Crash in pmc: [pmc,1762] negative increment cpu=1 ri=17 newvalue=45d4906d saved=fffff616cee9 incr=ffff00004fbdc184

Alexander Leidinger <[email protected]> Sun, 12 Jul 2026 15:18:06 +0200

Newsgroups	gmane.os.freebsd.current
Organization	No organization, this is a private message.
Message-ID	<[email protected]>

Hi,

I wanted to do some pmc based sampling in a jail and this crashed the 
kernel. Not directly, a "sleep 1" test was ok. The real application 
resulted in:
---snip---
__curthread () at /space/system/usr_src/sys/amd64/include/pcpu_aux.h:57
57              __asm("movq %%gs:%c1,%0" : "=r" (td)
(kgdb) #0  __curthread () at 
/space/system/usr_src/sys/amd64/include/pcpu_aux.h:57
         td = <optimized out>
#1  doadump (textdump=textdump@entry=1)
     at /space/system/usr_src/sys/kern/kern_shutdown.c:399
         error = 0
         coredump = <optimized out>
#2  0xffffffff8056183c in kern_reboot (howto=260)
     at /space/system/usr_src/sys/kern/kern_shutdown.c:519
         once = 0
         __pc = 0x0
#3  0xffffffff80561d5d in vpanic (fmt=<optimized out>,
     ap=ap@entry=0xfffffe0797916c90)
     at /space/system/usr_src/sys/kern/kern_shutdown.c:974
         buf = "[pmc,1762] negative increment cpu=1 ri=17 
newvalue=45d4906d saved=fffff616cee9 incr=ffff00004fbdc184", '\000' 
<repeats 155 times>
         __pc = 0x0
         __pc = 0x0
         __pc = 0x0
         other_cpus = {__bits = {16777213, 0 <repeats 15 times>}}
         td = 0xfffff80a4c988000
         bootopt = <unavailable>
         newpanic = <optimized out>
#4  0xffffffff80561ba3 in panic (fmt=<unavailable>)
     at /space/system/usr_src/sys/kern/kern_shutdown.c:887
         ap = {{gp_offset = 48, fp_offset = 48,
             overflow_arg_area = 0xfffffe0797916cc8,
             reg_save_area = 0xfffffe0797916c60}}
#5  0xffffffff8455ae47 in pmc_hook_handler (td=0xfffff80a4c988000,
     function=<optimized out>, arg=<optimized out>)
     at /space/system/usr_src/sys/dev/hwpmc/hwpmc_mod.c:1759
         __pc = 0x0
         __pc = 0x0
         __pc = 0x0
         __pc = 0x0
         cpu = <optimized out>
#6  0xffffffff80596d8d in sched_ule_sswitch (td=0xfffff80a4c988000,
     flags=<optimized out>) at 
/space/system/usr_src/sys/kern/sched_ule.c:2389
         __pc = 0x0
         __pc = 0x0
         __pc = 0x0
         cpuid = <optimized out>
         tdq = <optimized out>
         ts = 0xfffff80a4c988720
         preempted = <optimized out>
         mtx = 0xfffffe0065b291c0
         srqflag = <optimized out>
         newtd = 0xfffff80df74e4780
         pickcpu = <optimized out>
#7  0xffffffff8056e8c8 in mi_switch (flags=flags@entry=517)
     at /space/system/usr_src/sys/kern/kern_synch.c:526
         __pc = 0x0
         __pc = 0x0
         __pc = 0x0
         __pc = 0x0
         __pc = 0x0
         td = 0xfffff80a4c988000
         new_switchtime = <optimized out>
         runtime = <optimized out>
---snip---

Core available.

Bye,
Alexander.

-- 
http://www.Leidinger.net [email protected]: PGP 0x8F31830F9F2772BF
http://www.FreeBSD.org    [email protected]  : PGP 0x8F31830F9F2772BF

signature.asc (application/pgp-signature, 870 B)