diff options
Diffstat (limited to 'man2/perf_event_open.2')
| -rw-r--r-- | man2/perf_event_open.2 | 511 |
1 files changed, 410 insertions, 101 deletions
diff --git a/man2/perf_event_open.2 b/man2/perf_event_open.2 index 8a8102db0..dcd3ea996 100644 --- a/man2/perf_event_open.2 +++ b/man2/perf_event_open.2 @@ -126,7 +126,7 @@ The leader is created first, with The rest of the group members are created with subsequent .BR perf_event_open () calls with -.IR group_fd +.I group_fd being set to the file descriptor of the group leader. (A single event on its own is created with .IR group_fd " = \-1" @@ -162,7 +162,7 @@ then .TP .BR PERF_FLAG_FD_NO_GROUP This flag tells the event to ignore the -.IR group_fd +.I group_fd parameter except for the purpose of setting up output redirection using the .B PERF_FLAG_FD_OUTPUT @@ -247,8 +247,17 @@ struct perf_event_attr { due to exec */ use_clockid : 1, /* use clockid for time fields */ context_switch : 1, /* context switch data */ + write_backward : 1, /* Write ring buffer from end + to beginning */ + namespaces : 1, /* include namespaces data */ + ksymbol : 1, /* include ksymbol events */ + bpf_event : 1, /* include bpf events */ + aux_output : 1, /* generate AUX records + instead of events */ + cgroup : 1, /* include cgroup events */ + text_poke : 1, /* include text poke events */ - __reserved_1 : 37; + __reserved_1 : 30; union { __u32 wakeup_events; /* wakeup every n events */ @@ -352,7 +361,11 @@ These two dynamic PMUs create a kprobe/uprobe and attach it to the file descriptor generated by perf_event_open. The kprobe/uprobe will be destroyed on the destruction of the file descriptor. See fields -.IR kprobe_func ", " uprobe_path ", " kprobe_addr ", and " probe_offset +.IR kprobe_func , +.IR uprobe_path , +.IR kprobe_addr , +and +.I probe_offset for more details. .RE .TP @@ -401,7 +414,9 @@ the .I type field. The -.IR config1 " and " config2 +.I config1 +and +.I config2 fields are also taken into account in cases where 64 bits is not enough to fully specify the event. The encoding of these fields are event dependent. @@ -557,13 +572,16 @@ is then we are measuring a hardware CPU cache event. To calculate the appropriate .I config -value use the following equation: -.PP +value, use the following equation: .RS 4 -.nf - (perf_hw_cache_id) | (perf_hw_cache_op_id << 8) | - (perf_hw_cache_op_result_id << 16) -.fi +.PP +.in +4n +.EX +config = (perf_hw_cache_id) | + (perf_hw_cache_op_id << 8) | + (perf_hw_cache_op_result_id << 16); +.EE +.in .PP where .I perf_hw_cache_id @@ -649,24 +667,28 @@ Its parameters are set in other places. If .I type is -.BR kprobe +.B kprobe or .BR uprobe , set -.IR retprobe +.I retprobe (bit 0 of .IR config , see .IR /sys/bus/event_source/devices/[k,u]probe/format/retprobe ) for kretprobe/uretprobe. See fields -.IR kprobe_func ", " uprobe_path ", " kprobe_addr ", and " probe_offset +.IR kprobe_func , +.IR uprobe_path , +.IR kprobe_addr , +and +.I probe_offset for more details. .RE .TP .IR kprobe_func ", " uprobe_path ", " kprobe_addr ", and " probe_offset These fields describe the kprobe/uprobe for dynamic PMUs -.BR kprobe +.B kprobe and .BR uprobe . For @@ -709,7 +731,7 @@ to try and achieve the desired rate. The rate of adjustment is a timer tick. .TP -.I "sample_type" +.I sample_type The various bits in this field specify which values to include in the sample. They will be recorded in a ring-buffer, @@ -854,9 +876,23 @@ is set higher than zero then the register values returned are those captured by hardware at the time of the sampled instruction's retirement. +.TP +.BR PERF_SAMPLE_PHYS_ADDR " (since Linux 4.13)" +.