Re: Crash in pmc: [pmc,1762] negative increment cpu=1 ri=17 newvalue=45d4906d saved=fffff616cee9 incr=ffff00004fbdc184

Hello Alexander,

I believe this is related to a bug I'm looking into, otherwise you may be
using a counter that's not really a counter.  We probably need to remove
that assert for some of the memory counters.

With process mode counters we eventually don't re-enable the pmc on a
context switch and you will eventually just see zeros for the incremental
counts.  That's probably what's happening here is that when it queries the
PMC it goes from some positive number to zero in the next sample.  Also
explains why you don't see this problem with sleep because it takes a few
context switches for it to show up.

Not sure when this bug was introduced but it seems to be fairly old and I
wasn't readily hitting it in some cases.

Do you mind sharing the pmcstat command you tested with?

Best,
Ali


On Sun, Jul 12, 2026 at 9:19 AM Alexander Leidinger <Alexander@leidinger.net>
wrote:

> Hi,
>
> I wanted to do some pmc based sampling in a jail and this crashed the
> kernel. Not directly, a "sleep 1" test was ok. The real application
> resulted in:
> ---snip---
> __curthread () at /space/system/usr_src/sys/amd64/include/pcpu_aux.h:57
> 57              __asm("movq %%gs:%c1,%0" : "=r" (td)
> (kgdb) #0  __curthread () at
> /space/system/usr_src/sys/amd64/include/pcpu_aux.h:57
>          td = <optimized out>
> #1  doadump (textdump=textdump@entry=1)
>      at /space/system/usr_src/sys/kern/kern_shutdown.c:399
>          error = 0
>          coredump = <optimized out>
> #2  0xffffffff8056183c in kern_reboot (howto=260)
>      at /space/system/usr_src/sys/kern/kern_shutdown.c:519
>          once = 0
>          __pc = 0x0
> #3  0xffffffff80561d5d in vpanic (fmt=<optimized out>,
>      ap=ap@entry=0xfffffe0797916c90)
>      at /space/system/usr_src/sys/kern/kern_shutdown.c:974
>          buf = "[pmc,1762] negative increment cpu=1 ri=17
> newvalue=45d4906d saved=fffff616cee9 incr=ffff00004fbdc184", '\000'
> <repeats 155 times>
>          __pc = 0x0
>          __pc = 0x0
>          __pc = 0x0
>          other_cpus = {__bits = {16777213, 0 <repeats 15 times>}}
>          td = 0xfffff80a4c988000
>          bootopt = <unavailable>
>          newpanic = <optimized out>
> #4  0xffffffff80561ba3 in panic (fmt=<unavailable>)
>      at /space/system/usr_src/sys/kern/kern_shutdown.c:887
>          ap = {{gp_offset = 48, fp_offset = 48,
>              overflow_arg_area = 0xfffffe0797916cc8,
>              reg_save_area = 0xfffffe0797916c60}}
> #5  0xffffffff8455ae47 in pmc_hook_handler (td=0xfffff80a4c988000,
>      function=<optimized out>, arg=<optimized out>)
>      at /space/system/usr_src/sys/dev/hwpmc/hwpmc_mod.c:1759
>          __pc = 0x0
>          __pc = 0x0
>          __pc = 0x0
>          __pc = 0x0
>          cpu = <optimized out>
> #6  0xffffffff80596d8d in sched_ule_sswitch (td=0xfffff80a4c988000,
>      flags=<optimized out>) at
> /space/system/usr_src/sys/kern/sched_ule.c:2389
>          __pc = 0x0
>          __pc = 0x0
>          __pc = 0x0
>          cpuid = <optimized out>
>          tdq = <optimized out>
>          ts = 0xfffff80a4c988720
>          preempted = <optimized out>
>          mtx = 0xfffffe0065b291c0
>          srqflag = <optimized out>
>          newtd = 0xfffff80df74e4780
>          pickcpu = <optimized out>
> #7  0xffffffff8056e8c8 in mi_switch (flags=flags@entry=517)
>      at /space/system/usr_src/sys/kern/kern_synch.c:526
>          __pc = 0x0
>          __pc = 0x0
>          __pc = 0x0
>          __pc = 0x0
>          __pc = 0x0
>          td = 0xfffff80a4c988000
>          new_switchtime = <optimized out>
>          runtime = <optimized out>
> ---snip---
>
> Core available.
>
> Bye,
> Alexander.
>
> --
> http://www.Leidinger.net Alexander@Leidinger.net: PGP 0x8F31830F9F2772BF
> http://www.FreeBSD.org    netchild@FreeBSD.org  : PGP 0x8F31830F9F2772BF
>