Intel PEBS: How CPUs Attribute Performance Events to the Exact Instruction That Caused Them

2026-07-24

When you sample with perf record -e cache-misses, the CPU raises an interrupt when a counter overflows. But by the time the interrupt handler runs, dozens of instructions have retired past the guilty one. This is called skid, and it makes ordinary sampling useless for pinpointing which load actually missed cache.

PEBS (Precise Event-Based Sampling) is Intel's fix. Instead of relying on the interrupt to capture state, the CPU's retirement unit writes a snapshot into a memory buffer at the exact instruction that caused the event. The interrupt only fires when the buffer fills up — the actual attribution happens in hardware, in-line with retirement.

A PEBS record contains:

The data source encoding is the killer feature. A single cache-miss sample tells you not just "this load missed" but "this load hit L3 in a remote NUMA node after 240 cycles of latency." That's the difference between guessing and knowing.

Real-world example: You're chasing a p99 latency regression in a hot function. Regular sampling shows CPU time spread across three loads. Enable perf record -e mem_load_retired.l3_miss:pp (the :pp requests precise sampling). PEBS shows 90% of the L3 misses come from one specific pointer chase, with an average latency of 180 cycles — and the data source field says "remote DRAM." You've just diagnosed a NUMA placement bug in one profiling run.

The catch — PEBS has its own skid. Not all events support PEBS. Those that do come in two flavors: "precise" (skid = 0, the EventingIP is the guilty instruction) and "precise distribution" (skid ≤ a few instructions, but statistically unbiased). Also, the CPU still has to drain the pipeline to write the record, so PEBS-enabled sampling costs 5–15% more overhead than plain counting.

Rule of thumb: If your sample count divided by the event count is greater than ~1/10000, you're perturbing the workload. Set the sampling period high enough that PEBS records land less than once per 10,000 events — for a 1 GHz event rate, that's a period of at least 100,000.

AMD's equivalent is IBS (Instruction-Based Sampling), which works differently: it tags random in-flight instructions and reports everything that happens to them, rather than triggering on counter overflow. Different philosophy, same goal — kill the skid.

Key Takeaway: PEBS moves performance event attribution from the interrupt handler into the retirement unit, so you get the exact guilty instruction, its address, and — for memory events — where the data actually came from.

All newsletters