Enum nc::types::perf_event_type_t

pub enum perf_event_type_t {
    PERF_RECORD_MMAP = 1,
    PERF_RECORD_LOST = 2,
    PERF_RECORD_COMM = 3,
    PERF_RECORD_EXIT = 4,
    PERF_RECORD_THROTTLE = 5,
    PERF_RECORD_UNTHROTTLE = 6,
    PERF_RECORD_FORK = 7,
    PERF_RECORD_READ = 8,
    PERF_RECORD_SAMPLE = 9,
    PERF_RECORD_MMAP2 = 10,
    PERF_RECORD_AUX = 11,
    PERF_RECORD_ITRACE_START = 12,
    PERF_RECORD_LOST_SAMPLES = 13,
    PERF_RECORD_SWITCH = 14,
    PERF_RECORD_SWITCH_CPU_WIDE = 15,
    PERF_RECORD_NAMESPACES = 16,
    PERF_RECORD_KSYMBOL = 17,
    PERF_RECORD_BPF_EVENT = 18,
    PERF_RECORD_CGROUP = 19,
    PERF_RECORD_TEXT_POKE = 20,
    PERF_RECORD_MAX = 21,
}

perf_event_type

Variants

PERF_RECORD_MMAP = 1

If perf_event_attr.sample_id_all is set then all event types will have the sample_type selected fields related to where/when (identity) an event took place (TID, TIME, ID, STREAM_ID, CPU IDENTIFIER) described in PERF_RECORD_SAMPLE below, it will be stashed just after the perf_event_header and the fields already present for the existing fields, i.e. at the end of the payload. That way a newer perf.data file will be supported by older perf tools, with these new optional fields being ignored.

struct sample_id { { u32 pid, tid; } && PERF_SAMPLE_TID { u64 time; } && PERF_SAMPLE_TIME { u64 id; } && PERF_SAMPLE_ID { u64 stream_id;} && PERF_SAMPLE_STREAM_ID { u32 cpu, res; } && PERF_SAMPLE_CPU { u64 id; } && PERF_SAMPLE_IDENTIFIER } && perf_event_attr::sample_id_all

Note that PERF_SAMPLE_IDENTIFIER duplicates PERF_SAMPLE_ID. The advantage of PERF_SAMPLE_IDENTIFIER is that its position is fixed relative to header.size.

The MMAP events record the PROT_EXEC mappings so that we can correlate userspace IPs to code. They have the following structure:

struct { struct perf_event_header header;

u32 pid, tid; u64 addr; u64 len; u64 pgoff; char filename[]; struct sample_id sample_id; };

PERF_RECORD_LOST = 2

struct { struct perf_event_header header; u64 id; u64 lost; struct sample_id sample_id; };

PERF_RECORD_COMM = 3

struct {
  struct perf_event_header header;

  u32 pid, tid;
  char comm[];
  struct sample_id sample_id;
};

PERF_RECORD_EXIT = 4

struct { struct perf_event_header header; u32 pid, ppid; u32 tid, ptid; u64 time; struct sample_id sample_id; };

PERF_RECORD_THROTTLE = 5

struct {
  struct perf_event_header header;
  u64 time;
  u64 id;
  u64 stream_id;
  struct sample_id sample_id;
};

PERF_RECORD_UNTHROTTLE = 6

PERF_RECORD_FORK = 7

struct {
  struct perf_event_header header;
  u32 pid, ppid;
  u32 tid, ptid;
  u64 time;
  struct sample_id sample_id;
};

PERF_RECORD_READ = 8

struct {
  struct perf_event_header header;
  u32 pid, tid;

  struct read_format values;
  struct sample_id sample_id;
};

PERF_RECORD_SAMPLE = 9

struct {
 struct perf_event_header header;

 #
 # Note that PERF_SAMPLE_IDENTIFIER duplicates PERF_SAMPLE_ID.
 # The advantage of PERF_SAMPLE_IDENTIFIER is that its position
 # is fixed relative to header.
 #
 { u64 id; } && PERF_SAMPLE_IDENTIFIER
 { u64 ip; } && PERF_SAMPLE_IP
 { u32 pid, tid; } && PERF_SAMPLE_TID
 { u64 time; } && PERF_SAMPLE_TIME
 { u64 addr; } && PERF_SAMPLE_ADDR
 { u64 id; } && PERF_SAMPLE_ID
 { u64 stream_id; } && PERF_SAMPLE_STREAM_ID
 { u32 cpu, res; } && PERF_SAMPLE_CPU
 { u64 period; } && PERF_SAMPLE_PERIOD

