start); + pr_debug_dtp("find data type for %s%#x(%s) at %s+%#"PRIx64"\n", + offset_sign, offset, buf, + dloc->ms->sym->name, dloc->ip - dloc->ms->sym->start); =20 /* * IP is a relative instruction address from the start of the map, as @@ -1453,8 +1478,8 @@ static int find_data_type_die(struct data_loc_info *d= loc, Dwarf_Die *type_die) } =20 out: + pr_debug_dtp("final result: "); if (found) { - pr_debug_dtp("final type:"); pr_debug_type_name(type_die, TSR_KIND_TYPE); ret =3D 0; } else { --=20 2.46.0.184.g6999bdac58-goog From nobody Sat Feb 7 10:08:41 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 309A917D34D; Wed, 21 Aug 2024 23:26:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1724282791; cv=none; b=N2+dr05gOBY+8h/UNbxtt6IZNJ2ynbqhiyU9m3wMqpSEQmnbCRupeG56qTrIoaKuWPjOQkKt11/Pq94kGVSlYXdK2ovZKfg2glvm/1ZxqG5v5wyLzPcALsu0dANJDJ1+/uj8jEdGw9Pox518q2Zlv9cvdS5hzsfwQHebQ7gxT0c= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1724282791; c=relaxed/simple; bh=ZD3V5lXq0dOiGJvgR0GfD0Lbx8AsI7ZEokMA4pOyCHs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=YDvpG5E7mK9b24fZipTdWYVPqLE0Bjp06rSqsQ1BPqVPcUZkzveLPEVhV9IIpzIepFQllEHpblZ9wKYwcJMwFkR0/iXtGfhJqh3S0VreKmLZy1Z787Orf6/miNRxjMn1QiP96VSMKC44LSw644IaNNAzPoBO+6Vt6aJqrQHWgPA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=qAVrUch2; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="qAVrUch2" Received: by smtp.kernel.org (Postfix) with ESMTPSA id BB2ACC4AF14; Wed, 21 Aug 2024 23:26:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1724282791; bh=ZD3V5lXq0dOiGJvgR0GfD0Lbx8AsI7ZEokMA4pOyCHs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qAVrUch2Fqsfz8I3jbRqpS8X+sVyMhOsJ+gNz4skgX9xQNR9U5QNr9MpB8dx2TM64 k/Du8Xja5mumKbFF27vjPmogCJmsI3fhgy5dG8HqBF3t49rZJZUQlxNsJQQS/Cjo2c yCG2DGFbooURURIcvjJm4ySKiQImdstVPx0JGZYRIrjUJu2Jq4NnUvbGpOMeVT2BZP 3LEJHQs+PbDEBCpYml5zBIqK6QlTk+CVOfGpcthMm+BsOonQk4ieue17EKJhpcNmEN CT6Xe2/9I98B6fG3B9v9YsNcK2QnS4BXsHBJYelnPELofIm9X7Yc+doxrzwyApGP45 gIj37G2YulwpQ== From: Namhyung Kim To: Arnaldo Carvalho de Melo , Ian Rogers , Kan Liang Cc: Jiri Olsa , Adrian Hunter , Peter Zijlstra , Ingo Molnar , LKML , linux-perf-users@vger.kernel.org, Athira Rajeev Subject: [PATCH 3/4] perf annotate-data: Update stack slot for the store Date: Wed, 21 Aug 2024 16:26:27 -0700 Message-ID: <20240821232628.353177-4-namhyung@kernel.org> X-Mailer: git-send-email 2.46.0.184.g6999bdac58-goog In-Reply-To: <20240821232628.353177-1-namhyung@kernel.org> References: <20240821232628.353177-1-namhyung@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When checking the match variable at the target instruction, it might not have any information if it's a first write to a stack slot. In this case it could spill a register value into the stack so the type info is in the source operand. But currently it's hard to get the operand from the checking function. Let's process the instruction and retry to get the type info from the stack if there's no information already. This is an example