linux.git/tools/perf/util/annotate-arch, branch master

perf annotate: Use jump__delete when freeing LoongArch jumps

2026-04-14T06:41:11+00:00

Currently, the initialization of loongarch_jump_ops does not contain an
assignment to its .free field. This causes disasm_line__free() to fall
through to ins_ops__delete() for LoongArch jump instructions.

ins_ops__delete() will free ins_operands.source.raw and
ins_operands.source.name, and these fields overlaps with
ins_operands.jump.raw_comment and ins_operands.jump.raw_func_start.
Since in loongarch_jump__parse(), these two fields are populated by
strchr()-ing the same buffer, trying to free them will lead to undefined
behavior.

This invalid free usually leads to crashes:

        Process 1712902 (perf) of user 1000 dumped core.
        Stack trace of thread 1712902:
        #0  0x00007fffef155c58 n/a (libc.so.6 + 0x95c58)
        #1  0x00007fffef0f7a94 raise (libc.so.6 + 0x37a94)
        #2  0x00007fffef0dd6a8 abort (libc.so.6 + 0x1d6a8)
        #3  0x00007fffef145490 n/a (libc.so.6 + 0x85490)
        #4  0x00007fffef1646f4 n/a (libc.so.6 + 0xa46f4)
        #5  0x00007fffef164718 n/a (libc.so.6 + 0xa4718)
        #6  0x00005555583a6764 __zfree (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x106764)
        #7  0x000055555854fb70 disasm_line__free (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x2afb70)
        #8  0x000055555853d618 annotated_source__purge (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x29d618)
        #9  0x000055555852300c __hist_entry__tui_annotate (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x28300c)
        #10 0x0000555558526718 do_annotate (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x286718)
        #11 0x000055555852ed94 evsel__hists_browse (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x28ed94)
        #12 0x000055555831fdd0 cmd_report (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x7fdd0)
        #13 0x000055555839b644 handle_internal_command (/home/csmantle/dist/linux-arch/tools/perf/perf + 0xfb644)
        #14 0x00005555582fe6ac main (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x5e6ac)
        #15 0x00007fffef0ddd90 n/a (libc.so.6 + 0x1dd90)
        #16 0x00007fffef0ddf0c __libc_start_main (libc.so.6 + 0x1df0c)
        #17 0x00005555582fed10 _start (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x5ed10)
        ELF object binary architecture: LoongArch

... and it can be confirmed with Valgrind:

        ==1721834== Invalid free() / delete / delete[] / realloc()
        ==1721834==    at 0x4EA9014: free (in /usr/lib/valgrind/vgpreload_memcheck-loongarch64-linux.so)
        ==1721834==    by 0x4106287: __zfree (zalloc.c:13)
        ==1721834==    by 0x42ADC8F: disasm_line__free (in /home/csmantle/dist/linux-arch/tools/perf/perf)
        ==1721834==    by 0x429B737: annotated_source__purge (in /home/csmantle/dist/linux-arch/tools/perf/perf)
        ==1721834==    by 0x42811EB: __hist_entry__tui_annotate (in /home/csmantle/dist/linux-arch/tools/perf/perf)
        ==1721834==    by 0x42848D7: do_annotate (in /home/csmantle/dist/linux-arch/tools/perf/perf)
        ==1721834==    by 0x428CF33: evsel__hists_browse (in /home/csmantle/dist/linux-arch/tools/perf/perf)
        ==1721834==  Address 0x7d34303 is 35 bytes inside a block of size 62 alloc'd
        ==1721834==    at 0x4EA59B8: malloc (in /usr/lib/valgrind/vgpreload_memcheck-loongarch64-linux.so)
        ==1721834==    by 0x6B80B6F: strdup (strdup.c:42)
        ==1721834==    by 0x42AD917: disasm_line__new (in /home/csmantle/dist/linux-arch/tools/perf/perf)
        ==1721834==    by 0x42AE5A3: symbol__disassemble_objdump (in /home/csmantle/dist/linux-arch/tools/perf/perf)
        ==1721834==    by 0x42AF0A7: symbol__disassemble (in /home/csmantle/dist/linux-arch/tools/perf/perf)
        ==1721834==    by 0x429B3CF: symbol__annotate (in /home/csmantle/dist/linux-arch/tools/perf/perf)
        ==1721834==    by 0x429C233: symbol__annotate2 (in /home/csmantle/dist/linux-arch/tools/perf/perf)
        ==1721834==    by 0x42804D3: __hist_entry__tui_annotate (in /home/csmantle/dist/linux-arch/tools/perf/perf)
        ==1721834==    by 0x42848D7: do_annotate (in /home/csmantle/dist/linux-arch/tools/perf/perf)
        ==1721834==    by 0x428CF33: evsel__hists_browse (in /home/csmantle/dist/linux-arch/tools/perf/perf)

This patch adds the missing free() specialization in loongarch_jump_ops,
which prevents disasm_line__free() from invoking the default cleanup
function.

