From 4c864df8f475c3fed1dfc81a5b6484a5fd824eca Mon Sep 17 00:00:00 2001
From: Antonio Huete Jimenez <tuxillo@quantumachine.net>
Date: Thu, 27 May 2010 23:21:21 +0200
Subject: [PATCH] Initial import from hwpmc (aggelos) by swildner

---
 include/Makefile                   |    3 +-
 lib/Makefile                       |    3 +-
 lib/libpmc/Makefile                |   51 +
 lib/libpmc/libpmc.c                | 2237 ++++++++++++++++++
 lib/libpmc/pmc.3                   | 3426 +++++++++++++++++++++++++++
 lib/libpmc/pmc.h                   |  109 +
 lib/libpmc/pmclog.3                |  320 +++
 lib/libpmc/pmclog.c                |  553 +++++
 lib/libpmc/pmclog.h                |  154 ++
 sys/conf/files                     |    3 +
 sys/conf/options                   |    2 +
 sys/cpu/i386/include/atomic.h      |   65 +
 sys/cpu/i386/include/cpu.h         |    4 +
 sys/cpu/i386/include/pmc_mdep.h    |   83 +
 sys/dev/misc/hwpmc/hwpmc_amd.c     | 1002 ++++++++
 sys/dev/misc/hwpmc/hwpmc_amd.h     |  103 +
 sys/dev/misc/hwpmc/hwpmc_arm.c     |   40 +
 sys/dev/misc/hwpmc/hwpmc_ia64.c    |   40 +
 sys/dev/misc/hwpmc/hwpmc_logging.c | 1021 ++++++++
 sys/dev/misc/hwpmc/hwpmc_mod.c     | 4467 ++++++++++++++++++++++++++++++++++++
 sys/dev/misc/hwpmc/hwpmc_pentium.c |   49 +
 sys/dev/misc/hwpmc/hwpmc_pentium.h |   72 +
 sys/dev/misc/hwpmc/hwpmc_piv.c     | 1821 +++++++++++++++
 sys/dev/misc/hwpmc/hwpmc_piv.h     |  124 +
 sys/dev/misc/hwpmc/hwpmc_powerpc.c |   40 +
 sys/dev/misc/hwpmc/hwpmc_ppro.c    |  863 +++++++
 sys/dev/misc/hwpmc/hwpmc_ppro.h    |   83 +
 sys/dev/misc/hwpmc/hwpmc_sparc64.c |   40 +
 sys/dev/misc/hwpmc/hwpmc_x86.c     |  183 ++
 sys/dev/misc/hwpmc/pmc_events.h    |  530 +++++
 sys/kern/kern_exec.c               |   29 +
 sys/kern/kern_linker.c             |  101 +
 sys/kern/kern_pmc.c                |  107 +
 sys/kern/kern_subr.c               |   11 +
 sys/kern/kern_timeout.c            |   14 +
 sys/kern/lwkt_thread.c             |   20 +
 sys/platform/pc32/Makefile.inc     |    2 +-
 sys/platform/pc32/apic/apic_abi.c  |    7 +
 sys/platform/pc32/apic/mpapic.c    |    8 +-
 sys/platform/pc32/conf/files       |    5 +
 sys/platform/pc32/i386/machdep.c   |   12 +
 sys/platform/pc32/i386/trap.c      |   18 +
 sys/platform/pc32/include/smp.h    |    6 +-
 sys/sys/linker.h                   |    3 +
 sys/sys/pmc.h                      | 1008 ++++++++
 sys/sys/pmckern.h                  |  125 +
 sys/sys/pmclog.h                   |  247 ++
 sys/sys/proc.h                     |    1 +
 sys/sys/systm.h                    |    1 +
 sys/vm/vm_mmap.c                   |   46 +
 usr.sbin/pmccontrol/Makefile       |   15 +
 usr.sbin/pmccontrol/pmccontrol.8   |  127 +
 usr.sbin/pmccontrol/pmccontrol.c   |  480 ++++
 usr.sbin/pmcstat/Makefile          |   15 +
 usr.sbin/pmcstat/pmcstat.8         |  328 +++
 usr.sbin/pmcstat/pmcstat.c         | 1230 ++++++++++
 usr.sbin/pmcstat/pmcstat.h         |  143 ++
 usr.sbin/pmcstat/pmcstat_log.c     | 1863 +++++++++++++++
 58 files changed, 23458 insertions(+), 5 deletions(-)
 create mode 100644 lib/libpmc/Makefile
 create mode 100644 lib/libpmc/libpmc.c
 create mode 100644 lib/libpmc/pmc.3
 create mode 100644 lib/libpmc/pmc.h
 create mode 100644 lib/libpmc/pmclog.3
 create mode 100644 lib/libpmc/pmclog.c
 create mode 100644 lib/libpmc/pmclog.h
 create mode 100644 sys/cpu/i386/include/pmc_mdep.h
 create mode 100644 sys/dev/misc/hwpmc/hwpmc_amd.c
 create mode 100644 sys/dev/misc/hwpmc/hwpmc_amd.h
 create mode 100644 sys/dev/misc/hwpmc/hwpmc_arm.c
 create mode 100644 sys/dev/misc/hwpmc/hwpmc_ia64.c
 create mode 100644 sys/dev/misc/hwpmc/hwpmc_logging.c
 create mode 100644 sys/dev/misc/hwpmc/hwpmc_mod.c
 create mode 100644 sys/dev/misc/hwpmc/hwpmc_pentium.c
 create mode 100644 sys/dev/misc/hwpmc/hwpmc_pentium.h
 create mode 100644 sys/dev/misc/hwpmc/hwpmc_piv.c
 create mode 100644 sys/dev/misc/hwpmc/hwpmc_piv.h
 create mode 100644 sys/dev/misc/hwpmc/hwpmc_powerpc.c
 create mode 100644 sys/dev/misc/hwpmc/hwpmc_ppro.c
 create mode 100644 sys/dev/misc/hwpmc/hwpmc_ppro.h
 create mode 100644 sys/dev/misc/hwpmc/hwpmc_sparc64.c
 create mode 100644 sys/dev/misc/hwpmc/hwpmc_x86.c
 create mode 100644 sys/dev/misc/hwpmc/pmc_events.h
 create mode 100644 sys/kern/kern_pmc.c
 create mode 100644 sys/sys/pmc.h
 create mode 100644 sys/sys/pmckern.h
 create mode 100644 sys/sys/pmclog.h
 create mode 100644 usr.sbin/pmccontrol/Makefile
 create mode 100644 usr.sbin/pmccontrol/pmccontrol.8
 create mode 100644 usr.sbin/pmccontrol/pmccontrol.c
 create mode 100644 usr.sbin/pmcstat/Makefile
 create mode 100644 usr.sbin/pmcstat/pmcstat.8
 create mode 100644 usr.sbin/pmcstat/pmcstat.c
 create mode 100644 usr.sbin/pmcstat/pmcstat.h
 create mode 100644 usr.sbin/pmcstat/pmcstat_log.c

diff --git a/include/Makefile b/include/Makefile
index 909ff94..47db36a 100644
--- a/include/Makefile
+++ b/include/Makefile
@@ -76,7 +76,8 @@ LSUBDIRS=	bus/cam bus/cam/scsi \
 	dev/misc/lpt dev/misc/ppi \
 	dev/netif/wi \
 	dev/raid/ciss \
-	dev/video/bktr dev/video/meteor
+	dev/video/bktr dev/video/meteor \
+	dev/misc/hwpmc \
 
 # For SHARED=symlinks, bus/cam and netproto/atm are symlinks, so cam/scsi
 # and netproto/atm/* are taken care of
diff --git a/lib/Makefile b/lib/Makefile
index fa7a7ad..b5f2c0d 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -27,7 +27,7 @@ SUBDIR=	csu \
 	libftpio libipsec libipx libkcore libkiconv libkinfo \
 	libkvm libmagic \
 	${_libmilter} ${_libncp} libnetgraph libopie libpam \
-	libpcap libposix1e libsdp libthread_xu libpthread librpcsvc ${_libsm} \
+	libpcap ${_libpmc} libposix1e libsdp libthread_xu libpthread librpcsvc ${_libsm} \
 	${_libsmb} ${_libsmdb} ${_libsmutil} libstand libtelnet libusbhid \
 	${_libvgl} libwrap libxpg4 liby libypclnt libz i18n_module pam_module \
 	libc_rtld libsctp libevtr
@@ -48,6 +48,7 @@ _libsmutil=	libsmutil
 .endif
 