\" commit fc7ce9c74c3ad232b084d80148654f926d01ece7 +Records physical address of data like in +.BR PERF_SAMPLE_ADDR . +.TP +.BR PERF_SAMPLE_CGROUP " (since Linux 5.7)" +.\" commit 96aaab686505c449e24d76e76507290dcc30e008 +Records (perf_event) cgroup ID of the process. +This corresponds to the +.I id +field in the +.B PERF_RECORD_CGROUP +event. .RE .TP -.IR "read_format" +.I read_format This field specifies the format of the data returned by .BR read (2) on a @@ -885,7 +921,7 @@ Adds a 64-bit unique value that corresponds to the event group. Allows all counter values in an event group to be read with one read. .RE .TP -.IR "disabled" +.I disabled The .I disabled bit specifies whether the counter starts out disabled or enabled. @@ -906,7 +942,7 @@ Despite being 0, the child events will not start until the group leader is enabled. .TP -.IR "inherit" +.I inherit The .I inherit bit specifies that this counter should count events of child @@ -920,7 +956,7 @@ Inherit does not work for some combinations of values, such as .BR PERF_FORMAT_GROUP . .TP -.IR "pinned" +.I pinned The .I pinned bit specifies that the counter should always be on the CPU if at all @@ -933,7 +969,7 @@ return end-of-file (i.e., .BR read (2) returns 0) until the counter is subsequently enabled or disabled. .TP -.IR "exclusive" +.I exclusive The .I exclusive bit specifies that when this counter's group is on the CPU, @@ -949,13 +985,13 @@ This includes any users running a system-wide measurement as well as any kernel use of the performance counters (including the commonly enabled NMI Watchdog Timer interface). .TP -.IR "exclude_user" +.I exclude_user If this bit is set, the count excludes events that happen in user space. .TP -.IR "exclude_kernel" +.I exclude_kernel If this bit is set, the count excludes events that happen in kernel space. .TP -.IR "exclude_hv" +.I exclude_hv If this bit is set, the count excludes events that happen in the hypervisor. This is mainly for PMUs that have built-in support for handling this @@ -963,12 +999,12 @@ This is mainly for PMUs that have built-in support for handling this Extra support is needed for handling hypervisor measurements on most machines. .TP -.IR "exclude_idle" +.I exclude_idle If set, don't count when the CPU is running the idle task. While you can currently enable this for any event type, it is ignored for all but software events. .TP -.IR "mmap" +.I mmap The .I mmap bit enables generation of @@ -982,7 +1018,7 @@ This allows tools to notice new executable code being mapped into a program (dynamic shared libraries for example) so that addresses can be mapped back to the original code. .TP -.IR "comm" +.I comm The .I comm bit enables tracking of process command name as modified by the @@ -1001,30 +1037,30 @@ can be used to differentiate the .BR exec (2) case from the others. .TP -.IR "freq" +.I freq If this bit is set, then .I sample_frequency not .I sample_period is used when setting up the sampling interval. .TP -.IR "inherit_stat" +.I inherit_stat This bit enables saving of event counts on context switch for inherited tasks. This is meaningful only if the .I inherit field is set. .TP -.IR "enable_on_exec" +.I enable_on_exec If this bit is set, a counter is automatically enabled after a call to .BR exec (2). .TP -.IR "task" +.I task If this bit is set, then fork/exit notifications are included in the ring buffer. .TP -.IR "watermark" +.I watermark If set, have an overflow notification happen when we cross the .I wakeup_watermark boundary. @@ -1032,7 +1068,7 @@ Otherwise, overflow notifications happen after .I wakeup_events samples. .TP -.IR "precise_ip" " (since Linux 2.6.35)" +.IR precise_ip " (since Linux 2.6.35)" .