linux-kernel - [BUG] linux/arch/x86/events/intel/uncore_snbep.c: MCx Channel PCI devices are swapped around

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <AB0DE99B-34C1-4BDC-B9C4-15E85BDBF5FA@gmail.com>
Date: Sat, 27 Sep 2025 00:46:03 +0200
From: Aniruddha Deb <aniruddha.deb.2002@...il.com>
To: acme@...nel.org,
 peterz@...radead.org,
 mingo@...hat.com,
 namhyung@...nel.org
Cc: linux-perf-users@...r.kernel.org,
 linux-kernel@...r.kernel.org
Subject: [BUG] linux/arch/x86/events/intel/uncore_snbep.c: MCx Channel PCI
 devices are swapped around

Hi perf subsystem maintainers,

The iMC PMC’s in the haswell-EP subsystem have their PCI device ID’s swapped around. According to page 109 of https://www.intel.com/content/www/us/en/content-details/671052/intel-xeon-processor-e5-and-e7-v3-family-uncore-performance-monitoring-reference-manual.html, MC0 channel 0 and 1 map to 0x2fb4/5 and channel 2/3 map to 0x2fb0/1 respectively. Have attached a small patch illustrating the same.

--- a/arch/x86/events/intel/uncore_snbep.c
+++ b/arch/x86/events/intel/uncore_snbep.c
@@ -3118,32 +3118,32 @@
 	{ /* MC0 Channel 0 */
-		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x2fb0),
+		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x2fb4),
 		.driver_data = UNCORE_PCI_DEV_DATA(HSWEP_PCI_UNCORE_IMC, 0),
 	},
 	{ /* MC0 Channel 1 */
-		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x2fb1),
+		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x2fb5),
 		.driver_data = UNCORE_PCI_DEV_DATA(HSWEP_PCI_UNCORE_IMC, 1),
 	},
 	{ /* MC0 Channel 2 */
-		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x2fb4),
+		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x2fb0),
 		.driver_data = UNCORE_PCI_DEV_DATA(HSWEP_PCI_UNCORE_IMC, 2),
 	},
 	{ /* MC0 Channel 3 */
-		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x2fb5),
+		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x2fb1),
 		.driver_data = UNCORE_PCI_DEV_DATA(HSWEP_PCI_UNCORE_IMC, 3),
 	},
 	{ /* MC1 Channel 0 */
-		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x2fd0),
+		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x2fd4),
 		.driver_data = UNCORE_PCI_DEV_DATA(HSWEP_PCI_UNCORE_IMC, 4),
 	},
 	{ /* MC1 Channel 1 */
-		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x2fd1),
+		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x2fd5),
 		.driver_data = UNCORE_PCI_DEV_DATA(HSWEP_PCI_UNCORE_IMC, 5),
 	},
 	{ /* MC1 Channel 2 */
-		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x2fd4),
+		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x2fd0),
 		.driver_data = UNCORE_PCI_DEV_DATA(HSWEP_PCI_UNCORE_IMC, 6),
 	},
 	{ /* MC1 Channel 3 */
-		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x2fd5),
+		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x2fd1),
 		.driver_data = UNCORE_PCI_DEV_DATA(HSWEP_PCI_UNCORE_IMC, 7),
 	},

I came across this when reading the perf subsystem code to see how offcore memory controllers are accessed, and where the addresses are defined. Haven’t had the chance to test it out on hardware yet, so please let me know if the intel document is wrong and the values entered are correct in practice.

Thanks,
Aniruddha.