 _libncp=	libncp
+_libpmc=	libpmc
 _libsmb=	libsmb
 _libvgl=	libvgl
 
diff --git a/lib/libpmc/Makefile b/lib/libpmc/Makefile
new file mode 100644
index 0000000..5403311
--- /dev/null
+++ b/lib/libpmc/Makefile
@@ -0,0 +1,51 @@
+# $FreeBSD: src/lib/libpmc/Makefile,v 1.4 2005-06-09 19:45:06 jkoshy Exp $
+
+LIB=	pmc
+
+SRCS=	libpmc.c pmclog.c
+INCS=	pmc.h pmclog.h
+
+WARNS?=	6
+
+MAN=	pmc.3 pmclog.3
+
+MLINKS+= \
+	pmc.3 pmc_allocate.3 \
+	pmc.3 pmc_attach.3 \
+	pmc.3 pmc_capabilities.3 \
+	pmc.3 pmc_configure_logfile.3 \
+	pmc.3 pmc_cpuinfo.3 \
+	pmc.3 pmc_detach.3 \
+	pmc.3 pmc_disable.3 \
+	pmc.3 pmc_enable.3 \
+	pmc.3 pmc_event_names_of_class.3 \
+	pmc.3 pmc_flush_logfile.3 \
+	pmc.3 pmc_get_driver_stats.3 \
+	pmc.3 pmc_init.3 \
+	pmc.3 pmc_name_of_capability.3 \
+	pmc.3 pmc_name_of_class.3 \
+	pmc.3 pmc_name_of_cputype.3 \
+	pmc.3 pmc_name_of_event.3 \
+	pmc.3 pmc_name_of_mode.3 \
+	pmc.3 pmc_name_of_state.3 \
+	pmc.3 pmc_ncpu.3 \
+	pmc.3 pmc_npmc.3 \
+	pmc.3 pmc_pmcinfo.3 \
+	pmc.3 pmc_read.3 \
+	pmc.3 pmc_release.3 \
+	pmc.3 pmc_rw.3 \
+	pmc.3 pmc_set.3 \
+	pmc.3 pmc_start.3 \
+	pmc.3 pmc_stop.3 \
+	pmc.3 pmc_width.3 \
+	pmc.3 pmc_write.3 \
+	pmc.3 pmc_writelog.3 \
+	pmc.3 pmc_x86_get_msr.3
+
+MLINKS+= \
+	pmclog.3 pmclog_open.3 \
+	pmclog.3 pmclog_close.3 \
+	pmclog.3 pmclog_feed.3 \
+	pmclog.3 pmclog_read.3
+
+.include <bsd.lib.mk>
diff --git a/lib/libpmc/libpmc.c b/lib/libpmc/libpmc.c
new file mode 100644
index 0000000..5461975
--- /dev/null
+++ b/lib/libpmc/libpmc.c
@@ -0,0 +1,2237 @@
+/*-
+ * Copyright (c) 2003-2006 Joseph Koshy
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+/*__FBSDID("$FreeBSD: src/lib/libpmc/libpmc.c,v 1.11 2007-04-11 04:52:09 jkoshy Exp $");*/
+
+#include <sys/types.h>
+#include <sys/module.h>
+#include <sys/pmc.h>
+#include <sys/syscall.h>
+
+#include <ctype.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <pmc.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <strings.h>
+#include <unistd.h>
+
+/* Function prototypes */
+#if defined(__i386__)
+static int k7_allocate_pmc(enum pmc_event _pe, char *_ctrspec,
+    struct pmc_op_pmcallocate *_pmc_config);
+#endif
+#if defined(__amd64__) || defined(__i386__)
+static int k8_allocate_pmc(enum pmc_event _pe, char *_ctrspec,
+    struct pmc_op_pmcallocate *_pmc_config);
+static int p4_allocate_pmc(enum pmc_event _pe, char *_ctrspec,
+    struct pmc_op_pmcallocate *_pmc_config);
+#endif
+#if defined(__i386__)
+static int p5_allocate_pmc(enum pmc_event _pe, char *_ctrspec,
+    struct pmc_op_pmcallocate *_pmc_config);
+static int p6_allocate_pmc(enum pmc_event _pe, char *_ctrspec,
+    struct pmc_op_pmcallocate *_pmc_config);
+#endif
+
+#define PMC_CALL(cmd, params)				\
+	syscall(pmc_syscall, PMC_OP_##cmd, (params))
+
+/*
+ * Event aliases provide a way for the user to ask for generic events
+ * like "cache-misses", or "instructions-retired".  These aliases are
+ * mapped to the appropriate canonical event descriptions using a
+ * lookup table.
+ */
+
+struct pmc_event_alias {
+	const char	*pm_alias;
+	const char	*pm_spec;
+};
+
+static const struct pmc_event_alias *pmc_mdep_event_aliases;
+
+/*
+ * The pmc_event_descr table maps symbolic names known to the user
+ * to integer codes used by the PMC KLD.
+ */
+
+struct pmc_event_descr {
+	const char	*pm_ev_name;
+	enum pmc_event	pm_ev_code;
+	enum pmc_class	pm_ev_class;
+};
+
+static const struct pmc_event_descr
+pmc_event_table[] =
+{
+#undef  __PMC_EV
+#define	__PMC_EV(C,N,EV) { #EV, PMC_EV_ ## C ## _ ## N, PMC_CLASS_ ## C },
+	__PMC_EVENTS()
+};
+
+/*
+ * Mapping tables, mapping enumeration values to human readable
+ * strings.
+ */
+
+static const char * pmc_capability_names[] = {
+#undef	__PMC_CAP
+#define	__PMC_CAP(N,V,D)	#N ,
+	__PMC_CAPS()
+};
+
+static const char * pmc_class_names[] = {
+#undef	__PMC_CLASS
+#define __PMC_CLASS(C)	#C ,
+	__PMC_CLASSES()
+};
+
+static const char * pmc_cputype_names[] = {
+#undef	__PMC_CPU
+#define	__PMC_CPU(S, D) #S ,
+	__PMC_CPUS()
+};
+
+static const char * pmc_disposition_names[] = {
+#undef	__PMC_DISP
+#define	__PMC_DISP(D)	#D ,
+	__PMC_DISPOSITIONS()
+};
+
+static const char * pmc_mode_names[] = {
+#undef  __PMC_MODE
+#define __PMC_MODE(M,N)	#M ,
+	__PMC_MODES()
+};
+
+static const char * pmc_state_names[] = {
+#undef  __PMC_STATE
+#define __PMC_STATE(S) #S ,
+	__PMC_STATES()
+};
+
+static int pmc_syscall = -1;		/* filled in by pmc_init() */
+
+static struct pmc_cpuinfo cpu_info;	/* filled in by pmc_init() */
+
+
+/* Architecture dependent event parsing */
+static int (*pmc_mdep_allocate_pmc)(enum pmc_event _pe, char *_ctrspec,
+    struct pmc_op_pmcallocate *_pmc_config);
+
+/* Event masks for events */
+struct pmc_masks {
+	const char	*pm_name;
+	const uint32_t	pm_value;
+};
+#define	PMCMASK(N,V)	{ .pm_name = #N, .pm_value = (V) }
+#define	NULLMASK	PMCMASK(NULL,0)
+
+#if defined(__amd64__) || defined(__i386__)
+static int
+pmc_parse_mask(const struct pmc_masks *pmask, char *p, uint32_t *evmask)
+{
+	const struct pmc_masks *pm;
+	char *q, *r;
+	int c;
+
+	if (pmask == NULL)	/* no mask keywords */
+		return -1;
+	q = strchr(p, '='); 	/* skip '=' */
+	if (*++q == '\0')	/* no more data */
+		return -1;
+	c = 0;			/* count of mask keywords seen */
+	while ((r = strsep(&q, "+")) != NULL) {
+		for (pm = pmask; pm->pm_name && strcmp(r, pm->pm_name); pm++)
+			;
+		if (pm->pm_name == NULL) /* not found */
+			return -1;
+		*evmask |= pm->pm_value;
+		c++;
+	}
+	return c;
+}
+#endif
+
+#define	KWMATCH(p,kw)		(strcasecmp((p), (kw)) == 0)
+#define	KWPREFIXMATCH(p,kw)	(strncasecmp((p), (kw), sizeof((kw)) - 1) == 0)
+#define	EV_ALIAS(N,S)		{ .pm_alias = N, .pm_spec = S }
+
+#if defined(__i386__)
+
+/*
+ * AMD K7 (Athlon) CPUs.
+ */
+
+static struct pmc_event_alias k7_aliases[] = {
+	EV_ALIAS("branches",		"k7-retired-branches"),
+	EV_ALIAS("branch-mispredicts",	"k7-retired-branches-mispredicted"),
+	EV_ALIAS("cycles",		"tsc"),
+	EV_ALIAS("dc-misses",		"k7-dc-misses,mask=moesi"),
+	EV_ALIAS("ic-misses",		"k7-ic-misses"),
+	EV_ALIAS("instructions",	"k7-retired-instructions"),
+	EV_ALIAS("interrupts",		"k7-hardware-interrupts"),
+	EV_ALIAS(NULL, NULL)
+};
+
+#define	K7_KW_COUNT	"count"
+#define	K7_KW_EDGE	"edge"
+#define	K7_KW_INV	"inv"
+#define	K7_KW_OS	"os"
+#define	K7_KW_UNITMASK	"unitmask"
+#define	K7_KW_USR	"usr"
+
+static int
+k7_allocate_pmc(enum pmc_event pe, char *ctrspec,
+    struct pmc_op_pmcallocate *pmc_config)
+{
+	char 		*e, *p, *q;
+	int 		c, has_unitmask;
+	uint32_t	count, unitmask;
+
+	pmc_config->pm_md.pm_amd.pm_amd_config = 0;
+	pmc_config->pm_caps |= PMC_CAP_READ;
+
+	if (pe == PMC_EV_TSC_TSC) {
+		/* TSC events must be unqualified. */
+		if (ctrspec && *ctrspec != '\0')
+			return -1;
+		return 0;
+	}
+
+	if (pe == PMC_EV_K7_DC_REFILLS_FROM_L2 ||
+	    pe == PMC_EV_K7_DC_REFILLS_FROM_SYSTEM ||
+	    pe == PMC_EV_K7_DC_WRITEBACKS) {
+		has_unitmask = 1;
+		unitmask = AMD_PMC_UNITMASK_MOESI;
+	} else
+		unitmask = has_unitmask = 0;
+
+	pmc_config->pm_caps |= PMC_CAP_WRITE;
+
+	while ((p = strsep(&ctrspec, ",")) != NULL) {
+		if (KWPREFIXMATCH(p, K7_KW_COUNT "=")) {
+			q = strchr(p, '=');
+			if (*++q == '\0') /* skip '=' */
+				return -1;
+
+			count = strtol(q, &e, 0);
+			if (e == q || *e != '\0')
+				return -1;
+
+			pmc_config->pm_caps |= PMC_CAP_THRESHOLD;
+			pmc_config->pm_md.pm_amd.pm_amd_config |=
+			    AMD_PMC_TO_COUNTER(count);
+
+		} else if (KWMATCH(p, K7_KW_EDGE)) {
+			pmc_config->pm_caps |= PMC_CAP_EDGE;
+		} else if (KWMATCH(p, K7_KW_INV)) {
+			pmc_config->pm_caps |= PMC_CAP_INVERT;
+		} else if (KWMATCH(p, K7_KW_OS)) {
+			pmc_config->pm_caps |= PMC_CAP_SYSTEM;
+		} else if (KWPREFIXMATCH(p, K7_KW_UNITMASK "=")) {
+			if (has_unitmask == 0)
+				return -1;
+			unitmask = 0;
+			q = strchr(p, '=');
+			if (*++q == '\0') /* skip '=' */
+				return -1;
+
+			while ((c = tolower(*q++)) != 0)
+				if (c == 'm')
+					unitmask |= AMD_PMC_UNITMASK_M;
+				else if (c == 'o')
+					unitmask |= AMD_PMC_UNITMASK_O;
+				else if (c == 'e')
+					unitmask |= AMD_PMC_UNITMASK_E;
+				else if (c == 's')
+					unitmask |= AMD_PMC_UNITMASK_S;
+				else if (c == 'i')
+					unitmask |= AMD_PMC_UNITMASK_I;
+				else if (c == '+')
+					continue;
+				else
+					return -1;
+
+			if (unitmask == 0)
+				return -1;
+
+		} else if (KWMATCH(p, K7_KW_USR)) {
+			pmc_config->pm_caps |= PMC_CAP_USER;
+		} else
+			return -1;
+	}
+
+	if (has_unitmask) {
+		pmc_config->pm_caps |= PMC_CAP_QUALIFIER;
+		pmc_config->pm_md.pm_amd.pm_amd_config |=
+		    AMD_PMC_TO_UNITMASK(unitmask);
+	}
+
+	return 0;
+
+}
+
+#endif
+
+#if defined(__amd64__) || defined(__i386__)
+
+/*
+ * AMD K8 PMCs.
+ *
+ * These are very similar to AMD K7 PMCs, but support more kinds of
+ * events.
+ */
+
+static struct pmc_event_alias k8_aliases[] = {
+	EV_ALIAS("branches",		"k8-fr-retired-taken-branches"),
+	EV_ALIAS("branch-mispredicts",
+	    "k8-fr-retired-taken-branches-mispredicted"),
+	EV_ALIAS("cycles",		"tsc"),
+	EV_ALIAS("dc-misses",		"k8-dc-miss"),
+	EV_ALIAS("ic-misses",		"k8-ic-miss"),
+	EV_ALIAS("instructions", 	"k8-fr-retired-x86-instructions"),
+	EV_ALIAS("interrupts",		"k8-fr-taken-hardware-interrupts"),
+	EV_ALIAS("unhalted-cycles",	"k8-bu-cpu-clk-unhalted"),
+	EV_ALIAS(NULL, NULL)
+};
+
+#define	__K8MASK(N,V) PMCMASK(N,(1 << (V)))
+
+/*
+ * Parsing tables
+ */
+
+/* fp dispatched fpu ops */
+static const struct pmc_masks k8_mask_fdfo[] = {
+	__K8MASK(add-pipe-excluding-junk-ops,	0),
+	__K8MASK(multiply-pipe-excluding-junk-ops,	1),
+	__K8MASK(store-pipe-excluding-junk-ops,	2),
+	__K8MASK(add-pipe-junk-ops,		3),
+	__K8MASK(multiply-pipe-junk-ops,	4),
+	__K8MASK(store-pipe-junk-ops,		5),
+	NULLMASK
+};
+
+/* ls segment register loads */
+static const struct pmc_masks k8_mask_lsrl[] = {
+	__K8MASK(es,	0),
+	__K8MASK(cs,	1),
+	__K8MASK(ss,	2),
+	__K8MASK(ds,	3),
+	__K8MASK(fs,	4),
+	__K8MASK(gs,	5),
+	__K8MASK(hs,	6),
+	NULLMASK
+};
+
+/* ls locked operation */
+static const struct pmc_masks k8_mask_llo[] = {
+	__K8MASK(locked-instructions,	0),
+	__K8MASK(cycles-in-request,	1),
+	__K8MASK(cycles-to-complete,	2),
+	NULLMASK
+};
+
+/* dc refill from {l2,system} and dc copyback */
+static const struct pmc_masks k8_mask_dc[] = {
+	__K8MASK(invalid,	0),
+	__K8MASK(shared,	1),
+	__K8MASK(exclusive,	2),
+	__K8MASK(owner,		3),
+	__K8MASK(modified,	4),
+	NULLMASK
+};
+
+/* dc one bit ecc error */
+static const struct pmc_masks k8_mask_dobee[] = {
+	__K8MASK(scrubber,	0),
+	__K8MASK(piggyback,	1),
+	NULLMASK
+};
+
+/* dc dispatched prefetch instructions */
+static const struct pmc_masks k8_mask_ddpi[] = {
+	__K8MASK(load,	0),
+	__K8MASK(store,	1),
+	__K8MASK(nta,	2),
+	NULLMASK
+};
+
+/* dc dcache accesses by locks */
+static const struct pmc_masks k8_mask_dabl[] = {
+	__K8MASK(accesses,	0),
+	__K8MASK(misses,	1),
+	NULLMASK
+};
+
+/* bu internal l2 request */
+static const struct pmc_masks k8_mask_bilr[] = {
+	__K8MASK(ic-fill,	0),
+	__K8MASK(dc-fill,	1),
+	__K8MASK(tlb-reload,	2),
+	__K8MASK(tag-snoop,	3),
+	__K8MASK(cancelled,	4),
+	NULLMASK
+};
+
+/* bu fill request l2 miss */
+static const struct pmc_masks k8_mask_bfrlm[] = {
+	__K8MASK(ic-fill,	0),
+	__K8MASK(dc-fill,	1),
+	__K8MASK(tlb-reload,	2),
+	NULLMASK
+};
+
+/* bu fill into l2 */
+static const struct pmc_masks k8_mask_bfil[] = {
+	__K8MASK(dirty-l2-victim,	0),
+	__K8MASK(victim-from-l2,	1),
+	NULLMASK
+};
+
+/* fr retired fpu instructions */
+static const struct pmc_masks k8_mask_frfi[] = {
+	__K8MASK(x87,			0),
+	__K8MASK(mmx-3dnow,		1),
+	__K8MASK(packed-sse-sse2,	2),
+	__K8MASK(scalar-sse-sse2,	3),
+	NULLMASK
+};
+
+/* fr retired fastpath double op instructions */
+static const struct pmc_masks k8_mask_frfdoi[] = {
+	__K8MASK(low-op-pos-0,		0),
+	__K8MASK(low-op-pos-1,		1),
+	__K8MASK(low-op-pos-2,		2),
+	NULLMASK
+};
+
+/* fr fpu exceptions */
+static const struct pmc_masks k8_mask_ffe[] = {
+	__K8MASK(x87-reclass-microfaults,	0),
+	__K8MASK(sse-retype-microfaults,	1),
+	__K8MASK(sse-reclass-microfaults,	2),
+	__K8MASK(sse-and-x87-microtraps,	3),
+	NULLMASK
+};
+
+/* nb memory controller page access event */
+static const struct pmc_masks k8_mask_nmcpae[] = {
+	__K8MASK(page-hit,	0),
+	__K8MASK(page-miss,	1),
+	__K8MASK(page-conflict,	2),
+	NULLMASK
+};
+
+/* nb memory controller turnaround */
+static const struct pmc_masks k8_mask_nmct[] = {
+	__K8MASK(dimm-turnaround,		0),
+	__K8MASK(read-to-write-turnaround,	1),
+	__K8MASK(write-to-read-turnaround,	2),
+	NULLMASK
+};
+
+/* nb memory controller bypass saturation */
+static const struct pmc_masks k8_mask_nmcbs[] = {
+	__K8MASK(memory-controller-hi-pri-bypass,	0),
+	__K8MASK(memory-controller-lo-pri-bypass,	1),
+	__K8MASK(dram-controller-interface-bypass,	2),
+	__K8MASK(dram-controller-queue-bypass,		3),
+	NULLMASK
+};
+
+/* nb sized commands */
+static const struct pmc_masks k8_mask_nsc[] = {
+	__K8MASK(nonpostwrszbyte,	0),
+	__K8MASK(nonpostwrszdword,	1),
+	__K8MASK(postwrszbyte,		2),
+	__K8MASK(postwrszdword,		3),
+	__K8MASK(rdszbyte,		4),
+	__K8MASK(rdszdword,		5),
+	__K8MASK(rdmodwr,		6),
+	NULLMASK
+};
+
+/* nb probe result */
+static const struct pmc_masks k8_mask_npr[] = {
+	__K8MASK(probe-miss,		0),
+	__K8MASK(probe-hit,		1),
+	__K8MASK(probe-hit-dirty-no-memory-cancel, 2),
+	__K8MASK(probe-hit-dirty-with-memory-cancel, 3),
+	NULLMASK
+};
+
+/* nb hypertransport bus bandwidth */
+static const struct pmc_masks k8_mask_nhbb[] = { /* HT bus bandwidth */
+	__K8MASK(command,	0),
+	__K8MASK(data, 	1),
+	__K8MASK(buffer-release, 2),
+	__K8MASK(nop,	3),
+	NULLMASK
+};
+
+#undef	__K8MASK
+
+#define	K8_KW_COUNT	"count"
+#define	K8_KW_EDGE	"edge"
+#define	K8_KW_INV	"inv"
+#define	K8_KW_MASK	"mask"
+#define	K8_KW_OS	"os"
+#define	K8_KW_USR	"usr"
+
+static int
+k8_allocate_pmc(enum pmc_event pe, char *ctrspec,
+    struct pmc_op_pmcallocate *pmc_config)
+{
+	char 		*e, *p, *q;
+	int 		n;
+	uint32_t	count, evmask;
+	const struct pmc_masks	*pm, *pmask;
+
+	pmc_config->pm_caps |= PMC_CAP_READ;
+	pmc_config->pm_md.pm_amd.pm_amd_config = 0;
+
+	if (pe == PMC_EV_TSC_TSC) {
+		/* TSC events must be unqualified. */
+		if (ctrspec && *ctrspec != '\0')
+			return -1;
+		return 0;
+	}
+
+	pmask = NULL;
+	evmask = 0;
+
+#define	__K8SETMASK(M) pmask = k8_mask_##M
+
+	/* setup parsing tables */
+	switch (pe) {
+	case PMC_EV_K8_FP_DISPATCHED_FPU_OPS:
+		__K8SETMASK(fdfo);
+		break;
+	case PMC_EV_K8_LS_SEGMENT_REGISTER_LOAD:
+		__K8SETMASK(lsrl);
+		break;
+	case PMC_EV_K8_LS_LOCKED_OPERATION:
+		__K8SETMASK(llo);
+		break;
+	case PMC_EV_K8_DC_REFILL_FROM_L2:
+	case PMC_EV_K8_DC_REFILL_FROM_SYSTEM:
+	case PMC_EV_K8_DC_COPYBACK:
+		__K8SETMASK(dc);
+		break;
+	case PMC_EV_K8_DC_ONE_BIT_ECC_ERROR:
+		__K8SETMASK(dobee);
+		break;
+	case PMC_EV_K8_DC_DISPATCHED_PREFETCH_INSTRUCTIONS:
+		__K8SETMASK(ddpi);
+		break;
+	case PMC_EV_K8_DC_DCACHE_ACCESSES_BY_LOCKS:
+		__K8SETMASK(dabl);
+		break;
+	case PMC_EV_K8_BU_INTERNAL_L2_REQUEST:
+		__K8SETMASK(bilr);
+		break;
+	case PMC_EV_K8_BU_FILL_REQUEST_L2_MISS:
+		__K8SETMASK(bfrlm);
+		break;
+	case PMC_EV_K8_BU_FILL_INTO_L2:
+		__K8SETMASK(bfil);
+		break;
+	case PMC_EV_K8_FR_RETIRED_FPU_INSTRUCTIONS:
+		__K8SETMASK(frfi);
+		break;
+	case PMC_EV_K8_FR_RETIRED_FASTPATH_DOUBLE_OP_INSTRUCTIONS:
+		__K8SETMASK(frfdoi);
+		break;
+	case PMC_EV_K8_FR_FPU_EXCEPTIONS:
+		__K8SETMASK(ffe);
+		break;
+	case PMC_EV_K8_NB_MEMORY_CONTROLLER_PAGE_ACCESS_EVENT:
+		__K8SETMASK(nmcpae);
+		break;
+	case PMC_EV_K8_NB_MEMORY_CONTROLLER_TURNAROUND:
+		__K8SETMASK(nmct);
+		break;
+	case PMC_EV_K8_NB_MEMORY_CONTROLLER_BYPASS_SATURATION:
+		__K8SETMASK(nmcbs);
+		break;
+	case PMC_EV_K8_NB_SIZED_COMMANDS:
+		__K8SETMASK(nsc);
+		break;
+	case PMC_EV_K8_NB_PROBE_RESULT:
+		__K8SETMASK(npr);
+		break;
+	case PMC_EV_K8_NB_HT_BUS0_BANDWIDTH:
+	case PMC_EV_K8_NB_HT_BUS1_BANDWIDTH:
+	case PMC_EV_K8_NB_HT_BUS2_BANDWIDTH:
+		__K8SETMASK(nhbb);
+		break;
+
+	default:
+		break;		/* no options defined */
+	}
+
+	pmc_config->pm_caps |= PMC_CAP_WRITE;
+
+	while ((p = strsep(&ctrspec, ",")) != NULL) {
+		if (KWPREFIXMATCH(p, K8_KW_COUNT "=")) {
+			q = strchr(p, '=');
+			if (*++q == '\0') /* skip '=' */
+				return -1;
+
+			count = strtol(q, &e, 0);
+			if (e == q || *e != '\0')
+				return -1;
+
+			pmc_config->pm_caps |= PMC_CAP_THRESHOLD;
+			pmc_config->pm_md.pm_amd.pm_amd_config |=
+			    AMD_PMC_TO_COUNTER(count);
+
+		} else if (KWMATCH(p, K8_KW_EDGE)) {
+			pmc_config->pm_caps |= PMC_CAP_EDGE;
+		} else if (KWMATCH(p, K8_KW_INV)) {
+			pmc_config->pm_caps |= PMC_CAP_INVERT;
+		} else if (KWPREFIXMATCH(p, K8_KW_MASK "=")) {
+			if ((n = pmc_parse_mask(pmask, p, &evmask)) < 0)
+				return -1;
+			pmc_config->pm_caps |= PMC_CAP_QUALIFIER;
+		} else if (KWMATCH(p, K8_KW_OS)) {
+			pmc_config->pm_caps |= PMC_CAP_SYSTEM;
+		} else if (KWMATCH(p, K8_KW_USR)) {
+			pmc_config->pm_caps |= PMC_CAP_USER;
+		} else
+			return -1;
+	}
+
+	/* other post processing */
+
+	switch (pe) {
+	case PMC_EV_K8_FP_DISPATCHED_FPU_OPS:
+	case PMC_EV_K8_FP_CYCLES_WITH_NO_FPU_OPS_RETIRED:
+	case PMC_EV_K8_FP_DISPATCHED_FPU_FAST_FLAG_OPS:
+	case PMC_EV_K8_FR_RETIRED_FASTPATH_DOUBLE_OP_INSTRUCTIONS:
+	case PMC_EV_K8_FR_RETIRED_FPU_INSTRUCTIONS:
+	case PMC_EV_K8_FR_FPU_EXCEPTIONS:
+		/* XXX only available in rev B and later */
+		break;
+	case PMC_EV_K8_DC_DCACHE_ACCESSES_BY_LOCKS:
+		/* XXX only available in rev C and later */
+		break;
+	case PMC_EV_K8_LS_LOCKED_OPERATION:
+		/* XXX CPU Rev A,B evmask is to be zero */
+		if (evmask & (evmask - 1)) /* > 1 bit set */
+			return -1;
+		if (evmask == 0) {
+			evmask = 0x01; /* Rev C and later: #instrs */
+			pmc_config->pm_caps |= PMC_CAP_QUALIFIER;
+		}
+		break;
+	default:
+		if (evmask == 0 && pmask != NULL) {
+			for (pm = pmask; pm->pm_name; pm++)
+				evmask |= pm->pm_value;
+			pmc_config->pm_caps |= PMC_CAP_QUALIFIER;
+		}
+	}
+
+	if (pmc_config->pm_caps & PMC_CAP_QUALIFIER)
+		pmc_config->pm_md.pm_amd.pm_amd_config =
+		    AMD_PMC_TO_UNITMASK(evmask);
+
+	return 0;
+}
+
+#endif
+
+#if defined(__amd64__) || defined(__i386__)
+
+/*
+ * Intel P4 PMCs
+ */
+
+static struct pmc_event_alias p4_aliases[] = {
+	EV_ALIAS("branches",		"p4-branch-retired,mask=mmtp+mmtm"),
+	EV_ALIAS("branch-mispredicts",	"p4-mispred-branch-retired"),
+	EV_ALIAS("cycles",		"tsc"),
+	EV_ALIAS("instructions",
+	    "p4-instr-retired,mask=nbogusntag+nbogustag"),
+	EV_ALIAS("unhalted-cycles",	"p4-global-power-events"),
+	EV_ALIAS(NULL, NULL)
+};
+
+#define	P4_KW_ACTIVE	"active"
+#define	P4_KW_ACTIVE_ANY "any"
+#define	P4_KW_ACTIVE_BOTH "both"
+#define	P4_KW_ACTIVE_NONE "none"
+#define	P4_KW_ACTIVE_SINGLE "single"
+#define	P4_KW_BUSREQTYPE "busreqtype"
+#define	P4_KW_CASCADE	"cascade"
+#define	P4_KW_EDGE	"edge"
+#define	P4_KW_INV	"complement"
+#define	P4_KW_OS	"os"
+#define	P4_KW_MASK	"mask"
+#define	P4_KW_PRECISE	"precise"
+#define	P4_KW_TAG	"tag"
+#define	P4_KW_THRESHOLD	"threshold"
+#define	P4_KW_USR	"usr"
+
+#define	__P4MASK(N,V) PMCMASK(N, (1 << (V)))
+
+static const struct pmc_masks p4_mask_tcdm[] = { /* tc deliver mode */
+	__P4MASK(dd, 0),
+	__P4MASK(db, 1),
+	__P4MASK(di, 2),
+	__P4MASK(bd, 3),
+	__P4MASK(bb, 4),
+	__P4MASK(bi, 5),
+	__P4MASK(id, 6),
+	__P4MASK(ib, 7),
+	NULLMASK
+};
+
+static const struct pmc_masks p4_mask_bfr[] = { /* bpu fetch request */
+	__P4MASK(tcmiss, 0),
+	NULLMASK,
+};
+
+static const struct pmc_masks p4_mask_ir[] = { /* itlb reference */
+	__P4MASK(hit, 0),
+	__P4MASK(miss, 1),
+	__P4MASK(hit-uc, 2),
+	NULLMASK
+};
+
+static const struct pmc_masks p4_mask_memcan[] = { /* memory cancel */
+	__P4MASK(st-rb-full, 2),
+	__P4MASK(64k-conf, 3),
+	NULLMASK
+};
+
+static const struct pmc_masks p4_mask_memcomp[] = { /* memory complete */
+	__P4MASK(lsc, 0),
+	__P4MASK(ssc, 1),
+	NULLMASK
+};
+
+static const struct pmc_masks p4_mask_lpr[] = { /* load port replay */
+	__P4MASK(split-ld, 1),
+	NULLMASK
+};
+
+static const struct pmc_masks p4_mask_spr[] = { /* store port replay */
+	__P4MASK(split-st, 1),
+	NULLMASK
+};
+
+static const struct pmc_masks p4_mask_mlr[] = { /* mob load replay */
+	__P4MASK(no-sta, 1),
+	__P4MASK(no-std, 3),
+	__P4MASK(partial-data, 4),
+	__P4MASK(unalgn-addr, 5),
+	NULLMASK
+};
+
+static const struct pmc_masks p4_mask_pwt[] = { /* page walk type */
+	__P4MASK(dtmiss, 0),
+	__P4MASK(itmiss, 1),
+	NULLMASK
+};
+
+static const struct pmc_masks p4_mask_bcr[] = { /* bsq cache reference */
+	__P4MASK(rd-2ndl-hits, 0),
+	__P4MASK(rd-2ndl-hite, 1),
+	__P4MASK(rd-2ndl-hitm, 2),
+	__P4MASK(rd-3rdl-hits, 3),
+	__P4MASK(rd-3rdl-hite, 4),
+	__P4MASK(rd-3rdl-hitm, 5),
+	__P4MASK(rd-2ndl-miss, 8),
+	__P4MASK(rd-3rdl-miss, 9),
+	__P4MASK(wr-2ndl-miss, 10),
+	NULLMASK
+};
+
+static const struct pmc_masks p4_mask_ia[] = { /* ioq allocation */
+	__P4MASK(all-read, 5),
+	__P4MASK(all-write, 6),
+	__P4MASK(mem-uc, 7),
+	__P4MASK(mem-wc, 8),
+	__P4MASK(mem-wt, 9),
+	__P4MASK(mem-wp, 10),
+	__P4MASK(mem-wb, 11),
+	__P4MASK(own, 13),
+	__P4MASK(other, 14),
+	__P4MASK(prefetch, 15),
+	NULLMASK
+};
+
+static const struct pmc_masks p4_mask_iae[] = { /* ioq active entries */
+	__P4MASK(all-read, 5),
+	__P4MASK(all-write, 6),
+	__P4MASK(mem-uc, 7),
+	__P4MASK(mem-wc, 8),
+	__P4MASK(mem-wt, 9),
+	__P4MASK(mem-wp, 10),
+	__P4MASK(mem-wb, 11),
+	__P4MASK(own, 13),
+	__P4MASK(other, 14),
+	__P4MASK(prefetch, 15),
+	NULLMASK
+};
+
+static const struct pmc_masks p4_mask_fda[] = { /* fsb data activity */
+	__P4MASK(drdy-drv, 0),
+	__P4MASK(drdy-own, 1),
+	__P4MASK(drdy-other, 2),
+	__P4MASK(dbsy-drv, 3),
+	__P4MASK(dbsy-own, 4),
+	__P4MASK(dbsy-other, 5),
+	NULLMASK
+};
+
+static const struct pmc_masks p4_mask_ba[] = { /* bsq allocation */
+	__P4MASK(req-type0, 0),
+	__P4MASK(req-type1, 1),
+	__P4MASK(req-len0, 2),
+	__P4MASK(req-len1, 3),
+	__P4MASK(req-io-type, 5),
+	__P4MASK(req-lock-type, 6),
+	__P4MASK(req-cache-type, 7),
+	__P4MASK(req-split-type, 8),
+	__P4MASK(req-dem-type, 9),
+	__P4MASK(req-ord-type, 10),
+	__P4MASK(mem-type0, 11),
+	__P4MASK(mem-type1, 12),
+	__P4MASK(mem-type2, 13),
+	NULLMASK
+};
+
+static const struct pmc_masks p4_mask_sia[] = { /* sse input assist */
+	__P4MASK(all, 15),
+	NULLMASK
+};
+
+static const struct pmc_masks p4_mask_psu[] = { /* packed sp uop */
+	__P4MASK(all, 15),
+	NULLMASK
+};
+
+static const struct pmc_masks p4_mask_pdu[] = { /* packed dp uop */
+	__P4MASK(all, 15),
+	NULLMASK
+};
+
+static const struct pmc_masks p4_mask_ssu[] = { /* scalar sp uop */
+	__P4MASK(all, 15),
+	NULLMASK
+};
+
+static const struct pmc_masks p4_mask_sdu[] = { /* scalar dp uop */
+	__P4MASK(all, 15),
+	NULLMASK
+};
+
+static const struct pmc_masks p4_mask_64bmu[] = { /* 64 bit mmx uop */
+	__P4MASK(all, 15),
+	NULLMASK
+};
+
+static const struct pmc_masks p4_mask_128bmu[] = { /* 128 bit mmx uop */
+	__P4MASK(all, 15),
+	NULLMASK
+};
+
+static const struct pmc_masks p4_mask_xfu[] = { /* X87 fp uop */
+	__P4MASK(all, 15),
+	NULLMASK
+};
+
+static const struct pmc_masks p4_mask_xsmu[] = { /* x87 simd moves uop */
+	__P4MASK(allp0, 3),
+	__P4MASK(allp2, 4),
+	NULLMASK
+};
+
+static const struct pmc_masks p4_mask_gpe[] = { /* global power events */
+	__P4MASK(running, 0),
+	NULLMASK
+};
+
+static const struct pmc_masks p4_mask_tmx[] = { /* TC ms xfer */
+	__P4MASK(cisc, 0),
+	NULLMASK
+};
+
+static const struct pmc_masks p4_mask_uqw[] = { /* uop queue writes */
+	__P4MASK(from-tc-build, 0),
+	__P4MASK(from-tc-deliver, 1),
+	__P4MASK(from-rom, 2),
+	NULLMASK
+};
+
+static const struct pmc_masks p4_mask_rmbt[] = {
+	/* retired mispred branch type */
+	__P4MASK(conditional, 1),
+	__P4MASK(call, 2),
+	__P4MASK(return, 3),
+	__P4MASK(indirect, 4),
+	NULLMASK
+};
+
+static const struct pmc_masks p4_mask_rbt[] = { /* retired branch type */
+	__P4MASK(conditional, 1),
+	__P4MASK(call, 2),
+	__P4MASK(retired, 3),
+	__P4MASK(indirect, 4),
+	NULLMASK
+};
+
+static const struct pmc_masks p4_mask_rs[] = { /* resource stall */
+	__P4MASK(sbfull, 5),
+	NULLMASK
+};
+
+static const struct pmc_masks p4_mask_wb[] = { /* WC buffer */
+	__P4MASK(wcb-evicts, 0),
+	__P4MASK(wcb-full-evict, 1),
+	NULLMASK
+};
+
+static const struct pmc_masks p4_mask_fee[] = { /* front end event */
+	__P4MASK(nbogus, 0),
+	__P4MASK(bogus, 1),
+	NULLMASK
+};
+
+static const struct pmc_masks p4_mask_ee[] = { /* execution event */
+	__P4MASK(nbogus0, 0),
+	__P4MASK(nbogus1, 1),
+	__P4MASK(nbogus2, 2),
+	__P4MASK(nbogus3, 3),
+	__P4MASK(bogus0, 4),
+	__P4MASK(bogus1, 5),
+	__P4MASK(bogus2, 6),
+	__P4MASK(bogus3, 7),
+	NULLMASK
+};
+
+static const struct pmc_masks p4_mask_re[] = { /* replay event */
+	__P4MASK(nbogus, 0),
+	__P4MASK(bogus, 1),
+	NULLMASK
+};
+
+static const struct pmc_masks p4_mask_insret[] = { /* instr retired */
+	__P4MASK(nbogusntag, 0),
+	__P4MASK(nbogustag, 1),
+	__P4MASK(bogusntag, 2),
+	__P4MASK(bogustag, 3),
+	NULLMASK
+};
+
+static const struct pmc_masks p4_mask_ur[] = { /* uops retired */
+	__P4MASK(nbogus, 0),
+	__P4MASK(bogus, 1),
+	NULLMASK
+};
+
+static const struct pmc_masks p4_mask_ut[] = { /* uop type */
+	__P4MASK(tagloads, 1),
+	__P4MASK(tagstores, 2),
+	NULLMASK
+};
+
+static const struct pmc_masks p4_mask_br[] = { /* branch retired */
+	__P4MASK(mmnp, 0),
+	__P4MASK(mmnm, 1),
+	__P4MASK(mmtp, 2),
+	__P4MASK(mmtm, 3),
+	NULLMASK
+};
+
+static const struct pmc_masks p4_mask_mbr[] = { /* mispred branch retired */
+	__P4MASK(nbogus, 0),
+	NULLMASK
+};
+
+static const struct pmc_masks p4_mask_xa[] = { /* x87 assist */
+	__P4MASK(fpsu, 0),
+	__P4MASK(fpso, 1),
+	__P4MASK(poao, 2),
+	__P4MASK(poau, 3),
+	__P4MASK(prea, 4),
+	NULLMASK
+};
+
+static const struct pmc_masks p4_mask_machclr[] = { /* machine clear */
+	__P4MASK(clear, 0),
+	__P4MASK(moclear, 2),
+	__P4MASK(smclear, 3),
+	NULLMASK
+};
+
+/* P4 event parser */
+static int
+p4_allocate_pmc(enum pmc_event pe, char *ctrspec,
+    struct pmc_op_pmcallocate *pmc_config)
+{
+
+	char	*e, *p, *q;
+	int	count, has_tag, has_busreqtype, n;
+	uint32_t evmask, cccractivemask;
+	const struct pmc_masks *pm, *pmask;
+
+	pmc_config->pm_caps |= PMC_CAP_READ;
+	pmc_config->pm_md.pm_p4.pm_p4_cccrconfig =
+	    pmc_config->pm_md.pm_p4.pm_p4_escrconfig = 0;
+
+	if (pe == PMC_EV_TSC_TSC) {
+		/* TSC must not be further qualified */
+		if (ctrspec && *ctrspec != '\0')
+			return -1;
+		return 0;
+	}
+
+	pmask   = NULL;
+	evmask  = 0;
+	cccractivemask = 0x3;
+	has_tag = has_busreqtype = 0;
+	pmc_config->pm_caps |= PMC_CAP_WRITE;
+
+#define	__P4SETMASK(M) do {				\
+	pmask = p4_mask_##M; 				\
+} while (0)
+
+	switch (pe) {
+	case PMC_EV_P4_TC_DELIVER_MODE:
+		__P4SETMASK(tcdm);
+		break;
+	case PMC_EV_P4_BPU_FETCH_REQUEST:
+		__P4SETMASK(bfr);
+		break;
+	case PMC_EV_P4_ITLB_REFERENCE:
+		__P4SETMASK(ir);
+		break;
+	case PMC_EV_P4_MEMORY_CANCEL:
+		__P4SETMASK(memcan);
+		break;
+	case PMC_EV_P4_MEMORY_COMPLETE:
+		__P4SETMASK(memcomp);
+		break;
+	case PMC_EV_P4_LOAD_PORT_REPLAY:
+		__P4SETMASK(lpr);
+		break;
+	case PMC_EV_P4_STORE_PORT_REPLAY:
+		__P4SETMASK(spr);
+		break;
+	case PMC_EV_P4_MOB_LOAD_REPLAY:
+		__P4SETMASK(mlr);
+		break;
+	case PMC_EV_P4_PAGE_WALK_TYPE:
+		__P4SETMASK(pwt);
+		break;
+	case PMC_EV_P4_BSQ_CACHE_REFERENCE:
+		__P4SETMASK(bcr);
+		break;
+	case PMC_EV_P4_IOQ_ALLOCATION:
+		__P4SETMASK(ia);
+		has_busreqtype = 1;
+		break;
+	case PMC_EV_P4_IOQ_ACTIVE_ENTRIES:
+		__P4SETMASK(iae);
+		has_busreqtype = 1;
+		break;
+	case PMC_EV_P4_FSB_DATA_ACTIVITY:
+		__P4SETMASK(fda);
+		break;
+	case PMC_EV_P4_BSQ_ALLOCATION:
+		__P4SETMASK(ba);
+		break;
+	case PMC_EV_P4_SSE_INPUT_ASSIST:
+		__P4SETMASK(sia);
+		break;
+	case PMC_EV_P4_PACKED_SP_UOP:
+		__P4SETMASK(psu);
+		break;
+	case PMC_EV_P4_PACKED_DP_UOP:
+		__P4SETMASK(pdu);
+		break;
+	case PMC_EV_P4_SCALAR_SP_UOP:
+		__P4SETMASK(ssu);
+		break;
+	case PMC_EV_P4_SCALAR_DP_UOP:
+		__P4SETMASK(sdu);
+		break;
+	case PMC_EV_P4_64BIT_MMX_UOP:
+		__P4SETMASK(64bmu);
+		break;
+	case PMC_EV_P4_128BIT_MMX_UOP:
+		__P4SETMASK(128bmu);
+		break;
+	case PMC_EV_P4_X87_FP_UOP:
+		__P4SETMASK(xfu);
+		break;
+	case PMC_EV_P4_X87_SIMD_MOVES_UOP:
+		__P4SETMASK(xsmu);
+		break;
+	case PMC_EV_P4_GLOBAL_POWER_EVENTS:
+		__P4SETMASK(gpe);
+		break;
+	case PMC_EV_P4_TC_MS_XFER:
+		__P4SETMASK(tmx);
+		break;
+	case PMC_EV_P4_UOP_QUEUE_WRITES:
+		__P4SETMASK(uqw);
+		break;
+	case PMC_EV_P4_RETIRED_MISPRED_BRANCH_TYPE:
+		__P4SETMASK(rmbt);
+		break;
+	case PMC_EV_P4_RETIRED_BRANCH_TYPE:
+		__P4SETMASK(rbt);
+		break;
+	case PMC_EV_P4_RESOURCE_STALL:
+		__P4SETMASK(rs);
+		break;
+	case PMC_EV_P4_WC_BUFFER:
+		__P4SETMASK(wb);
+		break;
+	case PMC_EV_P4_BSQ_ACTIVE_ENTRIES:
+	case PMC_EV_P4_B2B_CYCLES:
+	case PMC_EV_P4_BNR:
+	case PMC_EV_P4_SNOOP:
+	case PMC_EV_P4_RESPONSE:
+		break;
+	case PMC_EV_P4_FRONT_END_EVENT:
+		__P4SETMASK(fee);
+		break;
+	case PMC_EV_P4_EXECUTION_EVENT:
+		__P4SETMASK(ee);
+		break;
+	case PMC_EV_P4_REPLAY_EVENT:
+		__P4SETMASK(re);
+		break;
+	case PMC_EV_P4_INSTR_RETIRED:
+		__P4SETMASK(insret);
+		break;
+	case PMC_EV_P4_UOPS_RETIRED:
+		__P4SETMASK(ur);
+		break;
+	case PMC_EV_P4_UOP_TYPE:
+		__P4SETMASK(ut);
+		break;
+	case PMC_EV_P4_BRANCH_RETIRED:
+		__P4SETMASK(br);
+		break;
+	case PMC_EV_P4_MISPRED_BRANCH_RETIRED:
+		__P4SETMASK(mbr);
+		break;
+	case PMC_EV_P4_X87_ASSIST:
+		__P4SETMASK(xa);
+		break;
+	case PMC_EV_P4_MACHINE_CLEAR:
+		__P4SETMASK(machclr);
+		break;
+	default:
+		return -1;
+	}
+
+	/* process additional flags */
+	while ((p = strsep(&ctrspec, ",")) != NULL) {
+		if (KWPREFIXMATCH(p, P4_KW_ACTIVE)) {
+			q = strchr(p, '=');
+			if (*++q == '\0') /* skip '=' */
+				return -1;
+
+			if (strcmp(q, P4_KW_ACTIVE_NONE) == 0)
+				cccractivemask = 0x0;
+			else if (strcmp(q, P4_KW_ACTIVE_SINGLE) == 0)
+				cccractivemask = 0x1;
+			else if (strcmp(q, P4_KW_ACTIVE_BOTH) == 0)
+				cccractivemask = 0x2;
+			else if (strcmp(q, P4_KW_ACTIVE_ANY) == 0)
+				cccractivemask = 0x3;
+			else
+				return -1;
+
+		} else if (KWPREFIXMATCH(p, P4_KW_BUSREQTYPE)) {
+			if (has_busreqtype == 0)
+				return -1;
+
+			q = strchr(p, '=');
+			if (*++q == '\0') /* skip '=' */
+				return -1;
+
+			count = strtol(q, &e, 0);
+			if (e == q || *e != '\0')
+				return -1;
+			evmask = (evmask & ~0x1F) | (count & 0x1F);
+		} else if (KWMATCH(p, P4_KW_CASCADE))
+			pmc_config->pm_caps |= PMC_CAP_CASCADE;
+		else if (KWMATCH(p, P4_KW_EDGE))
+			pmc_config->pm_caps |= PMC_CAP_EDGE;
+		else if (KWMATCH(p, P4_KW_INV))
+			pmc_config->pm_caps |= PMC_CAP_INVERT;
+		else if (KWPREFIXMATCH(p, P4_KW_MASK "=")) {
+			if ((n = pmc_parse_mask(pmask, p, &evmask)) < 0)
+				return -1;
+			pmc_config->pm_caps |= PMC_CAP_QUALIFIER;
+		} else if (KWMATCH(p, P4_KW_OS))
+			pmc_config->pm_caps |= PMC_CAP_SYSTEM;
+		else if (KWMATCH(p, P4_KW_PRECISE))
+			pmc_config->pm_caps |= PMC_CAP_PRECISE;
+		else if (KWPREFIXMATCH(p, P4_KW_TAG "=")) {
+			if (has_tag == 0)
+				return -1;
+
+			q = strchr(p, '=');
+			if (*++q == '\0') /* skip '=' */
+				return -1;
+
+			count = strtol(q, &e, 0);
+			if (e == q || *e != '\0')
+				return -1;
+
+			pmc_config->pm_caps |= PMC_CAP_TAGGING;
+			pmc_config->pm_md.pm_p4.pm_p4_escrconfig |=
+			    P4_ESCR_TO_TAG_VALUE(count);
+		} else if (KWPREFIXMATCH(p, P4_KW_THRESHOLD "=")) {
+			q = strchr(p, '=');
+			if (*++q == '\0') /* skip '=' */
+				return -1;
+
+			count = strtol(q, &e, 0);
+			if (e == q || *e != '\0')
+				return -1;
+
+			pmc_config->pm_caps |= PMC_CAP_THRESHOLD;
+			pmc_config->pm_md.pm_p4.pm_p4_cccrconfig &=
+			    ~P4_CCCR_THRESHOLD_MASK;
+			pmc_config->pm_md.pm_p4.pm_p4_cccrconfig |=
+			    P4_CCCR_TO_THRESHOLD(count);
+		} else if (KWMATCH(p, P4_KW_USR))
+			pmc_config->pm_caps |= PMC_CAP_USER;
+		else
+			return -1;
+	}
+
+	/* other post processing */
+	if (pe == PMC_EV_P4_IOQ_ALLOCATION ||
+	    pe == PMC_EV_P4_FSB_DATA_ACTIVITY ||
+	    pe == PMC_EV_P4_BSQ_ALLOCATION)
+		pmc_config->pm_caps |= PMC_CAP_EDGE;
+
+	/* fill in thread activity mask */
+	pmc_config->pm_md.pm_p4.pm_p4_cccrconfig |=
+	    P4_CCCR_TO_ACTIVE_THREAD(cccractivemask);
+
+	if (evmask)
+		pmc_config->pm_caps |= PMC_CAP_QUALIFIER;
+
+	switch (pe) {
+	case PMC_EV_P4_FSB_DATA_ACTIVITY:
+		if ((evmask & 0x06) == 0x06 ||
+		    (evmask & 0x18) == 0x18)
+			return -1; /* can't have own+other bits together */
+		if (evmask == 0) /* default:drdy-{drv,own}+dbsy{drv,own} */
+			evmask = 0x1D;
+		break;
+	case PMC_EV_P4_MACHINE_CLEAR:
+		/* only one bit is allowed to be set */
+		if ((evmask & (evmask - 1)) != 0)
+			return -1;
+		if (evmask == 0) {
+			evmask = 0x1; 	/* 'CLEAR' */
+			pmc_config->pm_caps |= PMC_CAP_QUALIFIER;
+		}
+		break;
+	default:
+		if (evmask == 0 && pmask) {
+			for (pm = pmask; pm->pm_name; pm++)
+				evmask |= pm->pm_value;
+			pmc_config->pm_caps |= PMC_CAP_QUALIFIER;
+		}
+	}
+
+	pmc_config->pm_md.pm_p4.pm_p4_escrconfig =
+	    P4_ESCR_TO_EVENT_MASK(evmask);
+
+	return 0;
+}
+
+#endif
+
+#if defined(__i386__)
+
+/*
+ * Pentium style PMCs
+ */
+
+static struct pmc_event_alias p5_aliases[] = {
+	EV_ALIAS("cycles", "tsc"),
+	EV_ALIAS(NULL, NULL)
+};
+
+static int
+p5_allocate_pmc(enum pmc_event pe, char *ctrspec,
+    struct pmc_op_pmcallocate *pmc_config)
+{
+	return -1 || pe || ctrspec || pmc_config; /* shut up gcc */
+}
+
+/*
+ * Pentium Pro style PMCs.  These PMCs are found in Pentium II, Pentium III,
+ * and Pentium M CPUs.
+ */
+
+static struct pmc_event_alias p6_aliases[] = {
+	EV_ALIAS("branches",		"p6-br-inst-retired"),
+	EV_ALIAS("branch-mispredicts",	"p6-br-miss-pred-retired"),
+	EV_ALIAS("cycles",		"tsc"),
+	EV_ALIAS("dc-misses",		"p6-dcu-lines-in"),
+	EV_ALIAS("ic-misses",		"p6-ifu-fetch-miss"),
+	EV_ALIAS("instructions",	"p6-inst-retired"),
+	EV_ALIAS("interrupts",		"p6-hw-int-rx"),
+	EV_ALIAS("unhalted-cycles",	"p6-cpu-clk-unhalted"),
+	EV_ALIAS(NULL, NULL)
+};
+
+#define	P6_KW_CMASK	"cmask"
+#define	P6_KW_EDGE	"edge"
+#define	P6_KW_INV	"inv"
+#define	P6_KW_OS	"os"
+#define	P6_KW_UMASK	"umask"
+#define	P6_KW_USR	"usr"
+
+static struct pmc_masks p6_mask_mesi[] = {
+	PMCMASK(m,	0x01),
+	PMCMASK(e,	0x02),
+	PMCMASK(s,	0x04),
+	PMCMASK(i,	0x08),
+	NULLMASK
+};
+
+static struct pmc_masks p6_mask_mesihw[] = {
+	PMCMASK(m,	0x01),
+	PMCMASK(e,	0x02),
+	PMCMASK(s,	0x04),
+	PMCMASK(i,	0x08),
+	PMCMASK(nonhw,	0x00),
+	PMCMASK(hw,	0x10),
+	PMCMASK(both,	0x30),
+	NULLMASK
+};
+
+static struct pmc_masks p6_mask_hw[] = {
+	PMCMASK(nonhw,	0x00),
+	PMCMASK(hw,	0x10),
+	PMCMASK(both,	0x30),
+	NULLMASK
+};
+
+static struct pmc_masks p6_mask_any[] = {
+	PMCMASK(self,	0x00),
+	PMCMASK(any,	0x20),
+	NULLMASK
+};
+
+static struct pmc_masks p6_mask_ekp[] = {
+	PMCMASK(nta,	0x00),
+	PMCMASK(t1,	0x01),
+	PMCMASK(t2,	0x02),
+	PMCMASK(wos,	0x03),
+	NULLMASK
+};
+
+static struct pmc_masks p6_mask_pps[] = {
+	PMCMASK(packed-and-scalar, 0x00),
+	PMCMASK(scalar,	0x01),
+	NULLMASK
+};
+
+static struct pmc_masks p6_mask_mite[] = {
+	PMCMASK(packed-multiply,	 0x01),
+	PMCMASK(packed-shift,		0x02),
+	PMCMASK(pack,			0x04),
+	PMCMASK(unpack,			0x08),
+	PMCMASK(packed-logical,		0x10),
+	PMCMASK(packed-arithmetic,	0x20),
+	NULLMASK
+};
+
+static struct pmc_masks p6_mask_fmt[] = {
+	PMCMASK(mmxtofp,	0x00),
+	PMCMASK(fptommx,	0x01),
+	NULLMASK
+};
+
+static struct pmc_masks p6_mask_sr[] = {
+	PMCMASK(es,	0x01),
+	PMCMASK(ds,	0x02),
+	PMCMASK(fs,	0x04),
+	PMCMASK(gs,	0x08),
+	NULLMASK
+};
+
+static struct pmc_masks p6_mask_eet[] = {
+	PMCMASK(all,	0x00),
+	PMCMASK(freq,	0x02),
+	NULLMASK
+};
+
+static struct pmc_masks p6_mask_efur[] = {
+	PMCMASK(all,	0x00),
+	PMCMASK(loadop,	0x01),
+	PMCMASK(stdsta,	0x02),
+	NULLMASK
+};
+
+static struct pmc_masks p6_mask_essir[] = {
+	PMCMASK(sse-packed-single,	0x00),
+	PMCMASK(sse-packed-single-scalar-single, 0x01),
+	PMCMASK(sse2-packed-double,	0x02),
+	PMCMASK(sse2-scalar-double,	0x03),
+	NULLMASK
+};
+
+static struct pmc_masks p6_mask_esscir[] = {
+	PMCMASK(sse-packed-single,	0x00),
+	PMCMASK(sse-scalar-single,	0x01),
+	PMCMASK(sse2-packed-double,	0x02),
+	PMCMASK(sse2-scalar-double,	0x03),
+	NULLMASK
+};
+
+/* P6 event parser */
+static int
+p6_allocate_pmc(enum pmc_event pe, char *ctrspec,
+    struct pmc_op_pmcallocate *pmc_config)
+{
+	char *e, *p, *q;
+	uint32_t evmask;
+	int count, n;
+	const struct pmc_masks *pm, *pmask;
+
+	pmc_config->pm_caps |= PMC_CAP_READ;
+	pmc_config->pm_md.pm_ppro.pm_ppro_config = 0;
+
+	if (pe == PMC_EV_TSC_TSC) {
+		if (ctrspec && *ctrspec != '\0')
+			return -1;
+		return 0;
+	}
+
+	pmc_config->pm_caps |= PMC_CAP_WRITE;
+	evmask = 0;
+
+#define	P6MASKSET(M)	pmask = p6_mask_ ## M
+
+	switch(pe) {
+	case PMC_EV_P6_L2_IFETCH: 	P6MASKSET(mesi); break;
+	case PMC_EV_P6_L2_LD:		P6MASKSET(mesi); break;
+	case PMC_EV_P6_L2_ST:		P6MASKSET(mesi); break;
+	case PMC_EV_P6_L2_RQSTS:	P6MASKSET(mesi); break;
+	case PMC_EV_P6_BUS_DRDY_CLOCKS:
+	case PMC_EV_P6_BUS_LOCK_CLOCKS:
+	case PMC_EV_P6_BUS_TRAN_BRD:
+	case PMC_EV_P6_BUS_TRAN_RFO:
+	case PMC_EV_P6_BUS_TRANS_WB:
+	case PMC_EV_P6_BUS_TRAN_IFETCH:
+	case PMC_EV_P6_BUS_TRAN_INVAL:
+	case PMC_EV_P6_BUS_TRAN_PWR:
+	case PMC_EV_P6_BUS_TRANS_P:
+	case PMC_EV_P6_BUS_TRANS_IO:
+	case PMC_EV_P6_BUS_TRAN_DEF:
+	case PMC_EV_P6_BUS_TRAN_BURST:
+	case PMC_EV_P6_BUS_TRAN_ANY:
+	case PMC_EV_P6_BUS_TRAN_MEM:
+		P6MASKSET(any);	break;
+	case PMC_EV_P6_EMON_KNI_PREF_DISPATCHED:
+	case PMC_EV_P6_EMON_KNI_PREF_MISS:
+		P6MASKSET(ekp); break;
+	case PMC_EV_P6_EMON_KNI_INST_RETIRED:
+	case PMC_EV_P6_EMON_KNI_COMP_INST_RET:
+		P6MASKSET(pps);	break;
+	case PMC_EV_P6_MMX_INSTR_TYPE_EXEC:
+		P6MASKSET(mite); break;
+	case PMC_EV_P6_FP_MMX_TRANS:
+		P6MASKSET(fmt);	break;
+	case PMC_EV_P6_SEG_RENAME_STALLS:
+	case PMC_EV_P6_SEG_REG_RENAMES:
+		P6MASKSET(sr);	break;
+	case PMC_EV_P6_EMON_EST_TRANS:
+		P6MASKSET(eet);	break;
+	case PMC_EV_P6_EMON_FUSED_UOPS_RET:
+		P6MASKSET(efur); break;
+	case PMC_EV_P6_EMON_SSE_SSE2_INST_RETIRED:
+		P6MASKSET(essir); break;
+	case PMC_EV_P6_EMON_SSE_SSE2_COMP_INST_RETIRED:
+		P6MASKSET(esscir); break;
+	default:
+		pmask = NULL;
+		break;
+	}
+
+	/* Pentium M PMCs have a few events with different semantics */
+	if (cpu_info.pm_cputype == PMC_CPU_INTEL_PM) {
+		if (pe == PMC_EV_P6_L2_LD ||
+		    pe == PMC_EV_P6_L2_LINES_IN ||
+		    pe == PMC_EV_P6_L2_LINES_OUT)
+			P6MASKSET(mesihw);
+		else if (pe == PMC_EV_P6_L2_M_LINES_OUTM)
+			P6MASKSET(hw);
+	}
+
+	/* Parse additional modifiers if present */
+	while ((p = strsep(&ctrspec, ",")) != NULL) {
+		if (KWPREFIXMATCH(p, P6_KW_CMASK "=")) {
+			q = strchr(p, '=');
+			if (*++q == '\0') /* skip '=' */
+				return -1;
+			count = strtol(q, &e, 0);
+			if (e == q || *e != '\0')
+				return -1;
+			pmc_config->pm_caps |= PMC_CAP_THRESHOLD;
+			pmc_config->pm_md.pm_ppro.pm_ppro_config |=
+			    P6_EVSEL_TO_CMASK(count);
+		} else if (KWMATCH(p, P6_KW_EDGE)) {
+			pmc_config->pm_caps |= PMC_CAP_EDGE;
+		} else if (KWMATCH(p, P6_KW_INV)) {
+			pmc_config->pm_caps |= PMC_CAP_INVERT;
+		} else if (KWMATCH(p, P6_KW_OS)) {
+			pmc_config->pm_caps |= PMC_CAP_SYSTEM;
+		} else if (KWPREFIXMATCH(p, P6_KW_UMASK "=")) {
+			evmask = 0;
+			if ((n = pmc_parse_mask(pmask, p, &evmask)) < 0)
+				return -1;
+			if ((pe == PMC_EV_P6_BUS_DRDY_CLOCKS ||
+			     pe == PMC_EV_P6_BUS_LOCK_CLOCKS ||
+			     pe == PMC_EV_P6_BUS_TRAN_BRD ||
+			     pe == PMC_EV_P6_BUS_TRAN_RFO ||
+			     pe == PMC_EV_P6_BUS_TRAN_IFETCH ||
+			     pe == PMC_EV_P6_BUS_TRAN_INVAL ||
+			     pe == PMC_EV_P6_BUS_TRAN_PWR ||
+			     pe == PMC_EV_P6_BUS_TRAN_DEF ||
+			     pe == PMC_EV_P6_BUS_TRAN_BURST ||
+			     pe == PMC_EV_P6_BUS_TRAN_ANY ||
+			     pe == PMC_EV_P6_BUS_TRAN_MEM ||
+			     pe == PMC_EV_P6_BUS_TRANS_IO ||
+			     pe == PMC_EV_P6_BUS_TRANS_P ||
+			     pe == PMC_EV_P6_BUS_TRANS_WB ||
+			     pe == PMC_EV_P6_EMON_EST_TRANS ||
+			     pe == PMC_EV_P6_EMON_FUSED_UOPS_RET ||
+			     pe == PMC_EV_P6_EMON_KNI_COMP_INST_RET ||
+			     pe == PMC_EV_P6_EMON_KNI_INST_RETIRED ||
+			     pe == PMC_EV_P6_EMON_KNI_PREF_DISPATCHED ||
+			     pe == PMC_EV_P6_EMON_KNI_PREF_MISS ||
+			     pe == PMC_EV_P6_EMON_SSE_SSE2_COMP_INST_RETIRED ||
+			     pe == PMC_EV_P6_EMON_SSE_SSE2_INST_RETIRED ||
+			     pe == PMC_EV_P6_FP_MMX_TRANS)
+			    && (n > 1))
+				return -1; /* only one mask keyword allowed */
+			pmc_config->pm_caps |= PMC_CAP_QUALIFIER;
+		} else if (KWMATCH(p, P6_KW_USR)) {
+			pmc_config->pm_caps |= PMC_CAP_USER;
+		} else
+			return -1;
+	}
+
+	/* post processing */
+	switch (pe) {
+
+		/*
+		 * The following events default to an evmask of 0
+		 */
+
+		/* default => 'self' */
+	case PMC_EV_P6_BUS_DRDY_CLOCKS:
+	case PMC_EV_P6_BUS_LOCK_CLOCKS:
+	case PMC_EV_P6_BUS_TRAN_BRD:
+	case PMC_EV_P6_BUS_TRAN_RFO:
+	case PMC_EV_P6_BUS_TRANS_WB:
+	case PMC_EV_P6_BUS_TRAN_IFETCH:
+	case PMC_EV_P6_BUS_TRAN_INVAL:
+	case PMC_EV_P6_BUS_TRAN_PWR:
+	case PMC_EV_P6_BUS_TRANS_P:
+	case PMC_EV_P6_BUS_TRANS_IO:
+	case PMC_EV_P6_BUS_TRAN_DEF:
+	case PMC_EV_P6_BUS_TRAN_BURST:
+	case PMC_EV_P6_BUS_TRAN_ANY:
+	case PMC_EV_P6_BUS_TRAN_MEM:
+
+		/* default => 'nta' */
+	case PMC_EV_P6_EMON_KNI_PREF_DISPATCHED:
+	case PMC_EV_P6_EMON_KNI_PREF_MISS:
+
+		/* default => 'packed and scalar' */
+	case PMC_EV_P6_EMON_KNI_INST_RETIRED:
+	case PMC_EV_P6_EMON_KNI_COMP_INST_RET:
+
+		/* default => 'mmx to fp transitions' */
+	case PMC_EV_P6_FP_MMX_TRANS:
+
+		/* default => 'SSE Packed Single' */
+	case PMC_EV_P6_EMON_SSE_SSE2_INST_RETIRED:
+	case PMC_EV_P6_EMON_SSE_SSE2_COMP_INST_RETIRED:
+
+		/* default => 'all fused micro-ops' */
+	case PMC_EV_P6_EMON_FUSED_UOPS_RET:
+
+		/* default => 'all transitions' */
+	case PMC_EV_P6_EMON_EST_TRANS:
+		break;
+
+	case PMC_EV_P6_MMX_UOPS_EXEC:
+		evmask = 0x0F;		/* only value allowed */
+		break;
+
+	default:
+
+		/*
+		 * For all other events, set the default event mask
+		 * to a logical OR of all the allowed event mask bits.
+		 */
+
+		if (evmask == 0 && pmask) {
+			for (pm = pmask; pm->pm_name; pm++)
+				evmask |= pm->pm_value;
+			pmc_config->pm_caps |= PMC_CAP_QUALIFIER;
+		}
+
+		break;
+	}
+
+	if (pmc_config->pm_caps & PMC_CAP_QUALIFIER)
+		pmc_config->pm_md.pm_ppro.pm_ppro_config |=
+		    P6_EVSEL_TO_UMASK(evmask);
+
+	return 0;
+}
+
+#endif
+
+/*
+ * API entry points
+ */
+
+
+int
+pmc_allocate(const char *ctrspec, enum pmc_mode mode,
+    uint32_t flags, int cpu, pmc_id_t *pmcid)
+{
+	int retval;
+	enum pmc_event pe;
+	char *r, *spec_copy;
+	const char *ctrname;
+	const struct pmc_event_alias *p;
+	struct pmc_op_pmcallocate pmc_config;
+
+	spec_copy = NULL;
+	retval    = -1;
+
+	if (mode != PMC_MODE_SS && mode != PMC_MODE_TS &&
+	    mode != PMC_MODE_SC && mode != PMC_MODE_TC) {
+		errno = EINVAL;
+		goto out;
+	}
+
+	/* replace an event alias with the canonical event specifier */
+	if (pmc_mdep_event_aliases)
+		for (p = pmc_mdep_event_aliases; p->pm_alias; p++)
+			if (!strcmp(ctrspec, p->pm_alias)) {
+				spec_copy = strdup(p->pm_spec);
+				break;
+			}
+
+	if (spec_copy == NULL)
+		spec_copy = strdup(ctrspec);
+
+	r = spec_copy;
+	ctrname = strsep(&r, ",");
+
+	/* look for the given counter name */
+
+	for (pe = PMC_EVENT_FIRST; pe < (PMC_EVENT_LAST+1); pe++)
+		if (!strcmp(ctrname, pmc_event_table[pe].pm_ev_name))
+			break;
+
+	if (pe > PMC_EVENT_LAST) {
+		errno = EINVAL;
+		goto out;
+	}
+
+	bzero(&pmc_config, sizeof(pmc_config));
+	pmc_config.pm_ev    = pmc_event_table[pe].pm_ev_code;
+	pmc_config.pm_class = pmc_event_table[pe].pm_ev_class;
+	pmc_config.pm_cpu   = cpu;
+	pmc_config.pm_mode  = mode;
+	pmc_config.pm_flags = flags;
+
+	if (PMC_IS_SAMPLING_MODE(mode))
+		pmc_config.pm_caps |= PMC_CAP_INTERRUPT;
+
+	if (pmc_mdep_allocate_pmc(pe, r, &pmc_config) < 0) {
+		errno = EINVAL;
+		goto out;
+	}
+
+	if (PMC_CALL(PMCALLOCATE, &pmc_config) < 0)
+		goto out;
+
+	*pmcid = pmc_config.pm_pmcid;
+
+	retval = 0;
+
+ out:
+	if (spec_copy)
+		free(spec_copy);
+
+	return retval;
+}
+
+int
+pmc_attach(pmc_id_t pmc, pid_t pid)
+{
+	struct pmc_op_pmcattach pmc_attach_args;
+
+	pmc_attach_args.pm_pmc = pmc;
+	pmc_attach_args.pm_pid = pid;
+
+	return PMC_CALL(PMCATTACH, &pmc_attach_args);
+}
+
+int
+pmc_capabilities(pmc_id_t pmcid, uint32_t *caps)
+{
+	unsigned int i;
+	enum pmc_class cl;
+
+	cl = PMC_ID_TO_CLASS(pmcid);
+	for (i = 0; i < cpu_info.pm_nclass; i++)
+		if (cpu_info.pm_classes[i].pm_class == cl) {
+			*caps = cpu_info.pm_classes[i].pm_caps;
+			return 0;
+		}
+	return EINVAL;
+}
+
+int
+pmc_configure_logfile(int fd)
+{
+	struct pmc_op_configurelog cla;
+
+	cla.pm_logfd = fd;
+	if (PMC_CALL(CONFIGURELOG, &cla) < 0)
+		return -1;
+	return 0;
+}
+
+int
+pmc_cpuinfo(const struct pmc_cpuinfo **pci)
+{
+	if (pmc_syscall == -1) {
+		errno = ENXIO;
+		return -1;
+	}
+
+	*pci = &cpu_info;
+	return 0;
+}
+
+int
+pmc_detach(pmc_id_t pmc, pid_t pid)
+{
+	struct pmc_op_pmcattach pmc_detach_args;
+
+	pmc_detach_args.pm_pmc = pmc;
+	pmc_detach_args.pm_pid = pid;
+
+	return PMC_CALL(PMCDETACH, &pmc_detach_args);
+}
+
+int
+pmc_disable(int cpu, int pmc)
+{
+	struct pmc_op_pmcadmin ssa;
+
+	ssa.pm_cpu = cpu;
+	ssa.pm_pmc = pmc;
+	ssa.pm_state = PMC_STATE_DISABLED;
+	return PMC_CALL(PMCADMIN, &ssa);
+}
+
+int
+pmc_enable(int cpu, int pmc)
+{
+	struct pmc_op_pmcadmin ssa;
+
+	ssa.pm_cpu = cpu;
+	ssa.pm_pmc = pmc;
+	ssa.pm_state = PMC_STATE_FREE;
+	return PMC_CALL(PMCADMIN, &ssa);
+}
+
+/*
+ * Return a list of events known to a given PMC class.  'cl' is the
+ * PMC class identifier, 'eventnames' is the returned list of 'const
+ * char *' pointers pointing to the names of the events. 'nevents' is
+ * the number of event name pointers returned.
+ *
+ * The space for 'eventnames' is allocated using malloc(3).  The caller
+ * is responsible for freeing this space when done.
+ */
+
+int
+pmc_event_names_of_class(enum pmc_class cl, const char ***eventnames,
+    int *nevents)
+{
+	int count;
+	const char **names;
+	const struct pmc_event_descr *ev;
+
+	switch (cl)
+	{
+	case PMC_CLASS_TSC:
+		ev = &pmc_event_table[PMC_EV_TSC_TSC];
+		count = 1;
+		break;
+	case PMC_CLASS_K7:
+		ev = &pmc_event_table[PMC_EV_K7_FIRST];
+		count = PMC_EV_K7_LAST - PMC_EV_K7_FIRST + 1;
+		break;
+	case PMC_CLASS_K8:
+		ev = &pmc_event_table[PMC_EV_K8_FIRST];
+		count = PMC_EV_K8_LAST - PMC_EV_K8_FIRST + 1;
+		break;
+	case PMC_CLASS_P5:
+		ev = &pmc_event_table[PMC_EV_P5_FIRST];
+		count = PMC_EV_P5_LAST - PMC_EV_P5_FIRST + 1;
+		break;
+	case PMC_CLASS_P6:
+		ev = &pmc_event_table[PMC_EV_P6_FIRST];
+		count = PMC_EV_P6_LAST - PMC_EV_P6_FIRST + 1;
+		break;
+	case PMC_CLASS_P4:
+		ev = &pmc_event_table[PMC_EV_P4_FIRST];
+		count = PMC_EV_P4_LAST - PMC_EV_P4_FIRST + 1;
+		break;
+	default:
+		errno = EINVAL;
+		return -1;
+	}
+
+	if ((names = malloc(count * sizeof(const char *))) == NULL)
+		return -1;
+
+	*eventnames = names;
+	*nevents = count;
+
+	for (;count--; ev++, names++)
+		*names = ev->pm_ev_name;
+	return 0;
+}
+
+int
+pmc_flush_logfile(void)
+{
+	return PMC_CALL(FLUSHLOG,0);
+}
+
+int
+pmc_get_driver_stats(struct pmc_driverstats *ds)
+{
+	struct pmc_op_getdriverstats gms;
+
+	if (PMC_CALL(GETDRIVERSTATS, &gms) < 0)
+		return -1;
+
+	/* copy out fields in the current userland<->library interface */
+	ds->pm_intr_ignored    = gms.pm_intr_ignored;
+	ds->pm_intr_processed  = gms.pm_intr_processed;
+	ds->pm_intr_bufferfull = gms.pm_intr_bufferfull;
+	ds->pm_syscalls        = gms.pm_syscalls;
+	ds->pm_syscall_errors  = gms.pm_syscall_errors;
+	ds->pm_buffer_requests = gms.pm_buffer_requests;
+	ds->pm_buffer_requests_failed = gms.pm_buffer_requests_failed;
+	ds->pm_log_sweeps      = gms.pm_log_sweeps;
+
+	return 0;
+}
+
+int
+pmc_get_msr(pmc_id_t pmc, uint32_t *msr)
+{
+	struct pmc_op_getmsr gm;
+
+	gm.pm_pmcid = pmc;
+	if (PMC_CALL(PMCGETMSR, &gm) < 0)
+		return -1;
+	*msr = gm.pm_msr;
+	return 0;
+}
+
+int
+pmc_init(void)
+{
+	int error, pmc_mod_id;
+	unsigned int n;
+	uint32_t abi_version;
+	struct module_stat pmc_modstat;
+	struct pmc_op_getcpuinfo op_cpu_info;
+
+	if (pmc_syscall != -1) /* already inited */
+		return 0;
+
+	/* retrieve the system call number from the KLD */
+	if ((pmc_mod_id = modfind(PMC_MODULE_NAME)) < 0)
+		return -1;
+
+	pmc_modstat.version = sizeof(struct module_stat);
+	if ((error = modstat(pmc_mod_id, &pmc_modstat)) < 0)
+		return -1;
+
+	pmc_syscall = pmc_modstat.data.intval;
+
+	/* check the kernel module's ABI against our compiled-in version */
+	abi_version = PMC_VERSION;
+	if (PMC_CALL(GETMODULEVERSION, &abi_version) < 0)
+		return (pmc_syscall = -1);
+
+	/* ignore patch & minor numbers for the comparision */
+	if ((abi_version & 0xFF000000) != (PMC_VERSION & 0xFF000000)) {
+		errno  = EPROGMISMATCH;
+		return (pmc_syscall = -1);
+	}
+
+	if (PMC_CALL(GETCPUINFO, &op_cpu_info) < 0)
+		return (pmc_syscall = -1);
+
+	cpu_info.pm_cputype = op_cpu_info.pm_cputype;
+	cpu_info.pm_ncpu    = op_cpu_info.pm_ncpu;
+	cpu_info.pm_npmc    = op_cpu_info.pm_npmc;
+	cpu_info.pm_nclass  = op_cpu_info.pm_nclass;
+	for (n = 0; n < cpu_info.pm_nclass; n++)
+		cpu_info.pm_classes[n] = op_cpu_info.pm_classes[n];
+
+	/* set parser pointer */
+	switch (cpu_info.pm_cputype) {
+#if defined(__i386__)
+	case PMC_CPU_AMD_K7:
+		pmc_mdep_event_aliases = k7_aliases;
+		pmc_mdep_allocate_pmc = k7_allocate_pmc;
+		break;
+	case PMC_CPU_INTEL_P5:
+		pmc_mdep_event_aliases = p5_aliases;
+		pmc_mdep_allocate_pmc = p5_allocate_pmc;
+		break;
+	case PMC_CPU_INTEL_P6:		/* P6 ... Pentium M CPUs have */
+	case PMC_CPU_INTEL_PII:		/* similar PMCs. */
+	case PMC_CPU_INTEL_PIII:
+	case PMC_CPU_INTEL_PM:
+		pmc_mdep_event_aliases = p6_aliases;
+		pmc_mdep_allocate_pmc = p6_allocate_pmc;
+		break;
+#endif
+#if defined(__amd64__) || defined(__i386__)
+	case PMC_CPU_INTEL_PIV:
+		pmc_mdep_event_aliases = p4_aliases;
+		pmc_mdep_allocate_pmc = p4_allocate_pmc;
+		break;
+	case PMC_CPU_AMD_K8:
+		pmc_mdep_event_aliases = k8_aliases;
+		pmc_mdep_allocate_pmc = k8_allocate_pmc;
+		break;
+#endif
+
+	default:
+		/*
+		 * Some kind of CPU this version of the library knows nothing
+		 * about.  This shouldn't happen since the abi version check
+		 * should have caught this.
+		 */
+		errno = ENXIO;
+		return (pmc_syscall = -1);
+	}
+
+	return 0;
+}
+
+const char *
+pmc_name_of_capability(enum pmc_caps cap)
+{
+	int i;
+
+	/*
+	 * 'cap' should have a single bit set and should be in
+	 * range.
+	 */
+
+	if ((cap & (cap - 1)) || cap < PMC_CAP_FIRST ||
+	    cap > PMC_CAP_LAST) {
+		errno = EINVAL;
+		return NULL;
+	}
+
+	i = ffs(cap);
+
+	return pmc_capability_names[i - 1];
+}
+
+const char *
+pmc_name_of_class(enum pmc_class pc)
+{
+	if ((int) pc >= PMC_CLASS_FIRST &&
+	    pc <= PMC_CLASS_LAST)
+		return pmc_class_names[pc];
+
+	errno = EINVAL;
+	return NULL;
+}
+
+const char *
+pmc_name_of_cputype(enum pmc_cputype cp)
+{
+	if ((int) cp >= PMC_CPU_FIRST &&
+	    cp <= PMC_CPU_LAST)
+		return pmc_cputype_names[cp];
+	errno = EINVAL;
+	return NULL;
+}
+
+const char *
+pmc_name_of_disposition(enum pmc_disp pd)
+{
+	if ((int) pd >= PMC_DISP_FIRST &&
+	    pd <= PMC_DISP_LAST)
+		return pmc_disposition_names[pd];
+
+	errno = EINVAL;
+	return NULL;
+}
+
+const char *
+pmc_name_of_event(enum pmc_event pe)
+{
+	if ((int) pe >= PMC_EVENT_FIRST &&
+	    pe <= PMC_EVENT_LAST)
+		return pmc_event_table[pe].pm_ev_name;
+
+	errno = EINVAL;
+	return NULL;
+}
+
+const char *
+pmc_name_of_mode(enum pmc_mode pm)
+{
+	if ((int) pm >= PMC_MODE_FIRST &&
+	    pm <= PMC_MODE_LAST)
+		return pmc_mode_names[pm];
+
+	errno = EINVAL;
+	return NULL;
+}
+
+const char *
+pmc_name_of_state(enum pmc_state ps)
+{
+	if ((int) ps >= PMC_STATE_FIRST &&
+	    ps <= PMC_STATE_LAST)
+		return pmc_state_names[ps];
+
+	errno = EINVAL;
+	return NULL;
+}
+
+int
+pmc_ncpu(void)
+{
+	if (pmc_syscall == -1) {
+		errno = ENXIO;
+		return -1;
+	}
+
+	return cpu_info.pm_ncpu;
+}
+
+int
+pmc_npmc(int cpu)
+{
+	if (pmc_syscall == -1) {
+		errno = ENXIO;
+		return -1;
+	}
+
+	if (cpu < 0 || cpu >= (int) cpu_info.pm_ncpu) {
+		errno = EINVAL;
+		return -1;
+	}
+
+	return cpu_info.pm_npmc;
+}
+
+int
+pmc_pmcinfo(int cpu, struct pmc_pmcinfo **ppmci)
+{
+	int nbytes, npmc;
+	struct pmc_op_getpmcinfo *pmci;
+
+	if ((npmc = pmc_npmc(cpu)) < 0)
+		return -1;
+
+	nbytes = sizeof(struct pmc_op_getpmcinfo) +
+	    npmc * sizeof(struct pmc_info);
+
+	if ((pmci = calloc(1, nbytes)) == NULL)
+		return -1;
+
+	pmci->pm_cpu  = cpu;
+
+	if (PMC_CALL(GETPMCINFO, pmci) < 0) {
+		free(pmci);
+		return -1;
+	}
+
+	/* kernel<->library, library<->userland interfaces are identical */
+	*ppmci = (struct pmc_pmcinfo *) pmci;
+
+	return 0;
+}
+
+int
+pmc_read(pmc_id_t pmc, pmc_value_t *value)
+{
+	struct pmc_op_pmcrw pmc_read_op;
+
+	pmc_read_op.pm_pmcid = pmc;
+	pmc_read_op.pm_flags = PMC_F_OLDVALUE;
+	pmc_read_op.pm_value = -1;
+
+	if (PMC_CALL(PMCRW, &pmc_read_op) < 0)
+		return -1;
+
+	*value = pmc_read_op.pm_value;
+
+	return 0;
+}
+
+int
+pmc_release(pmc_id_t pmc)
+{
+	struct pmc_op_simple	pmc_release_args;
+
+	pmc_release_args.pm_pmcid = pmc;
+
+	return PMC_CALL(PMCRELEASE, &pmc_release_args);
+}
+
+int
+pmc_rw(pmc_id_t pmc, pmc_value_t newvalue, pmc_value_t *oldvaluep)
+{
+	struct pmc_op_pmcrw pmc_rw_op;
+
+	pmc_rw_op.pm_pmcid = pmc;
+	pmc_rw_op.pm_flags = PMC_F_NEWVALUE | PMC_F_OLDVALUE;
+	pmc_rw_op.pm_value = newvalue;
+
+	if (PMC_CALL(PMCRW, &pmc_rw_op) < 0)
+		return -1;
+
+	*oldvaluep = pmc_rw_op.pm_value;
+
+	return 0;
+}
+
+int
+pmc_set(pmc_id_t pmc, pmc_value_t value)
+{
+	struct pmc_op_pmcsetcount sc;
+
+	sc.pm_pmcid = pmc;
+	sc.pm_count = value;
+
+	if (PMC_CALL(PMCSETCOUNT, &sc) < 0)
+		return -1;
+
+	return 0;
+
+}
+
+int
+pmc_start(pmc_id_t pmc)
+{
+	struct pmc_op_simple	pmc_start_args;
+
+	pmc_start_args.pm_pmcid = pmc;
+	return PMC_CALL(PMCSTART, &pmc_start_args);
+}
+
+int
+pmc_stop(pmc_id_t pmc)
+{
+	struct pmc_op_simple	pmc_stop_args;
+
+	pmc_stop_args.pm_pmcid = pmc;
+	return PMC_CALL(PMCSTOP, &pmc_stop_args);
+}
+
+int
+pmc_width(pmc_id_t pmcid, uint32_t *width)
+{
+	unsigned int i;
+	enum pmc_class cl;
+
+	cl = PMC_ID_TO_CLASS(pmcid);
+	for (i = 0; i < cpu_info.pm_nclass; i++)
+		if (cpu_info.pm_classes[i].pm_class == cl) {
+			*width = cpu_info.pm_classes[i].pm_width;
+			return 0;
+		}
+	return EINVAL;
+}
+
+int
+pmc_write(pmc_id_t pmc, pmc_value_t value)
+{
+	struct pmc_op_pmcrw pmc_write_op;
+
+	pmc_write_op.pm_pmcid = pmc;
+	pmc_write_op.pm_flags = PMC_F_NEWVALUE;
+	pmc_write_op.pm_value = value;
+
+	return PMC_CALL(PMCRW, &pmc_write_op);
+}
+
+int
+pmc_writelog(uint32_t userdata)
+{
+	struct pmc_op_writelog wl;
+
+	wl.pm_userdata = userdata;
+	return PMC_CALL(WRITELOG, &wl);
+}
diff --git a/lib/libpmc/pmc.3 b/lib/libpmc/pmc.3
new file mode 100644
index 0000000..e580496
--- /dev/null
+++ b/lib/libpmc/pmc.3
@@ -0,0 +1,3426 @@
+.\" Copyright (c) 2003-2006 Joseph Koshy.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\"
+.\" This software is provided by Joseph Koshy ``as is'' and
+.\" any express or implied warranties, including, but not limited to, the
+.\" implied warranties of merchantability and fitness for a particular purpose
+.\" are disclaimed.  in no event shall Joseph Koshy be liable
+.\" for any direct, indirect, incidental, special, exemplary, or consequential
+.\" damages (including, but not limited to, procurement of substitute goods
+.\" or services; loss of use, data, or profits; or business interruption)
+.\" however caused and on any theory of liability, whether in contract, strict
+.\" liability, or tort (including negligence or otherwise) arising in any way
+.\" out of the use of this software, even if advised of the possibility of
+.\" such damage.
+.\"
+.\" $FreeBSD: src/lib/libpmc/pmc.3,v 1.13 2007-04-12 09:16:54 jkoshy Exp $
+.\"
+.Dd February 25, 2006
+.Os
+.Dt PMC 3
+.Sh NAME
+.Nm pmc_allocate ,
+.Nm pmc_attach ,
+.Nm pmc_capabilities ,
+.Nm pmc_configure_logfile ,
+.Nm pmc_cpuinfo ,
+.Nm pmc_detach ,
+.Nm pmc_disable ,
+.Nm pmc_enable ,
+.Nm pmc_event_names_of_class ,
+.Nm pmc_flush_logfile ,
+.Nm pmc_get_driver_stats ,
+.Nm pmc_get_msr ,
+.Nm pmc_init ,
+.Nm pmc_name_of_capability ,
+.Nm pmc_name_of_class ,
+.Nm pmc_name_of_cputype ,
+.Nm pmc_name_of_event ,
+.Nm pmc_name_of_mode ,
+.Nm pmc_name_of_state ,
+.Nm pmc_ncpu ,
+.Nm pmc_npmc ,
+.Nm pmc_pmcinfo ,
+.Nm pmc_read ,
+.Nm pmc_release ,
+.Nm pmc_rw ,
+.Nm pmc_set ,
+.Nm pmc_start ,
+.Nm pmc_stop ,
+.Nm pmc_width ,
+.Nm pmc_write ,
+.Nm pmc_writelog
+.Nd programming API for using hardware performance monitoring counters
+.Sh LIBRARY
+.Lb libpmc
+.Sh SYNOPSIS
+.In pmc.h
+.Ft int
+.Fo pmc_allocate
+.Fa "const char *eventspecifier"
+.Fa "enum pmc_mode mode"
+.Fa "uint32_t flags"
+.Fa "int cpu"
+.Fa "pmc_id_t *pmcid"
+.Fc
+.Ft int
+.Fn pmc_attach "pmc_id_t pmcid" "pid_t pid"
+.Ft int
+.Fn pmc_capabilities "pmc_id_t pmc" "uint32_t *caps"
+.Ft int
+.Fn pmc_configure_logfile "int fd"
+.Ft int
+.Fn pmc_cpuinfo "const struct pmc_cpuinfo **cpu_info"
+.Ft int
+.Fn pmc_detach "pmc_id_t pmcid" "pid_t pid"
+.Ft int
+.Fn pmc_disable "int cpu" "int pmc"
+.Ft int
+.Fn pmc_enable "int cpu" "int pmc"
+.Ft int
+.Fo pmc_event_names_of_class
+.Fa "enum pmc_class cl"
+.Fa "const char ***eventnames"
+.Fa "int *nevents"
+.Fc
+.Ft int
+.Fn pmc_flush_logfile void
+.Ft int
+.Fn pmc_get_driver_stats "struct pmc_driverstats *gms"
+.Ft int
+.Fn pmc_get_msr "pmc_id_t pmc" "uint32_t *msr"
+.Ft int
+.Fn pmc_init void
+.Ft "const char *"
+.Fn pmc_name_of_capability "enum pmc_caps pc"
+.Ft "const char *"
+.Fn pmc_name_of_class "enum pmc_class pc"
+.Ft "const char *"
+.Fn pmc_name_of_cputype "enum pmc_cputype ct"
+.Ft "const char *"
+.Fn pmc_name_of_disposition "enum pmc_disp pd"
+.Ft "const char *"
+.Fn pmc_name_of_event "enum pmc_event pe"
+.Ft "const char *"
+.Fn pmc_name_of_mode "enum pmc_mode pm"
+.Ft "const char *"
+.Fn pmc_name_of_state "enum pmc_state ps"
+.Ft int
+.Fn pmc_ncpu void
+.Ft int
+.Fn pmc_npmc "int cpu"
+.Ft int
+.Fn pmc_pmcinfo "int cpu" "struct pmc_pmcinfo **pmc_info"
+.Ft int
+.Fn pmc_read "pmc_id_t pmc" "pmc_value_t *value"
+.Ft int
+.Fn pmc_release "pmc_id_t pmc"
+.Ft int
+.Fn pmc_rw "pmc_id_t pmc" "pmc_value_t newvalue" "pmc_value_t *oldvaluep"
+.Ft int
+.Fn pmc_set "pmc_id_t pmc" "pmc_value_t value"
+.Ft int
+.Fn pmc_start "pmc_id_t pmc"
+.Ft int
+.Fn pmc_stop "pmc_id_t pmc"
+.Ft int
+.Fn pmc_write "pmc_id_t pmc" "pmc_value_t value"
+.Ft int
+.Fn pmc_writelog "uint32_t userdata"
+.Ft int
+.Fn pmc_width "pmc_id_t pmc" "uint32_t *width"
+.Sh DESCRIPTION
+These functions implement a high-level library for using the
+system's hardware performance counters.
+.Pp
+PMCs are allocated using
+.Fn pmc_allocate ,
+released using
+.Fn pmc_release
+and read using
+.Fn pmc_read .
+Allocated PMCs may be started or stopped at any time using
+.Fn pmc_start
+and
+.Fn pmc_stop
+respectively.
+An allocated PMC may be of
+.Dq global
+scope, meaning that the PMC measures system-wide events, or
+.Dq process-private
+scope, meaning that the PMC only counts hardware events when
+the allocating process (or, optionally, its children)
+are active.
+.Pp
+PMCs may further be in
+.Dq "counting mode" ,
+or in
+.Dq "sampling mode" .
+Sampling mode PMCs deliver an interrupt to the CPU after
+a configured number of hardware events have been seen.
+A process-private sampling mode PMC will cause its owner
+process to get periodic
+.Dv SIGPROF
+interrupts, while a global sampling mode PMC is used to
+do system-wide statistical sampling (see
+.Xr hwpmc 4 ) .
+The sampling rate desired of a sampling-mode PMC is set using
+.Fn pmc_set .
+Counting mode PMCs do not interrupt the CPU; their values
+can be read using
+.Fn pmc_read .
+.Pp
+System-wide statistical sampling is configured by allocating
+at least one sampling mode PMC with
+global scope, and when a log file is configured using
+.Fn pmc_configure_logfile .
+The
+.Xr hwpmc 4
+driver manages system-wide statistical sampling; for more
+information please see
+.Xr hwpmc 4 .
+.Ss Application Programming Interface
+The function
+.Fn pmc_init
+initializes the
+.Nm pmc
+library.
+This function must be called first, before any of the other
+functions in the library.
+.Pp
+The function
+.Fn pmc_allocate
+allocates a counter that counts the events named by
+.Fa eventspecifier ,
+and writes the allocated counter ID to
+.Fa *pmcid .
+Argument
+.Fa eventspecifier
+comprises an PMC event name followed by an optional comma separated
+list of keywords and qualifiers.
+The allowed syntax for
+.Fa eventspecifier
+is processor architecture specific and is listed in section
+.Sx "EVENT SPECIFIERS"
+below.
+The desired PMC mode is specified by
+.Fa mode ,
+and any mode specific modifiers are specified using
+.Fa flags .
+The
+.Fa cpu
+argument is the value
+.Dv PMC_CPU_ANY ,
+or names the CPU the allocation is to be on.
+Requesting a specific CPU only makes sense for global PMCs;
+process-private PMC allocations should always specify
+.Dv PMC_CPU_ANY .
+.Pp
+By default, a PMC configured in process-virtual counting mode is set up
+to profile its owner process.
+The function
+.Fn pmc_attach
+may be used to attach the PMC to a different process.
+It
+needs to be called before the counter is first started
+with
+.Fn pmc_start .
+The function
+.Fn pmc_detach
+may be used to detach a PMC from a process it was attached to
+using a prior call to
+.Fn pmc_attach .
+.Pp
+The function
+.Fn pmc_release
+releases a PMC previously allocated with
+.Fn pmc_allocate .
+This function call implicitly detaches the PMC from all its target
+processes.
+.Pp
+An allocated PMC may be started and stopped using
+.Fn pmc_start
+and
+.Fn pmc_stop
+respectively.
+.Pp
+The current value of a PMC may be read with
+.Fn pmc_read
+and written using
+.Fn pmc_write ,
+provided the underlying hardware supports these operations on
+the allocated PMC.
+The read and write operation may be combined using
+.Fn pmc_rw .
+.Pp
+The function
+.Fn pmc_capabilities
+sets argument
+.Fa caps
+to a bitmask of capabilities supported by the PMC denoted by
+argument
+.Fa pmc .
+The function
+.Fn pmc_width
+sets argument
+.Fa width
+to the width of the PMC denoted by argument
+.Fa pmc .
+.Pp
+The
+.Fn pmc_configure_logfile
+function causes the
+.Xr hwpmc 4
+driver to log performance data to file corresponding
+to the process' file handle
+.Fa fd .
+If argument
+.Fa fd
+is \-1, then any previously configured logging is reset
+and all data queued to be written are discarded.
+.Pp
+The
+.Fn pmc_flush_logfile
+function will send all data queued inside the
+.Xr hwpmc 4
+driver to the configured log file before returning.
+The
+.Fn pmc_writelog
+function will append a log entry containing the argument
+.Fa userdata
+to the log file.
+.Pp
+The function
+.Fn pmc_set
+configures a sampling PMC
+.Fa pmc
+to interrupt every
+.Fa value
+events.
+For counting PMCs,
+.Fn pmc_set
+sets the initial value of the PMC to
+.Fa value .
+.Pp
+The function
+.Fn pmc_get_driver_statistics
+copies a snapshot of the usage statistics maintained by
+.Xr hwpmc 4
+into the memory area pointed to by argument
+.Fa gms .
+.Ss Signal Handling Requirements
+Applications using PMCs are required to handle the following signals:
+.Bl -tag -width indent
+.It Dv SIGBUS
+When the
+.Xr hwpmc 4
+module is unloaded using
+.Xr kldunload 8 ,
+processes that have PMCs allocated to them will be sent a
+.Dv SIGBUS
+signal.
+.It Dv SIGIO
+The
+.Xr hwpmc 4
+driver will send a PMC owning process a
+.Dv SIGIO
+signal if:
+.Bl -bullet
+.It
+If any process-mode PMC allocated by it loses all its
+target processes.
+.It
+If the driver encounters an error when writing log data to a
+configured log file.
+This error may be retrieved by a subsequent call to
+.Fn pmc_flush_logfile .
+.El
+.El
+.Ss Convenience Functions
+The function
+.Fn pmc_ncpu
+returns the number of CPUs present in the system.
+.Pp
+The function
+.Fn pmc_npmc
+returns the number of PMCs supported on CPU
+.Fa cpu .
+The function
+.Fn pmc_cpuinfo
+sets argument
+.Fa cpu_info
+to point to an internal structure with information about the system's CPUs.
+The caller should not
+.Fn free
+this pointer value.
+Function
+.Fn pmc_pmcinfo
+returns information about the current state of CPU
+.Fa cpu Ns 's
+PMCs.
+This function sets argument
+.Fa *pmc_info
+to point to a memory area allocated with
+.Xr calloc 3 .
+The caller is expected to
+.Fn free
+the area when done.
+.Pp
+The functions
+.Fn pmc_name_of_capability ,
+.Fn pmc_name_of_class ,
+.Fn pmc_name_of_cputype ,
+.Fn pmc_name_of_disposition ,
+.Fn pmc_name_of_event ,
+.Fn pmc_name_of_mode
+and
+.Fn pmc_name_of_state
+are useful for code wanting to print error messages.
+They return
+.Vt "const char *"
+pointers to human-readable representations of their arguments.
+These return values should not be freed using
+.Xr free 3 .
+.Pp
+The function
+.Fn pmc_event_names_of_class
+returns a list of event names supported by a given PMC class
+.Fa cl .
+On successful return, an array of
+.Vt "const char *"
+pointers to the names of valid events supported by class
+.Fa cl
+is allocated by the library using
+.Xr malloc 3 ,
+and a pointer to this array is returned in the location pointed to by
+.Fa eventnames .
+The number of pointers allocated is returned in the location pointed
+to by
+.Fa nevents .
+.Ss Administration
+Individual PMCs may be enabled or disabled on a given CPU using
+.Fn pmc_enable
+and
+.Fn pmc_disable
+respectively.
+For these functions,
+.Fa cpu
+is the CPU number, and
+.Fa pmc
+is the index of the PMC to be operated on.
+Only the super-user is allowed to enable and disable PMCs.
+.Ss x86 Architecture Specific API
+The
+.Fn pmc_get_msr
+function returns the processor model specific register number
+associated with
+.Fa pmc .
+Applications may use the x86
+.Ic RDPMC
+instruction to directly read the contents of the PMC.
+.Sh EVENT SPECIFIERS
+Event specifiers are strings comprising of an event name, followed by
+optional parameters modifying the semantics of the hardware event
+being probed.
+Event names are PMC architecture dependent, but the
+.Xr hwpmc 4
+library defines machine independent aliases for commonly used
+events.
+.Ss Event Name Aliases
+Event name aliases are CPU architecture independent names for commonly
+used events.
+The following aliases are known to this version of the
+.Nm pmc
+library:
+.Bl -tag -width indent
+.It Li branches
+Measure the number of branches retired.
+.It Li branch-mispredicts
+Measure the number of retired branches that were mispredicted.
+.It Li cycles
+Measure processor cycles.
+This event is implemented using the processor's Time Stamp Counter
+register.
+.It Li dc-misses
+Measure the number of data cache misses.
+.It Li ic-misses
+Measure the number of instruction cache misses.
+.It Li instructions
+Measure the number of instructions retired.
+.It Li interrupts
+Measure the number of interrupts seen.
+.It Li unhalted-cycles
+Measure the number of cycles the processor is not in a halted
+or sleep state.
+.El
+.Ss Time Stamp Counter (TSC)
+The timestamp counter is a monotonically non-decreasing counter that
+counts processor cycles.
+.Pp
+In the i386 architecture, this counter may
+be selected by requesting an event with event specifier
+.Dq Li tsc .
+The
+.Dq Li tsc
+event does not support any further qualifiers.
+It can only be allocated in system-wide counting mode,
+and is a read-only counter.
+Multiple processes are allowed to allocate the TSC.
+Once allocated, it may be read using the
+.Fn pmc_read
+function, or by using the RDTSC instruction.
+.Ss AMD (K7) PMCs
+These PMCs are present in the
+.Tn "AMD Athlon"
+series of CPUs and are documented in:
+.Rs
+.%B "AMD Athlon Processor x86 Code Optimization Guide"
+.%N "Publication No. 22007"
+.%D "February 2002"
+.%Q "Advanced Micro Devices, Inc."
+.Re
+.Pp
+Event specifiers for AMD K7 PMCs can have the following optional
+qualifiers:
+.Bl -tag -width indent
+.It Li count= Ns Ar value
+Configure the counter to increment only if the number of configured
+events measured in a cycle is greater than or equal to
+.Ar value .
+.It Li edge
+Configure the counter to only count negated-to-asserted transitions
+of the conditions expressed by the other qualifiers.
+In other words, the counter will increment only once whenever a given
+condition becomes true, irrespective of the number of clocks during
+which the condition remains true.
+.It Li inv
+Invert the sense of comparision when the
+.Dq Li count
+qualifier is present, making the counter to increment when the
+number of events per cycle is less than the value specified by
+the
+.Dq Li count
+qualifier.
+.It Li os
+Configure the PMC to count events happening at privilege level 0.
+.It Li unitmask= Ns Ar mask
+This qualifier is used to further qualify a select few events,
+.Dq Li k7-dc-refills-from-l2 ,
+.Dq Li k7-dc-refills-from-system
+and
+.Dq Li k7-dc-writebacks .
+Here
+.Ar mask
+is a string of the following characters optionally separated by
+.Ql +
+characters:
+.Pp
+.Bl -tag -width indent -compact
+.It Li m
+Count operations for lines in the
+.Dq Modified
+state.
+.It Li o
+Count operations for lines in the
+.Dq Owner
+state.
+.It Li e
+Count operations for lines in the
+.Dq Exclusive
+state.
+.It Li s
+Count operations for lines in the
+.Dq Shared
+state.
+.It Li i
+Count operations for lines in the
+.Dq Invalid
+state.
+.El
+.Pp
+If no
+.Dq Li unitmask
+qualifier is specified, the default is to count events for caches
+lines in any of the above states.
+.It Li usr
+Configure the PMC to count events occurring at privilege levels 1, 2
+or 3.
+.El
+.Pp
+If neither of the
+.Dq Li os
+or
+.Dq Li usr
+qualifiers were specified, the default is to enable both.
+.Pp
+The event specifiers supported on AMD K7 PMCs are:
+.Bl -tag -width indent
+.It Li k7-dc-accesses
+Count data cache accesses.
+.It Li k7-dc-misses
+Count data cache misses.
+.It Li k7-dc-refills-from-l2 Op Li ,unitmask= Ns Ar mask
+Count data cache refills from L2 cache.
+This event may be further qualified using the
+.Dq Li unitmask
+qualifier.
+.It Li k7-dc-refills-from-system Op Li ,unitmask= Ns Ar mask
+Count data cache refills from system memory.
+This event may be further qualified using the
+.Dq Li unitmask
+qualifier.
+.It Li k7-dc-writebacks Op Li ,unitmask= Ns Ar mask
+Count data cache writebacks.
+This event may be further qualified using the
+.Dq Li unitmask
+qualifier.
+.It Li k7-l1-dtlb-miss-and-l2-dtlb-hits
+Count L1 DTLB misses and L2 DTLB hits.
+.It Li k7-l1-and-l2-dtlb-misses
+Count L1 and L2 DTLB misses.
+.It Li k7-misaligned-references
+Count misaligned data references.
+.It Li k7-ic-fetches
+Count instruction cache fetches.
+.It Li k7-ic-misses
+Count instruction cache misses.
+.It Li k7-l1-itlb-misses
+Count L1 ITLB misses that are L2 ITLB hits.
+.It Li k7-l1-l2-itlb-misses
+Count L1 (and L2) ITLB misses.
+.It Li k7-retired-instructions
+Count all retired instructions.
+.It Li k7-retired-ops
+Count retired ops.
+.It Li k7-retired-branches
+Count all retired branches (conditional, unconditional, exceptions
+and interrupts).
+.It Li k7-retired-branches-mispredicted
+Count all misprediced retired branches.
+.It Li k7-retired-taken-branches
+Count retired taken branches.
+.It Li k7-retired-taken-branches-mispredicted
+Count mispredicted taken branches that were retired.
+.It Li k7-retired-far-control-transfers
+Count retired far control transfers.
+.It Li k7-retired-resync-branches
+Count retired resync branches (non control transfer branches).
+.It Li k7-interrupts-masked-cycles
+Count the number of cycles when the processor's
+.Va IF
+flag was zero.
+.It Li k7-interrupts-masked-while-pending-cycles
+Count the number of cycles interrupts were masked while pending due
+to the processor's
+.Va IF
+flag being zero.
+.It Li k7-hardware-interrupts
+Count the number of taken hardware interrupts.
+.El
+.Ss AMD (K8) PMCs
+These PMCs are present in the
+.Tn "AMD Athlon64"
+and
+.Tn "AMD Opteron"
+series of CPUs.
+They are documented in:
+.Rs
+.%B "BIOS and Kernel Developer's Guide for the AMD Athlon(tm) 64 and AMD Opteron Processors"
+.%N "Publication No. 26094"
+.%D "April 2004"
+.%Q "Advanced Micro Devices, Inc."
+.Re
+.Pp
+Event specifiers for AMD K8 PMCs can have the following optional
+qualifiers:
+.Bl -tag -width indent
+.It Li count= Ns Ar value
+Configure the counter to increment only if the number of configured
+events measured in a cycle is greater than or equal to
+.Ar value .
+.It Li edge
+Configure the counter to only count negated-to-asserted transitions
+of the conditions expressed by the other fields.
+In other words, the counter will increment only once whenever a given
+condition becomes true, irrespective of the number of clocks during
+which the condition remains true.
+.It Li inv
+Invert the sense of comparision when the
+.Dq Li count
+qualifier is present, making the counter to increment when the
+number of events per cycle is less than the value specified by
+the
+.Dq Li count
+qualifier.
+.It Li mask= Ns Ar qualifier
+Many event specifiers for AMD K8 PMCs need to be additionally
+qualified using a mask qualifier.
+These additional qualifiers are event-specific and are documented
+along with their associated event specifiers below.
+.It Li os
+Configure the PMC to count events happening at privilege level 0.
+.It Li usr
+Configure the PMC to count events occurring at privilege levels 1, 2
+or 3.
+.El
+.Pp
+If neither of the
+.Dq Li os
+or
+.Dq Li usr
+qualifiers were specified, the default is to enable both.
+.Pp
+The event specifiers supported on AMD K8 PMCs are:
+.Bl -tag -width indent
+.It Li k8-bu-cpu-clk-unhalted
+Count the number of clock cycles when the CPU is not in the HLT or
+STPCLK states.
+.It Li k8-bu-fill-request-l2-miss Op Li ,mask= Ns Ar qualifier
+Count fill requests that missed in the L2 cache.
+This event may be further qualified using
+.Ar qualifier ,
+which is a
+.Ql +
+separated set of the following keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li dc-fill
+Count data cache fill requests.
+.It Li ic-fill
+Count instruction cache fill requests.
+.It Li tlb-reload
+Count TLB reloads.
+.El
+.Pp
+The default is to count all types of requests.
+.It Li k8-bu-internal-l2-request Op Li ,mask= Ns Ar qualifier
+Count internally generated requests to the L2 cache.
+This event may be further qualified using
+.Ar qualifier ,
+which is a
+.Ql +
+separated set of the following keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li cancelled
+Count cancelled requests.
+.It Li dc-fill
+Count data cache fill requests.
+.It Li ic-fill
+Count instruction cache fill requests.
+.It Li tag-snoop
+Count tag snoop requests.
+.It Li tlb-reload
+Count TLB reloads.
+.El
+.Pp
+The default is to count all types of requests.
+.It Li k8-dc-access
+Count data cache accesses including microcode scratchpad accesses.
+.It Li k8-dc-copyback Op Li ,mask= Ns Ar qualifier
+Count data cache copyback operations.
+This event may be further qualified using
+.Ar qualifier ,
+which is a
+.Ql +
+separated set of the following keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li exclusive
+Count operations for lines in the
+.Dq exclusive
+state.
+.It Li invalid
+Count operations for lines in the
+.Dq invalid
+state.
+.It Li modified
+Count operations for lines in the
+.Dq modified
+state.
+.It Li owner
+Count operations for lines in the
+.Dq owner
+state.
+.It Li shared
+Count operations for lines in the
+.Dq shared
+state.
+.El
+.Pp
+The default is to count operations for lines in all the
+above states.
+.It Li k8-dc-dcache-accesses-by-locks Op Li ,mask= Ns Ar qualifier
+Count data cache accesses by lock instructions.
+This event is only available on processors of revision C or later
+vintage.
+This event may be further qualified using
+.Ar qualifier ,
+which is a
+.Ql +
+separated set of the following keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li accesses
+Count data cache accesses by lock instructions.
+.It Li misses
+Count data cache misses by lock instructions.
+.El
+.Pp
+The default is to count all accesses.
+.It Li k8-dc-dispatched-prefetch-instructions Op Li ,mask= Ns Ar qualifier
+Count the number of dispatched prefetch instructions.
+This event may be further qualified using
+.Ar qualifier ,
+which is a
+.Ql +
+separated set of the following keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li load
+Count load operations.
+.It Li nta
+Count non-temporal operations.
+.It Li store
+Count store operations.
+.El
+.Pp
+The default is to count all operations.
+.It Li k8-dc-l1-dtlb-miss-and-l2-dtlb-hit
+Count L1 DTLB misses that are L2 DTLB hits.
+.It Li k8-dc-l1-dtlb-miss-and-l2-dtlb-miss
+Count L1 DTLB misses that are also misses in the L2 DTLB.
+.It Li k8-dc-microarchitectural-early-cancel-of-an-access
+Count microarchitectural early cancels of data cache accesses.
+.It Li k8-dc-microarchitectural-late-cancel-of-an-access
+Count microarchitectural late cancels of data cache accesses.
+.It Li k8-dc-misaligned-data-reference
+Count misaligned data references.
+.It Li k8-dc-miss
+Count data cache misses.
+.It Li k8-dc-one-bit-ecc-error Op Li ,mask= Ns Ar qualifier
+Count one bit ECC errors found by the scrubber.
+This event may be further qualified using
+.Ar qualifier ,
+which is a
+.Ql +
+separated set of the following keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li scrubber
+Count scrubber detected errors.
+.It Li piggyback
+Count piggyback scrubber errors.
+.El
+.Pp
+The default is to count both kinds of errors.
+.It Li k8-dc-refill-from-l2 Op Li ,mask= Ns Ar qualifier
+Count data cache refills from L2 cache.
+This event may be further qualified using
+.Ar qualifier ,
+which is a
+.Ql +
+separated set of the following keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li exclusive
+Count operations for lines in the
+.Dq exclusive
+state.
+.It Li invalid
+Count operations for lines in the
+.Dq invalid
+state.
+.It Li modified
+Count operations for lines in the
+.Dq modified
+state.
+.It Li owner
+Count operations for lines in the
+.Dq owner
+state.
+.It Li shared
+Count operations for lines in the
+.Dq shared
+state.
+.El
+.Pp
+The default is to count operations for lines in all the
+above states.
+.It Li k8-dc-refill-from-system Op Li ,mask= Ns Ar qualifier
+Count data cache refills from system memory.
+This event may be further qualified using
+.Ar qualifier ,
+which is a
+.Ql +
+separated set of the following keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li exclusive
+Count operations for lines in the
+.Dq exclusive
+state.
+.It Li invalid
+Count operations for lines in the
+.Dq invalid
+state.
+.It Li modified
+Count operations for lines in the
+.Dq modified
+state.
+.It Li owner
+Count operations for lines in the
+.Dq owner
+state.
+.It Li shared
+Count operations for lines in the
+.Dq shared
+state.
+.El
+.Pp
+The default is to count operations for lines in all the
+above states.
+.It Li k8-fp-dispatched-fpu-ops Op Li ,mask= Ns Ar qualifier
+Count the number of dispatched FPU ops.
+This event is supported in revision B and later CPUs.
+This event may be further qualified using
+.Ar qualifier ,
+which is a
+.Ql +
+separated set of the following keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li add-pipe-excluding-junk-ops
+Count add pipe ops excluding junk ops.
+.It Li add-pipe-junk-ops
+Count junk ops in the add pipe.
+.It Li multiply-pipe-excluding-junk-ops
+Count multiply pipe ops excluding junk ops.
+.It Li multiply-pipe-junk-ops
+Count junk ops in the multiply pipe.
+.It Li store-pipe-excluding-junk-ops
+Count store pipe ops excluding junk ops
+.It Li store-pipe-junk-ops
+Count junk ops in the store pipe.
+.El
+.Pp
+The default is to count all types of ops.
+.It Li k8-fp-cycles-with-no-fpu-ops-retired
+Count cycles when no FPU ops were retired.
+This event is supported in revision B and later CPUs.
+.It Li k8-fp-dispatched-fpu-fast-flag-ops
+Count dispatched FPU ops that use the fast flag interface.
+This event is supported in revision B and later CPUs.
+.It Li k8-fr-decoder-empty
+Count cycles when there was nothing to dispatch (i.e., the decoder
+was empty).
+.It Li k8-fr-dispatch-stalls
+Count all dispatch stalls.
+.It Li k8-fr-dispatch-stall-for-segment-load
+Count dispatch stalls for segment loads.
+.It Li k8-fr-dispatch-stall-for-serialization
+Count dispatch stalls for serialization.
+.It Li k8-fr-dispatch-stall-from-branch-abort-to-retire
+Count dispatch stalls from branch abort to retiral.
+.It Li k8-fr-dispatch-stall-when-fpu-is-full
+Count dispatch stalls when the FPU is full.
+.It Li k8-fr-dispatch-stall-when-ls-is-full
+Count dispatch stalls when the load/store unit is full.
+.It Li k8-fr-dispatch-stall-when-reorder-buffer-is-full
+Count dispatch stalls when the reorder buffer is full.
+.It Li k8-fr-dispatch-stall-when-reservation-stations-are-full
+Count dispatch stalls when reservation stations are full.
+.It Li k8-fr-dispatch-stall-when-waiting-for-all-to-be-quiet
+Count dispatch stalls when waiting for all to be quiet.
+.\" XXX What does "waiting for all to be quiet" mean?
+.It Li k8-fr-dispatch-stall-when-waiting-far-xfer-or-resync-branch-pending
+Count dispatch stalls when a far control transfer or a resync branch
+is pending.
+.It Li k8-fr-fpu-exceptions Op Li ,mask= Ns Ar qualifier
+Count FPU exceptions.
+This event is supported in revision B and later CPUs.
+This event may be further qualified using
+.Ar qualifier ,
+which is a
+.Ql +
+separated set of the following keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li sse-and-x87-microtraps
+Count SSE and x87 microtraps.
+.It Li sse-reclass-microfaults
+Count SSE reclass microfaults
+.It Li sse-retype-microfaults
+Count SSE retype microfaults
+.It Li x87-reclass-microfaults
+Count x87 reclass microfaults.
+.El
+.Pp
+The default is to count all types of exceptions.
+.It Li k8-fr-interrupts-masked-cycles
+Count cycles when interrupts were masked (by CPU RFLAGS field IF was zero).
+.It Li k8-fr-interrupts-masked-while-pending-cycles
+Count cycles while interrupts were masked while pending (i.e., cycles
+when INTR was asserted while CPU RFLAGS field IF was zero).
+.It Li k8-fr-number-of-breakpoints-for-dr0
+Count the number of breakpoints for DR0.
+.It Li k8-fr-number-of-breakpoints-for-dr1
+Count the number of breakpoints for DR1.
+.It Li k8-fr-number-of-breakpoints-for-dr2
+Count the number of breakpoints for DR2.
+.It Li k8-fr-number-of-breakpoints-for-dr3
+Count the number of breakpoints for DR3.
+.It Li k8-fr-retired-branches
+Count retired branches including exceptions and interrupts.
+.It Li k8-fr-retired-branches-mispredicted
+Count mispredicted retired branches.
+.It Li k8-fr-retired-far-control-transfers
+Count retired far control transfers (which are always mispredicted).
+.It Li k8-fr-retired-fastpath-double-op-instructions Op Li ,mask= Ns Ar qualifier
+Count retired fastpath double op instructions.
+This event is supported in revision B and later CPUs.
+This event may be further qualified using
+.Ar qualifier ,
+which is a
+.Ql +
+separated set of the following keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li low-op-pos-0
+Count instructions with the low op in position 0.
+.It Li low-op-pos-1
+Count instructions with the low op in position 1.
+.It Li low-op-pos-2
+Count instructions with the low op in position 2.
+.El
+.Pp
+The default is to count all types of instructions.
+.It Li k8-fr-retired-fpu-instructions Op Li ,mask= Ns Ar qualifier
+Count retired FPU instructions.
+This event is supported in revision B and later CPUs.
+This event may be further qualified using
+.Ar qualifier ,
+which is a
+.Ql +
+separated set of the following keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li mmx-3dnow
+Count MMX and 3DNow!\& instructions.
+.It Li packed-sse-sse2
+Count packed SSE and SSE2 instructions.
+.It Li scalar-sse-sse2
+Count scalar SSE and SSE2 instructions
+.It Li x87
+Count x87 instructions.
+.El
+.Pp
+The default is to count all types of instructions.
+.It Li k8-fr-retired-near-returns
+Count retired near returns.
+.It Li k8-fr-retired-near-returns-mispredicted
+Count mispredicted near returns.
+.It Li k8-fr-retired-resyncs
+Count retired resyncs (non-control transfer branches).
+.It Li k8-fr-retired-taken-hardware-interrupts
+Count retired taken hardware interrupts.
+.It Li k8-fr-retired-taken-branches
+Count retired taken branches.
+.It Li k8-fr-retired-taken-branches-mispredicted
+Count retired taken branches that were mispredicted.
+.It Li k8-fr-retired-taken-branches-mispredicted-by-addr-miscompare
+Count retired taken branches that were mispredicted only due to an
+address miscompare.
+.It Li k8-fr-retired-uops
+Count retired uops.
+.It Li k8-fr-retired-x86-instructions
+Count retired x86 instructions including exceptions and interrupts.
+.It Li k8-ic-fetch
+Count instruction cache fetches.
+.It Li k8-ic-instruction-fetch-stall
+Count cycles in stalls due to instruction fetch.
+.It Li k8-ic-l1-itlb-miss-and-l2-itlb-hit
+Count L1 ITLB misses that are L2 ITLB hits.
+.It Li k8-ic-l1-itlb-miss-and-l2-itlb-miss
+Count ITLB misses that miss in both L1 and L2 ITLBs.
+.It Li k8-ic-microarchitectural-resync-by-snoop
+Count microarchitectural resyncs caused by snoops.
+.It Li k8-ic-miss
+Count instruction cache misses.
+.It Li k8-ic-refill-from-l2
+Count instruction cache refills from L2 cache.
+.It Li k8-ic-refill-from-system
+Count instruction cache refills from system memory.
+.It Li k8-ic-return-stack-hits
+Count hits to the return stack.
+.It Li k8-ic-return-stack-overflow
+Count overflows of the return stack.
+.It Li k8-ls-buffer2-full
+Count load/store buffer2 full events.
+.It Li k8-ls-locked-operation Op Li ,mask= Ns Ar qualifier
+Count locked operations.
+For revision C and later CPUs, the following qualifiers are supported:
+.Pp
+.Bl -tag -width indent -compact
+.It Li cycles-in-request
+Count the number of cycles in the lock request/grant stage.
+.It Li cycles-to-complete
+Count the number of cycles a lock takes to complete once it is
+non-speculative and is the older load/store operation.
+.It Li locked-instructions
+Count the number of lock instructions executed.
+.El
+.Pp
+The default is to count the number of lock instructions executed.
+.It Li k8-ls-microarchitectural-late-cancel
+Count microarchitectural late cancels of operations in the load/store
+unit.
+.It Li k8-ls-microarchitectural-resync-by-self-modifying-code
+Count microarchitectural resyncs caused by self-modifying code.
+.It Li k8-ls-microarchitectural-resync-by-snoop
+Count microarchitectural resyncs caused by snoops.
+.It Li k8-ls-retired-cflush-instructions
+Count retired CFLUSH instructions.
+.It Li k8-ls-retired-cpuid-instructions
+Count retired CPUID instructions.
+.It Li k8-ls-segment-register-load Op Li ,mask= Ns Ar qualifier
+Count segment register loads.
+This event may be further qualified using
+.Ar qualifier ,
+which is a
+.Ql +
+separated set of the following keywords:
+.Bl -tag -width indent -compact
+.It Li cs
+Count CS register loads.
+.It Li ds
+Count DS register loads.
+.It Li es
+Count ES register loads.
+.It Li fs
+Count FS register loads.
+.It Li gs
+Count GS register loads.
+.\" .It Li hs
+.\" Count HS register loads.
+.\" XXX "HS" register?
+.It Li ss
+Count SS register loads.
+.El
+.Pp
+The default is to count all types of loads.
+.It Li k8-nb-memory-controller-bypass-saturation Op Li ,mask= Ns Ar qualifier
+Count memory controller bypass counter saturation events.
+This event may be further qualified using
+.Ar qualifier ,
+which is a
+.Ql +
+separated set of the following keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li dram-controller-interface-bypass
+Count DRAM controller interface bypass.
+.It Li dram-controller-queue-bypass
+Count DRAM controller queue bypass.
+.It Li memory-controller-hi-pri-bypass
+Count memory controller high priority bypasses.
+.It Li memory-controller-lo-pri-bypass
+Count memory controller low priority bypasses.
+.El
+.Pp
+.It Li k8-nb-memory-controller-dram-slots-missed
+Count memory controller DRAM command slots missed (in MemClks).
+.It Li k8-nb-memory-controller-page-access-event Op Li ,mask= Ns Ar qualifier
+Count memory controller page access events.
+This event may be further qualified using
+.Ar qualifier ,
+which is a
+.Ql +
+separated set of the following keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li page-conflict
+Count page conflicts.
+.It Li page-hit
+Count page hits.
+.It Li page-miss
+Count page misses.
+.El
+.Pp
+The default is to count all types of events.
+.It Li k8-nb-memory-controller-page-table-overflow
+Count memory control page table overflow events.
+.It Li k8-nb-probe-result Op Li ,mask= Ns Ar qualifier
+Count probe events.
+This event may be further qualified using
+.Ar qualifier ,
+which is a
+.Ql +
+separated set of the following keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li probe-hit
+Count all probe hits.
+.It Li probe-hit-dirty-no-memory-cancel
+Count probe hits without memory cancels.
+.It Li probe-hit-dirty-with-memory-cancel
+Count probe hits with memory cancels.
+.It Li probe-miss
+Count probe misses.
+.El
+.It Li k8-nb-sized-commands Op Li ,mask= Ns Ar qualifier
+Count sized commands issued.
+This event may be further qualified using
+.Ar qualifier ,
+which is a
+.Ql +
+separated set of the following keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li nonpostwrszbyte
+.It Li nonpostwrszdword
+.It Li postwrszbyte
+.It Li postwrszdword
+.It Li rdszbyte
+.It Li rdszdword
+.It Li rdmodwr
+.El
+.Pp
+The default is to count all types of commands.
+.It Li k8-nb-memory-controller-turnaround Op Li ,mask= Ns Ar qualifier
+Count memory control turnaround events.
+This event may be further qualified using
+.Ar qualifier ,
+which is a
+.Ql +
+separated set of the following keywords:
+.Pp
+.Bl -tag -width indent -compact
+.\" XXX doc is unclear whether these are cycle counts or event counts
+.It Li dimm-turnaround
+Count DIMM turnarounds.
+.It Li read-to-write-turnaround
+Count read to write turnarounds.
+.It Li write-to-read-turnaround
+Count write to read turnarounds.
+.El
+.Pp
+The default is to count all types of events.
+.It Li k8-nb-ht-bus0-bandwidth Op Li ,mask= Ns Ar qualifier
+.It Li k8-nb-ht-bus1-bandwidth Op Li ,mask= Ns Ar qualifier
+.It Li k8-nb-ht-bus2-bandwidth Op Li ,mask= Ns Ar qualifier
+Count events on the HyperTransport(tm) buses.
+These events may be further qualified using
+.Ar qualifier ,
+which is a
+.Ql +
+separated set of the following keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li buffer-release
+Count buffer release messages sent.
+.It Li command
+Count command messages sent.
+.It Li data
+Count data messages sent.
+.It Li nop
+Count nop messages sent.
+.El
+.Pp
+The default is to count all types of messages.
+.El
+.Ss Intel P6 PMCS
+Intel P6 PMCs are present in Intel
+.Tn "Pentium Pro" ,
+.Tn "Pentium II" ,
+.Tn Celeron ,
+.Tn "Pentium III"
+and
+.Tn "Pentium M"
+processors.
+.Pp
+These CPUs have two counters.
+Some events may only be used on specific counters and some events are
+defined only on specific processor models.
+.Pp
+These PMCs are documented in
+.Rs
+.%B "IA-32 Intel(R) Architecture Software Developer's Manual"
+.%T "Volume 3: System Programming Guide"
+.%N "Order Number 245472-012"
+.%D 2003
+.%Q "Intel Corporation"
+.Re
+.Pp
+Some of these events are affected by processor errata described in
+.Rs
+.%B "Intel(R) Pentium(R) III Processor Specification Update"
+.%N "Document Number: 244453-054"
+.%D "April 2005"
+.%Q "Intel Corporation"
+.Re
+.Pp
+Event specifiers for Intel P6 PMCs can have the following common
+qualifiers:
+.Bl -tag -width indent
+.It Li cmask= Ns Ar value
+Configure the PMC to increment only if the number of configured
+events measured in a cycle is greater than or equal to
+.Ar value .
+.It Li edge
+Configure the PMC to count the number of deasserted to asserted
+transitions of the conditions expressed by the other qualifiers.
+If specified, the counter will increment only once whenever a
+condition becomes true, irrespective of the number of clocks during
+which the condition remains true.
+.It Li inv
+Invert the sense of comparision when the
+.Dq Li cmask
+qualifier is present, making the counter increment when the number of
+events per cycle is less than the value specified by the
+.Dq Li cmask
+qualifier.
+.It Li os
+Configure the PMC to count events happening at processor privilege
+level 0.
+.It Li umask= Ns Ar value
+This qualifier is used to further qualify the event selected (see
+below).
+.It Li usr
+Configure the PMC to count events occurring at privilege levels 1, 2
+or 3.
+.El
+.Pp
+If neither of the
+.Dq Li os
+or
+.Dq Li usr
+qualifiers are specified, the default is to enable both.
+.Pp
+The event specifiers supported by Intel P6 PMCs are:
+.Bl -tag -width indent
+.It Li p6-baclears
+Count the number of times a static branch prediction was made by the
+branch decoder because the BTB did not have a prediction.
+.It Li p6-br-bac-missp-exec
+.Pq Tn "Pentium M"
+Count the number of branch instructions executed that where
+mispredicted at the Front End (BAC).
+.It Li p6-br-bogus
+Count the number of bogus branches.
+.It Li p6-br-call-exec
+.Pq Tn "Pentium M"
+Count the number of call instructions executed.
+.It Li p6-br-call-missp-exec
+.Pq Tn "Pentium M"
+Count the number of call instructions executed that were mispredicted.
+.It Li p6-br-cnd-exec
+.Pq Tn "Pentium M"
+Count the number of conditional branch instructions executed.
+.It Li p6-br-cnd-missp-exec
+.Pq Tn "Pentium M"
+Count the number of conditional branch instructions executed that were
+mispredicted.
+.It Li p6-br-ind-call-exec
+.Pq Tn "Pentium M"
+Count the number of indirect call instructions executed.
+.It Li p6-br-ind-exec
+.Pq Tn "Pentium M"
+Count the number of indirect branch instructions executed.
+.It Li p6-br-ind-missp-exec
+.Pq Tn "Pentium M"
+Count the number of indirect branch instructions executed that were
+mispredicted.
+.It Li p6-br-inst-decoded
+Count the number of branch instructions decoded.
+.It Li p6-br-inst-exec
+.Pq Tn "Pentium M"
+Count the number of branch instructions executed but necessarily retired.
+.It Li p6-br-inst-retired
+Count the number of branch instructions retired.
+.It Li p6-br-miss-pred-retired
+Count the number of mispredicted branch instructions retired.
+.It Li p6-br-miss-pred-taken-ret
+Count the number of taken mispredicted branches retired.
+.It Li p6-br-missp-exec
+.Pq Tn "Pentium M"
+Count the number of branch instructions executed that were
+mispredicted at execution.
+.It Li p6-br-ret-bac-missp-exec
+.Pq Tn "Pentium M"
+Count the number of return instructions executed that were
+mispredicted at the Front End (BAC).
+.It Li p6-br-ret-exec
+.Pq Tn "Pentium M"
+Count the number of return instructions executed.
+.It Li p6-br-ret-missp-exec
+.Pq Tn "Pentium M"
+Count the number of return instructions executed that were
+mispredicted at execution.
+.It Li p6-br-taken-retired
+Count the number of taken branches retired.
+.It Li p6-btb-misses
+Count the number of branches for which the BTB did not produce a
+prediction.
+.It Li p6-bus-bnr-drv
+Count the number of bus clock cycles during which this processor is
+driving the BNR# pin.
+.It Li p6-bus-data-rcv
+Count the number of bus clock cycles during which this processor is
+receiving data.
+.It Li p6-bus-drdy-clocks Op Li ,umask= Ns Ar qualifier
+Count the number of clocks during which DRDY# is asserted.
+An additional qualifier may be specified, and comprises one of the
+following keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li any
+Count transactions generated by any agent on the bus.
+.It Li self
+Count transactions generated by this processor.
+.El
+.Pp
+The default is to count operations generated by this processor.
+.It Li p6-bus-hit-drv
+Count the number of bus clock cycles during which this processor is
+driving the HIT# pin.
+.It Li p6-bus-hitm-drv
+Count the number of bus clock cycles during which this processor is
+driving the HITM# pin.
+.It Li p6-bus-lock-clocks Op Li ,umask= Ns Ar qualifier
+Count the number of clocks during with LOCK# is asserted on the
+external system bus.
+An additional qualifier may be specified and comprises one of the following
+keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li any
+Count transactions generated by any agent on the bus.
+.It Li self
+Count transactions generated by this processor.
+.El
+.Pp
+The default is to count operations generated by this processor.
+.It Li p6-bus-req-outstanding
+Count the number of bus requests outstanding in any given cycle.
+.It Li p6-bus-snoop-stall
+Count the number of clock cycles during which the bus is snoop stalled.
+.It Li p6-bus-tran-any Op Li ,umask= Ns Ar qualifier
+Count the number of completed bus transactions of any kind.
+An additional qualifier may be specified and comprises one of the following
+keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li any
+Count transactions generated by any agent on the bus.
+.It Li self
+Count transactions generated by this processor.
+.El
+.Pp
+The default is to count operations generated by this processor.
+.It Li p6-bus-tran-brd Op Li ,umask= Ns Ar qualifier
+Count the number of burst read transactions.
+An additional qualifier may be specified and comprises one of the following
+keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li any
+Count transactions generated by any agent on the bus.
+.It Li self
+Count transactions generated by this processor.
+.El
+.Pp
+The default is to count operations generated by this processor.
+.It Li p6-bus-tran-burst Op Li ,umask= Ns Ar qualifier
+Count the number of completed burst transactions.
+An additional qualifier may be specified and comprises one of the following
+keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li any
+Count transactions generated by any agent on the bus.
+.It Li self
+Count transactions generated by this processor.
+.El
+.Pp
+The default is to count operations generated by this processor.
+.It Li p6-bus-tran-def Op Li ,umask= Ns Ar qualifier
+Count the number of completed deferred transactions.
+An additional qualifier may be specified and comprises one of the following
+keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li any
+Count transactions generated by any agent on the bus.
+.It Li self
+Count transactions generated by this processor.
+.El
+.Pp
+The default is to count operations generated by this processor.
+.It Li p6-bus-tran-ifetch Op Li ,umask= Ns Ar qualifier
+Count the number of completed instruction fetch transactions.
+An additional qualifier may be specified and comprises one of the following
+keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li any
+Count transactions generated by any agent on the bus.
+.It Li self
+Count transactions generated by this processor.
+.El
+.Pp
+The default is to count operations generated by this processor.
+.It Li p6-bus-tran-inval Op Li ,umask= Ns Ar qualifier
+Count the number of completed invalidate transactions.
+An additional qualifier may be specified and comprises one of the following
+keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li any
+Count transactions generated by any agent on the bus.
+.It Li self
+Count transactions generated by this processor.
+.El
+.Pp
+The default is to count operations generated by this processor.
+.It Li p6-bus-tran-mem Op Li ,umask= Ns Ar qualifier
+Count the number of completed memory transactions.
+An additional qualifier may be specified and comprises one of the following
+keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li any
+Count transactions generated by any agent on the bus.
+.It Li self
+Count transactions generated by this processor.
+.El
+.Pp
+The default is to count operations generated by this processor.
+.It Li p6-bus-tran-pwr Op Li ,umask= Ns Ar qualifier
+Count the number of completed partial write transactions.
+An additional qualifier may be specified and comprises one of the following
+keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li any
+Count transactions generated by any agent on the bus.
+.It Li self
+Count transactions generated by this processor.
+.El
+.Pp
+The default is to count operations generated by this processor.
+.It Li p6-bus-tran-rfo Op Li ,umask= Ns Ar qualifier
+Count the number of completed read-for-ownership transactions.
+An additional qualifier may be specified and comprises one of the following
+keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li any
+Count transactions generated by any agent on the bus.
+.It Li self
+Count transactions generated by this processor.
+.El
+.Pp
+The default is to count operations generated by this processor.
+.It Li p6-bus-trans-io Op Li ,umask= Ns Ar qualifier
+Count the number of completed I/O transactions.
+An additional qualifier may be specified and comprises one of the following
+keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li any
+Count transactions generated by any agent on the bus.
+.It Li self
+Count transactions generated by this processor.
+.El
+.Pp
+The default is to count operations generated by this processor.
+.It Li p6-bus-trans-p Op Li ,umask= Ns Ar qualifier
+Count the number of completed partial transactions.
+An additional qualifier may be specified and comprises one of the following
+keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li any
+Count transactions generated by any agent on the bus.
+.It Li self
+Count transactions generated by this processor.
+.El
+.Pp
+The default is to count operations generated by this processor.
+.It Li p6-bus-trans-wb Op Li ,umask= Ns Ar qualifier
+Count the number of completed write-back transactions.
+An additional qualifier may be specified and comprises one of the following
+keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li any
+Count transactions generated by any agent on the bus.
+.It Li self
+Count transactions generated by this processor.
+.El
+.Pp
+The default is to count operations generated by this processor.
+.It Li p6-cpu-clk-unhalted
+Count the number of cycles during with the processor was not halted.
+.Pp
+.Pq Tn "Pentium M"
+Count the number of cycles during with the processor was not halted
+and not in a thermal trip.
+.It Li p6-cycles-div-busy
+Count the number of cycles during which the divider is busy and cannot
+accept new divides.
+This event is only allocated on counter 0.
+.It Li p6-cycles-in-pending-and-masked
+Count the number of processor cycles for which interrupts were
+disabled and interrupts were pending.
+.It Li p6-cycles-int-masked
+Count the number of processor cycles for which interrupts were
+disabled.
+.It Li p6-data-mem-refs
+Count all loads and all stores using any memory type, including
+internal retries.
+Each part of a split store is counted separately.
+.It Li p6-dcu-lines-in
+Count the total lines allocated in the data cache unit.
+.It Li p6-dcu-m-lines-in
+Count the number of M state lines allocated in the data cache unit.
+.It Li p6-dcu-m-lines-out
+Count the number of M state lines evicted from the data cache unit.
+.It Li p6-dcu-miss-outstanding
+Count the weighted number of cycles while a data cache unit miss is
+outstanding, incremented by the number of outstanding cache misses at
+any time.
+.It Li p6-div
+Count the number of integer and floating-point divides including
+speculative divides.
+This event is only allocated on counter 1.
+.It Li p6-emon-esp-uops
+.Pq Tn "Pentium M"
+Count the total number of micro-ops.
+.It Li p6-emon-est-trans Op Li ,umask= Ns Ar qualifier
+.Pq Tn "Pentium M"
+Count the number of
+.Tn "Enhanced Intel SpeedStep"
+transitions.
+An additional qualifier may be specified, and can be one of the
+following keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li all
+Count all transitions.
+.It Li freq
+Count only frequency transitions.
+.El
+.Pp
+The default is to count all transitions.
+.It Li p6-emon-fused-uops-ret Op Li ,umask= Ns Ar qualifier
+.Pq Tn "Pentium M"
+Count the number of retired fused micro-ops.
+An additional qualifier may be specified, and may be one of the
+following keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li all
+Count all fused micro-ops.
+.It Li loadop
+Count only load and op micro-ops.
+.It Li stdsta
+Count only STD/STA micro-ops.
+.El
+.Pp
+The default is to count all fused micro-ops.
+.It Li p6-emon-kni-comp-inst-ret
+.Pq Tn "Pentium III"
+Count the number of SSE computational instructions retired.
+An additional qualifier may be specified, and comprises one of the
+following keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li packed-and-scalar
+Count packed and scalar operations.
+.It Li scalar
+Count scalar operations only.
+.El
+.Pp
+The default is to count packed and scalar operations.
+.It Li p6-emon-kni-inst-retired Op Li ,umask= Ns Ar qualifier
+.Pq Tn "Pentium III"
+Count the number of SSE instructions retired.
+An additional qualifier may be specified, and comprises one of the
+following keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li packed-and-scalar
+Count packed and scalar operations.
+.It Li scalar
+Count scalar operations only.
+.El
+.Pp
+The default is to count packed and scalar operations.
+.It Li p6-emon-kni-pref-dispatched Op Li ,umask= Ns Ar qualifier
+.Pq Tn "Pentium III"
+Count the number of SSE prefetch or weakly ordered instructions
+dispatched (including speculative prefetches).
+An additional qualifier may be specified, and comprises one of the
+following keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li nta
+Count non-temporal prefetches.
+.It Li t1
+Count prefetches to L1.
+.It Li t2
+Count prefetches to L2.
+.It Li wos
+Count weakly ordered stores.
+.El
+.Pp
+The default is to count non-temporal prefetches.
+.It Li p6-emon-kni-pref-miss Op Li ,umask= Ns Ar qualifier
+.Pq Tn "Pentium III"
+Count the number of prefetch or weakly ordered instructions that miss
+all caches.
+An additional qualifier may be specified, and comprises one of the
+following keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li nta
+Count non-temporal prefetches.
+.It Li t1
+Count prefetches to L1.
+.It Li t2
+Count prefetches to L2.
+.It Li wos
+Count weakly ordered stores.
+.El
+.Pp
+The default is to count non-temporal prefetches.
+.It Li p6-emon-pref-rqsts-dn
+.Pq Tn "Pentium M"
+Count the number of downward prefetches issued.
+.It Li p6-emon-pref-rqsts-up
+.Pq Tn "Pentium M"
+Count the number of upward prefetches issued.
+.It Li p6-emon-simd-instr-retired
+.Pq Tn "Pentium M"
+Count the number of retired
+.Tn MMX
+instructions.
+.It Li p6-emon-sse-sse2-comp-inst-retired Op Li ,umask= Ns Ar qualifier
+.Pq Tn "Pentium M"
+Count the number of computational SSE instructions retired.
+An additional qualifier may be specified and can be one of the
+following keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li sse-packed-single
+Count SSE packed-single instructions.
+.It Li sse-scalar-single
+Count SSE scalar-single instructions.
+.It Li sse2-packed-double
+Count SSE2 packed-double instructions.
+.It Li sse2-scalar-double
+Count SSE2 scalar-double instructions.
+.El
+.Pp
+The default is to count SSE packed-single instructions.
+.It Li p6-emon-sse-sse2-inst-retired Op Li ,umask= Ns Ar qualifer
+.Pp
+.Pq Tn "Pentium M"
+Count the number of SSE instructions retired.
+An additional qualifier can be specified, and can be one of the
+following keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li sse-packed-single
+Count SSE packed-single instructions.
+.It Li sse-packed-single-scalar-single
+Count SSE packed-single and scalar-single instructions.
+.It Li sse2-packed-double
+Count SSE2 packed-double instructions.
+.It Li sse2-scalar-double
+Count SSE2 scalar-double instructions.
+.El
+.Pp
+The default is to count SSE packed-single instructions.
+.It Li p6-emon-synch-uops
+.Pq Tn "Pentium M"
+Count the number of sync micro-ops.
+.It Li p6-emon-thermal-trip
+.Pq Tn "Pentium M"
+Count the duration or occurrences of thermal trips.
+Use the
+.Dq Li edge
+qualifier to count occurrences of thermal trips.
+.It Li p6-emon-unfusion
+.Pq Tn "Pentium M"
+Count the number of unfusion events in the reorder buffer.
+.It Li p6-flops
+Count the number of computational floating point operations retired.
+This event is only allocated on counter 0.
+.It Li p6-fp-assist
+Count the number of floating point exceptions handled by microcode.
+This event is only allocated on counter 1.
+.It Li p6-fp-comps-ops-exe
+Count the number of computation floating point operations executed.
+This event is only allocated on counter 0.
+.It Li p6-fp-mmx-trans Op Li ,umask= Ns Ar qualifier
+.Pq Tn "Pentium II" , Tn "Pentium III"
+Count the number of transitions between MMX and floating-point
+instructions.
+An additional qualifier may be specified, and comprises one of the
+following keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li mmxtofp
+Count transitions from MMX instructions to floating-point instructions.
+.It Li fptommx
+Count transitions from floating-point instructions to MMX instructions.
+.El
+.Pp
+The default is to count MMX to floating-point transitions.
+.It Li p6-hw-int-rx
+Count the number of hardware interrupts received.
+.It Li p6-ifu-fetch
+Count the number of instruction fetches, both cacheable and non-cacheable.
+.It Li p6-ifu-fetch-miss
+Count the number of instruction fetch misses (i.e., those that produce
+memory accesses).
+.It Li p6-ifu-mem-stall
+Count the number of cycles instruction fetch is stalled for any reason.
+.It Li p6-ild-stall
+Count the number of cycles the instruction length decoder is stalled.
+.It Li p6-inst-decoded
+Count the number of instructions decoded.
+.It Li p6-inst-retired
+Count the number of instructions retired.
+.It Li p6-itlb-miss
+Count the number of instruction TLB misses.
+.It Li p6-l2-ads
+Count the number of L2 address strobes.
+.It Li p6-l2-dbus-busy
+Count the number of cycles during which the L2 cache data bus was busy.
+.It Li p6-l2-dbus-busy-rd
+Count the number of cycles during which the L2 cache data bus was busy
+transferring read data from L2 to the processor.
+.It Li p6-l2-ifetch Op Li ,umask= Ns Ar qualifier
+Count the number of L2 instruction fetches.
+An additional qualifier may be specified and comprises a list of the following
+keywords separated by
+.Ql +
+characters:
+.Pp
+.Bl -tag -width indent -compact
+.It Li e
+Count operations affecting E (exclusive) state lines.
+.It Li i
+Count operations affecting I (invalid) state lines.
+.It Li m
+Count operations affecting M (modified) state lines.
+.It Li s
+Count operations affecting S (shared) state lines.
+.El
+.Pp
+The default is to count operations affecting all (MESI) state lines.
+.It Li p6-l2-ld Op Li ,umask= Ns Ar qualifier
+Count the number of L2 data loads.
+An additional qualifier may be specified and comprises a list of the following
+keywords separated by
+.Ql +
+characters:
+.Pp
+.Bl -tag -width indent -compact
+.It Li both
+.Pq Tn "Pentium M"
+Count both hardware-prefetched lines and non-hardware-prefetched lines.
+.It Li e
+Count operations affecting E (exclusive) state lines.
+.It Li hw
+.Pq Tn "Pentium M"
+Count hardware-prefetched lines only.
+.It Li i
+Count operations affecting I (invalid) state lines.
+.It Li m
+Count operations affecting M (modified) state lines.
+.It Li nonhw
+.Pq Tn "Pentium M"
+Exclude hardware-prefetched lines.
+.It Li s
+Count operations affecting S (shared) state lines.
+.El
+.Pp
+The default on processors other than
+.Tn "Pentium M"
+processors is to count operations affecting all (MESI) state lines.
+The default on
+.Tn "Pentium M"
+processors is to count both hardware-prefetched and
+non-hardware-prefetch operations on all (MESI) state lines.
+.Pq Errata
+This event is affected by processor errata E53.
+.It Li p6-l2-lines-in Op Li ,umask= Ns Ar qualifier
+Count the number of L2 lines allocated.
+An additional qualifier may be specified and comprises a list of the following
+keywords separated by
+.Ql +
+characters:
+.Pp
+.Bl -tag -width indent -compact
+.It Li both
+.Pq Tn "Pentium M"
+Count both hardware-prefetched lines and non-hardware-prefetched lines.
+.It Li e
+Count operations affecting E (exclusive) state lines.
+.It Li hw
+.Pq Tn "Pentium M"
+Count hardware-prefetched lines only.
+.It Li i
+Count operations affecting I (invalid) state lines.
+.It Li m
+Count operations affecting M (modified) state lines.
+.It Li nonhw
+.Pq Tn "Pentium M"
+Exclude hardware-prefetched lines.
+.It Li s
+Count operations affecting S (shared) state lines.
+.El
+.Pp
+The default on processors other than
+.Tn "Pentium M"
+processors is to count operations affecting all (MESI) state lines.
+The default on
+.Tn "Pentium M"
+processors is to count both hardware-prefetched and
+non-hardware-prefetch operations on all (MESI) state lines.
+.Pq Errata
+This event is affected by processor errata E45.
+.It Li p6-l2-lines-out Op Li ,umask= Ns Ar qualifier
+Count the number of L2 lines evicted.
+An additional qualifier may be specified and comprises a list of the following
+keywords separated by
+.Ql +
+characters:
+.Pp
+.Bl -tag -width indent -compact
+.It Li both
+.Pq Tn "Pentium M"
+Count both hardware-prefetched lines and non-hardware-prefetched lines.
+.It Li e
+Count operations affecting E (exclusive) state lines.
+.It Li hw
+.Pq Tn "Pentium M"
+Count hardware-prefetched lines only.
+.It Li i
+Count operations affecting I (invalid) state lines.
+.It Li m
+Count operations affecting M (modified) state lines.
+.It Li nonhw
+.Pq Tn "Pentium M" only
+Exclude hardware-prefetched lines.
+.It Li s
+Count operations affecting S (shared) state lines.
+.El
+.Pp
+The default on processors other than
+.Tn "Pentium M"
+processors is to count operations affecting all (MESI) state lines.
+The default on
+.Tn "Pentium M"
+processors is to count both hardware-prefetched and
+non-hardware-prefetch operations on all (MESI) state lines.
+.Pq Errata
+This event is affected by processor errata E45.
+.It Li p6-l2-m-lines-inm
+Count the number of modified lines allocated in L2 cache.
+.It Li p6-l2-m-lines-outm Op Li ,umask= Ns Ar qualifier
+Count the number of L2 M-state lines evicted.
+.Pp
+.Pq Tn "Pentium M"
+On these processors an additional qualifier may be specified and
+comprises a list of the following keywords separated by
+.Ql +
+characters:
+.Pp
+.Bl -tag -width indent -compact
+.It Li both
+Count both hardware-prefetched lines and non-hardware-prefetched lines.
+.It Li hw
+Count hardware-prefetched lines only.
+.It Li nonhw
+Exclude hardware-prefetched lines.
+.El
+.Pp
+The default is to count both hardware-prefetched and
+non-hardware-prefetch operations.
+.Pq Errata
+This event is affected by processor errata E53.
+.It Li p6-l2-rqsts Op Li ,umask= Ns Ar qualifier
+Count the total number of L2 requests.
+An additional qualifier may be specified and comprises a list of the following
+keywords separated by
+.Ql +
+characters:
+.Pp
+.Bl -tag -width indent -compact
+.It Li e
+Count operations affecting E (exclusive) state lines.
+.It Li i
+Count operations affecting I (invalid) state lines.
+.It Li m
+Count operations affecting M (modified) state lines.
+.It Li s
+Count operations affecting S (shared) state lines.
+.El
+.Pp
+The default is to count operations affecting all (MESI) state lines.
+.It Li p6-l2-st
+Count the number of L2 data stores.
+An additional qualifier may be specified and comprises a list of the following
+keywords separated by
+.Ql +
+characters:
+.Pp
+.Bl -tag -width indent -compact
+.It Li e
+Count operations affecting E (exclusive) state lines.
+.It Li i
+Count operations affecting I (invalid) state lines.
+.It Li m
+Count operations affecting M (modified) state lines.
+.It Li s
+Count operations affecting S (shared) state lines.
+.El
+.Pp
+The default is to count operations affecting all (MESI) state lines.
+.It Li p6-ld-blocks
+Count the number of load operations delayed due to store buffer blocks.
+.It Li p6-misalign-mem-ref
+Count the number of misaligned data memory references (crossing a 64
+bit boundary).
+.It Li p6-mmx-assist
+.Pq Tn "Pentium II" , Tn "Pentium III"
+Count the number of MMX assists executed.
+.It Li p6-mmx-instr-exec
+.Pq Tn Celeron , Tn "Pentium II"
+Count the number of MMX instructions executed, except MOVQ and MOVD
+stores from register to memory.
+.It Li p6-mmx-instr-ret
+.Pq Tn "Pentium II"
+Count the number of MMX instructions retired.
+.It Li p6-mmx-instr-type-exec Op Li ,umask= Ns Ar qualifier
+.Pq Tn "Pentium II" , Tn "Pentium III"
+Count the number of MMX instructions executed.
+An additional qualifier may be specified and comprises a list of
+the following keywords separated by
+.Ql +
+characters:
+.Pp
+.Bl -tag -width indent -compact
+.It Li pack
+Count MMX pack operation instructions.
+.It Li packed-arithmetic
+Count MMX packed arithmetic instructions.
+.It Li packed-logical
+Count MMX packed logical instructions.
+.It Li packed-multiply
+Count MMX packed multiply instructions.
+.It Li packed-shift
+Count MMX packed shift instructions.
+.It Li unpack
+Count MMX unpack operation instructions.
+.El
+.Pp
+The default is to count all operations.
+.It Li p6-mmx-sat-instr-exec
+.Pq Tn "Pentium II" , Tn "Pentium III"
+Count the number of MMX saturating instructions executed.
+.It Li p6-mmx-uops-exec
+.Pq Tn "Pentium II" , Tn "Pentium III"
+Count the number of MMX micro-ops executed.
+.It Li p6-mul
+Count the number of integer and floating-point multiplies, including
+speculative multiplies.
+This event is only allocated on counter 1.
+.It Li p6-partial-rat-stalls
+Count the number of cycles or events for partial stalls.
+.It Li p6-resource-stalls
+Count the number of cycles there was a resource related stall of any kind.
+.It Li p6-ret-seg-renames
+.Pq Tn "Pentium II" , Tn "Pentium III"
+Count the number of segment register rename events retired.
+.It Li p6-sb-drains
+Count the number of cycles the store buffer is draining.
+.It Li p6-seg-reg-renames Op Li ,umask= Ns Ar qualifier
+.Pq Tn "Pentium II" , Tn "Pentium III"
+Count the number of segment register renames.
+An additional qualifier may be specified, and comprises a list of the
+following keywords separated by
+.Ql +
+characters:
+.Pp
+.Bl -tag -width indent -compact
+.It Li ds
+Count renames for segment register DS.
+.It Li es
+Count renames for segment register ES.
+.It Li fs
+Count renames for segment register FS.
+.It Li gs
+Count renames for segment register GS.
+.El
+.Pp
+The default is to count operations affecting all segment registers.
+.It Li p6-seg-rename-stalls
+.Pq Tn "Pentium II" , Tn "Pentium III"
+Count the number of segment register renaming stalls.
+An additional qualifier may be specified, and comprises a list of the
+following keywords separated by
+.Ql +
+characters:
+.Pp
+.Bl -tag -width indent -compact
+.It Li ds
+Count stalls for segment register DS.
+.It Li es
+Count stalls for segment register ES.
+.It Li fs
+Count stalls for segment register FS.
+.It Li gs
+Count stalls for segment register GS.
+.El
+.Pp
+The default is to count operations affecting all the segment registers.
+.It Li p6-segment-reg-loads
+Count the number of segment register loads.
+.It Li p6-uops-retired
+Count the number of micro-ops retired.
+.El
+.Ss Intel P4 PMCS
+Intel P4 PMCs are present in Intel
+.Tn "Pentium 4"
+and
+.Tn Xeon
+processors.
+These PMCs are documented in
+.Rs
+.%B "IA-32 Intel(R) Architecture Software Developer's Manual"
+.%T "Volume 3: System Programming Guide"
+.%N "Order Number 245472-012"
+.%D 2003
+.%Q "Intel Corporation"
+.Re
+Further information about using these PMCs may be found in
+.Rs
+.%B "IA-32 Intel(R) Architecture Optimization Guide"
+.%D 2003
+.%N "Order Number 248966-009"
+.%Q "Intel Corporation"
+.Re
+Some of these events are affected by processor errata described in
+.Rs
+.%B "Intel(R) Pentium(R) 4 Processor Specification Update"
+.%N "Document Number: 249199-059"
+.%D "April 2005"
+.%Q "Intel Corporation"
+.Re
+.Pp
+Event specifiers for Intel P4 PMCs can have the following common
+qualifiers:
+.Bl -tag -width indent
+.It Li active= Ns Ar choice
+(On P4 HTT CPUs) Filter event counting based on which logical
+processors are active.
+The allowed values of
+.Ar choice
+are:
+.Pp
+.Bl -tag -width indent -compact
+.It Li any
+Count when either logical processor is active.
+.It Li both
+Count when both logical processors are active.
+.It Li none
+Count only when neither logical processor is active.
+.It Li single
+Count only when one logical processor is active.
+.El
+.Pp
+The default is
+.Dq Li both .
+.It Li cascade
+Configure the PMC to cascade onto its partner.
+See
+.Sx "Cascading P4 PMCs"
+below for more information.
+.It Li edge
+Configure the counter to count false to true transitions of the threshold
+comparision output.
+This qualifier only takes effect if a threshold qualifier has also been
+specified.
+.It Li complement
+Configure the counter to increment only when the event count seen is
+less than the threshold qualifier value specified.
+.It Li mask= Ns Ar qualifier
+Many event specifiers for Intel P4 PMCs need to be additionally
+qualified using a mask qualifier.
+The allowed syntax for these qualifiers is event specific and is
+described along with the events.
+.It Li os
+Configure the PMC to count when the CPL of the processor is 0.
+.It Li precise
+Select precise event based sampling.
+Precise sampling is supported by the hardware for a limited set of
+events.
+.It Li tag= Ns Ar value
+Configure the PMC to tag the internal uop selected by the other
+fields in this event specifier with value
+.Ar value .
+This feature is used when cascading PMCs.
+.It Li threshold= Ns Ar value
+Configure the PMC to increment only when the event counts seen are
+greater than the specified threshold value
+.Ar value .
+.It Li usr
+Configure the PMC to count when the CPL of the processor is 1, 2 or 3.
+.El
+.Pp
+If neither of the
+.Dq Li os
+or
+.Dq Li usr
+qualifiers are specified, the default is to enable both.
+.Pp
+On Intel Pentium 4 processors with HTT, events are
+divided into two classes:
+.Pp
+.Bl -tag -width indent -compact
+.It "TS Events"
+are those where hardware can differentiate between events
+generated on one logical processor from those generated on the
+other.
+.It "TI Events"
+are those where hardware cannot differentiate between events
+generated by multiple logical processors in a package.
+.El
+.Pp
+Only TS events are allowed for use with process-mode PMCs on
+Pentium-4/HTT CPUs.
+.Pp
+The event specifiers supported by Intel P4 PMCs are:
+.Pp
+.Bl -tag -width indent
+.It Li p4-128bit-mmx-uop Op Li ,mask= Ns Ar flags
+.Pq "TI event"
+Count integer SIMD SSE2 instructions that operate on 128 bit SIMD
+operands.
+Qualifier
+.Ar flags
+can take the following value (which is also the default):
+.Pp
+.Bl -tag -width indent -compact
+.It Li all
+Count all uops operating on 128 bit SIMD integer operands in memory or
+XMM register.
+.El
+.Pp
+If an instruction contains more than one 128 bit MMX uop, then each
+uop will be counted.
+.It Li p4-64bit-mmx-uop Op Li ,mask= Ns Ar flags
+.Pq "TI event"
+Count MMX instructions that operate on 64 bit SIMD operands.
+Qualifier
+.Ar flags
+can take the following value (which is also the default):
+.Pp
+.Bl -tag -width indent -compact
+.It Li all
+Count all uops operating on 64 bit SIMD integer operands in memory or
+in MMX registers.
+.El
+.Pp
+If an instruction contains more than one 64 bit MMX uop, then each
+uop will be counted.
+.It Li p4-b2b-cycles
+.Pq "TI event"
+Count back-to-back bys cycles.
+Further documentation for this event is unavailable.
+.It Li p4-bnr
+.Pq "TI event"
+Count bus-not-ready conditions.
+Further documentation for this event is unavailable.
+.It Li p4-bpu-fetch-request Op Li ,mask= Ns Ar qualifier
+.Pq "TS event"
+Count instruction fetch requests qualified by additional
+flags specified in
+.Ar qualifier .
+At this point only one flag is supported:
+.Pp
+.Bl -tag -width indent -compact
+.It Li tcmiss
+Count trace cache lookup misses.
+.El
+.Pp
+The default qualifier is also
+.Dq Li mask=tcmiss .
+.It Li p4-branch-retired Op Li ,mask= Ns Ar flags
+.Pq "TS event"
+Counts retired branches.
+Qualifier
+.Ar flags
+is a list of the following
+.Ql +
+separated strings:
+.Pp
+.Bl -tag -width indent -compact
+.It Li mmnp
+Count branches not-taken and predicted.
+.It Li mmnm
+Count branches not-taken and mis-predicted.
+.It Li mmtp
+Count branches taken and predicted.
+.It Li mmtm
+Count branches taken and mis-predicted.
+.El
+.Pp
+The default qualifier counts all four kinds of branches.
+.It Li p4-bsq-active-entries Op Li ,mask= Ns Ar qualifier
+.Pq "TS event"
+Count the number of entries (clipped at 15) currently active in the
+BSQ.
+Qualifier
+.Ar qualifier
+is a
+.Ql +
+separated set of the following flags:
+.Pp
+.Bl -tag -width indent -compact
+.It Li req-type0 , Li req-type1
+Forms a 2-bit number used to select the request type encoding:
+.Pp
+.Bl -tag -width indent -compact
+.It Li 0
+reads excluding read invalidate
+.It Li 1
+read invalidates
+.It Li 2
+writes other than writebacks
+.It Li 3
+writebacks
+.El
+.Pp
+Bit
+.Dq Li req-type1
+is the MSB for this two bit number.
+.It Li req-len0 , Li req-len1
+Forms a two-bit number that specifies the request length encoding:
+.Pp
+.Bl -tag -width indent -compact
+.It Li 0
+0 chunks
+.It Li 1
+1 chunk
+.It Li 3
+8 chunks
+.El
+.Pp
+Bit
+.Dq Li req-len1
+is the MSB for this two bit number.
+.It Li req-io-type
+Count requests that are input or output requests.
+.It Li req-lock-type
+Count requests that lock the bus.
+.It Li req-lock-cache
+Count requests that lock the cache.
+.It Li req-split-type
+Count requests that is a bus 8-byte chunk that is split across an
+8-byte boundary.
+.It Li req-dem-type
+Count requests that are demand (not prefetches) if set.
+Count requests that are prefetches if not set.
+.It Li req-ord-type
+Count requests that are ordered.
+.It Li mem-type0 , Li mem-type1 , Li mem-type2
+Forms a 3-bit number that specifies a memory type encoding:
+.Pp
+.Bl -tag -width indent -compact
+.It Li 0
+UC
+.It Li 1
+USWC
+.It Li 4
+WT
+.It Li 5
+WP
+.It Li 6
+WB
+.El
+.Pp
+Bit
+.Dq Li mem-type2
+is the MSB of this 3-bit number.
+.El
+.Pp
+The default qualifier has all the above bits set.
+.Pp
+Edge triggering using the
+.Dq Li edge
+qualifier should not be used with this event when counting cycles.
+.It Li p4-bsq-allocation Op Li ,mask= Ns Ar qualifier
+.Pq "TS event"
+Count allocations in the bus sequence unit according to the flags
+specified in
+.Ar qualifier ,
+which is a
+.Ql +
+separated set of the following flags:
+.Pp
+.Bl -tag -width indent -compact
+.It Li req-type0 , Li req-type1
+Forms a 2-bit number used to select the request type encoding:
+.Pp
+.Bl -tag -width indent -compact
+.It Li 0
+reads excluding read invalidate
+.It Li 1
+read invalidates
+.It Li 2
+writes other than writebacks
+.It Li 3
+writebacks
+.El
+.Pp
+Bit
+.Dq Li req-type1
+is the MSB for this two bit number.
+.It Li req-len0 , Li req-len1
+Forms a two-bit number that specifies the request length encoding:
+.Pp
+.Bl -tag -width indent -compact
+.It Li 0
+0 chunks
+.It Li 1
+1 chunk
+.It Li 3
+8 chunks
+.El
+.Pp
+Bit
+.Dq Li req-len1
+is the MSB for this two bit number.
+.It Li req-io-type
+Count requests that are input or output requests.
+.It Li req-lock-type
+Count requests that lock the bus.
+.It Li req-lock-cache
+Count requests that lock the cache.
+.It Li req-split-type
+Count requests that is a bus 8-byte chunk that is split across an
+8-byte boundary.
+.It Li req-dem-type
+Count requests that are demand (not prefetches) if set.
+Count requests that are prefetches if not set.
+.It Li req-ord-type
+Count requests that are ordered.
+.It Li mem-type0 , Li mem-type1 , Li mem-type2
+Forms a 3-bit number that specifies a memory type encoding:
+.Pp
+.Bl -tag -width indent -compact
+.It Li 0
+UC
+.It Li 1
+USWC
+.It Li 4
+WT
+.It Li 5
+WP
+.It Li 6
+WB
+.El
+.Pp
+Bit
+.Dq Li mem-type2
+is the MSB of this 3-bit number.
+.El
+.Pp
+The default qualifier has all the above bits set.
+.Pp
+This event is usually used along with the
+.Dq Li edge
+qualifier to avoid multiple counting.
+.It Li p4-bsq-cache-reference Op Li ,mask= Ns Ar qualifier
+.Pq "TS event"
+Count cache references as seen by the bus unit (2nd or 3rd level
+cache references).
+Qualifier
+.Ar qualifier
+is a
+.Ql +
+separated list of the following keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li rd-2ndl-hits
+Count 2nd level cache hits in the shared state.
+.It Li rd-2ndl-hite
+Count 2nd level cache hits in the exclusive state.
+.It Li rd-2ndl-hitm
+Count 2nd level cache hits in the modified state.
+.It Li rd-3rdl-hits
+Count 3rd level cache hits in the shared state.
+.It Li rd-3rdl-hite
+Count 3rd level cache hits in the exclusive state.
+.It Li rd-3rdl-hitm
+Count 3rd level cache hits in the modified state.
+.It Li rd-2ndl-miss
+Count 2nd level cache misses.
+.It Li rd-3rdl-miss
+Count 3rd level cache misses.
+.It Li wr-2ndl-miss
+Count write-back lookups from the data access cache that miss the 2nd
+level cache.
+.El
+.Pp
+The default is to count all the above events.
+.It Li p4-execution-event Op Li ,mask= Ns Ar flags
+.Pq "TS event"
+Count the retirement of tagged uops selected through the execution
+tagging mechanism.
+Qualifier
+.Ar flags
+can contain the following strings separated by
+.Ql +
+characters:
+.Pp
+.Bl -tag -width indent -compact
+.It Li nbogus0 , Li nbogus1 , Li nbogus2 , Li nbogus3
+The marked uops are not bogus.
+.It Li bogus0 , Li bogus1 , Li bogus2 , Li bogus3
+The marked uops are bogus.
+.El
+.Pp
+This event requires additional (upstream) events to be allocated to
+perform the desired uop tagging.
+The default is to set all the above flags.
+This event can be used for precise event based sampling.
+.It Li p4-front-end-event Op Li ,mask= Ns Ar flags
+.Pq "TS event"
+Count the retirement of tagged uops selected through the front-end
+tagging mechanism.
+Qualifier
+.Ar flags
+can contain the following strings separated by
+.Ql +
+characters:
+.Pp
+.Bl -tag -width indent -compact
+.It Li nbogus
+The marked uops are not bogus.
+.It Li bogus
+The marked uops are bogus.
+.El
+.Pp
+This event requires additional (upstream) events to be allocated to
+perform the desired uop tagging.
+The default is to select both kinds of events.
+This event can be used for precise event based sampling.
+.It Li p4-fsb-data-activity Op Li ,mask= Ns Ar flags
+.Pq "TI event"
+Count each DBSY or DRDY event selected by qualifier
+.Ar flags .
+Qualifier
+.Ar flags
+is a
+.Ql +
+separated set of the following flags:
+.Pp
+.Bl -tag -width indent -compact
+.It Li drdy-drv
+Count when this processor is driving data onto the bus.
+.It Li drdy-own
+Count when this processor is reading data from the bus.
+.It Li drdy-other
+Count when data is on the bus but not being sampled by this processor.
+.It Li dbsy-drv
+Count when this processor reserves the bus for use in the next cycle
+in order to drive data.
+.It Li dbsy-own
+Count when some agent reserves the bus for use in the next bus cycle
+to drive data that this processor will sample.
+.It Li dbsy-other
+Count when some agent reserves the bus for use in the next bus cycle
+to drive data that this processor will not sample.
+.El
+.Pp
+Flags
+.Dq Li drdy-own
+and
+.Dq Li drdy-other
+are mutually exclusive.
+Flags
+.Dq Li dbsy-own
+and
+.Dq Li dbsy-other
+are mutually exclusive.
+The default value for
+.Ar qualifier
+is
+.Dq Li drdy-drv+drdy-own+dbsy-drv+dbsy-own .
+.It Li p4-global-power-events Op Li ,mask= Ns Ar flags
+.Pq "TS event"
+Count cycles during which the processor is not stopped.
+Qualifier
+.Ar flags
+can take the following value (which is also the default):
+.Pp
+.Bl -tag -width indent -compact
+.It Li running
+Count cycles when the processor is active.
+.El
+.Pp
+.It Li p4-instr-retired Op Li ,mask= Ns Ar flags
+.Pq "TS event"
+Count instructions retired during a clock cycle.
+Qualifer
+.Ar flags
+comprises of the following strings separated by
+.Ql +
+characters:
+.Pp
+.Bl -tag -width indent -compact
+.It Li nbogusntag
+Count non-bogus instructions that are not tagged.
+.It Li nbogustag
+Count non-bogus instructions that are tagged.
+.It Li bogusntag
+Count bogus instructions that are not tagged.
+.It Li bogustag
+Count bogus instructions that are tagged.
+.El
+.Pp
+The default qualifier counts all the above kinds of instructions.
+.It Li p4-ioq-active-entries Xo
+.Op Li ,mask= Ns Ar qualifier
+.Op Li ,busreqtype= Ns Ar req-type
+.Xc
+.Pq "TS event"
+Count the number of entries (clipped at 15) in the IOQ that are
+active.
+The event masks are specified by qualifier
+.Ar qualifier
+and
+.Ar req-type .
+.Pp
+Qualifier
+.Ar qualifier
+is a
+.Ql +
+separated set of the following flags:
+.Pp
+.Bl -tag -width indent -compact
+.It Li all-read
+Count read entries.
+.It Li all-write
+Count write entries.
+.It Li mem-uc
+Count entries accessing uncacheable memory.
+.It Li mem-wc
+Count entries accessing write-combining memory.
+.It Li mem-wt
+Count entries accessing write-through memory.
+.It Li mem-wp
+Count entries accessing write-protected memory
+.It Li mem-wb
+Count entries accessing write-back memory.
+.It Li own
+Count store requests driven by the processor (i.e., not by other
+processors or by DMA).
+.It Li other
+Count store requests driven by other processors or by DMA.
+.It Li prefetch
+Include hardware and software prefetch requests in the count.
+.El
+.Pp
+The default value for
+.Ar qualifier
+is to enable all the above flags.
+.Pp
+The
+.Ar req-type
+qualifier is a 5-bit number can be additionally used to select a
+specific bus request type.
+The default is 0.
+.Pp
+The
+.Dq Li edge
+qualifier should not be used when counting cycles with this event.
+The exact behaviour of this event depends on the processor revision.
+.It Li p4-ioq-allocation Xo
+.Op Li ,mask= Ns Ar qualifier
+.Op Li ,busreqtype= Ns Ar req-type
+.Xc
+.Pq "TS event"
+Count various types of transactions on the bus matching the flags set
+in
+.Ar qualifier
+and
+.Ar req-type .
+.Pp
+Qualifier
+.Ar qualifier
+is a
+.Ql +
+separated set of the following flags:
+.Pp
+.Bl -tag -width indent -compact
+.It Li all-read
+Count read entries.
+.It Li all-write
+Count write entries.
+.It Li mem-uc
+Count entries accessing uncacheable memory.
+.It Li mem-wc
+Count entries accessing write-combining memory.
+.It Li mem-wt
+Count entries accessing write-through memory.
+.It Li mem-wp
+Count entries accessing write-protected memory
+.It Li mem-wb
+Count entries accessing write-back memory.
+.It Li own
+Count store requests driven by the processor (i.e., not by other
+processors or by DMA).
+.It Li other
+Count store requests driven by other processors or by DMA.
+.It Li prefetch
+Include hardware and software prefetch requests in the count.
+.El
+.Pp
+The default value for
+.Ar qualifier
+is to enable all the above flags.
+.Pp
+The
+.Ar req-type
+qualifier is a 5-bit number can be additionally used to select a
+specific bus request type.
+The default is 0.
+.Pp
+The
+.Dq Li edge
+qualifier is normally used with this event to prevent multiple
+counting.
+The exact behaviour of this event depends on the processor revision.
+.It Li p4-itlb-reference Op mask= Ns Ar qualifier
+.Pq "TS event"
+Count translations using the intruction translation look-aside
+buffer.
+The
+.Ar qualifier
+argument is a list of the following strings separated by
+.Ql +
+characters.
+.Pp
+.Bl -tag -width indent -compact
+.It Li hit
+Count ITLB hits.
+.It Li miss
+Count ITLB misses.
+.It Li hit-uc
+Count uncacheable ITLB hits.
+.El
+.Pp
+If no
+.Ar qualifier
+is specified the default is to count all the three kinds of ITLB
+translations.
+.It Li p4-load-port-replay Op Li ,mask= Ns Ar qualifier
+.Pq "TS event"
+Count replayed events at the load port.
+Qualifier
+.Ar qualifier
+can take on one value:
+.Pp
+.Bl -tag -width indent -compact
+.It Li split-ld
+Count split loads.
+.El
+.Pp
+The default value for
+.Ar qualifier
+is
+.Dq Li split-ld .
+.It Li p4-mispred-branch-retired Op Li ,mask= Ns Ar flags
+.Pq "TS event"
+Count mispredicted IA-32 branch instructions.
+Qualifier
+.Ar flags
+can take the following value (which is also the default):
+.Pp
+.Bl -tag -width indent -compact
+.It Li nbogus
+Count non-bogus retired branch instructions.
+.El
+.It Li p4-machine-clear Op Li ,mask= Ns Ar flags
+.Pq "TS event"
+Count the number of pipeline clears seen by the processor.
+Qualifer
+.Ar flags
+is a list of the following strings separated by
+.Ql +
+characters:
+.Pp
+.Bl -tag -width indent -compact
+.It Li clear
+Count for a portion of the many cycles when the machine is being
+cleared for any reason.
+.It Li moclear
+Count machine clears due to memory ordering issues.
+.It Li smclear
+Count machine clears due to self-modifying code.
+.El
+.Pp
+Use qualifier
+.Dq Li edge
+to get a count of occurrences of machine clears.
+The default qualifier is
+.Dq Li clear .
+.It Li p4-memory-cancel Op Li ,mask= Ns Ar event-list
+.Pq "TS event"
+Count the cancelling of various kinds of requests in the data cache
+address control unit of the CPU.
+The qualifier
+.Ar event-list
+is a list of the following strings separated by
+.Ql +
+characters:
+.Pp
+.Bl -tag -width indent -compact
+.It Li st-rb-full
+Requests cancelled because no store request buffer was available.
+.It Li 64k-conf
+Requests that conflict due to 64K aliasing.
+.El
+.Pp
+If
+.Ar event-list
+is not specified, then the default is to count both kinds of events.
+.It Li p4-memory-complete Op Li ,mask= Ns Ar event-list
+.Pq "TS event"
+Count the completion of load split, store split, uncacheable split and
+uncacheable load operations selected by qualifier
+.Ar event-list .
+The qualifier
+.Ar event-list
+is a
+.Ql +
+separated list of the following flags:
+.Pp
+.Bl -tag -width indent -compact
+.It Li lsc
+Count load splits completed, excluding loads from uncacheable or
+write-combining areas.
+.It Li ssc
+Count any split stores completed.
+.El
+.Pp
+The default is to count both kinds of operations.
+.It Li p4-mob-load-replay Op Li ,mask= Ns Ar qualifier
+.Pq "TS event"
+Count load replays triggered by the memory order buffer.
+Qualifier
+.Ar qualifier
+can be a
+.Ql +
+separated list of the following flags:
+.Pp
+.Bl -tag -width indent -compact
+.It Li no-sta
+Count replays because of unknown store addresses.
+.It Li no-std
+Count replays because of unknown store data.
+.It Li partial-data
+Count replays because of partially overlapped data accesses between
+load and store operations.
+.It Li unalgn-addr
+Count replays because of mismatches in the lower 4 bits of load and
+store operations.
+.El
+.Pp
+The default qualifier is
+.Ar no-sta+no-std+partial-data+unalgn-addr .
+.It Li p4-packed-dp-uop Op Li ,mask= Ns Ar flags
+.Pq "TI event"
+Count packed double-precision uops.
+Qualifier
+.Ar flags
+can take the following value (which is also the default):
+.Pp
+.Bl -tag -width indent -compact
+.It Li all
+Count all uops operating on packed double-precision operands.
+.El
+.It Li p4-packed-sp-uop Op Li ,mask= Ns Ar flags
+.Pq "TI event"
+Count packed single-precision uops.
+Qualifier
+.Ar flags
+can take the following value (which is also the default):
+.Pp
+.Bl -tag -width indent -compact
+.It Li all
+Count all uops operating on packed single-precision operands.
+.El
+.It Li p4-page-walk-type Op Li ,mask= Ns Ar qualifier
+.Pq "TI event"
+Count page walks performed by the page miss handler.
+Qualifier
+.Ar qualifier
+can be a
+.Ql +
+separated list of the following keywords:
+.Pp
+.Bl -tag -width indent -compact
+.It Li dtmiss
+Count page walks for data TLB misses.
+.It Li itmiss
+Count page walks for instruction TLB misses.
+.El
+.Pp
+The default value for
+.Ar qualifier
+is
+.Dq Li dtmiss+itmiss .
+.It Li p4-replay-event Op Li ,mask= Ns Ar flags
+.Pq "TS event"
+Count the retirement of tagged uops selected through the replay
+tagging mechanism.
+Qualifier
+.Ar flags
+contains a
+.Ql +
+separated set of the following strings:
+.Pp
+.Bl -tag -width indent -compact
+.It Li nbogus
+The marked uops are not bogus.
+.It Li bogus
+The marked uops are bogus.
+.El
+.Pp
+This event requires additional (upstream) events to be allocated to
+perform the desired uop tagging.
+The default qualifier counts both kinds of uops.
+This event can be used for precise event based sampling.
+.It Li p4-resource-stall Op Li ,mask= Ns Ar flags
+.Pq "TS event"
+Count the occurrence or latency of stalls in the allocator.
+Qualifier
+.Ar flags
+can take the following value (which is also the default):
+.Pp
+.Bl -tag -width indent -compact
+.It Li sbfull
+A stall due to the lack of store buffers.
+.El
+.It Li p4-response
+.Pq "TI event"
+Count different types of responses.
+Further documentation on this event is not available.
+.It Li p4-retired-branch-type Op Li ,mask= Ns Ar flags
+.Pq "TS event"
+Count branches retired.
+Qualifier
+.Ar flags
+contains a
+.Ql +
+separated list of strings:
+.Pp
+.Bl -tag -width indent -compact
+.It Li conditional
+Count conditional jumps.
+.It Li call
+Count direct and indirect call branches.
+.It Li return
+Count return branches.
+.It Li indirect
+Count returns, indirect calls or indirect jumps.
+.El
+.Pp
+The default qualifier counts all the above branch types.
+.It Li p4-retired-mispred-branch-type Op Li ,mask= Ns Ar flags
+.Pq "TS event"
+Count mispredicted branches retired.
+Qualifier
+.Ar flags
+contains a
+.Ql +
+separated list of strings:
+.Pp
+.Bl -tag -width indent -compact
+.It Li conditional
+Count conditional jumps.
+.It Li call
+Count indirect call branches.
+.It Li return
+Count return branches.
+.It Li indirect
+Count returns, indirect calls or indirect jumps.
+.El
+.Pp
+The default qualifier counts all the above branch types.
+.It Li p4-scalar-dp-uop Op Li ,mask= Ns Ar flags
+.Pq "TI event"
+Count the number of scalar double-precision uops.
+Qualifier
+.Ar flags
+can take the following value (which is also the default):
+.Pp
+.Bl -tag -width indent -compact
+.It Li all
+Count the number of scalar double-precision uops.
+.El
+.It Li p4-scalar-sp-uop Op Li ,mask= Ns Ar flags
+.Pq "TI event"
+Count the number of scalar single-precision uops.
+Qualifier
+.Ar flags
+can take the following value (which is also the default):
+.Pp
+.Bl -tag -width indent -compact
+.It Li all
+Count all uops operating on scalar single-precision operands.
+.El
+.It Li p4-snoop
+.Pq "TI event"
+Count snoop traffic.
+Further documentation on this event is not available.
+.It Li p4-sse-input-assist Op Li ,mask= Ns Ar flags
+.Pq "TI event"
+Count the number of times an assist is required to handle problems
+with the operands for SSE and SSE2 operations.
+Qualifier
+.Ar flags
+can take the following value (which is also the default):
+.Pp
+.Bl -tag -width indent -compact
+.It Li all
+Count assists for all SSE and SSE2 uops.
+.El
+.It Li p4-store-port-replay Op Li ,mask= Ns Ar qualifier
+.Pq "TS event"
+Count events replayed at the store port.
+Qualifier
+.Ar qualifier
+can take on one value:
+.Pp
+.Bl -tag -width indent -compact
+.It Li split-st
+Count split stores.
+.El
+.Pp
+The default value for
+.Ar qualifier
+is
+.Dq Li split-st .
+.It Li p4-tc-deliver-mode Op Li ,mask= Ns Ar qualifier
+.Pq "TI event"
+Count the duration in cycles of operating modes of the trace cache and
+decode engine.
+The desired operating mode is selected by
+.Ar qualifier ,
+which is a list of the following strings separated by
+.Ql +
+characters:
+.Pp
+.Bl -tag -width indent -compact
+.It Li DD
+Both logical processors are in deliver mode.
+.It Li DB
+Logical processor 0 is in deliver mode while logical processor 1 is in
+build mode.
+.It Li DI
+Logical processor 0 is in deliver mode while logical processor 1 is
+halted, or in machine clear, or transitioning to a long microcode
+flow.
+.It Li BD
+Logical processor 0 is in build mode while logical processor 1 is in
+deliver mode.
+.It Li BB
+Both logical processors are in build mode.
+.It Li BI
+Logical processor 0 is in build mode while logical processor 1 is
+halted, or in machine clear or transitioning to a long microcode
+flow.
+.It Li ID
+Logical processor 0 is halted, or in machine clear or transitioning to
+a long microcode flow while logical processor 1 is in deliver mode.
+.It Li IB
+Logical processor 0 is halted, or in machine clear or transitioning to
+a long microcode flow while logical processor 1 is in build mode.
+.El
+.Pp
+If there is only one logical processor in the processor package then
+the qualifier for logical processor 1 is ignored.
+If no qualifier is specified, the default qualifier is
+.Dq Li DD+DB+DI+BD+BB+BI+ID+IB .
+.It Li p4-tc-ms-xfer Op Li ,mask= Ns Ar flags
+.Pq "TI event"
+Count the number of times uop delivery changed from the trace cache to
+MS ROM.
+Qualifier
+.Ar flags
+can take the following value (which is also the default):
+.Pp
+.Bl -tag -width indent -compact
+.It Li cisc
+Count TC to MS transfers.
+.El
+.It Li p4-uop-queue-writes Op Li ,mask= Ns Ar flags
+.Pq "TS event"
+Count the number of valid uops written to the uop queue.
+Qualifier
+.Ar flags
+is a list of the following strings, separated by
+.Ql +
+characters:
+.Pp
+.Bl -tag -width indent -compact
+.It Li from-tc-build
+Count uops being written from the trace cache in build mode.
+.It Li from-tc-deliver
+Count uops being written from the trace cache in deliver mode.
+.It Li from-rom
+Count uops being written from microcode ROM.
+.El
+.Pp
+The default qualifier counts all the above kinds of uops.
+.It Li p4-uop-type Op Li ,mask= Ns Ar flags
+.Pq "TS event"
+This event is used in conjunction with the front-end at-retirement
+mechanism to tag load and store uops.
+Qualifer
+.Ar flags
+comprises the following strings separated by
+.Ql +
+characters:
+.Pp
+.Bl -tag -width indent -compact
+.It Li tagloads
+Mark uops that are load operations.
+.It Li tagstores
+Mark uops that are store operations.
+.El
+.Pp
+The default qualifier counts both kinds of uops.
+.It Li p4-uops-retired Op Li ,mask= Ns Ar flags
+.Pq "TS event"
+Count uops retired during a clock cycle.
+Qualifier
+.Ar flags
+comprises the following strings separated by
+.Ql +
+characters:
+.Pp
+.Bl -tag -width indent -compact
+.It Li nbogus
+Count marked uops that are not bogus.
+.It Li bogus
+Count marked uops that are bogus.
+.El
+.Pp
+The default qualifier counts both kinds of uops.
+.It Li p4-wc-buffer Op Li ,mask= Ns Ar flags
+.Pq "TI event"
+Count write-combining buffer operations.
+Qualifier
+.Ar flags
+contains the following strings separated by
+.Ql +
+characters:
+.Pp
+.Bl -tag -width indent -compact
+.It Li wcb-evicts
+WC buffer evictions due to any cause.
+.It Li wcb-full-evict
+WC buffer evictions due to no WC buffer being available.
+.El
+.Pp
+The default qualifer counts both kinds of evictions.
+.It Li p4-x87-assist Op Li ,mask= Ns Ar flags
+.Pq "TS event"
+Count the retirement of x87 instructions that required special
+handling.
+Qualifier
+.Ar flags
+contains the following strings separated by
+.Ql +
+characters:
+.Pp
+.Bl -tag -width indent -compact
+.It Li fpsu
+Count instructions that saw an FP stack underflow.
+.It Li fpso
+Count instructions that saw an FP stack overflow.
+.It Li poao
+Count instructions that saw an x87 output overflow.
+.It Li poau
+Count instructions that saw an x87 output underflow.
+.It Li prea
+Count instructions that needed an x87 input assist.
+.El
+.Pp
+The default qualifier counts all the above types of instruction
+retirements.
+.It Li p4-x87-fp-uop Op Li ,mask= Ns Ar flags
+.Pq "TI event"
+Count x87 floating-point uops.
+Qualifier
+.Ar flags
+can take the following value (which is also the default):
+.Pp
+.Bl -tag -width indent -compact
+.It Li all
+Count all x87 floating-point uops.
+.El
+.Pp
+If an instruction contains more than one x87 floating-point uops, then
+all x87 floating-point uops will be counted.
+This event does not count x87 floating-point data movement operations.
+.It Li p4-x87-simd-moves-uop Op Li ,mask= Ns Ar flags
+.Pq "TI event"
+Count each x87 FPU, MMX, SSE, or SSE2 uops that load data or store
+data or perform register-to-register moves.
+This event does not count integer move uops.
+Qualifier
+.Ar flags
+may contain the following keywords separated by
+.Ql +
+characters:
+.Pp
+.Bl -tag -width indent -compact
+.It Li allp0
+Count all x87 and SIMD store and move uops.
+.It Li allp2
+Count all x87 and SIMD load uops.
+.El
+.Pp
+The default is to count all uops.
+.Pq Errata
+This event may be affected by processor errata N43.
+.El
+.Ss "Cascading P4 PMCs"
+PMC cascading support is currently poorly implemented.
+While individual event counters may be allocated with a
+.Dq Li cascade
+qualifier, the current API does not offer the ability
+to name and allocate all the resources needed for a
+cascaded event counter pair in a single operation.
+.Ss "Precise Event Based Sampling"
+Support for precise event based sampling is currently
+unimplemented in
+.Xr hwpmc 4 .
+.Sh IMPLEMENTATION NOTES
+On the i386 architecture,
+.Fx
+has historically allowed the use of the RDTSC instruction from
+user-mode (i.e., at a processor CPL of 3) by any process.
+This behaviour is preserved by
+.Xr hwpmc 4 .
+.Sh RETURN VALUES
+The
+.Fn pmc_name_of_capability ,
+.Fn pmc_name_of_class ,
+.Fn pmc_name_of_cputype ,
+.Fn pmc_name_of_disposition ,
+.Fn pmc_name_of_event ,
+.Fn pmc_name_of_mode ,
+and
+.Fn pmc_name_of_state
+functions return a pointer to the human readable form of their argument.
+These pointers may point to statically allocated storage and must
+not be passed to
+.Fn free .
+In case of an error, these functions return
+.Dv NULL
+and set the global variable
+.Va errno .
+.Pp
+The functions
+.Fn pmc_ncpu
+and
+.Fn pmc_npmc
+return the number of CPUs and number of PMCs configured respectively;
+in case of an error they return the value
+\-1
+and set the global variable
+.Va errno .
+.Pp
+All other functions return the value
+0
+if successful; otherwise the value
+\-1
+is returned and the global variable
+.Va errno
+is set to indicate the error.
+.Sh COMPATIBILITY
+The interface between the
+.Nm pmc
+library and the
+.Xr hwpmc 4
+driver is intended to be private to the implementation and may
+change.
+In order to ease forward compatibility with future versions of the
+.Xr hwpmc 4
+driver, applications are urged to dynamically link with the
+.Nm pmc
+library.
+.Pp
+The
+.Nm pmc
+API is
+.Ud
+.Sh ERRORS
+A call to
+.Fn pmc_init
+may fail with the following errors in addition to those returned by
+.Xr modfind 2 ,
+.Xr modstat 2
+and
+.Xr hwpmc 4 :
+.Bl -tag -width Er
+.It Bq Er ENXIO
+An unknown CPU type was encountered during initialization.
+.It Bq Er EPROGMISMATCH
+The version number of the
+.Xr hwpmc 4
+kernel module did not match that compiled into the
+.Nm pmc
+library.
+.El
+.Pp
+A call to
+.Fn pmc_capabilities ,
+.Fn pmc_name_of_capability ,
+.Fn pmc_name_of_disposition ,
+.Fn pmc_name_of_state ,
+.Fn pmc_name_of_event ,
+.Fn pmc_name_of_mode
+.Fn pmc_name_of_class
+and
+.Fn pmc_width
+may fail with the following error:
+.Bl -tag -width Er
+.It Bq Er EINVAL
+An invalid argument was passed to the function.
+.El
+.Pp
+A call to
+.Fn pmc_cpuinfo
+or
+.Fn pmc_ncpu
+may fail with the following error:
+.Bl -tag -width Er
+.It Bq Er ENXIO
+The
+.Nm pmc
+has not been initialized.
+.El
+.Pp
+A call to
+.Fn pmc_npmc
+may fail with the following errors:
+.Bl -tag -width Er
+.It Bq Er EINVAL
+The argument passed in was out of range.
+.It Bq Er ENXIO
+The
+.Nm pmc
+library has not been initialized.
+.El
+.Pp
+A call to
+.Fn pmc_pmcinfo
+may fail with the following errors, in addition to those returned by
+.Xr hwpmc 4 :
+.Bl -tag -width Er
+.It Bq Er ENXIO
+The
+.Nm pmc
+library is not yet initialized.
+.El
+.Pp
+A call to
+.Fn pmc_allocate
+may fail with the following errors, in addition to those returned by
+.Xr hwpmc 4 :
+.Bl -tag -width Er
+.It Bq Er EINVAL
+The
+.Fa mode
+argument passed in had an illegal value, or the event specification
+.Fa ctrspec
+was unrecognized for this CPU type.
+.El
+.Pp
+Calls to
+.Fn pmc_attach ,
+.Fn pmc_configure_logfile ,
+.Fn pmc_detach ,
+.Fn pmc_disable ,
+.Fn pmc_enable ,
+.Fn pmc_get_driver_stats ,
+.Fn pmc_get_msr ,
+.Fn pmc_read ,
+.Fn pmc_release ,
+.Fn pmc_rw ,
+.Fn pmc_set ,
+.Fn pmc_start ,
+.Fn pmc_stop ,
+.Fn pmc_write ,
+and
+.Fn pmc_writelog
+may fail with the errors described in
+.Xr hwpmc 4 .
+.Pp
+If a log file was configured using
+.Fn pmc_configure_logfile
+and the
+.Xr hwpmc 4
+driver encountered an error while logging data to it, then
+logging will be stopped and a subsequent call to
+.Fn pmc_flush_logfile
+will fail with the error code seen by the
+.Xr hwpmc 4
+driver.
+.Sh SEE ALSO
+.Xr modfind 2 ,
+.Xr modstat 2 ,
+.Xr calloc 3 ,
+.Xr pmclog 3 ,
+.Xr hwpmc 4 ,
+.Xr pmccontrol 8 ,
+.Xr pmcstat 8
+.Sh HISTORY
+The
+.Nm pmc
+library first appeared in
+.Fx 6.0 .
+.Sh BUGS
+The information returned by
+.Fn pmc_cpuinfo ,
+.Fn pmc_ncpu
+and possibly
+.Fn pmc_npmc
+should really be available all the time, through a better designed
+interface and not just when
+.Xr hwpmc 4
+is present in the kernel.
diff --git a/lib/libpmc/pmc.h b/lib/libpmc/pmc.h
new file mode 100644
index 0000000..050d423
--- /dev/null
+++ b/lib/libpmc/pmc.h
@@ -0,0 +1,109 @@
+/*-
+ * Copyright (c) 2003,2004 Joseph Koshy
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD: src/lib/libpmc/pmc.h,v 1.3 2005-06-09 19:45:06 jkoshy Exp $
+ */
+
+#ifndef _PMC_H_
+#define _PMC_H_
+
+#include <sys/pmc.h>
+
+/*
+ * Driver statistics.
+ */
+struct pmc_driverstats {
+	int	pm_intr_ignored;	/* #interrupts ignored */
+	int	pm_intr_processed;	/* #interrupts processed */
+	int	pm_intr_bufferfull;	/* #interrupts with ENOSPC */
+	int	pm_syscalls;		/* #syscalls */
+	int	pm_syscall_errors;	/* #syscalls with errors */
+	int	pm_buffer_requests;	/* #buffer requests */
+	int	pm_buffer_requests_failed; /* #failed buffer requests */
+	int	pm_log_sweeps;		/* #sample buffer processing passes */
+};
+
+/*
+ * CPU information.
+ */
+struct pmc_cpuinfo {
+	enum pmc_cputype pm_cputype;	/* the kind of CPU */
+	uint32_t	pm_ncpu;	/* number of CPUs */
+	uint32_t	pm_npmc;	/* #PMCs per CPU */
+	uint32_t	pm_nclass;	/* #classes of PMCs */
+	struct pmc_classinfo pm_classes[PMC_CLASS_MAX];
+};
+
+/*
+ * Current PMC state.
+ */
+struct pmc_pmcinfo {
+	int32_t		pm_cpu;		/* CPU number */
+	struct pmc_info	pm_pmcs[];	/* NPMC structs */
+};
+
+/*
+ * Prototypes
+ */
+
+int	pmc_allocate(const char *_ctrspec, enum pmc_mode _mode, uint32_t _flags,
+    int _cpu, pmc_id_t *_pmcid);
+int	pmc_attach(pmc_id_t _pmcid, pid_t _pid);
+int	pmc_capabilities(pmc_id_t _pmc, uint32_t *_caps);
+int	pmc_configure_logfile(int _fd);
+int	pmc_flush_logfile(void);
+int	pmc_detach(pmc_id_t _pmcid, pid_t _pid);
+int	pmc_disable(int _cpu, int _pmc);
+int	pmc_enable(int _cpu, int _pmc);
+int	pmc_get_driver_stats(struct pmc_driverstats *_gms);
+int	pmc_get_msr(pmc_id_t _pmc, uint32_t *_msr);
+int	pmc_init(void);
+int	pmc_read(pmc_id_t _pmc, pmc_value_t *_value);
+int	pmc_release(pmc_id_t _pmc);
+int	pmc_rw(pmc_id_t _pmc, pmc_value_t _newvalue, pmc_value_t *_oldvalue);
+int	pmc_set(pmc_id_t _pmc, pmc_value_t _value);
+int	pmc_start(pmc_id_t _pmc);
+int	pmc_stop(pmc_id_t _pmc);
+int	pmc_width(pmc_id_t _pmc, uint32_t *_width);
+int	pmc_write(pmc_id_t _pmc, pmc_value_t _value);
+int	pmc_writelog(uint32_t _udata);
+
+int	pmc_ncpu(void);
+int	pmc_npmc(int _cpu);
+int	pmc_cpuinfo(const struct pmc_cpuinfo **_cpu_info);
+int	pmc_pmcinfo(int _cpu, struct pmc_pmcinfo **_pmc_info);
+
+const char	*pmc_name_of_capability(uint32_t _c);
+const char	*pmc_name_of_class(enum pmc_class _pc);
+const char	*pmc_name_of_cputype(enum pmc_cputype _cp);
+const char	*pmc_name_of_disposition(enum pmc_disp _pd);
+const char	*pmc_name_of_event(enum pmc_event _pe);
+const char	*pmc_name_of_mode(enum pmc_mode _pm);
+const char	*pmc_name_of_state(enum pmc_state _ps);
+
+int	pmc_event_names_of_class(enum pmc_class _cl, const char ***_eventnames,
+    int *_nevents);
+
+#endif
diff --git a/lib/libpmc/pmclog.3 b/lib/libpmc/pmclog.3
new file mode 100644
index 0000000..b3783b3
--- /dev/null
+++ b/lib/libpmc/pmclog.3
@@ -0,0 +1,320 @@
+.\" Copyright (c) 2005-2006 Joseph Koshy.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\"
+.\" This software is provided by Joseph Koshy ``as is'' and
+.\" any express or implied warranties, including, but not limited to, the
+.\" implied warranties of merchantability and fitness for a particular purpose
+.\" are disclaimed.  in no event shall Joseph Koshy be liable
+.\" for any direct, indirect, incidental, special, exemplary, or consequential
+.\" damages (including, but not limited to, procurement of substitute goods
+.\" or services; loss of use, data, or profits; or business interruption)
+.\" however caused and on any theory of liability, whether in contract, strict
+.\" liability, or tort (including negligence or otherwise) arising in any way
+.\" out of the use of this software, even if advised of the possibility of
+.\" such damage.
+.\"
+.\" $FreeBSD: src/lib/libpmc/pmclog.3,v 1.6 2006-09-17 21:27:35 ru Exp $
+.\"
+.Dd March 26, 2006
+.Os
+.Dt PMCLOG 3
+.Sh NAME
+.Nm pmclog_open ,
+.Nm pmclog_close ,
+.Nm pmclog_read ,
+.Nm pmclog_feed
+.Nd parse event log data generated by
+.Xr hwpmc 4
+.Sh LIBRARY
+.Lb libpmc
+.Sh SYNOPSIS
+.In pmclog.h
+.Ft "void *"
+.Fn pmclog_open "int fd"
+.Ft void
+.Fn pmclog_close "void *cookie"
+.Ft int
+.Fn pmclog_read "void *cookie" "struct pmclog_ev *ev"
+.Ft int
+.Fn pmclog_feed "void *cookie" "char *data" "int len"
+.Sh DESCRIPTION
+These functions provide a way for application programs to extract
+events from an event stream generated by
+.Xr hwpmc 4 .
+.Pp
+A new event log parser is allocated using
+.Fn pmclog_open .
+Argument
+.Fa fd
+may be a file descriptor opened for reading if the event stream is
+present in a file, or the constant
+.Dv PMCLOG_FD_NONE
+for an event stream present in memory.
+This function returns a cookie that is passed into the other functions
+in this API set.
+.Pp
+Function
+.Fn pmclog_read
+returns the next available event in the event stream associated with
+argument
+.Fa cookie .
+Argument
+.Fa ev
+points to an event descriptor that which will contain the result of a
+successfully parsed event.
+.Pp
+An event descriptor returned by
+.Fn pmclog_read
+has the following structure:
+.Bd -literal
+struct pmclog_ev {
+       enum pmclog_state pl_state;	/* parser state after 'get_event()' */
+       off_t             pl_offset;	/* byte offset in stream */
+       size_t            pl_count;	/* count of records so far */
+       struct timespec   pl_ts;		/* log entry timestamp */
+       enum pmclog_type  pl_type;	/* log entry kind */
+       union {				/* log entry data */
+		struct pmclog_ev_closelog    pl_cl;
+		struct pmclog_ev_dropnotify  pl_d;
+		struct pmclog_ev_initialize  pl_i;
+		struct pmclog_ev_map_in      pl_mi;
+		struct pmclog_ev_map_out     pl_mo;
+		struct pmclog_ev_pcsample    pl_s;
+		struct pmclog_ev_pmcallocate pl_a;
+		struct pmclog_ev_pmcattach   pl_t;
+		struct pmclog_ev_pmcdetach   pl_d;
+		struct pmclog_ev_proccsw     pl_c;
+		struct pmclog_ev_procexec    pl_x;
+		struct pmclog_ev_procexit    pl_e;
+		struct pmclog_ev_procfork    pl_f;
+		struct pmclog_ev_sysexit     pl_e;
+		struct pmclog_ev_userdata    pl_u;
+       } pl_u;
+};
+.Ed
+.Pp
+The current state of the parser is recorded in
+.Va pl_state .
+This field can take on the following values:
+.Bl -tag -width ".Dv PMCLOG_REQUIRE_DATA"
+.It Dv PMCLOG_EOF
+(For file based parsers only)
+An end-of-file condition was encountered on the configured file
+descriptor.
+.It Dv PMCLOG_ERROR
+An error occurred during parsing.
+.It Dv PMCLOG_OK
+A complete event record was read into
+.Fa *ev .
+.It Dv PMCLOG_REQUIRE_DATA
+There was insufficient data in the event stream to assemble a complete
+event record.
+For memory based parsers, more data can be fed to the
+parser using function
+.Fn pmclog_feed .
+For file based parsers, function
+.Fn pmclog_read
+may be retried when data is available on the configured file
+descriptor.
+.El
+.Pp
+The rest of the event structure is valid only if field
+.Va pl_state
+contains
+.Dv PMCLOG_OK .
+Field
+.Va pl_offset
+contains the offset of the current record in the byte stream.
+Field
+.Va pl_count
+contains the serial number of this event.
+Field
+.Va pl_ts
+contains a timestamp with the system time when the event occurred.
+Field
+.Va pl_type
+denotes the kind of the event returned in argument
+.Fa *ev
+and is one of the following:
+.Bl -tag -width ".Dv PMCLOG_TYPE_PMCALLOCATE"
+.It Dv PMCLOG_TYPE_CLOSELOG
+A marker indicating a successful close of a log file.
+This record will be the last record of a log file.
+.It Dv PMCLOG_TYPE_DROPNOTIFY
+A marker indicating that
+.Xr hwpmc 4
+had to drop data due to a resource constraint.
+.It Dv PMCLOG_TYPE_INITIALIZE
+An initialization record.
+This is the first record in a log file.
+.It Dv PMCLOG_TYPE_MAP_IN
+A record describing the introduction of a mapping to an executable
+object by a
+.Xr kldload 2
+or
+.Xr mmap 2
+system call.
+.It Dv PMCLOG_TYPE_MAP_OUT
+A record describing the removal of a mapping to an executable
+object by a
+.Xr kldunload 2
+or
+.Xr munmap 2
+system call.
+.It Dv PMCLOG_TYPE_PCSAMPLE
+A record containing an instruction pointer sample.
+.It Dv PMCLOG_TYPE_PMCALLOCATE
+A record describing a PMC allocation operation.
+.It Dv PMCLOG_TYPE_PMCATTACH
+A record describing a PMC attach operation.
+.It Dv PMCLOG_TYPE_PMCDETACH
+A record describing a PMC detach operation.
+.It Dv PMCLOG_TYPE_PROCCSW
+A record describing a PMC reading at the time of a process context switch.
+.It Dv PMCLOG_TYPE_PROCEXEC
+A record describing an
+.Xr execve 2
+by a target process.
+.It Dv PMCLOG_TYPE_PROCEXIT
+A record describing the accumulated PMC reading for a process at the
+time of
+.Xr _exit 2 .
+.It Dv PMCLOG_TYPE_PROCFORK
+A record describing a
+.Xr fork 2
+by a target process.
+.It Dv PMCLOG_TYPE_SYSEXIT
+A record describing a process exit, sent to processes
+owning system-wide sampling PMCs.
+.It Dv PMCLOG_TYPE_USERDATA
+A record containing user data.
+.El
+.Pp
+Function
+.Fn pmclog_feed
+is used with parsers configured to parse memory based event streams.
+It is intended to be called when function
+.Fn pmclog_read
+indicates the need for more data by a returning
+.Dv PMCLOG_REQUIRE_DATA
+in field
+.Va pl_state
+of its event structure argument.
+Argument
+.Fa data
+points to the start of a memory buffer containing fresh event data.
+Argument
+.Fa len
+indicates the number of data bytes available.
+The memory range
+.Bq Fa data , Fa data No + Fa len
+must remain valid till the next time
+.Fn pmclog_read
+returns an error.
+It is an error to use
+.Fn pmclog_feed
+on a parser configured to parse file data.
+.Pp
+Function
+.Fn pmclog_close
+releases the internal state allocated by a prior call
+to
+.Fn pmclog_open .
+.Sh RETURN VALUES
+Function
+.Fn pmclog_open
+will return a
+.No non- Ns Dv NULL
+value if successful or
+.Dv NULL
+otherwise.
+.Pp
+Function
+.Fn pmclog_read
+will return 0 in case a complete event record was successfully read,
+or will return \-1 and will set the
+.Va pl_state
+field of the event record to the appropriate code in case of an error.
+.Pp
+Function
+.Fn pmclog_feed
+will return 0 on success or \-1 in case of failure.
+.Sh EXAMPLES
+A template for using the log file parsing API is shown below in pseudocode:
+.Bd -literal
+void *parser;			/* cookie */
+struct pmclog_ev ev;		/* parsed event */
+int fd;				/* file descriptor */
+
+fd = open(filename, O_RDONLY);	/* open log file */
+parser = pmclog_open(fd);	/* initialize parser */
+if (parser == NULL)
+	--handle an out of memory error--;
+
+/* read and parse data */
+while (pmclog_read(parser, &ev) == 0) {
+	assert(ev.pl_state == PMCLOG_OK);
+	/* process the event */
+	switch (ev.pl_type) {
+	case PMCLOG_TYPE_ALLOCATE:
+		--process a pmc allocation record--
+		break;
+	case PMCLOG_TYPE_PROCCSW:
+		--process a thread context switch record--
+		break;
+	case PMCLOG_TYPE_PCSAMPLE:
+		--process a PC sample--
+		break;
+	--and so on--
+	}
+}
+
+/* examine parser state */
+switch (ev.pl_state) {
+case PMCLOG_EOF:
+	--normal termination--
+	break;
+case PMCLOG_ERROR:
+	--look at errno here--
+	break;
+case PMCLOG_REQUIRE_DATA:
+	--arrange for more data to be available for parsing--
+	break;
+default:
+	assert(0);
+	/*NOTREACHED*/
+}
+
+pmclog_close(parser);		/* cleanup */
+.Ed
+.Sh ERRORS
+A call to
+.Fn pmclog_init_parser
+may fail with any of the errors returned by
+.Xr malloc 3 .
+.Pp
+A call to
+.Fn pmclog_read
+for a file based parser may fail with any of the errors returned by
+.Xr read 2 .
+.Sh SEE ALSO
+.Xr read 2 ,
+.Xr malloc 3 ,
+.Xr pmc 3 ,
+.Xr hwpmc 4 ,
+.Xr pmcstat 8
+.Sh HISTORY
+The
+.Nm pmclog
+API
+.Ud
+It first appeared in
+.Fx 6.0 .
diff --git a/lib/libpmc/pmclog.c b/lib/libpmc/pmclog.c
new file mode 100644
index 0000000..5f62802
--- /dev/null
+++ b/lib/libpmc/pmclog.c
@@ -0,0 +1,553 @@
+/*-
+ * Copyright (c) 2005-2006 Joseph Koshy
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+/*__FBSDID("$FreeBSD: src/lib/libpmc/pmclog.c,v 1.4 2006-03-26 12:20:53 jkoshy Exp $");*/
+
+#include <sys/param.h>
+#include <sys/pmc.h>
+#include <sys/pmclog.h>
+
+#include <assert.h>
+#include <errno.h>
+#include <pmc.h>
+#include <pmclog.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+#include <strings.h>
+#include <unistd.h>
+
+#include <machine/pmc_mdep.h>
+
+#define	PMCLOG_BUFFER_SIZE			4096
+
+/*
+ * API NOTES
+ *
+ * The pmclog(3) API is oriented towards parsing an event stream in
+ * "realtime", i.e., from an data source that may or may not preserve
+ * record boundaries -- for example when the data source is elsewhere
+ * on a network.  The API allows data to be fed into the parser zero
+ * or more bytes at a time.
+ *
+ * The state for a log file parser is maintained in a 'struct
+ * pmclog_parse_state'.  Parser invocations are done by calling
+ * 'pmclog_read()'; this function will inform the caller when a
+ * complete event is parsed.
+ *
+ * The parser first assembles a complete log file event in an internal
+ * work area (see "ps_saved" below).  Once a complete log file event
+ * is read, the parser then parses it and converts it to an event
+ * descriptor usable by the client.  We could possibly avoid this two
+ * step process by directly parsing the input log to set fields in the
+ * event record.  However the parser's state machine would get
+ * insanely complicated, and this code is unlikely to be used in
+ * performance critical paths.
+ */
+
+enum pmclog_parser_state {
+	PL_STATE_NEW_RECORD,		/* in-between records */
+	PL_STATE_EXPECTING_HEADER,	/* header being read */
+	PL_STATE_PARTIAL_RECORD,	/* header present but not the record */
+	PL_STATE_ERROR			/* parsing error encountered */
+};
+
+struct pmclog_parse_state {
+	enum pmclog_parser_state ps_state;
+	enum pmc_cputype	ps_arch;	/* log file architecture */
+	uint32_t		ps_version;	/* hwpmc version */
+	int			ps_initialized;	/* whether initialized */
+	int			ps_count;	/* count of records processed */
+	off_t			ps_offset;	/* stream byte offset */
+	union pmclog_entry	ps_saved;	/* saved partial log entry */
+	int			ps_svcount;	/* #bytes saved */
+	int			ps_fd;		/* active fd or -1 */
+	char			*ps_buffer;	/* scratch buffer if fd != -1 */
+	char			*ps_data;	/* current parse pointer */
+	size_t			ps_len;		/* length of buffered data */
+};
+
+#define	PMCLOG_HEADER_FROM_SAVED_STATE(PS)				\
+	(* ((uint32_t *) &(PS)->ps_saved))
+
+#define	PMCLOG_INITIALIZE_READER(LE,A)	LE = (uint32_t *) &(A)
+#define	PMCLOG_READ32(LE,V) 		do {				\
+		(V)  = *(LE)++;						\
+	} while (0)
+#define	PMCLOG_READ64(LE,V)		do {				\
+		uint64_t _v;						\
+		_v  = (uint64_t) *(LE)++;				\
+		_v |= ((uint64_t) *(LE)++) << 32;			\
+		(V) = _v;						\
+	} while (0)
+
+#define	PMCLOG_READSTRING(LE,DST,LEN)	strlcpy((DST), (char *) (LE), (LEN))
+
+/*
+ * Assemble a log record from '*len' octets starting from address '*data'.
+ * Update 'data' and 'len' to reflect the number of bytes consumed.
+ *
+ * '*data' is potentially an unaligned address and '*len' octets may
+ * not be enough to complete a event record.
+ */
+
+static enum pmclog_parser_state
+pmclog_get_record(struct pmclog_parse_state *ps, char **data, ssize_t *len)
+{
+	int avail, copylen, recordsize, used;
+	uint32_t h;
+	const int HEADERSIZE = sizeof(uint32_t);
+	char *src, *dst;
+
+	if ((avail = *len) <= 0)
+		return (ps->ps_state = PL_STATE_ERROR);
+
+	src = *data;
+	h = used = 0;
+
+	if (ps->ps_state == PL_STATE_NEW_RECORD)
+		ps->ps_svcount = 0;
+
+	dst = (char *) &ps->ps_saved + ps->ps_svcount;
+
+	switch (ps->ps_state) {
+	case PL_STATE_NEW_RECORD:
+
+		/*
+		 * Transitions:
+		 *
+		 * Case A: avail < headersize
+		 *	-> 'expecting header'
+		 *
+		 * Case B: avail >= headersize
+		 *    B.1: avail < recordsize
+		 *	   -> 'partial record'
+		 *    B.2: avail >= recordsize
+		 *         -> 'new record'
+		 */
+
+		copylen = avail < HEADERSIZE ? avail : HEADERSIZE;
+		bcopy(src, dst, copylen);
+		ps->ps_svcount = used = copylen;
+
+		if (copylen < HEADERSIZE) {
+			ps->ps_state = PL_STATE_EXPECTING_HEADER;
+			goto done;
+		}
+
+		src += copylen;
+		dst += copylen;
+
+		h = PMCLOG_HEADER_FROM_SAVED_STATE(ps);
+		recordsize = PMCLOG_HEADER_TO_LENGTH(h);
+
+		if (recordsize <= 0)
+			goto error;
+
+		if (recordsize <= avail) { /* full record available */
+			bcopy(src, dst, recordsize - copylen);
+			ps->ps_svcount = used = recordsize;
+			goto done;
+		}
+
+		/* header + a partial record is available */
+		bcopy(src, dst, avail - copylen);
+		ps->ps_svcount = used = avail;
+		ps->ps_state = PL_STATE_PARTIAL_RECORD;
+
+		break;
+
+	case PL_STATE_EXPECTING_HEADER:
+
+		/*
+		 * Transitions:
+		 *
+		 * Case C: avail+saved < headersize
+		 * 	-> 'expecting header'
+		 *
+		 * Case D: avail+saved >= headersize
+		 *    D.1: avail+saved < recordsize
+		 *    	-> 'partial record'
+		 *    D.2: avail+saved >= recordsize
+		 *    	-> 'new record'
+		 *    (see PARTIAL_RECORD handling below)
+		 */
+
+		if (avail + ps->ps_svcount < HEADERSIZE) {
+			bcopy(src, dst, avail);
+			ps->ps_svcount += avail;
+			used = avail;
+			break;
+		}
+
+		used = copylen = HEADERSIZE - ps->ps_svcount;
+		bcopy(src, dst, copylen);
+		src += copylen;
+		dst += copylen;
+		avail -= copylen;
+		ps->ps_svcount += copylen;
+
+		/*FALLTHROUGH*/
+
+	case PL_STATE_PARTIAL_RECORD:
+
+		/*
+		 * Transitions:
+		 *
+		 * Case E: avail+saved < recordsize
+		 * 	-> 'partial record'
+		 *
+		 * Case F: avail+saved >= recordsize
+		 * 	-> 'new record'
+		 */
+
+		h = PMCLOG_HEADER_FROM_SAVED_STATE(ps);
+		recordsize = PMCLOG_HEADER_TO_LENGTH(h);
+
+		if (recordsize <= 0)
+			goto error;
+
+		if (avail + ps->ps_svcount < recordsize) {
+			copylen = avail;
+			ps->ps_state = PL_STATE_PARTIAL_RECORD;
+		} else {
+			copylen = recordsize - ps->ps_svcount;
+			ps->ps_state = PL_STATE_NEW_RECORD;
+		}
+
+		bcopy(src, dst, copylen);
+		ps->ps_svcount += copylen;
+		used += copylen;
+		break;
+
+	default:
+		goto error;
+	}
+
+ done:
+	*data += used;
+	*len  -= used;
+	return ps->ps_state;
+
+ error:
+	ps->ps_state = PL_STATE_ERROR;
+	return ps->ps_state;
+}
+
+/*
+ * Get an event from the stream pointed to by '*data'.  '*len'
+ * indicates the number of bytes available to parse.  Arguments
+ * '*data' and '*len' are updated to indicate the number of bytes
+ * consumed.
+ */
+
+static int
+pmclog_get_event(void *cookie, char **data, ssize_t *len,
+    struct pmclog_ev *ev)
+{
+	int evlen, pathlen;
+	uint32_t h, *le;
+	enum pmclog_parser_state e;
+	struct pmclog_parse_state *ps;
+
+	ps = (struct pmclog_parse_state *) cookie;
+
+	assert(ps->ps_state != PL_STATE_ERROR);
+
+	if ((e = pmclog_get_record(ps,data,len)) == PL_STATE_ERROR) {
+		ev->pl_state = PMCLOG_ERROR;
+		return -1;
+	}
+
+	if (e != PL_STATE_NEW_RECORD) {
+		ev->pl_state = PMCLOG_REQUIRE_DATA;
+		return -1;
+	}
+
+	PMCLOG_INITIALIZE_READER(le, ps->ps_saved);
+
+	PMCLOG_READ32(le,h);
+
+	if (!PMCLOG_HEADER_CHECK_MAGIC(h)) {
+		ps->ps_state = PL_STATE_ERROR;
+		ev->pl_state = PMCLOG_ERROR;
+		return -1;
+	}
+
+	/* copy out the time stamp */
+	PMCLOG_READ32(le,ev->pl_ts.tv_sec);
+	PMCLOG_READ32(le,ev->pl_ts.tv_nsec);
+
+	evlen = PMCLOG_HEADER_TO_LENGTH(h);
+
+#define	PMCLOG_GET_PATHLEN(P,E,TYPE) do {				\
+		(P) = (E) - offsetof(struct TYPE, pl_pathname);		\
+		if ((P) > PATH_MAX || (P) < 0)				\
+			goto error;					\
+	} while (0)
+
+	switch (ev->pl_type = PMCLOG_HEADER_TO_TYPE(h)) {
+	case PMCLOG_TYPE_CLOSELOG:
+	case PMCLOG_TYPE_DROPNOTIFY:
+		/* nothing to do */
+		break;
+	case PMCLOG_TYPE_INITIALIZE:
+		PMCLOG_READ32(le,ev->pl_u.pl_i.pl_version);
+		PMCLOG_READ32(le,ev->pl_u.pl_i.pl_arch);
+		ps->ps_version = ev->pl_u.pl_i.pl_version;
+		ps->ps_arch = ev->pl_u.pl_i.pl_arch;
+		ps->ps_initialized = 1;
+		break;
+	case PMCLOG_TYPE_MAP_IN:
+		PMCLOG_GET_PATHLEN(pathlen,evlen,pmclog_map_in);
+		PMCLOG_READ32(le,ev->pl_u.pl_mi.pl_pid);
+		PMCLOG_READADDR(le,ev->pl_u.pl_mi.pl_start);
+		PMCLOG_READSTRING(le, ev->pl_u.pl_mi.pl_pathname, pathlen);
+		break;
+	case PMCLOG_TYPE_MAP_OUT:
+		PMCLOG_READ32(le,ev->pl_u.pl_mo.pl_pid);
+		PMCLOG_READADDR(le,ev->pl_u.pl_mo.pl_start);
+		PMCLOG_READADDR(le,ev->pl_u.pl_mo.pl_end);
+		break;
+	case PMCLOG_TYPE_PCSAMPLE:
+		PMCLOG_READ32(le,ev->pl_u.pl_s.pl_pid);
+		PMCLOG_READADDR(le,ev->pl_u.pl_s.pl_pc);
+		PMCLOG_READ32(le,ev->pl_u.pl_s.pl_pmcid);
+		PMCLOG_READ32(le,ev->pl_u.pl_s.pl_usermode);
+		break;
+	case PMCLOG_TYPE_PMCALLOCATE:
+		PMCLOG_READ32(le,ev->pl_u.pl_a.pl_pmcid);
+		PMCLOG_READ32(le,ev->pl_u.pl_a.pl_event);
+		PMCLOG_READ32(le,ev->pl_u.pl_a.pl_flags);
+		if ((ev->pl_u.pl_a.pl_evname =
+		    pmc_name_of_event(ev->pl_u.pl_a.pl_event)) == NULL)
+			goto error;
+		break;
+	case PMCLOG_TYPE_PMCATTACH:
+		PMCLOG_GET_PATHLEN(pathlen,evlen,pmclog_pmcattach);
+		PMCLOG_READ32(le,ev->pl_u.pl_t.pl_pmcid);
+		PMCLOG_READ32(le,ev->pl_u.pl_t.pl_pid);
+		PMCLOG_READSTRING(le,ev->pl_u.pl_t.pl_pathname,pathlen);
+		break;
+	case PMCLOG_TYPE_PMCDETACH:
+		PMCLOG_READ32(le,ev->pl_u.pl_d.pl_pmcid);
+		PMCLOG_READ32(le,ev->pl_u.pl_d.pl_pid);
+		break;
+	case PMCLOG_TYPE_PROCCSW:
+		PMCLOG_READ32(le,ev->pl_u.pl_c.pl_pmcid);
+		PMCLOG_READ64(le,ev->pl_u.pl_c.pl_value);
+		PMCLOG_READ32(le,ev->pl_u.pl_c.pl_pid);
+		break;
+	case PMCLOG_TYPE_PROCEXEC:
+		PMCLOG_GET_PATHLEN(pathlen,evlen,pmclog_procexec);
+		PMCLOG_READ32(le,ev->pl_u.pl_x.pl_pid);
+		PMCLOG_READADDR(le,ev->pl_u.pl_x.pl_entryaddr);
+		PMCLOG_READ32(le,ev->pl_u.pl_x.pl_pmcid);
+		PMCLOG_READSTRING(le,ev->pl_u.pl_x.pl_pathname,pathlen);
+		break;
+	case PMCLOG_TYPE_PROCEXIT:
+		PMCLOG_READ32(le,ev->pl_u.pl_e.pl_pmcid);
+		PMCLOG_READ64(le,ev->pl_u.pl_e.pl_value);
+		PMCLOG_READ32(le,ev->pl_u.pl_e.pl_pid);
+		break;
+	case PMCLOG_TYPE_PROCFORK:
+		PMCLOG_READ32(le,ev->pl_u.pl_f.pl_oldpid);
+		PMCLOG_READ32(le,ev->pl_u.pl_f.pl_newpid);
+		break;
+	case PMCLOG_TYPE_SYSEXIT:
+		PMCLOG_READ32(le,ev->pl_u.pl_se.pl_pid);
+		break;
+	case PMCLOG_TYPE_USERDATA:
+		PMCLOG_READ32(le,ev->pl_u.pl_u.pl_userdata);
+		break;
+	default:	/* unknown record type */
+		ps->ps_state = PL_STATE_ERROR;
+		ev->pl_state = PMCLOG_ERROR;
+		return -1;
+	}
+
+	ev->pl_offset = (ps->ps_offset += evlen);
+	ev->pl_count  = (ps->ps_count += 1);
+	ev->pl_state = PMCLOG_OK;
+	return 0;
+
+ error:
+	ev->pl_state = PMCLOG_ERROR;
+	ps->ps_state = PL_STATE_ERROR;
+	return -1;
+}
+
+/*
+ * Extract and return the next event from the byte stream.
+ *
+ * Returns 0 and sets the event's state to PMCLOG_OK in case an event
+ * was successfully parsed.  Otherwise this function returns -1 and
+ * sets the event's state to one of PMCLOG_REQUIRE_DATA (if more data
+ * is needed) or PMCLOG_EOF (if an EOF was seen) or PMCLOG_ERROR if
+ * a parse error was encountered.
+ */
+
+int
+pmclog_read(void *cookie, struct pmclog_ev *ev)
+{
+	int retval;
+	ssize_t nread;
+	struct pmclog_parse_state *ps;
+
+	ps = (struct pmclog_parse_state *) cookie;
+
+	if (ps->ps_state == PL_STATE_ERROR) {
+		ev->pl_state = PMCLOG_ERROR;
+		return -1;
+	}
+
+	/*
+	 * If there isn't enough data left for a new event try and get
+	 * more data.
+	 */
+	if (ps->ps_len == 0) {
+		ev->pl_state = PMCLOG_REQUIRE_DATA;
+
+		/*
+		 * If we have a valid file descriptor to read from, attempt
+		 * to read from that.  This read may return with an error,
+		 * (which may be EAGAIN or other recoverable error), or
+		 * can return EOF.
+		 */
+		if (ps->ps_fd != PMCLOG_FD_NONE) {
+		refill:
+			nread = read(ps->ps_fd, ps->ps_buffer,
+			    PMCLOG_BUFFER_SIZE);
+
+			if (nread <= 0) {
+				if (nread == 0)
+					ev->pl_state = PMCLOG_EOF;
+				else if (errno != EAGAIN) /* not restartable */
+					ev->pl_state = PMCLOG_ERROR;
+				return -1;
+			}
+
+			ps->ps_len = nread;
+			ps->ps_data = ps->ps_buffer;
+		} else
+			return -1;
+	}
+
+	assert(ps->ps_len > 0);
+
+
+	 /* Retrieve one event from the byte stream. */
+	retval = pmclog_get_event(ps, &ps->ps_data, &ps->ps_len, ev);
+
+	/*
+	 * If we need more data and we have a configured fd, try read
+	 * from it.
+	 */
+	if (retval < 0 && ev->pl_state == PMCLOG_REQUIRE_DATA &&
+	    ps->ps_fd != -1) {
+		assert(ps->ps_len == 0);
+		goto refill;
+	}
+
+	return retval;
+}
+
+/*
+ * Feed data to a memory based parser.
+ *
+ * The memory area pointed to by 'data' needs to be valid till the
+ * next error return from pmclog_next_event().
+ */
+
+int
+pmclog_feed(void *cookie, char *data, int len)
+{
+	struct pmclog_parse_state *ps;
+
+	ps = (struct pmclog_parse_state *) cookie;
+
+	if (len < 0 ||		/* invalid length */
+	    ps->ps_buffer ||	/* called for a file parser */
+	    ps->ps_len != 0)	/* unnecessary call */
+		return -1;
+
+	ps->ps_data = data;
+	ps->ps_len  = len;
+
+	return 0;
+}
+
+/*
+ * Allocate and initialize parser state.
+ */
+
+void *
+pmclog_open(int fd)
+{
+	struct pmclog_parse_state *ps;
+
+	if ((ps = (struct pmclog_parse_state *) malloc(sizeof(*ps))) == NULL)
+		return NULL;
+
+	ps->ps_state = PL_STATE_NEW_RECORD;
+	ps->ps_arch = -1;
+	ps->ps_initialized = 0;
+	ps->ps_count = 0;
+	ps->ps_offset = (off_t) 0;
+	bzero(&ps->ps_saved, sizeof(ps->ps_saved));
+	ps->ps_svcount = 0;
+	ps->ps_fd    = fd;
+	ps->ps_data  = NULL;
+	ps->ps_buffer = NULL;
+	ps->ps_len   = 0;
+
+	/* allocate space for a work area */
+	if (ps->ps_fd != PMCLOG_FD_NONE) {
+		if ((ps->ps_buffer = malloc(PMCLOG_BUFFER_SIZE)) == NULL)
+			return NULL;
+	}
+
+	return ps;
+}
+
+
+/*
+ * Free up parser state.
+ */
+
+void
+pmclog_close(void *cookie)
+{
+	struct pmclog_parse_state *ps;
+
+	ps = (struct pmclog_parse_state *) cookie;
+
+	if (ps->ps_buffer)
+		free(ps->ps_buffer);
+
+	free(ps);
+}
diff --git a/lib/libpmc/pmclog.h b/lib/libpmc/pmclog.h
new file mode 100644
index 0000000..84572ad
--- /dev/null
+++ b/lib/libpmc/pmclog.h
@@ -0,0 +1,154 @@
+/*-
+ * Copyright (c) 2005-2006 Joseph Koshy
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD: src/lib/libpmc/pmclog.h,v 1.3 2006-03-26 12:20:53 jkoshy Exp $
+ */
+
+#ifndef	_PMCLOG_H_
+#define	_PMCLOG_H_
+
+#include <sys/pmclog.h>
+
+enum pmclog_state {
+	PMCLOG_OK,
+	PMCLOG_EOF,
+	PMCLOG_REQUIRE_DATA,
+	PMCLOG_ERROR
+};
+
+struct pmclog_ev_dropnotify {
+};
+
+struct pmclog_ev_closelog {
+};
+
+struct pmclog_ev_initialize {
+	uint32_t	pl_version;
+	uint32_t	pl_arch;
+};
+
+struct pmclog_ev_map_in {
+	pid_t		pl_pid;
+	uintfptr_t	pl_start;
+	char		pl_pathname[PATH_MAX];
+};
+
+struct pmclog_ev_map_out {
+	pid_t		pl_pid;
+	uintfptr_t	pl_start;
+	uintfptr_t	pl_end;
+};
+
+struct pmclog_ev_pcsample {
+	uintfptr_t	pl_pc;
+	pid_t		pl_pid;
+	pmc_id_t	pl_pmcid;
+	uint32_t	pl_usermode;
+};
+
+struct pmclog_ev_pmcallocate {
+	uint32_t	pl_event;
+	const char *	pl_evname;
+	uint32_t	pl_flags;
+	pmc_id_t	pl_pmcid;
+};
+
+struct pmclog_ev_pmcattach {
+	pmc_id_t	pl_pmcid;
+	pid_t		pl_pid;
+	char		pl_pathname[PATH_MAX];
+};
+
+struct pmclog_ev_pmcdetach {
+	pmc_id_t	pl_pmcid;
+	pid_t		pl_pid;
+};
+
+struct pmclog_ev_proccsw {
+	pid_t		pl_pid;
+	pmc_id_t	pl_pmcid;
+	pmc_value_t	pl_value;
+};
+
+struct pmclog_ev_procexec {
+	pid_t		pl_pid;
+	pmc_id_t	pl_pmcid;
+	uintfptr_t	pl_entryaddr;
+	char		pl_pathname[PATH_MAX];
+};
+
+struct pmclog_ev_procexit {
+	uint32_t	pl_pid;
+	pmc_id_t	pl_pmcid;
+	pmc_value_t	pl_value;
+};
+
+struct pmclog_ev_procfork {
+	pid_t		pl_oldpid;
+	pid_t		pl_newpid;
+};
+
+struct pmclog_ev_sysexit {
+	pid_t		pl_pid;
+};
+
+struct pmclog_ev_userdata {
+	uint32_t	pl_userdata;
+};
+
+struct pmclog_ev {
+	enum pmclog_state pl_state;	/* state after 'get_event()' */
+	off_t		  pl_offset;	/* byte offset in stream */
+	size_t		  pl_count;	/* count of records so far */
+	struct timespec   pl_ts;	/* log entry timestamp */
+	enum pmclog_type  pl_type;	/* type of log entry */
+	union { 			/* log entry data */
+		struct pmclog_ev_closelog	pl_cl;
+		struct pmclog_ev_dropnotify	pl_dn;
+		struct pmclog_ev_initialize	pl_i;
+		struct pmclog_ev_map_in		pl_mi;
+		struct pmclog_ev_map_out	pl_mo;
+		struct pmclog_ev_pcsample	pl_s;
+		struct pmclog_ev_pmcallocate	pl_a;
+		struct pmclog_ev_pmcattach	pl_t;
+		struct pmclog_ev_pmcdetach	pl_d;
+		struct pmclog_ev_proccsw	pl_c;
+		struct pmclog_ev_procexec	pl_x;
+		struct pmclog_ev_procexit	pl_e;
+		struct pmclog_ev_procfork	pl_f;
+		struct pmclog_ev_sysexit	pl_se;
+		struct pmclog_ev_userdata	pl_u;
+	} pl_u;
+};
+
+#define	PMCLOG_FD_NONE				(-1)
+
+void	*pmclog_open(int _fd);
+int	pmclog_feed(void *_cookie, char *_data, int _len);
+int	pmclog_read(void *_cookie, struct pmclog_ev *_ev);
+void	pmclog_close(void *_cookie);
+
+#endif
+
diff --git a/sys/conf/files b/sys/conf/files
index 2a89e68..128c5c2 100644
--- a/sys/conf/files
+++ b/sys/conf/files
@@ -308,6 +308,8 @@ dev/netif/cs/if_cs_pccard.c	optional cs pccard
 dev/misc/dcons/dcons.c		optional dcons
 dev/misc/dcons/dcons_crom.c	optional dcons_crom
 dev/misc/dcons/dcons_os.c	optional dcons
+dev/misc/hwpmc/hwpmc_logging.c		optional hwpmc
+dev/misc/hwpmc/hwpmc_mod.c		optional hwpmc
 #dev/raid/dpt/dpt_control.c	optional dpt
 dev/raid/dpt/dpt_scsi.c	optional dpt
 dev/raid/dpt/dpt_eisa.c	optional dpt eisa
@@ -707,6 +709,7 @@ kern/lwkt_msgport.c	standard
 kern/lwkt_serialize.c	standard
 kern/lwkt_caps.c	standard
 kern/kern_dsched.c	standard
+kern/kern_pmc.c		standard
 kern/kern_sensors.c	standard
 kern/kern_spinlock.c	standard
 kern/kern_synch.c	standard
diff --git a/sys/conf/options b/sys/conf/options
index 31ec5f7..7575261 100644
--- a/sys/conf/options
+++ b/sys/conf/options
@@ -692,3 +692,5 @@ TDMA_TXRATE_11NA_DEFAULT	opt_tdma.h
 TDMA_TXRATE_11NG_DEFAULT	opt_tdma.h
 