\" commit ab608344bcbde4f55ec4cd911b686b0ce3eae076 This controls the amount of skid. Skid is how many instructions @@ -1061,7 +1097,7 @@ See also the description of .BR PERF_RECORD_MISC_EXACT_IP . .RE .TP -.IR "mmap_data" " (since Linux 2.6.36)" +.IR mmap_data " (since Linux 2.6.36)" .\" commit 3af9e859281bda7eb7c20b51879cf43aa788ac2e This is the counterpart of the .I mmap @@ -1074,7 +1110,7 @@ calls that do not have .B PROT_EXEC set (for example data and SysV shared memory). .TP -.IR "sample_id_all" " (since Linux 2.6.38)" +.IR sample_id_all " (since Linux 2.6.38)" .\" commit c980d1091810df13f21aabbce545fd98f545bbf7 If set, then TID, TIME, ID, STREAM_ID, and CPU can additionally be included in @@ -1106,7 +1142,7 @@ struct sample_id { .EE .in .TP -.IR "exclude_host" " (since Linux 3.2)" +.IR exclude_host " (since Linux 3.2)" .\" commit a240f76165e6255384d4bdb8139895fac7988799 When conducting measurements that include processes running VM instances (i.e., have executed a @@ -1117,7 +1153,7 @@ This is only meaningful outside the guests; this setting does not change counts gathered inside of a guest. Currently, this functionality is x86 only. .TP -.IR "exclude_guest" " (since Linux 3.2)" +.IR exclude_guest " (since Linux 3.2)" .\" commit a240f76165e6255384d4bdb8139895fac7988799 When conducting measurements that include processes running VM instances (i.e., have executed a @@ -1128,15 +1164,15 @@ This is only meaningful outside the guests; this setting does not change counts gathered inside of a guest. Currently, this functionality is x86 only. .TP -.IR "exclude_callchain_kernel" " (since Linux 3.7)" +.IR exclude_callchain_kernel " (since Linux 3.7)" .\" commit d077526485d5c9b12fe85d0b2b3b7041e6bc5f91 Do not include kernel callchains. .TP -.IR "exclude_callchain_user" " (since Linux 3.7)" +.IR exclude_callchain_user " (since Linux 3.7)" .\" commit d077526485d5c9b12fe85d0b2b3b7041e6bc5f91 Do not include user callchains. .TP -.IR "mmap2" " (since Linux 3.16)" +.IR mmap2 " (since Linux 3.16)" .\" commit 13d7a2410fa637f450a29ecb515ac318ee40c741 .\" This is tricky; was committed during 3.12 development .\" but right before release was disabled. @@ -1149,7 +1185,7 @@ The .I mmap flag must also be set for this to work. .TP -.IR "comm_exec" " (since Linux 3.16)" +.IR comm_exec " (since Linux 3.16)" .\" commit 82b897782d10fcc4930c9d4a15b175348fdd2871 This is purely a feature-detection flag, it does not change kernel behavior. @@ -1165,7 +1201,7 @@ reported was caused by a call to This allows tools to distinguish between the various types of process renaming. .TP -.IR "use_clockid" " (since Linux 4.1)" +.IR use_clockid " (since Linux 4.1)" .\" commit 34f439278cef7b1177f8ce24f9fc81dfc6221d3b This allows selecting which internal Linux clock to use when generating timestamps via the @@ -1174,7 +1210,7 @@ field. This can make it easier to correlate perf sample times with timestamps generated by other tools. .TP -.IR "context_switch" " (since Linux 4.3)" +.IR context_switch " (since Linux 4.3)" .\" commit 45ac1403f564f411c6a383a2448688ba8dd705a4 This enables the generation of .B PERF_RECORD_SWITCH @@ -1189,7 +1225,50 @@ information even with strict .I perf_event_paranoid settings. .TP -.IR "wakeup_events" ", " "wakeup_watermark" +.IR write_backward " (since Linux 4.6)" +.\" commit 9ecda41acb971ebd07c8fb35faf24005c0baea12 +This causes the ring buffer to be written from the end to the beginning. +This is to support reading from overwritable ring buffer. +.TP +.IR namespaces " (since Linux 4.11)" +.