1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64

use crate::prelude::*;
use perf_event_open_sys::bindings;

/// BPF_EVENT records indicate when a BPF program is loaded or unloaded.
///
/// This struct corresponds to `PERF_RECORD_BPF_EVENT`. See the [manpage] for
/// more documentation.
///
/// [manpage]: http://man7.org/linux/man-pages/man2/perf_event_open.2.html
#[derive(Copy, Clone, Debug)]
#[allow(missing_docs)]
pub struct BpfEvent {
    pub ty: BpfEventType,
    pub flags: u16,
    pub id: u32,
    pub tag: [u8; 8],
}

c_enum! {
    /// Indicates the type of a [`BpfEvent`]
    #[derive(Copy, Clone, Eq, PartialEq, Hash)]
    pub enum BpfEventType : u16 {
        /// The event type is unknown.
        UNKNOWN = bindings::PERF_BPF_EVENT_UNKNOWN as _,

        /// A BPF program was loaded.
        PROG_LOAD = bindings::PERF_BPF_EVENT_PROG_LOAD as _,

        /// A BPF program was unloaded.
        PROG_UNLOAD = bindings::PERF_BPF_EVENT_PROG_UNLOAD as _,
    }
}

impl BpfEventType {
    /// Create a new `BpfEventType`.
    pub const fn new(value: u16) -> Self {
        Self(value)
    }
}

impl<'p> Parse<'p> for BpfEventType {
    fn parse<B, E>(p: &mut Parser<B, E>) -> ParseResult<Self>
    where
        E: Endian,
        B: ParseBuf<'p>,
    {
        Ok(Self::new(p.parse()?))
    }
}

impl<'p> Parse<'p> for BpfEvent {
    fn parse<B, E>(p: &mut Parser<B, E>) -> ParseResult<Self>
    where
        E: Endian,
        B: ParseBuf<'p>,
    {
        Ok(Self {
            ty: p.parse()?,
            flags: p.parse()?,
            id: p.parse()?,
            tag: p.parse()?,
        })
    }
}