 PANIC_REBOOT_WAIT_TIME	opt_panic.h
+
+HWPMC_HOOKS		opt_hwpmc_hooks.h
diff --git a/sys/cpu/i386/include/atomic.h b/sys/cpu/i386/include/atomic.h
index 1521b66..81ffe33 100644
--- a/sys/cpu/i386/include/atomic.h
+++ b/sys/cpu/i386/include/atomic.h
@@ -70,6 +70,9 @@
 #define ATOMIC_ASM(NAME, TYPE, OP, V)			\
 	extern void atomic_##NAME##_##TYPE(volatile u_##TYPE *p, u_##TYPE v); \
 	extern void atomic_##NAME##_##TYPE##_nonlocked(volatile u_##TYPE *p, u_##TYPE v);
+#define	ATOMIC_STORE_LOAD(TYPE, LOP, SOP)			\
+u_##TYPE	atomic_load_acq_##TYPE(volatile u_##TYPE *p);	\
+void		atomic_store_rel_##TYPE(volatile u_##TYPE *p, u_##TYPE v)
 #else /* !KLD_MODULE */
 #if defined(SMP) || !defined(_KERNEL)
 #define MPLOCKED	"lock ; "
@@ -107,6 +110,61 @@ atomic_##NAME##_##TYPE##_nonlocked(volatile u_##TYPE *p, u_##TYPE v)\
 			 : "iq" (V)); 			\
 }
 
+#if defined(_KERNEL) && !defined(SMP)
+
+/*
+ * We assume that a = b will do atomic loads and stores.  However, on a
+ * PentiumPro or higher, reads may pass writes, so for that case we have
+ * to use a serializing instruction (i.e. with LOCK) to do the load in
+ * SMP kernels.  For UP kernels, however, the cache of the single processor
+ * is always consistent, so we don't need any memory barriers.
+ */
+#define	ATOMIC_STORE_LOAD(TYPE, LOP, SOP)		\
+static __inline u_##TYPE				\
+atomic_load_acq_##TYPE(volatile u_##TYPE *p)		\
+{							\
+	return (*p);					\
+}							\
+							\
+static __inline void					\
+atomic_store_rel_##TYPE(volatile u_##TYPE *p, u_##TYPE v)\
+{							\
+	*p = v;						\
+}							\
+struct __hack
+
+#else /* !(_KERNEL && !SMP) */
+
+#define	ATOMIC_STORE_LOAD(TYPE, LOP, SOP)		\
+static __inline u_##TYPE				\
+atomic_load_acq_##TYPE(volatile u_##TYPE *p)		\
+{							\
+	u_##TYPE res;					\
+							\
+	__asm __volatile(MPLOCKED LOP			\
+	: "=a" (res),			/* 0 */		\
+	  "=m" (*p)			/* 1 */		\
+	: "m" (*p)			/* 2 */		\
+	: "memory");					\
+							\
+	return (res);					\
+}							\
+							\
+/*							\
+ * The XCHG instruction asserts LOCK automagically.	\
+ */							\
+static __inline void					\
+atomic_store_rel_##TYPE(volatile u_##TYPE *p, u_##TYPE v)\
+{							\
+	__asm __volatile(SOP				\
+	: "=m" (*p),			/* 0 */		\
+	  "+r" (v)			/* 1 */		\
+	: "m" (*p));			/* 2 */		\
+}							\
+struct __hack
+
+#endif /* _KERNEL && !SMP */
+
 #endif /* KLD_MODULE */
 
 /* egcs 1.1.2+ version */
@@ -154,6 +212,13 @@ atomic_readandclear_int(volatile u_int *addr)
 
 #endif /* KLD_MODULE */
 
+ATOMIC_STORE_LOAD(char,	"cmpxchgb %b0,%1", "xchgb %b1,%0");
+ATOMIC_STORE_LOAD(short,"cmpxchgw %w0,%1", "xchgw %w1,%0");
+ATOMIC_STORE_LOAD(int,	"cmpxchgl %0,%1",  "xchgl %1,%0");
+ATOMIC_STORE_LOAD(long,	"cmpxchgl %0,%1",  "xchgl %1,%0");
+
+#undef ATOMIC_ASM
+#undef ATOMIC_STORE_LOAD
 
 /*
  * atomic_poll_acquire_int(P)	Returns non-zero on success, 0 if the lock
diff --git a/sys/cpu/i386/include/cpu.h b/sys/cpu/i386/include/cpu.h
index acc0825..9f346a3 100644
--- a/sys/cpu/i386/include/cpu.h
+++ b/sys/cpu/i386/include/cpu.h
@@ -66,6 +66,10 @@
 #define CLKF_INTR(framep)	(mycpu->gd_intr_nesting_level > 1 || (curthread->td_flags & TDF_INTTHREAD))
 #define	CLKF_PC(framep)		((framep)->if_eip)
 