\" commit e422267322cd319e2695a535e47c5b1feeac45eb +This enables the generation of +.B PERF_RECORD_NAMESPACES +records when a task enters a new namespace. +Each namespace has a combination of device and inode numbers. +.TP +.IR ksymbol " (since Linux 5.0)" +.\" commit 76193a94522f1d4edf2447a536f3f796ce56343b +This enables the generation of +.B PERF_RECORD_KSYMBOL +records when new kernel symbols are registered or unregistered. +This is analyzing dynamic kernel functions like eBPF. +.TP +.IR bpf_event " (since Linux 5.0)" +.\" commit 6ee52e2a3fe4ea35520720736e6791df1fb67106 +This enables the generation of +.B PERF_RECORD_BPF_EVENT +records when an eBPF program is loaded or unloaded. +.TP +.IR auxevent " (since Linux 5.4)" +.\" commit ab43762ef010967e4ccd53627f70a2eecbeafefb +This allows normal (non-AUX) events to generate data for AUX events +if the hardware supports it. +.TP +.IR cgroup " (since Linux 5.7)" +.\" commit 96aaab686505c449e24d76e76507290dcc30e008 +This enables the generation of +.B PERF_RECORD_CGROUP +records when a new cgroup is created (and activated). +.TP +.IR text_poke " (since Linux 5.8)" +.\" commit e17d43b93e544f5016c0251d2074c15568d5d963 +This enables the generation of +.B PERF_RECORD_TEXT_POKE +records when there's a changes to the kernel text +(i.e., self-modifying code). +.TP +.IR wakeup_events ", " wakeup_watermark This union sets how many samples .RI ( wakeup_events ) or bytes @@ -1215,25 +1294,25 @@ Prior to Linux 3.0, setting to 0 resulted in no overflow notifications; more recent kernels treat 0 the same as 1. .TP -.IR "bp_type" " (since Linux 2.6.33)" +.IR bp_type " (since Linux 2.6.33)" .\" commit 24f1e32c60c45c89a997c73395b69c8af6f0a84e This chooses the breakpoint type. It is one of: .RS .TP -.BR HW_BREAKPOINT_EMPTY +.B HW_BREAKPOINT_EMPTY No breakpoint. .TP -.BR HW_BREAKPOINT_R +.B HW_BREAKPOINT_R Count when we read the memory location. .TP -.BR HW_BREAKPOINT_W +.B HW_BREAKPOINT_W Count when we write the memory location. .TP -.BR HW_BREAKPOINT_RW +.B HW_BREAKPOINT_RW Count when we read or write the memory location. .TP -.BR HW_BREAKPOINT_X +.B HW_BREAKPOINT_X Count when we execute code at the memory location. .PP The values can be combined via a bitwise or, but the @@ -1246,14 +1325,14 @@ with is not allowed. .RE .TP -.IR "bp_addr" " (since Linux 2.6.33)" +.IR bp_addr " (since Linux 2.6.33)" .\" commit 24f1e32c60c45c89a997c73395b69c8af6f0a84e This is the address of the breakpoint. For execution breakpoints, this is the memory address of the instruction of interest; for read and write breakpoints, it is the memory address of the memory location of interest. .TP -.IR "config1" " (since Linux 2.6.39)" +.IR config1 " (since Linux 2.6.39)" .\" commit a7e3ed1e470116c9d12c2f778431a481a6be8ab6 .I config1 is used for setting events that need an extra register or otherwise @@ -1261,7 +1340,7 @@ do not fit in the regular config field. Raw OFFCORE_EVENTS on Nehalem/Westmere/SandyBridge use this field on Linux 3.3 and later kernels. .TP -.IR "bp_len" " (since Linux 2.6.33)" +.IR bp_len " (since Linux 2.6.33)" .\" commit 24f1e32c60c45c89a997c73395b69c8af6f0a84e .I bp_len is the length of the breakpoint being measured if @@ -1277,14 +1356,14 @@ and For an execution breakpoint, set this to .IR sizeof(long) . .TP -.IR "config2" " (since Linux 2.6.39)" +.IR config2 " (since Linux 2.6.39)" .\" commit a7e3ed1e470116c9d12c2f778431a481a6be8ab6 .I config2 is a further extension of the .I config1 field. .TP -.IR "branch_sample_type" " (since Linux 3.4)" +.IR branch_sample_type " (since Linux 3.4)" .