Fixes: fb7fd2a14a503b9a ("perf annotate: Move raw_comment and raw_func_start fields out of 'struct ins_operands'")
Cc: stable@vger.kernel.org
Cc: WANG Rui 
Cc: Huacai Chen 
Cc: WANG Xuerui 
Cc: loongarch@lists.linux.dev
Signed-off-by: Rong Bao 
Tested-by: WANG Rui 
Signed-off-by: Namhyung Kim

perf tools: Use calloc() where applicable

2026-04-09T02:21:05+00:00

Instead of using zalloc(nr_entries * sizeof_entry) that is what calloc()
does.

In some places where linux/zalloc.h isn't needed, remove it, add when
needed and was getting it indirectly.

Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: Namhyung Kim

Merge tag 'perf-tools-fixes-for-v7.0-2-2026-03-23' into perf-tools-next

2026-03-25T07:06:23+00:00

To get the various fixes for v7.0.

Signed-off-by: Namhyung Kim

perf annotate-data: Use DWARF location ranges to preserve reg state

2026-03-19T21:42:29+00:00

When a function call occurs, caller-saved registers are typically
invalidated since the callee may clobber them. However, DWARF debug info
provides location ranges that indicate exactly where a variable is valid
in a register.

Track the DWARF location range end address in type_state_reg and use it
to determine if a caller-saved register should be preserved across a
call. If the current call address is within the DWARF-specified lifetime
of the variable, keep the register state valid instead of invalidating
it.

This improves type annotation for code where the compiler knows a
register value survives across calls (e.g., when the callee is known not
to clobber certain registers or when the value is reloaded after the
call at the same logical location).

Changes:
- Add `end` and `has_range` fields to die_var_type to capture DWARF
  location range information
- Add `lifetime_active` and `lifetime_end` fields to type_state_reg
- Check location lifetime before invalidating caller-saved registers

Signed-off-by: Zecheng Li 
Signed-off-by: Namhyung Kim

perf annotate-data: Invalidate caller-saved regs for all calls

2026-03-19T21:42:29+00:00

Previously, the x86 call handler returned early without invalidating
caller-saved registers when the call target symbol could not be resolved
(func == NULL). This violated the ABI which requires caller-saved
registers to be considered clobbered after any call instruction.

Fix this by:
1. Always invalidating caller-saved registers for any call instruction
   (except __fentry__ which preserves registers)
2. Using dl->ops.target.name as fallback when func->name is unavailable,
   allowing return type lookup for more call targets

This is a conservative change that may reduce type coverage for indirect
calls (e.g., callq *(%rax)) where we cannot determine the return type
but it ensures correctness.

Signed-off-by: Zecheng Li 
Signed-off-by: Namhyung Kim

perf annotate-data: Add invalidate_reg_state() helper for x86

2026-03-19T21:42:29+00:00

Add a helper function to consistently invalidate register state instead
of field assignments. This ensures kind, ok, and copied_from are all
properly cleared when a register becomes invalid.

The helper sets:
- kind = TSR_KIND_INVALID
- ok = false
- copied_from = -1

Replace all invalidation patterns with calls to this helper. No
functional change and this removes some incorrect annotations that were
caused by incomplete invalidation (e.g. a obsolete copied_from from an
invalidated register).

Signed-off-by: Zecheng Li 
Signed-off-by: Namhyung Kim

perf annotate loongarch: Fix off-by-one bug in outside check

2026-03-10T15:06:57+00:00

A copy-paste of a similar issue fixed by Peter Collingbourne in:
https://lore.kernel.org/linux-perf-users/20260304190613.2507582-1-pcc@google.com/

Signed-off-by: Ian Rogers 
Cc: Adrian Hunter 
Cc: Alexander Shishkin 
Cc: Bill Wendling 
Cc: Ingo Molnar 
Cc: James Clark 
Cc: Jiri Olsa 
Cc: Justin Stitt 
Cc: Mark Rutland 
Cc: Namhyung Kim 
Cc: Nathan Chancellor 
Cc: Nick Desaulniers 
Cc: Peter Collingbourne 
Cc: Peter Zijlstra 
Signed-off-by: Arnaldo Carvalho de Melo

perf disasm: Refactor arch__find and initialization of arch structs

2026-01-23T19:58:39+00:00

Switch arch__find to using an ELF machine number rather than a
string.

Rather than an array of fixed size arch structs turn the init functions
into new functions indexed by the ELF machine they correspond to.