+#define	TRAPF_USERMODE(framep) \
+	((ISPL((framep)->tf_cs) == SEL_UPL) || ((framep)->tf_eflags & PSL_VM))
+#define	TRAPF_PC(framep)	((framep)->tf_eip)
+
 /*
  * Preempt the current process if in interrupt from user mode,
  * or after the current trap/syscall if in system mode.
diff --git a/sys/cpu/i386/include/pmc_mdep.h b/sys/cpu/i386/include/pmc_mdep.h
new file mode 100644
index 0000000..92bc697
--- /dev/null
+++ b/sys/cpu/i386/include/pmc_mdep.h
@@ -0,0 +1,83 @@
+/*-
+ * Copyright (c) 2003-2005 Joseph Koshy
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD: src/sys/i386/include/pmc_mdep.h,v 1.5 2005/06/09 19:45:07 jkoshy Exp $
+ */
+
+#ifndef _MACHINE_PMC_MDEP_H
+#define	_MACHINE_PMC_MDEP_H 1
+
+/*
+ * On the i386 platform we support the following PMCs.
+ *
+ * K7		AMD Athlon XP/MP and other 32 bit processors.
+ * K8		AMD Athlon64 and Opteron PMCs in 32 bit mode.
+ * PIV		Intel P4/HTT and P4/EMT64
+ * PPRO		Intel Pentium Pro, Pentium-II, Pentium-III, Celeron and
+ *		Pentium-M processors
+ * PENTIUM	Intel Pentium MMX.
+ */
+
+#include <dev/misc/hwpmc/hwpmc_amd.h> /* K7 and K8 */
+#include <dev/misc/hwpmc/hwpmc_piv.h>
+#include <dev/misc/hwpmc/hwpmc_ppro.h>
+#include <dev/misc/hwpmc/hwpmc_pentium.h>
+
+/*
+ * Architecture specific extensions to <sys/pmc.h> structures.
+ */
+
+union pmc_md_op_pmcallocate  {
+	struct pmc_md_amd_op_pmcallocate	pm_amd;
+ 	struct pmc_md_ppro_op_pmcallocate	pm_ppro;
+	struct pmc_md_pentium_op_pmcallocate	pm_pentium;
+	struct pmc_md_p4_op_pmcallocate		pm_p4;
+	uint64_t				__pad[4];
+};
+
+/* Logging */
+#define	PMCLOG_READADDR		PMCLOG_READ32
+#define	PMCLOG_EMITADDR		PMCLOG_EMIT32
+
+#ifdef _KERNEL
+
+/* MD extension for 'struct pmc' */
+union pmc_md_pmc  {
+	struct pmc_md_amd_pmc	pm_amd;
+	struct pmc_md_ppro_pmc	pm_ppro;
+	struct pmc_md_pentium_pmc pm_pentium;
+	struct pmc_md_p4_pmc	pm_p4;
+};
+
+struct pmc;
+
+/*
+ * Prototypes
+ */
+
+void	pmc_x86_lapic_enable_pmc_interrupt(void);
+
+#endif /* _KERNEL */
+#endif /* _MACHINE_PMC_MDEP_H */
diff --git a/sys/dev/misc/hwpmc/hwpmc_amd.c b/sys/dev/misc/hwpmc/hwpmc_amd.c
new file mode 100644
index 0000000..b344643
--- /dev/null
+++ b/sys/dev/misc/hwpmc/hwpmc_amd.c
@@ -0,0 +1,1002 @@
+/*-
+ * Copyright (c) 2003-2005 Joseph Koshy
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ */
+
+#include <sys/cdefs.h>
+/*__FBSDID("$FreeBSD: src/sys/dev/hwpmc/hwpmc_amd.c,v 1.13 2005/12/05 11:58:32 ru Exp $");*/
+
+/* Support for the AMD K7 and later processors */
+
+#include <sys/param.h>
+#include <sys/lock.h>
+#include <sys/malloc.h>
+#include <sys/pmc.h>
+#include <sys/systm.h>
+
+#include <machine/cpufunc.h>
+#include <machine/md_var.h>
+#include <machine/pmc_mdep.h>
+#include <machine/specialreg.h>
+
+#ifdef	DEBUG
+enum pmc_class	amd_pmc_class;
+#endif
+
+/* AMD K7 & K8 PMCs */
+struct amd_descr {
+	struct pmc_descr pm_descr;  /* "base class" */
+	uint32_t	pm_evsel;   /* address of EVSEL register */
+	uint32_t	pm_perfctr; /* address of PERFCTR register */
+};
+
+static  struct amd_descr amd_pmcdesc[AMD_NPMCS] =
+{
+    {
+	.pm_descr =
+	{
+		.pd_name  = "TSC",
+		.pd_class = PMC_CLASS_TSC,
+		.pd_caps  = PMC_CAP_READ,
+		.pd_width = 64
+	},
+	.pm_evsel   = MSR_TSC,
+	.pm_perfctr = 0	/* unused */
+    },
+
+    {
+	.pm_descr =
+	{
+		.pd_name  = "",
+		.pd_class = -1,
+		.pd_caps  = AMD_PMC_CAPS,
+		.pd_width = 48
+	},
+	.pm_evsel   = AMD_PMC_EVSEL_0,
+	.pm_perfctr = AMD_PMC_PERFCTR_0
+    },
+    {
+	.pm_descr =
+	{
+		.pd_name  = "",
+		.pd_class = -1,
+		.pd_caps  = AMD_PMC_CAPS,
+		.pd_width = 48
+	},
+	.pm_evsel   = AMD_PMC_EVSEL_1,
+	.pm_perfctr = AMD_PMC_PERFCTR_1
+    },
+    {
+	.pm_descr =
+	{
+		.pd_name  = "",
+		.pd_class = -1,
+		.pd_caps  = AMD_PMC_CAPS,
+		.pd_width = 48
+	},
+	.pm_evsel   = AMD_PMC_EVSEL_2,
+	.pm_perfctr = AMD_PMC_PERFCTR_2
+    },
+    {
+	.pm_descr =
+	{
+		.pd_name  = "",
+		.pd_class = -1,
+		.pd_caps  = AMD_PMC_CAPS,
+		.pd_width = 48
+	},
+	.pm_evsel   = AMD_PMC_EVSEL_3,
+	.pm_perfctr = AMD_PMC_PERFCTR_3
+    }
+};
+
+struct amd_event_code_map {
+	enum pmc_event	pe_ev;	 /* enum value */
+	uint8_t		pe_code; /* encoded event mask */
+	uint8_t		pe_mask; /* bits allowed in unit mask */
+};
+
+const struct amd_event_code_map amd_event_codes[] = {
+#if	defined(__i386__)	/* 32 bit Athlon (K7) only */
+	{ PMC_EV_K7_DC_ACCESSES, 		0x40, 0 },
+	{ PMC_EV_K7_DC_MISSES,			0x41, 0 },
+	{ PMC_EV_K7_DC_REFILLS_FROM_L2,		0x42, AMD_PMC_UNITMASK_MOESI },
+	{ PMC_EV_K7_DC_REFILLS_FROM_SYSTEM,	0x43, AMD_PMC_UNITMASK_MOESI },
+	{ PMC_EV_K7_DC_WRITEBACKS,		0x44, AMD_PMC_UNITMASK_MOESI },
+	{ PMC_EV_K7_L1_DTLB_MISS_AND_L2_DTLB_HITS, 0x45, 0 },
+	{ PMC_EV_K7_L1_AND_L2_DTLB_MISSES,	0x46, 0 },
+	{ PMC_EV_K7_MISALIGNED_REFERENCES,	0x47, 0 },
+
+	{ PMC_EV_K7_IC_FETCHES,			0x80, 0 },
+	{ PMC_EV_K7_IC_MISSES,			0x81, 0 },
+
+	{ PMC_EV_K7_L1_ITLB_MISSES,		0x84, 0 },
+	{ PMC_EV_K7_L1_L2_ITLB_MISSES,		0x85, 0 },
+
+	{ PMC_EV_K7_RETIRED_INSTRUCTIONS,	0xC0, 0 },
+	{ PMC_EV_K7_RETIRED_OPS,		0xC1, 0 },
+	{ PMC_EV_K7_RETIRED_BRANCHES,		0xC2, 0 },
+	{ PMC_EV_K7_RETIRED_BRANCHES_MISPREDICTED, 0xC3, 0 },
+	{ PMC_EV_K7_RETIRED_TAKEN_BRANCHES, 	0xC4, 0 },
+	{ PMC_EV_K7_RETIRED_TAKEN_BRANCHES_MISPREDICTED, 0xC5, 0 },
+	{ PMC_EV_K7_RETIRED_FAR_CONTROL_TRANSFERS, 0xC6, 0 },
+	{ PMC_EV_K7_RETIRED_RESYNC_BRANCHES,	0xC7, 0 },
+	{ PMC_EV_K7_INTERRUPTS_MASKED_CYCLES,	0xCD, 0 },
+	{ PMC_EV_K7_INTERRUPTS_MASKED_WHILE_PENDING_CYCLES, 0xCE, 0 },
+	{ PMC_EV_K7_HARDWARE_INTERRUPTS,	0xCF, 0 },
+#endif
+
+	{ PMC_EV_K8_FP_DISPATCHED_FPU_OPS,		0x00, 0x3F },
+	{ PMC_EV_K8_FP_CYCLES_WITH_NO_FPU_OPS_RETIRED,	0x01, 0x00 },
+	{ PMC_EV_K8_FP_DISPATCHED_FPU_FAST_FLAG_OPS,	0x02, 0x00 },
+
+	{ PMC_EV_K8_LS_SEGMENT_REGISTER_LOAD, 		0x20, 0x7F },
+	{ PMC_EV_K8_LS_MICROARCHITECTURAL_RESYNC_BY_SELF_MODIFYING_CODE,
+	  						0x21, 0x00 },
+	{ PMC_EV_K8_LS_MICROARCHITECTURAL_RESYNC_BY_SNOOP, 0x22, 0x00 },
+	{ PMC_EV_K8_LS_BUFFER2_FULL,			0x23, 0x00 },
+	{ PMC_EV_K8_LS_LOCKED_OPERATION,		0x24, 0x07 },
+	{ PMC_EV_K8_LS_MICROARCHITECTURAL_LATE_CANCEL,	0x25, 0x00 },
+	{ PMC_EV_K8_LS_RETIRED_CFLUSH_INSTRUCTIONS,	0x26, 0x00 },
+	{ PMC_EV_K8_LS_RETIRED_CPUID_INSTRUCTIONS,	0x27, 0x00 },
+
+	{ PMC_EV_K8_DC_ACCESS,				0x40, 0x00 },
+	{ PMC_EV_K8_DC_MISS,				0x41, 0x00 },
+	{ PMC_EV_K8_DC_REFILL_FROM_L2,			0x42, 0x1F },
+	{ PMC_EV_K8_DC_REFILL_FROM_SYSTEM,		0x43, 0x1F },
+	{ PMC_EV_K8_DC_COPYBACK,			0x44, 0x1F },
+	{ PMC_EV_K8_DC_L1_DTLB_MISS_AND_L2_DTLB_HIT,	0x45, 0x00 },
+	{ PMC_EV_K8_DC_L1_DTLB_MISS_AND_L2_DTLB_MISS,	0x46, 0x00 },
+	{ PMC_EV_K8_DC_MISALIGNED_DATA_REFERENCE,	0x47, 0x00 },
+	{ PMC_EV_K8_DC_MICROARCHITECTURAL_LATE_CANCEL,	0x48, 0x00 },
+	{ PMC_EV_K8_DC_MICROARCHITECTURAL_EARLY_CANCEL, 0x49, 0x00 },
+	{ PMC_EV_K8_DC_ONE_BIT_ECC_ERROR,		0x4A, 0x03 },
+	{ PMC_EV_K8_DC_DISPATCHED_PREFETCH_INSTRUCTIONS, 0x4B, 0x07 },
+	{ PMC_EV_K8_DC_DCACHE_ACCESSES_BY_LOCKS,	0x4C, 0x03 },
+
+	{ PMC_EV_K8_BU_CPU_CLK_UNHALTED,		0x76, 0x00 },
+	{ PMC_EV_K8_BU_INTERNAL_L2_REQUEST,		0x7D, 0x1F },
+	{ PMC_EV_K8_BU_FILL_REQUEST_L2_MISS,		0x7E, 0x07 },
+	{ PMC_EV_K8_BU_FILL_INTO_L2,			0x7F, 0x03 },
+
+	{ PMC_EV_K8_IC_FETCH,				0x80, 0x00 },
+	{ PMC_EV_K8_IC_MISS,				0x81, 0x00 },
+	{ PMC_EV_K8_IC_REFILL_FROM_L2,			0x82, 0x00 },
+	{ PMC_EV_K8_IC_REFILL_FROM_SYSTEM,		0x83, 0x00 },
+	{ PMC_EV_K8_IC_L1_ITLB_MISS_AND_L2_ITLB_HIT,	0x84, 0x00 },
+	{ PMC_EV_K8_IC_L1_ITLB_MISS_AND_L2_ITLB_MISS,	0x85, 0x00 },
+	{ PMC_EV_K8_IC_MICROARCHITECTURAL_RESYNC_BY_SNOOP, 0x86, 0x00 },
+	{ PMC_EV_K8_IC_INSTRUCTION_FETCH_STALL,		0x87, 0x00 },
+	{ PMC_EV_K8_IC_RETURN_STACK_HIT,		0x88, 0x00 },
+	{ PMC_EV_K8_IC_RETURN_STACK_OVERFLOW,		0x89, 0x00 },
+
+	{ PMC_EV_K8_FR_RETIRED_X86_INSTRUCTIONS,	0xC0, 0x00 },
+	{ PMC_EV_K8_FR_RETIRED_UOPS,			0xC1, 0x00 },
+	{ PMC_EV_K8_FR_RETIRED_BRANCHES,		0xC2, 0x00 },
+	{ PMC_EV_K8_FR_RETIRED_BRANCHES_MISPREDICTED,	0xC3, 0x00 },
+	{ PMC_EV_K8_FR_RETIRED_TAKEN_BRANCHES,		0xC4, 0x00 },
+	{ PMC_EV_K8_FR_RETIRED_TAKEN_BRANCHES_MISPREDICTED, 0xC5, 0x00 },
+	{ PMC_EV_K8_FR_RETIRED_FAR_CONTROL_TRANSFERS,	0xC6, 0x00 },
+	{ PMC_EV_K8_FR_RETIRED_RESYNCS,			0xC7, 0x00 },
+	{ PMC_EV_K8_FR_RETIRED_NEAR_RETURNS,		0xC8, 0x00 },
+	{ PMC_EV_K8_FR_RETIRED_NEAR_RETURNS_MISPREDICTED, 0xC9, 0x00 },
+	{ PMC_EV_K8_FR_RETIRED_TAKEN_BRANCHES_MISPREDICTED_BY_ADDR_MISCOMPARE,
+							0xCA, 0x00 },
+	{ PMC_EV_K8_FR_RETIRED_FPU_INSTRUCTIONS,	0xCB, 0x0F },
+	{ PMC_EV_K8_FR_RETIRED_FASTPATH_DOUBLE_OP_INSTRUCTIONS,
+							0xCC, 0x07 },
+	{ PMC_EV_K8_FR_INTERRUPTS_MASKED_CYCLES,	0xCD, 0x00 },
+	{ PMC_EV_K8_FR_INTERRUPTS_MASKED_WHILE_PENDING_CYCLES, 0xCE, 0x00 },
+	{ PMC_EV_K8_FR_TAKEN_HARDWARE_INTERRUPTS,	0xCF, 0x00 },
+
+	{ PMC_EV_K8_FR_DECODER_EMPTY,			0xD0, 0x00 },
+	{ PMC_EV_K8_FR_DISPATCH_STALLS,			0xD1, 0x00 },
+	{ PMC_EV_K8_FR_DISPATCH_STALL_FROM_BRANCH_ABORT_TO_RETIRE,
+							0xD2, 0x00 },
+	{ PMC_EV_K8_FR_DISPATCH_STALL_FOR_SERIALIZATION, 0xD3, 0x00 },
+	{ PMC_EV_K8_FR_DISPATCH_STALL_FOR_SEGMENT_LOAD,	0xD4, 0x00 },
+	{ PMC_EV_K8_FR_DISPATCH_STALL_WHEN_REORDER_BUFFER_IS_FULL,
+							0xD5, 0x00 },
+	{ PMC_EV_K8_FR_DISPATCH_STALL_WHEN_RESERVATION_STATIONS_ARE_FULL,
+							0xD6, 0x00 },
+	{ PMC_EV_K8_FR_DISPATCH_STALL_WHEN_FPU_IS_FULL,	0xD7, 0x00 },
+	{ PMC_EV_K8_FR_DISPATCH_STALL_WHEN_LS_IS_FULL,	0xD8, 0x00 },
+	{ PMC_EV_K8_FR_DISPATCH_STALL_WHEN_WAITING_FOR_ALL_TO_BE_QUIET,
+							0xD9, 0x00 },
+	{ PMC_EV_K8_FR_DISPATCH_STALL_WHEN_FAR_XFER_OR_RESYNC_BRANCH_PENDING,
+							0xDA, 0x00 },
+	{ PMC_EV_K8_FR_FPU_EXCEPTIONS,			0xDB, 0x0F },
+	{ PMC_EV_K8_FR_NUMBER_OF_BREAKPOINTS_FOR_DR0,	0xDC, 0x00 },
+	{ PMC_EV_K8_FR_NUMBER_OF_BREAKPOINTS_FOR_DR1,	0xDD, 0x00 },
+	{ PMC_EV_K8_FR_NUMBER_OF_BREAKPOINTS_FOR_DR2,	0xDE, 0x00 },
+	{ PMC_EV_K8_FR_NUMBER_OF_BREAKPOINTS_FOR_DR3,	0xDF, 0x00 },
+
+	{ PMC_EV_K8_NB_MEMORY_CONTROLLER_PAGE_ACCESS_EVENT, 0xE0, 0x7 },
+	{ PMC_EV_K8_NB_MEMORY_CONTROLLER_PAGE_TABLE_OVERFLOW, 0xE1, 0x00 },
+	{ PMC_EV_K8_NB_MEMORY_CONTROLLER_DRAM_COMMAND_SLOTS_MISSED,
+							0xE2, 0x00 },
+	{ PMC_EV_K8_NB_MEMORY_CONTROLLER_TURNAROUND,	0xE3, 0x07 },
+	{ PMC_EV_K8_NB_MEMORY_CONTROLLER_BYPASS_SATURATION, 0xE4, 0x0F },
+	{ PMC_EV_K8_NB_SIZED_COMMANDS,			0xEB, 0x7F },
+	{ PMC_EV_K8_NB_PROBE_RESULT,			0xEC, 0x0F },
+	{ PMC_EV_K8_NB_HT_BUS0_BANDWIDTH,		0xF6, 0x0F },
+	{ PMC_EV_K8_NB_HT_BUS1_BANDWIDTH,		0xF7, 0x0F },
+	{ PMC_EV_K8_NB_HT_BUS2_BANDWIDTH,		0xF8, 0x0F }
+
+};
+
+const int amd_event_codes_size =
+	sizeof(amd_event_codes) / sizeof(amd_event_codes[0]);
+
+/*
+ * read a pmc register
+ */
+
+static int
+amd_read_pmc(int cpu, int ri, pmc_value_t *v)
+{
+	enum pmc_mode mode;
+	const struct amd_descr *pd;
+	struct pmc *pm;
+	const struct pmc_hw *phw;
+	pmc_value_t tmp;
+
+	KASSERT(cpu >= 0 && cpu < ncpus,
+	    ("[amd,%d] illegal CPU value %d", __LINE__, cpu));
+	KASSERT(ri >= 0 && ri < AMD_NPMCS,
+	    ("[amd,%d] illegal row-index %d", __LINE__, ri));
+
+	phw = pmc_pcpu[cpu]->pc_hwpmcs[ri];
+	pd  = &amd_pmcdesc[ri];
+	pm  = phw->phw_pmc;
+
+	KASSERT(pm != NULL,
+	    ("[amd,%d] No owner for HWPMC [cpu%d,pmc%d]", __LINE__,
+		cpu, ri));
+
+	mode = PMC_TO_MODE(pm);
+
+	PMCDBG(MDP,REA,1,"amd-read id=%d class=%d", ri, pd->pm_descr.pd_class);
+
+	/* Reading the TSC is a special case */
+	if (pd->pm_descr.pd_class == PMC_CLASS_TSC) {
+		KASSERT(PMC_IS_COUNTING_MODE(mode),
+		    ("[amd,%d] TSC counter in non-counting mode", __LINE__));
+		*v = rdtsc();
+		PMCDBG(MDP,REA,2,"amd-read id=%d -> %jd", ri, *v);
+		return 0;
+	}
+
+#ifdef	DEBUG
+	KASSERT(pd->pm_descr.pd_class == amd_pmc_class,
+	    ("[amd,%d] unknown PMC class (%d)", __LINE__,
+		pd->pm_descr.pd_class));
+#endif
+
+	tmp = rdmsr(pd->pm_perfctr); /* RDMSR serializes */
+	if (PMC_IS_SAMPLING_MODE(mode))
+		*v = AMD_PERFCTR_VALUE_TO_RELOAD_COUNT(tmp);
+	else
+		*v = tmp;
+
+	PMCDBG(MDP,REA,2,"amd-read id=%d -> %jd", ri, *v);
+
+	return 0;
+}
+
+/*
+ * Write a PMC MSR.
+ */
+
+static int
+amd_write_pmc(int cpu, int ri, pmc_value_t v)
+{
+	const struct amd_descr *pd;
+	struct pmc *pm;
+	const struct pmc_hw *phw;
+	enum pmc_mode mode;
+
+	KASSERT(cpu >= 0 && cpu < ncpus,
+	    ("[amd,%d] illegal CPU value %d", __LINE__, cpu));
+	KASSERT(ri >= 0 && ri < AMD_NPMCS,
+	    ("[amd,%d] illegal row-index %d", __LINE__, ri));
+
+	phw = pmc_pcpu[cpu]->pc_hwpmcs[ri];
+	pd  = &amd_pmcdesc[ri];
+	pm  = phw->phw_pmc;
+
+	KASSERT(pm != NULL,
+	    ("[amd,%d] PMC not owned (cpu%d,pmc%d)", __LINE__,
+		cpu, ri));
+
+	mode = PMC_TO_MODE(pm);
+
+	if (pd->pm_descr.pd_class == PMC_CLASS_TSC)
+		return 0;
+
+#ifdef	DEBUG
+	KASSERT(pd->pm_descr.pd_class == amd_pmc_class,
+	    ("[amd,%d] unknown PMC class (%d)", __LINE__,
+		pd->pm_descr.pd_class));
+#endif
+
+	/* use 2's complement of the count for sampling mode PMCs */
+	if (PMC_IS_SAMPLING_MODE(mode))
+		v = AMD_RELOAD_COUNT_TO_PERFCTR_VALUE(v);
+
+	PMCDBG(MDP,WRI,1,"amd-write cpu=%d ri=%d v=%jx", cpu, ri, v);
+
+	/* write the PMC value */
+	wrmsr(pd->pm_perfctr, v);
+	return 0;
+}
+
+/*
+ * configure hardware pmc according to the configuration recorded in
+ * pmc 'pm'.
+ */
+
+static int
+amd_config_pmc(int cpu, int ri, struct pmc *pm)
+{
+	struct pmc_hw *phw;
+
+	PMCDBG(MDP,CFG,1, "cpu=%d ri=%d pm=%p", cpu, ri, pm);
+
+	KASSERT(cpu >= 0 && cpu < ncpus,
+	    ("[amd,%d] illegal CPU value %d", __LINE__, cpu));
+	KASSERT(ri >= 0 && ri < AMD_NPMCS,
+	    ("[amd,%d] illegal row-index %d", __LINE__, ri));
+
+	phw = pmc_pcpu[cpu]->pc_hwpmcs[ri];
+
+	KASSERT(pm == NULL || phw->phw_pmc == NULL,
+	    ("[amd,%d] pm=%p phw->pm=%p hwpmc not unconfigured",
+		__LINE__, pm, phw->phw_pmc));
+
+	phw->phw_pmc = pm;
+	return 0;
+}
+
+/*
+ * Retrieve a configured PMC pointer from hardware state.
+ */
+
+static int
+amd_get_config(int cpu, int ri, struct pmc **ppm)
+{
+	*ppm = pmc_pcpu[cpu]->pc_hwpmcs[ri]->phw_pmc;
+
+	return 0;
+}
+
+/*
+ * Machine dependent actions taken during the context switch in of a
+ * thread.
+ */
+
+static int
+amd_switch_in(struct pmc_cpu *pc, struct pmc_process *pp)
+{
+	(void) pc;
+
+	PMCDBG(MDP,SWI,1, "pc=%p pp=%p enable-msr=%d", pc, pp,
+	    (pp->pp_flags & PMC_PP_ENABLE_MSR_ACCESS) != 0);
+
+	/* enable the RDPMC instruction if needed */
+	if (pp->pp_flags & PMC_PP_ENABLE_MSR_ACCESS)
+		load_cr4(rcr4() | CR4_PCE);
+
+	return 0;
+}
+
+/*
+ * Machine dependent actions taken during the context switch out of a
+ * thread.
+ */
+
+static int
+amd_switch_out(struct pmc_cpu *pc, struct pmc_process *pp)
+{
+	(void) pc;
+	(void) pp;		/* can be NULL */
+
+	PMCDBG(MDP,SWO,1, "pc=%p pp=%p enable-msr=%d", pc, pp, pp ?
+	    (pp->pp_flags & PMC_PP_ENABLE_MSR_ACCESS) == 1 : 0);
+
+	/* always turn off the RDPMC instruction */
+	load_cr4(rcr4() & ~CR4_PCE);
+
+	return 0;
+}
+
+/*
+ * Check if a given allocation is feasible.
+ */
+
+static int
+amd_allocate_pmc(int cpu, int ri, struct pmc *pm,
+    const struct pmc_op_pmcallocate *a)
+{
+	int i;
+	uint32_t allowed_unitmask, caps, config, unitmask;
+	enum pmc_event pe;
+	const struct pmc_descr *pd;
+
+	(void) cpu;
+
+	KASSERT(cpu >= 0 && cpu < ncpus,
+	    ("[amd,%d] illegal CPU value %d", __LINE__, cpu));
+	KASSERT(ri >= 0 && ri < AMD_NPMCS,
+	    ("[amd,%d] illegal row index %d", __LINE__, ri));
+
+	pd = &amd_pmcdesc[ri].pm_descr;
+
+	/* check class match */
+	if (pd->pd_class != a->pm_class)
+		return EINVAL;
+
+	caps = pm->pm_caps;
+
+	PMCDBG(MDP,ALL,1,"amd-allocate ri=%d caps=0x%x", ri, caps);
+
+	if ((pd->pd_caps & caps) != caps)
+		return EPERM;
+	if (pd->pd_class == PMC_CLASS_TSC) {
+		/* TSC's are always allocated in system-wide counting mode */
+		if (a->pm_ev != PMC_EV_TSC_TSC ||
+		    a->pm_mode != PMC_MODE_SC)
+			return EINVAL;
+		return 0;
+	}
+
+#ifdef	DEBUG
+	KASSERT(pd->pd_class == amd_pmc_class,
+	    ("[amd,%d] Unknown PMC class (%d)", __LINE__, pd->pd_class));
+#endif
+
+	pe = a->pm_ev;
+
+	/* map ev to the correct event mask code */
+	config = allowed_unitmask = 0;
+	for (i = 0; i < amd_event_codes_size; i++)
+		if (amd_event_codes[i].pe_ev == pe) {
+			config =
+			    AMD_PMC_TO_EVENTMASK(amd_event_codes[i].pe_code);
+			allowed_unitmask =
+			    AMD_PMC_TO_UNITMASK(amd_event_codes[i].pe_mask);
+			break;
+		}
+	if (i == amd_event_codes_size)
+		return EINVAL;
+
+	unitmask = a->pm_md.pm_amd.pm_amd_config & AMD_PMC_UNITMASK;
+	if (unitmask & ~allowed_unitmask) /* disallow reserved bits */
+		return EINVAL;
+
+	if (unitmask && (caps & PMC_CAP_QUALIFIER))
+		config |= unitmask;
+
+	if (caps & PMC_CAP_THRESHOLD)
+		config |= a->pm_md.pm_amd.pm_amd_config & AMD_PMC_COUNTERMASK;
+
+	/* set at least one of the 'usr' or 'os' caps */
+	if (caps & PMC_CAP_USER)
+		config |= AMD_PMC_USR;
+	if (caps & PMC_CAP_SYSTEM)
+		config |= AMD_PMC_OS;
+	if ((caps & (PMC_CAP_USER|PMC_CAP_SYSTEM)) == 0)
+		config |= (AMD_PMC_USR|AMD_PMC_OS);
+
+	if (caps & PMC_CAP_EDGE)
+		config |= AMD_PMC_EDGE;
+	if (caps & PMC_CAP_INVERT)
+		config |= AMD_PMC_INVERT;
+	if (caps & PMC_CAP_INTERRUPT)
+		config |= AMD_PMC_INT;
+
+	pm->pm_md.pm_amd.pm_amd_evsel = config; /* save config value */
+
+	PMCDBG(MDP,ALL,2,"amd-allocate ri=%d -> config=0x%x", ri, config);
+
+	return 0;
+}
+
+/*
+ * Release machine dependent state associated with a PMC.  This is a
+ * no-op on this architecture.
+ *
+ */
+
+/* ARGSUSED0 */
+static int
+amd_release_pmc(int cpu, int ri, struct pmc *pmc)
+{
+#ifdef	DEBUG
+	const struct amd_descr *pd;
+#endif
+	struct pmc_hw *phw;
+
+	(void) pmc;
+
+	KASSERT(cpu >= 0 && cpu < ncpus,
+	    ("[amd,%d] illegal CPU value %d", __LINE__, cpu));
+	KASSERT(ri >= 0 && ri < AMD_NPMCS,
+	    ("[amd,%d] illegal row-index %d", __LINE__, ri));
+
+	phw = pmc_pcpu[cpu]->pc_hwpmcs[ri];
+
+	KASSERT(phw->phw_pmc == NULL,
+	    ("[amd,%d] PHW pmc %p non-NULL", __LINE__, phw->phw_pmc));
+
+#ifdef	DEBUG
+	pd = &amd_pmcdesc[ri];
+	if (pd->pm_descr.pd_class == amd_pmc_class)
+		KASSERT(AMD_PMC_IS_STOPPED(pd->pm_evsel),
+		    ("[amd,%d] PMC %d released while active", __LINE__, ri));
+#endif
+
+	return 0;
+}
+
+/*
+ * start a PMC.
+ */
+
+static int
+amd_start_pmc(int cpu, int ri)
+{
+	uint32_t config;
+	struct pmc *pm;
+	struct pmc_hw *phw;
+	const struct amd_descr *pd;
+
+	KASSERT(cpu >= 0 && cpu < ncpus,
+	    ("[amd,%d] illegal CPU value %d", __LINE__, cpu));
+	KASSERT(ri >= 0 && ri < AMD_NPMCS,
+	    ("[amd,%d] illegal row-index %d", __LINE__, ri));
+
+	phw = pmc_pcpu[cpu]->pc_hwpmcs[ri];
+	pm  = phw->phw_pmc;
+	pd = &amd_pmcdesc[ri];
+
+	KASSERT(pm != NULL,
+	    ("[amd,%d] starting cpu%d,pmc%d with null pmc record", __LINE__,
+		cpu, ri));
+
+	PMCDBG(MDP,STA,1,"amd-start cpu=%d ri=%d", cpu, ri);
+
+	if (pd->pm_descr.pd_class == PMC_CLASS_TSC)
+		return 0;	/* TSCs are always running */
+
+#ifdef	DEBUG
+	KASSERT(pd->pm_descr.pd_class == amd_pmc_class,
+	    ("[amd,%d] unknown PMC class (%d)", __LINE__,
+		pd->pm_descr.pd_class));
+#endif
+
+	KASSERT(AMD_PMC_IS_STOPPED(pd->pm_evsel),
+	    ("[amd,%d] pmc%d,cpu%d: Starting active PMC \"%s\"", __LINE__,
+	    ri, cpu, pd->pm_descr.pd_name));
+
+	/* turn on the PMC ENABLE bit */
+	config = pm->pm_md.pm_amd.pm_amd_evsel | AMD_PMC_ENABLE;
+
+	PMCDBG(MDP,STA,2,"amd-start config=0x%x", config);
+
+	wrmsr(pd->pm_evsel, config);
+	return 0;
+}
+
+/*
+ * Stop a PMC.
+ */
+
+static int
+amd_stop_pmc(int cpu, int ri)
+{
+	struct pmc *pm;
+	struct pmc_hw *phw;
+	const struct amd_descr *pd;
+	uint64_t config;
+
+	KASSERT(cpu >= 0 && cpu < ncpus,
+	    ("[amd,%d] illegal CPU value %d", __LINE__, cpu));
+	KASSERT(ri >= 0 && ri < AMD_NPMCS,
+	    ("[amd,%d] illegal row-index %d", __LINE__, ri));
+
+	phw = pmc_pcpu[cpu]->pc_hwpmcs[ri];
+	pm  = phw->phw_pmc;
+	pd  = &amd_pmcdesc[ri];
+
+	KASSERT(pm != NULL,
+	    ("[amd,%d] cpu%d,pmc%d no PMC to stop", __LINE__,
+		cpu, ri));
+
+	/* can't stop a TSC */
+	if (pd->pm_descr.pd_class == PMC_CLASS_TSC)
+		return 0;
+
+#ifdef	DEBUG
+	KASSERT(pd->pm_descr.pd_class == amd_pmc_class,
+	    ("[amd,%d] unknown PMC class (%d)", __LINE__,
+		pd->pm_descr.pd_class));
+#endif
+
+	KASSERT(!AMD_PMC_IS_STOPPED(pd->pm_evsel),
+	    ("[amd,%d] PMC%d, CPU%d \"%s\" already stopped",
+		__LINE__, ri, cpu, pd->pm_descr.pd_name));
+
+	PMCDBG(MDP,STO,1,"amd-stop ri=%d", ri);
+
+	/* turn off the PMC ENABLE bit */
+	config = pm->pm_md.pm_amd.pm_amd_evsel & ~AMD_PMC_ENABLE;
+	wrmsr(pd->pm_evsel, config);
+	return 0;
+}
+
+/*
+ * Interrupt handler.  This function needs to return '1' if the
+ * interrupt was this CPU's PMCs or '0' otherwise.  It is not allowed
+ * to sleep or do anything a 'fast' interrupt handler is not allowed
+ * to do.
+ */
+
+static int
+amd_intr(int cpu, uintptr_t eip, int usermode)
+{
+	int i, error, retval, ri;
+	uint32_t config, evsel, perfctr;
+	struct pmc *pm;
+	struct pmc_cpu *pc;
+	struct pmc_hw *phw;
+	pmc_value_t v;
+
+	KASSERT(cpu >= 0 && cpu < ncpus,
+	    ("[amd,%d] out of range CPU %d", __LINE__, cpu));
+
+	PMCDBG(MDP,INT,1, "cpu=%d eip=%p um=%d", cpu, (void *) eip,
+	    usermode);
+
+	retval = 0;
+
+	pc = pmc_pcpu[cpu];
+
+	/*
+	 * look for all PMCs that have interrupted:
+	 * - skip over the TSC [PMC#0]
+	 * - look for a running, sampling PMC which has overflowed
+	 *   and which has a valid 'struct pmc' association
+	 *
+	 * If found, we call a helper to process the interrupt.
+	 *
+	 * If multiple PMCs interrupt at the same time, the AMD64
+	 * processor appears to deliver as many NMIs as there are
+	 * outstanding PMC interrupts.  Thus we need to only process
+	 * one interrupt at a time.
+	 */
+
+	for (i = 0; retval == 0 && i < AMD_NPMCS-1; i++) {
+
+		ri = i + 1;	/* row index; TSC is at ri == 0 */
+
+		if (!AMD_PMC_HAS_OVERFLOWED(i))
+			continue;
+
+		phw = pc->pc_hwpmcs[ri];
+
+		KASSERT(phw != NULL, ("[amd,%d] null PHW pointer", __LINE__));
+
+		if ((pm = phw->phw_pmc) == NULL ||
+		    pm->pm_state != PMC_STATE_RUNNING ||
+		    !PMC_IS_SAMPLING_MODE(PMC_TO_MODE(pm))) {
+			continue;
+		}
+
+		retval = 1;	/* found an interrupting PMC */
+
+		/* stop the PMC, reload count */
+		evsel   = AMD_PMC_EVSEL_0 + i;
+		perfctr = AMD_PMC_PERFCTR_0 + i;
+		v       = pm->pm_sc.pm_reloadcount;
+		config  = rdmsr(evsel);
+
+		KASSERT((config & ~AMD_PMC_ENABLE) ==
+		    (pm->pm_md.pm_amd.pm_amd_evsel & ~AMD_PMC_ENABLE),
+		    ("[amd,%d] config mismatch reg=0x%x pm=0x%x", __LINE__,
+			config, pm->pm_md.pm_amd.pm_amd_evsel));
+
+		wrmsr(evsel, config & ~AMD_PMC_ENABLE);
+		wrmsr(perfctr, AMD_RELOAD_COUNT_TO_PERFCTR_VALUE(v));
+
+		/* restart the counter if there was no error during logging */
+		error = pmc_process_interrupt(cpu, pm, eip, usermode);
+		if (error == 0)
+			wrmsr(evsel, config | AMD_PMC_ENABLE);
+	}
+
+	atomic_add_int(retval ? &pmc_stats.pm_intr_processed :
+	    &pmc_stats.pm_intr_ignored, 1);
+
+	return retval;
+}
+
+/*
+ * describe a PMC
+ */
+static int
+amd_describe(int cpu, int ri, struct pmc_info *pi, struct pmc **ppmc)
+{
+	int error;
+	size_t copied;
+	const struct amd_descr *pd;
+	struct pmc_hw *phw;
+
+	KASSERT(cpu >= 0 && cpu < ncpus,
+	    ("[amd,%d] illegal CPU %d", __LINE__, cpu));
+	KASSERT(ri >= 0 && ri < AMD_NPMCS,
+	    ("[amd,%d] row-index %d out of range", __LINE__, ri));
+
+	phw = pmc_pcpu[cpu]->pc_hwpmcs[ri];
+	pd  = &amd_pmcdesc[ri];
+
+	if ((error = copystr(pd->pm_descr.pd_name, pi->pm_name,
+		 PMC_NAME_MAX, &copied)) != 0)
+		return error;
+
+	pi->pm_class = pd->pm_descr.pd_class;
+
+	if (phw->phw_state & PMC_PHW_FLAG_IS_ENABLED) {
+		pi->pm_enabled = TRUE;
+		*ppmc          = phw->phw_pmc;
+	} else {
+		pi->pm_enabled = FALSE;
+		*ppmc          = NULL;
+	}
+
+	return 0;
+}
+
+/*
+ * i386 specific entry points
+ */
+
+/*
+ * return the MSR address of the given PMC.
+ */
+
+static int
+amd_get_msr(int ri, uint32_t *msr)
+{
+	KASSERT(ri >= 0 && ri < AMD_NPMCS,
+	    ("[amd,%d] ri %d out of range", __LINE__, ri));
+
+	*msr = amd_pmcdesc[ri].pm_perfctr - AMD_PMC_PERFCTR_0;
+	return 0;
+}
+
+/*
+ * processor dependent initialization.
+ */
+
+/*
+ * Per-processor data structure
+ *
+ * [common stuff]
+ * [5 struct pmc_hw pointers]
+ * [5 struct pmc_hw structures]
+ */
+
+struct amd_cpu {
+	struct pmc_cpu	pc_common;
+	struct pmc_hw	*pc_hwpmcs[AMD_NPMCS];
+	struct pmc_hw	pc_amdpmcs[AMD_NPMCS];
+};
+
+
+static int
+amd_init(int cpu)
+{
+	int n;
+	struct amd_cpu *pcs;
+	struct pmc_hw  *phw;
+
+	KASSERT(cpu >= 0 && cpu < ncpus,
+	    ("[amd,%d] insane cpu number %d", __LINE__, cpu));
+
+	PMCDBG(MDP,INI,1,"amd-init cpu=%d", cpu);
+
+	MALLOC(pcs, struct amd_cpu *, sizeof(struct amd_cpu), M_PMC,
+	    M_WAITOK|M_ZERO);
+
+	phw = &pcs->pc_amdpmcs[0];
+
+	/*
+	 * Initialize the per-cpu mutex and set the content of the
+	 * hardware descriptors to a known state.
+	 */
+
+	for (n = 0; n < AMD_NPMCS; n++, phw++) {
+		phw->phw_state 	  = PMC_PHW_FLAG_IS_ENABLED |
+		    PMC_PHW_CPU_TO_STATE(cpu) | PMC_PHW_INDEX_TO_STATE(n);
+		phw->phw_pmc	  = NULL;
+		pcs->pc_hwpmcs[n] = phw;
+	}
+
+	/* Mark the TSC as shareable */
+	pcs->pc_hwpmcs[0]->phw_state |= PMC_PHW_FLAG_IS_SHAREABLE;
+
+	pmc_pcpu[cpu] = (struct pmc_cpu *) pcs;
+
+	return 0;
+}
+
+
+/*
+ * processor dependent cleanup prior to the KLD
+ * being unloaded
+ */
+
+static int
+amd_cleanup(int cpu)
+{
+	int i;
+	uint32_t evsel;
+	struct pmc_cpu *pcs;
+
+	KASSERT(cpu >= 0 && cpu < ncpus,
+	    ("[amd,%d] insane cpu number (%d)", __LINE__, cpu));
+
+	PMCDBG(MDP,INI,1,"amd-cleanup cpu=%d", cpu);
+
+	/*
+	 * First, turn off all PMCs on this CPU.
+	 */
+
+	for (i = 0; i < 4; i++) { /* XXX this loop is now not needed */
+		evsel = rdmsr(AMD_PMC_EVSEL_0 + i);
+		evsel &= ~AMD_PMC_ENABLE;
+		wrmsr(AMD_PMC_EVSEL_0 + i, evsel);
+	}
+
+	/*
+	 * Next, free up allocated space.
+	 */
+
+	if ((pcs = pmc_pcpu[cpu]) == NULL)
+		return 0;
+
+#ifdef	DEBUG
+	/* check the TSC */
+	KASSERT(pcs->pc_hwpmcs[0]->phw_pmc == NULL,
+	    ("[amd,%d] CPU%d,PMC0 still in use", __LINE__, cpu));
+	for (i = 1; i < AMD_NPMCS; i++) {
+		KASSERT(pcs->pc_hwpmcs[i]->phw_pmc == NULL,
+		    ("[amd,%d] CPU%d/PMC%d in use", __LINE__, cpu, i));
+		KASSERT(AMD_PMC_IS_STOPPED(AMD_PMC_EVSEL_0 + (i-1)),
+		    ("[amd,%d] CPU%d/PMC%d not stopped", __LINE__, cpu, i));
+	}
+#endif
+
+	pmc_pcpu[cpu] = NULL;
+	FREE(pcs, M_PMC);
+	return 0;
+}
+
+/*
+ * Initialize ourselves.
+ */
+
+struct pmc_mdep *
+pmc_amd_initialize(void)
+{
+	enum pmc_cputype cputype;
+	enum pmc_class class;
+	struct pmc_mdep *pmc_mdep;
+	char *name;
+	int i;
+
+	/*
+	 * The presence of hardware performance counters on the AMD
+	 * Athlon, Duron or later processors, is _not_ indicated by
+	 * any of the processor feature flags set by the 'CPUID'
+	 * instruction, so we only check the 'instruction family'
+	 * field returned by CPUID for instruction family >= 6.
+	 */
+
+	class = cputype = -1;
+	name = NULL;
+	switch (cpu_id & 0xF00) {
+	case 0x600:		/* Athlon(tm) processor */
+		cputype = PMC_CPU_AMD_K7;
+		class = PMC_CLASS_K7;
+		name = "K7";
+		break;
+	case 0xF00:		/* Athlon64/Opteron processor */
+		cputype = PMC_CPU_AMD_K8;
+		class = PMC_CLASS_K8;
+		name = "K8";
+		break;
+	}
+
+	if ((int) cputype == -1) {
+		(void) kprintf("pmc: Unknown AMD CPU.\n");
+		return NULL;
+	}
+
+#ifdef	DEBUG
+	amd_pmc_class = class;
+#endif
+
+	MALLOC(pmc_mdep, struct pmc_mdep *, sizeof(struct pmc_mdep),
+	    M_PMC, M_WAITOK|M_ZERO);
+
+	pmc_mdep->pmd_cputype	   = cputype;
+	pmc_mdep->pmd_npmc 	   = AMD_NPMCS;
+
+	/* this processor has two classes of usable PMCs */
+	pmc_mdep->pmd_nclass       = 2;
+
+	/* TSC */
+	pmc_mdep->pmd_classes[0].pm_class   = PMC_CLASS_TSC;
+	pmc_mdep->pmd_classes[0].pm_caps    = PMC_CAP_READ;
+	pmc_mdep->pmd_classes[0].pm_width   = 64;
+
+	/* AMD K7/K8 PMCs */
+	pmc_mdep->pmd_classes[1].pm_class   = class;
+	pmc_mdep->pmd_classes[1].pm_caps    = AMD_PMC_CAPS;
+	pmc_mdep->pmd_classes[1].pm_width   = 48;
+
+	pmc_mdep->pmd_nclasspmcs[0] = 1;
+	pmc_mdep->pmd_nclasspmcs[1] = (AMD_NPMCS-1);
+
+	/* fill in the correct pmc name and class */
+	for (i = 1; i < AMD_NPMCS; i++) {
+		(void) ksnprintf(amd_pmcdesc[i].pm_descr.pd_name,
+		    sizeof(amd_pmcdesc[i].pm_descr.pd_name), "%s-%d",
+		    name, i-1);
+		amd_pmcdesc[i].pm_descr.pd_class = class;
+	}
+
+	pmc_mdep->pmd_init    	   = amd_init;
+	pmc_mdep->pmd_cleanup 	   = amd_cleanup;
+	pmc_mdep->pmd_switch_in    = amd_switch_in;
+	pmc_mdep->pmd_switch_out   = amd_switch_out;
+	pmc_mdep->pmd_read_pmc 	   = amd_read_pmc;
+	pmc_mdep->pmd_write_pmc    = amd_write_pmc;
+	pmc_mdep->pmd_config_pmc   = amd_config_pmc;
+	pmc_mdep->pmd_get_config   = amd_get_config;
+	pmc_mdep->pmd_allocate_pmc = amd_allocate_pmc;
+	pmc_mdep->pmd_release_pmc  = amd_release_pmc;
+	pmc_mdep->pmd_start_pmc    = amd_start_pmc;
+	pmc_mdep->pmd_stop_pmc     = amd_stop_pmc;
+	pmc_mdep->pmd_intr	   = amd_intr;
+	pmc_mdep->pmd_describe     = amd_describe;
+	pmc_mdep->pmd_get_msr  	   = amd_get_msr; /* i386 */
+
+	PMCDBG(MDP,INI,0,"%s","amd-initialize");
+
+	return pmc_mdep;
+}
diff --git a/sys/dev/misc/hwpmc/hwpmc_amd.h b/sys/dev/misc/hwpmc/hwpmc_amd.h
new file mode 100644
index 0000000..8418f3a
--- /dev/null
+++ b/sys/dev/misc/hwpmc/hwpmc_amd.h
@@ -0,0 +1,103 @@
+/*-
+ * Copyright (c) 2005, Joseph Koshy
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD: src/sys/dev/hwpmc/hwpmc_amd.h,v 1.1 2005/06/09 19:45:07 jkoshy Exp $
+ */
+
+/* Machine dependent interfaces */
+
+#ifndef _DEV_HWPMC_AMD_H_
+#define	_DEV_HWPMC_AMD_H_ 1
+
+/* AMD K7 and K8 PMCs */
+
+#define	AMD_PMC_EVSEL_0		0xC0010000
+#define	AMD_PMC_EVSEL_1		0xC0010001
+#define	AMD_PMC_EVSEL_2		0xC0010002
+#define	AMD_PMC_EVSEL_3		0xC0010003
+
+#define	AMD_PMC_PERFCTR_0	0xC0010004
+#define	AMD_PMC_PERFCTR_1	0xC0010005
+#define	AMD_PMC_PERFCTR_2	0xC0010006
+#define	AMD_PMC_PERFCTR_3	0xC0010007
+
+
+#define	AMD_NPMCS		5 /* 1 TSC + 4 PMCs */
+
+#define	AMD_PMC_COUNTERMASK	0xFF000000
+#define	AMD_PMC_TO_COUNTER(x)	(((x) << 24) & AMD_PMC_COUNTERMASK)
+#define	AMD_PMC_INVERT		(1 << 23)
+#define	AMD_PMC_ENABLE		(1 << 22)
+#define	AMD_PMC_INT		(1 << 20)
+#define	AMD_PMC_PC		(1 << 19)
+#define	AMD_PMC_EDGE		(1 << 18)
+#define	AMD_PMC_OS		(1 << 17)
+#define	AMD_PMC_USR		(1 << 16)
+
+#define	AMD_PMC_UNITMASK_M	0x10
+#define	AMD_PMC_UNITMASK_O	0x08
+#define	AMD_PMC_UNITMASK_E	0x04
+#define	AMD_PMC_UNITMASK_S	0x02
+#define	AMD_PMC_UNITMASK_I	0x01
+#define	AMD_PMC_UNITMASK_MOESI	0x1F
+
+#define	AMD_PMC_UNITMASK	0xFF00
+#define	AMD_PMC_EVENTMASK 	0x00FF
+
+#define	AMD_PMC_TO_UNITMASK(x)	(((x) << 8) & AMD_PMC_UNITMASK)
+#define	AMD_PMC_TO_EVENTMASK(x)	((x) & 0xFF)
+#define	AMD_VALID_BITS		(AMD_PMC_COUNTERMASK | AMD_PMC_INVERT |	\
+	AMD_PMC_ENABLE | AMD_PMC_INT | AMD_PMC_PC | AMD_PMC_EDGE | 	\
+	AMD_PMC_OS | AMD_PMC_USR | AMD_PMC_UNITMASK | AMD_PMC_EVENTMASK)
+
+#define AMD_PMC_CAPS		(PMC_CAP_INTERRUPT | PMC_CAP_USER | 	\
+	PMC_CAP_SYSTEM | PMC_CAP_EDGE | PMC_CAP_THRESHOLD | 		\
+	PMC_CAP_READ | PMC_CAP_WRITE | PMC_CAP_INVERT | PMC_CAP_QUALIFIER)
+
+#define AMD_PMC_IS_STOPPED(evsel) ((rdmsr((evsel)) & AMD_PMC_ENABLE) == 0)
+#define AMD_PMC_HAS_OVERFLOWED(pmc) ((rdpmc(pmc) & (1ULL << 47)) == 0)
+
+#define	AMD_RELOAD_COUNT_TO_PERFCTR_VALUE(V)	(-(V))
+#define	AMD_PERFCTR_VALUE_TO_RELOAD_COUNT(P)	(-(P))
+
+struct pmc_md_amd_op_pmcallocate {
+	uint32_t	pm_amd_config;
+};
+
+#ifdef _KERNEL
+
+/* MD extension for 'struct pmc' */
+struct pmc_md_amd_pmc {
+	uint32_t	pm_amd_evsel;
+};
+
+/*
+ * Prototypes
+ */
+
+struct pmc_mdep *pmc_amd_initialize(void);		/* AMD K7/K8 PMCs */
+
+#endif /* _KERNEL */
+#endif /* _DEV_HWPMC_AMD_H_ */
diff --git a/sys/dev/misc/hwpmc/hwpmc_arm.c b/sys/dev/misc/hwpmc/hwpmc_arm.c
new file mode 100644
index 0000000..5f21184
--- /dev/null
+++ b/sys/dev/misc/hwpmc/hwpmc_arm.c
@@ -0,0 +1,40 @@
+/*-
+ * Copyright (c) 2005, Joseph Koshy
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD: src/sys/dev/hwpmc/hwpmc_arm.c,v 1.1 2005/06/09 19:45:07 jkoshy Exp $");
+
+#include <sys/param.h>
+#include <sys/pmc.h>
+
+#include <machine/pmc_mdep.h>
+
+struct pmc_mdep *
+pmc_md_initialize()
+{
+	return NULL;
+}
diff --git a/sys/dev/misc/hwpmc/hwpmc_ia64.c b/sys/dev/misc/hwpmc/hwpmc_ia64.c
new file mode 100644
index 0000000..1786b2c
--- /dev/null
+++ b/sys/dev/misc/hwpmc/hwpmc_ia64.c
@@ -0,0 +1,40 @@
+/*-
+ * Copyright (c) 2005, Joseph Koshy
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD: src/sys/dev/hwpmc/hwpmc_ia64.c,v 1.1 2005/06/09 19:45:07 jkoshy Exp $");
+
+#include <sys/param.h>
+#include <sys/pmc.h>
+
+#include <machine/pmc_mdep.h>
+
+struct pmc_mdep *
+pmc_md_initialize()
+{
+	return NULL;
+}
diff --git a/sys/dev/misc/hwpmc/hwpmc_logging.c b/sys/dev/misc/hwpmc/hwpmc_logging.c
new file mode 100644
index 0000000..8fc3647
--- /dev/null
+++ b/sys/dev/misc/hwpmc/hwpmc_logging.c
@@ -0,0 +1,1021 @@
+/*-
+ * Copyright (c) 2005 Joseph Koshy
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ */
+
+/*
+ * Logging code for hwpmc(4)
+ */
+
+#include <sys/cdefs.h>
+/* __FBSDID("$FreeBSD: src/sys/dev/hwpmc/hwpmc_logging.c,v 1.7 2007/04/19 08:02:51 jkoshy Exp $"); */
+
+#include <sys/param.h>
+#include <sys/file.h>
+#include <sys/file2.h>
+#include <sys/kernel.h>
+#include <sys/kthread.h>
+#include <sys/lock.h>
+#include <sys/module.h>
+#include <sys/pmc.h>
+#include <sys/pmclog.h>
+#include <sys/proc.h>
+#include <sys/signalvar.h>
+#include <sys/spinlock.h>
+#include <sys/spinlock2.h>
+#include <sys/sysctl.h>
+#include <sys/systm.h>
+#include <sys/uio.h>
+#include <sys/unistd.h>
+#include <sys/vnode.h>
+
+/*
+ * There will probably be a corresponding lock in dragonfly,
+ * until then keep the macros around as markers. If the
+ * semantics are not too different for our lock, we might
+ * reuse them.
+ */
+#define PROC_LOCK(e)	do { (void)(e);  } while(0)
+#define PROC_UNLOCK(e)	do { (void)(e);  } while(0)
+
+/*
+ * Sysctl tunables
+ */
+
+SYSCTL_DECL(_kern_hwpmc);
+
+/*
+ * kern.hwpmc.logbuffersize -- size of the per-cpu owner buffers.
+ */
+
+static int pmclog_buffer_size = PMC_LOG_BUFFER_SIZE;
+TUNABLE_INT(PMC_SYSCTL_NAME_PREFIX "logbuffersize", &pmclog_buffer_size);
+SYSCTL_INT(_kern_hwpmc, OID_AUTO, logbuffersize, CTLFLAG_RD,
+    &pmclog_buffer_size, 0, "size of log buffers in kilobytes");
+
+
+/*
+ * kern.hwpmc.nbuffer -- number of global log buffers
+ */
+
+static int pmc_nlogbuffers = PMC_NLOGBUFFERS;
+TUNABLE_INT(PMC_SYSCTL_NAME_PREFIX "nbuffers", &pmc_nlogbuffers);
+SYSCTL_INT(_kern_hwpmc, OID_AUTO, nbuffers, CTLFLAG_RD,
+    &pmc_nlogbuffers, 0, "number of global log buffers");
+
+/*
+ * Global log buffer list and associated spin lock.
+ */
+
+TAILQ_HEAD(, pmclog_buffer) pmc_bufferlist =
+	TAILQ_HEAD_INITIALIZER(pmc_bufferlist);
+static struct spinlock pmc_bufferlist_lock;	/* spin lock */
+static struct lock pmc_kthread_lock;	/* sleep lock */
+
+#define	PMCLOG_INIT_BUFFER_DESCRIPTOR(D) do {				\
+		const int __roundup = roundup(sizeof(*D),		\
+			sizeof(uint32_t));				\
+		(D)->plb_fence = ((char *) (D)) +			\
+			 1024*pmclog_buffer_size;			\
+		(D)->plb_base  = (D)->plb_ptr = ((char *) (D)) +	\
+			__roundup;					\
+	} while (0)
+
+
+/*
+ * Log file record constructors.
+ */
+
+#define	_PMCLOG_TO_HEADER(T,L)						\
+	((PMCLOG_HEADER_MAGIC << 24) |					\
+	 (PMCLOG_TYPE_ ## T << 16)   |					\
+	 ((L) & 0xFFFF))
+
+/* reserve LEN bytes of space and initialize the entry header */
+#define	_PMCLOG_RESERVE(PO,TYPE,LEN,ACTION) do {			\
+		uint32_t *_le;						\
+		int _len = roundup((LEN), sizeof(uint32_t));		\
+		if ((_le = pmclog_reserve((PO), _len)) == NULL) {	\
+			ACTION;						\
+		}							\
+		*_le = _PMCLOG_TO_HEADER(TYPE,_len);			\
+		_le += 3	/* skip over timestamp */
+
+#define	PMCLOG_RESERVE(P,T,L)		_PMCLOG_RESERVE(P,T,L,return)
+#define	PMCLOG_RESERVE_WITH_ERROR(P,T,L) _PMCLOG_RESERVE(P,T,L,		\
+	error=ENOMEM;goto error)
+
+#define	PMCLOG_EMIT32(V)	do { *_le++ = (V); } while (0)
+#define	PMCLOG_EMIT64(V)	do { 					\
+		*_le++ = (uint32_t) ((V) & 0xFFFFFFFF);			\
+		*_le++ = (uint32_t) (((V) >> 32) & 0xFFFFFFFF);		\
+	} while (0)
+
+
+/* Emit a string.  Caution: does NOT update _le, so needs to be last */
+#define	PMCLOG_EMITSTRING(S,L)	do { bcopy((S), _le, (L)); } while (0)
+
+#define	PMCLOG_DESPATCH(PO)						\
+		pmclog_release((PO));					\
+	} while (0)
+
+/*
+ * Assertions about the log file format.
+ */
+
+CTASSERT(sizeof(struct pmclog_closelog) == 3*4);
+CTASSERT(sizeof(struct pmclog_dropnotify) == 3*4);
+CTASSERT(sizeof(struct pmclog_map_in) == PATH_MAX +
+    4*4 + sizeof(uintfptr_t));
+CTASSERT(offsetof(struct pmclog_map_in,pl_pathname) ==
+    4*4 + sizeof(uintfptr_t));
+CTASSERT(sizeof(struct pmclog_map_out) == 4*4 + 2*sizeof(uintfptr_t));
+CTASSERT(sizeof(struct pmclog_pcsample) == 6*4 + sizeof(uintfptr_t));
+CTASSERT(sizeof(struct pmclog_pmcallocate) == 6*4);
+CTASSERT(sizeof(struct pmclog_pmcattach) == 5*4 + PATH_MAX);
+CTASSERT(offsetof(struct pmclog_pmcattach,pl_pathname) == 5*4);
+CTASSERT(sizeof(struct pmclog_pmcdetach) == 5*4);
+CTASSERT(sizeof(struct pmclog_proccsw) == 5*4 + 8);
+CTASSERT(sizeof(struct pmclog_procexec) == 5*4 + PATH_MAX +
+    sizeof(uintfptr_t));
+CTASSERT(offsetof(struct pmclog_procexec,pl_pathname) == 5*4 +
+    sizeof(uintfptr_t));
+CTASSERT(sizeof(struct pmclog_procexit) == 5*4 + 8);
+CTASSERT(sizeof(struct pmclog_procfork) == 5*4);
+CTASSERT(sizeof(struct pmclog_sysexit) == 4*4);
+CTASSERT(sizeof(struct pmclog_userdata) == 4*4);
+
+/*
+ * Log buffer structure
+ */
+
+struct pmclog_buffer {
+	TAILQ_ENTRY(pmclog_buffer) plb_next;
+	char 		*plb_base;
+	char		*plb_ptr;
+	char 		*plb_fence;
+};
+
+/*
+ * Prototypes
+ */
+
+static int pmclog_get_buffer(struct pmc_owner *po);
+static void pmclog_loop(void *arg);
+static void pmclog_release(struct pmc_owner *po);
+static uint32_t *pmclog_reserve(struct pmc_owner *po, int length);
+static void pmclog_schedule_io(struct pmc_owner *po);
+static void pmclog_stop_kthread(struct pmc_owner *po);
+
+/*
+ * Helper functions
+ */
+
+/*
+ * Get a log buffer
+ */
+
+static int
+pmclog_get_buffer(struct pmc_owner *po)
+{
+	struct pmclog_buffer *plb;
+
+	KASSERT(po->po_curbuf == NULL,
+	    ("[pmc,%d] po=%p current buffer still valid", __LINE__, po));
+
+	spin_lock_wr(&pmc_bufferlist_lock);
+	if ((plb = TAILQ_FIRST(&pmc_bufferlist)) != NULL)
+		TAILQ_REMOVE(&pmc_bufferlist, plb, plb_next);
+	spin_unlock_wr(&pmc_bufferlist_lock);
+
+	PMCDBG(LOG,GTB,1, "po=%p plb=%p", po, plb);
+
+#ifdef	DEBUG
+	if (plb)
+		KASSERT(plb->plb_ptr == plb->plb_base &&
+		    plb->plb_base < plb->plb_fence,
+		    ("[pmc,%d] po=%p buffer invariants: ptr=%p "
+		    "base=%p fence=%p", __LINE__, po, plb->plb_ptr,
+		    plb->plb_base, plb->plb_fence));
+#endif
+
+	po->po_curbuf = plb;
+
+	/* update stats */
+	atomic_add_int(&pmc_stats.pm_buffer_requests, 1);
+	if (plb == NULL)
+		atomic_add_int(&pmc_stats.pm_buffer_requests_failed, 1);
+
+	return plb ? 0 : ENOMEM;
+}
+
+/*
+ * Log handler loop.
+ *
+ * This function is executed by each pmc owner's helper thread.
+ */
+
+static void
+pmclog_loop(void *arg)
+{
+	int error;
+	struct pmc_owner *po;
+	struct pmclog_buffer *lb;
+	struct ucred *ownercred;
+	struct thread *td;
+	struct uio auio;
+	struct iovec aiov;
+	size_t nbytes;
+
+	po = (struct pmc_owner *) arg;
+	td = curthread;
+	ownercred = crhold(po->po_owner->p_ucred);
+
+	PMCDBG(LOG,INI,1, "po=%p kt=%p", po, po->po_kthread);
+	KASSERT(po->po_kthread == curthread,
+	    ("[pmc,%d] proc mismatch po=%p po/kt=%p curthread=%p", __LINE__,
+		po, po->po_kthread, curthread));
+	lb = NULL;
+
+
+	/*
+	 * Loop waiting for I/O requests to be added to the owner
+	 * struct's queue.  The loop is exited when the log file
+	 * is deconfigured.
+	 */
+
+	lockmgr(&pmc_kthread_lock, LK_EXCLUSIVE);
+
+	for (;;) {
+
+		/* check if we've been asked to exit */
+		if ((po->po_flags & PMC_PO_OWNS_LOGFILE) == 0)
+			break;
+
+		if (lb == NULL) { /* look for a fresh buffer to write */
+			spin_lock_wr(&po->po_lock);
+			if ((lb = TAILQ_FIRST(&po->po_logbuffers)) == NULL) {
+				spin_unlock_wr(&po->po_lock);
+
+				/* wakeup any processes waiting for a FLUSH */
+				if (po->po_flags & PMC_PO_IN_FLUSH) {
+					po->po_flags &= ~PMC_PO_IN_FLUSH;
+					wakeup_one(po->po_kthread);
+				}
+
+				/*
+				 * drop pmc_kthread_lock and go to sleep,
+				 * using a critical section to ensure
+				 * there's no race with a wakeup.
+				 */
+				crit_enter();
+				tsleep_interlock(po);
+				lockmgr(&pmc_kthread_lock, LK_RELEASE);
+				/* XXX: fbsd flags PWAIT -- agg */
+				tsleep(po, 0, "pmcloop", 0);
+				crit_exit();
+				/*
+				 * lock must be acquired at the beginning
+				 * of the loop
+				 */
+				lockmgr(&pmc_kthread_lock, LK_EXCLUSIVE);
+				continue;
+			}
+
+			TAILQ_REMOVE(&po->po_logbuffers, lb, plb_next);
+			spin_unlock_wr(&po->po_lock);
+		}
+
+		lockmgr(&pmc_kthread_lock, LK_RELEASE);
+
+		/* process the request */
+		PMCDBG(LOG,WRI,2, "po=%p base=%p ptr=%p", po,
+		    lb->plb_base, lb->plb_ptr);
+		/* change our thread's credentials before issuing the I/O */
+
+		aiov.iov_base = lb->plb_base;
+		aiov.iov_len  = nbytes = lb->plb_ptr - lb->plb_base;
+
+		auio.uio_iov    = &aiov;
+		auio.uio_iovcnt = 1;
+		auio.uio_offset = -1;
+		auio.uio_resid  = nbytes;
+		auio.uio_rw     = UIO_WRITE;
+		auio.uio_segflg = UIO_SYSSPACE;
+		auio.uio_td     = td;
+
+		error = fo_write(po->po_file, &auio, ownercred, 0);
+
+		lockmgr(&pmc_kthread_lock, LK_EXCLUSIVE);
+
+		if (error) {
+			/* XXX some errors are recoverable */
+			/* XXX also check for SIGPIPE if a socket */
+
+			/* send a SIGIO to the owner and exit */
+			PROC_LOCK(po->po_owner);
+			lwpsignal(po->po_owner, NULL, SIGIO);
+			PROC_UNLOCK(po->po_owner);
+
+			po->po_error = error; /* save for flush log */
+
+			PMCDBG(LOG,WRI,2, "po=%p error=%d", po, error);
+
+			break;
+		}
+
+		/* put the used buffer back into the global pool */
+		PMCLOG_INIT_BUFFER_DESCRIPTOR(lb);
+
+		spin_lock_wr(&pmc_bufferlist_lock);
+		TAILQ_INSERT_HEAD(&pmc_bufferlist, lb, plb_next);
+		spin_unlock_wr(&pmc_bufferlist_lock);
+
+		lb = NULL;
+	}
+
+	po->po_kthread = NULL;
+
+	lockmgr(&pmc_kthread_lock, LK_RELEASE);
+
+	/* return the current I/O buffer to the global pool */
+	if (lb) {
+		PMCLOG_INIT_BUFFER_DESCRIPTOR(lb);
+
+		spin_lock_wr(&pmc_bufferlist_lock);
+		TAILQ_INSERT_HEAD(&pmc_bufferlist, lb, plb_next);
+		spin_unlock_wr(&pmc_bufferlist_lock);
+	}
+
+	/*
+	 * Exit this thread, signalling the waiter
+	 */
+
+	crfree(ownercred);
+
+	/*
+	 * XXX: maybe do a wakeup in kthread_exit() or lwkt_exit()?
+	 */
+	wakeup(td);
+	kthread_exit();
+}
+
+/*
+ * Release and log entry and schedule an I/O if needed.
+ */
+
+static void
+pmclog_release(struct pmc_owner *po)
+{
+	KASSERT(po->po_curbuf->plb_ptr >= po->po_curbuf->plb_base,
+	    ("[pmc,%d] buffer invariants po=%p ptr=%p base=%p", __LINE__,
+		po, po->po_curbuf->plb_ptr, po->po_curbuf->plb_base));
+	KASSERT(po->po_curbuf->plb_ptr <= po->po_curbuf->plb_fence,
+	    ("[pmc,%d] buffer invariants po=%p ptr=%p fenc=%p", __LINE__,
+		po, po->po_curbuf->plb_ptr, po->po_curbuf->plb_fence));
+
+	/* schedule an I/O if we've filled a buffer */
+	if (po->po_curbuf->plb_ptr >= po->po_curbuf->plb_fence)
+		pmclog_schedule_io(po);
+
+	spin_unlock_wr(&po->po_lock);
+
+	PMCDBG(LOG,REL,1, "po=%p", po);
+}
+
+
+/*
+ * Attempt to reserve 'length' bytes of space in an owner's log
+ * buffer.  The function returns a pointer to 'length' bytes of space
+ * if there was enough space or returns NULL if no space was
+ * available.  Non-null returns do so with the po mutex locked.  The
+ * caller must invoke pmclog_release() on the pmc owner structure
+ * when done.
+ */
+
+static uint32_t *
+pmclog_reserve(struct pmc_owner *po, int length)
+{
+	uintptr_t newptr, oldptr;
+	uint32_t *lh;
+	struct timespec ts;
+
+	PMCDBG(LOG,ALL,1, "po=%p len=%d", po, length);
+
+	KASSERT(length % sizeof(uint32_t) == 0,
+	    ("[pmclog,%d] length not a multiple of word size", __LINE__));
+
+	spin_lock_wr(&po->po_lock);
+
+	if (po->po_curbuf == NULL)
+		if (pmclog_get_buffer(po) != 0) {
+			spin_unlock_wr(&po->po_lock);
+			return NULL;
+		}
+
+	KASSERT(po->po_curbuf != NULL,
+	    ("[pmc,%d] po=%p no current buffer", __LINE__, po));
+
+	KASSERT(po->po_curbuf->plb_ptr >= po->po_curbuf->plb_base &&
+	    po->po_curbuf->plb_ptr <= po->po_curbuf->plb_fence,
+	    ("[pmc,%d] po=%p buffer invariants: ptr=%p base=%p fence=%p",
+		__LINE__, po, po->po_curbuf->plb_ptr, po->po_curbuf->plb_base,
+		po->po_curbuf->plb_fence));
+
+	oldptr = (uintptr_t) po->po_curbuf->plb_ptr;
+	newptr = oldptr + length;
+
+	KASSERT(oldptr != (uintptr_t) NULL,
+	    ("[pmc,%d] po=%p Null log buffer pointer", __LINE__, po));
+
+	/*
+	 * If we have space in the current buffer, return a pointer to
+	 * available space with the PO structure locked.
+	 */
+	if (newptr <= (uintptr_t) po->po_curbuf->plb_fence) {
+		po->po_curbuf->plb_ptr = (char *) newptr;
+		goto done;
+	}
+
+	/*
+	 * Otherwise, schedule the current buffer for output and get a
+	 * fresh buffer.
+	 */
+	pmclog_schedule_io(po);
+
+	if (pmclog_get_buffer(po) != 0) {
+		spin_unlock_wr(&po->po_lock);
+		return NULL;
+	}
+
+	KASSERT(po->po_curbuf != NULL,
+	    ("[pmc,%d] po=%p no current buffer", __LINE__, po));
+
+	KASSERT(po->po_curbuf->plb_ptr != NULL,
+	    ("[pmc,%d] null return from pmc_get_log_buffer", __LINE__));
+
+	KASSERT(po->po_curbuf->plb_ptr == po->po_curbuf->plb_base &&
+	    po->po_curbuf->plb_ptr <= po->po_curbuf->plb_fence,
+	    ("[pmc,%d] po=%p buffer invariants: ptr=%p base=%p fence=%p",
+		__LINE__, po, po->po_curbuf->plb_ptr, po->po_curbuf->plb_base,
+		po->po_curbuf->plb_fence));
+
+	oldptr = (uintptr_t) po->po_curbuf->plb_ptr;
+
+ done:
+	lh = (uint32_t *) oldptr;
+	lh++;				/* skip header */
+	getnanotime(&ts);		/* fill in the timestamp */
+	*lh++ = ts.tv_sec & 0xFFFFFFFF;
+	*lh++ = ts.tv_nsec & 0xFFFFFFF;
+	return (uint32_t *) oldptr;
+}
+
+/*
+ * Schedule an I/O.
+ *
+ * Transfer the current buffer to the helper kthread.
+ */
+
+static void
+pmclog_schedule_io(struct pmc_owner *po)
+{
+	KASSERT(po->po_curbuf != NULL,
+	    ("[pmc,%d] schedule_io with null buffer po=%p", __LINE__, po));
+
+	KASSERT(po->po_curbuf->plb_ptr >= po->po_curbuf->plb_base,
+	    ("[pmc,%d] buffer invariants po=%p ptr=%p base=%p", __LINE__,
+		po, po->po_curbuf->plb_ptr, po->po_curbuf->plb_base));
+	KASSERT(po->po_curbuf->plb_ptr <= po->po_curbuf->plb_fence,
+	    ("[pmc,%d] buffer invariants po=%p ptr=%p fenc=%p", __LINE__,
+		po, po->po_curbuf->plb_ptr, po->po_curbuf->plb_fence));
+
+	PMCDBG(LOG,SIO, 1, "po=%p", po);
+
+	/*
+	 * Add the current buffer to the tail of the buffer list and
+	 * wakeup the helper.
+	 */
+	TAILQ_INSERT_TAIL(&po->po_logbuffers, po->po_curbuf, plb_next);
+	po->po_curbuf = NULL;
+	wakeup_one(po);
+}
+
+/*
+ * Stop the helper kthread.
+ */
+
+static void
+pmclog_stop_kthread(struct pmc_owner *po)
+{
+	/*
+	 * Unset flag, wakeup the helper thread,
+	 * wait for it to exit
+	 */
+
+	KKASSERT(lockstatus(&pmc_kthread_lock, curthread) == LK_EXCLUSIVE);
+	po->po_flags &= ~PMC_PO_OWNS_LOGFILE;
+	wakeup_one(po);
+	if (po->po_kthread) {
+		crit_enter();
+		tsleep_interlock(po->po_kthread);
+		lockmgr(&pmc_kthread_lock, LK_RELEASE);
+		/* XXX: fbsd flags PPAUSE -- agg */
+		tsleep(po->po_kthread, 0, "pmckstp", 0);
+		crit_exit();
+		lockmgr(&pmc_kthread_lock, LK_EXCLUSIVE);
+	}
+}
+
+/*
+ * Public functions
+ */
+
+/*
+ * Configure a log file for pmc owner 'po'.
+ *
+ * Parameter 'logfd' is a file handle referencing an open file in the
+ * owner process.  This file needs to have been opened for writing.
+ */
+
+int
+pmclog_configure_log(struct pmc_owner *po, int logfd)
+{
+	int error;
+	struct proc *p;
+
+	PMCDBG(LOG,CFG,1, "config po=%p logfd=%d", po, logfd);
+
+	p = po->po_owner;
+
+	/* return EBUSY if a log file was already present */
+	if (po->po_flags & PMC_PO_OWNS_LOGFILE)
+		return EBUSY;
+
+	KASSERT(po->po_kthread == NULL,
+	    ("[pmc,%d] po=%p kthread (%p) already present", __LINE__, po,
+		po->po_kthread));
+	KASSERT(po->po_file == NULL,
+	    ("[pmc,%d] po=%p file (%p) already present", __LINE__, po,
+		po->po_file));
+
+	error = holdvnode(curthread->td_proc->p_fd, logfd, &po->po_file);
+	if (error)
+		goto error;
+
+	/* mark process as owning a log file */
+	po->po_flags |= PMC_PO_OWNS_LOGFILE;
+	error = kthread_create(pmclog_loop, po, &po->po_kthread,
+					"hwpmc: proc(%d)", p->p_pid);
+	if (error)
+		goto error;
+
+	/* mark process as using HWPMCs */
+	PROC_LOCK(p);
+	p->p_flag |= P_HWPMC;
+	PROC_UNLOCK(p);
+
+	/* create a log initialization entry */
+	PMCLOG_RESERVE_WITH_ERROR(po, INITIALIZE,
+	    sizeof(struct pmclog_initialize));
+	PMCLOG_EMIT32(PMC_VERSION);
+	PMCLOG_EMIT32(md->pmd_cputype);
+	PMCLOG_DESPATCH(po);
+
+	return 0;
+
+ error:
+	/* shutdown the thread */
+	lockmgr(&pmc_kthread_lock, LK_EXCLUSIVE);
+	if (po->po_kthread)
+		pmclog_stop_kthread(po);
+	lockmgr(&pmc_kthread_lock, LK_RELEASE);
+
+	KASSERT(po->po_kthread == NULL, ("[pmc,%d] po=%p kthread not stopped",
+	    __LINE__, po));
+
+	if (po->po_file)
+		(void) fdrop(po->po_file);
+	po->po_file  = NULL;	/* clear file and error state */
+	po->po_error = 0;
+
+	return error;
+}
+
+
+/*
+ * De-configure a log file.  This will throw away any buffers queued
+ * for this owner process.
+ */
+
+int
+pmclog_deconfigure_log(struct pmc_owner *po)
+{
+	int error;
+	struct pmclog_buffer *lb;
+
+	PMCDBG(LOG,CFG,1, "de-config po=%p", po);
+
+	if ((po->po_flags & PMC_PO_OWNS_LOGFILE) == 0)
+		return EINVAL;
+
+	KASSERT(po->po_sscount == 0,
+	    ("[pmc,%d] po=%p still owning SS PMCs", __LINE__, po));
+	KASSERT(po->po_file != NULL,
+	    ("[pmc,%d] po=%p no log file", __LINE__, po));
+
+	/* stop the kthread, this will reset the 'OWNS_LOGFILE' flag */
+	lockmgr(&pmc_kthread_lock, LK_EXCLUSIVE);
+	if (po->po_kthread)
+		pmclog_stop_kthread(po);
+	lockmgr(&pmc_kthread_lock, LK_RELEASE);
+
+	KASSERT(po->po_kthread == NULL,
+	    ("[pmc,%d] po=%p kthread not stopped", __LINE__, po));
+
+	/* return all queued log buffers to the global pool */
+	while ((lb = TAILQ_FIRST(&po->po_logbuffers)) != NULL) {
+		TAILQ_REMOVE(&po->po_logbuffers, lb, plb_next);
+		PMCLOG_INIT_BUFFER_DESCRIPTOR(lb);
+		spin_lock_wr(&pmc_bufferlist_lock);
+		TAILQ_INSERT_HEAD(&pmc_bufferlist, lb, plb_next);
+		spin_unlock_wr(&pmc_bufferlist_lock);
+	}
+
+	/* return the 'current' buffer to the global pool */
+	if ((lb = po->po_curbuf) != NULL) {
+		PMCLOG_INIT_BUFFER_DESCRIPTOR(lb);
+		spin_lock_wr(&pmc_bufferlist_lock);
+		TAILQ_INSERT_HEAD(&pmc_bufferlist, lb, plb_next);
+		spin_unlock_wr(&pmc_bufferlist_lock);
+	}
+
+	/* drop a reference to the fd */
+	error = fdrop(po->po_file);
+	po->po_file  = NULL;
+	po->po_error = 0;
+
+	return error;
+}
+
+/*
+ * Flush a process' log buffer.
+ */
+
+int
+pmclog_flush(struct pmc_owner *po)
+{
+	int error, has_pending_buffers = 0;
+
+	PMCDBG(LOG,FLS,1, "po=%p", po);
+
+	/*
+	 * If there is a pending error recorded by the logger thread,
+	 * return that.
+	 */
+	if (po->po_error)
+		return po->po_error;
+
+	error = 0;
+
+	/*
+	 * Check that we do have an active log file.
+	 */
+	lockmgr(&pmc_kthread_lock, LK_EXCLUSIVE);
+	if ((po->po_flags & PMC_PO_OWNS_LOGFILE) == 0) {
+		error = EINVAL;
+		goto error;
+	}
+
+	/*
+	 * Schedule the current buffer if any.
+	 */
+	spin_lock_wr(&po->po_lock);
+	if (po->po_curbuf)
+		pmclog_schedule_io(po);
+	has_pending_buffers = !TAILQ_EMPTY(&po->po_logbuffers);
+	spin_unlock_wr(&po->po_lock);
+
+	if (has_pending_buffers) {
+		po->po_flags |= PMC_PO_IN_FLUSH; /* ask for a wakeup */
+		lockmgr(&pmc_kthread_lock, LK_RELEASE);
+		/* XXX: fbsd flags PWAIT -- agg */
+		error = tsleep(po->po_kthread, 0, "pmcflush", 0);
+	}
+
+ error:
+	if (!has_pending_buffers)
+		lockmgr(&pmc_kthread_lock, LK_RELEASE);
+
+	return error;
+}
+
+
+/*
+ * Send a 'close log' event to the log file.
+ */
+
+void
+pmclog_process_closelog(struct pmc_owner *po)
+{
+	PMCLOG_RESERVE(po,CLOSELOG,sizeof(struct pmclog_closelog));
+	PMCLOG_DESPATCH(po);
+}
+
+void
+pmclog_process_dropnotify(struct pmc_owner *po)
+{
+	PMCLOG_RESERVE(po,DROPNOTIFY,sizeof(struct pmclog_dropnotify));
+	PMCLOG_DESPATCH(po);
+}
+
+void
+pmclog_process_map_in(struct pmc_owner *po, pid_t pid, uintfptr_t start,
+    const char *path)
+{
+	int pathlen, recordlen;
+
+	KASSERT(path != NULL, ("[pmclog,%d] map-in, null path", __LINE__));
+
+	pathlen = strlen(path) + 1;	/* #bytes for path name */
+	recordlen = offsetof(struct pmclog_map_in, pl_pathname) +
+	    pathlen;
+
+	PMCLOG_RESERVE(po, MAP_IN, recordlen);
+	PMCLOG_EMIT32(pid);
+	PMCLOG_EMITADDR(start);
+	PMCLOG_EMITSTRING(path,pathlen);
+	PMCLOG_DESPATCH(po);
+}
+
+void
+pmclog_process_map_out(struct pmc_owner *po, pid_t pid, uintfptr_t start,
+    uintfptr_t end)
+{
+	KASSERT(start <= end, ("[pmclog,%d] start > end", __LINE__));
+
+	PMCLOG_RESERVE(po, MAP_OUT, sizeof(struct pmclog_map_out));
+	PMCLOG_EMIT32(pid);
+	PMCLOG_EMITADDR(start);
+	PMCLOG_EMITADDR(end);
+	PMCLOG_DESPATCH(po);
+}
+
+void
+pmclog_process_pcsample(struct pmc *pm, struct pmc_sample *ps)
+{
+	struct pmc_owner *po;
+
+	PMCDBG(LOG,SAM,1,"pm=%p pid=%d pc=%p", pm, ps->ps_pid,
+	    (void *) ps->ps_pc);
+
+	po = pm->pm_owner;
+
+	PMCLOG_RESERVE(po, PCSAMPLE, sizeof(struct pmclog_pcsample));
+	PMCLOG_EMIT32(ps->ps_pid);
+	PMCLOG_EMITADDR(ps->ps_pc);
+	PMCLOG_EMIT32(pm->pm_id);
+	PMCLOG_EMIT32(ps->ps_usermode);
+	PMCLOG_DESPATCH(po);
+}
+
+void
+pmclog_process_pmcallocate(struct pmc *pm)
+{
+	struct pmc_owner *po;
+
+	po = pm->pm_owner;
+
+	PMCDBG(LOG,ALL,1, "pm=%p", pm);
+
+	PMCLOG_RESERVE(po, PMCALLOCATE, sizeof(struct pmclog_pmcallocate));
+	PMCLOG_EMIT32(pm->pm_id);
+	PMCLOG_EMIT32(pm->pm_event);
+	PMCLOG_EMIT32(pm->pm_flags);
+	PMCLOG_DESPATCH(po);
+}
+
+void
+pmclog_process_pmcattach(struct pmc *pm, pid_t pid, char *path)
+{
+	int pathlen, recordlen;
+	struct pmc_owner *po;
+
+	PMCDBG(LOG,ATT,1,"pm=%p pid=%d", pm, pid);
+
+	po = pm->pm_owner;
+
+	pathlen = strlen(path) + 1;	/* #bytes for the string */
+	recordlen = offsetof(struct pmclog_pmcattach, pl_pathname) + pathlen;
+
+	PMCLOG_RESERVE(po, PMCATTACH, recordlen);
+	PMCLOG_EMIT32(pm->pm_id);
+	PMCLOG_EMIT32(pid);
+	PMCLOG_EMITSTRING(path, pathlen);
+	PMCLOG_DESPATCH(po);
+}
+
+void
+pmclog_process_pmcdetach(struct pmc *pm, pid_t pid)
+{
+	struct pmc_owner *po;
+
+	PMCDBG(LOG,ATT,1,"!pm=%p pid=%d", pm, pid);
+
+	po = pm->pm_owner;
+
+	PMCLOG_RESERVE(po, PMCDETACH, sizeof(struct pmclog_pmcdetach));
+	PMCLOG_EMIT32(pm->pm_id);
+	PMCLOG_EMIT32(pid);
+	PMCLOG_DESPATCH(po);
+}
+
+/*
+ * Log a context switch event to the log file.
+ */
+
+void
+pmclog_process_proccsw(struct pmc *pm, struct pmc_process *pp, pmc_value_t v)
+{
+	struct pmc_owner *po;
+
+	KASSERT(pm->pm_flags & PMC_F_LOG_PROCCSW,
+	    ("[pmclog,%d] log-process-csw called gratuitously", __LINE__));
+
+	PMCDBG(LOG,SWO,1,"pm=%p pid=%d v=%jx", pm, pp->pp_proc->p_pid,
+	    v);
+
+	po = pm->pm_owner;
+
+	PMCLOG_RESERVE(po, PROCCSW, sizeof(struct pmclog_proccsw));
+	PMCLOG_EMIT32(pm->pm_id);
+	PMCLOG_EMIT64(v);
+	PMCLOG_EMIT32(pp->pp_proc->p_pid);
+	PMCLOG_DESPATCH(po);
+}
+
+void
+pmclog_process_procexec(struct pmc_owner *po, pmc_id_t pmid, pid_t pid,
+    uintfptr_t startaddr, char *path)
+{
+	int pathlen, recordlen;
+
+	PMCDBG(LOG,EXC,1,"po=%p pid=%d path=\"%s\"", po, pid, path);
+
+	pathlen   = strlen(path) + 1;	/* #bytes for the path */
+	recordlen = offsetof(struct pmclog_procexec, pl_pathname) + pathlen;
+
+	PMCLOG_RESERVE(po, PROCEXEC, recordlen);
+	PMCLOG_EMIT32(pid);
+	PMCLOG_EMITADDR(startaddr);
+	PMCLOG_EMIT32(pmid);
+	PMCLOG_EMITSTRING(path,pathlen);
+	PMCLOG_DESPATCH(po);
+}
+
+/*
+ * Log a process exit event (and accumulated pmc value) to the log file.
+ */
+
+void
+pmclog_process_procexit(struct pmc *pm, struct pmc_process *pp)
+{
+	int ri;
+	struct pmc_owner *po;
+
+	ri = PMC_TO_ROWINDEX(pm);
+	PMCDBG(LOG,EXT,1,"pm=%p pid=%d v=%jx", pm, pp->pp_proc->p_pid,
+	    pp->pp_pmcs[ri].pp_pmcval);
+
+	po = pm->pm_owner;
+
+	PMCLOG_RESERVE(po, PROCEXIT, sizeof(struct pmclog_procexit));
+	PMCLOG_EMIT32(pm->pm_id);
+	PMCLOG_EMIT64(pp->pp_pmcs[ri].pp_pmcval);
+	PMCLOG_EMIT32(pp->pp_proc->p_pid);
+	PMCLOG_DESPATCH(po);
+}
+
+/*
+ * Log a fork event.
+ */
+
+void
+pmclog_process_procfork(struct pmc_owner *po, pid_t oldpid, pid_t newpid)
+{
+	PMCLOG_RESERVE(po, PROCFORK, sizeof(struct pmclog_procfork));
+	PMCLOG_EMIT32(oldpid);
+	PMCLOG_EMIT32(newpid);
+	PMCLOG_DESPATCH(po);
+}
+
+/*
+ * Log a process exit event of the form suitable for system-wide PMCs.
+ */
+
+void
+pmclog_process_sysexit(struct pmc_owner *po, pid_t pid)
+{
+	PMCLOG_RESERVE(po, SYSEXIT, sizeof(struct pmclog_sysexit));
+	PMCLOG_EMIT32(pid);
+	PMCLOG_DESPATCH(po);
+}
+
+/*
+ * Write a user log entry.
+ */
+
+int
+pmclog_process_userlog(struct pmc_owner *po, struct pmc_op_writelog *wl)
+{
+	int error;
+
+	PMCDBG(LOG,WRI,1, "writelog po=%p ud=0x%x", po, wl->pm_userdata);
+
+	error = 0;
+
+	PMCLOG_RESERVE_WITH_ERROR(po, USERDATA,
+	    sizeof(struct pmclog_userdata));
+	PMCLOG_EMIT32(wl->pm_userdata);
+	PMCLOG_DESPATCH(po);
+
+ error:
+	return error;
+}
+
+/*
+ * Initialization.
+ *
+ * Create a pool of log buffers and initialize mutexes.
+ */
+
+void
+pmclog_initialize()
+{
+	int n;
+	struct pmclog_buffer *plb;
+
+	if (pmclog_buffer_size <= 0) {
+		(void) kprintf("hwpmc: tunable logbuffersize=%d must be greater "
+		    "than zero.\n", pmclog_buffer_size);
+		pmclog_buffer_size = PMC_LOG_BUFFER_SIZE;
+	}
+
+	if (pmc_nlogbuffers <= 0) {
+		(void) kprintf("hwpmc: tunable nlogbuffers=%d must be greater "
+		    "than zero.\n", pmc_nlogbuffers);
+		pmc_nlogbuffers = PMC_NLOGBUFFERS;
+	}
+
+	/* create global pool of log buffers */
+	for (n = 0; n < pmc_nlogbuffers; n++) {
+		MALLOC(plb, struct pmclog_buffer *, 1024 * pmclog_buffer_size,
+		    M_PMC, M_ZERO|M_WAITOK);
+		PMCLOG_INIT_BUFFER_DESCRIPTOR(plb);
+		TAILQ_INSERT_HEAD(&pmc_bufferlist, plb, plb_next);
+	}
+	spin_init(&pmc_bufferlist_lock);
+	lockinit(&pmc_kthread_lock, "pmc-sleep", 0, 0);
+}
+
+/*
+ * Shutdown logging.
+ *
+ * Destroy mutexes and release memory back the to free pool.
+ */
+
+void
+pmclog_shutdown()
+{
+	struct pmclog_buffer *plb;
+
+	lockuninit(&pmc_kthread_lock);
+	spin_uninit(&pmc_bufferlist_lock);
+
+	while ((plb = TAILQ_FIRST(&pmc_bufferlist)) != NULL) {
+		TAILQ_REMOVE(&pmc_bufferlist, plb, plb_next);
+		FREE(plb, M_PMC);
+	}
+}
diff --git a/sys/dev/misc/hwpmc/hwpmc_mod.c b/sys/dev/misc/hwpmc/hwpmc_mod.c
new file mode 100644
index 0000000..46a9931
--- /dev/null
+++ b/sys/dev/misc/hwpmc/hwpmc_mod.c
@@ -0,0 +1,4467 @@
+/*-
+ * Copyright (c) 2003-2006 Joseph Koshy
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ */
+
+#include <sys/cdefs.h>
+/* __FBSDID("$FreeBSD: src/sys/dev/hwpmc/hwpmc_mod.c,v 1.29 2007/06/05 00:00:50 jeff Exp $"); */
+
+#include <sys/param.h>
+#include <sys/eventhandler.h>
+#include <sys/jail.h>
+#include <sys/kernel.h>
+#include <sys/kthread.h>
+#include <sys/lock.h>
+#include <sys/malloc.h>
+#include <sys/module.h>
+#include <sys/pmc.h>
+#include <sys/pmckern.h>
+#include <sys/pmclog.h>
+#include <sys/proc.h>
+#include <sys/queue.h>
+#include <sys/resourcevar.h>
+#include <sys/sched.h>
+#include <sys/signalvar.h>
+#include <sys/spinlock.h>
+#include <sys/spinlock2.h>
+#include <sys/sysctl.h>
+#include <sys/sysent.h>
+#include <sys/systm.h>
+#include <sys/vnode.h>
+
+#include <sys/linker.h>		/* needs to be after <sys/malloc.h> */
+
+#include <machine/atomic.h>
+#include <machine/limits.h>
+#include <machine/md_var.h>
+#include <machine/smp.h>
+#include <sys/ktr.h> /* XXX */
+
+KTR_INFO_MASTER(hwpmctr);
+KTR_INFO(!0, hwpmctr, regval, 0, "r=%lld", sizeof(int64_t));
+
+#define PROC_LOCK(p)	do { (void)p; } while(0)
+#define PROC_UNLOCK(p)	do { (void)p; } while(0)
+
+static __inline void
+critical_enter(void)
+{
+	/* no preemption in the dragonfly kernel */
+}
+static __inline void
+critical_exit(void)
+{
+}
+
+/* I think we need giant for process manipulation etc -- agg */
+#define DROP_GIANT()	do {} while(0)
+#define PICKUP_GIANT()	do {} while(0)
+
+#define PRIV_PMC_MANAGE 0
+#define PRIV_PMC_SYSTEM 0
+static __inline int
+priv_check(struct thread *td, int priv)
+{
+	/*
+	 * FIXME: don't have privs in dfly, just use root for now -- agg
+	 * XXX: jail?
+	 */
+	return suser(td);
+}
+
+static __inline int
+p_candebug(struct thread *td, struct proc *p)
+{
+	/*
+	 * FIXME: need to bring in some stuff from freebsd which will
+	 * require some code reorganization. TBD -- agg
+	 */
+	return 0;
+}
+
+/*
+ * Types
+ */
+
+enum pmc_flags {
+	PMC_FLAG_NONE	  = 0x00, /* do nothing */
+	PMC_FLAG_REMOVE   = 0x01, /* atomically remove entry from hash */
+	PMC_FLAG_ALLOCATE = 0x02, /* add entry to hash if not found */
+};
+
+/*
+ * The offset in sysent where the syscall is allocated.
+ */
+
+static int pmc_syscall_num = NO_SYSCALL;
+struct pmc_cpu		**pmc_pcpu;	 /* per-cpu state */
+pmc_value_t		*pmc_pcpu_saved; /* saved PMC values: CSW handling */
+
+#define	PMC_PCPU_SAVED(C,R)	pmc_pcpu_saved[(R) + md->pmd_npmc*(C)]
+
+static int		*pmc_pmcdisp;	 /* PMC row dispositions */
+
+#define	PMC_ROW_DISP_IS_FREE(R)		(pmc_pmcdisp[(R)] == 0)
+#define	PMC_ROW_DISP_IS_THREAD(R)	(pmc_pmcdisp[(R)] > 0)
+#define	PMC_ROW_DISP_IS_STANDALONE(R)	(pmc_pmcdisp[(R)] < 0)
+
+#define	PMC_MARK_ROW_FREE(R) do {					  \
+	pmc_pmcdisp[(R)] = 0;						  \
+} while (0)
+
+#define	PMC_MARK_ROW_STANDALONE(R) do {					  \
+	KASSERT(pmc_pmcdisp[(R)] <= 0, ("[pmc,%d] row disposition error", \
+		    __LINE__));						  \
+	atomic_add_int(&pmc_pmcdisp[(R)], -1);				  \
+	KASSERT(pmc_pmcdisp[(R)] >= (-ncpus), ("[pmc,%d] row "	  \
+		"disposition error", __LINE__));			  \
+} while (0)
+
+#define	PMC_UNMARK_ROW_STANDALONE(R) do { 				  \
+	atomic_add_int(&pmc_pmcdisp[(R)], 1);				  \
+	KASSERT(pmc_pmcdisp[(R)] <= 0, ("[pmc,%d] row disposition error", \
+		    __LINE__));						  \
+} while (0)
+
+#define	PMC_MARK_ROW_THREAD(R) do {					  \
+	KASSERT(pmc_pmcdisp[(R)] >= 0, ("[pmc,%d] row disposition error", \
+		    __LINE__));						  \
+	atomic_add_int(&pmc_pmcdisp[(R)], 1);				  \
+} while (0)
+
+#define	PMC_UNMARK_ROW_THREAD(R) do {					  \
+	atomic_add_int(&pmc_pmcdisp[(R)], -1);				  \
+	KASSERT(pmc_pmcdisp[(R)] >= 0, ("[pmc,%d] row disposition error", \
+		    __LINE__));						  \
+} while (0)
+
+
+/* various event handlers */
+static eventhandler_tag	pmc_exit_tag, pmc_fork_tag;
+
+/* Module statistics */
+struct pmc_op_getdriverstats pmc_stats;
+
+/* Machine/processor dependent operations */
+struct pmc_mdep  *md;
+
+/*
+ * Hash tables mapping owner processes and target threads to PMCs.
+ */
+
+struct spinlock pmc_processhash_lock;		/* spin lock */
+static u_long pmc_processhashmask;
+static LIST_HEAD(pmc_processhash, pmc_process)	*pmc_processhash;
+
+/*
+ * Hash table of PMC owner descriptors.  This table is protected by
+ * the shared PMC "sx" lock.
+ */
+
+static u_long pmc_ownerhashmask;
+static LIST_HEAD(pmc_ownerhash, pmc_owner)	*pmc_ownerhash;
+
+/*
+ * List of PMC owners with system-wide sampling PMCs.
+ */
+
+static LIST_HEAD(, pmc_owner)			pmc_ss_owners;
+
+
+/*
+ * Prototypes
+ */
+
+#ifdef	DEBUG
+static int	pmc_debugflags_sysctl_handler(SYSCTL_HANDLER_ARGS);
+static int	pmc_debugflags_parse(char *newstr, char *fence);
+#endif
+
+static int	load(struct module *module, int cmd, void *arg);
+static int	pmc_attach_process(struct proc *p, struct pmc *pm);
+static struct pmc *pmc_allocate_pmc_descriptor(void);
+static struct pmc_owner *pmc_allocate_owner_descriptor(struct proc *p);
+static int	pmc_attach_one_process(struct proc *p, struct pmc *pm);
+static int	pmc_can_allocate_rowindex(struct proc *p, unsigned int ri,
+    int cpu);
+static int	pmc_can_attach(struct pmc *pm, struct proc *p);
+static void	pmc_cleanup(void);
+static int	pmc_detach_process(struct proc *p, struct pmc *pm);
+static int	pmc_detach_one_process(struct proc *p, struct pmc *pm,
+    int flags);
+static void	pmc_destroy_owner_descriptor(struct pmc_owner *po);
+static struct pmc_owner *pmc_find_owner_descriptor(struct proc *p);
+static int	pmc_find_pmc(pmc_id_t pmcid, struct pmc **pm);
+static struct pmc *pmc_find_pmc_descriptor_in_process(struct pmc_owner *po,
+    pmc_id_t pmc);
+static struct pmc_process *pmc_find_process_descriptor(struct proc *p,
+    uint32_t mode);
+static void	pmc_force_context_switch(void);
+static void	pmc_link_target_process(struct pmc *pm,
+    struct pmc_process *pp);
+static void	pmc_maybe_remove_owner(struct pmc_owner *po);
+static void	pmc_process_csw_in(struct thread *td);
+static void	pmc_process_csw_out(struct thread *td);
+static void	pmc_process_exit(struct thread *td);
+static void	pmc_process_fork(struct proc *p1,
+    struct proc *p2, int n);
+static void	pmc_process_samples(int cpu);
+static void	pmc_release_pmc_descriptor(struct pmc *pmc);
+static void	pmc_remove_owner(struct pmc_owner *po);
+static void	pmc_remove_process_descriptor(struct pmc_process *pp);
+static void	pmc_restore_cpu_binding(struct pmc_binding *pb);
+static void	pmc_save_cpu_binding(struct pmc_binding *pb);
+static void	pmc_select_cpu(int cpu);
+static int	pmc_start(struct pmc *pm);
+static int	pmc_stop(struct pmc *pm);
+static int	pmc_syscall_handler(void *syscall_args);
+static void	pmc_unlink_target_process(struct pmc *pmc,
+    struct pmc_process *pp);
+
+/*
+ * Kernel tunables and sysctl(8) interface.
+ */
+
+SYSCTL_NODE(_kern, OID_AUTO, hwpmc, CTLFLAG_RW, 0, "HWPMC parameters");
+
+#ifdef	DEBUG
+#ifndef agg
+#undef PMC_DEBUG_DEFAULT_FLAGS
+#define PMC_DEBUG_DEFAULT_FLAGS { \
+	.pdb_CPU = 0x00000000, \
+	.pdb_CSW = 0x00000000, \
+	.pdb_LOG = 0xffffffff, \
+	.pdb_MDP = 0x00000000, \
+	.pdb_MOD = (1 << PMC_DEBUG_MIN_PMS), \
+	.pdb_OWN = 0xffffffff, \
+	.pdb_PMC = 0xffffffff, \
+	.pdb_PRC = 0xffffffff, \
+	.pdb_SAM = 0xffffffff,}
+#endif
+struct pmc_debugflags pmc_debugflags = PMC_DEBUG_DEFAULT_FLAGS;
+char	pmc_debugstr[PMC_DEBUG_STRSIZE];
+TUNABLE_STR(PMC_SYSCTL_NAME_PREFIX "debugflags", pmc_debugstr,
+    sizeof(pmc_debugstr));
+SYSCTL_PROC(_kern_hwpmc, OID_AUTO, debugflags,
+    CTLTYPE_STRING|CTLFLAG_RW,
+    0, 0, pmc_debugflags_sysctl_handler, "A", "debug flags");
+#endif
+
+/*
+ * kern.hwpmc.hashrows -- determines the number of rows in the
+ * of the hash table used to look up threads
+ */
+
+static int pmc_hashsize = PMC_HASH_SIZE;
+TUNABLE_INT(PMC_SYSCTL_NAME_PREFIX "hashsize", &pmc_hashsize);
+SYSCTL_INT(_kern_hwpmc, OID_AUTO, hashsize, CTLFLAG_RD,
+    &pmc_hashsize, 0, "rows in hash tables");
+
+/*
+ * kern.hwpmc.nsamples --- number of PC samples per CPU
+ */
+
+static int pmc_nsamples = PMC_NSAMPLES;
+TUNABLE_INT(PMC_SYSCTL_NAME_PREFIX "nsamples", &pmc_nsamples);
+SYSCTL_INT(_kern_hwpmc, OID_AUTO, nsamples, CTLFLAG_RD,
+    &pmc_nsamples, 0, "number of PC samples per CPU");
+
+/*
+ * security.bsd.unprivileged_syspmcs -- allow non-root processes to
+ * allocate system-wide PMCs.
+ *
+ * Allowing unprivileged processes to allocate system PMCs is convenient
+ * if system-wide measurements need to be taken concurrently with other
+ * per-process measurements.  This feature is turned off by default.
+ */
+
+static int pmc_unprivileged_syspmcs = 0;
+TUNABLE_INT("kern.unprivileged_syspmcs", &pmc_unprivileged_syspmcs);
+SYSCTL_INT(_kern, OID_AUTO, unprivileged_syspmcs, CTLFLAG_RW,
+    &pmc_unprivileged_syspmcs, 0,
+    "allow unprivileged process to allocate system PMCs");
+
+/*
+ * Hash function.  Discard the lower 2 bits of the pointer since
+ * these are always zero for our uses.  The hash multiplier is
+ * round((2^LONG_BIT) * ((sqrt(5)-1)/2)).
+ */
+
+#if	LONG_BIT == 64
+#define	_PMC_HM		11400714819323198486u
+#elif	LONG_BIT == 32
+#define	_PMC_HM		2654435769u
+#else
+#error 	Must know the size of 'long' to compile
+#endif
+
+#define	PMC_HASH_PTR(P,M)	((((unsigned long) (P) >> 2) * _PMC_HM) & (M))
+
+/*
+ * Syscall structures
+ */
+
+/* The `sysent' for the new syscall */
+static struct sysent pmc_sysent = {
+	2,			/* sy_narg */
+	pmc_syscall_handler,	/* sy_call */
+	NULL
+};
+
+static struct syscall_module_data pmc_syscall_mod = {
+	load,
+	NULL,
+	&pmc_syscall_num,
+	&pmc_sysent,
+	{ 0, NULL }
+};
+
+static moduledata_t pmc_mod = {
+	PMC_MODULE_NAME,
+	syscall_module_handler,
+	&pmc_syscall_mod
+};
+
+DECLARE_MODULE(pmc, pmc_mod, SI_SUB_CONFIGURE, SI_ORDER_ANY);
+MODULE_VERSION(pmc, PMC_VERSION);
+
+#ifdef	DEBUG
+enum pmc_dbgparse_state {
+	PMCDS_WS,		/* in whitespace */
+	PMCDS_MAJOR,		/* seen a major keyword */
+	PMCDS_MINOR
+};
+
+static int
+pmc_debugflags_parse(char *newstr, char *fence)
+{
+	char c, *p, *q;
+	struct pmc_debugflags *tmpflags;
+	int error, found, *newbits, tmp;
+	size_t kwlen;
+
+	MALLOC(tmpflags, struct pmc_debugflags *, sizeof(*tmpflags),
+	    M_PMC, M_WAITOK|M_ZERO);
+
+	p = newstr;
+	error = 0;
+
+	for (; p < fence && (c = *p); p++) {
+
+		/* skip white space */
+		if (c == ' ' || c == '\t')
+			continue;
+
+		/* look for a keyword followed by "=" */
+		for (q = p; p < fence && (c = *p) && c != '='; p++)
+			;
+		if (c != '=') {
+			error = EINVAL;
+			goto done;
+		}
+
+		kwlen = p - q;
+		newbits = NULL;
+
+		/* lookup flag group name */
+#define	DBG_SET_FLAG_MAJ(S,F)						\
+		if (kwlen == sizeof(S)-1 && strncmp(q, S, kwlen) == 0)	\
+			newbits = &tmpflags->pdb_ ## F;
+
+		DBG_SET_FLAG_MAJ("cpu",		CPU);
+		DBG_SET_FLAG_MAJ("csw",		CSW);
+		DBG_SET_FLAG_MAJ("logging",	LOG);
+		DBG_SET_FLAG_MAJ("module",	MOD);
+		DBG_SET_FLAG_MAJ("md", 		MDP);
+		DBG_SET_FLAG_MAJ("owner",	OWN);
+		DBG_SET_FLAG_MAJ("pmc",		PMC);
+		DBG_SET_FLAG_MAJ("process",	PRC);
+		DBG_SET_FLAG_MAJ("sampling", 	SAM);
+
+		if (newbits == NULL) {
+			error = EINVAL;
+			goto done;
+		}
+
+		p++;		/* skip the '=' */
+
+		/* Now parse the individual flags */
+		tmp = 0;
+	newflag:
+		for (q = p; p < fence && (c = *p); p++)
+			if (c == ' ' || c == '\t' || c == ',')
+				break;
+
+		/* p == fence or c == ws or c == "," or c == 0 */
+
+		if ((kwlen = p - q) == 0) {
+			*newbits = tmp;
+			continue;
+		}
+
+		found = 0;
+#define	DBG_SET_FLAG_MIN(S,F)						\
+		if (kwlen == sizeof(S)-1 && strncmp(q, S, kwlen) == 0)	\
+			tmp |= found = (1 << PMC_DEBUG_MIN_ ## F)
+
+		/* a '*' denotes all possible flags in the group */
+		if (kwlen == 1 && *q == '*')
+			tmp = found = ~0;
+		/* look for individual flag names */
+		DBG_SET_FLAG_MIN("allocaterow", ALR);
+		DBG_SET_FLAG_MIN("allocate",	ALL);
+		DBG_SET_FLAG_MIN("attach",	ATT);
+		DBG_SET_FLAG_MIN("bind",	BND);
+		DBG_SET_FLAG_MIN("config",	CFG);
+		DBG_SET_FLAG_MIN("exec",	EXC);
+		DBG_SET_FLAG_MIN("exit",	EXT);
+		DBG_SET_FLAG_MIN("find",	FND);
+		DBG_SET_FLAG_MIN("flush",	FLS);
+		DBG_SET_FLAG_MIN("fork",	FRK);
+		DBG_SET_FLAG_MIN("getbuf",	GTB);
+		DBG_SET_FLAG_MIN("hook",	PMH);
+		DBG_SET_FLAG_MIN("init",	INI);
+		DBG_SET_FLAG_MIN("intr",	INT);
+		DBG_SET_FLAG_MIN("linktarget",	TLK);
+		DBG_SET_FLAG_MIN("mayberemove", OMR);
+		DBG_SET_FLAG_MIN("ops",		OPS);
+		DBG_SET_FLAG_MIN("read",	REA);
+		DBG_SET_FLAG_MIN("register",	REG);
+		DBG_SET_FLAG_MIN("release",	REL);
+		DBG_SET_FLAG_MIN("remove",	ORM);
+		DBG_SET_FLAG_MIN("sample",	SAM);
+		DBG_SET_FLAG_MIN("scheduleio",	SIO);
+		DBG_SET_FLAG_MIN("select",	SEL);
+		DBG_SET_FLAG_MIN("signal",	SIG);
+		DBG_SET_FLAG_MIN("swi",		SWI);
+		DBG_SET_FLAG_MIN("swo",		SWO);
+		DBG_SET_FLAG_MIN("start",	STA);
+		DBG_SET_FLAG_MIN("stop",	STO);
+		DBG_SET_FLAG_MIN("syscall",	PMS);