\" commit bce38cd53e5ddba9cb6d708c4ef3d04a4016ec7e If .B PERF_SAMPLE_BRANCH_STACK @@ -1355,20 +1434,20 @@ This requires hardware support, currently only found on Intel x86 Haswell or newer. .RE .TP -.IR "sample_regs_user" " (since Linux 3.7)" +.IR sample_regs_user " (since Linux 3.7)" .\" commit 4018994f3d8785275ef0e7391b75c3462c029e56 This bit mask defines the set of user CPU registers to dump on samples. The layout of the register mask is architecture-specific and is described in the kernel header file .IR arch/ARCH/include/uapi/asm/perf_regs.h . .TP -.IR "sample_stack_user" " (since Linux 3.7)" +.IR sample_stack_user " (since Linux 3.7)" .\" commit c5ebcedb566ef17bda7b02686e0d658a7bb42ee7 This defines the size of the user stack to dump if .B PERF_SAMPLE_STACK_USER is specified. .TP -.IR "clockid" " (since Linux 4.1)" +.IR clockid " (since Linux 4.1)" .\" commit 34f439278cef7b1177f8ce24f9fc81dfc6221d3b If .I use_clockid @@ -1385,13 +1464,13 @@ and .B CLOCK_TAI currently supported. .TP -.IR "aux_watermark" " (since Linux 4.1)" +.IR aux_watermark " (since Linux 4.1)" .\" commit 1a5941312414c71dece6717da9a0fa1303127afa This specifies how much data is required to trigger a .B PERF_RECORD_AUX sample. .TP -.IR "sample_max_stack" " (since Linux 4.8)" +.IR sample_max_stack " (since Linux 4.8)" .\" commit 97c79a38cd454602645f0470ffb444b3b75ce574 When .I sample_type @@ -1679,34 +1758,39 @@ delta since .I time_enabled (in nanoseconds) using rdtsc or similar. .IP -.nf - u64 quot, rem; - u64 delta; - quot = (cyc >> time_shift); - rem = cyc & (((u64)1 << time_shift) \- 1); - delta = time_offset + quot * time_mult + - ((rem * time_mult) >> time_shift); -.fi +.in +4n +.EX +u64 quot, rem; +u64 delta; + +quot = cyc >> time_shift; +rem = cyc & (((u64)1 << time_shift) \- 1); +delta = time_offset + quot * time_mult + + ((rem * time_mult) >> time_shift); +.EE +.in .IP Where .IR time_offset , .IR time_mult , .IR time_shift , and -.IR cyc +.I cyc are read in the seqcount loop described above. This delta can then be added to enabled and possible running (if idx), improving the scaling: .IP -.nf - enabled += delta; - if (idx) - running += delta; - quot = count / running; - rem = count % running; - count = quot * enabled + (rem * enabled) / running; -.fi +.in +4n +.EX +enabled += delta; +if (idx) + running += delta; +quot = count / running; +rem = count % running; +count = quot * enabled + (rem * enabled) / running; +.EE +.in .TP .IR time_zero " (since Linux 3.12)" .\" commit fa7315871046b9a4c48627905691dbde57e51033 @@ -1715,23 +1799,31 @@ If .I cap_usr_time_zero is set, then the hardware clock (the TSC timestamp counter on x86) can be calculated from the -.IR time_zero ", " time_mult ", and " time_shift " values:" +.IR time_zero , +.IR time_mult , +and +.I time_shift +values: .IP -.nf - time = timestamp - time_zero; - quot = time / time_mult; - rem = time % time_mult; - cyc = (quot << time_shift) + (rem << time_shift) / time_mult; -.fi +.in +4n +.EX +time = timestamp - time_zero; +quot = time / time_mult; +rem = time % time_mult; +cyc = (quot << time_shift) + (rem << time_shift) / time_mult; +.EE +.in .IP And vice versa: .IP -.nf - quot = cyc >> time_shift; - rem = cyc & (((u64)1 << time_shift) - 1); - timestamp = time_zero + quot * time_mult + - ((rem * time_mult) >> time_shift); -.fi +.in +4n +.EX +quot = cyc >> time_shift; +rem = cyc & (((u64)1 << time_shift) - 1); +timestamp = time_zero + quot * time_mult + + ((rem * time_mult) >> time_shift); +.EE +.in .TP .I data_head This points to the head of the data section. @@ -1782,7 +1874,7 @@ The desired offset and size must be page aligned, and the size must be a power of two. These values are then passed to mmap in order to map the AUX