Re: Crash in pmc: [pmc,1762] negative increment cpu=1 ri=17 newvalue=45d4906d saved=fffff616cee9 incr=ffff00004fbdc184

Am 2026-07-14 00:28, schrieb Ali Mashtizadeh:

> Hello Alexander,
> 
> I believe this is related to a bug I'm looking into, otherwise you may 
> be using a counter that's not really a counter.  We probably need to 
> remove that assert for some of the memory counters.
> 
> With process mode counters we eventually don't re-enable the pmc on a 
> context switch and you will eventually just see zeros for the 
> incremental counts.  That's probably what's happening here is that when 
> it queries the PMC it goes from some positive number to zero in the 
> next sample.  Also explains why you don't see this problem with sleep 
> because it takes a few context switches for it to show up.
> 
> Not sure when this bug was introduced but it seems to be fairly old and 
> I wasn't readily hitting it in some cases.
> 
> Do you mind sharing the pmcstat command you tested with?

cpuset -l 1 pmcstat -p inst_retired.any_p -p cpu_clk_unhalted.thread_p 
-p br_misp_retired.all_branches \
        /tmp/lame-off/lame/frontend/lame --quiet -b 320 /tmp/corpus.wav 
/tmp/o.mp3

CPU Intel Xeon X5675 (Westmere-EP)

from inside a jail

Bye,
Alexander.

> Best, Ali
> 
> On Sun, Jul 12, 2026 at 9:19 AM Alexander Leidinger 
> <Alexander@leidinger.net> wrote:
> 
>> Hi,
>> 
>> I wanted to do some pmc based sampling in a jail and this crashed the
>> kernel. Not directly, a "sleep 1" test was ok. The real application
>> resulted in:
>> ---snip---
>> __curthread () at 
>> /space/system/usr_src/sys/amd64/include/pcpu_aux.h:57
>> 57              __asm("movq %%gs:%c1,%0" : "=r" (td)
>> (kgdb) #0  __curthread () at
>> /space/system/usr_src/sys/amd64/include/pcpu_aux.h:57
>> td = <optimized out>
>> #1  doadump (textdump=textdump@entry=1)
>> at /space/system/usr_src/sys/kern/kern_shutdown.c:399
>> error = 0
>> coredump = <optimized out>
>> #2  0xffffffff8056183c in kern_reboot (howto=260)
>> at /space/system/usr_src/sys/kern/kern_shutdown.c:519
>> once = 0
>> __pc = 0x0
>> #3  0xffffffff80561d5d in vpanic (fmt=<optimized out>,
>> ap=ap@entry=0xfffffe0797916c90)
>> at /space/system/usr_src/sys/kern/kern_shutdown.c:974
>> buf = "[pmc,1762] negative increment cpu=1 ri=17
>> newvalue=45d4906d saved=fffff616cee9 incr=ffff00004fbdc184", '\000'
>> <repeats 155 times>
>> __pc = 0x0
>> __pc = 0x0
>> __pc = 0x0
>> other_cpus = {__bits = {16777213, 0 <repeats 15 times>}}
>> td = 0xfffff80a4c988000
>> bootopt = <unavailable>
>> newpanic = <optimized out>
>> #4  0xffffffff80561ba3 in panic (fmt=<unavailable>)
>> at /space/system/usr_src/sys/kern/kern_shutdown.c:887
>> ap = {{gp_offset = 48, fp_offset = 48,
>> overflow_arg_area = 0xfffffe0797916cc8,
>> reg_save_area = 0xfffffe0797916c60}}
>> #5  0xffffffff8455ae47 in pmc_hook_handler (td=0xfffff80a4c988000,
>> function=<optimized out>, arg=<optimized out>)
>> at /space/system/usr_src/sys/dev/hwpmc/hwpmc_mod.c:1759
>> __pc = 0x0
>> __pc = 0x0
>> __pc = 0x0
>> __pc = 0x0
>> cpu = <optimized out>
>> #6  0xffffffff80596d8d in sched_ule_sswitch (td=0xfffff80a4c988000,
>> flags=<optimized out>) at
>> /space/system/usr_src/sys/kern/sched_ule.c:2389
>> __pc = 0x0
>> __pc = 0x0
>> __pc = 0x0
>> cpuid = <optimized out>
>> tdq = <optimized out>
>> ts = 0xfffff80a4c988720
>> preempted = <optimized out>
>> mtx = 0xfffffe0065b291c0
>> srqflag = <optimized out>
>> newtd = 0xfffff80df74e4780
>> pickcpu = <optimized out>
>> #7  0xffffffff8056e8c8 in mi_switch (flags=flags@entry=517)
>> at /space/system/usr_src/sys/kern/kern_synch.c:526
>> __pc = 0x0
>> __pc = 0x0
>> __pc = 0x0
>> __pc = 0x0
>> __pc = 0x0
>> td = 0xfffff80a4c988000
>> new_switchtime = <optimized out>
>> runtime = <optimized out>
>> ---snip---
>> 
>> Core available.
>> 
>> Bye,
>> Alexander.
>> 
>> --
>> http://www.Leidinger.net Alexander@Leidinger.net: PGP 
>> 0x8F31830F9F2772BF
>> http://www.FreeBSD.org    netchild@FreeBSD.org  : PGP 
>> 0x8F31830F9F2772BF

-- 
http://www.Leidinger.net Alexander@Leidinger.net: PGP 0x8F31830F9F2772BF
http://www.FreeBSD.org    netchild@FreeBSD.org  : PGP 0x8F31830F9F2772BF