+		DBG_SET_FLAG_MIN("unlinktarget", TUL);
+		DBG_SET_FLAG_MIN("write",	WRI);
+		if (found == 0) {
+			/* unrecognized flag name */
+			error = EINVAL;
+			goto done;
+		}
+
+		if (c == 0 || c == ' ' || c == '\t') {	/* end of flag group */
+			*newbits = tmp;
+			continue;
+		}
+
+		p++;
+		goto newflag;
+	}
+
+	/* save the new flag set */
+	bcopy(tmpflags, &pmc_debugflags, sizeof(pmc_debugflags));
+
+ done:
+	FREE(tmpflags, M_PMC);
+	return error;
+}
+
+static int
+pmc_debugflags_sysctl_handler(SYSCTL_HANDLER_ARGS)
+{
+	char *fence, *newstr;
+	int error;
+	unsigned int n;
+
+	(void) arg1; (void) arg2; /* unused parameters */
+
+	n = sizeof(pmc_debugstr);
+	MALLOC(newstr, char *, n, M_PMC, M_ZERO|M_WAITOK);
+	(void) strlcpy(newstr, pmc_debugstr, n);
+
+	error = sysctl_handle_string(oidp, newstr, n, req);
+
+	/* if there is a new string, parse and copy it */
+	if (error == 0 && req->newptr != NULL) {
+		fence = newstr + (n < req->newlen ? n : req->newlen + 1);
+		if ((error = pmc_debugflags_parse(newstr, fence)) == 0)
+			(void) strlcpy(pmc_debugstr, newstr,
+			    sizeof(pmc_debugstr));
+	}
+
+	FREE(newstr, M_PMC);
+
+	return error;
+}
+#endif
+
+/*
+ * Concurrency Control
+ *
+ * The driver manages the following data structures:
+ *
+ *   - target process descriptors, one per target process
+ *   - owner process descriptors (and attached lists), one per owner process
+ *   - lookup hash tables for owner and target processes
+ *   - PMC descriptors (and attached lists)
+ *   - per-cpu hardware state
+ *   - the 'hook' variable through which the kernel calls into
+ *     this module
+ *   - the machine hardware state (managed by the MD layer)
+ *
+ * These data structures are accessed from:
+ *
+ * - thread context-switch code
+ * - interrupt handlers (possibly on multiple cpus)
+ * - kernel threads on multiple cpus running on behalf of user
+ *   processes doing system calls
+ * - this driver's private kernel threads
+ *
+ * = Locks and Locking strategy =
+ *
+ * The driver uses four locking strategies for its operation:
+ *
+ * - The global lockmgr lock "pmc_lock" is used to protect internal
+ *   data structures.
+ *
+ *   Calls into the module by syscall() start with this lock being
+ *   held in exclusive mode.  Depending on the requested operation,
+ *   the lock may be downgraded to 'shared' mode to allow more
+ *   concurrent readers into the module.  Calls into the module from
+ *   other parts of the kernel acquire the lock in shared mode.
+ *
+ *   This SX lock is held in exclusive mode for any operations that
+ *   modify the linkages between the driver's internal data structures.
+ *
+ *   The 'pmc_hook' function pointer is also protected by this lock.
+ *   It is only examined with the sx lock held in exclusive mode.  The
+ *   kernel module is allowed to be unloaded only with the sx lock held
+ *   in exclusive mode.  In normal syscall handling, after acquiring the
+ *   pmc_lock lock we first check that 'pmc_hook' is non-null before
+ *   proceeding.  This prevents races between the thread unloading the module
+ *   and other threads seeking to use the module.
+ *
+ * - Lookups of target process structures and owner process structures
+ *   cannot use the global "pmc_lock" lock because these lookups need
+ *   to happen during context switches and in other critical sections
+ *   where sleeping is not allowed.  We protect these lookup tables
+ *   with their own private spin-mutexes, "pmc_processhash_lock" and
+ *   "pmc_ownerhash_mtx".
+ *
+ * - Interrupt handlers work in a lock free manner.  At interrupt
+ *   time, handlers look at the PMC pointer (phw->phw_pmc) configured
+ *   when the PMC was started.  If this pointer is NULL, the interrupt
+ *   is ignored after updating driver statistics.  We ensure that this
+ *   pointer is set (using an atomic operation if necessary) before the
+ *   PMC hardware is started.  Conversely, this pointer is unset atomically
+ *   only after the PMC hardware is stopped.
+ *
+ *   We ensure that everything needed for the operation of an
+ *   interrupt handler is available without it needing to acquire any
+ *   locks.  We also ensure that a PMC's software state is destroyed only
+ *   after the PMC is taken off hardware (on all CPUs).
+ *
+ * - Context-switch handling with process-private PMCs needs more
+ *   care.
+ *
+ *   A given process may be the target of multiple PMCs.  For example,
+ *   PMCATTACH and PMCDETACH may be requested by a process on one CPU
+ *   while the target process is running on another.  A PMC could also
+ *   be getting released because its owner is exiting.  We tackle
+ *   these situations in the following manner:
+ *
+ *   - each target process structure 'pmc_process' has an array
+ *     of 'struct pmc *' pointers, one for each hardware PMC.
+ *
+ *   - At context switch IN time, each "target" PMC in RUNNING state
+ *     gets started on hardware and a pointer to each PMC is copied into
+ *     the per-cpu phw array.  The 'runcount' for the PMC is
+ *     incremented.
+ *
+ *   - At context switch OUT time, all process-virtual PMCs are stopped
+ *     on hardware.  The saved value is added to the PMCs value field
+ *     only if the PMC is in a non-deleted state (the PMCs state could
+ *     have changed during the current time slice).
+ *
+ *     Note that since in-between a switch IN on a processor and a switch
+ *     OUT, the PMC could have been released on another CPU.  Therefore
+ *     context switch OUT always looks at the hardware state to turn
+ *     OFF PMCs and will update a PMC's saved value only if reachable
+ *     from the target process record.
+ *
+ *   - OP PMCRELEASE could be called on a PMC at any time (the PMC could
+ *     be attached to many processes at the time of the call and could
+ *     be active on multiple CPUs).
+ *
+ *     We prevent further scheduling of the PMC by marking it as in
+ *     state 'DELETED'.  If the runcount of the PMC is non-zero then
+ *     this PMC is currently running on a CPU somewhere.  The thread
+ *     doing the PMCRELEASE operation waits by repeatedly doing a
+ *     pause() till the runcount comes to zero.
+ *
+ * The contents of a PMC descriptor (struct pmc) are protected using
+ * a spin-mutex.  In order to save space, we use a mutex pool.
+ *
+ * In terms of lock types used by witness(4), we use:
+ * - Type "pmc-sx", used by the global SX lock.
+ * - Type "pmc-sleep", for sleep mutexes used by logger threads.
+ * - Type "pmc-per-proc", for protecting PMC owner descriptors.
+ * - Type "pmc-leaf", used for all other spin mutexes.
+ */
+
+/*
+ * save the cpu binding of the current kthread
+ */
+
+/*
+ * count set bits
+ */
+static int
+csb(cpumask_t mask)
+{
+	unsigned i, cnt;
+
+	for (i = 0, cnt = 0; i < (sizeof(cpumask_t) * 8); ++i, mask >>= 1) {
+		if (mask & 1) {
+			++cnt;
+		}
+	}
+	return cnt;
+}
+
+static int
+sched_is_bound(struct thread *td)
+{
+	struct lwp *lwp;
+
+	lwp = td->td_lwp;
+	if (!lwp) {
+		panic("can't happen\n");
+	}
+	/* FIXME: could be better -- agg */
+	return csb(lwp->lwp_cpumask) == ((sizeof(cpumask_t) * 8) - 1);
+}
+
+static void
+pmc_save_cpu_binding(struct pmc_binding *pb)
+{
+	PMCDBG(CPU,BND,2, "%s", "save-cpu");
+	pb->pb_bound = sched_is_bound(curthread);
+	pb->pb_cpu   = mycpu->gd_cpuid;
+	PMCDBG(CPU,BND,2, "save-cpu cpu=%d", pb->pb_cpu);
+}
+
+/*
+ * restore the cpu binding of the current thread
+ */
+
+static void
+pmc_restore_cpu_binding(struct pmc_binding *pb)
+{
+	PMCDBG(CPU,BND,2, "restore-cpu curcpu=%d restore=%d",
+	    mycpu->gd_cpuid, pb->pb_cpu);
+
+	/* unconditionally return to original cpu */
+	lwkt_migratecpu(pb->pb_cpu);
+
+	PMCDBG(CPU,BND,2, "%s", "restore-cpu done");
+}
+
+/*
+ * move execution over the specified cpu and bind it there.
+ */
+
+static void
+pmc_select_cpu(int cpu)
+{
+	KASSERT(cpu >= 0 && ((1<<cpu) & smp_active_mask),
+	    ("[pmc,%d] bad cpu number %d", __LINE__, cpu));
+
+	/* never move to a disabled CPU */
+	KASSERT(pmc_cpu_is_disabled(cpu) == 0, ("[pmc,%d] selecting "
+	    "disabled CPU %d", __LINE__, cpu));
+
+	PMCDBG(CPU,SEL,2, "select-cpu cpu=%d", cpu);
+
+	lwkt_migratecpu(cpu);
+
+	KASSERT(mycpu->gd_cpuid == cpu,
+	    ("[pmc,%d] CPU not bound [cpu=%d, curr=%d]", __LINE__,
+		cpu, mycpu->gd_cpuid));
+
+	PMCDBG(CPU,SEL,2, "select-cpu cpu=%d ok", cpu);
+}
+
+/*
+ * Force a context switch.
+ *
+ * We do this by pause'ing for 1 tick -- invoking mi_switch() is not
+ * guaranteed to force a context switch.
+ */
+
+static void
+pmc_force_context_switch(void)
+{
+	static int pillow;
+	tsleep(&pillow, 0, "pmcctx", 1);
+}
+
+/*
+ * Get the file name for an executable.  This is a simple wrapper
+ * around vn_fullpath(9).
+ */
+
+static void
+pmc_getfilename(struct vnode *v, char **fullpath, char **freepath)
+{
+	struct thread *td;
+
+	td = curthread;
+	*fullpath = "unknown";
+	*freepath = NULL;
+	vn_lock(v, LK_CANRECURSE | LK_EXCLUSIVE | LK_RETRY);
+	vn_fullpath(td->td_proc, v, fullpath, freepath);
+	vn_unlock(v);
+}
+
+/*
+ * remove an process owning PMCs
+ */
+
+void
+pmc_remove_owner(struct pmc_owner *po)
+{
+	struct pmc *pm, *tmp;
+
+	KKASSERT(lockstatus(&pmc_lock, curthread) == LK_EXCLUSIVE);
+
+	PMCDBG(OWN,ORM,1, "remove-owner po=%p", po);
+
+	/* Remove descriptor from the owner hash table */
+	LIST_REMOVE(po, po_next);
+
+	/* release all owned PMC descriptors */
+	LIST_FOREACH_MUTABLE(pm, &po->po_pmcs, pm_next, tmp) {
+		PMCDBG(OWN,ORM,2, "pmc=%p", pm);
+		KASSERT(pm->pm_owner == po,
+		    ("[pmc,%d] owner %p != po %p", __LINE__, pm->pm_owner, po));
+
+		pmc_release_pmc_descriptor(pm);	/* will unlink from the list */
+	}
+
+	KASSERT(po->po_sscount == 0,
+	    ("[pmc,%d] SS count not zero", __LINE__));
+	KASSERT(LIST_EMPTY(&po->po_pmcs),
+	    ("[pmc,%d] PMC list not empty", __LINE__));
+
+	/* de-configure the log file if present */
+	if (po->po_flags & PMC_PO_OWNS_LOGFILE)
+		pmclog_deconfigure_log(po);
+}
+
+/*
+ * remove an owner process record if all conditions are met.
+ */
+
+static void
+pmc_maybe_remove_owner(struct pmc_owner *po)
+{
+
+	PMCDBG(OWN,OMR,1, "maybe-remove-owner po=%p", po);
+
+	/*
+	 * Remove owner record if
+	 * - this process does not own any PMCs
+	 * - this process has not allocated a system-wide sampling buffer
+	 */
+
+	if (LIST_EMPTY(&po->po_pmcs) &&
+	    ((po->po_flags & PMC_PO_OWNS_LOGFILE) == 0)) {
+		pmc_remove_owner(po);
+		pmc_destroy_owner_descriptor(po);
+	}
+}
+
+/*
+ * Add an association between a target process and a PMC.
+ */
+
+static void
+pmc_link_target_process(struct pmc *pm, struct pmc_process *pp)
+{
+	int ri;
+	struct pmc_target *pt;
+
+	KKASSERT(lockstatus(&pmc_lock, curthread) == LK_EXCLUSIVE);
+
+	KASSERT(pm != NULL && pp != NULL,
+	    ("[pmc,%d] Null pm %p or pp %p", __LINE__, pm, pp));
+	KASSERT(PMC_IS_VIRTUAL_MODE(PMC_TO_MODE(pm)),
+	    ("[pmc,%d] Attaching a non-process-virtual pmc=%p to pid=%d",
+		__LINE__, pm, pp->pp_proc->p_pid));
+	KASSERT(pp->pp_refcnt >= 0 && pp->pp_refcnt < ((int) md->pmd_npmc - 1),
+	    ("[pmc,%d] Illegal reference count %d for process record %p",
+		__LINE__, pp->pp_refcnt, (void *) pp));
+
+	ri = PMC_TO_ROWINDEX(pm);
+
+	PMCDBG(PRC,TLK,1, "link-target pmc=%p ri=%d pmc-process=%p",
+	    pm, ri, pp);
+
+#ifdef	DEBUG
+	LIST_FOREACH(pt, &pm->pm_targets, pt_next)
+	    if (pt->pt_process == pp)
+		    KASSERT(0, ("[pmc,%d] pp %p already in pmc %p targets",
+				__LINE__, pp, pm));
+#endif
+
+	MALLOC(pt, struct pmc_target *, sizeof(struct pmc_target),
+	    M_PMC, M_ZERO|M_WAITOK);
+
+	pt->pt_process = pp;
+
+	LIST_INSERT_HEAD(&pm->pm_targets, pt, pt_next);
+
+	atomic_store_rel_ptr((uintptr_t *)&pp->pp_pmcs[ri].pp_pmc,
+	    (uintptr_t)pm);
+
+	if (pm->pm_owner->po_owner == pp->pp_proc)
+		pm->pm_flags |= PMC_F_ATTACHED_TO_OWNER;
+
+	/*
+	 * Initialize the per-process values at this row index.
+	 */
+	pp->pp_pmcs[ri].pp_pmcval = PMC_TO_MODE(pm) == PMC_MODE_TS ?
+	    pm->pm_sc.pm_reloadcount : 0;
+
+	pp->pp_refcnt++;
+
+}
+
+/*
+ * Removes the association between a target process and a PMC.
+ */
+
+static void
+pmc_unlink_target_process(struct pmc *pm, struct pmc_process *pp)
+{
+	int ri;
+	struct proc *p;
+	struct pmc_target *ptgt;
+
+	KKASSERT(lockstatus(&pmc_lock, curthread) == LK_EXCLUSIVE);
+
+	KASSERT(pm != NULL && pp != NULL,
+	    ("[pmc,%d] Null pm %p or pp %p", __LINE__, pm, pp));
+
+	KASSERT(pp->pp_refcnt >= 1 && pp->pp_refcnt < (int) md->pmd_npmc,
+	    ("[pmc,%d] Illegal ref count %d on process record %p",
+		__LINE__, pp->pp_refcnt, (void *) pp));
+
+	ri = PMC_TO_ROWINDEX(pm);
+
+	PMCDBG(PRC,TUL,1, "unlink-target pmc=%p ri=%d pmc-process=%p",
+	    pm, ri, pp);
+
+	KASSERT(pp->pp_pmcs[ri].pp_pmc == pm,
+	    ("[pmc,%d] PMC ri %d mismatch pmc %p pp->[ri] %p", __LINE__,
+		ri, pm, pp->pp_pmcs[ri].pp_pmc));
+
+	pp->pp_pmcs[ri].pp_pmc = NULL;
+	pp->pp_pmcs[ri].pp_pmcval = (pmc_value_t) 0;
+
+	/* Remove owner-specific flags */
+	if (pm->pm_owner->po_owner == pp->pp_proc) {
+		pp->pp_flags &= ~PMC_PP_ENABLE_MSR_ACCESS;
+		pm->pm_flags &= ~PMC_F_ATTACHED_TO_OWNER;
+	}
+
+	pp->pp_refcnt--;
+
+	/* Remove the target process from the PMC structure */
+	LIST_FOREACH(ptgt, &pm->pm_targets, pt_next)
+		if (ptgt->pt_process == pp)
+			break;
+
+	KASSERT(ptgt != NULL, ("[pmc,%d] process %p (pp: %p) not found "
+		    "in pmc %p", __LINE__, pp->pp_proc, pp, pm));
+
+	LIST_REMOVE(ptgt, pt_next);
+	FREE(ptgt, M_PMC);
+
+	/* if the PMC now lacks targets, send the owner a SIGIO */
+	if (LIST_EMPTY(&pm->pm_targets)) {
+		p = pm->pm_owner->po_owner;
+		PROC_LOCK(p);
+		lwpsignal(p, NULL, SIGIO);
+		PROC_UNLOCK(p);
+
+		PMCDBG(PRC,SIG,2, "signalling proc=%p signal=%d", p,
+		    SIGIO);
+	}
+}
+
+/*
+ * Check if PMC 'pm' may be attached to target process 't'.
+ */
+
+static int
+pmc_can_attach(struct pmc *pm, struct proc *t)
+{
+	struct proc *o;		/* pmc owner */
+	struct ucred *oc, *tc;	/* owner, target credentials */
+	int decline_attach, i;
+
+	/*
+	 * A PMC's owner can always attach that PMC to itself.
+	 */
+
+	if ((o = pm->pm_owner->po_owner) == t)
+		return 0;
+
+	PROC_LOCK(o);
+	oc = o->p_ucred;
+	crhold(oc);
+	PROC_UNLOCK(o);
+
+	PROC_LOCK(t);
+	tc = t->p_ucred;
+	crhold(tc);
+	PROC_UNLOCK(t);
+
+	/*
+	 * The effective uid of the PMC owner should match at least one
+	 * of the {effective,real,saved} uids of the target process.
+	 */
+
+	decline_attach = oc->cr_uid != tc->cr_uid &&
+	    oc->cr_uid != tc->cr_svuid &&
+	    oc->cr_uid != tc->cr_ruid;
+
+	/*
+	 * Every one of the target's group ids, must be in the owner's
+	 * group list.
+	 */
+	for (i = 0; !decline_attach && i < tc->cr_ngroups; i++)
+		decline_attach = !groupmember(tc->cr_groups[i], oc);
+
+	/* check the read and saved gids too */
+	if (decline_attach == 0)
+		decline_attach = !groupmember(tc->cr_rgid, oc) ||
+		    !groupmember(tc->cr_svgid, oc);
+
+	crfree(tc);
+	crfree(oc);
+
+	return !decline_attach;
+}
+
+/*
+ * Attach a process to a PMC.
+ */
+
+static int
+pmc_attach_one_process(struct proc *p, struct pmc *pm)
+{
+	int ri;
+	char *fullpath, *freepath;
+	struct pmc_process	*pp;
+
+	KKASSERT(lockstatus(&pmc_lock, curthread) == LK_EXCLUSIVE);
+
+	kprintf("FTLOD\n");
+	PMCDBG(PRC,ATT,2, "attach-one pm=%p ri=%d proc=%p (%d, %s)", pm,
+	    PMC_TO_ROWINDEX(pm), p, p->p_pid, p->p_comm);
+
+	/*
+	 * Locate the process descriptor corresponding to process 'p',
+	 * allocating space as needed.
+	 *
+	 * Verify that rowindex 'pm_rowindex' is free in the process
+	 * descriptor.
+	 *
+	 * If not, allocate space for a descriptor and link the
+	 * process descriptor and PMC.
+	 */
+	ri = PMC_TO_ROWINDEX(pm);
+
+	if ((pp = pmc_find_process_descriptor(p, PMC_FLAG_ALLOCATE)) == NULL)
+		return ENOMEM;
+
+	if (pp->pp_pmcs[ri].pp_pmc == pm) /* already present at slot [ri] */
+		return EEXIST;
+
+	if (pp->pp_pmcs[ri].pp_pmc != NULL)
+		return EBUSY;
+
+	pmc_link_target_process(pm, pp);
+
+	if (PMC_IS_SAMPLING_MODE(PMC_TO_MODE(pm)) &&
+	    (pm->pm_flags & PMC_F_ATTACHED_TO_OWNER) == 0)
+		pm->pm_flags |= PMC_F_NEEDS_LOGFILE;
+
+	pm->pm_flags |= PMC_F_ATTACH_DONE; /* mark as attached */
+
+	/* issue an attach event to a configured log file */
+	if (pm->pm_owner->po_flags & PMC_PO_OWNS_LOGFILE) {
+		pmc_getfilename(p->p_textvp, &fullpath, &freepath);
+		pmclog_process_pmcattach(pm, p->p_pid, fullpath);
+		if (freepath)
+			FREE(freepath, M_TEMP);
+	}
+	/* mark process as using HWPMCs */
+	PROC_LOCK(p);
+	p->p_flag |= P_HWPMC;
+	PROC_UNLOCK(p);
+
+	return 0;
+}
+
+/*
+ * Attach a process and optionally its children
+ */
+
+static int
+pmc_attach_process(struct proc *p, struct pmc *pm)
+{
+	int error;
+	struct proc *top;
+
+	KKASSERT(lockstatus(&pmc_lock, curthread) == LK_EXCLUSIVE);
+
+	PMCDBG(PRC,ATT,1, "attach pm=%p ri=%d proc=%p (%d, %s)", pm,
+	    PMC_TO_ROWINDEX(pm), p, p->p_pid, p->p_comm);
+
+
+	/*
+	 * If this PMC successfully allowed a GETMSR operation
+	 * in the past, disallow further ATTACHes.
+	 */
+
+	if ((pm->pm_flags & PMC_PP_ENABLE_MSR_ACCESS) != 0)
+		return EPERM;
+
+	if ((pm->pm_flags & PMC_F_DESCENDANTS) == 0)
+		return pmc_attach_one_process(p, pm);
+
+	/*
+	 * Traverse all child processes, attaching them to
+	 * this PMC.
+	 */
+
+	top = p;
+
+	for (;;) {
+		kprintf("attaching: p %lu\n", p->p_pid);
+		if ((error = pmc_attach_one_process(p, pm)) != 0)
+			break;
+		if (!LIST_EMPTY(&p->p_children))
+			p = LIST_FIRST(&p->p_children);
+		else for (;;) {
+			if (p == top)
+				goto done;
+			if (LIST_NEXT(p, p_sibling)) {
+				p = LIST_NEXT(p, p_sibling);
+				break;
+			}
+			p = p->p_pptr;
+		}
+	}
+
+	if (error)
+		(void) pmc_detach_process(top, pm);
+
+ done:
+	return error;
+}
+
+/*
+ * Detach a process from a PMC.  If there are no other PMCs tracking
+ * this process, remove the process structure from its hash table.  If
+ * 'flags' contains PMC_FLAG_REMOVE, then free the process structure.
+ */
+
+static int
+pmc_detach_one_process(struct proc *p, struct pmc *pm, int flags)
+{
+	int ri;
+	struct pmc_process *pp;
+
+	KKASSERT(lockstatus(&pmc_lock, curthread) == LK_EXCLUSIVE);
+
+	KASSERT(pm != NULL,
+	    ("[pmc,%d] null pm pointer", __LINE__));
+
+	ri = PMC_TO_ROWINDEX(pm);
+
+	PMCDBG(PRC,ATT,2, "detach-one pm=%p ri=%d proc=%p (%d, %s) flags=0x%x",
+	    pm, ri, p, p->p_pid, p->p_comm, flags);
+
+	if ((pp = pmc_find_process_descriptor(p, 0)) == NULL)
+		return ESRCH;
+
+	if (pp->pp_pmcs[ri].pp_pmc != pm)
+		return EINVAL;
+
+	pmc_unlink_target_process(pm, pp);
+
+	/* Issue a detach entry if a log file is configured */
+	if (pm->pm_owner->po_flags & PMC_PO_OWNS_LOGFILE)
+		pmclog_process_pmcdetach(pm, p->p_pid);
+
+	/*
+	 * If there are no PMCs targetting this process, we remove its
+	 * descriptor from the target hash table and unset the P_HWPMC
+	 * flag in the struct proc.
+	 */
+	KASSERT(pp->pp_refcnt >= 0 && pp->pp_refcnt < (int) md->pmd_npmc,
+	    ("[pmc,%d] Illegal refcnt %d for process struct %p",
+		__LINE__, pp->pp_refcnt, pp));
+
+	if (pp->pp_refcnt != 0)	/* still a target of some PMC */
+		return 0;
+
+	pmc_remove_process_descriptor(pp);
+
+	if (flags & PMC_FLAG_REMOVE)
+		FREE(pp, M_PMC);
+
+	PROC_LOCK(p);
+	p->p_flag &= ~P_HWPMC;
+	PROC_UNLOCK(p);
+
+	return 0;
+}
+
+/*
+ * Detach a process and optionally its descendants from a PMC.
+ */
+
+static int
+pmc_detach_process(struct proc *p, struct pmc *pm)
+{
+	struct proc *top;
+
+	KKASSERT(lockstatus(&pmc_lock, curthread) == LK_EXCLUSIVE);
+
+	PMCDBG(PRC,ATT,1, "detach pm=%p ri=%d proc=%p (%d, %s)", pm,
+	    PMC_TO_ROWINDEX(pm), p, p->p_pid, p->p_comm);
+
+	if ((pm->pm_flags & PMC_F_DESCENDANTS) == 0)
+		return pmc_detach_one_process(p, pm, PMC_FLAG_REMOVE);
+
+	/*
+	 * Traverse all children, detaching them from this PMC.  We
+	 * ignore errors since we could be detaching a PMC from a
+	 * partially attached proc tree.
+	 */
+
+	top = p;
+
+	for (;;) {
+		(void) pmc_detach_one_process(p, pm, PMC_FLAG_REMOVE);
+
+		if (!LIST_EMPTY(&p->p_children))
+			p = LIST_FIRST(&p->p_children);
+		else for (;;) {
+			if (p == top)
+				goto done;
+			if (LIST_NEXT(p, p_sibling)) {
+				p = LIST_NEXT(p, p_sibling);
+				break;
+			}
+			p = p->p_pptr;
+		}
+	}
+
+ done:
+	if (LIST_EMPTY(&pm->pm_targets))
+		pm->pm_flags &= ~PMC_F_ATTACH_DONE;
+
+	return 0;
+}
+
+
+/*
+ * Thread context switch IN
+ */
+
+static void
+pmc_process_csw_in(struct thread *td)
+{
+	int cpu;
+	unsigned int ri;
+	struct pmc *pm;
+	struct proc *p;
+	struct pmc_cpu *pc;
+	struct pmc_hw *phw;
+	struct pmc_process *pp;
+	pmc_value_t newvalue;
+
+	p = td->td_proc;
+
+	if ((pp = pmc_find_process_descriptor(p, PMC_FLAG_NONE)) == NULL)
+		return;
+
+	KASSERT(pp->pp_proc == td->td_proc,
+	    ("[pmc,%d] not my thread state", __LINE__));
+
+	critical_enter(); /* no preemption from this point */
+
+	cpu = mycpu->gd_cpuid;
+
+	PMCDBG(CSW,SWI,1, "cpu=%d proc=%p (%d, %s) pp=%p", cpu, p,
+	    p->p_pid, p->p_comm, pp);
+
+	KASSERT(cpu >= 0 && cpu < ncpus,
+	    ("[pmc,%d] wierd CPU id %d", __LINE__, cpu));
+
+	pc = pmc_pcpu[cpu];
+
+	for (ri = 0; ri < md->pmd_npmc; ri++) {
+
+		if ((pm = pp->pp_pmcs[ri].pp_pmc) == NULL)
+			continue;
+
+		KASSERT(PMC_IS_VIRTUAL_MODE(PMC_TO_MODE(pm)),
+		    ("[pmc,%d] Target PMC in non-virtual mode (%d)",
+			__LINE__, PMC_TO_MODE(pm)));
+
+		KASSERT(PMC_TO_ROWINDEX(pm) == ri,
+		    ("[pmc,%d] Row index mismatch pmc %d != ri %d",
+			__LINE__, PMC_TO_ROWINDEX(pm), ri));
+
+		/*
+		 * Only PMCs that are marked as 'RUNNING' need
+		 * be placed on hardware.
+		 */
+
+		if (pm->pm_state != PMC_STATE_RUNNING)
+			continue;
+
+		/* increment PMC runcount */
+		atomic_add_rel_32(&pm->pm_runcount, 1);
+
+		/* configure the HWPMC we are going to use. */
+		md->pmd_config_pmc(cpu, ri, pm);
+
+		phw = pc->pc_hwpmcs[ri];
+
+		KASSERT(phw != NULL,
+		    ("[pmc,%d] null hw pointer", __LINE__));
+
+		KASSERT(phw->phw_pmc == pm,
+		    ("[pmc,%d] hw->pmc %p != pmc %p", __LINE__,
+			phw->phw_pmc, pm));
+
+		/*
+		 * Write out saved value and start the PMC.
+		 *
+		 * Sampling PMCs use a per-process value, while
+		 * counting mode PMCs use a per-pmc value that is
+		 * inherited across descendants.
+		 */
+		if (PMC_TO_MODE(pm) == PMC_MODE_TS) {
+			spin_lock_wr(&pm->lock);
+			newvalue = PMC_PCPU_SAVED(cpu,ri) =
+			    pp->pp_pmcs[ri].pp_pmcval;
+			spin_unlock_wr(&pm->lock);
+		} else {
+			KASSERT(PMC_TO_MODE(pm) == PMC_MODE_TC,
+			    ("[pmc,%d] illegal mode=%d", __LINE__,
+			    PMC_TO_MODE(pm)));
+			spin_lock_wr(&pm->lock);
+			newvalue = PMC_PCPU_SAVED(cpu, ri) =
+			    pm->pm_gv.pm_savedvalue;
+			spin_unlock_wr(&pm->lock);
+		}
+
+		PMCDBG(CSW,SWI,1,"cpu=%d ri=%d new=%jd", cpu, ri, newvalue);
+
+		md->pmd_write_pmc(cpu, ri, newvalue);
+		md->pmd_start_pmc(cpu, ri);
+	}
+
+	/*
+	 * perform any other architecture/cpu dependent thread
+	 * switch-in actions.
+	 */
+
+	(void) (*md->pmd_switch_in)(pc, pp);
+
+	critical_exit();
+
+}
+
+/*
+ * Thread context switch OUT.
+ */
+
+static void
+pmc_process_csw_out(struct thread *td)
+{
+	int cpu;
+	enum pmc_mode mode;
+	unsigned int ri;
+	struct pmc *pm;
+	struct proc *p;
+	struct pmc_cpu *pc;
+	struct pmc_process *pp;
+	int64_t tmp;
+	pmc_value_t newvalue;
+
+
+	/*
+	 * Locate our process descriptor; this may be NULL if
+	 * this process is exiting and we have already removed
+	 * the process from the target process table.
+	 *
+	 * Note that due to kernel preemption, multiple
+	 * context switches may happen while the process is
+	 * exiting.
+	 *
+	 * Note also that if the target process cannot be
+	 * found we still need to deconfigure any PMCs that
+	 * are currently running on hardware.
+	 */
+
+	p = td->td_proc;
+	pp = pmc_find_process_descriptor(p, PMC_FLAG_NONE);
+
+	/*
+	 * save PMCs
+	 */
+
+	critical_enter();
+
+	cpu = mycpu->gd_cpuid;
+
+	PMCDBG(CSW,SWO,1, "cpu=%d proc=%p (%d, %s) pp=%p", cpu, p,
+	    p->p_pid, p->p_comm, pp);
+
+	KASSERT(cpu >= 0 && cpu < ncpus,
+	    ("[pmc,%d wierd CPU id %d", __LINE__, cpu));
+
+	pc = pmc_pcpu[cpu];
+
+	/*
+	 * When a PMC gets unlinked from a target PMC, it will
+	 * be removed from the target's pp_pmc[] array.
+	 *
+	 * However, on a MP system, the target could have been
+	 * executing on another CPU at the time of the unlink.
+	 * So, at context switch OUT time, we need to look at
+	 * the hardware to determine if a PMC is scheduled on
+	 * it.
+	 */
+
+	for (ri = 0; ri < md->pmd_npmc; ri++) {
+
+		pm = NULL;
+		(void) (*md->pmd_get_config)(cpu, ri, &pm);
+
+		if (pm == NULL)	/* nothing at this row index */
+			continue;
+
+		mode = PMC_TO_MODE(pm);
+		if (!PMC_IS_VIRTUAL_MODE(mode))
+			continue; /* not a process virtual PMC */
+
+		KASSERT(PMC_TO_ROWINDEX(pm) == ri,
+		    ("[pmc,%d] ri mismatch pmc(%d) ri(%d)",
+			__LINE__, PMC_TO_ROWINDEX(pm), ri));
+
+		/* Stop hardware if not already stopped */
+		if (pm->pm_stalled == 0)
+			md->pmd_stop_pmc(cpu, ri);
+
+		/* reduce this PMC's runcount */
+		atomic_subtract_rel_32(&pm->pm_runcount, 1);
+
+		/*
+		 * If this PMC is associated with this process,
+		 * save the reading.
+		 */
+
+		if (pp != NULL && pp->pp_pmcs[ri].pp_pmc != NULL) {
+
+			KASSERT(pm == pp->pp_pmcs[ri].pp_pmc,
+			    ("[pmc,%d] pm %p != pp_pmcs[%d] %p", __LINE__,
+				pm, ri, pp->pp_pmcs[ri].pp_pmc));
+
+			KASSERT(pp->pp_refcnt > 0,
+			    ("[pmc,%d] pp refcnt = %d", __LINE__,
+				pp->pp_refcnt));
+
+			md->pmd_read_pmc(cpu, ri, &newvalue);
+
+			tmp = newvalue - PMC_PCPU_SAVED(cpu,ri);
+
+			PMCDBG(CSW,SWI,1,"cpu=%d ri=%d tmp=%jd", cpu, ri,
+			    tmp);
+
+			if (mode == PMC_MODE_TS) {
+
+				/*
+				 * For sampling process-virtual PMCs,
+				 * we expect the count to be
+				 * decreasing as the 'value'
+				 * programmed into the PMC is the
+				 * number of events to be seen till
+				 * the next sampling interrupt.
+				 */
+				if (tmp < 0)
+					tmp += pm->pm_sc.pm_reloadcount;
+				spin_lock_wr(&pm->lock);
+				pp->pp_pmcs[ri].pp_pmcval -= tmp;
+				if ((int64_t) pp->pp_pmcs[ri].pp_pmcval < 0)
+					pp->pp_pmcs[ri].pp_pmcval +=
+					    pm->pm_sc.pm_reloadcount;
+				spin_unlock_wr(&pm->lock);
+
+			} else {
+
+				/*
+				 * For counting process-virtual PMCs,
+				 * we expect the count to be
+				 * increasing monotonically, modulo a 64
+				 * bit wraparound.
+				 */
+
+				KTR_LOG(hwpmctr_regval, PMC_PCPU_SAVED(cpu, ri));
+				KASSERT((int64_t) tmp >= 0,
+				    ("[pmc,%d] negative increment cpu=%d "
+				     "ri=%d newvalue=%jx saved=%jx "
+				     "incr=%jx", __LINE__, cpu, ri,
+				     newvalue, PMC_PCPU_SAVED(cpu,ri), tmp));
+
+				spin_lock_wr(&pm->lock);
+				pm->pm_gv.pm_savedvalue += tmp;
+				pp->pp_pmcs[ri].pp_pmcval += tmp;
+				spin_unlock_wr(&pm->lock);
+
+				if (pm->pm_flags & PMC_F_LOG_PROCCSW)
+					pmclog_process_proccsw(pm, pp, tmp);
+			}
+		}
+
+		/* mark hardware as free */
+		md->pmd_config_pmc(cpu, ri, NULL);
+	}
+
+	/*
+	 * perform any other architecture/cpu dependent thread
+	 * switch out functions.
+	 */
+
+	(void) (*md->pmd_switch_out)(pc, pp);
+
+	critical_exit();
+}
+
+/*
+ * Log a KLD operation.
+ */
+
+static void
+pmc_process_kld_load(struct pmckern_map_in *pkm)
+{
+	struct pmc_owner *po;
+
+	KKASSERT(lockstatus(&pmc_lock, curthread) == LK_SHARED);
+
+	/*
+	 * Notify owners of system sampling PMCs about KLD operations.
+	 */
+
+	LIST_FOREACH(po, &pmc_ss_owners, po_ssnext)
+	    if (po->po_flags & PMC_PO_OWNS_LOGFILE)
+	    	pmclog_process_map_in(po, (pid_t) -1, pkm->pm_address,
+		    (char *) pkm->pm_file);
+
+	/*
+	 * TODO: Notify owners of (all) process-sampling PMCs too.
+	 */
+
+	return;
+}
+
+static void
+pmc_process_kld_unload(struct pmckern_map_out *pkm)
+{
+	struct pmc_owner *po;
+
+	KKASSERT(lockstatus(&pmc_lock, curthread) == LK_SHARED);
+
+	LIST_FOREACH(po, &pmc_ss_owners, po_ssnext)
+	    if (po->po_flags & PMC_PO_OWNS_LOGFILE)
+		pmclog_process_map_out(po, (pid_t) -1,
+		    pkm->pm_address, pkm->pm_address + pkm->pm_size);
+		    
+	/*
+	 * TODO: Notify owners of process-sampling PMCs.
+	 */
+}
+
+/*
+ * A mapping change for a process.
+ */
+
+static void
+pmc_process_mmap(struct thread *td, struct pmckern_map_in *pkm)
+{
+	int ri;
+	pid_t pid;
+	char *fullpath, *freepath;
+	const struct pmc *pm;
+	struct pmc_owner *po;
+	const struct pmc_process *pp;
+
+	freepath = fullpath = NULL;
+	pmc_getfilename((struct vnode *) pkm->pm_file, &fullpath, &freepath);
+
+	pid = td->td_proc->p_pid;
+
+	/* Inform owners of all system-wide sampling PMCs. */
+	LIST_FOREACH(po, &pmc_ss_owners, po_ssnext)
+	    if (po->po_flags & PMC_PO_OWNS_LOGFILE)
+		pmclog_process_map_in(po, pid, pkm->pm_address, fullpath);
+
+	if ((pp = pmc_find_process_descriptor(td->td_proc, 0)) == NULL)
+		goto done;
+
+	/*
+	 * Inform sampling PMC owners tracking this process.
+	 */
+	for (ri = 0; ri < md->pmd_npmc; ri++)
+		if ((pm = pp->pp_pmcs[ri].pp_pmc) != NULL &&
+		    PMC_IS_SAMPLING_MODE(PMC_TO_MODE(pm)))
+			pmclog_process_map_in(pm->pm_owner,
+			    pid, pkm->pm_address, fullpath);
+
+  done:
+	if (freepath)
+		FREE(freepath, M_TEMP);
+}
+
+
+/*
+ * Log an munmap request.
+ */
+
+static void
+pmc_process_munmap(struct thread *td, struct pmckern_map_out *pkm)
+{
+	int ri;
+	pid_t pid;
+	struct pmc_owner *po;
+	const struct pmc *pm;
+	const struct pmc_process *pp;
+
+	pid = td->td_proc->p_pid;
+
+	LIST_FOREACH(po, &pmc_ss_owners, po_ssnext)
+	    if (po->po_flags & PMC_PO_OWNS_LOGFILE)
+		pmclog_process_map_out(po, pid, pkm->pm_address,
+		    pkm->pm_address + pkm->pm_size);
+
+	if ((pp = pmc_find_process_descriptor(td->td_proc, 0)) == NULL)
+		return;
+
+	for (ri = 0; ri < md->pmd_npmc; ri++)
+		if ((pm = pp->pp_pmcs[ri].pp_pmc) != NULL &&
+		    PMC_IS_SAMPLING_MODE(PMC_TO_MODE(pm)))
+			pmclog_process_map_out(pm->pm_owner, pid,
+			    pkm->pm_address, pkm->pm_address + pkm->pm_size);
+}
+
+/*
+ * The 'hook' invoked from the kernel proper
+ */
+
+
+#ifdef	DEBUG
+const char *pmc_hooknames[] = {
+	/* these strings correspond to PMC_FN_* in <sys/pmckern.h> */
+	"",
+	"EXEC",
+	"CSW-IN",
+	"CSW-OUT",
+	"SAMPLE",
+	"KLDLOAD",
+	"KLDUNLOAD",
+	"MMAP",
+	"MUNMAP"
+};
+#endif
+
+static int
+pmc_hook_handler(struct thread *td, int function, void *arg)
+{
+
+	PMCDBG(MOD,PMH,1, "hook td=%p func=%d \"%s\" arg=%p", td, function,
+	    pmc_hooknames[function], arg);
+
+	switch (function)
+	{
+
+	/*
+	 * Process exec()
+	 */
+
+	case PMC_FN_PROCESS_EXEC:
+	{
+		char *fullpath, *freepath;
+		unsigned int ri;
+		int is_using_hwpmcs;
+		struct pmc *pm;
+		struct proc *p;
+		struct pmc_owner *po;
+		struct pmc_process *pp;
+		struct pmckern_procexec *pk;
+
+		KKASSERT(lockstatus(&pmc_lock, curthread) == LK_EXCLUSIVE);
+
+		p = td->td_proc;
+		pmc_getfilename(p->p_textvp, &fullpath, &freepath);
+
+		pk = (struct pmckern_procexec *) arg;
+
+		/* Inform owners of SS mode PMCs of the exec event. */
+		LIST_FOREACH(po, &pmc_ss_owners, po_ssnext)
+		    if (po->po_flags & PMC_PO_OWNS_LOGFILE)
+			    pmclog_process_procexec(po, PMC_ID_INVALID,
+				p->p_pid, pk->pm_entryaddr, fullpath);
+
+		PROC_LOCK(p);
+		is_using_hwpmcs = p->p_flag & P_HWPMC;
+		PROC_UNLOCK(p);
+
+		if (!is_using_hwpmcs) {
+			if (freepath)
+				FREE(freepath, M_TEMP);
+			break;
+		}
+
+		/*
+		 * PMCs are not inherited across an exec():  remove any
+		 * PMCs that this process is the owner of.
+		 */
+
+		if ((po = pmc_find_owner_descriptor(p)) != NULL) {
+			pmc_remove_owner(po);
+			pmc_destroy_owner_descriptor(po);
+		}
+
+		/*
+		 * If the process being exec'ed is not the target of any
+		 * PMC, we are done.
+		 */
+		if ((pp = pmc_find_process_descriptor(p, 0)) == NULL) {
+			if (freepath)
+				FREE(freepath, M_TEMP);
+			break;
+		}
+
+		/*
+		 * Log the exec event to all monitoring owners.  Skip
+		 * owners who have already recieved the event because
+		 * they had system sampling PMCs active.
+		 */
+		for (ri = 0; ri < md->pmd_npmc; ri++)
+			if ((pm = pp->pp_pmcs[ri].pp_pmc) != NULL) {
+				po = pm->pm_owner;
+				if (po->po_sscount == 0 &&
+				    po->po_flags & PMC_PO_OWNS_LOGFILE)
+					pmclog_process_procexec(po, pm->pm_id,
+					    p->p_pid, pk->pm_entryaddr,
+					    fullpath);
+			}
+
+		if (freepath)
+			FREE(freepath, M_TEMP);
+
+
+		PMCDBG(PRC,EXC,1, "exec proc=%p (%d, %s) cred-changed=%d",
+		    p, p->p_pid, p->p_comm, pk->pm_credentialschanged);
+
+		if (pk->pm_credentialschanged == 0) /* no change */
+			break;
+
+		/*
+		 * If the newly exec()'ed process has a different credential
+		 * than before, allow it to be the target of a PMC only if
+		 * the PMC's owner has sufficient priviledge.
+		 */
+
+		for (ri = 0; ri < md->pmd_npmc; ri++)
+			if ((pm = pp->pp_pmcs[ri].pp_pmc) != NULL)
+				if (pmc_can_attach(pm, td->td_proc) != 0)
+					pmc_detach_one_process(td->td_proc,
+					    pm, PMC_FLAG_NONE);
+
+		KASSERT(pp->pp_refcnt >= 0 && pp->pp_refcnt < (int) md->pmd_npmc,
+		    ("[pmc,%d] Illegal ref count %d on pp %p", __LINE__,
+			pp->pp_refcnt, pp));
+
+		/*
+		 * If this process is no longer the target of any
+		 * PMCs, we can remove the process entry and free
+		 * up space.
+		 */
+
+		if (pp->pp_refcnt == 0) {
+			pmc_remove_process_descriptor(pp);
+			FREE(pp, M_PMC);
+			break;
+		}
+
+	}
+	break;
+
+	case PMC_FN_CSW_IN:
+		pmc_process_csw_in(td);
+		break;
+
+	case PMC_FN_CSW_OUT:
+		pmc_process_csw_out(td);
+		break;
+
+	/*
+	 * Process accumulated PC samples.
+	 *
+	 * This function is expected to be called by hardclock() for
+	 * each CPU that has accumulated PC samples.
+	 *
+	 * This function is to be executed on the CPU whose samples
+	 * are being processed.
+	 */
+	case PMC_FN_DO_SAMPLES:
+
+		/*
+		 * Clear the cpu specific bit in the CPU mask before
+		 * do the rest of the processing.  If the NMI handler
+		 * gets invoked after the "atomic_clear_int()" call
+		 * below but before "pmc_process_samples()" gets
+		 * around to processing the interrupt, then we will
+		 * come back here at the next hardclock() tick (and
+		 * may find nothing to do if "pmc_process_samples()"
+		 * had already processed the interrupt).  We don't
+		 * lose the interrupt sample.
+		 */
+		atomic_clear_int(&pmc_cpumask, (1 << mycpu->gd_cpuid));
+		pmc_process_samples(mycpu->gd_cpuid);
+		break;
+
+
+	case PMC_FN_KLD_LOAD:
+		KKASSERT(lockstatus(&pmc_lock, curthread) == LK_SHARED);
+		pmc_process_kld_load((struct pmckern_map_in *) arg);
+		break;
+
+	case PMC_FN_KLD_UNLOAD:
+		KKASSERT(lockstatus(&pmc_lock, curthread) == LK_SHARED);
+		pmc_process_kld_unload((struct pmckern_map_out *) arg);
+		break;
+
+	case PMC_FN_MMAP:
+		KKASSERT(lockstatus(&pmc_lock, curthread) == LK_SHARED);
+		pmc_process_mmap(td, (struct pmckern_map_in *) arg);
+		break;
+
+	case PMC_FN_MUNMAP:
+		KKASSERT(lockstatus(&pmc_lock, curthread) == LK_SHARED);
+		pmc_process_munmap(td, (struct pmckern_map_out *) arg);
+		break;
+
+	default:
+#ifdef	DEBUG
+		KASSERT(0, ("[pmc,%d] unknown hook %d\n", __LINE__, function));
+#endif
+		break;
+
+	}
+
+	return 0;
+}
+
+/*
+ * allocate a 'struct pmc_owner' descriptor in the owner hash table.
+ */
+
+static struct pmc_owner *
+pmc_allocate_owner_descriptor(struct proc *p)
+{
+	uint32_t hindex;
+	struct pmc_owner *po;
+	struct pmc_ownerhash *poh;
+
+	hindex = PMC_HASH_PTR(p, pmc_ownerhashmask);
+	poh = &pmc_ownerhash[hindex];
+
+	/* allocate space for N pointers and one descriptor struct */
+	MALLOC(po, struct pmc_owner *, sizeof(struct pmc_owner),
+	    M_PMC, M_ZERO|M_WAITOK);
+
+	po->po_sscount = po->po_error = po->po_flags = 0;
+	po->po_file  = NULL;
+	po->po_owner = p;
+	po->po_kthread = NULL;
+	LIST_INIT(&po->po_pmcs);
+	LIST_INSERT_HEAD(poh, po, po_next); /* insert into hash table */
+
+	TAILQ_INIT(&po->po_logbuffers);
+	spin_init(&po->po_lock);
+
+	PMCDBG(OWN,ALL,1, "allocate-owner proc=%p (%d, %s) pmc-owner=%p",
+	    p, p->p_pid, p->p_comm, po);
+
+	return po;
+}
+
+static void
+pmc_destroy_owner_descriptor(struct pmc_owner *po)
+{
+
+	PMCDBG(OWN,REL,1, "destroy-owner po=%p proc=%p (%d, %s)",
+	    po, po->po_owner, po->po_owner->p_pid, po->po_owner->p_comm);
+
+	spin_uninit(&po->po_lock);
+	FREE(po, M_PMC);
+}
+
+/*
+ * find the descriptor corresponding to process 'p', adding or removing it
+ * as specified by 'mode'.
+ */
+
+static struct pmc_process *
+pmc_find_process_descriptor(struct proc *p, uint32_t mode)
+{
+	uint32_t hindex;
+	struct pmc_process *pp, *ppnew;
+	struct pmc_processhash *pph;
+
+	hindex = PMC_HASH_PTR(p, pmc_processhashmask);
+	pph = &pmc_processhash[hindex];
+
+	ppnew = NULL;
+
+	/*
+	 * Pre-allocate memory in the FIND_ALLOCATE case since we
+	 * cannot call malloc(9) once we hold a spin lock.
+	 */
+
+	if (mode & PMC_FLAG_ALLOCATE) {
+		/* allocate additional space for 'n' pmc pointers */
+		MALLOC(ppnew, struct pmc_process *,
+		    sizeof(struct pmc_process) + md->pmd_npmc *
+		    sizeof(struct pmc_targetstate), M_PMC, M_ZERO|M_WAITOK);
+	}
+
+	spin_lock_wr(&pmc_processhash_lock);
+	LIST_FOREACH(pp, pph, pp_next)
+	    if (pp->pp_proc == p)
+		    break;
+
+	if ((mode & PMC_FLAG_REMOVE) && pp != NULL)
+		LIST_REMOVE(pp, pp_next);
+
+	if ((mode & PMC_FLAG_ALLOCATE) && pp == NULL &&
+	    ppnew != NULL) {
+		ppnew->pp_proc = p;
+		LIST_INSERT_HEAD(pph, ppnew, pp_next);
+		pp = ppnew;
+		ppnew = NULL;
+	}
+	spin_unlock_wr(&pmc_processhash_lock);
+
+	if (pp != NULL && ppnew != NULL)
+		FREE(ppnew, M_PMC);
+
+	return pp;
+}
+
+/*
+ * remove a process descriptor from the process hash table.
+ */
+
+static void
+pmc_remove_process_descriptor(struct pmc_process *pp)
+{
+	KASSERT(pp->pp_refcnt == 0,
+	    ("[pmc,%d] Removing process descriptor %p with count %d",
+		__LINE__, pp, pp->pp_refcnt));
+
+	spin_lock_wr(&pmc_processhash_lock);
+	LIST_REMOVE(pp, pp_next);
+	spin_unlock_wr(&pmc_processhash_lock);
+}
+
+
+/*
+ * find an owner descriptor corresponding to proc 'p'
+ */
+
+static struct pmc_owner *
+pmc_find_owner_descriptor(struct proc *p)
+{
+	uint32_t hindex;
+	struct pmc_owner *po;
+	struct pmc_ownerhash *poh;
+
+	hindex = PMC_HASH_PTR(p, pmc_ownerhashmask);
+	poh = &pmc_ownerhash[hindex];
+
+	po = NULL;
+	LIST_FOREACH(po, poh, po_next)
+	    if (po->po_owner == p)
+		    break;
+
+	PMCDBG(OWN,FND,1, "find-owner proc=%p (%d, %s) hindex=0x%x -> "
+	    "pmc-owner=%p", p, p->p_pid, p->p_comm, hindex, po);
+
+	return po;
+}
+
+/*
+ * pmc_allocate_pmc_descriptor
+ *
+ * Allocate a pmc descriptor and initialize its
+ * fields.
+ */
+
+static struct pmc *
+pmc_allocate_pmc_descriptor(void)
+{
+	struct pmc *pmc;
+
+	MALLOC(pmc, struct pmc *, sizeof(struct pmc), M_PMC, M_ZERO|M_WAITOK);
+
+	if (pmc != NULL) {
+		pmc->pm_owner = NULL;
+		LIST_INIT(&pmc->pm_targets);
+	}
+
+	PMCDBG(PMC,ALL,1, "allocate-pmc -> pmc=%p", pmc);
+
+	return pmc;
+}
+
+/*
+ * Destroy a pmc descriptor.
+ */
+
+static void
+pmc_destroy_pmc_descriptor(struct pmc *pm)
+{
+	(void) pm;
+
+#ifdef	DEBUG
+	KASSERT(pm->pm_state == PMC_STATE_DELETED ||
+	    pm->pm_state == PMC_STATE_FREE,
+	    ("[pmc,%d] destroying non-deleted PMC", __LINE__));
+	KASSERT(LIST_EMPTY(&pm->pm_targets),
+	    ("[pmc,%d] destroying pmc with targets", __LINE__));
+	KASSERT(pm->pm_owner == NULL,
+	    ("[pmc,%d] destroying pmc attached to an owner", __LINE__));
+	KASSERT(pm->pm_runcount == 0,
+	    ("[pmc,%d] pmc has non-zero run count %d", __LINE__,
+		pm->pm_runcount));
+#endif
+}
+
+static void
+pmc_wait_for_pmc_idle(struct pmc *pm)
+{
+#ifdef	DEBUG
+	volatile int maxloop;
+
+	maxloop = 100 * ncpus;
+#endif
+
+	/*
+	 * Loop (with a forced context switch) till the PMC's runcount
+	 * comes down to zero.
+	 */
+	while (atomic_load_acq_32(&pm->pm_runcount) > 0) {
+#ifdef	DEBUG
+		maxloop--;
+		KASSERT(maxloop > 0,
+		    ("[pmc,%d] (ri%d, rc%d) waiting too long for "
+			"pmc to be free", __LINE__,
+			PMC_TO_ROWINDEX(pm), pm->pm_runcount));
+#endif
+		pmc_force_context_switch();
+	}
+}
+
+/*
+ * This function does the following things:
+ *
+ *  - detaches the PMC from hardware
+ *  - unlinks all target threads that were attached to it
+ *  - removes the PMC from its owner's list
+ *  - destroy's the PMC private mutex
+ *
+ * Once this function completes, the given pmc pointer can be safely
+ * FREE'd by the caller.
+ */
+
+static void
+pmc_release_pmc_descriptor(struct pmc *pm)
+{
+	u_int ri, cpu;
+	enum pmc_mode mode;
+	struct pmc_hw *phw;
+	struct pmc_owner *po;
+	struct pmc_process *pp;
+	struct pmc_target *ptgt, *tmp;
+	struct pmc_binding pb;
+
+	KKASSERT(lockstatus(&pmc_lock, curthread) == LK_EXCLUSIVE);
+
+	KASSERT(pm, ("[pmc,%d] null pmc", __LINE__));
+
+	ri   = PMC_TO_ROWINDEX(pm);
+	mode = PMC_TO_MODE(pm);
+
+	PMCDBG(PMC,REL,1, "release-pmc pmc=%p ri=%d mode=%d", pm, ri,
+	    mode);
+
+	/*
+	 * First, we take the PMC off hardware.
+	 */
+	cpu = 0;
+	if (PMC_IS_SYSTEM_MODE(mode)) {
+
+		/*
+		 * A system mode PMC runs on a specific CPU.  Switch
+		 * to this CPU and turn hardware off.
+		 */
+		pmc_save_cpu_binding(&pb);
+
+		cpu = PMC_TO_CPU(pm);
+
+		pmc_select_cpu(cpu);
+
+		/* switch off non-stalled CPUs */
+		if (pm->pm_state == PMC_STATE_RUNNING &&
+		    pm->pm_stalled == 0) {
+
+			phw = pmc_pcpu[cpu]->pc_hwpmcs[ri];
+
+			KASSERT(phw->phw_pmc == pm,
+			    ("[pmc, %d] pmc ptr ri(%d) hw(%p) pm(%p)",
+				__LINE__, ri, phw->phw_pmc, pm));
+			PMCDBG(PMC,REL,2, "stopping cpu=%d ri=%d", cpu, ri);
+
+			critical_enter();
+			md->pmd_stop_pmc(cpu, ri);
+			critical_exit();
+		}
+
+		PMCDBG(PMC,REL,2, "decfg cpu=%d ri=%d", cpu, ri);
+
+		critical_enter();
+		md->pmd_config_pmc(cpu, ri, NULL);
+		critical_exit();
+
+		/* adjust the global and process count of SS mode PMCs */
+		if (mode == PMC_MODE_SS && pm->pm_state == PMC_STATE_RUNNING) {
+			po = pm->pm_owner;
+			po->po_sscount--;
+			if (po->po_sscount == 0) {
+				atomic_subtract_rel_int(&pmc_ss_count, 1);
+				LIST_REMOVE(po, po_ssnext);
+			}
+		}
+
+		pm->pm_state = PMC_STATE_DELETED;
+
+		pmc_restore_cpu_binding(&pb);
+
+		/*
+		 * We could have references to this PMC structure in
+		 * the per-cpu sample queues.  Wait for the queue to
+		 * drain.
+		 */
+		pmc_wait_for_pmc_idle(pm);
+
+	} else if (PMC_IS_VIRTUAL_MODE(mode)) {
+
+		/*
+		 * A virtual PMC could be running on multiple CPUs at
+		 * a given instant.
+		 *
+		 * By marking its state as DELETED, we ensure that
+		 * this PMC is never further scheduled on hardware.
+		 *
+		 * Then we wait till all CPUs are done with this PMC.
+		 */
+		pm->pm_state = PMC_STATE_DELETED;
+
+
+		/* Wait for the PMCs runcount to come to zero. */
+		pmc_wait_for_pmc_idle(pm);
+
+		/*
+		 * At this point the PMC is off all CPUs and cannot be
+		 * freshly scheduled onto a CPU.  It is now safe to
+		 * unlink all targets from this PMC.  If a
+		 * process-record's refcount falls to zero, we remove
+		 * it from the hash table.  The module-wide SX lock
+		 * protects us from races.
+		 */
+		LIST_FOREACH_MUTABLE(ptgt, &pm->pm_targets, pt_next, tmp) {
+			pp = ptgt->pt_process;
+			pmc_unlink_target_process(pm, pp); /* frees 'ptgt' */
+
+			PMCDBG(PMC,REL,3, "pp->refcnt=%d", pp->pp_refcnt);
+
+			/*
+			 * If the target process record shows that no
+			 * PMCs are attached to it, reclaim its space.
+			 */
+
+			if (pp->pp_refcnt == 0) {
+				pmc_remove_process_descriptor(pp);
+				FREE(pp, M_PMC);
+			}
+		}
+
+		cpu = curthread->td_gd->gd_cpuid; /* setup cpu for pmd_release() */
+
+	}
+
+	/*
+	 * Release any MD resources
+	 */
+
+	(void) md->pmd_release_pmc(cpu, ri, pm);
+
+	/*
+	 * Update row disposition
+	 */
+
+	if (PMC_IS_SYSTEM_MODE(PMC_TO_MODE(pm)))
+		PMC_UNMARK_ROW_STANDALONE(ri);
+	else
+		PMC_UNMARK_ROW_THREAD(ri);
+
+	/* unlink from the owner's list */
+	if (pm->pm_owner) {
+		LIST_REMOVE(pm, pm_next);
+		pm->pm_owner = NULL;
+	}
+
+	pmc_destroy_pmc_descriptor(pm);
+}
+
+/*
+ * Register an owner and a pmc.
+ */
+
+static int
+pmc_register_owner(struct proc *p, struct pmc *pmc)
+{
+	struct pmc_owner *po;
+
+	KKASSERT(lockstatus(&pmc_lock, curthread) == LK_EXCLUSIVE);
+
+	if ((po = pmc_find_owner_descriptor(p)) == NULL)
+		if ((po = pmc_allocate_owner_descriptor(p)) == NULL)
+			return ENOMEM;
+
+	KASSERT(pmc->pm_owner == NULL,
+	    ("[pmc,%d] attempting to own an initialized PMC", __LINE__));
+	pmc->pm_owner  = po;
+
+	LIST_INSERT_HEAD(&po->po_pmcs, pmc, pm_next);
+
+	PROC_LOCK(p);
+	p->p_flag |= P_HWPMC;
+	PROC_UNLOCK(p);
+
+	if (po->po_flags & PMC_PO_OWNS_LOGFILE)
+		pmclog_process_pmcallocate(pmc);
+
+	PMCDBG(PMC,REG,1, "register-owner pmc-owner=%p pmc=%p",
+	    po, pmc);
+
+	return 0;
+}
+
+/*
+ * Return the current row disposition:
+ * == 0 => FREE
+ *  > 0 => PROCESS MODE
+ *  < 0 => SYSTEM MODE
+ */
+
+int
+pmc_getrowdisp(int ri)
+{
+	return pmc_pmcdisp[ri];
+}
+
+/*
+ * Check if a PMC at row index 'ri' can be allocated to the current
+ * process.
+ *
+ * Allocation can fail if:
+ *   - the current process is already being profiled by a PMC at index 'ri',
+ *     attached to it via OP_PMCATTACH.
+ *   - the current process has already allocated a PMC at index 'ri'
+ *     via OP_ALLOCATE.
+ */
+
+static int
+pmc_can_allocate_rowindex(struct proc *p, unsigned int ri, int cpu)
+{
+	enum pmc_mode mode;
+	struct pmc *pm;
+	struct pmc_owner *po;
+	struct pmc_process *pp;
+
+	PMCDBG(PMC,ALR,1, "can-allocate-rowindex proc=%p (%d, %s) ri=%d "
+	    "cpu=%d", p, p->p_pid, p->p_comm, ri, cpu);
+
+	/*
+	 * We shouldn't have already allocated a process-mode PMC at
+	 * row index 'ri'.
+	 *
+	 * We shouldn't have allocated a system-wide PMC on the same
+	 * CPU and same RI.
+	 */
+	if ((po = pmc_find_owner_descriptor(p)) != NULL)
+		LIST_FOREACH(pm, &po->po_pmcs, pm_next) {
+		    if (PMC_TO_ROWINDEX(pm) == ri) {
+			    mode = PMC_TO_MODE(pm);
+			    if (PMC_IS_VIRTUAL_MODE(mode))
+				    return EEXIST;
+			    if (PMC_IS_SYSTEM_MODE(mode) &&
+				(int) PMC_TO_CPU(pm) == cpu)
+				    return EEXIST;
+		    }
+	        }
+
+	/*
+	 * We also shouldn't be the target of any PMC at this index
+	 * since otherwise a PMC_ATTACH to ourselves will fail.
+	 */
+	if ((pp = pmc_find_process_descriptor(p, 0)) != NULL)
+		if (pp->pp_pmcs[ri].pp_pmc)
+			return EEXIST;
+
+	PMCDBG(PMC,ALR,2, "can-allocate-rowindex proc=%p (%d, %s) ri=%d ok",
+	    p, p->p_pid, p->p_comm, ri);
+
+	return 0;
+}
+
+/*
+ * Check if a given PMC at row index 'ri' can be currently used in
+ * mode 'mode'.
+ */
+
+static int
+pmc_can_allocate_row(int ri, enum pmc_mode mode)
+{
+	enum pmc_disp	disp;
+
+	KKASSERT(lockstatus(&pmc_lock, curthread) == LK_EXCLUSIVE);
+
+	PMCDBG(PMC,ALR,1, "can-allocate-row ri=%d mode=%d", ri, mode);
+
+	if (PMC_IS_SYSTEM_MODE(mode))
+		disp = PMC_DISP_STANDALONE;
+	else
+		disp = PMC_DISP_THREAD;
+
+	/*
+	 * check disposition for PMC row 'ri':
+	 *
+	 * Expected disposition		Row-disposition		Result
+	 *
+	 * STANDALONE			STANDALONE or FREE	proceed
+	 * STANDALONE			THREAD			fail
+	 * THREAD			THREAD or FREE		proceed
+	 * THREAD			STANDALONE		fail
+	 */
+
+	if (!PMC_ROW_DISP_IS_FREE(ri) &&
+	    !(disp == PMC_DISP_THREAD && PMC_ROW_DISP_IS_THREAD(ri)) &&
+	    !(disp == PMC_DISP_STANDALONE && PMC_ROW_DISP_IS_STANDALONE(ri)))
+		return EBUSY;
+
+	/*
+	 * All OK
+	 */
+
+	PMCDBG(PMC,ALR,2, "can-allocate-row ri=%d mode=%d ok", ri, mode);
+
+	return 0;
+
+}
+
+/*
+ * Find a PMC descriptor with user handle 'pmcid' for thread 'td'.
+ */
+
+static struct pmc *
+pmc_find_pmc_descriptor_in_process(struct pmc_owner *po, pmc_id_t pmcid)
+{
+	struct pmc *pm;
+
+	KASSERT(PMC_ID_TO_ROWINDEX(pmcid) < md->pmd_npmc,
+	    ("[pmc,%d] Illegal pmc index %d (max %d)", __LINE__,
+		PMC_ID_TO_ROWINDEX(pmcid), md->pmd_npmc));
+
+	LIST_FOREACH(pm, &po->po_pmcs, pm_next)
+	    if (pm->pm_id == pmcid)
+		    return pm;
+
+	return NULL;
+}
+
+static int
+pmc_find_pmc(pmc_id_t pmcid, struct pmc **pmc)
+{
+
+	struct pmc *pm;
+	struct pmc_owner *po;
+
+	PMCDBG(PMC,FND,1, "find-pmc id=%d", pmcid);
+
+	if ((po = pmc_find_owner_descriptor(curthread->td_proc)) == NULL)
+		return ESRCH;
+
+	if ((pm = pmc_find_pmc_descriptor_in_process(po, pmcid)) == NULL)
+		return EINVAL;
+
+	PMCDBG(PMC,FND,2, "find-pmc id=%d -> pmc=%p", pmcid, pm);
+
+	*pmc = pm;
+	return 0;
+}
+
+/*
+ * Start a PMC.
+ */
+
+static int
+pmc_start(struct pmc *pm)
+{
+	int error, cpu, ri;
+	enum pmc_mode mode;
+	struct pmc_owner *po;
+	struct pmc_binding pb;
+
+	KASSERT(pm != NULL,
+	    ("[pmc,%d] null pm", __LINE__));
+
+	mode = PMC_TO_MODE(pm);
+	ri   = PMC_TO_ROWINDEX(pm);
+	error = 0;
+
+	PMCDBG(PMC,OPS,1, "start pmc=%p mode=%d ri=%d", pm, mode, ri);
+
+	po = pm->pm_owner;
+
+	if (PMC_IS_VIRTUAL_MODE(mode)) {
+
+		/*
+		 * If a PMCATTACH has never been done on this PMC,
+		 * attach it to its owner process.
+		 */
+
+		if (LIST_EMPTY(&pm->pm_targets))
+			error = (pm->pm_flags & PMC_F_ATTACH_DONE) ? ESRCH :
+			    pmc_attach_process(po->po_owner, pm);
+
+		/*
+		 * Disallow PMCSTART if a logfile is required but has not
+		 * been configured yet.
+		 */
+
+		if (error == 0 && (pm->pm_flags & PMC_F_NEEDS_LOGFILE) &&
+		    (po->po_flags & PMC_PO_OWNS_LOGFILE) == 0)
+			error = EDOOFUS;
+
+		/*
+		 * If the PMC is attached to its owner, then force a context
+		 * switch to ensure that the MD state gets set correctly.
+		 */
+
+		if (error == 0) {
+			pm->pm_state = PMC_STATE_RUNNING;
+			if (pm->pm_flags & PMC_F_ATTACHED_TO_OWNER)
+				pmc_force_context_switch();
+		}
+
+		return error;
+	}
+
+
+	/*
+	 * A system-wide PMC.
+	 */
+
+	if ((pm->pm_flags & PMC_F_NEEDS_LOGFILE) &&
+	    (po->po_flags & PMC_PO_OWNS_LOGFILE) == 0)
+		return EDOOFUS;	/* programming error */
+
+	/*
+	 * Add the owner to the global list if this is a system-wide
+	 * sampling PMC.
+	 */
+
+	if (mode == PMC_MODE_SS) {
+		if (po->po_sscount == 0) {
+			LIST_INSERT_HEAD(&pmc_ss_owners, po, po_ssnext);
+			atomic_add_rel_int(&pmc_ss_count, 1);
+			PMCDBG(PMC,OPS,1, "po=%p in global list", po);
+		}
+		po->po_sscount++;
+	}
+
+	/* TODO: dump system wide process mappings to the log? */
+
+	/*
+	 * Move to the CPU associated with this
+	 * PMC, and start the hardware.
+	 */
+
+	pmc_save_cpu_binding(&pb);
+
+	cpu = PMC_TO_CPU(pm);
+
+	if (pmc_cpu_is_disabled(cpu))
+		return ENXIO;
+
+	pmc_select_cpu(cpu);
+
+	/*
+	 * global PMCs are configured at allocation time
+	 * so write out the initial value and start the PMC.
+	 */
+
+	pm->pm_state = PMC_STATE_RUNNING;
+
+	critical_enter();
+	if ((error = md->pmd_write_pmc(cpu, ri,
+		 PMC_IS_SAMPLING_MODE(mode) ?
+		 pm->pm_sc.pm_reloadcount :
+		 pm->pm_sc.pm_initial)) == 0)
+		error = md->pmd_start_pmc(cpu, ri);
+	critical_exit();
+
+	pmc_restore_cpu_binding(&pb);
+
+	return error;
+}
+
+/*
+ * Stop a PMC.
+ */
+
+static int
+pmc_stop(struct pmc *pm)
+{
+	int cpu, error, ri;
+	struct pmc_owner *po;
+	struct pmc_binding pb;
+
+	KASSERT(pm != NULL, ("[pmc,%d] null pmc", __LINE__));
+
+	PMCDBG(PMC,OPS,1, "stop pmc=%p mode=%d ri=%d", pm,
+	    PMC_TO_MODE(pm), PMC_TO_ROWINDEX(pm));
+
+	pm->pm_state = PMC_STATE_STOPPED;
+
+	/*
+	 * If the PMC is a virtual mode one, changing the state to
+	 * non-RUNNING is enough to ensure that the PMC never gets
+	 * scheduled.
+	 *
+	 * If this PMC is current running on a CPU, then it will
+	 * handled correctly at the time its target process is context
+	 * switched out.
+	 */
+
+	if (PMC_IS_VIRTUAL_MODE(PMC_TO_MODE(pm)))
+		return 0;
+
+	/*
+	 * A system-mode PMC.  Move to the CPU associated with
+	 * this PMC, and stop the hardware.  We update the
+	 * 'initial count' so that a subsequent PMCSTART will
+	 * resume counting from the current hardware count.
+	 */
+
+	pmc_save_cpu_binding(&pb);
+
+	cpu = PMC_TO_CPU(pm);
+
+	KASSERT(cpu >= 0 && cpu < ncpus,
+	    ("[pmc,%d] illegal cpu=%d", __LINE__, cpu));
+
+	if (pmc_cpu_is_disabled(cpu))
+		return ENXIO;
+
+	pmc_select_cpu(cpu);
+
+	ri = PMC_TO_ROWINDEX(pm);
+
+	critical_enter();
+	if ((error = md->pmd_stop_pmc(cpu, ri)) == 0)
+		error = md->pmd_read_pmc(cpu, ri, &pm->pm_sc.pm_initial);
+	critical_exit();
+
+	pmc_restore_cpu_binding(&pb);
+
+	po = pm->pm_owner;
+
+	/* remove this owner from the global list of SS PMC owners */
+	if (PMC_TO_MODE(pm) == PMC_MODE_SS) {
+		po->po_sscount--;
+		if (po->po_sscount == 0) {
+			atomic_subtract_rel_int(&pmc_ss_count, 1);
+			LIST_REMOVE(po, po_ssnext);
+			PMCDBG(PMC,OPS,2,"po=%p removed from global list", po);
+		}
+	}
+
+	return error;
+}
+
+
+#ifdef	DEBUG
+static const char *pmc_op_to_name[] = {
+#undef	__PMC_OP
+#define	__PMC_OP(N, D)	#N ,
+	__PMC_OPS()
+	NULL
+};
+#endif
+
+/*
+ * The syscall interface
+ */
+
+#define	PMC_GET_SX_XLOCK(...) do {		\
+	lockmgr(&pmc_lock, LK_EXCLUSIVE);	\
+	if (pmc_hook == NULL) {			\
+		lockmgr(&pmc_lock, LK_RELEASE);	\
+		return __VA_ARGS__;		\
+	}					\
+} while (0)
+
+#define	PMC_DOWNGRADE_SX() do {			\
+	lockmgr(&pmc_lock, LK_DOWNGRADE);	\
+	is_sx_downgraded = 1;			\
+} while (0)
+
+static int
+pmc_syscall_handler(void *syscall_args)
+{
+	int error, is_sx_downgraded, op;
+	struct pmc_syscall_args *c;
+	void *arg;
+	struct thread *td;
+
+	td = curthread;
+	PMC_GET_SX_XLOCK(ENOSYS);
+
+	DROP_GIANT();
+
+	is_sx_downgraded = 0;
+
+	c = (struct pmc_syscall_args *) syscall_args;
+
+	op = c->pmop_code;
+	arg = c->pmop_data;
+
+	PMCDBG(MOD,PMS,1, "syscall op=%d \"%s\" arg=%p", op,
+	    pmc_op_to_name[op], arg);
+
+	error = 0;
+	atomic_add_int(&pmc_stats.pm_syscalls, 1);
+
+	switch(op)
+	{
+
+
+	/*
+	 * Configure a log file.
+	 *
+	 * XXX This OP will be reworked.
+	 */
+
+	case PMC_OP_CONFIGURELOG:
+	{
+		struct proc *p;
+		struct pmc *pm;
+		struct pmc_owner *po;
+		struct pmckern_map_in *km, *kmbase;
+		struct pmc_op_configurelog cl;
+
+		KKASSERT(lockstatus(&pmc_lock, curthread) == LK_EXCLUSIVE);
+
+		if ((error = copyin(arg, &cl, sizeof(cl))) != 0)
+			break;
+
+		/* mark this process as owning a log file */
+		p = td->td_proc;
+		if ((po = pmc_find_owner_descriptor(p)) == NULL)
+			if ((po = pmc_allocate_owner_descriptor(p)) == NULL) {
+				error = ENOMEM;
+				break;
+			}
+
+		/*
+		 * If a valid fd was passed in, try to configure that,
+		 * otherwise if 'fd' was less than zero and there was
+		 * a log file configured, flush its buffers and
+		 * de-configure it.
+		 */
+		if (cl.pm_logfd >= 0)
+			error = pmclog_configure_log(po, cl.pm_logfd);
+		else if (po->po_flags & PMC_PO_OWNS_LOGFILE) {
+			pmclog_process_closelog(po);
+			error = pmclog_flush(po);
+			if (error == 0) {
+				LIST_FOREACH(pm, &po->po_pmcs, pm_next)
+				    if (pm->pm_flags & PMC_F_NEEDS_LOGFILE &&
+					pm->pm_state == PMC_STATE_RUNNING)
+					    pmc_stop(pm);
+				error = pmclog_deconfigure_log(po);
+			}
+		} else
+			error = EINVAL;
+
+		if (error)
+			break;
+
+		/*
+		 * Log the current set of kernel modules.
+		 */
+		kmbase = linker_hwpmc_list_objects();
+		for (km = kmbase; km->pm_file != NULL; km++) {
+			PMCDBG(LOG,REG,1,"%s %p", (char *) km->pm_file,
+			    (void *) km->pm_address);
+			pmclog_process_map_in(po, (pid_t) -1, km->pm_address,
+			    km->pm_file);
+		}
+		FREE(kmbase, M_LINKER);
+	}
+	break;
+
+
+	/*
+	 * Flush a log file.
+	 */
+
+	case PMC_OP_FLUSHLOG:
+	{
+		struct pmc_owner *po;
+
+		KKASSERT(lockstatus(&pmc_lock, curthread) == LK_EXCLUSIVE);
+
+		if ((po = pmc_find_owner_descriptor(td->td_proc)) == NULL) {
+			error = EINVAL;
+			break;
+		}
+
+		error = pmclog_flush(po);
+	}
+	break;
+
+	/*
+	 * Retrieve hardware configuration.
+	 */
+
+	case PMC_OP_GETCPUINFO:	/* CPU information */
+	{
+		struct pmc_op_getcpuinfo gci;
+
+		gci.pm_cputype = md->pmd_cputype;
+		gci.pm_ncpu    = ncpus;
+		gci.pm_npmc    = md->pmd_npmc;
+		gci.pm_nclass  = md->pmd_nclass;
+		bcopy(md->pmd_classes, &gci.pm_classes,
+		    sizeof(gci.pm_classes));
+		error = copyout(&gci, arg, sizeof(gci));
+	}
+	break;
+
+
+	/*
+	 * Get module statistics
+	 */
+
+	case PMC_OP_GETDRIVERSTATS:
+	{
+		struct pmc_op_getdriverstats gms;
+
+		bcopy(&pmc_stats, &gms, sizeof(gms));
+		error = copyout(&gms, arg, sizeof(gms));
+	}
+	break;
+
+
+	/*
+	 * Retrieve module version number
+	 */
+
+	case PMC_OP_GETMODULEVERSION:
+	{
+		uint32_t cv, modv;
+
+		/* retrieve the client's idea of the ABI version */
+		if ((error = copyin(arg, &cv, sizeof(uint32_t))) != 0)
+			break;
+		/* don't service clients newer than our driver */
+		modv = PMC_VERSION;
+		if ((cv & 0xFFFF0000) > (modv & 0xFFFF0000)) {
+			error = EPROGMISMATCH;
+			break;
+		}
+		error = copyout(&modv, arg, sizeof(int));
+	}
+	break;
+
+
+	/*
+	 * Retrieve the state of all the PMCs on a given
+	 * CPU.
+	 */
+
+	case PMC_OP_GETPMCINFO:
+	{
+		uint32_t cpu, n, npmc;
+		size_t pmcinfo_size;
+		struct pmc *pm;
+		struct pmc_info *p, *pmcinfo;
+		struct pmc_op_getpmcinfo *gpi;
+		struct pmc_owner *po;
+		struct pmc_binding pb;
+
+		PMC_DOWNGRADE_SX();
+
+		gpi = (struct pmc_op_getpmcinfo *) arg;
+
+		if ((error = copyin(&gpi->pm_cpu, &cpu, sizeof(cpu))) != 0)
+			break;
+
+		if (cpu >= (unsigned int) ncpus) {
+			error = EINVAL;
+			break;
+		}
+
+		if (pmc_cpu_is_disabled(cpu)) {
+			error = ENXIO;
+			break;
+		}
+
+		/* switch to CPU 'cpu' */
+		pmc_save_cpu_binding(&pb);
+		pmc_select_cpu(cpu);
+
+		npmc = md->pmd_npmc;
+
+		pmcinfo_size = npmc * sizeof(struct pmc_info);
+		MALLOC(pmcinfo, struct pmc_info *, pmcinfo_size, M_PMC,
+		    M_WAITOK);
+
+		p = pmcinfo;
+
+		for (n = 0; n < md->pmd_npmc; n++, p++) {
+
+			if ((error = md->pmd_describe(cpu, n, p, &pm)) != 0)
+				break;
+
+			if (PMC_ROW_DISP_IS_STANDALONE(n))
+				p->pm_rowdisp = PMC_DISP_STANDALONE;
+			else if (PMC_ROW_DISP_IS_THREAD(n))
+				p->pm_rowdisp = PMC_DISP_THREAD;
+			else
+				p->pm_rowdisp = PMC_DISP_FREE;
+
+			p->pm_ownerpid = -1;
+
+			if (pm == NULL)	/* no PMC associated */
+				continue;
+
+			po = pm->pm_owner;
+
+			KASSERT(po->po_owner != NULL,
+			    ("[pmc,%d] pmc_owner had a null proc pointer",
+				__LINE__));
+
+			p->pm_ownerpid = po->po_owner->p_pid;
+			p->pm_mode     = PMC_TO_MODE(pm);
+			p->pm_event    = pm->pm_event;
+			p->pm_flags    = pm->pm_flags;
+
+			if (PMC_IS_SAMPLING_MODE(PMC_TO_MODE(pm)))
+				p->pm_reloadcount =
+				    pm->pm_sc.pm_reloadcount;
+		}
+
+		pmc_restore_cpu_binding(&pb);
+
+		/* now copy out the PMC info collected */
+		if (error == 0)
+			error = copyout(pmcinfo, &gpi->pm_pmcs, pmcinfo_size);
+
+		FREE(pmcinfo, M_PMC);
+	}
+	break;
+
+
+	/*
+	 * Set the administrative state of a PMC.  I.e. whether
+	 * the PMC is to be used or not.
+	 */
+
+	case PMC_OP_PMCADMIN:
+	{
+		int cpu, ri;
+		enum pmc_state request;
+		struct pmc_cpu *pc;
+		struct pmc_hw *phw;
+		struct pmc_op_pmcadmin pma;
+		struct pmc_binding pb;
+
+		KKASSERT(lockstatus(&pmc_lock, curthread) == LK_EXCLUSIVE);
+
+		KASSERT(td == curthread,
+		    ("[pmc,%d] td != curthread", __LINE__));
+
+		error = priv_check(td, PRIV_PMC_MANAGE);
+		if (error)
+			break;
+
+		if ((error = copyin(arg, &pma, sizeof(pma))) != 0)
+			break;
+
+		cpu = pma.pm_cpu;
+
+		if (cpu < 0 || cpu >= ncpus) {
+			error = EINVAL;
+			break;
+		}
+
+		if (pmc_cpu_is_disabled(cpu)) {
+			error = ENXIO;
+			break;
+		}
+
+		request = pma.pm_state;
+
+		if (request != PMC_STATE_DISABLED &&
+		    request != PMC_STATE_FREE) {
+			error = EINVAL;
+			break;
+		}
+
+		ri = pma.pm_pmc; /* pmc id == row index */
+		if (ri < 0 || ri >= (int) md->pmd_npmc) {
+			error = EINVAL;
+			break;
+		}
+
+		/*
+		 * We can't disable a PMC with a row-index allocated
+		 * for process virtual PMCs.
+		 */
+
+		if (PMC_ROW_DISP_IS_THREAD(ri) &&
+		    request == PMC_STATE_DISABLED) {
+			error = EBUSY;
+			break;
+		}
+
+		/*
+		 * otherwise, this PMC on this CPU is either free or
+		 * in system-wide mode.
+		 */
+
+		pmc_save_cpu_binding(&pb);
+		pmc_select_cpu(cpu);
+
+		pc  = pmc_pcpu[cpu];
+		phw = pc->pc_hwpmcs[ri];
+
+		/*
+		 * XXX do we need some kind of 'forced' disable?
+		 */
+
+		if (phw->phw_pmc == NULL) {
+			if (request == PMC_STATE_DISABLED &&
+			    (phw->phw_state & PMC_PHW_FLAG_IS_ENABLED)) {
+				phw->phw_state &= ~PMC_PHW_FLAG_IS_ENABLED;
+				PMC_MARK_ROW_STANDALONE(ri);
+			} else if (request == PMC_STATE_FREE &&
+			    (phw->phw_state & PMC_PHW_FLAG_IS_ENABLED) == 0) {
+				phw->phw_state |=  PMC_PHW_FLAG_IS_ENABLED;
+				PMC_UNMARK_ROW_STANDALONE(ri);
+			}
+			/* other cases are a no-op */
+		} else
+			error = EBUSY;
+
+		pmc_restore_cpu_binding(&pb);
+	}
+	break;
+
+
+	/*
+	 * Allocate a PMC.
+	 */
+
+	case PMC_OP_PMCALLOCATE:
+	{
+		uint32_t caps;
+		u_int cpu;
+		int n;
+		enum pmc_mode mode;
+		struct pmc *pmc;
+		struct pmc_hw *phw;
+		struct pmc_op_pmcallocate pa;
+		struct pmc_binding pb;
+
+		if ((error = copyin(arg, &pa, sizeof(pa))) != 0)
+			break;
+
+		caps = pa.pm_caps;
+		mode = pa.pm_mode;
+		cpu  = pa.pm_cpu;
+
+		if ((mode != PMC_MODE_SS  &&  mode != PMC_MODE_SC  &&
+		     mode != PMC_MODE_TS  &&  mode != PMC_MODE_TC) ||
+		    (cpu != (u_int) PMC_CPU_ANY && cpu >= (u_int) ncpus)) {
+			error = EINVAL;
+			break;
+		}
+
+		/*
+		 * Virtual PMCs should only ask for a default CPU.
+		 * System mode PMCs need to specify a non-default CPU.
+		 */
+
+		if ((PMC_IS_VIRTUAL_MODE(mode) && cpu != (u_int) PMC_CPU_ANY) ||
+		    (PMC_IS_SYSTEM_MODE(mode) && cpu == (u_int) PMC_CPU_ANY)) {
+			error = EINVAL;
+			break;
+		}
+
+		/*
+		 * Check that a disabled CPU is not being asked for.
+		 */
+
+		if (PMC_IS_SYSTEM_MODE(mode) && pmc_cpu_is_disabled(cpu)) {
+			error = ENXIO;
+			break;
+		}
+
+		/*
+		 * Refuse an allocation for a system-wide PMC if this
+		 * process has been jailed, or if this process lacks
+		 * super-user credentials and the sysctl tunable
+		 * 'security.bsd.unprivileged_syspmcs' is zero.
+		 */
+
+		if (PMC_IS_SYSTEM_MODE(mode)) {
+			if (jailed(curthread->td_proc->p_ucred)) {
+				error = EPERM;
+				break;
+			}
+			if (!pmc_unprivileged_syspmcs) {
+				error = priv_check(curthread,
+				    PRIV_PMC_SYSTEM);
+				if (error)
+					break;
+			}
+		}
+
+		if (error)
+			break;
+
+		/*
+		 * Look for valid values for 'pm_flags'
+		 */
+
+		if ((pa.pm_flags & ~(PMC_F_DESCENDANTS | PMC_F_LOG_PROCCSW |
+		    PMC_F_LOG_PROCEXIT)) != 0) {
+			error = EINVAL;
+			break;
+		}
+
+		/* process logging options are not allowed for system PMCs */
+		if (PMC_IS_SYSTEM_MODE(mode) && (pa.pm_flags &
+		    (PMC_F_LOG_PROCCSW | PMC_F_LOG_PROCEXIT))) {
+			error = EINVAL;
+			break;
+		}
+
+		/*
+		 * All sampling mode PMCs need to be able to interrupt the
+		 * CPU.
+		 */
+		if (PMC_IS_SAMPLING_MODE(mode))
+			caps |= PMC_CAP_INTERRUPT;
+
+		/* A valid class specifier should have been passed in. */
+		for (n = 0; n < md->pmd_nclass; n++)
+			if (md->pmd_classes[n].pm_class == pa.pm_class)
+				break;
+		if (n == md->pmd_nclass) {
+			error = EINVAL;
+			break;
+		}
+
+		/* The requested PMC capabilities should be feasible. */
+		if ((md->pmd_classes[n].pm_caps & caps) != caps) {
+			error = EOPNOTSUPP;
+			break;
+		}
+
+		PMCDBG(PMC,ALL,2, "event=%d caps=0x%x mode=%d cpu=%d",
+		    pa.pm_ev, caps, mode, cpu);
+
+		pmc = pmc_allocate_pmc_descriptor();
+		pmc->pm_id    = PMC_ID_MAKE_ID(cpu,pa.pm_mode,pa.pm_class,
+		    PMC_ID_INVALID);
+		pmc->pm_event = pa.pm_ev;
+		pmc->pm_state = PMC_STATE_FREE;
+		pmc->pm_caps  = caps;
+		pmc->pm_flags = pa.pm_flags;
+
+		/* switch thread to CPU 'cpu' */
+		pmc_save_cpu_binding(&pb);
+
+#define	PMC_IS_SHAREABLE_PMC(cpu, n)				\
+	(pmc_pcpu[(cpu)]->pc_hwpmcs[(n)]->phw_state &		\
+	 PMC_PHW_FLAG_IS_SHAREABLE)
+#define	PMC_IS_UNALLOCATED(cpu, n)				\
+	(pmc_pcpu[(cpu)]->pc_hwpmcs[(n)]->phw_pmc == NULL)
+
+		if (PMC_IS_SYSTEM_MODE(mode)) {
+			pmc_select_cpu(cpu);
+			for (n = 0; n < (int) md->pmd_npmc; n++)
+				if (pmc_can_allocate_row(n, mode) == 0 &&
+				    pmc_can_allocate_rowindex(
+					    curthread->td_proc, n, cpu) == 0 &&
+				    (PMC_IS_UNALLOCATED(cpu, n) ||
+				     PMC_IS_SHAREABLE_PMC(cpu, n)) &&
+				    md->pmd_allocate_pmc(cpu, n, pmc,
+					&pa) == 0)
+					break;
+		} else {
+			/* Process virtual mode */
+			for (n = 0; n < (int) md->pmd_npmc; n++) {
+				if (pmc_can_allocate_row(n, mode) == 0 &&
+				    pmc_can_allocate_rowindex(
+					    curthread->td_proc, n,
+					    PMC_CPU_ANY) == 0 &&
+				    md->pmd_allocate_pmc(curthread->td_gd->gd_cpuid,
+					n, pmc, &pa) == 0)
+					break;
+			}
+		}
+
+#undef	PMC_IS_UNALLOCATED
+#undef	PMC_IS_SHAREABLE_PMC
+
+		pmc_restore_cpu_binding(&pb);
+
+		if (n == (int) md->pmd_npmc) {
+			pmc_destroy_pmc_descriptor(pmc);
+			FREE(pmc, M_PMC);
+			pmc = NULL;
+			error = EINVAL;
+			break;
+		}
+
+		/* Fill in the correct value in the ID field */
+		pmc->pm_id = PMC_ID_MAKE_ID(cpu,mode,pa.pm_class,n);
+
+		PMCDBG(PMC,ALL,2, "ev=%d class=%d mode=%d n=%d -> pmcid=%x",
+		    pmc->pm_event, pa.pm_class, mode, n, pmc->pm_id);
+
+		/* Process mode PMCs with logging enabled need log files */
+		if (pmc->pm_flags & (PMC_F_LOG_PROCEXIT | PMC_F_LOG_PROCCSW))
+			pmc->pm_flags |= PMC_F_NEEDS_LOGFILE;
+
+		/* All system mode sampling PMCs require a log file */
+		if (PMC_IS_SAMPLING_MODE(mode) && PMC_IS_SYSTEM_MODE(mode))
+			pmc->pm_flags |= PMC_F_NEEDS_LOGFILE;
+
+		/*
+		 * Configure global pmc's immediately
+		 */
+
+		if (PMC_IS_SYSTEM_MODE(PMC_TO_MODE(pmc))) {
+
+			pmc_save_cpu_binding(&pb);
+			pmc_select_cpu(cpu);
+
+			phw = pmc_pcpu[cpu]->pc_hwpmcs[n];
+
+			if ((phw->phw_state & PMC_PHW_FLAG_IS_ENABLED) == 0 ||
+			    (error = md->pmd_config_pmc(cpu, n, pmc)) != 0) {
+				(void) md->pmd_release_pmc(cpu, n, pmc);
+				pmc_destroy_pmc_descriptor(pmc);
+				FREE(pmc, M_PMC);
+				pmc = NULL;
+				pmc_restore_cpu_binding(&pb);
+				error = EPERM;
+				break;
+			}
+
+			pmc_restore_cpu_binding(&pb);
+		}
+
+		pmc->pm_state    = PMC_STATE_ALLOCATED;
+
+		/*
+		 * mark row disposition
+		 */
+
+		if (PMC_IS_SYSTEM_MODE(mode))
+			PMC_MARK_ROW_STANDALONE(n);
+		else
+			PMC_MARK_ROW_THREAD(n);
+
+		/*
+		 * Register this PMC with the current thread as its owner.
+		 */
+
+		if ((error =
+		    pmc_register_owner(curthread->td_proc, pmc)) != 0) {
+			pmc_release_pmc_descriptor(pmc);
+			FREE(pmc, M_PMC);
+			pmc = NULL;
+			break;
+		}
+
+		/*
+		 * Return the allocated index.
+		 */
+
+		pa.pm_pmcid = pmc->pm_id;
+
+		error = copyout(&pa, arg, sizeof(pa));
+	}
+	break;
+
+
+	/*
+	 * Attach a PMC to a process.
+	 */
+
+	case PMC_OP_PMCATTACH:
+	{
+		struct pmc *pm;
+		struct proc *p;
+		struct pmc_op_pmcattach a;
+
+		KKASSERT(lockstatus(&pmc_lock, curthread) == LK_EXCLUSIVE);
+
+		if ((error = copyin(arg, &a, sizeof(a))) != 0)
+			break;
+
+		if (a.pm_pid < 0) {
+			error = EINVAL;
+			break;
+		} else if (a.pm_pid == 0)
+			a.pm_pid = td->td_proc->p_pid;
+
+		if ((error = pmc_find_pmc(a.pm_pmc, &pm)) != 0)
+			break;
+
+		if (PMC_IS_SYSTEM_MODE(PMC_TO_MODE(pm))) {
+			error = EINVAL;
+			break;
+		}
+
+		/* PMCs may be (re)attached only when allocated or stopped */
+		if (pm->pm_state == PMC_STATE_RUNNING) {
+			error = EBUSY;
+			break;
+		} else if (pm->pm_state != PMC_STATE_ALLOCATED &&
+		    pm->pm_state != PMC_STATE_STOPPED) {
+			error = EINVAL;
+			break;
+		}
+
+		/* lookup pid */
+		if ((p = pfind(a.pm_pid)) == NULL) {
+			error = ESRCH;
+			break;
+		}
+
+		/*
+		 * Ignore processes that are working on exiting.
+		 */
+		if (p->p_flag & P_WEXIT) {
+			error = ESRCH;
+			PROC_UNLOCK(p);	/* pfind() returns a locked process */
+			break;
+		}
+
+		/*
+		 * we are allowed to attach a PMC to a process if
+		 * we can debug it.
+		 */
+		error = p_candebug(curthread, p);
+
+		PROC_UNLOCK(p);
+
+		if (error == 0)
+			error = pmc_attach_process(p, pm);
+	}
+	break;
+
+
+	/*
+	 * Detach an attached PMC from a process.
+	 */
+
+	case PMC_OP_PMCDETACH:
+	{
+		struct pmc *pm;
+		struct proc *p;
+		struct pmc_op_pmcattach a;
+
+		if ((error = copyin(arg, &a, sizeof(a))) != 0)
+			break;
+
+		if (a.pm_pid < 0) {
+			error = EINVAL;
+			break;
+		} else if (a.pm_pid == 0)
+			a.pm_pid = td->td_proc->p_pid;
+
+		if ((error = pmc_find_pmc(a.pm_pmc, &pm)) != 0)
+			break;
+
+		if ((p = pfind(a.pm_pid)) == NULL) {
+			error = ESRCH;
+			break;
+		}
+
+		/*
+		 * Treat processes that are in the process of exiting
+		 * as if they were not present.
+		 */
+
+		if (p->p_flag & P_WEXIT)
+			error = ESRCH;
+
+		PROC_UNLOCK(p);	/* pfind() returns a locked process */
+
+		if (error == 0)
+			error = pmc_detach_process(p, pm);
+	}
+	break;
+
+
+	/*
+	 * Retrieve the MSR number associated with the counter
+	 * 'pmc_id'.  This allows processes to directly use RDPMC
+	 * instructions to read their PMCs, without the overhead of a
+	 * system call.
+	 */
+
+	case PMC_OP_PMCGETMSR:
+	{
+		int ri;
+		struct pmc	*pm;
+		struct pmc_target *pt;
+		struct pmc_op_getmsr gm;
+
+		PMC_DOWNGRADE_SX();
+
+		/* CPU has no 'GETMSR' support */
+		if (md->pmd_get_msr == NULL) {
+			error = ENOSYS;
+			break;
+		}
+
+		if ((error = copyin(arg, &gm, sizeof(gm))) != 0)
+			break;
+
+		if ((error = pmc_find_pmc(gm.pm_pmcid, &pm)) != 0)
+			break;
+
+		/*
+		 * The allocated PMC has to be a process virtual PMC,
+		 * i.e., of type MODE_T[CS].  Global PMCs can only be
+		 * read using the PMCREAD operation since they may be
+		 * allocated on a different CPU than the one we could
+		 * be running on at the time of the RDPMC instruction.
+		 *
+		 * The GETMSR operation is not allowed for PMCs that
+		 * are inherited across processes.
+		 */
+
+		if (!PMC_IS_VIRTUAL_MODE(PMC_TO_MODE(pm)) ||
+		    (pm->pm_flags & PMC_F_DESCENDANTS)) {
+			error = EINVAL;
+			break;
+		}
+
+		/*
+		 * It only makes sense to use a RDPMC (or its
+		 * equivalent instruction on non-x86 architectures) on
+		 * a process that has allocated and attached a PMC to
+		 * itself.  Conversely the PMC is only allowed to have
+		 * one process attached to it -- its owner.
+		 */
+
+		if ((pt = LIST_FIRST(&pm->pm_targets)) == NULL ||
+		    LIST_NEXT(pt, pt_next) != NULL ||
+		    pt->pt_process->pp_proc != pm->pm_owner->po_owner) {
+			error = EINVAL;
+			break;
+		}
+
+		ri = PMC_TO_ROWINDEX(pm);
+
+		if ((error = (*md->pmd_get_msr)(ri, &gm.pm_msr)) < 0)
+			break;
+
+		if ((error = copyout(&gm, arg, sizeof(gm))) < 0)
+			break;
+
+		/*
+		 * Mark our process as using MSRs.  Update machine
+		 * state using a forced context switch.
+		 */
+
+		pt->pt_process->pp_flags |= PMC_PP_ENABLE_MSR_ACCESS;
+		pmc_force_context_switch();
+
+	}
+	break;
+
+	/*
+	 * Release an allocated PMC
+	 */
+
+	case PMC_OP_PMCRELEASE:
+	{
+		pmc_id_t pmcid;
+		struct pmc *pm;
+		struct pmc_owner *po;
+		struct pmc_op_simple sp;
+
+		/*
+		 * Find PMC pointer for the named PMC.
+		 *
+		 * Use pmc_release_pmc_descriptor() to switch off the
+		 * PMC, remove all its target threads, and remove the
+		 * PMC from its owner's list.
+		 *
+		 * Remove the owner record if this is the last PMC
+		 * owned.
+		 *
+		 * Free up space.
+		 */
+
+		if ((error = copyin(arg, &sp, sizeof(sp))) != 0)
+			break;
+
+		pmcid = sp.pm_pmcid;
+
+		if ((error = pmc_find_pmc(pmcid, &pm)) != 0)
+			break;
+
+		po = pm->pm_owner;
+		pmc_release_pmc_descriptor(pm);
+		pmc_maybe_remove_owner(po);
+
+		FREE(pm, M_PMC);
+	}
+	break;
+
+
+	/*
+	 * Read and/or write a PMC.
+	 */
+
+	case PMC_OP_PMCRW:
+	{
+		uint32_t cpu, ri;
+		struct pmc *pm;
+		struct pmc_op_pmcrw *pprw;
+		struct pmc_op_pmcrw prw;