buffer. Pages in the AUX buffer are included as part of the -.BR RLIMIT_MEMLOCK +.B RLIMIT_MEMLOCK resource limit (see .BR setrlimit (2)), and also as part of the @@ -1799,10 +1891,14 @@ new data began, and it is the consumer's job to disable measurement while reading to avoid possible data races. .IP The -.IR aux_head " and " aux_tail +.I aux_head +and +.I aux_tail ring buffer pointers have the same behavior and ordering rules as the previous described -.IR data_head " and " data_tail . +.I data_head +and +.IR data_tail . .PP The following 2^n ring-buffer pages have the layout described below. .PP @@ -1894,9 +1990,9 @@ system call. .BR PERF_RECORD_MISC_SWITCH_OUT " (since Linux 4.3)" .\" commit 45ac1403f564f411c6a383a2448688ba8dd705a4 When a -.BR PERF_RECORD_SWITCH +.B PERF_RECORD_SWITCH or -.BR PERF_RECORD_SWITCH_CPU_WIDE +.B PERF_RECORD_SWITCH_CPU_WIDE record is generated, this bit indicates that the context switch is away from the current process (instead of into the current process). @@ -2101,7 +2197,7 @@ struct { u64 nr; /* if PERF_SAMPLE_CALLCHAIN */ u64 ips[nr]; /* if PERF_SAMPLE_CALLCHAIN */ u32 size; /* if PERF_SAMPLE_RAW */ - char data[size]; /* if PERF_SAMPLE_RAW */ + char data[size]; /* if PERF_SAMPLE_RAW */ u64 bnr; /* if PERF_SAMPLE_BRANCH_STACK */ struct perf_branch_entry lbr[bnr]; /* if PERF_SAMPLE_BRANCH_STACK */ @@ -2118,6 +2214,8 @@ struct { u64 abi; /* if PERF_SAMPLE_REGS_INTR */ u64 regs[weight(mask)]; /* if PERF_SAMPLE_REGS_INTR */ + u64 phys_addr; /* if PERF_SAMPLE_PHYS_ADDR */ + u64 cgroup; /* if PERF_SAMPLE_CGROUP */ }; .EE .in @@ -2264,7 +2362,7 @@ Support for .IR mispred , .IR predicted , and -.IR cycles +.I cycles is optional; if not supported, those values will be 0. .PP @@ -2281,7 +2379,9 @@ is enabled, then the user CPU registers are recorded. The .I abi field is one of -.BR PERF_SAMPLE_REGS_ABI_NONE ", " PERF_SAMPLE_REGS_ABI_32 " or" +.BR PERF_SAMPLE_REGS_ABI_NONE , +.BR PERF_SAMPLE_REGS_ABI_32 , +or .BR PERF_SAMPLE_REGS_ABI_64 . .IP The @@ -2538,6 +2638,19 @@ attr field. The number of values is the number of bits set in the .I sample_regs_intr bit mask. +.TP +.I phys_addr +If the +.B PERF_SAMPLE_PHYS_ADDR +flag is set, then the 64-bit physical address is recorded. +.TP +.I cgroup +If the +.B PERF_SAMPLE_CGROUP +flag is set, +then the 64-bit cgroup ID (for the perf_event subsystem) is recorded. +To get the pathname of the cgroup, the ID should match to one in a +.B PERF_RECORD_CGROUP . .RE .TP .B PERF_RECORD_MMAP2 @@ -2744,6 +2857,202 @@ or next (if switching out) process on the CPU. The thread ID of the previous (if switching in) or next (if switching out) thread on the CPU. .RE +.TP +.BR PERF_RECORD_NAMESPACES " (since Linux 4.11)" +.\" commit e422267322cd319e2695a535e47c5b1feeac45eb +This record includes various namespace information of a process. +.IP +.in +4n +.EX +struct { + struct perf_event_header header; + u32 pid; + u32 tid; + u64 nr_namespaces; + struct { u64 dev, inode } [nr_namespaces]; + struct sample_id sample_id; +}; +.EE +.in +.RS +.TP +.I pid +is the process ID +.TP +.I tid +is the thread ID +.TP +.I nr_namespace +is the number of namespaces in this record +.RE +.IP +Each namespace has +.I dev +and +.I inode +fields and is recorded in the +fixed position like below: +.RS +.TP +.BR NET_NS_INDEX = 0 +Network namespace +.TP +.BR UTS_NS_INDEX = 1 +UTS namespace +.TP +.BR IPC_NS_INDEX = 2 +IPC namespace +.TP +.BR PID_NS_INDEX = 3 +PID namespace +.TP +.BR USER_NS_INDEX = 4 +User namespace +.TP +.BR MNT_NS_INDEX = 5 +Mount namespace +.TP +.BR CGROUP_NS_INDEX = 6 +Cgroup namespace +.RE +.TP +.BR PERF_RECORD_KSYMBOL " (since Linux 5.0)" +.