From: Peter Zijlstra <peterz@infradead.org>
To: "Chen, Zide" <zide.chen@intel.com>
Cc: Dapeng Mi <dapeng1.mi@linux.intel.com>,
Ingo Molnar <mingo@redhat.com>,
Arnaldo Carvalho de Melo <acme@kernel.org>,
Namhyung Kim <namhyung@kernel.org>,
Ian Rogers <irogers@google.com>,
Adrian Hunter <adrian.hunter@intel.com>,
Alexander Shishkin <alexander.shishkin@linux.intel.com>,
Andi Kleen <ak@linux.intel.com>,
Eranian Stephane <eranian@google.com>,
linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org,
Dapeng Mi <dapeng1.mi@intel.com>,
Falcon Thomas <thomas.falcon@intel.com>,
Xudong Hao <xudong.hao@intel.com>,
stable@vger.kernel.org
Subject: Re: [RESEND Patch 2/2] perf/x86/intel: Add missing branch counters constraint apply
Date: Wed, 11 Mar 2026 21:03:40 +0100 [thread overview]
Message-ID: <20260311200340.GV606826@noisy.programming.kicks-ass.net> (raw)
In-Reply-To: <6e2e5d3e-0906-43af-8816-f9f812e7e0aa@intel.com>
On Fri, Mar 06, 2026 at 05:27:35PM -0800, Chen, Zide wrote:
>
>
> On 2/27/2026 9:33 PM, Dapeng Mi wrote:
> > When running the command:
> > 'perf record -e "{instructions,instructions:p}" -j any,counter sleep 1',
> > a "shift-out-of-bounds" warning is reported on CWF.
> >
> > [ 5231.981423][ C17] UBSAN: shift-out-of-bounds in /kbuild/src/consumer/arch/x86/events/intel/lbr.c:970:15
> > [ 5231.981428][ C17] shift exponent 64 is too large for 64-bit type 'long long unsigned int'
> > [ 5231.981436][ C17] CPU: 17 UID: 0 PID: 211871 Comm: sleep Tainted: G S W 6.18.0-2025-12-09-intel-next-48166-g6cf574943ba3 #1 PREEMPT(none)
> > [ 5231.981445][ C17] Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN
> > [ 5231.981447][ C17] Hardware name: Intel Corporation AvenueCity/AvenueCity, BIOS BHSDCRB1.IPC.3544.P98.2508260307 08/26/2025
> > [ 5231.981449][ C17] Call Trace:
> > [ 5231.981453][ C17] <NMI>
> > [ 5231.981455][ C17] dump_stack_lvl+0x4b/0x70
> > [ 5231.981463][ C17] ubsan_epilogue+0x5/0x2b
> > [ 5231.981468][ C17] __ubsan_handle_shift_out_of_bounds.cold+0x61/0xe6
> > [ 5231.981472][ C17] ? __entry_text_end+0x158b/0x102259
> > [ 5231.981475][ C17] intel_pmu_lbr_counters_reorder.isra.0.cold+0x2a/0xa7
> > [ 5231.981480][ C17] ? __task_pid_nr_ns+0x134/0x2a0
> > [ 5231.981483][ C17] ? __pfx_intel_pmu_lbr_counters_reorder.isra.0+0x10/0x10
> > [ 5231.981486][ C17] ? __pfx_perf_output_sample+0x10/0x10
> > [ 5231.981489][ C17] ? arch_perf_update_userpage+0x293/0x310
> > [ 5231.981491][ C17] ? __pfx_arch_perf_update_userpage+0x10/0x10
> > [ 5231.981494][ C17] ? local_clock_noinstr+0xd/0x100
> > [ 5231.981498][ C17] ? calc_timer_values+0x2cb/0x860
> > [ 5231.981501][ C17] ? perf_event_update_userpage+0x399/0x5b0
> > [ 5231.981505][ C17] ? __pfx_perf_event_update_userpage+0x10/0x10
> > [ 5231.981508][ C17] ? local_clock_noinstr+0xd/0x100
> > [ 5231.981511][ C17] ? __perf_event_account_interrupt+0x11c/0x540
> > [ 5231.981514][ C17] intel_pmu_lbr_save_brstack+0xc0/0x4c0
> > [ 5231.981518][ C17] setup_arch_pebs_sample_data+0x114b/0x2400
> > [ 5231.981522][ C17] ? __pfx_x86_perf_event_set_period+0x10/0x10
> > [ 5231.981526][ C17] intel_pmu_drain_arch_pebs+0x64d/0xcc0
> > [ 5231.981530][ C17] ? __pfx_intel_pmu_drain_arch_pebs+0x10/0x10
> > [ 5231.981534][ C17] ? unwind_next_frame+0x11c5/0x1df0
> > [ 5231.981541][ C17] ? intel_pmu_drain_bts_buffer+0xbf/0x6e0
> > [ 5231.981545][ C17] ? __pfx_intel_pmu_drain_bts_buffer+0x10/0x10
> > [ 5231.981550][ C17] handle_pmi_common+0x5c5/0xcb0
> > [ 5231.981553][ C17] ? __pfx_handle_pmi_common+0x10/0x10
> > [ 5231.981556][ C17] ? intel_idle+0x64/0xb0
> > [ 5231.981560][ C17] ? intel_bts_interrupt+0xe5/0x4c0
> > [ 5231.981562][ C17] ? __pfx_intel_bts_interrupt+0x10/0x10
> > [ 5231.981565][ C17] ? intel_pmu_lbr_filter+0x27f/0x910
> > [ 5231.981568][ C17] intel_pmu_handle_irq+0x2ed/0x600
> > [ 5231.981571][ C17] perf_event_nmi_handler+0x219/0x280
> > [ 5231.981575][ C17] ? __pfx_perf_event_nmi_handler+0x10/0x10
> > [ 5231.981579][ C17] ? unwind_next_frame+0x11c5/0x1df0
> > [ 5231.981582][ C17] nmi_handle.part.0+0x11b/0x3a0
> > [ 5231.981585][ C17] ? unwind_next_frame+0x11c5/0x1df0
> > [ 5231.981588][ C17] default_do_nmi+0x6b/0x180
> > [ 5231.981591][ C17] fred_exc_nmi+0x3e/0x80
> > [ 5231.981594][ C17] asm_fred_entrypoint_kernel+0x41/0x60
> > [ 5231.981596][ C17] RIP: 0010:unwind_next_frame+0x11c5/0x1df0
> > ......