of __tcp_transmit_skb(). The instructions are <__tcp_transmit_skb>: 0: nopl 0x0(%rax, %rax, 1) 5: push %rbp 6: mov %rsp, %rbp 9: push %r15 b: push %r14 d: push %r13 f: push %r12 11: push %rbx 12: sub $0x98, %rsp 19: mov %r8d, -0xa8(%rbp) ... It cannot find any variable at -0xa8(%rbp) at this point. ----------------------------------------------------------- find data type for -0xa8(reg6) at __tcp_transmit_skb+0x19 CU for net/ipv4/tcp_output.c (die:0x817f543) frame base: cfa=3D0 fbreg=3D6 scope: [1/1] (die:81aac3e) bb: [0 - 19] var [0] -0x98(stack) type=3D'struct tcp_out_options' size=3D0x28 (die:0x8= 1af3df) var [5] reg8 type=3D'unsigned int' size=3D0x4 (die:0x8180ed6) var [5] reg2 type=3D'unsigned int' size=3D0x4 (die:0x8180ed6) var [5] reg1 type=3D'int' size=3D0x4 (die:0x818059e) var [5] reg4 type=3D'struct sk_buff*' size=3D0x8 (die:0x8181360) var [5] reg5 type=3D'struct sock*' size=3D0x8 (die:0x8181a0c) chk [19] reg6 offset=3D-0xa8 ok=3D0 kind=3D0 fbreg : no type information no type information And it was able to find the type after processing the 'mov' instruction. ----------------------------------------------------------- find data type for -0xa8(reg6) at __tcp_transmit_skb+0x19 CU for net/ipv4/tcp_output.c (die:0x817f543) frame base: cfa=3D0 fbreg=3D6 scope: [1/1] (die:81aac3e) bb: [0 - 19] var [0] -0x98(stack) type=3D'struct tcp_out_options' size=3D0x28 (die:0x8= 1af3df) var [5] reg8 type=3D'unsigned int' size=3D0x4 (die:0x8180ed6) var [5] reg2 type=3D'unsigned int' size=3D0x4 (die:0x8180ed6) var [5] reg1 type=3D'int' size=3D0x4 (die:0x818059e) var [5] reg4 type=3D'struct sk_buff*' size=3D0x8 (die:0x8181360) var [5] reg5 type=3D'struct sock*' size=3D0x8 (die:0x8181a0c) chk [19] reg6 offset=3D-0xa8 ok=3D0 kind=3D0 fbreg : retry = <<<--- here mov [19] reg8 -> -0xa8(stack) type=3D'unsigned int' size=3D0x4 (die:0x818= 0ed6) chk [19] reg6 offset=3D-0xa8 ok=3D0 kind=3D0 fbreg : Good! found by insn track: -0xa8(reg6) type-offset=3D0 final result: type=3D'unsigned int' size=3D0x4 (die:0x8180ed6) Signed-off-by: Namhyung Kim --- tools/perf/util/annotate-data.c | 29 +++++++++++++++++++++++++---- 1 file changed, 25 insertions(+), 4 deletions(-) diff --git a/tools/perf/util/annotate-data.c b/tools/perf/util/annotate-dat= a.c index cedfe6edcd45..b33089caccbc 100644 --- a/tools/perf/util/annotate-data.c +++ b/tools/perf/util/annotate-data.c @@ -955,19 +955,22 @@ static void setup_stack_canary(struct data_loc_info *= dloc) static enum type_match_result check_matching_type(struct type_state *state, struct data_loc_info *dloc, Dwarf_Die *cu_die, + struct disasm_line *dl, Dwarf_Die *type_die) { Dwarf_Word size; - u32 insn_offset =3D dloc->ip - dloc->ms->sym->start; + u32 insn_offset =3D dl->al.offset; int reg =3D dloc->op->reg1; int offset =3D dloc->op->offset; const char *offset_sign =3D ""; + bool retry =3D true; =20 if (offset < 0) { offset =3D -offset; offset_sign =3D "-"; } =20 +again: pr_debug_dtp("chk [%x] reg%d offset=3D%s%#x ok=3D%d