+		struct pmc_binding pb;
+		pmc_value_t oldvalue;
+
+		PMC_DOWNGRADE_SX();
+
+		if ((error = copyin(arg, &prw, sizeof(prw))) != 0)
+			break;
+
+		ri = 0;
+		PMCDBG(PMC,OPS,1, "rw id=%d flags=0x%x", prw.pm_pmcid,
+		    prw.pm_flags);
+
+		/* must have at least one flag set */
+		if ((prw.pm_flags & (PMC_F_OLDVALUE|PMC_F_NEWVALUE)) == 0) {
+			error = EINVAL;
+			break;
+		}
+
+		/* locate pmc descriptor */
+		if ((error = pmc_find_pmc(prw.pm_pmcid, &pm)) != 0)
+			break;
+
+		/* Can't read a PMC that hasn't been started. */
+		if (pm->pm_state != PMC_STATE_ALLOCATED &&
+		    pm->pm_state != PMC_STATE_STOPPED &&
+		    pm->pm_state != PMC_STATE_RUNNING) {
+			error = EINVAL;
+			break;
+		}
+
+		/* writing a new value is allowed only for 'STOPPED' pmcs */
+		if (pm->pm_state == PMC_STATE_RUNNING &&
+		    (prw.pm_flags & PMC_F_NEWVALUE)) {
+			error = EBUSY;
+			break;
+		}
+
+		if (PMC_IS_VIRTUAL_MODE(PMC_TO_MODE(pm))) {
+
+			/*
+			 * If this PMC is attached to its owner (i.e.,
+			 * the process requesting this operation) and
+			 * is running, then attempt to get an
+			 * upto-date reading from hardware for a READ.
+			 * Writes are only allowed when the PMC is
+			 * stopped, so only update the saved value
+			 * field.
+			 *
+			 * If the PMC is not running, or is not
+			 * attached to its owner, read/write to the
+			 * savedvalue field.
+			 */
+
+			ri = PMC_TO_ROWINDEX(pm);
+
+			spin_lock_wr(&pm->lock);
+			cpu = curthread->td_gd->gd_cpuid;
+
+			if (prw.pm_flags & PMC_F_OLDVALUE) {
+				if ((pm->pm_flags & PMC_F_ATTACHED_TO_OWNER) &&
+				    (pm->pm_state == PMC_STATE_RUNNING))
+					error = (*md->pmd_read_pmc)(cpu, ri,
+					    &oldvalue);
+				else
+					oldvalue = pm->pm_gv.pm_savedvalue;
+			}
+			if (prw.pm_flags & PMC_F_NEWVALUE)
+				pm->pm_gv.pm_savedvalue = prw.pm_value;
+
+			spin_unlock_wr(&pm->lock);
+
+		} else { /* System mode PMCs */
+			cpu = PMC_TO_CPU(pm);
+			ri  = PMC_TO_ROWINDEX(pm);
+
+			if (pmc_cpu_is_disabled(cpu)) {
+				error = ENXIO;
+				break;
+			}
+
+			/* move this thread to CPU 'cpu' */
+			pmc_save_cpu_binding(&pb);
+			pmc_select_cpu(cpu);
+
+			critical_enter();
+			/* save old value */
+			if (prw.pm_flags & PMC_F_OLDVALUE)
+				if ((error = (*md->pmd_read_pmc)(cpu, ri,
+					 &oldvalue)))
+					goto error;
+			/* write out new value */
+			if (prw.pm_flags & PMC_F_NEWVALUE)
+				error = (*md->pmd_write_pmc)(cpu, ri,
+				    prw.pm_value);
+		error:
+			critical_exit();
+			pmc_restore_cpu_binding(&pb);
+			if (error)
+				break;
+		}
+
+		pprw = (struct pmc_op_pmcrw *) arg;
+
+#ifdef	DEBUG
+		if (prw.pm_flags & PMC_F_NEWVALUE)
+			PMCDBG(PMC,OPS,2, "rw id=%d new %jx -> old %jx",
+			    ri, prw.pm_value, oldvalue);
+		else if (prw.pm_flags & PMC_F_OLDVALUE)
+			PMCDBG(PMC,OPS,2, "rw id=%d -> old %jx", ri, oldvalue);
+#endif
+
+		/* return old value if requested */
+		if (prw.pm_flags & PMC_F_OLDVALUE)
+			if ((error = copyout(&oldvalue, &pprw->pm_value,
+				 sizeof(prw.pm_value))))
+				break;
+
+	}
+	break;
+
+
+	/*
+	 * Set the sampling rate for a sampling mode PMC and the
+	 * initial count for a counting mode PMC.
+	 */
+
+	case PMC_OP_PMCSETCOUNT:
+	{
+		struct pmc *pm;
+		struct pmc_op_pmcsetcount sc;
+
+		PMC_DOWNGRADE_SX();
+
+		if ((error = copyin(arg, &sc, sizeof(sc))) != 0)
+			break;
+
+		if ((error = pmc_find_pmc(sc.pm_pmcid, &pm)) != 0)
+			break;
+
+		if (pm->pm_state == PMC_STATE_RUNNING) {
+			error = EBUSY;
+			break;
+		}
+
+		if (PMC_IS_SAMPLING_MODE(PMC_TO_MODE(pm)))
+			pm->pm_sc.pm_reloadcount = sc.pm_count;
+		else
+			pm->pm_sc.pm_initial = sc.pm_count;
+	}
+	break;
+
+
+	/*
+	 * Start a PMC.
+	 */
+
+	case PMC_OP_PMCSTART:
+	{
+		pmc_id_t pmcid;
+		struct pmc *pm;
+		struct pmc_op_simple sp;
+
+		KKASSERT(lockstatus(&pmc_lock, curthread) == LK_EXCLUSIVE);
+
+		if ((error = copyin(arg, &sp, sizeof(sp))) != 0)
+			break;
+
+		pmcid = sp.pm_pmcid;
+
+		if ((error = pmc_find_pmc(pmcid, &pm)) != 0)
+			break;
+
+		KASSERT(pmcid == pm->pm_id,
+		    ("[pmc,%d] pmcid %x != id %x", __LINE__,
+			pm->pm_id, pmcid));
+
+		if (pm->pm_state == PMC_STATE_RUNNING) /* already running */
+			break;
+		else if (pm->pm_state != PMC_STATE_STOPPED &&
+		    pm->pm_state != PMC_STATE_ALLOCATED) {
+			error = EINVAL;
+			break;
+		}
+
+		error = pmc_start(pm);
+	}
+	break;
+
+
+	/*
+	 * Stop a PMC.
+	 */
+
+	case PMC_OP_PMCSTOP:
+	{
+		pmc_id_t pmcid;
+		struct pmc *pm;
+		struct pmc_op_simple sp;
+
+		PMC_DOWNGRADE_SX();
+
+		if ((error = copyin(arg, &sp, sizeof(sp))) != 0)
+			break;
+
+		pmcid = sp.pm_pmcid;
+
+		/*
+		 * Mark the PMC as inactive and invoke the MD stop
+		 * routines if needed.
+		 */
+
+		if ((error = pmc_find_pmc(pmcid, &pm)) != 0)
+			break;
+
+		KASSERT(pmcid == pm->pm_id,
+		    ("[pmc,%d] pmc id %x != pmcid %x", __LINE__,
+			pm->pm_id, pmcid));
+
+		if (pm->pm_state == PMC_STATE_STOPPED) /* already stopped */
+			break;
+		else if (pm->pm_state != PMC_STATE_RUNNING) {
+			error = EINVAL;
+			break;
+		}
+
+		error = pmc_stop(pm);
+	}
+	break;
+
+
+	/*
+	 * Write a user supplied value to the log file.
+	 */
+
+	case PMC_OP_WRITELOG:
+	{
+		struct pmc_op_writelog wl;
+		struct pmc_owner *po;
+
+		PMC_DOWNGRADE_SX();
+
+		if ((error = copyin(arg, &wl, sizeof(wl))) != 0)
+			break;
+
+		if ((po = pmc_find_owner_descriptor(td->td_proc)) == NULL) {
+			error = EINVAL;
+			break;
+		}
+
+		if ((po->po_flags & PMC_PO_OWNS_LOGFILE) == 0) {
+			error = EINVAL;
+			break;
+		}
+
+		error = pmclog_process_userlog(po, &wl);
+	}
+	break;
+
+
+	default:
+		error = EINVAL;
+		break;
+	}
+
+	lockmgr(&pmc_lock, LK_RELEASE);
+
+	if (error)
+		atomic_add_int(&pmc_stats.pm_syscall_errors, 1);
+
+	PICKUP_GIANT();
+
+	return error;
+}
+
+/*
+ * Helper functions
+ */
+
+
+/*
+ * Interrupt processing.
+ *
+ * Find a free slot in the per-cpu array of PC samples and write the
+ * current (PMC,PID,PC) triple to it.  If an event was successfully
+ * added, a bit is set in mask 'pmc_cpumask' denoting that the
+ * DO_SAMPLES hook needs to be invoked from the clock handler.
+ *
+ * This function is meant to be called from an NMI handler.  It cannot
+ * use any of the locking primitives supplied by the OS.
+ */
+
+int
+pmc_process_interrupt(int cpu, struct pmc *pm, uintfptr_t pc, int usermode)
+{
+	int error, ri;
+	struct thread *td;
+	struct pmc_sample *ps;
+	struct pmc_samplebuffer *psb;
+
+	error = 0;
+	ri = PMC_TO_ROWINDEX(pm);
+
+	psb = pmc_pcpu[cpu]->pc_sb;
+
+	ps = psb->ps_write;
+	if (ps->ps_pc) {	/* in use, reader hasn't caught up */
+		pm->pm_stalled = 1;
+		atomic_add_int(&pmc_stats.pm_intr_bufferfull, 1);
+		PMCDBG(SAM,INT,1,"(spc) cpu=%d pm=%p pc=%jx um=%d wr=%d rd=%d",
+		    cpu, pm, (uint64_t) pc, usermode,
+		    (int) (psb->ps_write - psb->ps_samples),
+		    (int) (psb->ps_read - psb->ps_samples));
+		error = ENOMEM;
+		goto done;
+	}
+
+	/* fill in entry */
+	PMCDBG(SAM,INT,1,"cpu=%d pm=%p pc=%jx um=%d wr=%d rd=%d", cpu, pm,
+	    (uint64_t) pc, usermode,
+	    (int) (psb->ps_write - psb->ps_samples),
+	    (int) (psb->ps_read - psb->ps_samples));
+
+	atomic_add_rel_32(&pm->pm_runcount, 1);		/* hold onto PMC */
+	ps->ps_pmc = pm;
+	if ((td = curthread) && td->td_proc)
+		ps->ps_pid = td->td_proc->p_pid;
+	else
+		ps->ps_pid = -1;
+	ps->ps_usermode = usermode;
+	ps->ps_pc = pc;		/* mark entry as in use */
+
+	/* increment write pointer, modulo ring buffer size */
+	ps++;
+	if (ps == psb->ps_fence)
+		psb->ps_write = psb->ps_samples;
+	else
+		psb->ps_write = ps;
+
+ done:
+	/* mark CPU as needing processing */
+	atomic_set_rel_int(&pmc_cpumask, (1 << cpu));
+
+	return error;
+}
+
+
+/*
+ * Process saved PC samples.
+ */
+
+static void
+pmc_process_samples(int cpu)
+{
+	int n, ri;
+	struct pmc *pm;
+	struct pmc_owner *po;
+	struct pmc_sample *ps;
+	struct pmc_samplebuffer *psb;
+
+	KASSERT(mycpu->gd_cpuid == cpu,
+	    ("[pmc,%d] not on the correct CPU pcpu=%d cpu=%d", __LINE__,
+		mycpu->gd_cpuid, cpu));
+
+	psb = pmc_pcpu[cpu]->pc_sb;
+
+	for (n = 0; n < pmc_nsamples; n++) { /* bound on #iterations */
+
+		ps = psb->ps_read;
+		if (ps->ps_pc == (uintfptr_t) 0)	/* no data */
+			break;
+
+		pm = ps->ps_pmc;
+		po = pm->pm_owner;
+
+		KASSERT(PMC_IS_SAMPLING_MODE(PMC_TO_MODE(pm)),
+		    ("[pmc,%d] pmc=%p non-sampling mode=%d", __LINE__,
+			pm, PMC_TO_MODE(pm)));
+
+		/* Ignore PMCs that have been switched off */
+		if (pm->pm_state != PMC_STATE_RUNNING)
+			goto entrydone;
+
+		PMCDBG(SAM,OPS,1,"cpu=%d pm=%p pc=%jx um=%d wr=%d rd=%d", cpu,
+		    pm, (uint64_t) ps->ps_pc, ps->ps_usermode,
+		    (int) (psb->ps_write - psb->ps_samples),
+		    (int) (psb->ps_read - psb->ps_samples));
+
+		/*
+		 * If this is a process-mode PMC that is attached to
+		 * its owner, and if the PC is in user mode, update
+		 * profiling statistics like timer-based profiling
+		 * would have done.
+		 */
+		if (pm->pm_flags & PMC_F_ATTACHED_TO_OWNER) {
+			if (ps->ps_usermode) {
+				addupc_intr(po->po_owner, ps->ps_pc, 1);
+			}
+			goto entrydone;
+		}
+
+		/*
+		 * Otherwise, this is either a sampling mode PMC that
+		 * is attached to a different process than its owner,
+		 * or a system-wide sampling PMC.  Dispatch a log
+		 * entry to the PMC's owner process.
+		 */
+
+		pmclog_process_pcsample(pm, ps);
+
+	entrydone:
+		ps->ps_pc = (uintfptr_t) 0;	/* mark entry as free */
+		atomic_subtract_rel_32(&pm->pm_runcount, 1);
+
+		/* increment read pointer, modulo sample size */
+		if (++ps == psb->ps_fence)
+			psb->ps_read = psb->ps_samples;
+		else
+			psb->ps_read = ps;
+	}
+
+	atomic_add_int(&pmc_stats.pm_log_sweeps, 1);
+
+	/* Do not re-enable stalled PMCs if we failed to process any samples */
+	if (n == 0)
+		return;
+
+	/*
+	 * Restart any stalled sampling PMCs on this CPU.
+	 *
+	 * If the NMI handler sets the pm_stalled field of a PMC after
+	 * the check below, we'll end up processing the stalled PMC at
+	 * the next hardclock tick.
+	 */
+	for (n = 0; n < md->pmd_npmc; n++) {
+		(void) (*md->pmd_get_config)(cpu,n,&pm);
+		if (pm == NULL ||			 /* !cfg'ed */
+		    pm->pm_state != PMC_STATE_RUNNING || /* !active */
+		    !PMC_IS_SAMPLING_MODE(PMC_TO_MODE(pm)) || /* !sampling */
+		    pm->pm_stalled == 0) /* !stalled */
+			continue;
+
+		pm->pm_stalled = 0;
+		ri = PMC_TO_ROWINDEX(pm);
+		(*md->pmd_start_pmc)(cpu, ri);
+	}
+}
+
+/*
+ * Event handlers.
+ */
+
+/*
+ * Handle a process exit.
+ *
+ * Remove this process from all hash tables.  If this process
+ * owned any PMCs, turn off those PMCs and deallocate them,
+ * removing any associations with target processes.
+ *
+ * This function will be called by the last 'thread' of a
+ * process.
+ *
+ * XXX This eventhandler gets called early in the exit process.
+ * Consider using a 'hook' invocation from thread_exit() or equivalent
+ * spot.  Another negative is that kse_exit doesn't seem to call
+ * exit1() [??].
+ *
+ */
+
+static void
+pmc_process_exit(struct thread *td)
+{
+	int is_using_hwpmcs;
+	int cpu;
+	unsigned int ri;
+	struct pmc *pm;
+	struct pmc_process *pp;
+	struct pmc_owner *po;
+	pmc_value_t newvalue, tmp;
+	struct proc *p;
+
+	p = td->td_proc;
+	KKASSERT(p);
+
+	PROC_LOCK(p);
+	is_using_hwpmcs = p->p_flag & P_HWPMC;
+	PROC_UNLOCK(p);
+
+	/*
+	 * Log a sysexit event to all SS PMC owners.
+	 */
+	LIST_FOREACH(po, &pmc_ss_owners, po_ssnext)
+	    if (po->po_flags & PMC_PO_OWNS_LOGFILE)
+		    pmclog_process_sysexit(po, p->p_pid);
+
+	if (!is_using_hwpmcs)
+		return;
+
+	PMC_GET_SX_XLOCK();
+	PMCDBG(PRC,EXT,1,"process-exit proc=%p (%d, %s)", p, p->p_pid,
+	    p->p_comm);
+
+	/*
+	 * Since this code is invoked by the last thread in an exiting
+	 * process, we would have context switched IN at some prior
+	 * point.  However, with PREEMPTION, kernel mode context
+	 * switches may happen any time, so we want to disable a
+	 * context switch OUT till we get any PMCs targetting this
+	 * process off the hardware.
+	 *
+	 * We also need to atomically remove this process'
+	 * entry from our target process hash table, using
+	 * PMC_FLAG_REMOVE.
+	 */
+	PMCDBG(PRC,EXT,1, "process-exit proc=%p (%d, %s)", p, p->p_pid,
+	    p->p_comm);
+
+	critical_enter(); /* no preemption */
+
+	cpu = curthread->td_gd->gd_cpuid;
+
+	if ((pp = pmc_find_process_descriptor(p,
+		 PMC_FLAG_REMOVE)) != NULL) {
+
+		PMCDBG(PRC,EXT,2,
+		    "process-exit proc=%p pmc-process=%p", p, pp);
+
+		/*
+		 * The exiting process could the target of
+		 * some PMCs which will be running on
+		 * currently executing CPU.
+		 *
+		 * We need to turn these PMCs off like we
+		 * would do at context switch OUT time.
+		 */
+		for (ri = 0; ri < md->pmd_npmc; ri++) {
+
+			/*
+			 * Pick up the pmc pointer from hardware
+			 * state similar to the CSW_OUT code.
+			 */
+			pm = NULL;
+			(void) (*md->pmd_get_config)(cpu, ri, &pm);
+
+			PMCDBG(PRC,EXT,2, "ri=%d pm=%p", ri, pm);
+
+			if (pm == NULL ||
+			    !PMC_IS_VIRTUAL_MODE(PMC_TO_MODE(pm)))
+				continue;
+
+			PMCDBG(PRC,EXT,2, "ppmcs[%d]=%p pm=%p "
+			    "state=%d", ri, pp->pp_pmcs[ri].pp_pmc,
+			    pm, pm->pm_state);
+
+			KASSERT(PMC_TO_ROWINDEX(pm) == ri,
+			    ("[pmc,%d] ri mismatch pmc(%d) ri(%d)",
+				__LINE__, PMC_TO_ROWINDEX(pm), ri));
+
+			KASSERT(pm == pp->pp_pmcs[ri].pp_pmc,
+			    ("[pmc,%d] pm %p != pp_pmcs[%d] %p",
+				__LINE__, pm, ri, pp->pp_pmcs[ri].pp_pmc));
+
+			(void) md->pmd_stop_pmc(cpu, ri);
+
+			KASSERT(pm->pm_runcount > 0,
+			    ("[pmc,%d] bad runcount ri %d rc %d",
+				__LINE__, ri, pm->pm_runcount));
+
+			/* Stop hardware only if it is actually running */
+			if (pm->pm_state == PMC_STATE_RUNNING &&
+			    pm->pm_stalled == 0) {
+				md->pmd_read_pmc(cpu, ri, &newvalue);
+				tmp = newvalue -
+				    PMC_PCPU_SAVED(cpu,ri);
+
+				spin_lock_wr(&pm->lock);
+				pm->pm_gv.pm_savedvalue += tmp;
+				pp->pp_pmcs[ri].pp_pmcval += tmp;
+				spin_unlock_wr(&pm->lock);
+			}
+
+			atomic_subtract_rel_32(&pm->pm_runcount,1);
+
+			KASSERT((int) pm->pm_runcount >= 0,
+			    ("[pmc,%d] runcount is %d", __LINE__, ri));
+
+			(void) md->pmd_config_pmc(cpu, ri, NULL);
+		}
+
+		/*
+		 * Inform the MD layer of this pseudo "context switch
+		 * out"
+		 */
+		(void) md->pmd_switch_out(pmc_pcpu[cpu], pp);
+
+		critical_exit(); /* ok to be pre-empted now */
+
+		/*
+		 * Unlink this process from the PMCs that are
+		 * targetting it.  This will send a signal to
+		 * all PMC owner's whose PMCs are orphaned.
+		 *
+		 * Log PMC value at exit time if requested.
+		 */
+		for (ri = 0; ri < md->pmd_npmc; ri++)
+			if ((pm = pp->pp_pmcs[ri].pp_pmc) != NULL) {
+				if (pm->pm_flags & PMC_F_NEEDS_LOGFILE &&
+				    PMC_IS_COUNTING_MODE(PMC_TO_MODE(pm)))
+					pmclog_process_procexit(pm, pp);
+				pmc_unlink_target_process(pm, pp);
+			}
+		FREE(pp, M_PMC);
+
+	} else
+		critical_exit(); /* pp == NULL */
+
+
+	/*
+	 * If the process owned PMCs, free them up and free up
+	 * memory.
+	 */
+	if ((po = pmc_find_owner_descriptor(p)) != NULL) {
+		pmc_remove_owner(po);
+		pmc_destroy_owner_descriptor(po);
+	}
+
+	lockmgr(&pmc_lock, LK_RELEASE);
+}
+
+/*
+ * Handle a process fork.
+ *
+ * If the parent process 'p1' is under HWPMC monitoring, then copy
+ * over any attached PMCs that have 'do_descendants' semantics.
+ */
+
+static void
+pmc_process_fork(struct proc *p1, struct proc *newproc,
+    int flags)
+{
+	int is_using_hwpmcs;
+	unsigned int ri;
+	uint32_t do_descendants;
+	struct pmc *pm;
+	struct pmc_owner *po;
+	struct pmc_process *ppnew, *ppold;
+
+	(void) flags;		/* unused parameter */
+
+	PROC_LOCK(p1);
+	is_using_hwpmcs = p1->p_flag & P_HWPMC;
+	PROC_UNLOCK(p1);
+
+	/*
+	 * If there are system-wide sampling PMCs active, we need to
+	 * log all fork events to their owner's logs.
+	 */
+
+	LIST_FOREACH(po, &pmc_ss_owners, po_ssnext)
+	    if (po->po_flags & PMC_PO_OWNS_LOGFILE)
+		    pmclog_process_procfork(po, p1->p_pid, newproc->p_pid);
+
+	if (!is_using_hwpmcs)
+		return;
+
+	PMC_GET_SX_XLOCK();
+	PMCDBG(PMC,FRK,1, "process-fork proc=%p (%d, %s) -> %p", p1,
+	    p1->p_pid, p1->p_comm, newproc);
+
+	/*
+	 * If the parent process (curthread->td_proc) is a
+	 * target of any PMCs, look for PMCs that are to be
+	 * inherited, and link these into the new process
+	 * descriptor.
+	 */
+	if ((ppold = pmc_find_process_descriptor(curthread->td_proc,
+		 PMC_FLAG_NONE)) == NULL)
+		goto done;		/* nothing to do */
+
+	do_descendants = 0;
+	for (ri = 0; ri < md->pmd_npmc; ri++)
+		if ((pm = ppold->pp_pmcs[ri].pp_pmc) != NULL)
+			do_descendants |= pm->pm_flags & PMC_F_DESCENDANTS;
+	if (do_descendants == 0) /* nothing to do */
+		goto done;
+
+	/* allocate a descriptor for the new process  */
+	if ((ppnew = pmc_find_process_descriptor(newproc,
+		 PMC_FLAG_ALLOCATE)) == NULL)
+		goto done;
+
+	/*
+	 * Run through all PMCs that were targeting the old process
+	 * and which specified F_DESCENDANTS and attach them to the
+	 * new process.
+	 *
+	 * Log the fork event to all owners of PMCs attached to this
+	 * process, if not already logged.
+	 */
+	for (ri = 0; ri < md->pmd_npmc; ri++)
+		if ((pm = ppold->pp_pmcs[ri].pp_pmc) != NULL &&
+		    (pm->pm_flags & PMC_F_DESCENDANTS)) {
+			pmc_link_target_process(pm, ppnew);
+			po = pm->pm_owner;
+			if (po->po_sscount == 0 &&
+			    po->po_flags & PMC_PO_OWNS_LOGFILE)
+				pmclog_process_procfork(po, p1->p_pid,
+				    newproc->p_pid);
+		}
+
+	/*
+	 * Now mark the new process as being tracked by this driver.
+	 */
+	PROC_LOCK(newproc);
+	newproc->p_flag |= P_HWPMC;
+	PROC_UNLOCK(newproc);
+
+ done:
+	lockmgr(&pmc_lock, LK_RELEASE);
+}
+
+
+/*
+ * initialization
+ */
+
+static const char *pmc_name_of_pmcclass[] = {
+#undef	__PMC_CLASS
+#define	__PMC_CLASS(N) #N ,
+	__PMC_CLASSES()
+};
+
+static int
+pmc_initialize(void)
+{
+	int cpu, error, n;
+	struct pmc_binding pb;
+	struct pmc_samplebuffer *sb;
+
+	md = NULL;
+	error = 0;
+
+#ifdef	DEBUG
+	/* parse debug flags first */
+	if (TUNABLE_STR_FETCH(PMC_SYSCTL_NAME_PREFIX "debugflags",
+		pmc_debugstr, sizeof(pmc_debugstr)))
+		pmc_debugflags_parse(pmc_debugstr,
+		    pmc_debugstr+strlen(pmc_debugstr));
+#endif
+
+	PMCDBG(MOD,INI,0, "PMC Initialize (version %x)", PMC_VERSION);
+
+	/* check kernel version */
+	if (pmc_kernel_version != PMC_VERSION) {
+		if (pmc_kernel_version == 0)
+			kprintf("hwpmc: this kernel has not been compiled with "
+			    "'options HWPMC_HOOKS'.\n");
+		else
+			kprintf("hwpmc: kernel version (0x%x) does not match "
+			    "module version (0x%x).\n", pmc_kernel_version,
+			    PMC_VERSION);
+		return EPROGMISMATCH;
+	}
+
+	/*
+	 * check sysctl parameters
+	 */
+
+	if (pmc_hashsize <= 0) {
+		(void) kprintf("hwpmc: tunable hashsize=%d must be greater "
+		    "than zero.\n", pmc_hashsize);
+		pmc_hashsize = PMC_HASH_SIZE;
+	}
+
+	if (pmc_nsamples <= 0 || pmc_nsamples > 65535) {
+		(void) kprintf("hwpmc: tunable nsamples=%d out of range.\n",
+		    pmc_nsamples);
+		pmc_nsamples = PMC_NSAMPLES;
+	}
+
+	md = pmc_md_initialize();
+
+	if (md == NULL || md->pmd_init == NULL)
+		return ENOSYS;
+
+	/* allocate space for the per-cpu array */
+	MALLOC(pmc_pcpu, struct pmc_cpu **, ncpus * sizeof(struct pmc_cpu *),
+	    M_PMC, M_WAITOK|M_ZERO);
+
+	/* per-cpu 'saved values' for managing process-mode PMCs */
+	MALLOC(pmc_pcpu_saved, pmc_value_t *,
+	    sizeof(pmc_value_t) * ncpus * md->pmd_npmc, M_PMC, M_WAITOK);
+
+	/* perform cpu dependent initialization */
+	pmc_save_cpu_binding(&pb);
+	for (cpu = 0; cpu < ncpus; cpu++) {
+		if (pmc_cpu_is_disabled(cpu))
+			continue;
+		pmc_select_cpu(cpu);
+		if ((error = md->pmd_init(cpu)) != 0)
+			break;
+	}
+	pmc_restore_cpu_binding(&pb);
+
+	if (error != 0)
+		return error;
+
+	/* allocate space for the sample array */
+	for (cpu = 0; cpu < ncpus; cpu++) {
+		if (pmc_cpu_is_disabled(cpu))
+			continue;
+		MALLOC(sb, struct pmc_samplebuffer *,
+		    sizeof(struct pmc_samplebuffer) +
+		    pmc_nsamples * sizeof(struct pmc_sample), M_PMC,
+		    M_WAITOK|M_ZERO);
+
+		sb->ps_read = sb->ps_write = sb->ps_samples;
+		sb->ps_fence = sb->ps_samples + pmc_nsamples;
+		KASSERT(pmc_pcpu[cpu] != NULL,
+		    ("[pmc,%d] cpu=%d Null per-cpu data", __LINE__, cpu));
+
+		pmc_pcpu[cpu]->pc_sb = sb;
+	}
+
+	/* allocate space for the row disposition array */
+	pmc_pmcdisp = kmalloc(sizeof(enum pmc_mode) * md->pmd_npmc,
+	    M_PMC, M_WAITOK|M_ZERO);
+
+	KASSERT(pmc_pmcdisp != NULL,
+	    ("[pmc,%d] pmcdisp allocation returned NULL", __LINE__));
+
+	/* mark all PMCs as available */
+	for (n = 0; n < (int) md->pmd_npmc; n++)
+		PMC_MARK_ROW_FREE(n);
+
+	/* allocate thread hash tables */
+	pmc_ownerhash = hashinit(pmc_hashsize, M_PMC,
+	    &pmc_ownerhashmask);
+
+	pmc_processhash = hashinit(pmc_hashsize, M_PMC,
+	    &pmc_processhashmask);
+	spin_init(&pmc_processhash_lock);
+
+	LIST_INIT(&pmc_ss_owners);
+	pmc_ss_count = 0;
+
+	PMCDBG(MOD,INI,1, "pmc_ownerhash=%p, mask=0x%lx "
+	    "targethash=%p mask=0x%lx", pmc_ownerhash, pmc_ownerhashmask,
+	    pmc_processhash, pmc_processhashmask);
+
+	/* register process {exit,fork,exec} handlers */
+	if (at_exit(pmc_process_exit)) {
+		panic("cannot register exit() handler\n");
+	}
+	if (at_fork(pmc_process_fork)) {
+		panic("cannot register fork() handler\n");
+	}
+
+	/* initialize logging */
+	pmclog_initialize();
+
+	/* set hook functions */
+	pmc_intr = md->pmd_intr;
+	pmc_hook = pmc_hook_handler;
+
+	if (error == 0) {
+		kprintf(PMC_MODULE_NAME ":");
+		for (n = 0; n < (int) md->pmd_nclass; n++) {
+			kprintf(" %s/%d/0x%b",
+			    pmc_name_of_pmcclass[md->pmd_classes[n].pm_class],
+			    md->pmd_nclasspmcs[n],
+			    md->pmd_classes[n].pm_caps,
+			    "\20"
+			    "\1INT\2USR\3SYS\4EDG\5THR"
+			    "\6REA\7WRI\10INV\11QUA\12PRC"
+			    "\13TAG\14CSC");
+		}
+		kprintf("\n");
+	}
+
+	return error;
+}
+
+/* prepare to be unloaded */
+static void
+pmc_cleanup(void)
+{
+	int cpu;
+	struct pmc_ownerhash *ph;
+	struct pmc_owner *po, *tmp;
+	struct pmc_binding pb;
+#ifdef	DEBUG
+	struct pmc_processhash *prh;
+#endif
+
+	PMCDBG(MOD,INI,0, "%s", "cleanup");
+
+	/* switch off sampling */
+	atomic_store_rel_int(&pmc_cpumask, 0);
+	pmc_intr = NULL;
+
+	lockmgr(&pmc_lock, LK_EXCLUSIVE);
+	if (pmc_hook == NULL) {	/* being unloaded already */
+		lockmgr(&pmc_lock, LK_RELEASE);
+		return;
+	}
+
+	pmc_hook = NULL; /* prevent new threads from entering module */
+
+	/* deregister event handlers */
+	EVENTHANDLER_DEREGISTER(process_fork, pmc_fork_tag);
+	EVENTHANDLER_DEREGISTER(process_exit, pmc_exit_tag);
+
+	/* send SIGBUS to all owner threads, free up allocations */
+	if (pmc_ownerhash)
+		for (ph = pmc_ownerhash;
+		     ph <= &pmc_ownerhash[pmc_ownerhashmask];
+		     ph++) {
+			LIST_FOREACH_MUTABLE(po, ph, po_next, tmp) {
+				pmc_remove_owner(po);
+
+				/* send SIGBUS to owner processes */
+				PMCDBG(MOD,INI,2, "cleanup signal proc=%p "
+				    "(%d, %s)", po->po_owner,
+				    po->po_owner->p_pid,
+				    po->po_owner->p_comm);
+
+				PROC_LOCK(po->po_owner);
+				lwpsignal(po->po_owner, NULL, SIGBUS);
+				PROC_UNLOCK(po->po_owner);
+
+				pmc_destroy_owner_descriptor(po);
+			}
+		}
+
+	spin_uninit(&pmc_processhash_lock);
+	if (pmc_processhash) {
+#ifdef	DEBUG
+		struct pmc_process *pp;
+
+		PMCDBG(MOD,INI,3, "%s", "destroy process hash");
+		for (prh = pmc_processhash;
+		     prh <= &pmc_processhash[pmc_processhashmask];
+		     prh++)
+			LIST_FOREACH(pp, prh, pp_next)
+			    PMCDBG(MOD,INI,3, "pid=%d", pp->pp_proc->p_pid);
+#endif
+
+		hashdestroy(pmc_processhash, M_PMC, pmc_processhashmask);
+		pmc_processhash = NULL;
+	}
+
+	if (pmc_ownerhash) {
+		PMCDBG(MOD,INI,3, "%s", "destroy owner hash");
+		hashdestroy(pmc_ownerhash, M_PMC, pmc_ownerhashmask);
+		pmc_ownerhash = NULL;
+	}
+
+	KASSERT(LIST_EMPTY(&pmc_ss_owners),
+	    ("[pmc,%d] Global SS owner list not empty", __LINE__));
+	KASSERT(pmc_ss_count == 0,
+	    ("[pmc,%d] Global SS count not empty", __LINE__));
+
+	/* free the per-cpu sample buffers */
+	for (cpu = 0; cpu < ncpus; cpu++) {
+		if (pmc_cpu_is_disabled(cpu))
+			continue;
+		KASSERT(pmc_pcpu[cpu]->pc_sb != NULL,
+		    ("[pmc,%d] Null cpu sample buffer cpu=%d", __LINE__,
+			cpu));
+		FREE(pmc_pcpu[cpu]->pc_sb, M_PMC);
+		pmc_pcpu[cpu]->pc_sb = NULL;
+	}
+
+ 	/* do processor dependent cleanup */
+	PMCDBG(MOD,INI,3, "%s", "md cleanup");
+	if (md) {
+		pmc_save_cpu_binding(&pb);
+		for (cpu = 0; cpu < ncpus; cpu++) {
+			PMCDBG(MOD,INI,1,"pmc-cleanup cpu=%d pcs=%p",
+			    cpu, pmc_pcpu[cpu]);
+			if (pmc_cpu_is_disabled(cpu))
+				continue;
+			pmc_select_cpu(cpu);
+			if (pmc_pcpu[cpu])
+				(void) md->pmd_cleanup(cpu);
+		}
+		FREE(md, M_PMC);
+		md = NULL;
+		pmc_restore_cpu_binding(&pb);
+	}
+
+	/* deallocate per-cpu structures */
+	FREE(pmc_pcpu, M_PMC);
+	pmc_pcpu = NULL;
+
+	FREE(pmc_pcpu_saved, M_PMC);
+	pmc_pcpu_saved = NULL;
+
+	if (pmc_pmcdisp) {
+		FREE(pmc_pmcdisp, M_PMC);
+		pmc_pmcdisp = NULL;
+	}
+
+	pmclog_shutdown();
+
+	lockmgr(&pmc_lock, LK_RELEASE);	/* we are done */
+}
+
+/*
+ * The function called at load/unload.
+ */
+
+static int
+load (struct module *module __unused, int cmd, void *arg __unused)
+{
+	int error;
+
+	error = 0;
+
+	switch (cmd) {
+	case MOD_LOAD :
+		/* initialize the subsystem */
+		error = pmc_initialize();
+		if (error != 0)
+			break;
+		PMCDBG(MOD,INI,1, "syscall=%d ncpus=%d",
+		    pmc_syscall_num, ncpus);
+		break;
+
+
+	case MOD_UNLOAD :
+	case MOD_SHUTDOWN:
+		pmc_cleanup();
+		PMCDBG(MOD,INI,1, "%s", "unloaded");
+		break;
+
+	default :
+		error = EINVAL;	/* XXX should panic(9) */
+		break;
+	}
+
+	return error;
+}
+
+/* memory pool */
+MALLOC_DEFINE(M_PMC, "pmc", "Memory space for the PMC module");
diff --git a/sys/dev/misc/hwpmc/hwpmc_pentium.c b/sys/dev/misc/hwpmc/hwpmc_pentium.c
new file mode 100644
index 0000000..64713d2
--- /dev/null
+++ b/sys/dev/misc/hwpmc/hwpmc_pentium.c
@@ -0,0 +1,49 @@
+/*-
+ * Copyright (c) 2003-2005 Joseph Koshy
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+/*__FBSDID("$FreeBSD: src/sys/dev/hwpmc/hwpmc_pentium.c,v 1.4 2005/06/09 19:45:07 jkoshy Exp $");*/
+
+#include <sys/param.h>
+#include <sys/lock.h>
+#include <sys/pmc.h>
+#include <sys/pmckern.h>
+#include <sys/systm.h>
+
+#include <machine/cpufunc.h>
+#include <machine/md_var.h>
+#include <machine/pmc_mdep.h>
+
+/*
+ * Intel Pentium PMCs
+ */
+
+int
+pmc_initialize_p5(struct pmc_mdep *pmc_mdep)
+{
+	(void) pmc_mdep;
+	return ENOSYS;		/* nothing here yet */
+}
diff --git a/sys/dev/misc/hwpmc/hwpmc_pentium.h b/sys/dev/misc/hwpmc/hwpmc_pentium.h
new file mode 100644
index 0000000..f999f4e
--- /dev/null
+++ b/sys/dev/misc/hwpmc/hwpmc_pentium.h
@@ -0,0 +1,72 @@
+/*-
+ * Copyright (c) 2005, Joseph Koshy
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD: src/sys/dev/hwpmc/hwpmc_pentium.h,v 1.1 2005/06/09 19:45:07 jkoshy Exp $
+ */
+
+/* Machine dependent interfaces */
+
+#ifndef _DEV_HWPMC_PENTIUM_H_
+#define	_DEV_HWPMC_PENTIUM_H_ 1
+
+/* Intel Pentium PMCs */
+
+#define	PENTIUM_NPMCS	3		/* 1 TSC + 2 PMCs */
+#define	PENTIUM_CESR_PC1		(1 << 25)
+#define	PENTIUM_CESR_CC1_MASK		0x01C00000
+#define	PENTIUM_CESR_TO_CC1(C)		(((C) & 0x07) << 22)
+#define	PENTIUM_CESR_ES1_MASK		0x003F0000
+#define	PENTIUM_CESR_TO_ES1(E)		(((E) & 0x3F) << 16)
+#define	PENTIUM_CESR_PC0		(1 << 9)
+#define	PENTIUM_CESR_CC0_MASK		0x000001C0
+#define	PENTIUM_CESR_TO_CC0(C)		(((C) & 0x07) << 6)
+#define	PENTIUM_CESR_ES0_MASK		0x0000003F
+#define	PENTIUM_CESR_TO_ES0(E)		((E) & 0x3F)
+#define	PENTIUM_CESR_RESERVED		0xFC00FC00
+
+#define	PENTIUM_MSR_CESR		0x11
+#define	PENTIUM_MSR_CTR0		0x12
+#define	PENTIUM_MSR_CTR1		0x13
+
+struct pmc_md_pentium_op_pmcallocate {
+	uint32_t	pm_pentium_config;
+};
+
+#ifdef _KERNEL
+
+/* MD extension for 'struct pmc' */
+struct pmc_md_pentium_pmc {
+	uint32_t	pm_pentium_cesr;
+};
+
+
+/*
+ * Prototypes
+ */
+
+int	pmc_initialize_p5(struct pmc_mdep *);		/* Pentium PMCs */
+
+#endif /* _KERNEL */
+#endif /* _DEV_HWPMC_PENTIUM_H_ */
diff --git a/sys/dev/misc/hwpmc/hwpmc_piv.c b/sys/dev/misc/hwpmc/hwpmc_piv.c
new file mode 100644
index 0000000..aa5cb99
--- /dev/null
+++ b/sys/dev/misc/hwpmc/hwpmc_piv.c
@@ -0,0 +1,1821 @@
+/*-
+ * Copyright (c) 2003-2005 Joseph Koshy
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+/*__FBSDID("$FreeBSD: src/sys/dev/hwpmc/hwpmc_piv.c,v 1.14 2007/04/19 08:02:51 jkoshy Exp $");*/
+
+#include <sys/param.h>
+#include <sys/lock.h>
+#include <sys/pmc.h>
+#include <sys/pmckern.h>
+#include <sys/spinlock.h>
+#include <sys/spinlock2.h>
+#include <sys/systm.h>
+
+#include <machine/cpufunc.h>
+#include <machine/md_var.h>
+#include <machine/specialreg.h>
+
+/*
+ * PENTIUM 4 SUPPORT
+ *
+ * The P4 has 18 PMCs, divided into 4 groups with 4,4,4 and 6 PMCs
+ * respectively.  Each PMC comprises of two model specific registers:
+ * a counter configuration control register (CCCR) and a counter
+ * register that holds the actual event counts.
+ *
+ * Configuring an event requires the use of one of 45 event selection
+ * control registers (ESCR).  Events are associated with specific
+ * ESCRs.  Each PMC group has a set of ESCRs it can use.
+ *
+ * - The BPU counter group (4 PMCs) can use the 16 ESCRs:
+ *   BPU_ESCR{0,1}, IS_ESCR{0,1}, MOB_ESCR{0,1}, ITLB_ESCR{0,1},
+ *   PMH_ESCR{0,1}, IX_ESCR{0,1}, FSB_ESCR{0,}, BSU_ESCR{0,1}.
+ *
+ * - The MS counter group (4 PMCs) can use the 6 ESCRs: MS_ESCR{0,1},
+ *   TC_ESCR{0,1}, TBPU_ESCR{0,1}.
+ *
+ * - The FLAME counter group (4 PMCs) can use the 10 ESCRs:
+ *   FLAME_ESCR{0,1}, FIRM_ESCR{0,1}, SAAT_ESCR{0,1}, U2L_ESCR{0,1},
+ *   DAC_ESCR{0,1}.
+ *
+ * - The IQ counter group (6 PMCs) can use the 13 ESCRs: IQ_ESCR{0,1},
+ *   ALF_ESCR{0,1}, RAT_ESCR{0,1}, SSU_ESCR0, CRU_ESCR{0,1,2,3,4,5}.
+ *
+ * Even-numbered ESCRs can be used with counters 0, 1 and 4 (if
+ * present) of a counter group.  Odd-numbers ESCRs can be used with
+ * counters 2, 3 and 5 (if present) of a counter group.  The
+ * 'p4_escrs[]' table describes these restrictions in a form that
+ * function 'p4_allocate()' uses for making allocation decisions.
+ *
+ * SYSTEM-MODE AND THREAD-MODE ALLOCATION
+ *
+ * In addition to remembering the state of PMC rows
+ * ('FREE','STANDALONE', or 'THREAD'), we similar need to track the
+ * state of ESCR rows.  If an ESCR is allocated to a system-mode PMC
+ * on a CPU we cannot allocate this to a thread-mode PMC.  On a
+ * multi-cpu (multiple physical CPUs) system, ESCR allocation on each
+ * CPU is tracked by the pc_escrs[] array.
+ *
+ * Each system-mode PMC that is using an ESCR records its row-index in
+ * the appropriate entry and system-mode allocation attempts check
+ * that an ESCR is available using this array.  Process-mode PMCs do
+ * not use the pc_escrs[] array, since ESCR row itself would have been
+ * marked as in 'THREAD' mode.
+ *
+ * HYPERTHREADING SUPPORT
+ *
+ * When HTT is enabled, the FreeBSD kernel treats the two 'logical'
+ * cpus as independent CPUs and can schedule kernel threads on them
+ * independently.  However, the two logical CPUs share the same set of
+ * PMC resources.  We need to ensure that:
+ * - PMCs that use the PMC_F_DESCENDANTS semantics are handled correctly,
+ *   and,
+ * - Threads of multi-threaded processes that get scheduled on the same
+ *   physical CPU are handled correctly.
+ *
+ * HTT Detection
+ *
+ * Not all HTT capable systems will have HTT enabled.  We detect the
+ * presence of HTT by detecting if 'p4_init()' was called for a secondary
+ * CPU in a HTT pair.
+ *
+ * Note that hwpmc(4) cannot currently deal with a change in HTT status once
+ * loaded.
+ *
+ * Handling HTT READ / WRITE / START / STOP
+ *
+ * PMC resources are shared across the CPUs in an HTT pair.  We
+ * designate the lower numbered CPU in a HTT pair as the 'primary'
+ * CPU.  In each primary CPU's state we keep track of a 'runcount'
+ * which reflects the number of PMC-using processes that have been
+ * scheduled on its secondary CPU.  Process-mode PMC operations will
+ * actually 'start' or 'stop' hardware only if these are the first or
+ * last processes respectively to use the hardware.  PMC values
+ * written by a 'write' operation are saved and are transferred to
+ * hardware at PMC 'start' time if the runcount is 0.  If the runcount
+ * is greater than 0 at the time of a 'start' operation, we keep track
+ * of the actual hardware value at the time of the 'start' operation
+ * and use this to adjust the final readings at PMC 'stop' or 'read'
+ * time.
+ *
+ * Execution sequences:
+ *
+ * Case 1:   CPUx   +...-		(no overlap)
+ *	     CPUy         +...-
+ *           RC   0 1   0 1   0
+ *
+ * Case 2:   CPUx   +........-		(partial overlap)
+ * 	     CPUy       +........-
+ *           RC   0 1   2    1   0
+ *
+ * Case 3:   CPUx   +..............-	(fully overlapped)
+ *	     CPUy       +.....-
+ *	     RC   0 1   2     1    0
+ *
+ *     Key:
+ *     'CPU[xy]' : one of the two logical processors on a HTT CPU.
+ *     'RC'      : run count (#threads per physical core).
+ *     '+'       : point in time when a thread is put on a CPU.
+ *     '-'       : point in time where a thread is taken off a CPU.
+ *
+ * Handling HTT CONFIG
+ *
+ * Different processes attached to the same PMC may get scheduled on
+ * the two logical processors in the package.  We keep track of config
+ * and de-config operations using the CFGFLAGS fields of the per-physical
+ * cpu state.
+ *
+ * Handling TSCs
+ *
+ * TSCs are architectural state and each CPU in a HTT pair has its own
+ * TSC register.
+ */
+
+#define	P4_PMCS()				\
+	P4_PMC(BPU_COUNTER0)			\
+	P4_PMC(BPU_COUNTER1)			\
+	P4_PMC(BPU_COUNTER2)			\
+	P4_PMC(BPU_COUNTER3)			\
+	P4_PMC(MS_COUNTER0)			\
+	P4_PMC(MS_COUNTER1)			\
+	P4_PMC(MS_COUNTER2)			\
+	P4_PMC(MS_COUNTER3)			\
+	P4_PMC(FLAME_COUNTER0)			\
+	P4_PMC(FLAME_COUNTER1)			\
+	P4_PMC(FLAME_COUNTER2)			\
+	P4_PMC(FLAME_COUNTER3)			\
+	P4_PMC(IQ_COUNTER0)			\
+	P4_PMC(IQ_COUNTER1)			\
+	P4_PMC(IQ_COUNTER2)			\
+	P4_PMC(IQ_COUNTER3)			\
+	P4_PMC(IQ_COUNTER4)			\
+	P4_PMC(IQ_COUNTER5)			\
+	P4_PMC(NONE)
+
+enum pmc_p4pmc {
+#undef	P4_PMC
+#define	P4_PMC(N)	P4_PMC_##N ,
+	P4_PMCS()
+};
+
+/*
+ * P4 ESCR descriptors
+ */
+
+#define	P4_ESCRS()							\
+    P4_ESCR(BSU_ESCR0,	0x3A0, BPU_COUNTER0, BPU_COUNTER1, NONE)	\
+    P4_ESCR(BSU_ESCR1,	0x3A1, BPU_COUNTER2, BPU_COUNTER3, NONE)	\
+    P4_ESCR(FSB_ESCR0,	0x3A2, BPU_COUNTER0, BPU_COUNTER1, NONE)	\
+    P4_ESCR(FSB_ESCR1,	0x3A3, BPU_COUNTER2, BPU_COUNTER3, NONE)	\
+    P4_ESCR(FIRM_ESCR0,	0x3A4, FLAME_COUNTER0, FLAME_COUNTER1, NONE)	\
+    P4_ESCR(FIRM_ESCR1,	0x3A5, FLAME_COUNTER2, FLAME_COUNTER3, NONE)	\
+    P4_ESCR(FLAME_ESCR0, 0x3A6, FLAME_COUNTER0, FLAME_COUNTER1, NONE)	\
+    P4_ESCR(FLAME_ESCR1, 0x3A7, FLAME_COUNTER2, FLAME_COUNTER3, NONE)	\
+    P4_ESCR(DAC_ESCR0,	0x3A8, FLAME_COUNTER0, FLAME_COUNTER1, NONE)	\
+    P4_ESCR(DAC_ESCR1,	0x3A9, FLAME_COUNTER2, FLAME_COUNTER3, NONE)	\
+    P4_ESCR(MOB_ESCR0,	0x3AA, BPU_COUNTER0, BPU_COUNTER1, NONE)	\
+    P4_ESCR(MOB_ESCR1,	0x3AB, BPU_COUNTER2, BPU_COUNTER3, NONE)	\
+    P4_ESCR(PMH_ESCR0,	0x3AC, BPU_COUNTER0, BPU_COUNTER1, NONE)	\
+    P4_ESCR(PMH_ESCR1,	0x3AD, BPU_COUNTER2, BPU_COUNTER3, NONE)	\
+    P4_ESCR(SAAT_ESCR0,	0x3AE, FLAME_COUNTER0, FLAME_COUNTER1, NONE)	\
+    P4_ESCR(SAAT_ESCR1,	0x3AF, FLAME_COUNTER2, FLAME_COUNTER3, NONE)	\
+    P4_ESCR(U2L_ESCR0,	0x3B0, FLAME_COUNTER0, FLAME_COUNTER1, NONE)	\
+    P4_ESCR(U2L_ESCR1,	0x3B1, FLAME_COUNTER2, FLAME_COUNTER3, NONE)	\
+    P4_ESCR(BPU_ESCR0,	0x3B2, BPU_COUNTER0, BPU_COUNTER1, NONE)	\
+    P4_ESCR(BPU_ESCR1,	0x3B3, BPU_COUNTER2, BPU_COUNTER3, NONE)	\
+    P4_ESCR(IS_ESCR0,	0x3B4, BPU_COUNTER0, BPU_COUNTER1, NONE)	\
+    P4_ESCR(IS_ESCR1,	0x3B5, BPU_COUNTER2, BPU_COUNTER3, NONE)	\
+    P4_ESCR(ITLB_ESCR0,	0x3B6, BPU_COUNTER0, BPU_COUNTER1, NONE)	\
+    P4_ESCR(ITLB_ESCR1,	0x3B7, BPU_COUNTER2, BPU_COUNTER3, NONE)	\
+    P4_ESCR(CRU_ESCR0,	0x3B8, IQ_COUNTER0, IQ_COUNTER1, IQ_COUNTER4)	\
+    P4_ESCR(CRU_ESCR1,	0x3B9, IQ_COUNTER2, IQ_COUNTER3, IQ_COUNTER5)	\
+    P4_ESCR(IQ_ESCR0,	0x3BA, IQ_COUNTER0, IQ_COUNTER1, IQ_COUNTER4)	\
+    P4_ESCR(IQ_ESCR1,	0x3BB, IQ_COUNTER1, IQ_COUNTER3, IQ_COUNTER5)	\
+    P4_ESCR(RAT_ESCR0,	0x3BC, IQ_COUNTER0, IQ_COUNTER1, IQ_COUNTER4)	\
+    P4_ESCR(RAT_ESCR1,	0x3BD, IQ_COUNTER2, IQ_COUNTER3, IQ_COUNTER5)	\
+    P4_ESCR(SSU_ESCR0,	0x3BE, IQ_COUNTER0, IQ_COUNTER2, IQ_COUNTER4)	\
+    P4_ESCR(MS_ESCR0,	0x3C0, MS_COUNTER0, MS_COUNTER1, NONE)		\
+    P4_ESCR(MS_ESCR1,	0x3C1, MS_COUNTER2, MS_COUNTER3, NONE)		\
+    P4_ESCR(TBPU_ESCR0,	0x3C2, MS_COUNTER0, MS_COUNTER1, NONE)		\
+    P4_ESCR(TBPU_ESCR1,	0x3C3, MS_COUNTER2, MS_COUNTER3, NONE)		\
+    P4_ESCR(TC_ESCR0,	0x3C4, MS_COUNTER0, MS_COUNTER1, NONE)		\
+    P4_ESCR(TC_ESCR1,	0x3C5, MS_COUNTER2, MS_COUNTER3, NONE)		\
+    P4_ESCR(IX_ESCR0,	0x3C8, BPU_COUNTER0, BPU_COUNTER1, NONE)	\
+    P4_ESCR(IX_ESCR1,	0x3C9, BPU_COUNTER2, BPU_COUNTER3, NONE)	\
+    P4_ESCR(ALF_ESCR0,	0x3CA, IQ_COUNTER0, IQ_COUNTER1, IQ_COUNTER4)	\
+    P4_ESCR(ALF_ESCR1,	0x3CB, IQ_COUNTER2, IQ_COUNTER3, IQ_COUNTER5)	\
+    P4_ESCR(CRU_ESCR2,	0x3CC, IQ_COUNTER0, IQ_COUNTER1, IQ_COUNTER4)	\
+    P4_ESCR(CRU_ESCR3,	0x3CD, IQ_COUNTER2, IQ_COUNTER3, IQ_COUNTER5)	\
+    P4_ESCR(CRU_ESCR4,	0x3E0, IQ_COUNTER0, IQ_COUNTER1, IQ_COUNTER4)	\
+    P4_ESCR(CRU_ESCR5,	0x3E1, IQ_COUNTER2, IQ_COUNTER3, IQ_COUNTER5)	\
+    P4_ESCR(NONE,		~0,    NONE, NONE, NONE)
+
+enum pmc_p4escr {
+#define	P4_ESCR(N, MSR, P1, P2, P3)	P4_ESCR_##N ,
+	P4_ESCRS()
+#undef	P4_ESCR
+};
+
+struct pmc_p4escr_descr {
+	const char	pm_escrname[PMC_NAME_MAX];
+	u_short		pm_escr_msr;
+	const enum pmc_p4pmc pm_pmcs[P4_MAX_PMC_PER_ESCR];
+};
+
+static struct pmc_p4escr_descr p4_escrs[] =
+{
+#define	P4_ESCR(N, MSR, P1, P2, P3)		\
+	{					\
+		.pm_escrname = #N,		\
+		.pm_escr_msr = (MSR),		\
+		.pm_pmcs =			\
+		{				\
+			P4_PMC_##P1,		\
+			P4_PMC_##P2,		\
+			P4_PMC_##P3		\
+		}				\
+	} ,
+
+	P4_ESCRS()
+
+#undef	P4_ESCR
+};
+
+/*
+ * P4 Event descriptor
+ */
+
+struct p4_event_descr {
+	const enum pmc_event pm_event;
+	const uint32_t	pm_escr_eventselect;
+	const uint32_t	pm_cccr_select;
+	const char	pm_is_ti_event;
+	enum pmc_p4escr	pm_escrs[P4_MAX_ESCR_PER_EVENT];
+};
+
+static struct p4_event_descr p4_events[] = {
+
+#define	P4_EVDESCR(NAME, ESCREVENTSEL, CCCRSEL, TI_EVENT, ESCR0, ESCR1)	\
+	{								\
+		.pm_event            = PMC_EV_P4_##NAME,		\
+		.pm_escr_eventselect = (ESCREVENTSEL),			\
+		.pm_cccr_select      = (CCCRSEL),			\
+		.pm_is_ti_event	     = (TI_EVENT),			\
+		.pm_escrs            =					\
+		{							\
+			P4_ESCR_##ESCR0,				\
+			P4_ESCR_##ESCR1					\
+		}							\
+	}
+
+P4_EVDESCR(TC_DELIVER_MODE,	0x01, 0x01, TRUE,  TC_ESCR0,	TC_ESCR1),
+P4_EVDESCR(BPU_FETCH_REQUEST,	0x03, 0x00, FALSE, BPU_ESCR0,	BPU_ESCR1),
+P4_EVDESCR(ITLB_REFERENCE,	0x18, 0x03, FALSE, ITLB_ESCR0,	ITLB_ESCR1),
+P4_EVDESCR(MEMORY_CANCEL,	0x02, 0x05, FALSE, DAC_ESCR0,	DAC_ESCR1),
+P4_EVDESCR(MEMORY_COMPLETE,	0x08, 0x02, FALSE, SAAT_ESCR0,	SAAT_ESCR1),
+P4_EVDESCR(LOAD_PORT_REPLAY,	0x04, 0x02, FALSE, SAAT_ESCR0,	SAAT_ESCR1),
+P4_EVDESCR(STORE_PORT_REPLAY,	0x05, 0x02, FALSE, SAAT_ESCR0,	SAAT_ESCR1),
+P4_EVDESCR(MOB_LOAD_REPLAY,	0x03, 0x02, FALSE, MOB_ESCR0,	MOB_ESCR1),
+P4_EVDESCR(PAGE_WALK_TYPE,	0x01, 0x04, TRUE,  PMH_ESCR0,	PMH_ESCR1),
+P4_EVDESCR(BSQ_CACHE_REFERENCE,	0x0C, 0x07, FALSE, BSU_ESCR0,	BSU_ESCR1),
+P4_EVDESCR(IOQ_ALLOCATION,	0x03, 0x06, FALSE, FSB_ESCR0,	FSB_ESCR1),
+P4_EVDESCR(IOQ_ACTIVE_ENTRIES,	0x1A, 0x06, FALSE, FSB_ESCR1,	NONE),
+P4_EVDESCR(FSB_DATA_ACTIVITY,	0x17, 0x06, TRUE,  FSB_ESCR0,	FSB_ESCR1),
+P4_EVDESCR(BSQ_ALLOCATION,	0x05, 0x07, FALSE, BSU_ESCR0,	NONE),
+P4_EVDESCR(BSQ_ACTIVE_ENTRIES,	0x06, 0x07, FALSE, BSU_ESCR1,	NONE),
+	/* BSQ_ACTIVE_ENTRIES inherits CPU specificity from BSQ_ALLOCATION */
+P4_EVDESCR(SSE_INPUT_ASSIST,	0x34, 0x01, TRUE,  FIRM_ESCR0,	FIRM_ESCR1),
+P4_EVDESCR(PACKED_SP_UOP,	0x08, 0x01, TRUE,  FIRM_ESCR0,	FIRM_ESCR1),
+P4_EVDESCR(PACKED_DP_UOP,	0x0C, 0x01, TRUE,  FIRM_ESCR0,	FIRM_ESCR1),
+P4_EVDESCR(SCALAR_SP_UOP,	0x0A, 0x01, TRUE,  FIRM_ESCR0,	FIRM_ESCR1),
+P4_EVDESCR(SCALAR_DP_UOP,	0x0E, 0x01, TRUE,  FIRM_ESCR0,	FIRM_ESCR1),
+P4_EVDESCR(64BIT_MMX_UOP,	0x02, 0x01, TRUE,  FIRM_ESCR0,	FIRM_ESCR1),
+P4_EVDESCR(128BIT_MMX_UOP,	0x1A, 0x01, TRUE,  FIRM_ESCR0,	FIRM_ESCR1),
+P4_EVDESCR(X87_FP_UOP,		0x04, 0x01, TRUE,  FIRM_ESCR0,	FIRM_ESCR1),
+P4_EVDESCR(X87_SIMD_MOVES_UOP,	0x2E, 0x01, TRUE,  FIRM_ESCR0,	FIRM_ESCR1),
+P4_EVDESCR(GLOBAL_POWER_EVENTS,	0x13, 0x06, FALSE, FSB_ESCR0,	FSB_ESCR1),
+P4_EVDESCR(TC_MS_XFER,		0x05, 0x00, FALSE, MS_ESCR0,	MS_ESCR1),
+P4_EVDESCR(UOP_QUEUE_WRITES,	0x09, 0x00, FALSE, MS_ESCR0,	MS_ESCR1),
+P4_EVDESCR(RETIRED_MISPRED_BRANCH_TYPE,
+    				0x05, 0x02, FALSE, TBPU_ESCR0,	TBPU_ESCR1),
+P4_EVDESCR(RETIRED_BRANCH_TYPE,	0x04, 0x02, FALSE, TBPU_ESCR0,	TBPU_ESCR1),
+P4_EVDESCR(RESOURCE_STALL,	0x01, 0x01, FALSE, ALF_ESCR0,	ALF_ESCR1),
+P4_EVDESCR(WC_BUFFER,		0x05, 0x05, TRUE,  DAC_ESCR0,	DAC_ESCR1),
+P4_EVDESCR(B2B_CYCLES,		0x16, 0x03, TRUE,  FSB_ESCR0,	FSB_ESCR1),
+P4_EVDESCR(BNR,			0x08, 0x03, TRUE,  FSB_ESCR0,	FSB_ESCR1),
+P4_EVDESCR(SNOOP,		0x06, 0x03, TRUE,  FSB_ESCR0,	FSB_ESCR1),
+P4_EVDESCR(RESPONSE,		0x04, 0x03, TRUE,  FSB_ESCR0,	FSB_ESCR1),
+P4_EVDESCR(FRONT_END_EVENT,	0x08, 0x05, FALSE, CRU_ESCR2,	CRU_ESCR3),
+P4_EVDESCR(EXECUTION_EVENT,	0x0C, 0x05, FALSE, CRU_ESCR2,	CRU_ESCR3),
+P4_EVDESCR(REPLAY_EVENT, 	0x09, 0x05, FALSE, CRU_ESCR2,	CRU_ESCR3),
+P4_EVDESCR(INSTR_RETIRED,	0x02, 0x04, FALSE, CRU_ESCR0,	CRU_ESCR1),
+P4_EVDESCR(UOPS_RETIRED,	0x01, 0x04, FALSE, CRU_ESCR0,	CRU_ESCR1),
+P4_EVDESCR(UOP_TYPE,		0x02, 0x02, FALSE, RAT_ESCR0,	RAT_ESCR1),
+P4_EVDESCR(BRANCH_RETIRED,	0x06, 0x05, FALSE, CRU_ESCR2,	CRU_ESCR3),
+P4_EVDESCR(MISPRED_BRANCH_RETIRED, 0x03, 0x04, FALSE, CRU_ESCR0, CRU_ESCR1),
+P4_EVDESCR(X87_ASSIST,		0x03, 0x05, FALSE, CRU_ESCR2,	CRU_ESCR3),
+P4_EVDESCR(MACHINE_CLEAR,	0x02, 0x05, FALSE, CRU_ESCR2,	CRU_ESCR3)
+
+#undef	P4_EVDESCR
+};
+
+#define	P4_EVENT_IS_TI(E) ((E)->pm_is_ti_event == TRUE)
+
+#define	P4_NEVENTS	(PMC_EV_P4_LAST - PMC_EV_P4_FIRST + 1)
+
+/*
+ * P4 PMC descriptors
+ */
+
+struct p4pmc_descr {
+	struct pmc_descr pm_descr; 	/* common information */
+	enum pmc_p4pmc	pm_pmcnum;	/* PMC number */
+	uint32_t	pm_pmc_msr; 	/* PERFCTR MSR address */
+	uint32_t	pm_cccr_msr;  	/* CCCR MSR address */
+};
+
+static struct p4pmc_descr p4_pmcdesc[P4_NPMCS] = {
+
+	/*
+	 * TSC descriptor
+	 */
+
+	{
+		.pm_descr =
+		{
+			.pd_name  = "TSC",
+			.pd_class = PMC_CLASS_TSC,
+			.pd_caps  = PMC_CAP_READ | PMC_CAP_WRITE,
+			.pd_width = 64
+		},
+		.pm_pmcnum   = ~0,
+		.pm_cccr_msr = ~0,
+		.pm_pmc_msr  = 0x10,
+	},
+
+	/*
+	 * P4 PMCS
+	 */
+
+#define	P4_PMC_CAPS (PMC_CAP_INTERRUPT | PMC_CAP_USER | PMC_CAP_SYSTEM |  \
+	PMC_CAP_EDGE | PMC_CAP_THRESHOLD | PMC_CAP_READ | PMC_CAP_WRITE | \
+	PMC_CAP_INVERT | PMC_CAP_QUALIFIER | PMC_CAP_PRECISE |            \
+	PMC_CAP_TAGGING | PMC_CAP_CASCADE)
+
+#define	P4_PMCDESCR(N, PMC, CCCR)			\
+	{						\
+		.pm_descr =				\
+		{					\
+			.pd_name = #N,			\
+			.pd_class = PMC_CLASS_P4,	\
+			.pd_caps = P4_PMC_CAPS,		\
+			.pd_width = 40			\
+		},					\
+		.pm_pmcnum      = P4_PMC_##N,		\
+		.pm_cccr_msr 	= (CCCR),		\
+		.pm_pmc_msr	= (PMC)			\
+	}
+
+	P4_PMCDESCR(BPU_COUNTER0,	0x300,	0x360),
+	P4_PMCDESCR(BPU_COUNTER1,	0x301,	0x361),
+	P4_PMCDESCR(BPU_COUNTER2,	0x302,	0x362),
+	P4_PMCDESCR(BPU_COUNTER3,	0x303,	0x363),
+	P4_PMCDESCR(MS_COUNTER0,	0x304,	0x364),
+	P4_PMCDESCR(MS_COUNTER1,	0x305,	0x365),
+	P4_PMCDESCR(MS_COUNTER2,	0x306,	0x366),
+	P4_PMCDESCR(MS_COUNTER3,	0x307,	0x367),
+	P4_PMCDESCR(FLAME_COUNTER0,	0x308,	0x368),
+	P4_PMCDESCR(FLAME_COUNTER1,	0x309,	0x369),
+	P4_PMCDESCR(FLAME_COUNTER2,	0x30A,	0x36A),
+	P4_PMCDESCR(FLAME_COUNTER3,	0x30B,	0x36B),
+	P4_PMCDESCR(IQ_COUNTER0,	0x30C,	0x36C),
+	P4_PMCDESCR(IQ_COUNTER1,	0x30D,	0x36D),
+	P4_PMCDESCR(IQ_COUNTER2,	0x30E,	0x36E),
+	P4_PMCDESCR(IQ_COUNTER3,	0x30F,	0x36F),
+	P4_PMCDESCR(IQ_COUNTER4,	0x310,	0x370),
+	P4_PMCDESCR(IQ_COUNTER5,	0x311,	0x371),
+
+#undef	P4_PMCDESCR
+};
+
+/* HTT support */
+#define	P4_NHTT					2 /* logical processors/chip */
+
+static int p4_system_has_htt;
+
+/*
+ * Per-CPU data structure for P4 class CPUs
+ *
+ * [common stuff]
+ * [19 struct pmc_hw pointers]
+ * [19 struct pmc_hw structures]
+ * [45 ESCRs status bytes]
+ * [per-cpu spin mutex]
+ * [19 flag fields for holding config flags and a runcount]
+ * [19*2 hw value fields]	(Thread mode PMC support)
+ *    or
+ * [19*2 EIP values]		(Sampling mode PMCs)
+ * [19*2 pmc value fields]	(Thread mode PMC support))
+ */
+
+struct p4_cpu {
+	struct pmc_cpu	pc_common;
+	struct pmc_hw	*pc_hwpmcs[P4_NPMCS];
+	struct pmc_hw	pc_p4pmcs[P4_NPMCS];
+	char		pc_escrs[P4_NESCR];
+	struct spinlock	pc_lock;		/* spin lock */
+	uint32_t	pc_intrflag;	/* NMI handler flags */
+	unsigned int	pc_intrlock;	/* NMI handler spin lock */
+	unsigned char	pc_flags[P4_NPMCS]; /* 4 bits each: {cfg,run}count */
+	union {
+		pmc_value_t pc_hw[P4_NPMCS * P4_NHTT];
+		uintptr_t   pc_ip[P4_NPMCS * P4_NHTT];
+	}		pc_si;
+	pmc_value_t	pc_pmc_values[P4_NPMCS * P4_NHTT];
+};
+
+/*
+ * A 'logical' CPU shares PMC resources with partner 'physical' CPU,
+ * except the TSC, which is architectural and hence seperate.  The
+ * 'logical' CPU descriptor thus has pointers to the physical CPUs
+ * descriptor state except for the TSC (rowindex 0) which is not
+ * shared.
+ */
+
+struct p4_logicalcpu {
+	struct pmc_cpu	pc_common;
+	struct pmc_hw	*pc_hwpmcs[P4_NPMCS];
+	struct pmc_hw	pc_tsc;
+};
+
+#define	P4_PCPU_PMC_VALUE(PC,RI,CPU) 	(PC)->pc_pmc_values[(RI)*((CPU) & 1)]
+#define	P4_PCPU_HW_VALUE(PC,RI,CPU)	(PC)->pc_si.pc_hw[(RI)*((CPU) & 1)]
+#define	P4_PCPU_SAVED_IP(PC,RI,CPU)	(PC)->pc_si.pc_ip[(RI)*((CPU) & 1)]
+
+#define	P4_PCPU_GET_FLAGS(PC,RI,MASK)	((PC)->pc_flags[(RI)] & (MASK))
+#define	P4_PCPU_SET_FLAGS(PC,RI,MASK,VAL)	do {	\
+	char _tmp;					\
+	_tmp = (PC)->pc_flags[(RI)];			\
+	_tmp &= ~(MASK);				\
+	_tmp |= (VAL) & (MASK);				\
+	(PC)->pc_flags[(RI)] = _tmp;			\
+} while (0)
+
+#define	P4_PCPU_GET_RUNCOUNT(PC,RI)	P4_PCPU_GET_FLAGS(PC,RI,0x0F)
+#define	P4_PCPU_SET_RUNCOUNT(PC,RI,V)	P4_PCPU_SET_FLAGS(PC,RI,0x0F,V)
+
+#define	P4_PCPU_GET_CFGFLAGS(PC,RI)	(P4_PCPU_GET_FLAGS(PC,RI,0xF0) >> 4)
+#define	P4_PCPU_SET_CFGFLAGS(PC,RI,C)	P4_PCPU_SET_FLAGS(PC,RI,0xF0,((C) <<4))
+
+#define	P4_CPU_TO_FLAG(C)		(P4_CPU_IS_HTT_SECONDARY(cpu) ? 0x2 : 0x1)
+
+#define	P4_PCPU_GET_INTRFLAG(PC,I)	((PC)->pc_intrflag & (1 << (I)))
+#define	P4_PCPU_SET_INTRFLAG(PC,I,V)	do {		\
+		uint32_t __mask;			\
+		__mask = 1 << (I);			\
+		if ((V))				\
+			(PC)->pc_intrflag |= __mask;	\
+		else					\
+			(PC)->pc_intrflag &= ~__mask;	\
+	} while (0)
+
+/*
+ * A minimal spin lock implementation for use inside the NMI handler.
+ *
+ * We don't want to use a regular spin lock here, because curthread
+ * may not be consistent at the time the handler is invoked.
+ */
+#define	P4_PCPU_ACQ_INTR_SPINLOCK(PC) do {				\
+		while (!atomic_cmpset_acq_int(&pc->pc_intrlock, 0, 1))	\
+			cpu_pause();					\
+	} while (0)
+#define	P4_PCPU_REL_INTR_SPINLOCK(PC) 					\
+	atomic_store_rel_int(&pc->pc_intrlock, 0);
+
+/* ESCR row disposition */
+static int p4_escrdisp[P4_NESCR];
+
+#define	P4_ESCR_ROW_DISP_IS_THREAD(E)		(p4_escrdisp[(E)] > 0)
+#define	P4_ESCR_ROW_DISP_IS_STANDALONE(E)	(p4_escrdisp[(E)] < 0)
+#define	P4_ESCR_ROW_DISP_IS_FREE(E)		(p4_escrdisp[(E)] == 0)
+
+#define	P4_ESCR_MARK_ROW_STANDALONE(E) do {				\
+	KASSERT(p4_escrdisp[(E)] <= 0, ("[p4,%d] row disposition error",\
+		    __LINE__));						\
+	atomic_add_int(&p4_escrdisp[(E)], -1);				\
+	KASSERT(p4_escrdisp[(E)] >= (-ncpus), ("[p4,%d] row "	\
+		"disposition error", __LINE__));			\
+} while (0)
+
+#define	P4_ESCR_UNMARK_ROW_STANDALONE(E) do {				\
+	atomic_add_int(&p4_escrdisp[(E)], 1);				\
+	KASSERT(p4_escrdisp[(E)] <= 0, ("[p4,%d] row disposition error",\
+		    __LINE__));						\
+} while (0)
+
+#define	P4_ESCR_MARK_ROW_THREAD(E) do {					 \
+	KASSERT(p4_escrdisp[(E)] >= 0, ("[p4,%d] row disposition error", \
+		    __LINE__));						 \
+	atomic_add_int(&p4_escrdisp[(E)], 1);				 \
+} while (0)
+
+#define	P4_ESCR_UNMARK_ROW_THREAD(E) do {				 \
+	atomic_add_int(&p4_escrdisp[(E)], -1);				 \
+	KASSERT(p4_escrdisp[(E)] >= 0, ("[p4,%d] row disposition error", \
+		    __LINE__));						 \
+} while (0)
+
+#define	P4_PMC_IS_STOPPED(cccr)	((rdmsr(cccr) & P4_CCCR_ENABLE) == 0)
+
+#define	P4_CPU_IS_HTT_SECONDARY(cpu)					\
+	(p4_system_has_htt ? ((cpu) & 1) : 0)
+#define	P4_TO_HTT_PRIMARY(cpu) 						\
+	(p4_system_has_htt ? ((cpu) & ~1) : (cpu))
+
+#define	P4_CCCR_Tx_MASK	(~(P4_CCCR_OVF_PMI_T0|P4_CCCR_OVF_PMI_T1|	\
+			     P4_CCCR_ENABLE|P4_CCCR_OVF))
+#define	P4_ESCR_Tx_MASK	(~(P4_ESCR_T0_OS|P4_ESCR_T0_USR|P4_ESCR_T1_OS|	\
+			     P4_ESCR_T1_USR))
+
+/*
+ * support routines
+ */
+
+static struct p4_event_descr *
+p4_find_event(enum pmc_event ev)
+{
+	int n;
+
+	for (n = 0; n < P4_NEVENTS; n++)
+		if (p4_events[n].pm_event == ev)
+			break;
+	if (n == P4_NEVENTS)
+		return NULL;
+	return &p4_events[n];
+}
+
+/*
+ * Initialize per-cpu state
+ */
+
+static int
+p4_init(int cpu)
+{
+	int n, phycpu;
+	char *pescr;
+	struct p4_cpu *pcs;
+	struct p4_logicalcpu *plcs;
+	struct pmc_hw *phw;
+
+	KASSERT(cpu >= 0 && cpu < ncpus,
+	    ("[p4,%d] insane cpu number %d", __LINE__, cpu));
+
+	PMCDBG(MDP,INI,0, "p4-init cpu=%d logical=%d", cpu,
+	    pmc_cpu_is_logical(cpu) != 0);
+
+	/*
+	 * The two CPUs in an HT pair share their per-cpu state.
+	 *
+	 * For HT capable CPUs, we assume that the two logical
+	 * processors in the HT pair get two consecutive CPU ids
+	 * starting with an even id #.
+	 *
+	 * The primary CPU (the even numbered CPU of the pair) would
+	 * have been initialized prior to the initialization for the
+	 * secondary.
+	 */
+
+	if (pmc_cpu_is_logical(cpu) && (cpu & 1)) {
+
+		p4_system_has_htt = 1;
+
+		phycpu = P4_TO_HTT_PRIMARY(cpu);
+		pcs = (struct p4_cpu *) pmc_pcpu[phycpu];
+		PMCDBG(MDP,INI,1, "p4-init cpu=%d phycpu=%d pcs=%p",
+		    cpu, phycpu, pcs);
+		KASSERT(pcs,
+		    ("[p4,%d] Null Per-Cpu state cpu=%d phycpu=%d", __LINE__,
+			cpu, phycpu));
+		if (pcs == NULL) /* decline to init */
+			return ENXIO;
+
+		MALLOC(plcs, struct p4_logicalcpu *,
+		    sizeof(struct p4_logicalcpu), M_PMC, M_WAITOK|M_ZERO);
+
+		/* The TSC is architectural state and is not shared */
+		plcs->pc_hwpmcs[0] = &plcs->pc_tsc;
+		plcs->pc_tsc.phw_state = PMC_PHW_FLAG_IS_ENABLED |
+		    PMC_PHW_CPU_TO_STATE(cpu) | PMC_PHW_INDEX_TO_STATE(0) |
+		    PMC_PHW_FLAG_IS_SHAREABLE;
+
+		/* Other PMCs are shared with the physical CPU */
+		for (n = 1; n < P4_NPMCS; n++)
+			plcs->pc_hwpmcs[n] = pcs->pc_hwpmcs[n];
+
+		pmc_pcpu[cpu] = (struct pmc_cpu *) plcs;
+		return 0;
+	}
+
+	MALLOC(pcs, struct p4_cpu *, sizeof(struct p4_cpu), M_PMC,
+	    M_WAITOK|M_ZERO);
+
+	if (pcs == NULL)
+		return ENOMEM;
+	phw = pcs->pc_p4pmcs;
+
+	for (n = 0; n < P4_NPMCS; n++, phw++) {
+		phw->phw_state   = PMC_PHW_FLAG_IS_ENABLED |
+		    PMC_PHW_CPU_TO_STATE(cpu) | PMC_PHW_INDEX_TO_STATE(n);
+		phw->phw_pmc     = NULL;
+		pcs->pc_hwpmcs[n] = phw;
+	}
+
+	/* Mark the TSC as shareable */
+	pcs->pc_hwpmcs[0]->phw_state |= PMC_PHW_FLAG_IS_SHAREABLE;
+
+	pescr = pcs->pc_escrs;
+	for (n = 0; n < P4_NESCR; n++)
+		*pescr++ = P4_INVALID_PMC_INDEX;
+	pmc_pcpu[cpu] = (struct pmc_cpu *) pcs;
+
+	spin_init(&pcs->pc_lock);
+
+	return 0;
+}
+
+/*
+ * Destroy per-cpu state.
+ */
+
+static int
+p4_cleanup(int cpu)
+{
+	int i;
+	struct p4_cpu *pcs;
+
+	PMCDBG(MDP,INI,0, "p4-cleanup cpu=%d", cpu);
+
+	if ((pcs = (struct p4_cpu *) pmc_pcpu[cpu]) == NULL)
+		return 0;
+
+	/* Turn off all PMCs on this CPU */
+	for (i = 0; i < P4_NPMCS - 1; i++)
+		wrmsr(P4_CCCR_MSR_FIRST + i,
+		    rdmsr(P4_CCCR_MSR_FIRST + i) & ~P4_CCCR_ENABLE);
+
+	/*
+	 * If the CPU is physical we need to teardown the
+	 * full MD state.
+	 */
+	if (!P4_CPU_IS_HTT_SECONDARY(cpu))
+		spin_uninit(&pcs->pc_lock);
+
+	FREE(pcs, M_PMC);
+
+	pmc_pcpu[cpu] = NULL;
+
+	return 0;
+}
+
+/*
+ * Context switch in.
+ */
+
+static int
+p4_switch_in(struct pmc_cpu *pc, struct pmc_process *pp)
+{
+	(void) pc;
+
+	PMCDBG(MDP,SWI,1, "pc=%p pp=%p enable-msr=%d", pc, pp,
+	    (pp->pp_flags & PMC_PP_ENABLE_MSR_ACCESS) != 0);
+
+	/* enable the RDPMC instruction */
+	if (pp->pp_flags & PMC_PP_ENABLE_MSR_ACCESS)
+		load_cr4(rcr4() | CR4_PCE);
+
+	PMCDBG(MDP,SWI,2, "cr4=0x%x", (uint32_t) rcr4());
+
+	return 0;
+}
+
+/*
+ * Context switch out.
+ */
+
+static int
+p4_switch_out(struct pmc_cpu *pc, struct pmc_process *pp)
+{
+	(void) pc;
+	(void) pp;		/* can be null */
+
+	PMCDBG(MDP,SWO,1, "pc=%p pp=%p", pc, pp);
+
+	/* always disallow the RDPMC instruction */
+	load_cr4(rcr4() & ~CR4_PCE);
+
+	PMCDBG(MDP,SWO,2, "cr4=0x%x", (uint32_t) rcr4());
+
+	return 0;
+}
+
+/*
+ * Read a PMC
+ */
+
+static int
+p4_read_pmc(int cpu, int ri, pmc_value_t *v)
+{
+	enum pmc_mode mode;
+	struct p4pmc_descr *pd;
+	struct pmc *pm;
+	struct p4_cpu *pc;
+	struct pmc_hw *phw;
+	pmc_value_t tmp;
+
+	KASSERT(cpu >= 0 && cpu < ncpus,
+	    ("[p4,%d] illegal CPU value %d", __LINE__, cpu));
+	KASSERT(ri >= 0 && ri < P4_NPMCS,
+	    ("[p4,%d] illegal row-index %d", __LINE__, ri));
+
+
+	if (ri == 0) {	/* TSC */
+#ifdef	DEBUG
+		pc  = (struct p4_cpu *) pmc_pcpu[cpu];
+		phw = pc->pc_hwpmcs[ri];
+		pm  = phw->phw_pmc;
+
+		KASSERT(pm, ("[p4,%d] cpu=%d ri=%d not configured", __LINE__,
+			    cpu, ri));
+		KASSERT(PMC_TO_CLASS(pm) == PMC_CLASS_TSC,
+		    ("[p4,%d] cpu=%d ri=%d not a TSC (%d)", __LINE__, cpu, ri,
+			PMC_TO_CLASS(pm)));
+		KASSERT(PMC_IS_COUNTING_MODE(PMC_TO_MODE(pm)),
+		    ("[p4,%d] TSC counter in non-counting mode", __LINE__));
+#endif
+		*v = rdtsc();
+		PMCDBG(MDP,REA,2, "p4-read -> %jx", *v);
+		return 0;
+	}
+
+	pc  = (struct p4_cpu *) pmc_pcpu[P4_TO_HTT_PRIMARY(cpu)];
+	phw = pc->pc_hwpmcs[ri];
+	pd  = &p4_pmcdesc[ri];
+	pm  = phw->phw_pmc;
+
+	KASSERT(pm != NULL,
+	    ("[p4,%d] No owner for HWPMC [cpu%d,pmc%d]", __LINE__,
+		cpu, ri));
+
+	KASSERT(pd->pm_descr.pd_class == PMC_TO_CLASS(pm),
+	    ("[p4,%d] class mismatch pd %d != id class %d", __LINE__,
+		pd->pm_descr.pd_class, PMC_TO_CLASS(pm)));
+
+	mode = PMC_TO_MODE(pm);
+
+	PMCDBG(MDP,REA,1, "p4-read cpu=%d ri=%d mode=%d", cpu, ri, mode);
+
+	KASSERT(pd->pm_descr.pd_class == PMC_CLASS_P4,
+	    ("[p4,%d] unknown PMC class %d", __LINE__, pd->pm_descr.pd_class));
+
+	tmp = rdmsr(p4_pmcdesc[ri].pm_pmc_msr);
+
+	if (PMC_IS_VIRTUAL_MODE(mode)) {
+		if (tmp < P4_PCPU_HW_VALUE(pc,ri,cpu)) /* 40 bit overflow */
+			tmp += (P4_PERFCTR_MASK + 1) -
+			    P4_PCPU_HW_VALUE(pc,ri,cpu);
+		else
+			tmp -= P4_PCPU_HW_VALUE(pc,ri,cpu);
+		tmp += P4_PCPU_PMC_VALUE(pc,ri,cpu);
+	}
+
+	if (PMC_IS_SAMPLING_MODE(mode)) /* undo transformation */
+		*v = P4_PERFCTR_VALUE_TO_RELOAD_COUNT(tmp);
+	else
+		*v = tmp;
+
+	PMCDBG(MDP,REA,2, "p4-read -> %jx", *v);
+	return 0;
+}
+
+/*
+ * Write a PMC
+ */
+
+static int
+p4_write_pmc(int cpu, int ri, pmc_value_t v)
+{
+	enum pmc_mode mode;
+	struct pmc *pm;
+	struct p4_cpu *pc;
+	const struct pmc_hw *phw;
+	const struct p4pmc_descr *pd;
+
+	KASSERT(cpu >= 0 && cpu < ncpus,
+	    ("[amd,%d] illegal CPU value %d", __LINE__, cpu));
+	KASSERT(ri >= 0 && ri < P4_NPMCS,
+	    ("[amd,%d] illegal row-index %d", __LINE__, ri));
+
+
+	/*
+	 * The P4's TSC register is writeable, but we don't allow a
+	 * write as changing the TSC's value could interfere with
+	 * timekeeping and other system functions.
+	 */
+	if (ri == 0) {
+#ifdef	DEBUG
+		pc  = (struct p4_cpu *) pmc_pcpu[cpu];
+		phw = pc->pc_hwpmcs[ri];
+		pm  = phw->phw_pmc;
+		KASSERT(pm, ("[p4,%d] cpu=%d ri=%d not configured", __LINE__,
+			    cpu, ri));
+		KASSERT(PMC_TO_CLASS(pm) == PMC_CLASS_TSC,
+		    ("[p4,%d] cpu=%d ri=%d not a TSC (%d)", __LINE__,
+			cpu, ri, PMC_TO_CLASS(pm)));
+#endif
+		return 0;
+	}
+
+	/* Shared PMCs */
+	pc  = (struct p4_cpu *) pmc_pcpu[P4_TO_HTT_PRIMARY(cpu)];
+	phw = pc->pc_hwpmcs[ri];
+	pm  = phw->phw_pmc;
+	pd  = &p4_pmcdesc[ri];
+
+	KASSERT(pm != NULL,
+	    ("[p4,%d] No owner for HWPMC [cpu%d,pmc%d]", __LINE__,
+		cpu, ri));
+
+	mode = PMC_TO_MODE(pm);
+
+	PMCDBG(MDP,WRI,1, "p4-write cpu=%d ri=%d mode=%d v=%jx", cpu, ri,
+	    mode, v);
+
+	/*
+	 * write the PMC value to the register/saved value: for
+	 * sampling mode PMCs, the value to be programmed into the PMC
+	 * counter is -(C+1) where 'C' is the requested sample rate.
+	 */
+	if (PMC_IS_SAMPLING_MODE(mode))
+		v = P4_RELOAD_COUNT_TO_PERFCTR_VALUE(v);
+
+	if (PMC_IS_SYSTEM_MODE(mode))
+		wrmsr(pd->pm_pmc_msr, v);
+	else
+		P4_PCPU_PMC_VALUE(pc,ri,cpu) = v;
+
+	return 0;
+}
+
+/*
+ * Configure a PMC 'pm' on the given CPU and row-index.
+ *
+ * 'pm' may be NULL to indicate de-configuration.
+ *
+ * On HTT systems, a PMC may get configured twice, once for each
+ * "logical" CPU.  We track this using the CFGFLAGS field of the
+ * per-cpu state; this field is a bit mask with one bit each for
+ * logical CPUs 0 & 1.
+ */
+
+static int
+p4_config_pmc(int cpu, int ri, struct pmc *pm)
+{
+	struct pmc_hw *phw;
+	struct p4_cpu *pc;
+	int cfgflags, cpuflag;
+
+	KASSERT(cpu >= 0 && cpu < ncpus,
+	    ("[p4,%d] illegal CPU %d", __LINE__, cpu));
+	KASSERT(ri >= 0 && ri < P4_NPMCS,
+	    ("[p4,%d] illegal row-index %d", __LINE__, ri));
+
+	PMCDBG(MDP,CFG,1, "cpu=%d ri=%d pm=%p", cpu, ri, pm);
+
+	if (ri == 0) {		/* TSC */
+		pc = (struct p4_cpu *) pmc_pcpu[cpu];
+		phw = pc->pc_hwpmcs[ri];
+
+		KASSERT(pm == NULL || phw->phw_pmc == NULL,
+		    ("[p4,%d] hwpmc doubly config'ed", __LINE__));
+		phw->phw_pmc = pm;
+		return 0;
+	}
+
+	/* Shared PMCs */
+
+	pc = (struct p4_cpu *) pmc_pcpu[P4_TO_HTT_PRIMARY(cpu)];
+	phw = pc->pc_hwpmcs[ri];
+
+	KASSERT(pm == NULL || phw->phw_pmc == NULL ||
+	    (p4_system_has_htt && phw->phw_pmc == pm),
+	    ("[p4,%d] hwpmc not unconfigured before re-config", __LINE__));
+
+	spin_lock_wr(&pc->pc_lock);
+	cfgflags = P4_PCPU_GET_CFGFLAGS(pc,ri);
+
+	KASSERT(cfgflags >= 0 || cfgflags <= 3,
+	    ("[p4,%d] illegal cfgflags cfg=%d on cpu=%d ri=%d", __LINE__,
+		cfgflags, cpu, ri));
+
+	KASSERT(cfgflags == 0 || phw->phw_pmc,
+	    ("[p4,%d] cpu=%d ri=%d pmc configured with zero cfg count",
+		__LINE__, cpu, ri));
+
+	cpuflag = P4_CPU_TO_FLAG(cpu);
+
+	if (pm) {		/* config */
+		if (cfgflags == 0)
+			phw->phw_pmc = pm;
+
+		KASSERT(phw->phw_pmc == pm,
+		    ("[p4,%d] cpu=%d ri=%d config %p != hw %p",
+			__LINE__, cpu, ri, pm, phw->phw_pmc));
+
+		cfgflags |= cpuflag;
+	} else {		/* unconfig */
+		cfgflags &= ~cpuflag;
+
+		if (cfgflags == 0)
+			phw->phw_pmc = NULL;
+	}
+
+	KASSERT(cfgflags >= 0 || cfgflags <= 3,
+	    ("[p4,%d] illegal runcount cfg=%d on cpu=%d ri=%d", __LINE__,
+		cfgflags, cpu, ri));
+
+	P4_PCPU_SET_CFGFLAGS(pc,ri,cfgflags);
+
+	spin_unlock_wr(&pc->pc_lock);
+
+	return 0;
+}
+
+/*
+ * Retrieve a configured PMC pointer from hardware state.
+ */
+
+static int
+p4_get_config(int cpu, int ri, struct pmc **ppm)
+{
+	struct p4_cpu *pc;
+	struct pmc_hw *phw;
+	int cfgflags;
+
+	pc = (struct p4_cpu *) pmc_pcpu[P4_TO_HTT_PRIMARY(cpu)];
+	phw = pc->pc_hwpmcs[ri];
+
+	spin_lock_wr(&pc->pc_lock);
+	cfgflags = P4_PCPU_GET_CFGFLAGS(pc,ri);
+	spin_unlock_wr(&pc->pc_lock);
+
+	if (cfgflags & P4_CPU_TO_FLAG(cpu))
+		*ppm = phw->phw_pmc; /* PMC config'ed on this CPU */
+	else
+		*ppm = NULL;
+
+	return 0;
+}
+
+/*
+ * Allocate a PMC.
+ *
+ * The allocation strategy differs between HTT and non-HTT systems.
+ *
+ * The non-HTT case:
+ *   - Given the desired event and the PMC row-index, lookup the
+ *   list of valid ESCRs for the event.
+ *   - For each valid ESCR:
+ *     - Check if the ESCR is free and the ESCR row is in a compatible
+ *       mode (i.e., system or process))
+ *     - Check if the ESCR is usable with a P4 PMC at the desired row-index.
+ *   If everything matches, we determine the appropriate bit values for the
+ *   ESCR and CCCR registers.
+ *
+ * The HTT case:
+ *
+ * - Process mode PMCs require special care.  The FreeBSD scheduler could
+ *   schedule any two processes on the same physical CPU.  We need to ensure
+ *   that a given PMC row-index is never allocated to two different
+ *   PMCs owned by different user-processes.
+ *   This is ensured by always allocating a PMC from a 'FREE' PMC row
+ *   if the system has HTT active.
+ * - A similar check needs to be done for ESCRs; we do not want two PMCs
+ *   using the same ESCR to be scheduled at the same time.  Thus ESCR
+ *   allocation is also restricted to FREE rows if the system has HTT
+ *   enabled.
+ * - Thirdly, some events are 'thread-independent' terminology, i.e.,
+ *   the PMC hardware cannot distinguish between events caused by
+ *   different logical CPUs.  This makes it impossible to assign events
+ *   to a given thread of execution.  If the system has HTT enabled,
+ *   these events are not allowed for process-mode PMCs.
+ */
+
+static int
+p4_allocate_pmc(int cpu, int ri, struct pmc *pm,
+    const struct pmc_op_pmcallocate *a)
+{
+	int found, n, m;
+	uint32_t caps, cccrvalue, escrvalue, tflags;
+	enum pmc_p4escr escr;
+	struct p4_cpu *pc;
+	struct p4_event_descr *pevent;
+	const struct p4pmc_descr *pd;
+
+	KASSERT(cpu >= 0 && cpu < ncpus,
+	    ("[p4,%d] illegal CPU %d", __LINE__, cpu));
+	KASSERT(ri >= 0 && ri < P4_NPMCS,
+	    ("[p4,%d] illegal row-index value %d", __LINE__, ri));
+
+	pd = &p4_pmcdesc[ri];
+
+	PMCDBG(MDP,ALL,1, "p4-allocate ri=%d class=%d pmccaps=0x%x "
+	    "reqcaps=0x%x", ri, pd->pm_descr.pd_class, pd->pm_descr.pd_caps,
+	    pm->pm_caps);
+
+	/* check class */
+	if (pd->pm_descr.pd_class != a->pm_class)
+		return EINVAL;
+
+	/* check requested capabilities */
+	caps = a->pm_caps;
+	if ((pd->pm_descr.pd_caps & caps) != caps)
+		return EPERM;
+
+	if (pd->pm_descr.pd_class == PMC_CLASS_TSC) {
+		/* TSC's are always allocated in system-wide counting mode */
+		if (a->pm_ev != PMC_EV_TSC_TSC ||
+		    a->pm_mode != PMC_MODE_SC)
+			return EINVAL;
+		return 0;
+	}
+
+	/*
+	 * If the system has HTT enabled, and the desired allocation
+	 * mode is process-private, and the PMC row disposition is not
+	 * FREE (0), decline the allocation.
+	 */
+
+	if (p4_system_has_htt &&
+	    PMC_IS_VIRTUAL_MODE(PMC_TO_MODE(pm)) &&
+	    pmc_getrowdisp(ri) != 0)
+		return EBUSY;
+
+	KASSERT(pd->pm_descr.pd_class == PMC_CLASS_P4,
+	    ("[p4,%d] unknown PMC class %d", __LINE__,
+		pd->pm_descr.pd_class));
+
+	if (pm->pm_event < PMC_EV_P4_FIRST ||
+	    pm->pm_event > PMC_EV_P4_LAST)
+		return EINVAL;
+
+	if ((pevent = p4_find_event(pm->pm_event)) == NULL)
+		return ESRCH;
+
+	PMCDBG(MDP,ALL,2, "pevent={ev=%d,escrsel=0x%x,cccrsel=0x%x,isti=%d}",
+	    pevent->pm_event, pevent->pm_escr_eventselect,
+	    pevent->pm_cccr_select, pevent->pm_is_ti_event);
+
+	/*
+	 * Some PMC events are 'thread independent'and therefore
+	 * cannot be used for process-private modes if HTT is being
+	 * used.
+	 */
+
+	if (P4_EVENT_IS_TI(pevent) &&
+	    PMC_IS_VIRTUAL_MODE(PMC_TO_MODE(pm)) &&
+	    p4_system_has_htt)
+		return EINVAL;
+
+	pc = (struct p4_cpu *) pmc_pcpu[P4_TO_HTT_PRIMARY(cpu)];
+
+	found   = 0;
+
+	/* look for a suitable ESCR for this event */
+	for (n = 0; n < P4_MAX_ESCR_PER_EVENT && !found; n++) {
+		if ((escr = pevent->pm_escrs[n]) == P4_ESCR_NONE)
+			break;	/* out of ESCRs */
+		/*
+		 * Check ESCR row disposition.
+		 *
+		 * If the request is for a system-mode PMC, then the
+		 * ESCR row should not be in process-virtual mode, and
+		 * should also be free on the current CPU.
+		 */
+
+		if (PMC_IS_SYSTEM_MODE(PMC_TO_MODE(pm))) {
+		    if (P4_ESCR_ROW_DISP_IS_THREAD(escr) ||
+			pc->pc_escrs[escr] != P4_INVALID_PMC_INDEX)
+			    continue;
+		}
+
+		/*
+		 * If the request is for a process-virtual PMC, and if
+		 * HTT is not enabled, we can use an ESCR row that is
+		 * either FREE or already in process mode.
+		 *
+		 * If HTT is enabled, then we need to ensure that a
+		 * given ESCR is never allocated to two PMCS that
+		 * could run simultaneously on the two logical CPUs of
+		 * a CPU package.  We ensure this be only allocating
+		 * ESCRs from rows marked as 'FREE'.
+		 */
+
+		if (PMC_IS_VIRTUAL_MODE(PMC_TO_MODE(pm))) {
+			if (p4_system_has_htt) {
+				if (!P4_ESCR_ROW_DISP_IS_FREE(escr))
+					continue;
+			} else
+				if (P4_ESCR_ROW_DISP_IS_STANDALONE(escr))
+					continue;
+		}
+
+		/*
+		 * We found a suitable ESCR for this event.  Now check if
+		 * this escr can work with the PMC at row-index 'ri'.
+		 */
+
+		for (m = 0; m < P4_MAX_PMC_PER_ESCR; m++)
+			if (p4_escrs[escr].pm_pmcs[m] == pd->pm_pmcnum) {
+				found = 1;
+				break;
+			}
+	}
+
+	if (found == 0)
+		return ESRCH;
+
+	KASSERT((int) escr >= 0 && escr < P4_NESCR,
+	    ("[p4,%d] illegal ESCR value %d", __LINE__, escr));
+
+	/* mark ESCR row mode */
+	if (PMC_IS_SYSTEM_MODE(PMC_TO_MODE(pm))) {
+		pc->pc_escrs[escr] = ri; /* mark ESCR as in use on this cpu */
+		P4_ESCR_MARK_ROW_STANDALONE(escr);
+	} else {
+		KASSERT(pc->pc_escrs[escr] == P4_INVALID_PMC_INDEX,
+		    ("[p4,%d] escr[%d] already in use", __LINE__, escr));
+		P4_ESCR_MARK_ROW_THREAD(escr);
+	}
+
+	pm->pm_md.pm_p4.pm_p4_escrmsr   = p4_escrs[escr].pm_escr_msr;
+	pm->pm_md.pm_p4.pm_p4_escr      = escr;
+
+	cccrvalue = P4_CCCR_TO_ESCR_SELECT(pevent->pm_cccr_select);
+	escrvalue = P4_ESCR_TO_EVENT_SELECT(pevent->pm_escr_eventselect);
+
+	/* CCCR fields */
+	if (caps & PMC_CAP_THRESHOLD)
+		cccrvalue |= (a->pm_md.pm_p4.pm_p4_cccrconfig &
+		    P4_CCCR_THRESHOLD_MASK) | P4_CCCR_COMPARE;
+
+	if (caps & PMC_CAP_EDGE)
+		cccrvalue |= P4_CCCR_EDGE;
+
+	if (caps & PMC_CAP_INVERT)
+		cccrvalue |= P4_CCCR_COMPLEMENT;
+
+	if (p4_system_has_htt)
+		cccrvalue |= a->pm_md.pm_p4.pm_p4_cccrconfig &
+		    P4_CCCR_ACTIVE_THREAD_MASK;
+	else			/* no HTT; thread field should be '11b' */
+		cccrvalue |= P4_CCCR_TO_ACTIVE_THREAD(0x3);
+
+	if (caps & PMC_CAP_CASCADE)
+		cccrvalue |= P4_CCCR_CASCADE;
+
+	/* On HTT systems the PMI T0 field may get moved to T1 at pmc start */
+	if (caps & PMC_CAP_INTERRUPT)
+		cccrvalue |= P4_CCCR_OVF_PMI_T0;
+
+	/* ESCR fields */
+	if (caps & PMC_CAP_QUALIFIER)
+		escrvalue |= a->pm_md.pm_p4.pm_p4_escrconfig &
+		    P4_ESCR_EVENT_MASK_MASK;
+	if (caps & PMC_CAP_TAGGING)
+		escrvalue |= (a->pm_md.pm_p4.pm_p4_escrconfig &
+		    P4_ESCR_TAG_VALUE_MASK) | P4_ESCR_TAG_ENABLE;
+	if (caps & PMC_CAP_QUALIFIER)
+		escrvalue |= (a->pm_md.pm_p4.pm_p4_escrconfig &
+		    P4_ESCR_EVENT_MASK_MASK);
+
+	/* HTT: T0_{OS,USR} bits may get moved to T1 at pmc start */
+	tflags = 0;
+	if (caps & PMC_CAP_SYSTEM)
+		tflags |= P4_ESCR_T0_OS;
+	if (caps & PMC_CAP_USER)
+		tflags |= P4_ESCR_T0_USR;
+	if (tflags == 0)
+		tflags = (P4_ESCR_T0_OS|P4_ESCR_T0_USR);
+	escrvalue |= tflags;
+
+	pm->pm_md.pm_p4.pm_p4_cccrvalue = cccrvalue;
+	pm->pm_md.pm_p4.pm_p4_escrvalue = escrvalue;
+
+	PMCDBG(MDP,ALL,2, "p4-allocate cccrsel=0x%x cccrval=0x%x "
+	    "escr=%d escrmsr=0x%x escrval=0x%x", pevent->pm_cccr_select,
+	    cccrvalue, escr, pm->pm_md.pm_p4.pm_p4_escrmsr, escrvalue);
+
+	return 0;
+}
+
+/*
+ * release a PMC.
+ */
+
+static int
+p4_release_pmc(int cpu, int ri, struct pmc *pm)
+{
+	enum pmc_p4escr escr;
+	struct pmc_hw *phw;
+	struct p4_cpu *pc;
+
+	if (p4_pmcdesc[ri].pm_descr.pd_class == PMC_CLASS_TSC)
+		return 0;
+
+	escr = pm->pm_md.pm_p4.pm_p4_escr;
+
+	PMCDBG(MDP,REL,1, "p4-release cpu=%d ri=%d escr=%d", cpu, ri, escr);
+
+	if (PMC_IS_SYSTEM_MODE(PMC_TO_MODE(pm))) {
+		pc  = (struct p4_cpu *) pmc_pcpu[P4_TO_HTT_PRIMARY(cpu)];
+		phw = pc->pc_hwpmcs[ri];
+
+		KASSERT(phw->phw_pmc == NULL,
+		    ("[p4,%d] releasing configured PMC ri=%d", __LINE__, ri));
+
+		P4_ESCR_UNMARK_ROW_STANDALONE(escr);
+		KASSERT(pc->pc_escrs[escr] == ri,
+		    ("[p4,%d] escr[%d] not allocated to ri %d", __LINE__,
+			escr, ri));
+	        pc->pc_escrs[escr] = P4_INVALID_PMC_INDEX; /* mark as free */
+	} else
+		P4_ESCR_UNMARK_ROW_THREAD(escr);
+
+	return 0;
+}
+
+/*
+ * Start a PMC
+ */
+
+static int
+p4_start_pmc(int cpu, int ri)
+{
+	int rc;
+	uint32_t cccrvalue, cccrtbits, escrvalue, escrmsr, escrtbits;
+	struct pmc *pm;
+	struct p4_cpu *pc;
+	struct pmc_hw *phw;
+	struct p4pmc_descr *pd;
+
+	KASSERT(cpu >= 0 && cpu < ncpus,
+	    ("[p4,%d] illegal CPU value %d", __LINE__, cpu));
+	KASSERT(ri >= 0 && ri < P4_NPMCS,
+	    ("[p4,%d] illegal row-index %d", __LINE__, ri));
+
+	pc  = (struct p4_cpu *) pmc_pcpu[P4_TO_HTT_PRIMARY(cpu)];
+	phw = pc->pc_hwpmcs[ri];
+	pm  = phw->phw_pmc;
+	pd  = &p4_pmcdesc[ri];
+
+	KASSERT(pm != NULL,
+	    ("[p4,%d] starting cpu%d,pmc%d with null pmc", __LINE__,
+		cpu, ri));
+
+	PMCDBG(MDP,STA,1, "p4-start cpu=%d ri=%d", cpu, ri);
+
+	if (pd->pm_descr.pd_class == PMC_CLASS_TSC) /* TSC are always on */
+		return 0;
+
+	KASSERT(pd->pm_descr.pd_class == PMC_CLASS_P4,
+	    ("[p4,%d] wrong PMC class %d", __LINE__,
+		pd->pm_descr.pd_class));
+
+	/* retrieve the desired CCCR/ESCR values from the PMC */
+	cccrvalue = pm->pm_md.pm_p4.pm_p4_cccrvalue;
+	escrvalue = pm->pm_md.pm_p4.pm_p4_escrvalue;
+	escrmsr   = pm->pm_md.pm_p4.pm_p4_escrmsr;
+
+	/* extract and zero the logical processor selection bits */
+	cccrtbits = cccrvalue & P4_CCCR_OVF_PMI_T0;
+	escrtbits = escrvalue & (P4_ESCR_T0_OS|P4_ESCR_T0_USR);
+	cccrvalue &= ~P4_CCCR_OVF_PMI_T0;
+	escrvalue &= ~(P4_ESCR_T0_OS|P4_ESCR_T0_USR);
+
+	if (P4_CPU_IS_HTT_SECONDARY(cpu)) { /* shift T0 bits to T1 position */
+		cccrtbits <<= 1;
+		escrtbits >>= 2;
+	}
+
+	/* start system mode PMCs directly */
+	if (PMC_IS_SYSTEM_MODE(PMC_TO_MODE(pm))) {
+		wrmsr(escrmsr, escrvalue | escrtbits);
+		wrmsr(pd->pm_cccr_msr, cccrvalue | cccrtbits | P4_CCCR_ENABLE);
+		return 0;
+	}
+
+	/*
+	 * Thread mode PMCs
+	 *
+	 * On HTT machines, the same PMC could be scheduled on the
+	 * same physical CPU twice (once for each logical CPU), for
+	 * example, if two threads of a multi-threaded process get
+	 * scheduled on the same CPU.
+	 *
+	 */
+
+	spin_lock_wr(&pc->pc_lock);
+
+	rc = P4_PCPU_GET_RUNCOUNT(pc,ri);
+	KASSERT(rc == 0 || rc == 1,
+	    ("[p4,%d] illegal runcount cpu=%d ri=%d rc=%d", __LINE__, cpu, ri,
+		rc));
+
+	if (rc == 0) {		/* 1st CPU and the non-HTT case */
+
+		KASSERT(P4_PMC_IS_STOPPED(pd->pm_cccr_msr),
+		    ("[p4,%d] cpu=%d ri=%d cccr=0x%x not stopped", __LINE__,
+			cpu, ri, pd->pm_cccr_msr));
+
+		/* write out the low 40 bits of the saved value to hardware */
+		wrmsr(pd->pm_pmc_msr,
+		    P4_PCPU_PMC_VALUE(pc,ri,cpu) & P4_PERFCTR_MASK);
+
+	} else if (rc == 1) {		/* 2nd CPU */
+
+		/*
+		 * Stop the PMC and retrieve the CCCR and ESCR values
+		 * from their MSRs, and turn on the additional T[0/1]
+		 * bits for the 2nd CPU.
+		 */
+
+		cccrvalue = rdmsr(pd->pm_cccr_msr);
+		wrmsr(pd->pm_cccr_msr, cccrvalue & ~P4_CCCR_ENABLE);
+
+		/* check that the configuration bits read back match the PMC */
+		KASSERT((cccrvalue & P4_CCCR_Tx_MASK) ==
+		    (pm->pm_md.pm_p4.pm_p4_cccrvalue & P4_CCCR_Tx_MASK),
+		    ("[p4,%d] Extra CCCR bits cpu=%d rc=%d ri=%d "
+			"cccr=0x%x PMC=0x%x", __LINE__, cpu, rc, ri,
+			cccrvalue & P4_CCCR_Tx_MASK,
+			pm->pm_md.pm_p4.pm_p4_cccrvalue & P4_CCCR_Tx_MASK));
+		KASSERT(cccrvalue & P4_CCCR_ENABLE,
+		    ("[p4,%d] 2nd cpu rc=%d cpu=%d ri=%d not running",
