[PATCH] perf stat: Merge CPU maps when merging uncore aliases

[PATCH] perf stat: Merge CPU maps when merging uncore aliases

[Chun-Tse Shao]

Sockets with event zero counts are hidden in `perf stat --per-socket`
because alias merging aggregates counts but not CPU maps. This causes
the display logic to incorrectly skip sockets not present in the leader
instance's map.

For example, with AMD_UMC:
  $ cat /sys/bus/event_source/devices/amd_umc*/cpumask
  0
  ...
  128
  ...

  $ perf stat -e amd_umc/config=0xff/ --per-socket -a -- sleep 1

   Performance counter stats for 'system wide':

  S0       12                  0      amd_umc/config=0xff/

         1.000777829 seconds time elapsed

Merge CPU maps in `evsel__merge_aggr_counters` to ensure the aggregated
event correctly reflects all underlying PMU instances.

After fix:
  $ perf stat -e amd_umc/config=0xff/ --per-socket -a -- sleep 1

   Performance counter stats for 'system wide':

  S0       12                  0      amd_umc/config=0xff/
  S1       12                  0      amd_umc/config=0xff/

         1.000666681 seconds time elapsed

Signed-off-by: Chun-Tse Shao <ctshao@google.com>
---
 tools/perf/util/stat.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/tools/perf/util/stat.c b/tools/perf/util/stat.c
index 14d169e22e8f..d696d217f98d 100644
--- a/tools/perf/util/stat.c
+++ b/tools/perf/util/stat.c
@@ -535,6 +535,12 @@ static int evsel__merge_aggr_counters(struct evsel *evsel, struct evsel *alias)
 		aggr_counts_a->run += aggr_counts_b->run;
 	}
 
+	/*
+	 * Merge the CPU maps so that the display logic (e.g. should_skip_zero_counter)
+	 * knows this merged event covers all CPUs from both aliases.
+	 */
+	perf_cpu_map__merge(&evsel->core.cpus, alias->core.cpus);
+
 	return 0;
 }
 
-- 
2.54.0.rc1.555.g9c883467ad-goog

Re: [PATCH] perf stat: Merge CPU maps when merging uncore aliases

[Ian Rogers]

On Thu, Apr 16, 2026 at 1:48 PM Chun-Tse Shao <ctshao@google.com> wrote:
>
> Sockets with event zero counts are hidden in `perf stat --per-socket`
> because alias merging aggregates counts but not CPU maps. This causes
> the display logic to incorrectly skip sockets not present in the leader
> instance's map.
>
> For example, with AMD_UMC:
>   $ cat /sys/bus/event_source/devices/amd_umc*/cpumask
>   0
>   ...
>   128
>   ...
>
>   $ perf stat -e amd_umc/config=0xff/ --per-socket -a -- sleep 1
>
>    Performance counter stats for 'system wide':
>
>   S0       12                  0      amd_umc/config=0xff/
>
>          1.000777829 seconds time elapsed
>
> Merge CPU maps in `evsel__merge_aggr_counters` to ensure the aggregated
> event correctly reflects all underlying PMU instances.
>
> After fix:
>   $ perf stat -e amd_umc/config=0xff/ --per-socket -a -- sleep 1
>
>    Performance counter stats for 'system wide':
>
>   S0       12                  0      amd_umc/config=0xff/
>   S1       12                  0      amd_umc/config=0xff/
>
>          1.000666681 seconds time elapsed
>
> Signed-off-by: Chun-Tse Shao <ctshao@google.com>
> ---
>  tools/perf/util/stat.c | 6 ++++++
>  1 file changed, 6 insertions(+)
>
> diff --git a/tools/perf/util/stat.c b/tools/perf/util/stat.c
> index 14d169e22e8f..d696d217f98d 100644
> --- a/tools/perf/util/stat.c
> +++ b/tools/perf/util/stat.c
> @@ -535,6 +535,12 @@ static int evsel__merge_aggr_counters(struct evsel *evsel, struct evsel *alias)
>                 aggr_counts_a->run += aggr_counts_b->run;
>         }
>
> +       /*
> +        * Merge the CPU maps so that the display logic (e.g. should_skip_zero_counter)
> +        * knows this merged event covers all CPUs from both aliases.
> +        */
> +       perf_cpu_map__merge(&evsel->core.cpus, alias->core.cpus);
> +

Once we have counts, mutating the cpumaps seems wrong; it could impact
other things such as the evlist copies of unioned together cpumaps.
I'm confused by the bug, we should have two aggregate ids one for each
socket. In should_skip_zero_counter it should only skip the zero count
if the counter is not applicable for the counter currently trying to
be printed. Does the display code fail to iterate through all the
counters?

Thanks,
Ian

>         return 0;
>  }
>
> --
> 2.54.0.rc1.555.g9c883467ad-goog
>

Re: [PATCH] perf stat: Merge CPU maps when merging uncore aliases

[sashiko-bot]

Sashiko AI review found 2 potential issue(s):
- [Medium] Expanding `evsel->core.cpus` without reallocating parallel arrays causes a deterministic NULL pointer dereference and out-of-bounds access.
- [Medium] Missing error handling for `perf_cpu_map__merge()`, masking memory allocation failures.
--

commit ca357f612c76d14c9a719708c9f0cdce0f262717
Author: Chun-Tse Shao <ctshao@google.com>

perf stat: Merge CPU maps when merging uncore aliases

This commit merges CPU maps for aliases in evsel__merge_aggr_counters() to
prevent the display logic from hiding sockets with zero counts. It aims to
ensure the aggregated event correctly reflects all underlying PMU instances.

> diff --git a/tools/perf/util/stat.c b/tools/perf/util/stat.c
> index 14d169e22e8f5..d696d217f98d6 100644
> --- a/tools/perf/util/stat.c
> +++ b/tools/perf/util/stat.c
[ ... ]
> @@ -535,6 +535,12 @@ static int evsel__merge_aggr_counters(struct evsel *evsel, struct evsel *alias)
>  		aggr_counts_a->run += aggr_counts_b->run;
>  	}
>  
> +	/*
> +	 * Merge the CPU maps so that the display logic (e.g. should_skip_zero_counter)
> +	 * knows this merged event covers all CPUs from both aliases.
> +	 */
> +	perf_cpu_map__merge(&evsel->core.cpus, alias->core.cpus);

perf_cpu_map__merge() can fail and return an error code like -ENOMEM.
Should we check the return value here and propagate the error, instead of
ignoring it?

Additionally, does expanding the CPU map in-place here cause out-of-bounds
memory accesses?

Arrays like evsel->counts and evsel->prev_raw_counts are allocated earlier
based on the original size of evsel->core.cpus:

tools/perf/util/stat.c:evsel__alloc_prev_raw_counts() {
	int cpu_map_nr = evsel__nr_cpus(evsel);
	int nthreads = perf_thread_map__nr(evsel->core.threads);
	struct perf_counts *counts;

	counts = perf_counts__new(cpu_map_nr, nthreads);
	...
}

If perf_cpu_map__merge() increases the number of CPUs in the map, later
iterations over the CPU map (such as in interval mode) will access these
parallel xyarrays out of bounds. When the loop index exceeds the original
array size, the access returns NULL and causes a segmentation fault when
unconditionally dereferenced.

Do we need to reallocate evsel->counts and evsel->prev_raw_counts when
merging these CPU maps?

> +
>  	return 0;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260416204828.1303734-1-ctshao@google.com?part=1