kind=3D%d ", insn_offset, reg, offset_sign, offset, state->regs[reg].ok, state->regs[reg].kind); @@ -1079,8 +1082,17 @@ static enum type_match_result check_matching_type(st= ruct type_state *state, pr_debug_dtp("fbreg"); =20 stack =3D find_stack_state(state, dloc->type_offset); - if (stack =3D=3D NULL) + if (stack =3D=3D NULL) { + if (retry) { + pr_debug_dtp(" : retry\n"); + retry =3D false; + + /* update type info it's the first store to the stack */ + update_insn_state(state, dloc, cu_die, dl); + goto again; + } return PERF_TMR_NO_TYPE; + } =20 if (stack->kind =3D=3D TSR_KIND_CANARY) { setup_stack_canary(dloc); @@ -1111,8 +1123,17 @@ static enum type_match_result check_matching_type(st= ruct type_state *state, return PERF_TMR_NO_TYPE; =20 stack =3D find_stack_state(state, dloc->type_offset - fboff); - if (stack =3D=3D NULL) + if (stack =3D=3D NULL) { + if (retry) { + pr_debug_dtp(" : retry\n"); + retry =3D false; + + /* update type info it's the first store to the stack */ + update_insn_state(state, dloc, cu_die, dl); + goto again; + } return PERF_TMR_NO_TYPE; + } =20 if (stack->kind =3D=3D TSR_KIND_CANARY) { setup_stack_canary(dloc); @@ -1202,7 +1223,7 @@ static enum type_match_result find_data_type_insn(str= uct data_loc_info *dloc, =20 if (this_ip =3D=3D dloc->ip) { ret =3D check_matching_type(&state, dloc, - cu_die, type_die); + cu_die, dl, type_die); pr_debug_dtp(" : %s\n", match_result_str(ret)); goto out; } --=20 2.46.0.184.g6999bdac58-goog From nobody Sat Feb 7 10:08:41 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id ED90117DFEC; Wed, 21 Aug 2024 23:26:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1724282792; cv=none; b=pnx/diQ05KaiYE/AOwSeSGY0eOALFLoc/Mxm4q/S/lgI7pqjpZflQBSKdmK2wX3yq8GqP1K5u9jMbl3xkTmiZQjMUrmWH6WVqVvT/OMpHl+RxTdkaALw0arAFQ782YRMQ2ZrXaQ2xglUQg4VUb4VyQIzAp1N7fjbKyAr6GMkyDQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1724282792; c=relaxed/simple; bh=YetaJCsMe1jW2DeFg6AkdVEOqTo94MXBhxk32FnOM8A=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Kvf7x87k1xJuMPyyMsZ7ZdcVjKSkUZ3Pd3VoHClsNs5+c+zOe6Pt/QkY/BauCVGa8zbf01zFG/2+XZ0OMmagJgl2NxU3vavIuxXAAqRlV4HXTwIoKUNoeoz5TsPkKry5e/mcVhSsurGs0VWXSYN6cpT920gDixPIUU/sHsGxUSY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=sLgekLp8; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="sLgekLp8" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 38DA7C32782; Wed, 21 Aug 2024 23:26:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1724282791; bh=YetaJCsMe1jW2DeFg6AkdVEOqTo94MXBhxk32FnOM8A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=sLgekLp8NYawdzslIQeQm+3resmqR2T6RqOX7gXDnaWiIRmF5/VLWbE6P5DpkXF93 DKK0T6HWZWawcVkXIprbwMtjK3I01vlSylzYCa44Wh1ZSy5Ojm+CJOz8xLfzY7Ebpz LFcl1o3BpZT6pealC9D/C5fk7BEiEm/5qz7svCT6BbMnzbd8b3nVCyUpo8A24SJxDc IUQF3umGli6Oz46G3fqpdEsrDcLHQgMOr58Hrpnx7Xz1qetn9ZcYyGJ8bGU4MZ4oSC l1Xg+y6cJ0/yaKsxXmbbKp0RGvOl3FcVllZw0ljFrzQVsc8ZRw29MIZwjmBIDSFn0l e3HvfJxWkHgBA== From: Namhyung Kim To: Arnaldo Carvalho de Melo , Ian Rogers , Kan Liang Cc: Jiri Olsa , Adrian Hunter , Peter Zijlstra , Ingo Molnar , LKML , linux-perf-users@vger.kernel.org, Athira Rajeev Subject: [PATCH 4/4] perf annotate-data: Copy back variable types after move Date: Wed, 21 Aug 2024 16:26:28 -0700 Message-ID: <20240821232628.353177-5-namhyung@kernel.org> X-Mailer: git-send-email 2.46.0.184.g6999bdac58-goog In-Reply-To: <20240821232628.353177-1-namhyung@kernel.org> References: <20240821232628.353177-1-namhyung@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" In some cases, compilers don't set the location expression in DWARF precisely. For instance, it may assign a variable to a register after copying it from a different register. Then it should use the register for the new type but still uses the old register. This makes hard to track the type information properly. This is an example I found in __tcp_transmit_skb(). The first argument (sk) of this function is a pointer to sock and there's a variable (tp) for tcp_sock. static int __tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it, gfp_t gfp_mask, u32 rcv_nxt) { ... struct tcp_sock *tp; BUG_ON(!skb || !tcp_skb_pcount(skb)); tp =3D tcp_sk(sk); prior_wstamp =3D tp->tcp_wstamp_ns; tp->tcp_wstamp_ns =3D max(tp->tcp_wstamp_ns, tp->tcp_clock_cache); ... So it basically calls tcp_sk(sk) to get the tcp_sock pointer from sk. But it turned out to be the same value because tcp_sock embeds sock as the first member. The sk is located in reg5 (RDI) and tp is in reg3 (RBX). The offset of tcp_wstamp_ns is 0x748 and tcp_clock_cache is 0x750. So you need to use RBX (reg3) to access the fields in the tcp_sock. But the code used RDI (reg5) as it has the same value. $ pahole --hex -C tcp_sock vmlinux | grep -e 748 -e 750 u64 tcp_wstamp_ns; /* 0x748 0x8 */ u64 tcp_clock_cache; /* 0x750 0x8 */ And this is the disassembly of the part of the function. <__tcp_transmit_skb>: ... 44: mov %rdi, %rbx 47: mov 0x748(%rdi), %rsi 4e: mov 0x750(%rdi), %rax 55: cmp %rax, %rsi Because compiler put the debug info to RBX, it only knows RDI is a pointer to sock and accessing those two fields resulted in error due to offset being beyond the type size. ----------------------------------------------------------- find data type for 0x748(reg5) at __tcp_transmit_skb+0x63 CU for net/ipv4/tcp_output.c (die:0x817f543) frame base: cfa=3D0 fbreg=3D6 scope: [1/1] (die:81aac3e) bb: [0 - 30] var [0] -0x98(stack) type=3D'struct tcp_out_options' size=3D0x28 (die:0x8= 1af3df) var [5] reg8 type=3D'unsigned int' size=3D0x4 (die:0x8180ed6) var [5] reg2 type=3D'unsigned int' size=3D0x4 (die:0x8180ed6) var [5] reg1 type=3D'int' size=3D0x4 (die:0x818059e) var [5] reg4 type=3D'struct sk_buff*' size=3D0x8 (die:0x8181360) var [5] reg5 type=3D'struct sock*' size=3D0x8 (die:0x8181a0c) = <<<--- the first argument ('sk' at %RDI) mov [19] reg8 -> -0xa8(stack) type=3D'unsigned int' size=3D0x4 (die:0x818= 0ed6) mov [20] stack canary -> reg0 mov [29] reg0 -> -0x30(stack) stack canary bb: [36 - 3e] mov [36] reg4 -> reg15 type=3D'struct sk_buff*' size=3D0x8 (die:0x8181360) bb: [44 - 63] mov [44] reg5 -> reg3 type=3D'struct sock*' size=3D0x8 (die:0x8181a0c) = <<<--- calling tcp_sk() var [47] reg3 type=3D'struct tcp_sock*' size=3D0x8 (die:0x819eead) = <<<--- new variable ('tp' at %RBX) var [4e] reg4 type=3D'unsigned long long' size=3D0x8 (die:0x8180edd) mov [58] reg4 -> -0xc0(stack) type=3D'unsigned long long' size=3D0x8 (die= :0x8180edd) chk [63] reg5 offset=3D0x748 ok=3D1 kind=3D1 (struct sock*) : offset bigg= er than size <<<--- access with old variable final result: offset bigger than size While it's a fault in the compiler, we could work around this issue by using the type of new variable when it's copied directly. So I've added copied_from field in the register state to track those direct register to register copies. After that new register gets a new type and the old register still has the same type, it'll update (copy it back) the type of the old register. For example, if we can update type of reg5 at __tcp_transmit_skb+0x47, we can find the target type of the instruction at 0x63 like below: ----------------------------------------------------------- find data type for 0x748(reg5) at __tcp_transmit_skb+0x63 ... bb: [44 - 63] mov [44] reg5 -> reg3 type=3D'struct sock*' size=3D0x8 (die:0x8181a0c) var [47] reg3 type=3D'struct tcp_sock*' size=3D0x8 (die:0x819eead) var [47] copyback reg5 type=3D'struct tcp_sock*' size=3D0x8 (die:0x819eea= d) <<<--- here mov [47] 0x748(reg5) -> reg4 type=3D'unsigned long long' size=3D0x8 (die:= 0x8180edd) mov [4e] 0x750(reg5) -> reg0 type=3D'unsigned long long' size=3D0x8 (die:= 0x8180edd) mov [58] reg4 -> -0xc0(stack) type=3D'unsigned long long' size=3D0x8 (die= :0x8180edd) chk [63] reg5 offset=3D0x748 ok=3D1 kind=3D1 (struct tcp_sock*) : Good! = <<<--- new type found by insn track: 0x748(reg5) type-offset=3D0x748 final result: type=3D'struct tcp_sock' size=3D0xa98 (die:0x819eeb2) Signed-off-by: Namhyung Kim --- tools/perf/arch/x86/annotate/instructions.c | 8 ++++++ tools/perf/util/annotate-data.c | 31 +++++++++++++++++++++ tools/perf/util/annotate-data.h | 1 + 3 files changed, 40 insertions(+) diff --git a/tools/perf/arch/x86/annotate/instructions.c b/tools/perf/arch/= x86/annotate/instructions.c index 15dfc2988e24..5caf5a17f03d 100644 --- a/tools/perf/arch/x86/annotate/instructions.c +++ b/tools/perf/arch/x86/annotate/instructions.c @@ -267,6 +267,7 @@ static void update_insn_state_x86(struct type_state *st= ate, return; =20 tsr =3D &state->regs[dst->reg1]; + tsr->copied_from =3D -1; =20 if (src->imm) imm_value =3D src->offset; @@ -326,6 +327,8 @@ static void update_insn_state_x86(struct type_state *st= ate, return; =20 tsr =3D &state->regs[dst->reg1]; + tsr->copied_from =3D -1; + if (dso__kernel(map__dso(dloc->ms->map)) && src->segment =3D=3D INSN_SEG_X86_GS && src->imm) { u64 ip =3D dloc->ms->sym->start + dl->al.offset; @@ -386,6 +389,10 @@ static void update_insn_state_x86(struct type_state *s= tate, tsr->imm_value =3D state->regs[src->reg1].imm_value; tsr->ok =3D true; =20 + /* To copy back the variable type later (hopefully) */ + if (tsr->kind =3D=3D TSR_KIND_TYPE) + tsr->copied_from =3D src->reg1; + pr_debug_dtp("mov [%x] reg%d -> reg%d", insn_offset, src->reg1, dst->reg1); pr_debug_type_name(&tsr->type, tsr->kind); @@ -398,6 +405,7 @@ static void update_insn_state_x86(struct type_state *st= ate, return; =20 tsr =3D &state->regs[dst->reg1]; + tsr->copied_from =3D -1; =20 retry: /* Check stack variables with offset */ diff --git a/tools/perf/util/annotate-data.c b/tools/perf/util/annotate-dat= a.c index b33089caccbc..81efd5bdb93b 100644 --- a/tools/perf/util/annotate-data.c +++ b/tools/perf/util/annotate-data.c @@ -774,6 +774,11 @@ bool get_global_var_type(Dwarf_Die *cu_die, struct dat= a_loc_info *dloc, return true; } =20 +static bool die_is_same(Dwarf_Die *die_a, Dwarf_Die *die_b) +{ + return (die_a->cu =3D=3D die_b->cu) && (die_a->addr =3D=3D die_b->addr); +} + /** * update_var_state - Update type state using given variables * @state: type state table @@ -825,6 +830,7 @@ static void update_var_state(struct type_state *state, = struct data_loc_info *dlo pr_debug_type_name(&mem_die, TSR_KIND_TYPE); } else if (has_reg_type(state, var->reg) && var->offset =3D=3D 0) { struct type_state_reg *reg; + Dwarf_Die orig_type; =20 reg =3D &state->regs[var->reg]; =20 @@ -832,6 +838,8 @@ static void update_var_state(struct type_state *state, = struct data_loc_info *dlo !is_better_type(®->type, &mem_die)) continue; =20 + orig_type =3D reg->type; + reg->type =3D mem_die; reg->kind =3D TSR_KIND_TYPE; reg->ok =3D true; @@ -839,6 +847,29 @@ static void update_var_state(struct type_state *state,= struct data_loc_info *dlo pr_debug_dtp("var [%"PRIx64"] reg%d", insn_offset, var->reg); pr_debug_type_name(&mem_die, TSR_KIND_TYPE); + + /* + * If this register is directly copied from another and it gets a + * better type, also update the type of the source register. This + * is usually the case of container_of() macro with offset of 0. + */ + if (has_reg_type(state, reg->copied_from)) { + struct type_state_reg *copy_reg; + + copy_reg =3D &state->regs[reg->copied_from]; + + /* TODO: check if type is compatible or embedded */ + if (!copy_reg->ok || (copy_reg->kind !=3D TSR_KIND_TYPE) || + !die_is_same(©_reg->type, &orig_type) || + !is_better_type(©_reg->type, &mem_die)) + continue; + + copy_reg->type =3D mem_die; + + pr_debug_dtp("var [%"PRIx64"] copyback reg%d", + insn_offset, reg->copied_from); + pr_debug_type_name(&mem_die, TSR_KIND_TYPE); + } } } } diff --git a/tools/perf/util/annotate-data.h b/tools/perf/util/annotate-dat= a.h index 37a1a3b68e0b..8ac0fd94a0ba 100644 --- a/tools/perf/util/annotate-data.h +++ b/tools/perf/util/annotate-data.h @@ -176,6 +176,7 @@ struct type_state_reg { bool ok; bool caller_saved; u8 kind; + u8 copied_from; }; =20 /* Type information in a stack location, dynamically allocated */ --=20 2.46.0.184.g6999bdac58-goog