+			__LINE__, rc, cpu, ri));
+		KASSERT((cccrvalue & cccrtbits) == 0,
+		    ("[p4,%d] CCCR T0/T1 mismatch rc=%d cpu=%d ri=%d"
+		     "cccrvalue=0x%x tbits=0x%x", __LINE__, rc, cpu, ri,
+			cccrvalue, cccrtbits));
+
+		escrvalue = rdmsr(escrmsr);
+
+		KASSERT((escrvalue & P4_ESCR_Tx_MASK) ==
+		    (pm->pm_md.pm_p4.pm_p4_escrvalue & P4_ESCR_Tx_MASK),
+		    ("[p4,%d] Extra ESCR bits cpu=%d rc=%d ri=%d "
+			"escr=0x%x pm=0x%x", __LINE__, cpu, rc, ri,
+			escrvalue & P4_ESCR_Tx_MASK,
+			pm->pm_md.pm_p4.pm_p4_escrvalue & P4_ESCR_Tx_MASK));
+		KASSERT((escrvalue & escrtbits) == 0,
+		    ("[p4,%d] ESCR T0/T1 mismatch rc=%d cpu=%d ri=%d "
+		     "escrmsr=0x%x escrvalue=0x%x tbits=0x%x", __LINE__,
+			rc, cpu, ri, escrmsr, escrvalue, escrtbits));
+	}
+
+	/* Enable the correct bits for this CPU. */
+	escrvalue |= escrtbits;
+	cccrvalue |= cccrtbits | P4_CCCR_ENABLE;
+
+	/* Save HW value at the time of starting hardware */
+	P4_PCPU_HW_VALUE(pc,ri,cpu) = rdmsr(pd->pm_pmc_msr);
+
+	/* Program the ESCR and CCCR and start the PMC */
+	wrmsr(escrmsr, escrvalue);
+	wrmsr(pd->pm_cccr_msr, cccrvalue);
+
+	++rc;
+	P4_PCPU_SET_RUNCOUNT(pc,ri,rc);
+
+	spin_unlock_wr(&pc->pc_lock);
+
+	PMCDBG(MDP,STA,2,"p4-start cpu=%d rc=%d ri=%d escr=%d "
+	    "escrmsr=0x%x escrvalue=0x%x cccr_config=0x%x v=%jx", cpu, rc,
+	    ri, pm->pm_md.pm_p4.pm_p4_escr, escrmsr, escrvalue,
+	    cccrvalue, P4_PCPU_HW_VALUE(pc,ri,cpu));
+
+	return 0;
+}
+
+/*
+ * Stop a PMC.
+ */
+
+static int
+p4_stop_pmc(int cpu, int ri)
+{
+	int rc;
+	uint32_t cccrvalue, cccrtbits, escrvalue, escrmsr, escrtbits;
+	struct pmc *pm;
+	struct p4_cpu *pc;
+	struct pmc_hw *phw;
+	struct p4pmc_descr *pd;
+	pmc_value_t tmp;
+
+	KASSERT(cpu >= 0 && cpu < ncpus,
+	    ("[p4,%d] illegal CPU value %d", __LINE__, cpu));
+	KASSERT(ri >= 0 && ri < P4_NPMCS,
+	    ("[p4,%d] illegal row index %d", __LINE__, ri));
+
+	pd  = &p4_pmcdesc[ri];
+
+	if (pd->pm_descr.pd_class == PMC_CLASS_TSC)
+		return 0;
+
+	pc  = (struct p4_cpu *) pmc_pcpu[P4_TO_HTT_PRIMARY(cpu)];
+	phw = pc->pc_hwpmcs[ri];
+
+	KASSERT(phw != NULL,
+	    ("[p4,%d] null phw for cpu%d, ri%d", __LINE__, cpu, ri));
+
+	pm  = phw->phw_pmc;
+
+	KASSERT(pm != NULL,
+	    ("[p4,%d] null pmc for cpu%d, ri%d", __LINE__, cpu, ri));
+
+	PMCDBG(MDP,STO,1, "p4-stop cpu=%d ri=%d", cpu, ri);
+
+	if (PMC_IS_SYSTEM_MODE(PMC_TO_MODE(pm))) {
+		wrmsr(pd->pm_cccr_msr,
+		    pm->pm_md.pm_p4.pm_p4_cccrvalue & ~P4_CCCR_ENABLE);
+		return 0;
+	}
+
+	/*
+	 * Thread mode PMCs.
+	 *
+	 * On HTT machines, this PMC may be in use by two threads
+	 * running on two logical CPUS.  Thus we look at the
+	 * 'pm_runcount' field and only turn off the appropriate TO/T1
+	 * bits (and keep the PMC running) if two logical CPUs were
+	 * using the PMC.
+	 *
+	 */
+
+	/* bits to mask */
+	cccrtbits = P4_CCCR_OVF_PMI_T0;
+	escrtbits = P4_ESCR_T0_OS | P4_ESCR_T0_USR;
+	if (P4_CPU_IS_HTT_SECONDARY(cpu)) {
+		cccrtbits <<= 1;
+		escrtbits >>= 2;
+	}
+
+	spin_lock_wr(&pc->pc_lock);
+
+	rc = P4_PCPU_GET_RUNCOUNT(pc,ri);
+
+	KASSERT(rc == 2 || rc == 1,
+	    ("[p4,%d] illegal runcount cpu=%d ri=%d rc=%d", __LINE__, cpu, ri,
+		rc));
+
+	--rc;
+
+	P4_PCPU_SET_RUNCOUNT(pc,ri,rc);
+
+	/* Stop this PMC */
+	cccrvalue = rdmsr(pd->pm_cccr_msr);
+	wrmsr(pd->pm_cccr_msr, cccrvalue & ~P4_CCCR_ENABLE);
+
+	escrmsr   = pm->pm_md.pm_p4.pm_p4_escrmsr;
+	escrvalue = rdmsr(escrmsr);
+
+	/* The current CPU should be running on this PMC */
+	KASSERT(escrvalue & escrtbits,
+	    ("[p4,%d] ESCR T0/T1 mismatch cpu=%d rc=%d ri=%d escrmsr=0x%x "
+		"escrvalue=0x%x tbits=0x%x", __LINE__, cpu, rc, ri, escrmsr,
+		escrvalue, escrtbits));
+	KASSERT(PMC_IS_COUNTING_MODE(PMC_TO_MODE(pm)) ||
+	    (cccrvalue & cccrtbits),
+	    ("[p4,%d] CCCR T0/T1 mismatch cpu=%d ri=%d cccrvalue=0x%x "
+		"tbits=0x%x", __LINE__, cpu, ri, cccrvalue, cccrtbits));
+
+	/* get the current hardware reading */
+	tmp = rdmsr(pd->pm_pmc_msr);
+
+	if (rc == 1) {		/* need to keep the PMC running */
+		escrvalue &= ~escrtbits;
+		cccrvalue &= ~cccrtbits;
+		wrmsr(escrmsr, escrvalue);
+		wrmsr(pd->pm_cccr_msr, cccrvalue);
+	}
+
+	spin_unlock_wr(&pc->pc_lock);
+
+	PMCDBG(MDP,STO,2, "p4-stop cpu=%d rc=%d ri=%d escrmsr=0x%x "
+	    "escrval=0x%x cccrval=0x%x v=%jx", cpu, rc, ri, escrmsr,
+	    escrvalue, cccrvalue, tmp);
+
+	if (tmp < P4_PCPU_HW_VALUE(pc,ri,cpu)) /* 40 bit counter overflow */
+		tmp += (P4_PERFCTR_MASK + 1) - P4_PCPU_HW_VALUE(pc,ri,cpu);
+	else
+		tmp -= P4_PCPU_HW_VALUE(pc,ri,cpu);
+
+	P4_PCPU_PMC_VALUE(pc,ri,cpu) += tmp;
+
+	return 0;
+}
+
+/*
+ * Handle an interrupt.
+ *
+ * The hardware sets the CCCR_OVF whenever a counter overflow occurs,
+ * so the handler examines all the 18 CCCR registers, processing the
+ * counters that have overflowed.
+ *
+ * On HTT machines, the CCCR register is shared and will interrupt
+ * both logical processors if so configured.  Thus multiple logical
+ * CPUs could enter the NMI service routine at the same time.  These
+ * will get serialized using a per-cpu spinlock dedicated for use in
+ * the NMI handler.
+ */
+
+static int
+p4_intr(int cpu, uintptr_t eip, int usermode)
+{
+	int i, did_interrupt, error, ri;
+	uint32_t cccrval, ovf_mask, ovf_partner;
+	struct p4_cpu *pc;
+	struct pmc_hw *phw;
+	struct pmc *pm;
+	pmc_value_t v;
+
+	PMCDBG(MDP,INT, 1, "cpu=%d eip=%p um=%d", cpu, (void *) eip, usermode);
+
+	pc = (struct p4_cpu *) pmc_pcpu[P4_TO_HTT_PRIMARY(cpu)];
+
+	ovf_mask = P4_CPU_IS_HTT_SECONDARY(cpu) ?
+	    P4_CCCR_OVF_PMI_T1 : P4_CCCR_OVF_PMI_T0;
+	ovf_mask |= P4_CCCR_OVF;
+	if (p4_system_has_htt)
+		ovf_partner = P4_CPU_IS_HTT_SECONDARY(cpu) ? P4_CCCR_OVF_PMI_T0 :
+		    P4_CCCR_OVF_PMI_T1;
+	else
+		ovf_partner = 0;
+	did_interrupt = 0;
+
+	if (p4_system_has_htt)
+		P4_PCPU_ACQ_INTR_SPINLOCK(pc);
+
+	/*
+	 * Loop through all CCCRs, looking for ones that have
+	 * interrupted this CPU.
+	 */
+	for (i = 0; i < P4_NPMCS-1; i++) {
+
+		ri = i + 1;	/* row index */
+
+		/*
+		 * Check if our partner logical CPU has already marked
+		 * this PMC has having interrupted it.  If so, reset
+		 * the flag and process the interrupt, but leave the
+		 * hardware alone.
+		 */
+		if (p4_system_has_htt && P4_PCPU_GET_INTRFLAG(pc,ri)) {
+			P4_PCPU_SET_INTRFLAG(pc,ri,0);
+			did_interrupt = 1;
+
+			/*
+			 * Ignore de-configured or stopped PMCs.
+			 * Ignore PMCs not in sampling mode.
+			 */
+			phw = pc->pc_hwpmcs[ri];
+			pm  = phw->phw_pmc;
+			if (pm == NULL ||
+			    pm->pm_state != PMC_STATE_RUNNING ||
+			    !PMC_IS_SAMPLING_MODE(PMC_TO_MODE(pm))) {
+				continue;
+			}
+			(void) pmc_process_interrupt(cpu, pm, eip, usermode);
+			continue;
+		}
+
+		/*
+		 * Fresh interrupt.  Look for the CCCR_OVF bit
+		 * and the OVF_Tx bit for this logical
+		 * processor being set.
+		 */
+		cccrval = rdmsr(P4_CCCR_MSR_FIRST + i);
+
+		if ((cccrval & ovf_mask) != ovf_mask)
+			continue;
+
+		/*
+		 * If the other logical CPU would also have been
+		 * interrupted due to the PMC being shared, record
+		 * this fact in the per-cpu saved interrupt flag
+		 * bitmask.
+		 */
+		if (p4_system_has_htt && (cccrval & ovf_partner))
+			P4_PCPU_SET_INTRFLAG(pc, ri, 1);
+
+		v = rdmsr(P4_PERFCTR_MSR_FIRST + i);
+
+		PMCDBG(MDP,INT, 2, "ri=%d v=%jx", ri, v);
+
+		/* Stop the counter, and reset the overflow  bit */
+		cccrval &= ~(P4_CCCR_OVF | P4_CCCR_ENABLE);
+		wrmsr(P4_CCCR_MSR_FIRST + i, cccrval);
+
+		did_interrupt = 1;
+
+		/*
+		 * Ignore de-configured or stopped PMCs.  Ignore PMCs
+		 * not in sampling mode.
+		 */
+		phw = pc->pc_hwpmcs[ri];
+		pm  = phw->phw_pmc;
+
+		if (pm == NULL ||
+		    pm->pm_state != PMC_STATE_RUNNING ||
+		    !PMC_IS_SAMPLING_MODE(PMC_TO_MODE(pm))) {
+			continue;
+		}
+
+		/*
+		 * Process the interrupt.  Re-enable the PMC if
+		 * processing was successful.
+		 */
+		error = pmc_process_interrupt(cpu, pm, eip, usermode);
+
+		/*
+		 * Only the first processor executing the NMI handler
+		 * in a HTT pair will restart a PMC, and that too
+		 * only if there were no errors.
+		 */
+		v = P4_RELOAD_COUNT_TO_PERFCTR_VALUE(
+			pm->pm_sc.pm_reloadcount);
+		wrmsr(P4_PERFCTR_MSR_FIRST + i, v);
+		if (error == 0)
+			wrmsr(P4_CCCR_MSR_FIRST + i,
+			    cccrval | P4_CCCR_ENABLE);
+	}
+
+	/* allow the other CPU to proceed */
+	if (p4_system_has_htt)
+		P4_PCPU_REL_INTR_SPINLOCK(pc);
+
+	/*
+	 * On Intel P4 CPUs, the PMC 'pcint' entry in the LAPIC gets
+	 * masked when a PMC interrupts the CPU.  We need to unmask
+	 * the interrupt source explicitly.
+	 */
+
+	if (did_interrupt)
+		pmc_x86_lapic_enable_pmc_interrupt();
+
+	atomic_add_int(did_interrupt ? &pmc_stats.pm_intr_processed :
+	    &pmc_stats.pm_intr_ignored, 1);
+
+	return did_interrupt;
+}
+
+/*
+ * Describe a CPU's PMC state.
+ */
+
+static int
+p4_describe(int cpu, int ri, struct pmc_info *pi,
+    struct pmc **ppmc)
+{
+	int error;
+	size_t copied;
+	struct pmc_hw *phw;
+	const struct p4pmc_descr *pd;
+
+	KASSERT(cpu >= 0 && cpu < ncpus,
+	    ("[p4,%d] illegal CPU %d", __LINE__, cpu));
+	KASSERT(ri >= 0 && ri < P4_NPMCS,
+	    ("[p4,%d] row-index %d out of range", __LINE__, ri));
+
+	PMCDBG(MDP,OPS,1,"p4-describe cpu=%d ri=%d", cpu, ri);
+
+	if (P4_CPU_IS_HTT_SECONDARY(cpu))
+		return EINVAL;
+
+	phw = pmc_pcpu[cpu]->pc_hwpmcs[ri];
+	pd  = &p4_pmcdesc[ri];
+
+	if ((error = copystr(pd->pm_descr.pd_name, pi->pm_name,
+		 PMC_NAME_MAX, &copied)) != 0)
+		return error;
+
+	pi->pm_class = pd->pm_descr.pd_class;
+
+	if (phw->phw_state & PMC_PHW_FLAG_IS_ENABLED) {
+		pi->pm_enabled = TRUE;
+		*ppmc          = phw->phw_pmc;
+	} else {
+		pi->pm_enabled = FALSE;
+		*ppmc          = NULL;
+	}
+
+	return 0;
+}
+
+/*
+ * Get MSR# for use with RDPMC.
+ */
+
+static int
+p4_get_msr(int ri, uint32_t *msr)
+{
+	KASSERT(ri >= 0 && ri < P4_NPMCS,
+	    ("[p4,%d] ri %d out of range", __LINE__, ri));
+
+	*msr = p4_pmcdesc[ri].pm_pmc_msr - P4_PERFCTR_MSR_FIRST;
+
+	PMCDBG(MDP,OPS, 1, "ri=%d getmsr=0x%x", ri, *msr);
+
+	return 0;
+}
+
+
+int
+pmc_initialize_p4(struct pmc_mdep *pmc_mdep)
+{
+	struct p4_event_descr *pe;
+
+	KASSERT(strcmp(cpu_vendor, "GenuineIntel") == 0,
+	    ("[p4,%d] Initializing non-intel processor", __LINE__));
+
+	PMCDBG(MDP,INI,1, "%s", "p4-initialize");
+
+	switch (pmc_mdep->pmd_cputype) {
+	case PMC_CPU_INTEL_PIV:
+
+		pmc_mdep->pmd_npmc	    = P4_NPMCS;
+		pmc_mdep->pmd_classes[1].pm_class = PMC_CLASS_P4;
+		pmc_mdep->pmd_classes[1].pm_caps  = P4_PMC_CAPS;
+		pmc_mdep->pmd_classes[1].pm_width = 40;
+		pmc_mdep->pmd_nclasspmcs[1] = 18;
+
+		pmc_mdep->pmd_init    	    = p4_init;
+		pmc_mdep->pmd_cleanup 	    = p4_cleanup;
+		pmc_mdep->pmd_switch_in     = p4_switch_in;
+		pmc_mdep->pmd_switch_out    = p4_switch_out;
+		pmc_mdep->pmd_read_pmc 	    = p4_read_pmc;
+		pmc_mdep->pmd_write_pmc     = p4_write_pmc;
+		pmc_mdep->pmd_config_pmc    = p4_config_pmc;
+		pmc_mdep->pmd_get_config    = p4_get_config;
+		pmc_mdep->pmd_allocate_pmc  = p4_allocate_pmc;
+		pmc_mdep->pmd_release_pmc   = p4_release_pmc;
+		pmc_mdep->pmd_start_pmc     = p4_start_pmc;
+		pmc_mdep->pmd_stop_pmc      = p4_stop_pmc;
+		pmc_mdep->pmd_intr	    = p4_intr;
+		pmc_mdep->pmd_describe      = p4_describe;
+		pmc_mdep->pmd_get_msr  	    = p4_get_msr; /* i386 */
+
+		/* model specific munging */
+		if ((cpu_id & 0xFFF) < 0xF27) {
+
+			/*
+			 * On P4 and Xeon with CPUID < (Family 15,
+			 * Model 2, Stepping 7), only one ESCR is
+			 * available for the IOQ_ALLOCATION event.
+			 */
+
+			pe = p4_find_event(PMC_EV_P4_IOQ_ALLOCATION);
+			pe->pm_escrs[1] = P4_ESCR_NONE;
+		}
+
+		break;
+
+	default:
+		KASSERT(0,("[p4,%d] Unknown CPU type", __LINE__));
+		return ENOSYS;
+	}
+
+	return 0;
+}
diff --git a/sys/dev/misc/hwpmc/hwpmc_piv.h b/sys/dev/misc/hwpmc/hwpmc_piv.h
new file mode 100644
index 0000000..767829a
--- /dev/null
+++ b/sys/dev/misc/hwpmc/hwpmc_piv.h
@@ -0,0 +1,124 @@
+/*-
+ * Copyright (c) 2005, Joseph Koshy
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD: src/sys/dev/hwpmc/hwpmc_piv.h,v 1.1 2005/06/09 19:45:07 jkoshy Exp $
+ */
+
+/* Machine dependent interfaces */
+
+#ifndef _DEV_HWPMC_PIV_H_
+#define	_DEV_HWPMC_PIV_H_ 1
+
+/* Intel P4 PMCs */
+
+#define	P4_NPMCS		19	/* 1 TSC + 18 PMCS */
+#define	P4_NESCR		45
+#define	P4_INVALID_PMC_INDEX	-1
+#define	P4_MAX_ESCR_PER_EVENT	2
+#define	P4_MAX_PMC_PER_ESCR	3
+
+#define	P4_CCCR_OVF			(1 << 31)
+#define	P4_CCCR_CASCADE			(1 << 30)
+#define	P4_CCCR_OVF_PMI_T1		(1 << 27)
+#define	P4_CCCR_OVF_PMI_T0		(1 << 26)
+#define	P4_CCCR_FORCE_OVF		(1 << 25)
+#define	P4_CCCR_EDGE			(1 << 24)
+#define	P4_CCCR_THRESHOLD_SHIFT		20
+#define	P4_CCCR_THRESHOLD_MASK		0x00F00000
+#define	P4_CCCR_TO_THRESHOLD(C)		(((C) << P4_CCCR_THRESHOLD_SHIFT) & \
+	P4_CCCR_THRESHOLD_MASK)
+#define	P4_CCCR_COMPLEMENT		(1 << 19)
+#define	P4_CCCR_COMPARE			(1 << 18)
+#define	P4_CCCR_ACTIVE_THREAD_SHIFT	16
+#define	P4_CCCR_ACTIVE_THREAD_MASK	0x00030000
+#define	P4_CCCR_TO_ACTIVE_THREAD(T)	(((T) << P4_CCCR_ACTIVE_THREAD_SHIFT) & \
+	P4_CCCR_ACTIVE_THREAD_MASK)
+#define	P4_CCCR_ESCR_SELECT_SHIFT	13
+#define	P4_CCCR_ESCR_SELECT_MASK	0x0000E000
+#define	P4_CCCR_TO_ESCR_SELECT(E)	(((E) << P4_CCCR_ESCR_SELECT_SHIFT) & \
+	P4_CCCR_ESCR_SELECT_MASK)
+#define	P4_CCCR_ENABLE			(1 << 12)
+#define	P4_CCCR_VALID_BITS		(P4_CCCR_OVF | P4_CCCR_CASCADE | \
+    P4_CCCR_OVF_PMI_T1 | P4_CCCR_OVF_PMI_T0 | P4_CCCR_FORCE_OVF | 	 \
+    P4_CCCR_EDGE | P4_CCCR_THRESHOLD_MASK | P4_CCCR_COMPLEMENT |	 \
+    P4_CCCR_COMPARE | P4_CCCR_ESCR_SELECT_MASK | P4_CCCR_ENABLE)
+
+#define	P4_ESCR_EVENT_SELECT_SHIFT	25
+#define	P4_ESCR_EVENT_SELECT_MASK	0x7E000000
+#define	P4_ESCR_TO_EVENT_SELECT(E)	(((E) << P4_ESCR_EVENT_SELECT_SHIFT) & \
+	P4_ESCR_EVENT_SELECT_MASK)
+#define	P4_ESCR_EVENT_MASK_SHIFT	9
+#define	P4_ESCR_EVENT_MASK_MASK		0x01FFFE00
+#define	P4_ESCR_TO_EVENT_MASK(M)	(((M) << P4_ESCR_EVENT_MASK_SHIFT) & \
+	P4_ESCR_EVENT_MASK_MASK)
+#define	P4_ESCR_TAG_VALUE_SHIFT		5
+#define	P4_ESCR_TAG_VALUE_MASK		0x000001E0
+#define	P4_ESCR_TO_TAG_VALUE(T)		(((T) << P4_ESCR_TAG_VALUE_SHIFT) & \
+	P4_ESCR_TAG_VALUE_MASK)
+#define	P4_ESCR_TAG_ENABLE 		0x00000010
+#define	P4_ESCR_T0_OS			0x00000008
+#define	P4_ESCR_T0_USR			0x00000004
+#define	P4_ESCR_T1_OS			0x00000002
+#define	P4_ESCR_T1_USR			0x00000001
+#define	P4_ESCR_OS			P4_ESCR_T0_OS
+#define	P4_ESCR_USR			P4_ESCR_T0_USR
+#define	P4_ESCR_VALID_BITS		(P4_ESCR_EVENT_SELECT_MASK |	\
+    P4_ESCR_EVENT_MASK_MASK | P4_ESCR_TAG_VALUE_MASK | 			\
+    P4_ESCR_TAG_ENABLE | P4_ESCR_T0_OS | P4_ESCR_T0_USR | P4_ESCR_T1_OS \
+    P4_ESCR_T1_USR)
+
+#define	P4_PERFCTR_MASK			0xFFFFFFFFFFLL /* 40 bits */
+#define	P4_PERFCTR_OVERFLOWED(PMC)	((rdpmc(PMC) & (1LL << 39)) == 0)
+
+#define	P4_CCCR_MSR_FIRST		0x360 /* MSR_BPU_CCCR0 */
+#define	P4_PERFCTR_MSR_FIRST		0x300 /* MSR_BPU_COUNTER0 */
+
+#define	P4_RELOAD_COUNT_TO_PERFCTR_VALUE(V)	(1 - (V))
+#define	P4_PERFCTR_VALUE_TO_RELOAD_COUNT(P)	(1 - (P))
+
+struct pmc_md_p4_op_pmcallocate {
+	uint32_t	pm_p4_cccrconfig;
+	uint32_t	pm_p4_escrconfig;
+};
+
+#ifdef _KERNEL
+
+/* MD extension for 'struct pmc' */
+struct pmc_md_p4_pmc {
+	uint32_t	pm_p4_cccrvalue;
+	uint32_t	pm_p4_escrvalue;
+	uint32_t	pm_p4_escr;
+	uint32_t	pm_p4_escrmsr;
+};
+
+
+/*
+ * Prototypes
+ */
+
+int	pmc_initialize_p4(struct pmc_mdep *);		/* Pentium IV PMCs */
+
+#endif /* _KERNEL */
+#endif /* _MACHINE_PMC_MDEP_H */
diff --git a/sys/dev/misc/hwpmc/hwpmc_powerpc.c b/sys/dev/misc/hwpmc/hwpmc_powerpc.c
new file mode 100644
index 0000000..df403eb
--- /dev/null
+++ b/sys/dev/misc/hwpmc/hwpmc_powerpc.c
@@ -0,0 +1,40 @@
+/*-
+ * Copyright (c) 2005, Joseph Koshy
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD: src/sys/dev/hwpmc/hwpmc_powerpc.c,v 1.1 2005/06/09 19:45:07 jkoshy Exp $");
+
+#include <sys/param.h>
+#include <sys/pmc.h>
+
+#include <machine/pmc_mdep.h>
+
+struct pmc_mdep *
+pmc_md_initialize()
+{
+	return NULL;
+}
diff --git a/sys/dev/misc/hwpmc/hwpmc_ppro.c b/sys/dev/misc/hwpmc/hwpmc_ppro.c
new file mode 100644
index 0000000..038ea9e
--- /dev/null
+++ b/sys/dev/misc/hwpmc/hwpmc_ppro.c
@@ -0,0 +1,863 @@
+/*-
+ * Copyright (c) 2003-2005 Joseph Koshy
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+/*__FBSDID("$FreeBSD: src/sys/dev/hwpmc/hwpmc_ppro.c,v 1.9 2005/07/14 15:09:14 jkoshy Exp $");*/
+
+#include <sys/param.h>
+#include <sys/lock.h>
+#include <sys/pmc.h>
+#include <sys/pmckern.h>
+#include <sys/systm.h>
+
+#include <machine/cpufunc.h>
+#include <machine/md_var.h>
+#include <machine/pmc_mdep.h>
+#include <machine/specialreg.h>
+
+/*
+ * PENTIUM PRO SUPPORT
+ *
+ * Quirks:
+ *
+ * - Both PMCs are enabled by a single bit P6_EVSEL_EN in performance
+ *   counter '0'.  This bit needs to be '1' if any of the two
+ *   performance counters are in use.  Perf counters can also be
+ *   switched off by writing zeros to their EVSEL register.
+ *
+ * - While the width of these counters is 40 bits, we do not appear to
+ *   have a way of writing 40 bits to the counter MSRs.  A WRMSR
+ *   instruction will sign extend bit 31 of the value being written to
+ *   the perf counter -- a value of 0x80000000 written to an perf
+ *   counter register will be sign extended to 0xFF80000000.
+ *
+ *   This quirk primarily affects thread-mode PMCs in counting mode, as
+ *   these PMCs read and write PMC registers at every context switch.
+ */
+
+struct p6pmc_descr {
+	struct pmc_descr pm_descr; /* common information */
+	uint32_t	pm_pmc_msr;
+	uint32_t	pm_evsel_msr;
+};
+
+static struct p6pmc_descr p6_pmcdesc[P6_NPMCS] = {
+
+	/* TSC */
+	{
+		.pm_descr =
+		{
+			.pd_name  = "TSC",
+			.pd_class = PMC_CLASS_TSC,
+			.pd_caps  = PMC_CAP_READ,
+			.pd_width = 64
+		},
+		.pm_pmc_msr   = 0x10,
+		.pm_evsel_msr = ~0
+	},
+
+#define	P6_PMC_CAPS (PMC_CAP_INTERRUPT | PMC_CAP_USER | PMC_CAP_SYSTEM | \
+    PMC_CAP_EDGE | PMC_CAP_THRESHOLD | PMC_CAP_READ | PMC_CAP_WRITE |	 \
+    PMC_CAP_INVERT | PMC_CAP_QUALIFIER)
+
+	/* PMC 0 */
+	{
+		.pm_descr =
+		{
+			.pd_name  ="P6-0",
+			.pd_class = PMC_CLASS_P6,
+			.pd_caps  = P6_PMC_CAPS,
+			.pd_width = 40
+		},
+		.pm_pmc_msr   = P6_MSR_PERFCTR0,
+		.pm_evsel_msr = P6_MSR_EVSEL0
+	},
+
+	/* PMC 1 */
+	{
+		.pm_descr =
+		{
+			.pd_name  ="P6-1",
+			.pd_class = PMC_CLASS_P6,
+			.pd_caps  = P6_PMC_CAPS,
+			.pd_width = 40
+		},
+		.pm_pmc_msr   = P6_MSR_PERFCTR1,
+		.pm_evsel_msr = P6_MSR_EVSEL1
+	}
+};
+
+static enum pmc_cputype p6_cputype;
+
+/*
+ * P6 Event descriptor
+ */
+
+struct p6_event_descr {
+	const enum pmc_event pm_event;
+	uint32_t	     pm_evsel;
+	uint32_t	     pm_flags;
+	uint32_t	     pm_unitmask;
+};
+
+static const struct p6_event_descr p6_events[] = {
+
+#define	P6_EVDESCR(NAME, EVSEL, FLAGS, UMASK)	\
+	{					\
+		.pm_event = PMC_EV_P6_##NAME,	\
+		.pm_evsel = (EVSEL),		\
+		.pm_flags = (FLAGS),		\
+		.pm_unitmask = (UMASK)		\
+	}
+
+#define	P6F_P6		(1 << PMC_CPU_INTEL_P6)
+#define	P6F_CL		(1 << PMC_CPU_INTEL_CL)
+#define	P6F_PII		(1 << PMC_CPU_INTEL_PII)
+#define	P6F_PIII	(1 << PMC_CPU_INTEL_PIII)
+#define	P6F_PM		(1 << PMC_CPU_INTEL_PM)
+#define	P6F_CTR0	0x0001
+#define	P6F_CTR1	0x0002
+#define	P6F_ALL_CPUS	(P6F_P6 | P6F_PII | P6F_CL | P6F_PIII | P6F_PM)
+#define	P6F_ALL_CTRS	(P6F_CTR0 | P6F_CTR1)
+#define	P6F_ALL		(P6F_ALL_CPUS | P6F_ALL_CTRS)
+
+#define	P6_EVENT_VALID_FOR_CPU(P,CPU)	((P)->pm_flags & (1 << (CPU)))
+#define	P6_EVENT_VALID_FOR_CTR(P,CTR)	((P)->pm_flags & (1 << (CTR)))
+
+P6_EVDESCR(DATA_MEM_REFS,		0x43, P6F_ALL, 0x00),
+P6_EVDESCR(DCU_LINES_IN,		0x45, P6F_ALL, 0x00),
+P6_EVDESCR(DCU_M_LINES_IN,		0x46, P6F_ALL, 0x00),
+P6_EVDESCR(DCU_M_LINES_OUT,		0x47, P6F_ALL, 0x00),
+P6_EVDESCR(DCU_MISS_OUTSTANDING,	0x47, P6F_ALL, 0x00),
+P6_EVDESCR(IFU_FETCH,			0x80, P6F_ALL, 0x00),
+P6_EVDESCR(IFU_FETCH_MISS,		0x81, P6F_ALL, 0x00),
+P6_EVDESCR(ITLB_MISS,			0x85, P6F_ALL, 0x00),
+P6_EVDESCR(IFU_MEM_STALL,		0x86, P6F_ALL, 0x00),
+P6_EVDESCR(ILD_STALL,			0x87, P6F_ALL, 0x00),
+P6_EVDESCR(L2_IFETCH,			0x28, P6F_ALL, 0x0F),
+P6_EVDESCR(L2_LD,			0x29, P6F_ALL, 0x0F),
+P6_EVDESCR(L2_ST,			0x2A, P6F_ALL, 0x0F),
+P6_EVDESCR(L2_LINES_IN,			0x24, P6F_ALL, 0x0F),
+P6_EVDESCR(L2_LINES_OUT,		0x26, P6F_ALL, 0x0F),
+P6_EVDESCR(L2_M_LINES_INM,		0x25, P6F_ALL, 0x00),
+P6_EVDESCR(L2_M_LINES_OUTM,		0x27, P6F_ALL, 0x0F),
+P6_EVDESCR(L2_RQSTS,			0x2E, P6F_ALL, 0x0F),
+P6_EVDESCR(L2_ADS,			0x21, P6F_ALL, 0x00),
+P6_EVDESCR(L2_DBUS_BUSY,		0x22, P6F_ALL, 0x00),
+P6_EVDESCR(L2_DBUS_BUSY_RD,		0x23, P6F_ALL, 0x00),
+P6_EVDESCR(BUS_DRDY_CLOCKS,		0x62, P6F_ALL, 0x20),
+P6_EVDESCR(BUS_LOCK_CLOCKS,		0x63, P6F_ALL, 0x20),
+P6_EVDESCR(BUS_REQ_OUTSTANDING,		0x60, P6F_ALL, 0x00),
+P6_EVDESCR(BUS_TRAN_BRD,		0x65, P6F_ALL, 0x20),
+P6_EVDESCR(BUS_TRAN_RFO,		0x66, P6F_ALL, 0x20),
+P6_EVDESCR(BUS_TRANS_WB,		0x67, P6F_ALL, 0x20),
+P6_EVDESCR(BUS_TRAN_IFETCH,		0x68, P6F_ALL, 0x20),
+P6_EVDESCR(BUS_TRAN_INVAL,		0x69, P6F_ALL, 0x20),
+P6_EVDESCR(BUS_TRAN_PWR,		0x6A, P6F_ALL, 0x20),
+P6_EVDESCR(BUS_TRANS_P,			0x6B, P6F_ALL, 0x20),
+P6_EVDESCR(BUS_TRANS_IO,		0x6C, P6F_ALL, 0x20),
+P6_EVDESCR(BUS_TRAN_DEF,		0x6D, P6F_ALL, 0x20),
+P6_EVDESCR(BUS_TRAN_BURST,		0x6E, P6F_ALL, 0x20),
+P6_EVDESCR(BUS_TRAN_ANY,		0x70, P6F_ALL, 0x20),
+P6_EVDESCR(BUS_TRAN_MEM,		0x6F, P6F_ALL, 0x20),
+P6_EVDESCR(BUS_DATA_RCV,		0x64, P6F_ALL, 0x00),
+P6_EVDESCR(BUS_BNR_DRV,			0x61, P6F_ALL, 0x00),
+P6_EVDESCR(BUS_HIT_DRV,			0x7A, P6F_ALL, 0x00),
+P6_EVDESCR(BUS_HITM_DRV,		0x7B, P6F_ALL, 0x00),
+P6_EVDESCR(BUS_SNOOP_STALL,		0x7E, P6F_ALL, 0x00),
+P6_EVDESCR(FLOPS,			0xC1, P6F_ALL_CPUS | P6F_CTR0, 0x00),
+P6_EVDESCR(FP_COMPS_OPS_EXE,		0x10, P6F_ALL_CPUS | P6F_CTR0, 0x00),
+P6_EVDESCR(FP_ASSIST,			0x11, P6F_ALL_CPUS | P6F_CTR1, 0x00),
+P6_EVDESCR(MUL,				0x12, P6F_ALL_CPUS | P6F_CTR1, 0x00),
+P6_EVDESCR(DIV,				0x13, P6F_ALL_CPUS | P6F_CTR1, 0x00),
+P6_EVDESCR(CYCLES_DIV_BUSY,		0x14, P6F_ALL_CPUS | P6F_CTR0, 0x00),
+P6_EVDESCR(LD_BLOCKS,			0x03, P6F_ALL, 0x00),
+P6_EVDESCR(SB_DRAINS,			0x04, P6F_ALL, 0x00),
+P6_EVDESCR(MISALIGN_MEM_REF,		0x05, P6F_ALL, 0x00),
+P6_EVDESCR(EMON_KNI_PREF_DISPATCHED,	0x07, P6F_PIII | P6F_ALL_CTRS, 0x03),
+P6_EVDESCR(EMON_KNI_PREF_MISS,		0x4B, P6F_PIII | P6F_ALL_CTRS, 0x03),
+P6_EVDESCR(INST_RETIRED,		0xC0, P6F_ALL, 0x00),
+P6_EVDESCR(UOPS_RETIRED,		0xC2, P6F_ALL, 0x00),
+P6_EVDESCR(INST_DECODED,		0xD0, P6F_ALL, 0x00),
+P6_EVDESCR(EMON_KNI_INST_RETIRED,	0xD8, P6F_PIII | P6F_ALL_CTRS, 0x01),
+P6_EVDESCR(EMON_KNI_COMP_INST_RET,	0xD9, P6F_PIII | P6F_ALL_CTRS, 0x01),
+P6_EVDESCR(HW_INT_RX,			0xC8, P6F_ALL, 0x00),
+P6_EVDESCR(CYCLES_INT_MASKED,		0xC6, P6F_ALL, 0x00),
+P6_EVDESCR(CYCLES_INT_PENDING_AND_MASKED, 0xC7, P6F_ALL, 0x00),
+P6_EVDESCR(BR_INST_RETIRED,		0xC4, P6F_ALL, 0x00),
+P6_EVDESCR(BR_MISS_PRED_RETIRED,	0xC5, P6F_ALL, 0x00),
+P6_EVDESCR(BR_TAKEN_RETIRED,		0xC9, P6F_ALL, 0x00),
+P6_EVDESCR(BR_MISS_PRED_TAKEN_RET, 	0xCA, P6F_ALL, 0x00),
+P6_EVDESCR(BR_INST_DECODED,		0xE0, P6F_ALL, 0x00),
+P6_EVDESCR(BTB_MISSES,			0xE2, P6F_ALL, 0x00),
+P6_EVDESCR(BR_BOGUS,			0xE4, P6F_ALL, 0x00),
+P6_EVDESCR(BACLEARS,			0xE6, P6F_ALL, 0x00),
+P6_EVDESCR(RESOURCE_STALLS,		0xA2, P6F_ALL, 0x00),
+P6_EVDESCR(PARTIAL_RAT_STALLS,		0xD2, P6F_ALL, 0x00),
+P6_EVDESCR(SEGMENT_REG_LOADS,		0x06, P6F_ALL, 0x00),
+P6_EVDESCR(CPU_CLK_UNHALTED,		0x79, P6F_ALL, 0x00),
+P6_EVDESCR(MMX_INSTR_EXEC,		0xB0,
+			P6F_ALL_CTRS | P6F_CL | P6F_PII, 0x00),
+P6_EVDESCR(MMX_SAT_INSTR_EXEC,		0xB1,
+			P6F_ALL_CTRS | P6F_PII | P6F_PIII, 0x00),
+P6_EVDESCR(MMX_UOPS_EXEC,		0xB2,
+			P6F_ALL_CTRS | P6F_PII | P6F_PIII, 0x0F),
+P6_EVDESCR(MMX_INSTR_TYPE_EXEC,		0xB3,
+			P6F_ALL_CTRS | P6F_PII | P6F_PIII, 0x3F),
+P6_EVDESCR(FP_MMX_TRANS,		0xCC,
+			P6F_ALL_CTRS | P6F_PII | P6F_PIII, 0x01),
+P6_EVDESCR(MMX_ASSIST,			0xCD,
+			P6F_ALL_CTRS | P6F_PII | P6F_PIII, 0x00),
+P6_EVDESCR(MMX_INSTR_RET,		0xCE, P6F_ALL_CTRS | P6F_PII, 0x00),
+P6_EVDESCR(SEG_RENAME_STALLS,		0xD4,
+			P6F_ALL_CTRS | P6F_PII | P6F_PIII, 0x0F),
+P6_EVDESCR(SEG_REG_RENAMES,		0xD5,
+			P6F_ALL_CTRS | P6F_PII | P6F_PIII, 0x0F),
+P6_EVDESCR(RET_SEG_RENAMES,		0xD6,
+			P6F_ALL_CTRS | P6F_PII | P6F_PIII, 0x00),
+P6_EVDESCR(EMON_EST_TRANS,		0x58, P6F_ALL_CTRS | P6F_PM, 0x02),
+P6_EVDESCR(EMON_THERMAL_TRIP,		0x59, P6F_ALL_CTRS | P6F_PM, 0x00),
+P6_EVDESCR(BR_INST_EXEC,		0x88, P6F_ALL_CTRS | P6F_PM, 0x00),
+P6_EVDESCR(BR_MISSP_EXEC,		0x89, P6F_ALL_CTRS | P6F_PM, 0x00),
+P6_EVDESCR(BR_BAC_MISSP_EXEC,		0x8A, P6F_ALL_CTRS | P6F_PM, 0x00),
+P6_EVDESCR(BR_CND_EXEC,			0x8B, P6F_ALL_CTRS | P6F_PM, 0x00),
+P6_EVDESCR(BR_CND_MISSP_EXEC,		0x8C, P6F_ALL_CTRS | P6F_PM, 0x00),
+P6_EVDESCR(BR_IND_EXEC,			0x8D, P6F_ALL_CTRS | P6F_PM, 0x00),
+P6_EVDESCR(BR_IND_MISSP_EXEC,		0x8E, P6F_ALL_CTRS | P6F_PM, 0x00),
+P6_EVDESCR(BR_RET_EXEC,			0x8F, P6F_ALL_CTRS | P6F_PM, 0x00),
+P6_EVDESCR(BR_RET_MISSP_EXEC,		0x90, P6F_ALL_CTRS | P6F_PM, 0x00),
+P6_EVDESCR(BR_RET_BAC_MISSP_EXEC,	0x91, P6F_ALL_CTRS | P6F_PM, 0x00),
+P6_EVDESCR(BR_CALL_EXEC,		0x92, P6F_ALL_CTRS | P6F_PM, 0x00),
+P6_EVDESCR(BR_CALL_MISSP_EXEC,		0x93, P6F_ALL_CTRS | P6F_PM, 0x00),
+P6_EVDESCR(BR_IND_CALL_EXEC,		0x94, P6F_ALL_CTRS | P6F_PM, 0x00),
+P6_EVDESCR(EMON_SIMD_INSTR_RETIRED,	0xCE, P6F_ALL_CTRS | P6F_PM, 0x00),
+P6_EVDESCR(EMON_SYNCH_UOPS,		0xD3, P6F_ALL_CTRS | P6F_PM, 0x00),
+P6_EVDESCR(EMON_ESP_UOPS,		0xD7, P6F_ALL_CTRS | P6F_PM, 0x00),
+P6_EVDESCR(EMON_FUSED_UOPS_RET,		0xDA, P6F_ALL_CTRS | P6F_PM, 0x03),
+P6_EVDESCR(EMON_UNFUSION,		0xDB, P6F_ALL_CTRS | P6F_PM, 0x00),
+P6_EVDESCR(EMON_PREF_RQSTS_UP,		0xF0, P6F_ALL_CTRS | P6F_PM, 0x00),
+P6_EVDESCR(EMON_PREF_RQSTS_DN,		0xD8, P6F_ALL_CTRS | P6F_PM, 0x00),
+P6_EVDESCR(EMON_SSE_SSE2_INST_RETIRED,	0xD8, P6F_ALL_CTRS | P6F_PM, 0x03),
+P6_EVDESCR(EMON_SSE_SSE2_COMP_INST_RETIRED, 0xD9, P6F_ALL_CTRS | P6F_PM, 0x03)
+
+#undef	P6_EVDESCR
+};
+
+#define	P6_NEVENTS	(PMC_EV_P6_LAST - PMC_EV_P6_FIRST + 1)
+
+static const struct p6_event_descr *
+p6_find_event(enum pmc_event ev)
+{
+	int n;
+
+	for (n = 0; n < P6_NEVENTS; n++)
+		if (p6_events[n].pm_event == ev)
+			break;
+	if (n == P6_NEVENTS)
+		return NULL;
+	return &p6_events[n];
+}
+
+/*
+ * Per-CPU data structure for P6 class CPUs
+ *
+ * [common stuff]
+ * [flags for maintaining PMC start/stop state]
+ * [3 struct pmc_hw pointers]
+ * [3 struct pmc_hw structures]
+ */
+
+struct p6_cpu {
+	struct pmc_cpu	pc_common;
+	struct pmc_hw	*pc_hwpmcs[P6_NPMCS];
+	struct pmc_hw	pc_p6pmcs[P6_NPMCS];
+	uint32_t	pc_state;
+};
+
+/*
+ * If CTR1 is active, we need to keep the 'EN' bit if CTR0 set,
+ * with the rest of CTR0 being zero'ed out.
+ */
+#define	P6_SYNC_CTR_STATE(PC) do {				\
+		uint32_t _config, _enable;			\
+		_enable = 0;					\
+		if ((PC)->pc_state & 0x02)			\
+			_enable |= P6_EVSEL_EN;			\
+		if ((PC)->pc_state & 0x01)			\
+			_config = rdmsr(P6_MSR_EVSEL0) | 	\
+			    P6_EVSEL_EN;			\
+		else						\
+			_config = 0;				\
+		wrmsr(P6_MSR_EVSEL0, _config | _enable);	\
+	} while (0)
+
+#define	P6_MARK_STARTED(PC,RI) do {				\
+		(PC)->pc_state |= (1 << ((RI)-1));		\
+	} while (0)
+
+#define	P6_MARK_STOPPED(PC,RI) do {				\
+		(PC)->pc_state &= ~(1<< ((RI)-1));		\
+	} while (0)
+
+static int
+p6_init(int cpu)
+{
+	int n;
+	struct p6_cpu *pcs;
+	struct pmc_hw *phw;
+
+	KASSERT(cpu >= 0 && cpu < ncpus,
+	    ("[p6,%d] bad cpu %d", __LINE__, cpu));
+
+	PMCDBG(MDP,INI,0,"p6-init cpu=%d", cpu);
+
+	MALLOC(pcs, struct p6_cpu *, sizeof(struct p6_cpu), M_PMC,
+	    M_WAITOK|M_ZERO);
+
+	phw = pcs->pc_p6pmcs;
+
+	for (n = 0; n < P6_NPMCS; n++, phw++) {
+		phw->phw_state   = PMC_PHW_FLAG_IS_ENABLED |
+		    PMC_PHW_CPU_TO_STATE(cpu) | PMC_PHW_INDEX_TO_STATE(n);
+		phw->phw_pmc     = NULL;
+		pcs->pc_hwpmcs[n] = phw;
+	}
+
+	/* Mark the TSC as shareable */
+	pcs->pc_hwpmcs[0]->phw_state |= PMC_PHW_FLAG_IS_SHAREABLE;
+
+	pmc_pcpu[cpu] = (struct pmc_cpu *) pcs;
+
+	return 0;
+}
+
+static int
+p6_cleanup(int cpu)
+{
+	struct pmc_cpu *pcs;
+
+	KASSERT(cpu >= 0 && cpu < ncpus,
+	    ("[p6,%d] bad cpu %d", __LINE__, cpu));
+
+	PMCDBG(MDP,INI,0,"p6-cleanup cpu=%d", cpu);
+
+	if ((pcs = pmc_pcpu[cpu]) != NULL)
+		FREE(pcs, M_PMC);
+	pmc_pcpu[cpu] = NULL;
+
+	return 0;
+}
+
+static int
+p6_switch_in(struct pmc_cpu *pc, struct pmc_process *pp)
+{
+	(void) pc;
+
+	PMCDBG(MDP,SWI,1, "pc=%p pp=%p enable-msr=%d", pc, pp,
+	    pp->pp_flags & PMC_PP_ENABLE_MSR_ACCESS);
+
+	/* allow the RDPMC instruction if needed */
+	if (pp->pp_flags & PMC_PP_ENABLE_MSR_ACCESS)
+		load_cr4(rcr4() | CR4_PCE);
+
+	PMCDBG(MDP,SWI,1, "cr4=0x%x", rcr4());
+
+	return 0;
+}
+
+static int
+p6_switch_out(struct pmc_cpu *pc, struct pmc_process *pp)
+{
+	(void) pc;
+	(void) pp;		/* can be NULL */
+
+	PMCDBG(MDP,SWO,1, "pc=%p pp=%p cr4=0x%x", pc, pp, rcr4());
+
+	/* always turn off the RDPMC instruction */
+ 	load_cr4(rcr4() & ~CR4_PCE);
+
+	return 0;
+}
+
+static int
+p6_read_pmc(int cpu, int ri, pmc_value_t *v)
+{
+	struct pmc_hw *phw;
+	struct pmc *pm;
+	struct p6pmc_descr *pd;
+	pmc_value_t tmp;
+
+	phw = pmc_pcpu[cpu]->pc_hwpmcs[ri];
+	pm  = phw->phw_pmc;
+	pd  = &p6_pmcdesc[ri];
+
+	KASSERT(pm,
+	    ("[p6,%d] cpu %d ri %d pmc not configured", __LINE__, cpu, ri));
+
+	if (pd->pm_descr.pd_class == PMC_CLASS_TSC) {
+		*v = rdtsc();
+		return 0;
+	}
+
+	tmp = rdmsr(pd->pm_pmc_msr) & P6_PERFCTR_READ_MASK;
+	if (PMC_IS_SAMPLING_MODE(PMC_TO_MODE(pm)))
+		*v = P6_PERFCTR_VALUE_TO_RELOAD_COUNT(tmp);
+	else
+		*v = tmp;
+
+	PMCDBG(MDP,REA,1, "p6-read cpu=%d ri=%d msr=0x%x -> v=%jx", cpu, ri,
+	    pd->pm_pmc_msr, *v);
+
+	return 0;
+}
+
+static int
+p6_write_pmc(int cpu, int ri, pmc_value_t v)
+{
+	struct pmc_hw *phw;
+	struct pmc *pm;
+	struct p6pmc_descr *pd;
+
+	phw = pmc_pcpu[cpu]->pc_hwpmcs[ri];
+	pm  = phw->phw_pmc;
+	pd  = &p6_pmcdesc[ri];
+
+	KASSERT(pm,
+	    ("[p6,%d] cpu %d ri %d pmc not configured", __LINE__, cpu, ri));
+
+	if (pd->pm_descr.pd_class == PMC_CLASS_TSC)
+		return 0;
+
+	PMCDBG(MDP,WRI,1, "p6-write cpu=%d ri=%d msr=0x%x v=%jx", cpu, ri,
+	    pd->pm_pmc_msr, v);
+
+	if (PMC_IS_SAMPLING_MODE(PMC_TO_MODE(pm)))
+		v = P6_RELOAD_COUNT_TO_PERFCTR_VALUE(v);
+
+	wrmsr(pd->pm_pmc_msr, v & P6_PERFCTR_WRITE_MASK);
+
+	return 0;
+}
+
+static int
+p6_config_pmc(int cpu, int ri, struct pmc *pm)
+{
+	struct pmc_hw *phw;
+
+	PMCDBG(MDP,CFG,1, "p6-config cpu=%d ri=%d pm=%p", cpu, ri, pm);
+
+	phw = pmc_pcpu[cpu]->pc_hwpmcs[ri];
+	phw->phw_pmc = pm;
+
+	return 0;
+}
+
+/*
+ * Retrieve a configured PMC pointer from hardware state.
+ */
+
+static int
+p6_get_config(int cpu, int ri, struct pmc **ppm)
+{
+	*ppm = pmc_pcpu[cpu]->pc_hwpmcs[ri]->phw_pmc;
+
+	return 0;
+}
+
+
+/*
+ * A pmc may be allocated to a given row index if:
+ * - the event is valid for this CPU
+ * - the event is valid for this counter index
+ */
+
+static int
+p6_allocate_pmc(int cpu, int ri, struct pmc *pm,
+    const struct pmc_op_pmcallocate *a)
+{
+	uint32_t allowed_unitmask, caps, config, unitmask;
+	const struct p6pmc_descr *pd;
+	const struct p6_event_descr *pevent;
+	enum pmc_event ev;
+
+	(void) cpu;
+
+	KASSERT(cpu >= 0 && cpu < ncpus,
+	    ("[p4,%d] illegal CPU %d", __LINE__, cpu));
+	KASSERT(ri >= 0 && ri < P6_NPMCS,
+	    ("[p4,%d] illegal row-index value %d", __LINE__, ri));
+
+	pd = &p6_pmcdesc[ri];
+
+	PMCDBG(MDP,ALL,1, "p6-allocate ri=%d class=%d pmccaps=0x%x "
+	    "reqcaps=0x%x", ri, pd->pm_descr.pd_class, pd->pm_descr.pd_caps,
+	    pm->pm_caps);
+
+	/* check class */
+	if (pd->pm_descr.pd_class != a->pm_class)
+		return EINVAL;
+
+	/* check requested capabilities */
+	caps = a->pm_caps;
+	if ((pd->pm_descr.pd_caps & caps) != caps)
+		return EPERM;
+
+	if (pd->pm_descr.pd_class == PMC_CLASS_TSC) {
+		/* TSC's are always allocated in system-wide counting mode */
+		if (a->pm_ev != PMC_EV_TSC_TSC ||
+		    a->pm_mode != PMC_MODE_SC)
+			return EINVAL;
+		return 0;
+	}
+
+	/*
+	 * P6 class events
+	 */
+
+	ev = pm->pm_event;
+
+	if (ev < PMC_EV_P6_FIRST || ev > PMC_EV_P6_LAST)
+		return EINVAL;
+
+	if ((pevent = p6_find_event(ev)) == NULL)
+		return ESRCH;
+
+	if (!P6_EVENT_VALID_FOR_CPU(pevent, p6_cputype) ||
+	    !P6_EVENT_VALID_FOR_CTR(pevent, (ri-1)))
+		return EINVAL;
+
+	/* For certain events, Pentium M differs from the stock P6 */
+	allowed_unitmask = 0;
+	if (p6_cputype == PMC_CPU_INTEL_PM) {
+		if (ev == PMC_EV_P6_L2_LD || ev == PMC_EV_P6_L2_LINES_IN ||
+		    ev == PMC_EV_P6_L2_LINES_OUT)
+			allowed_unitmask = P6_EVSEL_TO_UMASK(0x3F);
+		else if (ev == PMC_EV_P6_L2_M_LINES_OUTM)
+			allowed_unitmask = P6_EVSEL_TO_UMASK(0x30);
+	} else
+		allowed_unitmask = P6_EVSEL_TO_UMASK(pevent->pm_unitmask);
+
+	unitmask = a->pm_md.pm_ppro.pm_ppro_config & P6_EVSEL_UMASK_MASK;
+	if (unitmask & ~allowed_unitmask) /* disallow reserved bits */
+		return EINVAL;
+
+	if (ev == PMC_EV_P6_MMX_UOPS_EXEC) /* hardcoded mask */
+		unitmask = P6_EVSEL_TO_UMASK(0x0F);
+
+	config = 0;
+
+	config |= P6_EVSEL_EVENT_SELECT(pevent->pm_evsel);
+
+	if (unitmask & (caps & PMC_CAP_QUALIFIER))
+		config |= unitmask;
+
+	if (caps & PMC_CAP_THRESHOLD)
+		config |= a->pm_md.pm_ppro.pm_ppro_config &
+		    P6_EVSEL_CMASK_MASK;
+
+	/* set at least one of the 'usr' or 'os' caps */
+	if (caps & PMC_CAP_USER)
+		config |= P6_EVSEL_USR;
+	if (caps & PMC_CAP_SYSTEM)
+		config |= P6_EVSEL_OS;
+	if ((caps & (PMC_CAP_USER|PMC_CAP_SYSTEM)) == 0)
+		config |= (P6_EVSEL_USR|P6_EVSEL_OS);
+
+	if (caps & PMC_CAP_EDGE)
+		config |= P6_EVSEL_E;
+	if (caps & PMC_CAP_INVERT)
+		config |= P6_EVSEL_INV;
+	if (caps & PMC_CAP_INTERRUPT)
+		config |= P6_EVSEL_INT;
+
+	pm->pm_md.pm_ppro.pm_ppro_evsel = config;
+
+	PMCDBG(MDP,ALL,2, "p6-allocate config=0x%x", config);
+
+	return 0;
+}
+
+static int
+p6_release_pmc(int cpu, int ri, struct pmc *pm)
+{
+	struct pmc_hw *phw;
+
+	(void) pm;
+
+	PMCDBG(MDP,REL,1, "p6-release cpu=%d ri=%d pm=%p", cpu, ri, pm);
+
+	KASSERT(cpu >= 0 && cpu < ncpus,
+	    ("[p6,%d] illegal CPU value %d", __LINE__, cpu));
+	KASSERT(ri >= 0 && ri < P6_NPMCS,
+	    ("[p6,%d] illegal row-index %d", __LINE__, ri));
+
+	phw = pmc_pcpu[cpu]->pc_hwpmcs[ri];
+
+	KASSERT(phw->phw_pmc == NULL,
+	    ("[p6,%d] PHW pmc %p != pmc %p", __LINE__, phw->phw_pmc, pm));
+
+	return 0;
+}
+
+static int
+p6_start_pmc(int cpu, int ri)
+{
+	uint32_t config;
+	struct pmc *pm;
+	struct p6_cpu *pc;
+	struct pmc_hw *phw;
+	const struct p6pmc_descr *pd;
+
+	KASSERT(cpu >= 0 && cpu < ncpus,
+	    ("[p6,%d] illegal CPU value %d", __LINE__, cpu));
+	KASSERT(ri >= 0 && ri < P6_NPMCS,
+	    ("[p6,%d] illegal row-index %d", __LINE__, ri));
+
+	pc  = (struct p6_cpu *) pmc_pcpu[cpu];
+	phw = pc->pc_common.pc_hwpmcs[ri];
+	pm  = phw->phw_pmc;
+	pd  = &p6_pmcdesc[ri];
+
+	KASSERT(pm,
+	    ("[p6,%d] starting cpu%d,ri%d with no pmc configured",
+		__LINE__, cpu, ri));
+
+	PMCDBG(MDP,STA,1, "p6-start cpu=%d ri=%d", cpu, ri);
+
+	if (pd->pm_descr.pd_class == PMC_CLASS_TSC)
+		return 0;	/* TSC are always running */
+
+	KASSERT(pd->pm_descr.pd_class == PMC_CLASS_P6,
+	    ("[p6,%d] unknown PMC class %d", __LINE__,
+		pd->pm_descr.pd_class));
+
+	config = pm->pm_md.pm_ppro.pm_ppro_evsel;
+
+	PMCDBG(MDP,STA,2, "p6-start/2 cpu=%d ri=%d evselmsr=0x%x config=0x%x",
+	    cpu, ri, pd->pm_evsel_msr, config);
+
+	P6_MARK_STARTED(pc, ri);
+	wrmsr(pd->pm_evsel_msr, config);
+
+	P6_SYNC_CTR_STATE(pc);
+
+	return 0;
+}
+
+static int
+p6_stop_pmc(int cpu, int ri)
+{
+	struct pmc *pm;
+	struct p6_cpu *pc;
+	struct pmc_hw *phw;
+	struct p6pmc_descr *pd;
+
+	KASSERT(cpu >= 0 && cpu < ncpus,
+	    ("[p6,%d] illegal cpu value %d", __LINE__, cpu));
+	KASSERT(ri >= 0 && ri < P6_NPMCS,
+	    ("[p6,%d] illegal row index %d", __LINE__, ri));
+
+	pc  = (struct p6_cpu *) pmc_pcpu[cpu];
+	phw = pc->pc_common.pc_hwpmcs[ri];
+	pm  = phw->phw_pmc;
+	pd  = &p6_pmcdesc[ri];
+
+	KASSERT(pm,
+	    ("[p6,%d] cpu%d ri%d no configured PMC to stop", __LINE__,
+		cpu, ri));
+
+	if (pd->pm_descr.pd_class == PMC_CLASS_TSC)
+		return 0;
+
+	KASSERT(pd->pm_descr.pd_class == PMC_CLASS_P6,
+	    ("[p6,%d] unknown PMC class %d", __LINE__,
+		pd->pm_descr.pd_class));
+
+	PMCDBG(MDP,STO,1, "p6-stop cpu=%d ri=%d", cpu, ri);
+
+	wrmsr(pd->pm_evsel_msr, 0);	/* stop hw */
+	P6_MARK_STOPPED(pc, ri);	/* update software state */
+
+	P6_SYNC_CTR_STATE(pc);		/* restart CTR1 if need be */
+
+	PMCDBG(MDP,STO,2, "p6-stop/2 cpu=%d ri=%d", cpu, ri);
+	return 0;
+}
+
+static int
+p6_intr(int cpu, uintptr_t eip, int usermode)
+{
+	int i, error, retval, ri;
+	uint32_t perf0cfg;
+	struct pmc *pm;
+	struct p6_cpu *pc;
+	struct pmc_hw *phw;
+	pmc_value_t v;
+
+	KASSERT(cpu >= 0 && cpu < ncpus,
+	    ("[p6,%d] CPU %d out of range", __LINE__, cpu));
+
+	retval = 0;
+	pc = (struct p6_cpu *) pmc_pcpu[cpu];
+
+	/* stop both PMCs */
+	perf0cfg = rdmsr(P6_MSR_EVSEL0);
+	wrmsr(P6_MSR_EVSEL0, perf0cfg & ~P6_EVSEL_EN);
+
+	for (i = 0; i < P6_NPMCS-1; i++) {
+		ri = i + 1;
+
+		if (!P6_PMC_HAS_OVERFLOWED(i))
+			continue;
+
+		phw = pc->pc_common.pc_hwpmcs[ri];
+
+		if ((pm = phw->phw_pmc) == NULL ||
+		    pm->pm_state != PMC_STATE_RUNNING ||
+		    !PMC_IS_SAMPLING_MODE(PMC_TO_MODE(pm))) {
+			continue;
+		}
+
+		retval = 1;
+
+		error = pmc_process_interrupt(cpu, pm, eip, usermode);
+		if (error)
+			P6_MARK_STOPPED(pc,ri);
+
+		/* reload sampling count */
+		v = pm->pm_sc.pm_reloadcount;
+		wrmsr(P6_MSR_PERFCTR0 + i,
+		    P6_RELOAD_COUNT_TO_PERFCTR_VALUE(v));
+
+	}
+
+	/*
+	 * On P6 processors, the LAPIC needs to have its PMC interrupt
+	 * unmasked after a PMC interrupt.
+	 */
+	if (retval)
+		pmc_x86_lapic_enable_pmc_interrupt();
+
+	atomic_add_int(retval ? &pmc_stats.pm_intr_processed :
+	    &pmc_stats.pm_intr_ignored, 1);
+
+	/* restart counters that can be restarted */
+	P6_SYNC_CTR_STATE(pc);
+
+	return retval;
+}
+
+static int
+p6_describe(int cpu, int ri, struct pmc_info *pi,
+    struct pmc **ppmc)
+{
+	int error;
+	size_t copied;
+	struct pmc_hw *phw;
+	struct p6pmc_descr *pd;
+
+	phw = pmc_pcpu[cpu]->pc_hwpmcs[ri];
+	pd  = &p6_pmcdesc[ri];
+
+	if ((error = copystr(pd->pm_descr.pd_name, pi->pm_name,
+		 PMC_NAME_MAX, &copied)) != 0)
+		return error;
+
+	pi->pm_class = pd->pm_descr.pd_class;
+
+	if (phw->phw_state & PMC_PHW_FLAG_IS_ENABLED) {
+		pi->pm_enabled = TRUE;
+		*ppmc          = phw->phw_pmc;
+	} else {
+		pi->pm_enabled = FALSE;
+		*ppmc          = NULL;
+	}
+
+	return 0;
+}
+
+static int
+p6_get_msr(int ri, uint32_t *msr)
+{
+	KASSERT(ri >= 0 && ri < P6_NPMCS,
+	    ("[p6,%d ri %d out of range", __LINE__, ri));
+
+	*msr = p6_pmcdesc[ri].pm_pmc_msr - P6_MSR_PERFCTR0;
+	return 0;
+}
+
+int
+pmc_initialize_p6(struct pmc_mdep *pmc_mdep)
+{
+	KASSERT(strcmp(cpu_vendor, "GenuineIntel") == 0,
+	    ("[p6,%d] Initializing non-intel processor", __LINE__));
+
+	PMCDBG(MDP,INI,1, "%s", "p6-initialize");
+
+	switch (pmc_mdep->pmd_cputype) {
+
+		/*
+		 * P6 Family Processors
+		 */
+
+	case PMC_CPU_INTEL_P6:
+	case PMC_CPU_INTEL_CL:
+	case PMC_CPU_INTEL_PII:
+	case PMC_CPU_INTEL_PIII:
+	case PMC_CPU_INTEL_PM:
+
+		p6_cputype = pmc_mdep->pmd_cputype;
+
+		pmc_mdep->pmd_npmc          = P6_NPMCS;
+		pmc_mdep->pmd_classes[1].pm_class = PMC_CLASS_P6;
+		pmc_mdep->pmd_classes[1].pm_caps  = P6_PMC_CAPS;
+		pmc_mdep->pmd_classes[1].pm_width = 40;
+		pmc_mdep->pmd_nclasspmcs[1] = 2;
+
+		pmc_mdep->pmd_init    	    = p6_init;
+		pmc_mdep->pmd_cleanup 	    = p6_cleanup;
+		pmc_mdep->pmd_switch_in     = p6_switch_in;
+		pmc_mdep->pmd_switch_out    = p6_switch_out;
+		pmc_mdep->pmd_read_pmc 	    = p6_read_pmc;
+		pmc_mdep->pmd_write_pmc     = p6_write_pmc;
+		pmc_mdep->pmd_config_pmc    = p6_config_pmc;
+		pmc_mdep->pmd_get_config    = p6_get_config;
+		pmc_mdep->pmd_allocate_pmc  = p6_allocate_pmc;
+		pmc_mdep->pmd_release_pmc   = p6_release_pmc;
+		pmc_mdep->pmd_start_pmc     = p6_start_pmc;
+		pmc_mdep->pmd_stop_pmc      = p6_stop_pmc;
+		pmc_mdep->pmd_intr	    = p6_intr;
+		pmc_mdep->pmd_describe      = p6_describe;
+		pmc_mdep->pmd_get_msr  	    = p6_get_msr; /* i386 */
+
+		break;
+	default:
+		KASSERT(0,("[p6,%d] Unknown CPU type", __LINE__));
+		return ENOSYS;
+	}
+
+	return 0;
+}
diff --git a/sys/dev/misc/hwpmc/hwpmc_ppro.h b/sys/dev/misc/hwpmc/hwpmc_ppro.h
new file mode 100644
index 0000000..469f99c
--- /dev/null
+++ b/sys/dev/misc/hwpmc/hwpmc_ppro.h
@@ -0,0 +1,83 @@
+/*-
+ * Copyright (c) 2005, Joseph Koshy
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD: src/sys/dev/hwpmc/hwpmc_ppro.h,v 1.1 2005/06/09 19:45:07 jkoshy Exp $
+ */
+
+/* Machine dependent interfaces */
+
+#ifndef _DEV_HWPMC_PPRO_H_
+#define	_DEV_HWPMC_PPRO_H_
+
+/* Intel PPro, Celeron, P-II, P-III, Pentium-M PMCS */
+
+#define	P6_NPMCS	3		/* 1 TSC + 2 PMCs */
+
+#define	P6_EVSEL_CMASK_MASK		0xFF000000
+#define	P6_EVSEL_TO_CMASK(C)		(((C) & 0xFF) << 24)
+#define	P6_EVSEL_INV			(1 << 23)
+#define	P6_EVSEL_EN			(1 << 22)
+#define	P6_EVSEL_INT			(1 << 20)
+#define	P6_EVSEL_PC			(1 << 19)
+#define	P6_EVSEL_E			(1 << 18)
+#define	P6_EVSEL_OS			(1 << 17)
+#define	P6_EVSEL_USR			(1 << 16)
+#define	P6_EVSEL_UMASK_MASK		0x0000FF00
+#define	P6_EVSEL_TO_UMASK(U)		(((U) & 0xFF) << 8)
+#define	P6_EVSEL_EVENT_SELECT(ES)	((ES) & 0xFF)
+#define	P6_EVSEL_RESERVED		(1 << 21)
+
+#define	P6_MSR_EVSEL0			0x0186
+#define	P6_MSR_EVSEL1			0x0187
+#define	P6_MSR_PERFCTR0			0x00C1
+#define	P6_MSR_PERFCTR1			0x00C2
+
+#define	P6_PERFCTR_READ_MASK		0xFFFFFFFFFFLL	/* 40 bits */
+#define	P6_PERFCTR_WRITE_MASK		0xFFFFFFFFU	/* 32 bits */
+
+#define	P6_RELOAD_COUNT_TO_PERFCTR_VALUE(R)	(-(R))
+#define	P6_PERFCTR_VALUE_TO_RELOAD_COUNT(P)	(-(P))
+
+#define	P6_PMC_HAS_OVERFLOWED(P)	((rdpmc(P) & (1LL << 39)) == 0)
+
+struct pmc_md_ppro_op_pmcallocate {
+	uint32_t	pm_ppro_config;
+};
+
+#ifdef _KERNEL
+
+/* MD extension for 'struct pmc' */
+struct pmc_md_ppro_pmc {
+	uint32_t	pm_ppro_evsel;
+};
+
+/*
+ * Prototypes
+ */
+
+int	pmc_initialize_p6(struct pmc_mdep *);		/* Pentium Pro PMCs */
+
+#endif /* _KERNEL */
+#endif /* _DEV_HWPMC_PPRO_H_ */
diff --git a/sys/dev/misc/hwpmc/hwpmc_sparc64.c b/sys/dev/misc/hwpmc/hwpmc_sparc64.c
new file mode 100644
index 0000000..77f35f8
--- /dev/null
+++ b/sys/dev/misc/hwpmc/hwpmc_sparc64.c
@@ -0,0 +1,40 @@
+/*-
+ * Copyright (c) 2005, Joseph Koshy
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD: src/sys/dev/hwpmc/hwpmc_sparc64.c,v 1.1 2005/06/09 19:45:07 jkoshy Exp $");
+
+#include <sys/param.h>
+#include <sys/pmc.h>
+
+#include <machine/pmc_mdep.h>
+
+struct pmc_mdep *
+pmc_md_initialize()
+{
+	return NULL;
+}
diff --git a/sys/dev/misc/hwpmc/hwpmc_x86.c b/sys/dev/misc/hwpmc/hwpmc_x86.c
new file mode 100644
index 0000000..419fcec
--- /dev/null
+++ b/sys/dev/misc/hwpmc/hwpmc_x86.c
@@ -0,0 +1,183 @@
+/*-
+ * Copyright (c) 2005, Joseph Koshy
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+/*__FBSDID("$FreeBSD: src/sys/dev/hwpmc/hwpmc_x86.c,v 1.5 2006/04/04 02:36:04 ps Exp $");*/
+
+#include <sys/param.h>
+#include <sys/bus.h>
+#include <sys/spinlock.h>
+#include <sys/systm.h>
+#include <sys/pmc.h>
+
+#include <machine/md_var.h>
+#include <machine/pmc_mdep.h>
+#include <machine/smp.h>
+
+void
+pmc_x86_lapic_enable_pmc_interrupt(void)
+{
+	lapic_enable_pmc_interrupt();
+}
+
+static struct pmc_mdep *
+pmc_intel_initialize(void)
+{
+	struct pmc_mdep *pmc_mdep;
+	enum pmc_cputype cputype;
+	int error, model;
+
+	KASSERT(strcmp(cpu_vendor, "GenuineIntel") == 0,
+	    ("[intel,%d] Initializing non-intel processor", __LINE__));
+
+	PMCDBG(MDP,INI,0, "intel-initialize cpuid=0x%x", cpu_id);
+
+	cputype = -1;
+
+	switch (cpu_id & 0xF00) {
+#if	defined(__i386__)
+	case 0x500:		/* Pentium family processors */
+		cputype = PMC_CPU_INTEL_P5;
+		break;
+	case 0x600:		/* Pentium Pro, Celeron, Pentium II & III */
+		switch ((cpu_id & 0xF0) >> 4) { /* model number field */
+		case 0x1:
+			cputype = PMC_CPU_INTEL_P6;
+			break;
+		case 0x3: case 0x5:
+			cputype = PMC_CPU_INTEL_PII;
+			break;
+		case 0x6:
+			cputype = PMC_CPU_INTEL_CL;
+			break;
+		case 0x7: case 0x8: case 0xA: case 0xB:
+			cputype = PMC_CPU_INTEL_PIII;
+			break;
+		case 0x9: case 0xD: case 0xE:
+			cputype = PMC_CPU_INTEL_PM;
+			break;
+		}
+		break;
+#endif
+#if	defined(__i386__) || defined(__amd64__)
+	case 0xF00:		/* P4 */
+		model = ((cpu_id & 0xF0000) >> 12) | ((cpu_id & 0xF0) >> 4);
+		if (model >= 0 && model <= 6) /* known models */
+			cputype = PMC_CPU_INTEL_PIV;
+		break;
+	}
+#endif
+
+	if ((int) cputype == -1) {
+		kprintf("pmc: Unknown Intel CPU.\n");
+		return NULL;
+	}
+
+	MALLOC(pmc_mdep, struct pmc_mdep *, sizeof(struct pmc_mdep),
+	    M_PMC, M_WAITOK|M_ZERO);
+
+	pmc_mdep->pmd_cputype 	    = cputype;
+	pmc_mdep->pmd_nclass	    = 2;
+	pmc_mdep->pmd_classes[0].pm_class    = PMC_CLASS_TSC;
+	pmc_mdep->pmd_classes[0].pm_caps     = PMC_CAP_READ;
+	pmc_mdep->pmd_classes[0].pm_width    = 64;
+	pmc_mdep->pmd_nclasspmcs[0] = 1;
+
+	error = 0;
+
+	switch (cputype) {
+
+#if	defined(__i386__) || defined(__amd64__)
+
+		/*
+		 * Intel Pentium 4 Processors, and P4/EMT64 processors.
+		 */
+
+	case PMC_CPU_INTEL_PIV:
+		error = pmc_initialize_p4(pmc_mdep);
+		break;
+#endif
+
+#if	defined(__i386__)
+		/*
+		 * P6 Family Processors
+		 */
+
+	case PMC_CPU_INTEL_P6:
+	case PMC_CPU_INTEL_CL:
+	case PMC_CPU_INTEL_PII:
+	case PMC_CPU_INTEL_PIII:
+	case PMC_CPU_INTEL_PM:
+
+		error = pmc_initialize_p6(pmc_mdep);
+		break;
+
+		/*
+		 * Intel Pentium PMCs.
+		 */
+
+	case PMC_CPU_INTEL_P5:
+		error = pmc_initialize_p5(pmc_mdep);
+		break;
+#endif
+
+	default:
+		KASSERT(0,("[intel,%d] Unknown CPU type", __LINE__));
+	}
+
+	if (error) {
+		FREE(pmc_mdep, M_PMC);
+		pmc_mdep = NULL;
+	}
+
+	return pmc_mdep;
+}
+
+
+/*
+ * Machine dependent initialization for x86 class platforms.
+ */
+
+struct pmc_mdep *
+pmc_md_initialize()
+{
+	int i;
+	struct pmc_mdep *md;
+
+	/* determine the CPU kind */
+	md = NULL;
+	if (strcmp(cpu_vendor, "AuthenticAMD") == 0)
+		md = pmc_amd_initialize();
+	else if (strcmp(cpu_vendor, "GenuineIntel") == 0)
+		md = pmc_intel_initialize();
+
+	/* disallow sampling if we do not have an LAPIC */
+	if (md != NULL && lapic == NULL)
+		for (i = 1; i < md->pmd_nclass; i++)
+			md->pmd_classes[i].pm_caps &= ~PMC_CAP_INTERRUPT;
+
+	return md;
+}
diff --git a/sys/dev/misc/hwpmc/pmc_events.h b/sys/dev/misc/hwpmc/pmc_events.h
new file mode 100644
index 0000000..ac8073c
--- /dev/null
+++ b/sys/dev/misc/hwpmc/pmc_events.h
@@ -0,0 +1,530 @@
+/*-
+ * Copyright (c) 2005  Joseph Koshy
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD: src/sys/dev/hwpmc/pmc_events.h,v 1.1 2005/06/09 19:45:07 jkoshy Exp $
+ */
+
+#ifndef _DEV_HWPMC_PMC_EVENTS_H_
+#define	_DEV_HWPMC_PMC_EVENTS_H_
+
+/*
+ * PMC event codes.
+ *
+ * __PMC_EV(CLASS, SYMBOLIC-NAME, VALUE, READABLE-NAME)
+ *
+ */
+
+/*
+ * AMD K7 Events, from "The AMD Athlon(tm) Processor x86 Code
+ * Optimization Guide" [Doc#22007K, Feb 2002]
+ */
+
+#define	__PMC_EV_K7()							\
+__PMC_EV(K7, DC_ACCESSES,		k7-dc-accesses)			\
+__PMC_EV(K7, DC_MISSES,			k7-dc-misses)			\
+__PMC_EV(K7, DC_REFILLS_FROM_L2,	k7-dc-refills-from-l2)		\
+__PMC_EV(K7, DC_REFILLS_FROM_SYSTEM,	k7-dc-refills-from-system)	\
+__PMC_EV(K7, DC_WRITEBACKS,		k7-dc-writebacks)		\
+__PMC_EV(K7, L1_DTLB_MISS_AND_L2_DTLB_HITS,				\
+			k7-l1-dtlb-miss-and-l2-dtlb-hits)		\
+__PMC_EV(K7, L1_AND_L2_DTLB_MISSES,	k7-l1-and-l2-dtlb-misses)	\
+__PMC_EV(K7, MISALIGNED_REFERENCES,	k7-misaligned-references)	\
+__PMC_EV(K7, IC_FETCHES,		k7-ic-fetches)			\
+__PMC_EV(K7, IC_MISSES,			k7-ic-misses)			\
+__PMC_EV(K7, L1_ITLB_MISSES,		k7-l1-itlb-misses)		\
+__PMC_EV(K7, L1_L2_ITLB_MISSES,		k7-l1-l2-itlb-misses)		\
+__PMC_EV(K7, RETIRED_INSTRUCTIONS,	k7-retired-instructions)	\
+__PMC_EV(K7, RETIRED_OPS,		k7-retired-ops)			\
+__PMC_EV(K7, RETIRED_BRANCHES,		k7-retired-branches)		\
+__PMC_EV(K7, RETIRED_BRANCHES_MISPREDICTED,				\
+			k7-retired-branches-mispredicted)		\
+__PMC_EV(K7, RETIRED_TAKEN_BRANCHES,	k7-retired-taken-branches)	\
+__PMC_EV(K7, RETIRED_TAKEN_BRANCHES_MISPREDICTED,			\
+			k7-retired-taken-branches-mispredicted)		\
+__PMC_EV(K7, RETIRED_FAR_CONTROL_TRANSFERS,				\
+			k7-retired-far-control-transfers)		\
+__PMC_EV(K7, RETIRED_RESYNC_BRANCHES, k7-retired-resync-branches)	\
+__PMC_EV(K7, INTERRUPTS_MASKED_CYCLES, k7-interrupts-masked-cycles)	\
+__PMC_EV(K7, INTERRUPTS_MASKED_WHILE_PENDING_CYCLES,			\
+			k7-interrupts-masked-while-pending-cycles)	\
+__PMC_EV(K7, HARDWARE_INTERRUPTS,	k7-hardware-interrupts)
+
+#define	PMC_EV_K7_FIRST	PMC_EV_K7_DC_ACCESSES
+#define	PMC_EV_K7_LAST	PMC_EV_K7_HARDWARE_INTERRUPTS
+
+/*
+ * Intel P4 Events, from "IA-32 Intel(r) Architecture Software
+ * Developer's Manual, Volume 3: System Programming Guide" [245472-012]
+ */
+
+#define	__PMC_EV_P4()							\
+__PMC_EV(P4, TC_DELIVER_MODE,		p4-tc-deliver-mode)		\
+__PMC_EV(P4, BPU_FETCH_REQUEST,		p4-bpu-fetch-request)		\
+__PMC_EV(P4, ITLB_REFERENCE,		p4-itlb-reference)		\
+__PMC_EV(P4, MEMORY_CANCEL,		p4-memory-cancel)		\
+__PMC_EV(P4, MEMORY_COMPLETE,		p4-memory-complete)		\
+__PMC_EV(P4, LOAD_PORT_REPLAY,		p4-load-port-replay)		\
+__PMC_EV(P4, STORE_PORT_REPLAY,		p4-store-port-replay)		\
+__PMC_EV(P4, MOB_LOAD_REPLAY,		p4-mob-load-replay)		\
+__PMC_EV(P4, PAGE_WALK_TYPE,		p4-page-walk-type)		\
+__PMC_EV(P4, BSQ_CACHE_REFERENCE,	p4-bsq-cache-reference)		\
+__PMC_EV(P4, IOQ_ALLOCATION,		p4-ioq-allocation)		\
+__PMC_EV(P4, IOQ_ACTIVE_ENTRIES,	p4-ioq-active-entries)		\
+__PMC_EV(P4, FSB_DATA_ACTIVITY,		p4-fsb-data-activity)		\
+__PMC_EV(P4, BSQ_ALLOCATION,		p4-bsq-allocation)		\
+__PMC_EV(P4, BSQ_ACTIVE_ENTRIES,	p4-bsq-active-entries)		\
+__PMC_EV(P4, SSE_INPUT_ASSIST,		p4-sse-input-assist)		\
+__PMC_EV(P4, PACKED_SP_UOP,		p4-packed-sp-uop)		\
+__PMC_EV(P4, PACKED_DP_UOP,		p4-packed-dp-uop)		\
+__PMC_EV(P4, SCALAR_SP_UOP,		p4-scalar-sp-uop)		\
+__PMC_EV(P4, SCALAR_DP_UOP,		p4-scalar-dp-uop)		\
+__PMC_EV(P4, 64BIT_MMX_UOP,		p4-64bit-mmx-uop)		\
+__PMC_EV(P4, 128BIT_MMX_UOP,		p4-128bit-mmx-uop)		\
+__PMC_EV(P4, X87_FP_UOP,		p4-x87-fp-uop)			\
+__PMC_EV(P4, X87_SIMD_MOVES_UOP,	p4-x87-simd-moves-uop)		\
+__PMC_EV(P4, GLOBAL_POWER_EVENTS,	p4-global-power-events)		\
+__PMC_EV(P4, TC_MS_XFER,		p4-tc-ms-xfer)			\
+__PMC_EV(P4, UOP_QUEUE_WRITES,		p4-uop-queue-writes)		\
+__PMC_EV(P4, RETIRED_MISPRED_BRANCH_TYPE,				\
+			    p4-retired-mispred-branch-type)		\
+__PMC_EV(P4, RETIRED_BRANCH_TYPE,	p4-retired-branch-type)		\
+__PMC_EV(P4, RESOURCE_STALL,		p4-resource-stall)		\
+__PMC_EV(P4, WC_BUFFER,			p4-wc-buffer)			\
+__PMC_EV(P4, B2B_CYCLES,		p4-b2b-cycles)			\
+__PMC_EV(P4, BNR,			p4-bnr)				\
+__PMC_EV(P4, SNOOP,			p4-snoop)			\
+__PMC_EV(P4, RESPONSE,			p4-response)			\
+__PMC_EV(P4, FRONT_END_EVENT,		p4-front-end-event)		\
+__PMC_EV(P4, EXECUTION_EVENT,		p4-execution-event)		\
+__PMC_EV(P4, REPLAY_EVENT,		p4-replay-event)		\
+__PMC_EV(P4, INSTR_RETIRED,		p4-instr-retired)		\
+__PMC_EV(P4, UOPS_RETIRED,		p4-uops-retired)		\
+__PMC_EV(P4, UOP_TYPE,			p4-uop-type)			\
+__PMC_EV(P4, BRANCH_RETIRED,		p4-branch-retired)		\
+__PMC_EV(P4, MISPRED_BRANCH_RETIRED,	p4-mispred-branch-retired)	\
+__PMC_EV(P4, X87_ASSIST,		p4-x87-assist)			\
+__PMC_EV(P4, MACHINE_CLEAR,		p4-machine-clear)
+
+#define	PMC_EV_P4_FIRST PMC_EV_P4_TC_DELIVER_MODE
+#define	PMC_EV_P4_LAST	PMC_EV_P4_MACHINE_CLEAR
+
+/* Intel Pentium Pro, P-II, P-III and Pentium-M style events */
+
+#define	__PMC_EV_P6()							\
+__PMC_EV(P6, DATA_MEM_REFS,		p6-data-mem-refs)		\
+__PMC_EV(P6, DCU_LINES_IN,		p6-dcu-lines-in)		\
+__PMC_EV(P6, DCU_M_LINES_IN,		p6-dcu-m-lines-in)		\
+__PMC_EV(P6, DCU_M_LINES_OUT,		p6-dcu-m-lines-out)		\
+__PMC_EV(P6, DCU_MISS_OUTSTANDING,	p6-dcu-miss-outstanding)	\
+__PMC_EV(P6, IFU_FETCH,			p6-ifu-fetch)			\
+__PMC_EV(P6, IFU_FETCH_MISS,		p6-ifu-fetch-miss)		\
+__PMC_EV(P6, ITLB_MISS,			p6-itlb-miss)			\
+__PMC_EV(P6, IFU_MEM_STALL,		p6-ifu-mem-stall)		\
+__PMC_EV(P6, ILD_STALL,			p6-ild-stall)			\
+__PMC_EV(P6, L2_IFETCH,			p6-l2-ifetch)			\
+__PMC_EV(P6, L2_LD,			p6-l2-ld)			\
+__PMC_EV(P6, L2_ST,			p6-l2-st)			\
+__PMC_EV(P6, L2_LINES_IN,		p6-l2-lines-in)			\
+__PMC_EV(P6, L2_LINES_OUT,		p6-l2-lines-out)		\
+__PMC_EV(P6, L2_M_LINES_INM,		p6-l2-m-lines-inm)		\
+__PMC_EV(P6, L2_M_LINES_OUTM,		p6-l2-m-lines-outm)		\
+__PMC_EV(P6, L2_RQSTS,			p6-l2-rqsts)			\
+__PMC_EV(P6, L2_ADS,			p6-l2-ads)			\
+__PMC_EV(P6, L2_DBUS_BUSY,		p6-l2-dbus-busy)		\
+__PMC_EV(P6, L2_DBUS_BUSY_RD,		p6-l2-dbus-busy-rd)		\
+__PMC_EV(P6, BUS_DRDY_CLOCKS,		p6-bus-drdy-clocks)		\
+__PMC_EV(P6, BUS_LOCK_CLOCKS,		p6-bus-lock-clocks)		\
+__PMC_EV(P6, BUS_REQ_OUTSTANDING,	p6-bus-req-outstanding)		\
+__PMC_EV(P6, BUS_TRAN_BRD,		p6-bus-tran-brd)		\
+__PMC_EV(P6, BUS_TRAN_RFO,		p6-bus-tran-rfo)		\
+__PMC_EV(P6, BUS_TRANS_WB,		p6-bus-trans-wb)		\
+__PMC_EV(P6, BUS_TRAN_IFETCH,		p6-bus-tran-ifetch)		\
+__PMC_EV(P6, BUS_TRAN_INVAL,		p6-bus-tran-inval)		\
+__PMC_EV(P6, BUS_TRAN_PWR,		p6-bus-tran-pwr)		\
+__PMC_EV(P6, BUS_TRANS_P,		p6-bus-trans-p)			\
+__PMC_EV(P6, BUS_TRANS_IO,		p6-bus-trans-io)		\
+__PMC_EV(P6, BUS_TRAN_DEF,		p6-bus-tran-def)		\
+__PMC_EV(P6, BUS_TRAN_BURST,		p6-bus-tran-burst)		\
+__PMC_EV(P6, BUS_TRAN_ANY,		p6-bus-tran-any)		\
+__PMC_EV(P6, BUS_TRAN_MEM,		p6-bus-tran-mem)		\
+__PMC_EV(P6, BUS_DATA_RCV,		p6-bus-data-rcv)		\
+__PMC_EV(P6, BUS_BNR_DRV,		p6-bus-bnr-drv)			\
+__PMC_EV(P6, BUS_HIT_DRV,		p6-bus-hit-drv)			\
+__PMC_EV(P6, BUS_HITM_DRV,		p6-bus-hitm-drv)		\
+__PMC_EV(P6, BUS_SNOOP_STALL,		p6-bus-snoop-stall)		\
+__PMC_EV(P6, FLOPS,			p6-flops)			\
+__PMC_EV(P6, FP_COMPS_OPS_EXE,		p6-fp-comps-ops-exe)		\
+__PMC_EV(P6, FP_ASSIST,			p6-fp-assist)			\
+__PMC_EV(P6, MUL,			p6-mul)				\
+__PMC_EV(P6, DIV,			p6-div)				\
+__PMC_EV(P6, CYCLES_DIV_BUSY,		p6-cycles-div-busy)		\
+__PMC_EV(P6, LD_BLOCKS,			p6-ld-blocks)			\
+__PMC_EV(P6, SB_DRAINS,			p6-sb-drains)			\
+__PMC_EV(P6, MISALIGN_MEM_REF,		p6-misalign-mem-ref)		\
+__PMC_EV(P6, EMON_KNI_PREF_DISPATCHED,	p6-emon-kni-pref-dispatched)	\
+__PMC_EV(P6, EMON_KNI_PREF_MISS,	p6-emon-kni-pref-miss)		\
+__PMC_EV(P6, INST_RETIRED,		p6-inst-retired)		\
+__PMC_EV(P6, UOPS_RETIRED,		p6-uops-retired)		\
+__PMC_EV(P6, INST_DECODED,		p6-inst-decoded)		\
+__PMC_EV(P6, EMON_KNI_INST_RETIRED,	p6-emon-kni-inst-retired)	\
+__PMC_EV(P6, EMON_KNI_COMP_INST_RET,	p6-emon-kni-comp-inst-ret)	\
+__PMC_EV(P6, HW_INT_RX,			p6-hw-int-rx)			\
+__PMC_EV(P6, CYCLES_INT_MASKED,		p6-cycles-int-masked)		\
+__PMC_EV(P6, CYCLES_INT_PENDING_AND_MASKED,				\
+			    p6-cycles-in-pending-and-masked)		\
+__PMC_EV(P6, BR_INST_RETIRED,		p6-br-inst-retired)		\
+__PMC_EV(P6, BR_MISS_PRED_RETIRED,	p6-br-miss-pred-retired)	\
+__PMC_EV(P6, BR_TAKEN_RETIRED,		p6-br-taken-retired)		\
+__PMC_EV(P6, BR_MISS_PRED_TAKEN_RET,	p6-br-miss-pred-taken-ret)	\
+__PMC_EV(P6, BR_INST_DECODED,		p6-br-inst-decoded)		\
+__PMC_EV(P6, BTB_MISSES,		p6-btb-misses)			\
+__PMC_EV(P6, BR_BOGUS,			p6-br-bogus)			\
+__PMC_EV(P6, BACLEARS,			p6-baclears)			\
+__PMC_EV(P6, RESOURCE_STALLS,		p6-resource-stalls)		\
+__PMC_EV(P6, PARTIAL_RAT_STALLS,	p6-partial-rat-stalls)		\
+__PMC_EV(P6, SEGMENT_REG_LOADS,		p6-segment-reg-loads)		\
+__PMC_EV(P6, CPU_CLK_UNHALTED,		p6-cpu-clk-unhalted)		\
+__PMC_EV(P6, MMX_INSTR_EXEC,		p6-mmx-instr-exec)		\
+__PMC_EV(P6, MMX_SAT_INSTR_EXEC,	p6-mmx-sat-instr-exec)		\
+__PMC_EV(P6, MMX_UOPS_EXEC,		p6-mmx-uops-exec)		\
+__PMC_EV(P6, MMX_INSTR_TYPE_EXEC,	p6-mmx-instr-type-exec)		\
+__PMC_EV(P6, FP_MMX_TRANS,		p6-fp-mmx-trans)		\
+__PMC_EV(P6, MMX_ASSIST,		p6-mmx-assist)			\
+__PMC_EV(P6, MMX_INSTR_RET,		p6-mmx-instr-ret)		\
+__PMC_EV(P6, SEG_RENAME_STALLS,		p6-seg-rename-stalls)		\
+__PMC_EV(P6, SEG_REG_RENAMES,		p6-seg-reg-renames)		\
+__PMC_EV(P6, RET_SEG_RENAMES,		p6-ret-seg-renames)		\
+__PMC_EV(P6, EMON_EST_TRANS,		p6-emon-est-trans)		\
+__PMC_EV(P6, EMON_THERMAL_TRIP,		p6-emon-thermal-trip)		\
+__PMC_EV(P6, BR_INST_EXEC,		p6-br-inst-exec)		\
+__PMC_EV(P6, BR_MISSP_EXEC,		p6-br-missp-exec)		\
+__PMC_EV(P6, BR_BAC_MISSP_EXEC,		p6-br-bac-missp-exec)		\
+__PMC_EV(P6, BR_CND_EXEC,		p6-br-cnd-exec)			\
+__PMC_EV(P6, BR_CND_MISSP_EXEC,		p6-br-cnd-missp-exec)		\
+__PMC_EV(P6, BR_IND_EXEC,		p6-br-ind-exec)			\
+__PMC_EV(P6, BR_IND_MISSP_EXEC,		p6-br-ind-missp-exec)		\
+__PMC_EV(P6, BR_RET_EXEC,		p6-br-ret-exec)			\
+__PMC_EV(P6, BR_RET_MISSP_EXEC,		p6-br-ret-missp-exec)		\
+__PMC_EV(P6, BR_RET_BAC_MISSP_EXEC,	p6-br-ret-bac-missp-exec)	\
+__PMC_EV(P6, BR_CALL_EXEC,		p6-br-call-exec)		\
+__PMC_EV(P6, BR_CALL_MISSP_EXEC,	p6-br-call-missp-exec)		\
+__PMC_EV(P6, BR_IND_CALL_EXEC,		p6-br-ind-call-exec)		\
+__PMC_EV(P6, EMON_SIMD_INSTR_RETIRED,	p6-emon-simd-instr-retired)	\
+__PMC_EV(P6, EMON_SYNCH_UOPS,		p6-emon-synch-uops)		\
+__PMC_EV(P6, EMON_ESP_UOPS,		p6-emon-esp-uops)		\
+__PMC_EV(P6, EMON_FUSED_UOPS_RET,	p6-emon-fused-uops-ret)		\
+__PMC_EV(P6, EMON_UNFUSION,		p6-emon-unfusion)		\
+__PMC_EV(P6, EMON_PREF_RQSTS_UP,	p6-emon-pref-rqsts-up)		\
+__PMC_EV(P6, EMON_PREF_RQSTS_DN,	p6-emon-pref-rqsts-dn)		\
+__PMC_EV(P6, EMON_SSE_SSE2_INST_RETIRED,				\
+				p6-emon-sse-sse2-inst-retired)		\
+__PMC_EV(P6, EMON_SSE_SSE2_COMP_INST_RETIRED,				\
+				p6-emon-sse-sse2-comp-inst-retired)
+
+
+#define	PMC_EV_P6_FIRST	PMC_EV_P6_DATA_MEM_REFS
+#define	PMC_EV_P6_LAST	PMC_EV_P6_EMON_SSE_SSE2_COMP_INST_RETIRED
+
+/* AMD K8 PMCs */
+
+#define	__PMC_EV_K8()							\
+__PMC_EV(K8, FP_DISPATCHED_FPU_OPS,	k8-fp-dispatched-fpu-ops)	\
+__PMC_EV(K8, FP_CYCLES_WITH_NO_FPU_OPS_RETIRED,				\
+		k8-fp-cycles-with-no-fpu-ops-retired)			\
+__PMC_EV(K8, FP_DISPATCHED_FPU_FAST_FLAG_OPS,				\
+		k8-fp-dispatched-fpu-fast-flag-ops)			\
+__PMC_EV(K8, LS_SEGMENT_REGISTER_LOAD,	k8-ls-segment-register-load)	\
+__PMC_EV(K8, LS_MICROARCHITECTURAL_RESYNC_BY_SELF_MODIFYING_CODE,	\
+		k8-ls-microarchitectural-resync-by-self-modifying-code)	\
+__PMC_EV(K8, LS_MICROARCHITECTURAL_RESYNC_BY_SNOOP,			\
+		k8-ls-microarchitectural-resync-by-snoop)		\
+__PMC_EV(K8, LS_BUFFER2_FULL,		k8-ls-buffer2-full)		\
+__PMC_EV(K8, LS_LOCKED_OPERATION,	k8-ls-locked-operation)		\
+__PMC_EV(K8, LS_MICROARCHITECTURAL_LATE_CANCEL,				\
+		k8-ls-microarchitectural-late-cancel)			\
+__PMC_EV(K8, LS_RETIRED_CFLUSH_INSTRUCTIONS,				\
+		k8-ls-retired-cflush-instructions)			\
+__PMC_EV(K8, LS_RETIRED_CPUID_INSTRUCTIONS,				\
+		k8-ls-retired-cpuid-instructions)			\
+__PMC_EV(K8, DC_ACCESS,			k8-dc-access)			\
+__PMC_EV(K8, DC_MISS,			k8-dc-miss)			\
+__PMC_EV(K8, DC_REFILL_FROM_L2,		k8-dc-refill-from-l2)		\
+__PMC_EV(K8, DC_REFILL_FROM_SYSTEM,	k8-dc-refill-from-system)	\
+__PMC_EV(K8, DC_COPYBACK,		k8-dc-copyback)			\
+__PMC_EV(K8, DC_L1_DTLB_MISS_AND_L2_DTLB_HIT,				\
+		k8-dc-l1-dtlb-miss-and-l2-dtlb-hit)			\
+__PMC_EV(K8, DC_L1_DTLB_MISS_AND_L2_DTLB_MISS,				\
+		k8-dc-l1-dtlb-miss-and-l2-dtlb-miss)			\
+__PMC_EV(K8, DC_MISALIGNED_DATA_REFERENCE,				\
+		k8-dc-misaligned-data-reference)			\
+__PMC_EV(K8, DC_MICROARCHITECTURAL_LATE_CANCEL,				\
+		k8-dc-microarchitectural-late-cancel-of-an-access)	\
+__PMC_EV(K8, DC_MICROARCHITECTURAL_EARLY_CANCEL,			\
+		k8-dc-microarchitectural-early-cancel-of-an-access)	\
+__PMC_EV(K8, DC_ONE_BIT_ECC_ERROR,	k8-dc-one-bit-ecc-error)	\
+__PMC_EV(K8, DC_DISPATCHED_PREFETCH_INSTRUCTIONS,			\
+		k8-dc-dispatched-prefetch-instructions)			\
+__PMC_EV(K8, DC_DCACHE_ACCESSES_BY_LOCKS,				\
+		k8-dc-dcache-accesses-by-locks)				\
+__PMC_EV(K8, BU_CPU_CLK_UNHALTED,	k8-bu-cpu-clk-unhalted)		\
+__PMC_EV(K8, BU_INTERNAL_L2_REQUEST,	k8-bu-internal-l2-request)	\
+__PMC_EV(K8, BU_FILL_REQUEST_L2_MISS,	k8-bu-fill-request-l2-miss)	\
+__PMC_EV(K8, BU_FILL_INTO_L2,		k8-bu-fill-into-l2)		\
+__PMC_EV(K8, IC_FETCH,			k8-ic-fetch)			\
+__PMC_EV(K8, IC_MISS,			k8-ic-miss)			\
+__PMC_EV(K8, IC_REFILL_FROM_L2,		k8-ic-refill-from-l2)		\
+__PMC_EV(K8, IC_REFILL_FROM_SYSTEM,	k8-ic-refill-from-system)	\
+__PMC_EV(K8, IC_L1_ITLB_MISS_AND_L2_ITLB_HIT,				\
+		k8-ic-l1-itlb-miss-and-l2-itlb-hit)			\
+__PMC_EV(K8, IC_L1_ITLB_MISS_AND_L2_ITLB_MISS,				\
+		k8-ic-l1-itlb-miss-and-l2-itlb-miss)			\
+__PMC_EV(K8, IC_MICROARCHITECTURAL_RESYNC_BY_SNOOP,			\
+		k8-ic-microarchitectural-resync-by-snoop)		\
+__PMC_EV(K8, IC_INSTRUCTION_FETCH_STALL,				\
+		k8-ic-instruction-fetch-stall)				\
+__PMC_EV(K8, IC_RETURN_STACK_HIT,	k8-ic-return-stack-hit)		\
+__PMC_EV(K8, IC_RETURN_STACK_OVERFLOW,	k8-ic-return-stack-overflow)	\
+__PMC_EV(K8, FR_RETIRED_X86_INSTRUCTIONS,				\
+		k8-fr-retired-x86-instructions)				\
+__PMC_EV(K8, FR_RETIRED_UOPS,		k8-fr-retired-uops)		\
+__PMC_EV(K8, FR_RETIRED_BRANCHES,	k8-fr-retired-branches)		\
+__PMC_EV(K8, FR_RETIRED_BRANCHES_MISPREDICTED,				\
+		k8-fr-retired-branches-mispredicted)			\
+__PMC_EV(K8, FR_RETIRED_TAKEN_BRANCHES,					\
+		k8-fr-retired-taken-branches)				\
+__PMC_EV(K8, FR_RETIRED_TAKEN_BRANCHES_MISPREDICTED,			\
+		k8-fr-retired-taken-branches-mispredicted)		\
+__PMC_EV(K8, FR_RETIRED_FAR_CONTROL_TRANSFERS,				\
+		k8-fr-retired-far-control-transfers)			\
+__PMC_EV(K8, FR_RETIRED_RESYNCS,	k8-fr-retired-resyncs)		\
+__PMC_EV(K8, FR_RETIRED_NEAR_RETURNS,	k8-fr-retired-near-returns)	\
+__PMC_EV(K8, FR_RETIRED_NEAR_RETURNS_MISPREDICTED,			\
+		k8-fr-retired-near-returns-mispredicted)		\
+__PMC_EV(K8,								\
+	FR_RETIRED_TAKEN_BRANCHES_MISPREDICTED_BY_ADDR_MISCOMPARE,	\
+	k8-fr-retired-taken-branches-mispredicted-by-addr-miscompare)	\
+__PMC_EV(K8, FR_RETIRED_FPU_INSTRUCTIONS,				\
+		k8-fr-retired-fpu-instructions)				\
+__PMC_EV(K8, FR_RETIRED_FASTPATH_DOUBLE_OP_INSTRUCTIONS,		\
+		k8-fr-retired-fastpath-double-op-instructions)		\
+__PMC_EV(K8, FR_INTERRUPTS_MASKED_CYCLES,				\
+		k8-fr-interrupts-masked-cycles)				\
+__PMC_EV(K8, FR_INTERRUPTS_MASKED_WHILE_PENDING_CYCLES,			\
+		k8-fr-interrupts-masked-while-pending-cycles)		\
+__PMC_EV(K8, FR_TAKEN_HARDWARE_INTERRUPTS,				\
+		k8-fr-taken-hardware-interrupts)			\
+__PMC_EV(K8, FR_DECODER_EMPTY,		k8-fr-decoder-empty)		\
+__PMC_EV(K8, FR_DISPATCH_STALLS,	k8-fr-dispatch-stalls)		\
+__PMC_EV(K8, FR_DISPATCH_STALL_FROM_BRANCH_ABORT_TO_RETIRE,		\
+		k8-fr-dispatch-stall-from-branch-abort-to-retire)	\
+__PMC_EV(K8, FR_DISPATCH_STALL_FOR_SERIALIZATION,			\
+		k8-fr-dispatch-stall-for-serialization)			\
+__PMC_EV(K8, FR_DISPATCH_STALL_FOR_SEGMENT_LOAD,			\
+		k8-fr-dispatch-stall-for-segment-load)			\
+__PMC_EV(K8, FR_DISPATCH_STALL_WHEN_REORDER_BUFFER_IS_FULL,		\
+		k8-fr-dispatch-stall-when-reorder-buffer-is-full)	\
+__PMC_EV(K8,								\
+	FR_DISPATCH_STALL_WHEN_RESERVATION_STATIONS_ARE_FULL,		\
+	k8-fr-dispatch-stall-when-reservation-stations-are-full)	\
+__PMC_EV(K8, FR_DISPATCH_STALL_WHEN_FPU_IS_FULL,			\
+		k8-fr-dispatch-stall-when-fpu-is-full)			\
+__PMC_EV(K8, FR_DISPATCH_STALL_WHEN_LS_IS_FULL,				\
+		k8-fr-dispatch-stall-when-ls-is-full)			\
+__PMC_EV(K8, FR_DISPATCH_STALL_WHEN_WAITING_FOR_ALL_TO_BE_QUIET,	\
+		k8-fr-dispatch-stall-when-waiting-for-all-to-be-quiet)	\
+__PMC_EV(K8,								\
+	FR_DISPATCH_STALL_WHEN_FAR_XFER_OR_RESYNC_BRANCH_PENDING,	\
+	k8-fr-dispatch-stall-when-far-xfer-or-resync-branch-pending)	\
+__PMC_EV(K8, FR_FPU_EXCEPTIONS,		k8-fr-fpu-exceptions)		\
+__PMC_EV(K8, FR_NUMBER_OF_BREAKPOINTS_FOR_DR0,				\
+		k8-fr-number-of-breakpoints-for-dr0)			\
+__PMC_EV(K8, FR_NUMBER_OF_BREAKPOINTS_FOR_DR1,				\
+		k8-fr-number-of-breakpoints-for-dr1)			\
+__PMC_EV(K8, FR_NUMBER_OF_BREAKPOINTS_FOR_DR2,				\
+		k8-fr-number-of-breakpoints-for-dr2)			\
+__PMC_EV(K8, FR_NUMBER_OF_BREAKPOINTS_FOR_DR3,				\
+		k8-fr-number-of-breakpoints-for-dr3)			\
+__PMC_EV(K8, NB_MEMORY_CONTROLLER_PAGE_ACCESS_EVENT,			\
+		k8-nb-memory-controller-page-access-event)		\
+__PMC_EV(K8, NB_MEMORY_CONTROLLER_PAGE_TABLE_OVERFLOW,			\
+		k8-nb-memory-controller-page-table-overflow)		\
+__PMC_EV(K8, NB_MEMORY_CONTROLLER_DRAM_COMMAND_SLOTS_MISSED,		\
+		k8-nb-memory-controller-dram-slots-missed)		\
+__PMC_EV(K8, NB_MEMORY_CONTROLLER_TURNAROUND,				\
+		k8-nb-memory-controller-turnaround)			\
+__PMC_EV(K8, NB_MEMORY_CONTROLLER_BYPASS_SATURATION,			\
+		k8-nb-memory-controller-bypass-saturation)		\
+__PMC_EV(K8, NB_SIZED_COMMANDS,		k8-nb-sized-commands)		\
+__PMC_EV(K8, NB_PROBE_RESULT,		k8-nb-probe-result)		\
+__PMC_EV(K8, NB_HT_BUS0_BANDWIDTH,	k8-nb-ht-bus0-bandwidth)	\
+__PMC_EV(K8, NB_HT_BUS1_BANDWIDTH,	k8-nb-ht-bus1-bandwidth)	\
+__PMC_EV(K8, NB_HT_BUS2_BANDWIDTH,	k8-nb-ht-bus2-bandwidth)
+
+#define	PMC_EV_K8_FIRST		PMC_EV_K8_FP_DISPATCHED_FPU_OPS
+#define	PMC_EV_K8_LAST		PMC_EV_K8_NB_HT_BUS2_BANDWIDTH
+
+
+/* Intel Pentium Events */
+#define	__PMC_EV_P5()							\
+__PMC_EV(P5, DATA_READ, p5-data-read)					\
+__PMC_EV(P5, DATA_WRITE, p5-data-write)					\
+__PMC_EV(P5, DATA_TLB_MISS, p5-data-tlb-miss)				\
+__PMC_EV(P5, DATA_READ_MISS, p5-data-read-miss)				\
+__PMC_EV(P5, DATA_WRITE_MISS, p5-data-write-miss)			\
+__PMC_EV(P5, WRITE_HIT_TO_M_OR_E_STATE_LINES,				\
+    p5-write-hit-to-m-or-e-state-lines)					\
+__PMC_EV(P5, DATA_CACHE_LINES_WRITTEN_BACK,				\
+    p4-data-cache-lines-written-back)					\
+__PMC_EV(P5, EXTERNAL_SNOOPS, p5-external-snoops)			\
+__PMC_EV(P5, EXTERNAL_DATA_CACHE_SNOOP_HITS,				\
+    p5-external-data-cache-snoop-hits)					\
+__PMC_EV(P5, MEMORY_ACCESSES_IN_BOTH_PIPES,				\
+    p5-memory-accesses-in-both-pipes)					\
+__PMC_EV(P5, BANK_CONFLICTS, p5-bank-conflicts)				\
+__PMC_EV(P5, MISALIGNED_DATA_OR_IO_REFERENCES,				\
+    p5-misaligned-data-or-io-references)				\
+__PMC_EV(P5, CODE_READ, p5-code-read)					\
+__PMC_EV(P5, CODE_TLB_MISS, p5-code-tlb-miss)				\
+__PMC_EV(P5, CODE_CACHE_MISS, p5-code-cache-miss)			\
+__PMC_EV(P5, ANY_SEGMENT_REGISTER_LOADED,				\
+    p5-any-segment-register-loaded)					\
+__PMC_EV(P5, BRANCHES, p5-branches)					\
+__PMC_EV(P5, BTB_HITS, p5-btb-hits)					\
+__PMC_EV(P5, TAKEN_BRANCH_OR_BTB_HIT,					\
+    p5-taken-branch-or-btb-hit)						\
+__PMC_EV(P5, PIPELINE_FLUSHES, p5-pipeline-flushes)			\
+__PMC_EV(P5, INSTRUCTIONS_EXECUTED, p5-instructions-executed)		\
+__PMC_EV(P5, INSTRUCTIONS_EXECUTED_V_PIPE,				\
+    p5-instructions-executed-v-pipe)					\
+__PMC_EV(P5, BUS_CYCLE_DURATION, p5-bus-cycle-duration)			\
+__PMC_EV(P5, WRITE_BUFFER_FULL_STALL_DURATION,				\
+    p5-write-buffer-full-stall-duration)				\
+__PMC_EV(P5, WAITING_FOR_DATA_MEMORY_READ_STALL_DURATION,		\
+    p5-waiting-for-data-memory-read-stall-duration)			\
+__PMC_EV(P5, STALL_ON_WRITE_TO_AN_E_OR_M_STATE_LINE,			\
+    p5-stall-on-write-to-an-e-or-m-state-line)				\
+__PMC_EV(P5, LOCKED_BUS_CYCLE, p5-locked-bus-cycle)			\
+__PMC_EV(P5, IO_READ_OR_WRITE_CYCLE, p5-io-read-or-write-cycle)		\
+__PMC_EV(P5, NONCACHEABLE_MEMORY_READS,					\
+    p5-noncacheable-memory-reads)					\
+__PMC_EV(P5, PIPELINE_AGI_STALLS, p5-pipeline-agi-stalls)		\
+__PMC_EV(P5, FLOPS, p5-flops)						\
+__PMC_EV(P5, BREAKPOINT_MATCH_ON_DR0_REGISTER,				\
+    p5-breakpoint-match-on-dr0-register)				\
+__PMC_EV(P5, BREAKPOINT_MATCH_ON_DR1_REGISTER,				\
+    p5-breakpoint-match-on-dr1-register)				\
+__PMC_EV(P5, BREAKPOINT_MATCH_ON_DR2_REGISTER,				\
+    p5-breakpoint-match-on-dr2-register)				\
+__PMC_EV(P5, BREAKPOINT_MATCH_ON_DR3_REGISTER,				\
+    p5-breakpoint-match-on-dr3-register)				\
+__PMC_EV(P5, HARDWARE_INTERRUPTS, p5-hardware-interrupts)		\
+__PMC_EV(P5, DATA_READ_OR_WRITE, p5-data-read-or-write)			\
+__PMC_EV(P5, DATA_READ_MISS_OR_WRITE_MISS,				\
+    p5-data-read-miss-or-write-miss)					\
+__PMC_EV(P5, BUS_OWNERSHIP_LATENCY, p5-bus-ownership-latency)		\
+__PMC_EV(P5, BUS_OWNERSHIP_TRANSFERS, p5-bus-ownership-transfers)	\
+__PMC_EV(P5, MMX_INSTRUCTIONS_EXECUTED_U_PIPE,				\
+    p5-mmx-instructions-executed-u-pipe)				\
+__PMC_EV(P5, MMX_INSTRUCTIONS_EXECUTED_V_PIPE,				\
+    p5-mmx-instructions-executed-v-pipe)				\
+__PMC_EV(P5, CACHE_M_LINE_SHARING, p5-cache-m-line-sharing)		\
+__PMC_EV(P5, CACHE_LINE_SHARING, p5-cache-line-sharing)			\
+__PMC_EV(P5, EMMS_INSTRUCTIONS_EXECUTED,				\
+    p5-emms-instructions-executed)					\
+__PMC_EV(P5, TRANSITIONS_BETWEEN_MMX_AND_FP_INSTRUCTIONS,		\
+    p5-transitions-between-mmx-and-fp-instructions)			\
+__PMC_EV(P5, BUS_UTILIZATION_DUE_TO_PROCESSOR_ACTIVITY,			\
+    p5-bus-utilization-due-to-processor-activity)			\
+__PMC_EV(P5, WRITES_TO_NONCACHEABLE_MEMORY,				\
+    p5-writes-to-noncacheable-memory)					\
+__PMC_EV(P5, SATURATING_MMX_INSTRUCTIONS_EXECUTED,			\
+    p5-saturating-mmx-instructions-executed)				\
+__PMC_EV(P5, SATURATIONS_PERFORMED, p5-saturations-performed)		\
+__PMC_EV(P5, NUMBER_OF_CYCLES_NOT_IN_HALT_STATE,			\
+    p5-number-of-cycles-not-in-halt-state)				\
+__PMC_EV(P5, DATA_CACHE_TLB_MISS_STALL_DURATION,			\
+    p5-data-cache-tlb-miss-stall-duration)				\
+__PMC_EV(P5, MMX_INSTRUCTION_DATA_READS,				\
+    p5-mmx-instruction-data-reads)					\
+__PMC_EV(P5, MMX_INSTRUCTION_DATA_READ_MISSES,				\
+    p5-mmx-instruction-data-read-misses)				\
+__PMC_EV(P5, FLOATING_POINT_STALLS_DURATION,				\
+    p5-floating-point-stalls-duration)					\
+__PMC_EV(P5, TAKEN_BRANCHES, p5-taken-branches)				\
+__PMC_EV(P5, D1_STARVATION_AND_FIFO_IS_EMPTY,				\
+    p5-d1-starvation-and-fifo-is-empty)					\
+__PMC_EV(P5, D1_STARVATION_AND_ONLY_ONE_INSTRUCTION_IN_FIFO,		\
+    p5-d1-starvation-and-only-instruction-in-fifo)			\
+__PMC_EV(P5, MMX_INSTRUCTION_DATA_WRITES,				\
+    p5-mmx-instruction-data-writes)					\
+__PMC_EV(P5, MMX_INSTRUCTION_DATA_WRITE_MISSES,				\
+    p5-mmx-instruction-data-write-misses)				\
+__PMC_EV(P5, PIPELINE_FLUSHES_DUE_TO_WRONG_BRANCH_PREDICTIONS,		\
+    p5-pipeline-flushes-due-to-wrong-branch-predictions)		\
+__PMC_EV(P5,								\
+    PIPELINE_FLUSHES_DUE_TO_WRONG_BRANCH_PREDICTIONS_RESOLVED_IN_WB_STAGE, \
+    p5-pipeline-flushes-due-to-wrong-branch-predictions-resolved-in-wb-stage) \
+__PMC_EV(P5, MISALIGNED_DATA_MEMORY_REFERENCE_ON_MMX_INSTRUCTIONS,	\
+    p5-misaligned-data-memory-reference-on-mmx-instructions)		\
+__PMC_EV(P5, PIPELINE_STALL_FOR_MMX_INSTRUCTION_DATA_MEMORY_READS,	\
+    p5-pipeline-stall-for-mmx-instruction-data-memory-reads)		\
+__PMC_EV(P5, MISPREDICTED_OR_UNPREDICTED_RETURNS,			\
+    p5-mispredicted-or-unpredicted-returns)				\
+__PMC_EV(P5, PREDICTED_RETURNS, p5-predicted-returns)			\
+__PMC_EV(P5, MMX_MULTIPLY_UNIT_INTERLOCK,				\
+    p5-mmx-multiply-unit-interlock)					\
+__PMC_EV(P5, MOVD_MOVQ_STORE_STALL_DUE_TO_PREVIOUS_MMX_OPERATION,	\
+    p5-movd-movq-store-stall-due-to-previous-mmx-operation)		\
+__PMC_EV(P5, RETURNS, p5-returns)					\
+__PMC_EV(P5, BTB_FALSE_ENTRIES, p5-btb-false-entries)			\
+__PMC_EV(P5, BTB_MISS_PREDICTION_ON_NOT_TAKEN_BRANCH,			\
+    p5-btb-miss-prediction-on-not-taken-branch)				\
+__PMC_EV(P5,								\
+    FULL_WRITE_BUFFER_STALL_DURATION_WHILE_EXECUTING_MMX_INSTRUCTIONS,	\
+    p5-full-write-buffer-stall-duration-while-executing-mmx-instructions) \
+__PMC_EV(P5, STALL_ON_MMX_INSTRUCTION_WRITE_TO_E_OR_M_STATE_LINE,	\
+    p5-stall-on-mmx-instruction-write-to-e-o-m-state-line)
+
+#define	PMC_EV_P5_FIRST		PMC_EV_P5_DATA_READ
+#define	PMC_EV_P5_LAST	        \
+	PMC_EV_P5_STALL_ON_MMX_INSTRUCTION_WRITE_TO_E_OR_M_STATE_LINE
+
+/* timestamp counters. */
+#define	__PMC_EV_TSC()							\
+	__PMC_EV(TSC, TSC, tsc)
+
+/* All known PMC events */
+#define	__PMC_EVENTS()							\
+	__PMC_EV_TSC()							\
+	__PMC_EV_K7()							\
+	__PMC_EV_P6()							\
+	__PMC_EV_P4()							\
+	__PMC_EV_K8()							\
+	__PMC_EV_P5()							\
+
+#define	PMC_EVENT_FIRST	PMC_EV_TSC_TSC
+#define	PMC_EVENT_LAST	PMC_EV_P5_LAST
+
+#endif /* _DEV_HWPMC_PMC_EVENTS_H_ */
diff --git a/sys/kern/kern_exec.c b/sys/kern/kern_exec.c
index b3d847c..28b4fd5 100644
--- a/sys/kern/kern_exec.c
+++ b/sys/kern/kern_exec.c
@@ -27,6 +27,8 @@
  * $DragonFly: src/sys/kern/kern_exec.c,v 1.64 2008/10/26 04:29:19 sephe Exp $
  */
 
