perf_event_open
Implemented in Antinomie 0.7.0 · Syscall list
Synopsis
Section titled “Synopsis”long perf_event_open(struct perf_event_attr *attr_uptr, pid_t pid, int cpu, int group_fd, unsigned long flags);| Number (x86-64) | 298 |
| ABI | common |
| Kernel entry point | sys_perf_event_open |
This is the raw kernel prototype from the pinned Linux 6.12.94 schema, not the libc wrapper.
Description
Section titled “Description”Creates a performance counter or tracing event described by a perf_event_attr and returns a descriptor to read it.
Arguments
Section titled “Arguments”| Name | Type | Meaning |
|---|---|---|
attr_uptr (arg0) |
struct perf_event_attr * |
Pointer to a perf_event_attr. |
pid (arg1) |
pid_t |
Process or thread id. |
cpu (arg2) |
int |
CPU number. |
group_fd (arg3) |
int |
Group leader descriptor, or -1. |
flags (arg4) |
unsigned long |
Option flags that change the behavior of the call. |
Return value
Section titled “Return value”On success: A new file descriptor (a non-negative number).
In an Antinomie trace the Return column and the ret filter field show the raw kernel return value. On failure that is the negative errno, for example -2 for ENOENT, not the -1 plus errno that the libc wrapper gives. syscall.errno holds the positive errno and syscall.success is false.
Common errors
Section titled “Common errors”| Raw return | Name | Meaning |
|---|---|---|
-13 |
EACCES |
Permission denied. |
-22 |
EINVAL |
An argument is invalid. |
-2 |
ENOENT |
A path component or the named object does not exist. |
Man page
Section titled “Man page”perf_event_open(2) on man7.org
Captured by Antinomie
Section titled “Captured by Antinomie”Coverage mark: Implemented. Every pointer argument has a capture rule in the pinned kernel patch and none of them records a “no decoder”, “address only” or “not observed” gap on any code path. Individual values can still be incomplete on a particular call; see the capture statuses.
Every call is recorded as an Entry record (the six argument words and the pointees copied at entry) and an Exit record (the return value and the pointees copied at exit).
Arguments
Section titled “Arguments”| Argument | When | How | Recorded field key | Condition |
|---|---|---|---|---|
attr_uptr (arg0) |
Entry | the pointer itself, as a raw word | args.0, args.raw[0] |
|
| ↳ pointee | Entry | structure perf_event_attr, size from its own size field (versioned) |
arg0.perf_event_attr |
always |
| ↳ pointee | Exit | u32 size the kernel wants |
arg0.required_size |
result is -E2BIG |
pid (arg1) |
Entry | raw scalar word | args.1, args.pid |
|
cpu (arg2) |
Entry | raw scalar word | args.2, args.cpu |
|
group_fd (arg3) |
Entry | raw scalar word | args.3, args.group_fd |
|
flags (arg4) |
Entry | raw scalar word; Syscall Trace also decodes it into flag names (perf group), listing unknown bits separately |
args.4, args.flags |
Filter fields
Section titled “Filter fields”- Result:
ret,syscall.errno,syscall.success,syscall.duration_ns. - Argument words:
args.attr_uptr(arg0),args.pid(arg1),args.cpu(arg2),args.group_fd(arg3),args.flags(arg4);args.0toargs.5by position. - Structure
perf_event_attrbehindattr_uptr(arg0):args.attr_uptr.<member>foraux_output,aux_sample_size,aux_watermark,bp_type,bpf_event,branch_sample_type,build_id,cgroup,clockid,comm,comm_exec,config,config3,context_switch,disabled,enable_on_exec,exclude_callchain_kernel,exclude_callchain_user,exclude_guest,exclude_host,exclude_hv,exclude_idle,exclude_kernel,exclude_user,exclusive,freq,inherit,inherit_stat,inherit_thread,ksymbol,mmap,mmap2,mmap_data,namespaces,pinned,precise_ip,read_format,remove_on_exec,sample_id_all,sample_max_stack,sample_regs_intr,sample_regs_user,sample_stack_user,sample_type,sig_data,sigtrap,size,task, and 5 more.
See Syscall Trace filter for the full syntax.
For what the capture statuses mean, see Capture statuses. For what is never recorded, see Known gaps.