\" commit 76193a94522f1d4edf2447a536f3f796ce56343b +This record indicates kernel symbol register/unregister events. +.IP +.in +4n +.EX +struct { + struct perf_event_header header; + u64 addr; + u32 len; + u16 ksym_type; + u16 flags; + char name[]; + struct sample_id sample_id; +}; +.EE +.in +.RS +.TP +.I addr +is the address of the kernel symbol. +.TP +.I len +is the length of the kernel symbol. +.TP +.I ksym_type +is the type of the kernel symbol. +Currently the following types are available: +.RS +.TP +.B PERF_RECORD_KSYMBOL_TYPE_BPF +The kernel symbol is a BPF function. +.RE +.TP +.I flags +If the +.B PERF_RECORD_KSYMBOL_FLAGS_UNREGISTER +is set, then this event is for unregistering the kernel symbol. +.RE +.TP +.BR PERF_RECORD_BPF_EVENT " (since Linux 5.0)" +.\" commit 6ee52e2a3fe4ea35520720736e6791df1fb67106 +This record indicates BPF program is loaded or unloaded. +.IP +.in +4n +.EX +struct { + struct perf_event_header header; + u16 type; + u16 flags; + u32 id; + u8 tag[BPF_TAG_SIZE]; + struct sample_id sample_id; +}; +.EE +.in +.RS +.TP +.I type +is one of the following values: +.RS +.TP +.B PERF_BPF_EVENT_PROG_LOAD +A BPF program is loaded +.TP +.B PERF_BPF_EVENT_PROG_UNLOAD +A BPF program is unloaded +.RE +.TP +.I id +is the ID of the BPF program. +.TP +.I tag +is the tag of the BPF program. +Currently, +.B BPF_TAG_SIZE +is defined as 8. +.RE +.TP +.BR PERF_RECORD_CGROUP " (since Linux 5.7)" +.\" commit 96aaab686505c449e24d76e76507290dcc30e008 +This record indicates a new cgroup is created and activated. +.IP +.in +4n +.EX +struct { + struct perf_event_header header; + u64 id; + char path[]; + struct sample_id sample_id; +}; +.EE +.in +.RS +.TP +.I id +is the cgroup identifier. +This can be also retrieved by +.BR name_to_handle_at (2) +on the cgroup path (as a file handle). +.TP +.I path +is the path of the cgroup from the root. +.RE +.TP +.BR PERF_RECORD_TEXT_POKE " (since Linux 5.8)" +.\" commit e17d43b93e544f5016c0251d2074c15568d5d963 +This record indicates a change in the kernel text. +This includes addition and removal of the text +and the corresponding length is zero in this case. +.IP +.in +4n +.EX +struct { + struct perf_event_header header; + u64 addr; + u16 old_len; + u16 new_len; + u8 bytes[]; + struct sample_id sample_id; +}; +.EE +.in +.RS +.TP +.I addr +is the address of the change +.TP +.I old_len +is the old length +.TP +.I new_len +is the new length +.TP +.I bytes +contains old bytes immediately followed by new bytes. +.RE .RE .SS Overflow handling Events can be set to notify when a threshold is crossed, @@ -2972,7 +3281,7 @@ This allows querying which Berkeley Packet Filter (BPF) programs are attached to an existing kprobe tracepoint. You can only attach one BPF program per event, but you can have multiple events attached to a tracepoint. -Querying this value on one tracepoint event returns the id +Querying this value on one tracepoint event returns the ID of all BPF programs in all events attached to the tracepoint. You need .B CAP_PERFMON @@ -3002,7 +3311,7 @@ value is filled in by the kernel with the number of attached BPF programs. The .I ids -array is filled with the id of each attached BPF program. +array is filled with the ID of each attached BPF program. If there are more programs than will fit in the array, then the kernel will return .B ENOSPC @@ -3495,7 +3804,7 @@ main(int argc, char **argv) .IR Documentation/admin-guide/perf-security.rst in the kernel source tree .SH COLOPHON -This page is part of release 5.09 of the Linux +This page is part of release 5.10 of the Linux .I man-pages project. A description of the project, |