On Thu, 2009-04-02 at 16:27 -0700, Corey Ashford wrote:Whoops, nevermind.
My misunderstanding on this one. This enum is used for event type, not the record_type, and as such is makes sense for there to be exclusive mmap and munmap event records.
Thinking about this a bit, I'm guessing that the idea is to track the loading and unloading of shared objects which uses mmap and munmap, so that that the ip can be related to a particular object that was mapped in at the time of the counter overflow interrupt. Is that right?
Indeed, whenever a mmap/munmap happens of a PROT_EXEC range we record
that information so that we can relate the userspace IPs to some file
and hence the actual userspace code.