This allows data to be stored with a struct arch with the container_of
trick, so the priv variable can be removed.

Switch to using the thread to find the arch rather than the evsel as the
evsel only has limited notions of the running thread upon which
disassembly is performed.

Factor out the e_machine and e_flags into their own struct to make them
easier to pass around.

Reviewed-by: James Clark 
Signed-off-by: Ian Rogers 
Cc: Aditya Bodkhe 
Cc: Adrian Hunter 
Cc: Albert Ou 
Cc: Alexander Shishkin 
Cc: Alexandre Ghiti 
Cc: Athira Rajeev 
Cc: Bill Wendling 
Cc: Dr. David Alan Gilbert 
Cc: Guo Ren 
Cc: Howard Chu 
Cc: Ingo Molnar 
Cc: Jiri Olsa 
Cc: John Garry 
Cc: Julia Lawall 
Cc: Justin Stitt 
Cc: Krzysztof Łopatowski 
Cc: Leo Yan 
Cc: Namhyung Kim 
Cc: Nathan Chancellor 
Cc: Nick Desaulniers 
Cc: Palmer Dabbelt 
Cc: Paul Walmsley 
Cc: Peter Zijlstra 
Cc: Sergei Trofimovich 
Cc: Shimin Guo 
Cc: Suchit Karunakaran 
Cc: Thomas Falcon 
Cc: Tianyou Li 
Cc: Will Deacon 
Cc: Zecheng Li 
[ Include elf.h for EM_CSKY and friends and also conditionally define EM_CSKY_ABIMASK for old distros ]
Signed-off-by: Arnaldo Carvalho de Melo

perf map_symbol: Switch from holding maps to holding thread

2026-01-23T19:58:39+00:00

maps may belong to >1 thread. In contexts like symbolization
information from the thread may be useful, such as the ELF machine.

As the maps can be gained from the thread switch from holding maps in
struct map_symbol to holding the thread.

Holding the maps in addr_location is also redundant, switch this to
using thread__maps.

Reviewed-by: James Clark 
Signed-off-by: Ian Rogers 
Cc: Aditya Bodkhe 
Cc: Adrian Hunter 
Cc: Albert Ou 
Cc: Alexander Shishkin 
Cc: Alexandre Ghiti 
Cc: Athira Rajeev 
Cc: Bill Wendling 
Cc: Dr. David Alan Gilbert 
Cc: Guo Ren 
Cc: Howard Chu 
Cc: Ingo Molnar 
Cc: Jiri Olsa 
Cc: John Garry 
Cc: Julia Lawall 
Cc: Justin Stitt 
Cc: Krzysztof Łopatowski 
Cc: Leo Yan 
Cc: Namhyung Kim 
Cc: Nathan Chancellor 
Cc: Nick Desaulniers 
Cc: Palmer Dabbelt 
Cc: Paul Walmsley 
Cc: Peter Zijlstra 
Cc: Sergei Trofimovich 
Cc: Shimin Guo 
Cc: Suchit Karunakaran 
Cc: Thomas Falcon 
Cc: Tianyou Li 
Cc: Will Deacon 
Cc: Zecheng Li 
Signed-off-by: Arnaldo Carvalho de Melo

perf disasm: Refactor ins__is_call/jump to avoid exposing arch ins_ops

2026-01-23T19:58:38+00:00

Add booleans indicating whether and ins_ops are call or jump and
return it. This avoids exposing loongarch and s390 ins_ops for the
sake of matching.

Reviewed-by: James Clark 
Signed-off-by: Ian Rogers 
Cc: Aditya Bodkhe 
Cc: Adrian Hunter 
Cc: Albert Ou 
Cc: Alexander Shishkin 
Cc: Alexandre Ghiti 
Cc: Athira Rajeev 
Cc: Bill Wendling 
Cc: Dr. David Alan Gilbert 
Cc: Guo Ren 
Cc: Howard Chu 
Cc: Ingo Molnar 
Cc: Jiri Olsa 
Cc: John Garry 
Cc: Julia Lawall 
Cc: Justin Stitt 
Cc: Krzysztof Łopatowski 
Cc: Leo Yan 
Cc: Namhyung Kim 
Cc: Nathan Chancellor 
Cc: Nick Desaulniers 
Cc: Palmer Dabbelt 
Cc: Paul Walmsley 
Cc: Peter Zijlstra 
Cc: Sergei Trofimovich 
Cc: Shimin Guo 
Cc: Suchit Karunakaran 
Cc: Thomas Falcon 
Cc: Tianyou Li 
Cc: Will Deacon 
Cc: Zecheng Li 
Signed-off-by: Arnaldo Carvalho de Melo