 { struct read_format values; } && PERF_SAMPLE_READ

 { u64 nr;
   u64 ips[nr]; } && PERF_SAMPLE_CALLCHAIN

 #
 # The RAW record below is opaque data wrt the ABI
 #
 # That is, the ABI doesn't make any promises wrt to
 # the stability of its content, it may vary depending
 # on event, hardware, kernel version and phase of
 # the moon.
 #
 # In other words, PERF_SAMPLE_RAW contents are not an ABI.
 #

 { u32 size;
   char data[size]; }&& PERF_SAMPLE_RAW

 { u64 nr;
   { u64 from, to, flags } lbr[nr];} && PERF_SAMPLE_BRANCH_STACK

 { u64 abi; # enum perf_sample_regs_abi
   u64 regs[weight(mask)]; } && PERF_SAMPLE_REGS_USER
 { u64 size;
   char data[size];
   u64 dyn_size; } && PERF_SAMPLE_STACK_USER

 { u64 weight; } && PERF_SAMPLE_WEIGHT
 { u64 data_src; } && PERF_SAMPLE_DATA_SRC
 { u64 transaction; } && PERF_SAMPLE_TRANSACTION
 { u64 abi; # enum perf_sample_regs_abi
   u64 regs[weight(mask)]; } && PERF_SAMPLE_REGS_INTR
 { u64 phys_addr;} && PERF_SAMPLE_PHYS_ADDR
};

PERF_RECORD_MMAP2 = 10

The MMAP2 records are an augmented version of MMAP, they add maj, min, ino numbers to be used to uniquely identify each mapping

struct { struct perf_event_header header; u32 pid, tid; u64 addr; u64 len; u64 pgoff; u32 maj; u32 min; u64 ino; u64 ino_generation; u32 prot, flags; char filename[]; struct sample_id sample_id; };

PERF_RECORD_AUX = 11

Records that new data landed in the AUX buffer part.

struct {
  struct perf_event_header header;

  u64 aux_offset;
  u64 aux_size;
  u64 flags;
  struct sample_id sample_id;
};

PERF_RECORD_ITRACE_START = 12

Indicates that instruction trace has started

struct {
  struct perf_event_header header;
  u32 pid;
  u32 tid;
  struct sample_id sample_id;
};

PERF_RECORD_LOST_SAMPLES = 13

Records the dropped/lost sample number.

struct {
  struct perf_event_header header;

  u64 lost;
  struct sample_id sample_id;
};

PERF_RECORD_SWITCH = 14

Records a context switch in or out (flagged by PERF_RECORD_MISC_SWITCH_OUT). See also PERF_RECORD_SWITCH_CPU_WIDE.

struct {
  struct perf_event_header header;
  struct sample_id sample_id;
};

PERF_RECORD_SWITCH_CPU_WIDE = 15

CPU-wide version of PERF_RECORD_SWITCH with next_prev_pid and next_prev_tid that are the next (switching out) or previous (switching in) pid/tid.

struct {
  struct perf_event_header header;
  u32 next_prev_pid;
  u32 next_prev_tid;
  struct sample_id sample_id;
};

PERF_RECORD_NAMESPACES = 16

struct {
  struct perf_event_header header;
  u32 pid;
  u32 tid;
  u64 nr_namespaces;
  { u64 dev, inode; } [nr_namespaces];
  struct sample_id sample_id;
};

PERF_RECORD_KSYMBOL = 17

Record ksymbol register/unregister events:

struct {
  struct perf_event_header header;
  u64 addr;
  u32 len;
  u16 ksym_type;
  u16 flags;
  char name[];
  struct sample_id sample_id;
};

PERF_RECORD_BPF_EVENT = 18

Record bpf events:

enum perf_bpf_event_type {
  PERF_BPF_EVENT_UNKNOWN     = 0,
  PERF_BPF_EVENT_PROG_LOAD   = 1,
  PERF_BPF_EVENT_PROG_UNLOAD = 2,
};

struct {
  struct perf_event_header header;
  u16 type;
  u16 flags;
  u32 id;
  u8 tag[BPF_TAG_SIZE];
  struct sample_id sample_id;
};

PERF_RECORD_CGROUP = 19

struct {
  struct perf_event_header header;
  u64 id;
  char path[];
  struct sample_id sample_id;
};

PERF_RECORD_TEXT_POKE = 20

Records changes to kernel text i.e. self-modified code. ‘old_len’ is the number of old bytes, ‘new_len’ is the number of new bytes. Either ‘old_len’ or ‘new_len’ may be zero to indicate, for example, the addition or removal of a trampoline. ‘bytes’ contains the old bytes followed immediately by the new bytes.

struct {
  struct perf_event_header header;
  u64 addr;
  u16 old_len;
  u16 new_len;
  u8 bytes[];
  struct sample_id sample_id;
};

PERF_RECORD_MAX = 21

non-ABI