That trace could be reduced to:
UBSAN: shift-out-of-bounds in /kbuild/src/consumer/arch/x86/events/intel/lbr.c:970:15
shift exponent 64 is too large for 64-bit type 'long long unsigned int'
......
intel_pmu_lbr_counters_reorder.isra.0.cold+0x2a/0xa7
intel_pmu_lbr_save_brstack+0xc0/0x4c0
setup_arch_pebs_sample_data+0x114b/0x2400
Without loosing anything valuable.
> > The warning occurs because the second "instructions:p" event, which
> > involves branch counters sampling, is incorrectly programmed to fixed
> > counter 0 instead of the general-purpose (GP) counters 0-3 that support
So here you have 0-3, the normal 'range' notation, but then you go all
funny and use ~ instead:
> > branch counters sampling. Currently only GP counters 0~3 support branch
> > counters sampling on CWF, any event involving branch counters sampling
> > should be programed on GP counters 0~3.
> > Since the counter index of fixed> counter 0 is 32, it leads to the "src" value in below code is right
> > shifted 64 bits and trigger the "shift-out-of-bounds" warning.
> >
> > cnt = (src >> (order[j] * LBR_INFO_BR_CNTR_BITS)) & LBR_INFO_BR_CNTR_MASK;
> >
> > The root cause is the loss of the branch counters constraint for the
> > last event in the branch counters sampling event group. This results in
> > the second "instructions:p" event being programmed on fixed counter 0
> > incorrectly instead of the appropriate GP counters 0~3.
s/0~3/0-3/ ?
next prev parent reply other threads:[~2026-03-11 20:04 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-02-28 5:33 [RESEND Patch 1/2] perf/x86/intel: Only check GP counters for PEBS constraints validation Dapeng Mi
2026-02-28 5:33 ` [RESEND Patch 2/2] perf/x86/intel: Add missing branch counters constraint apply Dapeng Mi
2026-03-07 1:27 ` Chen, Zide
2026-03-11 20:03 ` Peter Zijlstra [this message]
2026-03-12 2:02 ` Mi, Dapeng
2026-03-11 20:16 ` Peter Zijlstra
2026-03-12 2:31 ` Mi, Dapeng
2026-03-12 6:41 ` Peter Zijlstra
2026-03-12 6:52 ` Mi, Dapeng
2026-03-12 7:40 ` Peter Zijlstra
2026-03-16 9:50 ` [tip: perf/urgent] " tip-bot2 for Dapeng Mi
2026-03-07 1:27 ` [RESEND Patch 1/2] perf/x86/intel: Only check GP counters for PEBS constraints validation Chen, Zide
2026-03-12 8:28 ` Mi, Dapeng
2026-03-12 8:42 ` Peter Zijlstra
2026-03-12 8:44 ` Mi, Dapeng
2026-03-16 9:50 ` [tip: perf/core] " tip-bot2 for Dapeng Mi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260311200340.GV606826@noisy.programming.kicks-ass.net \
--to=peterz@infradead.org \
--cc=acme@kernel.org \
--cc=adrian.hunter@intel.com \
--cc=ak@linux.intel.com \
--cc=alexander.shishkin@linux.intel.com \
--cc=dapeng1.mi@intel.com \
--cc=dapeng1.mi@linux.intel.com \
--cc=eranian@google.com \
--cc=irogers@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-perf-users@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=namhyung@kernel.org \
--cc=stable@vger.kernel.org \
--cc=thomas.falcon@intel.com \
--cc=xudong.hao@intel.com \
--cc=zide.chen@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.