+#include "opt_hwpmc_hooks.h"
+
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/sysproto.h>
@@ -69,6 +71,10 @@
 #include <vm/vnode_pager.h>
 #include <vm/vm_pager.h>
 
+#ifdef	HWPMC_HOOKS
+#include <sys/pmckern.h>
+#endif
+
 #include <sys/user.h>
 #include <sys/reg.h>
 
@@ -187,6 +193,10 @@ kern_execve(struct nlookupdata *nd, struct image_args *args)
 	struct image_params image_params, *imgp;
 	struct vattr attr;
 	int (*img_first) (struct image_params *);
+	int credential_changing;
+#ifdef HWPMC_HOOKS
+	struct pmckern_procexec pe;
+#endif
 
 	if (debug_execve_args) {
 		kprintf("%s()\n", __func__);
@@ -387,6 +397,7 @@ interpret:
 		wakeup((caddr_t)p->p_pptr);
 	}
 
+	credential_changing = 0;
 	/*
 	 * Implement image setuid/setgid.
 	 *
@@ -402,6 +413,7 @@ interpret:
 		 * root.  Record any set-id flags first to make sure that
 		 * we do not regain any tracing during a possible block.
 		 */
+		credential_changing = !0;
 		setsugid();
 		if (p->p_tracenode && ktrace_suid == 0 &&
 		    priv_check(td, PRIV_ROOT) != 0) {
@@ -477,6 +489,23 @@ interpret:
 	/* clear "fork but no exec" flag, as we _are_ execing */
 	p->p_acflag &= ~AFORK;
 
+#ifdef	HWPMC_HOOKS
+	/*
+	 * Check if system-wide sampling is in effect or if the
+	 * current process is using PMCs.  If so, do exec() time
+	 * processing.  This processing needs to happen AFTER the
+	 * P_INEXEC flag is cleared.
+	 *
+	 * The proc lock needs to be released before taking the PMC
+	 * SX.
+	 */
+	if (PMC_SYSTEM_SAMPLING_ACTIVE() || PMC_PROC_IS_USING_PMCS(p)) {
+		pe.pm_credentialschanged = credential_changing;
+		pe.pm_entryaddr = imgp->entry_addr;
+
+		PMC_CALL_HOOK_X(td, PMC_FN_PROCESS_EXEC, (void *) &pe);
+	}
+#endif
 	/* Set values passed into the program in registers. */
 	exec_setregs(imgp->entry_addr, (u_long)(uintptr_t)stack_base,
 	    imgp->ps_strings);
diff --git a/sys/kern/kern_linker.c b/sys/kern/kern_linker.c
index 4c2ccc0..571f162 100644
--- a/sys/kern/kern_linker.c
+++ b/sys/kern/kern_linker.c
@@ -28,6 +28,7 @@
  */
 
 #include "opt_ddb.h"
+#include "opt_hwpmc_hooks.h"
 
 #include <sys/param.h>
 #include <sys/kernel.h>
@@ -55,6 +56,10 @@
 #include <dlfcn.h>
 #endif
 
+#ifdef HWPMC_HOOKS
+#include <sys/pmckern.h>
+#endif
+
 #ifdef KLD_DEBUG
 int kld_debug = 1;
 #endif
@@ -411,6 +416,20 @@ linker_find_file_by_id(int fileid)
     return lf;
 }
 
+static int
+linker_file_foreach(int (*predicate)(linker_file_t, void*), void *context)
+{
+	linker_file_t lf;
+	int retval = 0;
+
+	TAILQ_FOREACH(lf, &linker_files, link) {
+		retval = predicate(lf, context);
+		if (retval != 0)
+			break;
+	}
+	return (retval);
+}
+
 linker_file_t
 linker_make_file(const char* pathname, void* priv, struct linker_file_ops* ops)
 {
@@ -750,6 +769,9 @@ linker_ddb_symbol_values(c_linker_sym_t sym, linker_symval_t *symval)
 int
 sys_kldload(struct kldload_args *uap)
 {
+#ifdef HWPMC_HOOKS
+    struct pmckern_map_in pkm;
+#endif
     struct thread *td = curthread;
     char *file;
     char *kldname, *modname;
@@ -786,6 +808,11 @@ sys_kldload(struct kldload_args *uap)
     rel_mplock();
     if (error)
 	goto out;
+#ifdef HWPMC_HOOKS
+    pkm.pm_file = lf->filename;
+    pkm.pm_address = (uintptr_t) lf->address;
+    PMC_CALL_HOOK(td, PMC_FN_KLD_LOAD, (void *) &pkm);
+#endif
 
     lf->userrefs++;
     uap->sysmsg_result = lf->id;
@@ -802,6 +829,9 @@ out:
 int
 sys_kldunload(struct kldunload_args *uap)
 {
+#ifdef HWPMC_HOOKS
+    struct pmckern_map_out pkm;
+#endif
     struct thread *td = curthread;
     linker_file_t lf;
     int error = 0;
@@ -821,6 +851,11 @@ sys_kldunload(struct kldunload_args *uap)
 	    error = EBUSY;
 	    goto out;
 	}
+#ifdef HWPMC_HOOKS
+	/* Save data needed by hwpmc(4) before unloading. */
+	pkm.pm_address = (uintptr_t) lf->address;
+	pkm.pm_size = lf->size;
+#endif
 	lf->userrefs--;
 	error = linker_file_unload(lf);
 	if (error)
@@ -830,6 +865,12 @@ sys_kldunload(struct kldunload_args *uap)
     }
 out:
     rel_mplock();
+
+#ifdef HWPMC_HOOKS
+    if (error == 0)
+	PMC_CALL_HOOK(td, PMC_FN_KLD_UNLOAD, (void *) &pkm);
+#endif
+
     return error;
 }
 
@@ -1587,3 +1628,63 @@ linker_load_dependencies(linker_file_t lf)
     linker_addmodules(lf, start, stop, 0);
     return (error);
 }
+
+#ifdef HWPMC_HOOKS
+
+struct hwpmc_context {
+	int	nobjects;
+	int	nmappings;
+	struct pmckern_map_in *kobase;
+};
+
+static int
+linker_hwpmc_list_object(linker_file_t lf, void *arg)
+{
+	struct hwpmc_context *hc;
+
+	hc = arg;
+
+	/* If we run out of mappings, fail. */
+	if (hc->nobjects >= hc->nmappings)
+		return (1);
+
+	/* Save the info for this linker file. */
+	hc->kobase[hc->nobjects].pm_file = lf->filename;
+	hc->kobase[hc->nobjects].pm_address = (uintptr_t)lf->address;
+	hc->nobjects++;
+	return (0);
+}
+
+/*
+ * Inform hwpmc about the set of kernel modules currently loaded.
+ */
+void *
+linker_hwpmc_list_objects(void)
+{
+	struct hwpmc_context hc;
+
+	hc.nmappings = 15;	/* a reasonable default */
+
+ retry:
+	/* allocate nmappings+1 entries */
+	MALLOC(hc.kobase, struct pmckern_map_in *,
+	    (hc.nmappings + 1) * sizeof(struct pmckern_map_in), M_LINKER,
+	    M_WAITOK | M_ZERO);
+
+	hc.nobjects = 0;
+	if (linker_file_foreach(linker_hwpmc_list_object, &hc) != 0) {
+		hc.nmappings = hc.nobjects;
+		FREE(hc.kobase, M_LINKER);
+		goto retry;
+	}
+
+	KASSERT(hc.nobjects > 0, ("linker_hpwmc_list_objects: no kernel "
+		"objects?"));
+
+	/* The last entry of the malloced area comprises of all zeros. */
+	KASSERT(hc.kobase[hc.nobjects].pm_file == NULL,
+	    ("linker_hwpmc_list_objects: last object not NULL"));
+
+	return ((void *)hc.kobase);
+}
+#endif
diff --git a/sys/kern/kern_pmc.c b/sys/kern/kern_pmc.c
new file mode 100644
index 0000000..ff872d3
--- /dev/null
+++ b/sys/kern/kern_pmc.c
@@ -0,0 +1,107 @@
+/*-
+ * Copyright (c) 2003-2005, Joseph Koshy
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+/*__FBSDID("$FreeBSD: src/sys/kern/kern_pmc.c,v 1.6 2005/12/04 02:12:43 ru Exp $");*/
+
+#include "opt_hwpmc_hooks.h"
+
+#include <sys/lock.h>
+#include <sys/types.h>
+#include <sys/pmc.h>
+#include <sys/pmckern.h>
+
+#ifdef	HWPMC_HOOKS
+#define	PMC_KERNEL_VERSION	PMC_VERSION
+#else
+#define	PMC_KERNEL_VERSION	0
+#endif
+
+const int pmc_kernel_version = PMC_KERNEL_VERSION;
+
+/* Hook variable. */
+int (*pmc_hook)(struct thread *td, int function, void *arg) = NULL;
+
+/* Interrupt handler */
+int (*pmc_intr)(int cpu, uintptr_t pc, int usermode) = NULL;
+
+/* Bitmask of CPUs requiring servicing at hardclock time */
+volatile cpumask_t pmc_cpumask;
+
+/*
+ * A global count of SS mode PMCs.  When non-zero, this means that
+ * we have processes that are sampling the system as a whole.
+ */
+volatile int pmc_ss_count;
+
+/*
+ * Since PMC(4) may not be loaded in the current kernel, the
+ * convention followed is that a non-NULL value of 'pmc_hook' implies
+ * the presence of this kernel module.
+ *
+ * This requires us to protect 'pmc_hook' with a
+ * lockmgr lock -- thus making the process of calling into PMC(4)
+ * somewhat more expensive than a simple 'if' check and indirect call.
+ */
+struct lock pmc_lock;
+
+static void
+pmc_lock_init(void *arg)
+{
+	lockinit(&pmc_lock, "pmc-lock", 0, 0);
+}
+
+static void
+pmc_lock_uninit(void *arg)
+{
+	lockuninit(&pmc_lock);
+}
+
+SYSINIT(pmclock, SI_SUB_DRIVERS, SI_ORDER_FIRST, pmc_lock_init, 0);
+SYSUNINIT(pmclock, SI_SUB_DRIVERS, SI_ORDER_ANY, pmc_lock_uninit, 0);
+
+/*
+ * Helper functions
+ */
+
+int
+pmc_cpu_is_disabled(int cpu)
+{
+#ifdef	SMP
+	return ((hlt_cpus_mask & (1 << cpu)) != 0);
+#else
+	return 0;
+#endif
+}
+
+int
+pmc_cpu_is_logical(int cpu)
+{
+#ifdef	SMP
+	return ((logical_cpus_mask & (1 << cpu)) != 0);
+#else
+	return 0;
+#endif
+}
diff --git a/sys/kern/kern_subr.c b/sys/kern/kern_subr.c
index 4abceec..c917194 100644
--- a/sys/kern/kern_subr.c
+++ b/sys/kern/kern_subr.c
@@ -289,6 +289,17 @@ hashinit_ext(int elements, size_t size, struct malloc_type *type,
 	hashtbl = kmalloc((size_t)hashsize * size, type, M_WAITOK | M_ZERO);
 	*hashmask = hashsize - 1;
 	return (hashtbl);
+
+void
+hashdestroy(void *vhashtbl, struct malloc_type *type, u_long hashmask)
+{
+	LIST_HEAD(generic, generic) *hashtbl, *hp;
+
+	hashtbl = vhashtbl;
+	for (hp = hashtbl; hp <= &hashtbl[hashmask]; hp++)
+		if (!LIST_EMPTY(hp))
+			panic("hashdestroy: hash not empty");
+	kfree(hashtbl, type);
 }
 
 static int primes[] = { 1, 13, 31, 61, 127, 251, 509, 761, 1021, 1531, 2039,
diff --git a/sys/kern/kern_timeout.c b/sys/kern/kern_timeout.c
index 279431a..0fdd7ca 100644
--- a/sys/kern/kern_timeout.c
+++ b/sys/kern/kern_timeout.c
@@ -99,6 +99,9 @@
  * The per-cpu augmentation was done by Matthew Dillon.
  */
 
+#include "opt_hwpmc_hooks.h"
+#include "opt_ddb.h"
+
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/callout.h>
@@ -109,6 +112,10 @@
 #include <sys/thread2.h>
 #include <sys/mplock2.h>
 
+#ifdef HWPMC_HOOKS
+#include <sys/pmckern.h>
+#endif
+
 #ifndef MAX_SOFTCLOCK_STEPS
 #define MAX_SOFTCLOCK_STEPS 100 /* Maximum allowed value of steps. */
 #endif
@@ -216,6 +223,13 @@ hardclock_softtick(globaldata_t gd)
 	++sc->curticks;
 	if (sc->isrunning)
 		return;
+#ifdef	HWPMC_HOOKS
+	/*
+	 * XXX: does hook sleep? is that ok here? -- agg
+	 */
+	if (PMC_CPU_HAS_SAMPLES(mycpu->gd_cpuid))
+		PMC_CALL_HOOK_UNLOCKED(curthread, PMC_FN_DO_SAMPLES, NULL);
+#endif
 	if (sc->softticks == sc->curticks) {
 		/*
 		 * in sync, only wakeup the thread if there is something to
diff --git a/sys/kern/lwkt_thread.c b/sys/kern/lwkt_thread.c
index 0c7dd6b..9e0a497 100644
--- a/sys/kern/lwkt_thread.c
+++ b/sys/kern/lwkt_thread.c
@@ -39,6 +39,12 @@
  * scheduling is queued via (async) IPIs.
  */
 
+#ifdef _KERNEL
+
+#include "opt_hwpmc_hooks.h"
+
+#endif
+
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/kernel.h>
@@ -85,6 +91,12 @@ KTR_INFO(KTR_CTXSW, ctxsw, deadtd, 3, "#threads[%p].name = <dead>", sizeof (stru
 
 static MALLOC_DEFINE(M_THREAD, "thread", "lwkt threads");
 
+#ifdef HWPMC_HOOKS
+#include <sys/pmckern.h>
+#endif
+
+static int untimely_switch = 0;
+
 #ifdef	INVARIANTS
 static int panic_on_cscount = 0;
 #endif
@@ -773,7 +785,15 @@ using_idle_thread:
     }
 #endif
 	KTR_LOG(ctxsw_sw, gd->gd_cpuid, ntd);
+#ifdef	HWPMC_HOOKS
+	if (td->td_proc && PMC_PROC_IS_USING_PMCS(td->td_proc))
+	    PMC_SWITCH_CONTEXT(td, PMC_FN_CSW_OUT);
+#endif
 	td->td_switch(ntd);
+#ifdef	HWPMC_HOOKS
+	if (td->td_proc && PMC_PROC_IS_USING_PMCS(td->td_proc))
+	    PMC_SWITCH_CONTEXT(td, PMC_FN_CSW_IN);
+#endif
     }
     /* NOTE: current cpu may have changed after switch */
     crit_exit_quick(td);
diff --git a/sys/platform/pc32/Makefile.inc b/sys/platform/pc32/Makefile.inc
index 86d5ccc..c170d3a 100644
--- a/sys/platform/pc32/Makefile.inc
+++ b/sys/platform/pc32/Makefile.inc
@@ -2,7 +2,7 @@
 #
 # $DragonFly: src/sys/platform/pc32/Makefile.inc,v 1.5 2007/01/30 14:50:11 corecode Exp $
 
-DEV_SUPPORT=	acpica5 agp bridge crypto disk drm est misc netif \
+DEV_SUPPORT=	acpica5 agp bridge crypto disk drm est hwpmc misc netif \
 		pccard powermng raid serial sound usbmisc video
 
 SYSCONS_APM_SUPPORT=1
diff --git a/sys/platform/pc32/apic/apic_abi.c b/sys/platform/pc32/apic/apic_abi.c
index a6efefe..ae59e9c 100644
--- a/sys/platform/pc32/apic/apic_abi.c
+++ b/sys/platform/pc32/apic/apic_abi.c
@@ -40,6 +40,8 @@
  * $DragonFly: src/sys/platform/pc32/apic/apic_abi.c,v 1.12 2007/04/30 16:45:55 dillon Exp $
  */
 
+#include "opt_hwpmc_hooks.h"
+
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/kernel.h>
@@ -190,6 +192,11 @@ apic_finalize(void)
     temp = lapic.lvt_lint1;
     temp &= ~APIC_LVT_MASKED;
     lapic.lvt_lint1 = temp;
+#ifdef	HWPMC_HOOKS
+	/* Program the PMC LVT entry if present. */
+    if (((lapic->version & APIC_VER_MAXLVT) >> MAXLVTSHIFT) >= LVT_PMC)
+	lapic->lvt_pcint = lvt_mode(la, LVT_PMC, lapic->lvt_pcint);
+#endif
 
     if (bootverbose)
 	apic_dump("bsp_apic_configure()");
diff --git a/sys/platform/pc32/apic/mpapic.c b/sys/platform/pc32/apic/mpapic.c
index 4813912..bef22cd 100644
--- a/sys/platform/pc32/apic/mpapic.c
+++ b/sys/platform/pc32/apic/mpapic.c
@@ -26,6 +26,8 @@
  * $DragonFly: src/sys/platform/pc32/apic/mpapic.c,v 1.22 2008/04/20 13:44:26 swildner Exp $
  */
 
+#include "opt_hwpmc_hooks.h"
+
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/kernel.h>
@@ -130,6 +132,11 @@ apic_initialize(boolean_t bsp)
 		  APIC_LVT_POLARITY_MASK | APIC_LVT_DM_MASK);
 	temp |= APIC_LVT_MASKED | APIC_LVT_DM_NMI;
 	lapic.lvt_lint1 = temp;
+#ifdef	HWPMC_HOOKS
+	/* Program the PMC LVT entry if present. */
+	if (((lapic->version & APIC_VER_MAXLVT) >> MAXLVTSHIFT) >= LVT_PMC)
+		lapic->lvt_pcint = lvt_mode(la, LVT_PMC, lapic->lvt_pcint);
+#endif
 
 	/*
 	 * Mask the apic error interrupt, apic performance counter
@@ -398,7 +405,6 @@ apic_dump(char* str)
 		lapic.lvt_lint0, lapic.lvt_lint1, lapic.tpr, lapic.svr);
 }
 
-
 #if defined(APIC_IO)
 
 /*
diff --git a/sys/platform/pc32/conf/files b/sys/platform/pc32/conf/files
index aed5ab7..5ee9b27 100644
--- a/sys/platform/pc32/conf/files
+++ b/sys/platform/pc32/conf/files
@@ -98,6 +98,11 @@ dev/crypto/glxsb/glxsb.c		optional	glxsb
 dev/crypto/glxsb/glxsb_hash.c		optional	glxsb
 dev/netif/ed/if_ed_isa.c		optional	ed isa
 bus/eisa/eisaconf.c			optional	eisa
+dev/hwpmc/hwpmc_amd.c			optional	hwpmc
+dev/hwpmc/hwpmc_pentium.c		optional	hwpmc
+dev/hwpmc/hwpmc_piv.c			optional	hwpmc
+dev/hwpmc/hwpmc_ppro.c			optional	hwpmc
+dev/hwpmc/hwpmc_x86.c			optional	hwpmc
 dev/video/fb/fb.c			optional	fb
 dev/video/fb/fb.c			optional	vga
 dev/video/fb/splash.c			optional	splash
diff --git a/sys/platform/pc32/i386/machdep.c b/sys/platform/pc32/i386/machdep.c
index 171b029..8568907 100644
--- a/sys/platform/pc32/i386/machdep.c
+++ b/sys/platform/pc32/i386/machdep.c
@@ -2541,6 +2541,18 @@ outb(u_int port, u_char data)
 
 #endif /* DDB */
 
+#include <machine_base/apic/apicreg.h>
+
+void
+lapic_enable_pmc_interrupt(void)
+{
+	uint32_t value;
+
+	value =  lapic->lvt_pcint;
+	value &= ~APIC_LVT_MASKED;
+	lapic->lvt_pcint = value;
+}
+
 
 
 #include "opt_cpu.h"
diff --git a/sys/platform/pc32/i386/trap.c b/sys/platform/pc32/i386/trap.c
index e9b125d..9e187a7 100644
--- a/sys/platform/pc32/i386/trap.c
+++ b/sys/platform/pc32/i386/trap.c
@@ -48,6 +48,7 @@
 
 #include "opt_cpu.h"
 #include "opt_ddb.h"
+#include "opt_hwpmc_hooks.h"
 #include "opt_ktrace.h"
 #include "opt_clock.h"
 #include "opt_trap.h"
@@ -70,6 +71,9 @@
 #include <sys/ktrace.h>
 #endif
 #include <sys/ktr.h>
+#ifdef HWPMC_HOOKS
+#include <sys/pmckern.h>
+#endif
 #include <sys/upcall.h>
 #include <sys/vkernel.h>
 #include <sys/sysproto.h>
@@ -422,6 +426,20 @@ trap(struct trapframe *frame)
 	}
 #endif
 
+#ifdef	HWPMC_HOOKS
+	/*
+	 * CPU PMCs interrupt using an NMI so we check for that first.
+	 * If the HWPMC module is active, 'pmc_hook' will point to
+	 * the function to be called.  A return value of '1' from the
+	 * hook means that the NMI was handled by it and that we can
+	 * return immediately.
+	 */
+	if (type == T_NMI && pmc_intr &&
+	    (*pmc_intr)(mycpu->gd_cpuid, (uintptr_t) frame->tf_eip,
+		TRAPF_USERMODE(frame)))
+	    goto out;
+#endif
+
 	eva = 0;
 	++gd->gd_trap_nesting_level;
 	if (frame->tf_trapno == T_PAGEFLT) {
diff --git a/sys/platform/pc32/include/smp.h b/sys/platform/pc32/include/smp.h
index 028732d..894fa81 100644
--- a/sys/platform/pc32/include/smp.h
+++ b/sys/platform/pc32/include/smp.h
@@ -16,6 +16,8 @@
 
 #ifdef _KERNEL
 
+#include <machine_base/apic/apicreg.h>
+
 #if defined(SMP)
 
 #ifndef LOCORE
@@ -35,7 +37,6 @@ extern int current_postcode;  /** XXX currently in mp_machdep.c */
 			outb(0x80, current_postcode)
 
 
-#include <machine_base/apic/apicreg.h>
 #include <machine/pcb.h>
 
 /* global data in mpboot.s */
@@ -166,9 +167,12 @@ extern cpumask_t		smp_active_mask;
 #endif /* !LOCORE */
 #else	/* !SMP */
 
+extern volatile lapic_t *lapic;
 #define	smp_active_mask	1	/* smp_active_mask always 1 on UP machines */
 
 #endif
 
+void	lapic_enable_pmc_interrupt(void);
+
 #endif /* _KERNEL */
 #endif /* _MACHINE_SMP_H_ */
diff --git a/sys/sys/linker.h b/sys/sys/linker.h
index 04ff770..4691d2e 100644
--- a/sys/sys/linker.h
+++ b/sys/sys/linker.h
@@ -245,6 +245,9 @@ int linker_ddb_search_symbol(caddr_t _value, c_linker_sym_t *_sym,
 int linker_ddb_symbol_values(c_linker_sym_t _sym, linker_symval_t *_symval);
 
 
+/* HWPMC helper */
+void *linker_hwpmc_list_objects(void);
+
 #endif	/* _KERNEL */
 
 /*
diff --git a/sys/sys/pmc.h b/sys/sys/pmc.h
new file mode 100644
index 0000000..4805794
--- /dev/null
+++ b/sys/sys/pmc.h
@@ -0,0 +1,1008 @@
+/*-
+ * Copyright (c) 2003-2006, Joseph Koshy
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD: src/sys/sys/pmc.h,v 1.11 2006/03/28 16:20:29 jkoshy Exp $
+ */
+
+#ifndef _SYS_PMC_H_
+#define	_SYS_PMC_H_
+
+#include <dev/misc/hwpmc/pmc_events.h>
+#include <sys/sysmsg.h>
+
+#include <machine/pmc_mdep.h>
+#include <machine/profile.h>
+
+#define	PMC_MODULE_NAME		"hwpmc"
+#define	PMC_NAME_MAX		16 /* HW counter name size */
+#define	PMC_CLASS_MAX		4  /* #classes of PMCs in a system */
+
+/*
+ * Kernel<->userland API version number [MMmmpppp]
+ *
+ * Major numbers are to be incremented when an incompatible change to
+ * the ABI occurs that older clients will not be able to handle.
+ *
+ * Minor numbers are incremented when a backwards compatible change
+ * occurs that allows older correct programs to run unchanged.  For
+ * example, when support for a new PMC type is added.
+ *
+ * The patch version is incremented for every bug fix.
+ */
+#define	PMC_VERSION_MAJOR	0x02
+#define	PMC_VERSION_MINOR	0x00
+#define	PMC_VERSION_PATCH	0x0000
+
+#define	PMC_VERSION		(PMC_VERSION_MAJOR << 24 |		\
+	PMC_VERSION_MINOR << 16 | PMC_VERSION_PATCH)
+
+/*
+ * Kinds of CPUs known
+ */
+
+#define	__PMC_CPUS()					\
+	__PMC_CPU(AMD_K7,     "AMD K7")			\
+	__PMC_CPU(AMD_K8,     "AMD K8")			\
+	__PMC_CPU(INTEL_P5,   "Intel Pentium")		\
+	__PMC_CPU(INTEL_P6,   "Intel Pentium Pro")	\
+	__PMC_CPU(INTEL_CL,   "Intel Celeron")		\
+	__PMC_CPU(INTEL_PII,  "Intel Pentium II")	\
+	__PMC_CPU(INTEL_PIII, "Intel Pentium III")	\
+	__PMC_CPU(INTEL_PM,   "Intel Pentium M")	\
+	__PMC_CPU(INTEL_PIV,  "Intel Pentium IV")
+
+enum pmc_cputype {
+#undef	__PMC_CPU
+#define	__PMC_CPU(S,D)	PMC_CPU_##S ,
+	__PMC_CPUS()
+};
+
+#define	PMC_CPU_FIRST	PMC_CPU_AMD_K7
+#define	PMC_CPU_LAST	PMC_CPU_INTEL_PIV
+
+/*
+ * Classes of PMCs
+ */
+
+#define	__PMC_CLASSES()							\
+	__PMC_CLASS(TSC)	/* CPU Timestamp counter */		\
+	__PMC_CLASS(K7)		/* AMD K7 performance counters */	\
+	__PMC_CLASS(K8)		/* AMD K8 performance counters */	\
+	__PMC_CLASS(P5)		/* Intel Pentium counters */		\
+	__PMC_CLASS(P6)		/* Intel Pentium Pro counters */	\
+	__PMC_CLASS(P4)		/* Intel Pentium-IV counters */
+
+enum pmc_class {
+#undef  __PMC_CLASS
+#define	__PMC_CLASS(N)	PMC_CLASS_##N ,
+	__PMC_CLASSES()
+};
+
+#define	PMC_CLASS_FIRST	PMC_CLASS_TSC
+#define	PMC_CLASS_LAST	PMC_CLASS_P4
+
+/*
+ * A PMC can be in the following states:
+ *
+ * Hardware states:
+ *   DISABLED   -- administratively prohibited from being used.
+ *   FREE       -- HW available for use
+ * Software states:
+ *   ALLOCATED  -- allocated
+ *   STOPPED    -- allocated, but not counting events
+ *   RUNNING    -- allocated, and in operation; 'pm_runcount'
+ *                 holds the number of CPUs using this PMC at
+ *                 a given instant
+ *   DELETED    -- being destroyed
+ */
+
+#define	__PMC_HWSTATES()			\
+	__PMC_STATE(DISABLED)			\
+	__PMC_STATE(FREE)
+
+#define	__PMC_SWSTATES()			\
+	__PMC_STATE(ALLOCATED)			\
+	__PMC_STATE(STOPPED)			\
+	__PMC_STATE(RUNNING)			\
+	__PMC_STATE(DELETED)
+
+#define	__PMC_STATES()				\
+	__PMC_HWSTATES()			\
+	__PMC_SWSTATES()
+
+enum pmc_state {
+#undef	__PMC_STATE
+#define	__PMC_STATE(S)	PMC_STATE_##S,
+	__PMC_STATES()
+	__PMC_STATE(MAX)
+};
+
+#define	PMC_STATE_FIRST	PMC_STATE_DISABLED
+#define	PMC_STATE_LAST	PMC_STATE_DELETED
+
+/*
+ * An allocated PMC may used as a 'global' counter or as a
+ * 'thread-private' one.  Each such mode of use can be in either
+ * statistical sampling mode or in counting mode.  Thus a PMC in use
+ *
+ * SS i.e., SYSTEM STATISTICAL  -- system-wide statistical profiling
+ * SC i.e., SYSTEM COUNTER      -- system-wide counting mode
+ * TS i.e., THREAD STATISTICAL  -- thread virtual, statistical profiling
+ * TC i.e., THREAD COUNTER      -- thread virtual, counting mode
+ *
+ * Statistical profiling modes rely on the PMC periodically delivering
+ * a interrupt to the CPU (when the configured number of events have
+ * been measured), so the PMC must have the ability to generate
+ * interrupts.
+ *
+ * In counting modes, the PMC counts its configured events, with the
+ * value of the PMC being read whenever needed by its owner process.
+ *
+ * The thread specific modes "virtualize" the PMCs -- the PMCs appear
+ * to be thread private and count events only when the profiled thread
+ * actually executes on the CPU.
+ *
+ * The system-wide "global" modes keep the PMCs running all the time
+ * and are used to measure the behaviour of the whole system.
+ */
+
+#define	__PMC_MODES()				\
+	__PMC_MODE(SS,	0)			\
+	__PMC_MODE(SC,	1)			\
+	__PMC_MODE(TS,	2)			\
+	__PMC_MODE(TC,	3)
+
+enum pmc_mode {
+#undef	__PMC_MODE
+#define	__PMC_MODE(M,N)	PMC_MODE_##M = N,
+	__PMC_MODES()
+};
+
+#define	PMC_MODE_FIRST	PMC_MODE_SS
+#define	PMC_MODE_LAST	PMC_MODE_TC
+
+#define	PMC_IS_COUNTING_MODE(mode)				\
+	((mode) == PMC_MODE_SC || (mode) == PMC_MODE_TC)
+#define	PMC_IS_SYSTEM_MODE(mode)				\
+	((mode) == PMC_MODE_SS || (mode) == PMC_MODE_SC)
+#define	PMC_IS_SAMPLING_MODE(mode)				\
+	((mode) == PMC_MODE_SS || (mode) == PMC_MODE_TS)
+#define	PMC_IS_VIRTUAL_MODE(mode)				\
+	((mode) == PMC_MODE_TS || (mode) == PMC_MODE_TC)
+
+/*
+ * PMC row disposition
+ */
+
+#define	__PMC_DISPOSITIONS(N)					\
+	__PMC_DISP(STANDALONE)	/* global/disabled counters */	\
+	__PMC_DISP(FREE)	/* free/available */		\
+	__PMC_DISP(THREAD)	/* thread-virtual PMCs */	\
+	__PMC_DISP(UNKNOWN)	/* sentinel */
+
+enum pmc_disp {
+#undef	__PMC_DISP
+#define	__PMC_DISP(D)	PMC_DISP_##D ,
+	__PMC_DISPOSITIONS()
+};
+
+#define	PMC_DISP_FIRST	PMC_DISP_STANDALONE
+#define	PMC_DISP_LAST	PMC_DISP_THREAD
+
+/*
+ * Counter capabilities
+ *
+ * __PMC_CAPS(NAME, VALUE, DESCRIPTION)
+ */
+
+#define	__PMC_CAPS()							\
+	__PMC_CAP(INTERRUPT,	0, "generate interrupts")		\
+	__PMC_CAP(USER,		1, "count user-mode events")		\
+	__PMC_CAP(SYSTEM,	2, "count system-mode events")		\
+	__PMC_CAP(EDGE,		3, "do edge detection of events")	\
+	__PMC_CAP(THRESHOLD,	4, "ignore events below a threshold")	\
+	__PMC_CAP(READ,		5, "read PMC counter")			\
+	__PMC_CAP(WRITE,	6, "reprogram PMC counter")		\
+	__PMC_CAP(INVERT,	7, "invert comparision sense")		\
+	__PMC_CAP(QUALIFIER,	8, "further qualify monitored events")	\
+	__PMC_CAP(PRECISE,	9, "perform precise sampling")		\
+	__PMC_CAP(TAGGING,	10, "tag upstream events")		\
+	__PMC_CAP(CASCADE,	11, "cascade counters")
+
+enum pmc_caps
+{
+#undef	__PMC_CAP
+#define	__PMC_CAP(NAME, VALUE, DESCR)	PMC_CAP_##NAME = (1 << VALUE) ,
+	__PMC_CAPS()
+};
+
+#define	PMC_CAP_FIRST		PMC_CAP_INTERRUPT
+#define	PMC_CAP_LAST		PMC_CAP_CASCADE
+
+/*
+ * PMC Event Numbers
+ *
+ * These are generated from the definitions in "dev/hwpmc/pmc_events.h".
+ */
+
+enum pmc_event {
+#undef	__PMC_EV
+#define	__PMC_EV(C,N,D) PMC_EV_ ## C ## _ ## N ,
+	__PMC_EVENTS()
+};
+
+#define	PMC_EVENT_FIRST	PMC_EV_TSC_TSC
+#define	PMC_EVENT_LAST	PMC_EV_P5_LAST
+
+/*
+ * PMC SYSCALL INTERFACE
+ */
+
+/*
+ * "PMC_OPS" -- these are the commands recognized by the kernel
+ * module, and are used when performing a system call from userland.
+ */
+
+#define	__PMC_OPS()							\
+	__PMC_OP(CONFIGURELOG, "Set log file")				\
+	__PMC_OP(FLUSHLOG, "Flush log file")				\
+	__PMC_OP(GETCPUINFO, "Get system CPU information")		\
+	__PMC_OP(GETDRIVERSTATS, "Get driver statistics")		\
+	__PMC_OP(GETMODULEVERSION, "Get module version")		\
+	__PMC_OP(GETPMCINFO, "Get per-cpu PMC information")		\
+	__PMC_OP(PMCADMIN, "Set PMC state")				\
+	__PMC_OP(PMCALLOCATE, "Allocate and configure a PMC")		\
+	__PMC_OP(PMCATTACH, "Attach a PMC to a process")		\
+	__PMC_OP(PMCDETACH, "Detach a PMC from a process")		\
+	__PMC_OP(PMCGETMSR, "Get a PMC's hardware address")		\
+	__PMC_OP(PMCRELEASE, "Release a PMC")				\
+	__PMC_OP(PMCRW, "Read/Set a PMC")				\
+	__PMC_OP(PMCSETCOUNT, "Set initial count/sampling rate")	\
+	__PMC_OP(PMCSTART, "Start a PMC")				\
+	__PMC_OP(PMCSTOP, "Start a PMC")				\
+	__PMC_OP(WRITELOG, "Write a cookie to the log file")
+
+enum pmc_ops {
+#undef	__PMC_OP
+#define	__PMC_OP(N, D)	PMC_OP_##N,
+	__PMC_OPS()
+};
+
+
+/*
+ * Flags used in operations on PMCs.
+ */
+
+#define	PMC_F_FORCE		0x00000001 /*OP ADMIN force operation */
+#define	PMC_F_DESCENDANTS	0x00000002 /*OP ALLOCATE track descendants */
+#define	PMC_F_LOG_PROCCSW	0x00000004 /*OP ALLOCATE track ctx switches */
+#define	PMC_F_LOG_PROCEXIT	0x00000008 /*OP ALLOCATE log proc exits */
+#define	PMC_F_NEWVALUE		0x00000010 /*OP RW write new value */
+#define	PMC_F_OLDVALUE		0x00000020 /*OP RW get old value */
+#define	PMC_F_KGMON		0x00000040 /*OP ALLOCATE kgmon(8) profiling */
+
+/* internal flags */
+#define	PMC_F_ATTACHED_TO_OWNER	0x00010000 /*attached to owner*/
+#define	PMC_F_NEEDS_LOGFILE	0x00020000 /*needs log file */
+#define	PMC_F_ATTACH_DONE	0x00040000 /*attached at least once */
+
+/*
+ * Cookies used to denote allocated PMCs, and the values of PMCs.
+ */
+
+typedef uint32_t	pmc_id_t;
+typedef uint64_t	pmc_value_t;
+
+#define	PMC_ID_INVALID		(~ (pmc_id_t) 0)
+
+/*
+ * PMC IDs have the following format:
+ *
+ * +--------+----------+-----------+-----------+
+ * |   CPU  | PMC MODE | PMC CLASS | ROW INDEX |
+ * +--------+----------+-----------+-----------+
+ *
+ * where each field is 8 bits wide.  Field 'CPU' is set to the
+ * requested CPU for system-wide PMCs or PMC_CPU_ANY for process-mode
+ * PMCs.  Field 'PMC MODE' is the allocated PMC mode.  Field 'PMC
+ * CLASS' is the class of the PMC.  Field 'ROW INDEX' is the row index
+ * for the PMC.
+ *
+ * The 'ROW INDEX' ranges over 0..NWPMCS where NHWPMCS is the total
+ * number of hardware PMCs on this cpu.
+ */
+
+
+#define	PMC_ID_TO_ROWINDEX(ID)	((ID) & 0xFF)
+#define	PMC_ID_TO_CLASS(ID)	(((ID) & 0xFF00) >> 8)
+#define	PMC_ID_TO_MODE(ID)	(((ID) & 0xFF0000) >> 16)
+#define	PMC_ID_TO_CPU(ID)	(((ID) & 0xFF000000) >> 24)
+#define	PMC_ID_MAKE_ID(CPU,MODE,CLASS,ROWINDEX)			\
+	((((CPU) & 0xFF) << 24) | (((MODE) & 0xFF) << 16) |	\
+	(((CLASS) & 0xFF) << 8) | ((ROWINDEX) & 0xFF))
+
+/*
+ * Data structures for system calls supported by the pmc driver.
+ */
+
+/*
+ * OP PMCALLOCATE
+ *
+ * Allocate a PMC on the named CPU.
+ */
+
+#define	PMC_CPU_ANY	~0
+
+struct pmc_op_pmcallocate {
+	uint32_t	pm_caps;	/* PMC_CAP_* */
+	uint32_t	pm_cpu;		/* CPU number or PMC_CPU_ANY */
+	enum pmc_class	pm_class;	/* class of PMC desired */
+	enum pmc_event	pm_ev;		/* [enum pmc_event] desired */
+	uint32_t	pm_flags;	/* additional modifiers PMC_F_* */
+	enum pmc_mode	pm_mode;	/* desired mode */
+	pmc_id_t	pm_pmcid;	/* [return] process pmc id */
+
+	union pmc_md_op_pmcallocate pm_md; /* MD layer extensions */
+};
+
+/*
+ * OP PMCADMIN
+ *
+ * Set the administrative state (i.e., whether enabled or disabled) of
+ * a PMC 'pm_pmc' on CPU 'pm_cpu'.  Note that 'pm_pmc' specifies an
+ * absolute PMC number and need not have been first allocated by the
+ * calling process.
+ */
+
+struct pmc_op_pmcadmin {
+	int		pm_cpu;		/* CPU# */
+	uint32_t	pm_flags;	/* flags */
+	int		pm_pmc;         /* PMC# */
+	enum pmc_state  pm_state;	/* desired state */
+};
+
+/*
+ * OP PMCATTACH / OP PMCDETACH
+ *
+ * Attach/detach a PMC and a process.
+ */
+
+struct pmc_op_pmcattach {
+	pmc_id_t	pm_pmc;		/* PMC to attach to */
+	pid_t		pm_pid;		/* target process */
+};
+
+/*
+ * OP PMCSETCOUNT
+ *
+ * Set the sampling rate (i.e., the reload count) for statistical counters.
+ * 'pm_pmcid' need to have been previously allocated using PMCALLOCATE.
+ */
+
+struct pmc_op_pmcsetcount {
+	pmc_value_t	pm_count;	/* initial/sample count */
+	pmc_id_t	pm_pmcid;	/* PMC id to set */
+};
+
+
+/*
+ * OP PMCRW
+ *
+ * Read the value of a PMC named by 'pm_pmcid'.  'pm_pmcid' needs
+ * to have been previously allocated using PMCALLOCATE.
+ */
+
+
+struct pmc_op_pmcrw {
+	uint32_t	pm_flags;	/* PMC_F_{OLD,NEW}VALUE*/
+	pmc_id_t	pm_pmcid;	/* pmc id */
+	pmc_value_t	pm_value;	/* new&returned value */
+};
+
+
+/*
+ * OP GETPMCINFO
+ *
+ * retrieve PMC state for a named CPU.  The caller is expected to
+ * allocate 'npmc' * 'struct pmc_info' bytes of space for the return
+ * values.
+ */
+
+struct pmc_info {
+	char		pm_name[PMC_NAME_MAX]; /* pmc name */
+	enum pmc_class	pm_class;	/* enum pmc_class */
+	int		pm_enabled;	/* whether enabled */
+	enum pmc_disp	pm_rowdisp;	/* FREE, THREAD or STANDLONE */
+	pid_t		pm_ownerpid;	/* owner, or -1 */
+	enum pmc_mode	pm_mode;	/* current mode [enum pmc_mode] */
+	enum pmc_event	pm_event;	/* current event */
+	uint32_t	pm_flags;	/* current flags */
+	pmc_value_t	pm_reloadcount;	/* sampling counters only */
+};
+
+struct pmc_op_getpmcinfo {
+	int32_t		pm_cpu;		/* 0 <= cpu < mp_maxid */
+	struct pmc_info	pm_pmcs[];	/* space for 'npmc' structures */
+};
+
+
+/*
+ * OP GETCPUINFO
+ *
+ * Retrieve system CPU information.
+ */
+
+struct pmc_classinfo {
+	enum pmc_class	pm_class; 	/* class id */
+	uint32_t	pm_caps;	/* counter capabilities */
+	uint32_t	pm_width;	/* width of the PMC */
+};
+
+struct pmc_op_getcpuinfo {
+	enum pmc_cputype pm_cputype; /* what kind of CPU */
+	uint32_t	pm_ncpu;    /* number of CPUs */
+	uint32_t	pm_npmc;    /* #PMCs per CPU */
+	uint32_t	pm_nclass;  /* #classes of PMCs */
+	struct pmc_classinfo  pm_classes[PMC_CLASS_MAX];
+};
+
+/*
+ * OP CONFIGURELOG
+ *
+ * Configure a log file for writing system-wide statistics to.
+ */
+
+struct pmc_op_configurelog {
+	int		pm_flags;
+	int		pm_logfd;   /* logfile fd (or -1) */
+};
+
+/*
+ * OP GETDRIVERSTATS
+ *
+ * Retrieve pmc(4) driver-wide statistics.
+ */
+
+struct pmc_op_getdriverstats {
+	int	pm_intr_ignored;	/* #interrupts ignored */
+	int	pm_intr_processed;	/* #interrupts processed */
+	int	pm_intr_bufferfull;	/* #interrupts with ENOSPC */
+	int	pm_syscalls;		/* #syscalls */
+	int	pm_syscall_errors;	/* #syscalls with errors */
+	int	pm_buffer_requests;	/* #buffer requests */
+	int	pm_buffer_requests_failed; /* #failed buffer requests */
+	int	pm_log_sweeps;		/* #sample buffer processing passes */
+};
+
+/*
+ * OP RELEASE / OP START / OP STOP
+ *
+ * Simple operations on a PMC id.
+ */
+
+struct pmc_op_simple {
+	pmc_id_t	pm_pmcid;
+};
+
+/*
+ * OP WRITELOG
+ *
+ * Flush the current log buffer and write 4 bytes of user data to it.
+ */
+
+struct pmc_op_writelog {
+	uint32_t	pm_userdata;
+};
+
+/*
+ * OP GETMSR
+ *
+ * Retrieve the machine specific address assoicated with the allocated
+ * PMC.  This number can be used subsequently with a read-performance-counter
+ * instruction.
+ */
+
+struct pmc_op_getmsr {
+	uint32_t	pm_msr;		/* machine specific address */
+	pmc_id_t	pm_pmcid;	/* allocated pmc id */
+};
+
+#ifdef _KERNEL
+
+#include <sys/malloc.h>
+#include <sys/sysctl.h>
+
+#define	PMC_HASH_SIZE				16
+#define	PMC_MTXPOOL_SIZE			32
+#define	PMC_LOG_BUFFER_SIZE			4
+#define	PMC_NLOGBUFFERS				16
+#define	PMC_NSAMPLES				32
+
+#define PMC_SYSCTL_NAME_PREFIX "kern." PMC_MODULE_NAME "."
+
+/*
+ * Locking keys
+ *
+ * (b) - pmc_bufferlist_mtx (spin lock)
+ * (k) - pmc_kthread_mtx (sleep lock)
+ * (o) - po->po_mtx (spin lock)
+ */
+
+/*
+ * PMC commands
+ */
+
+struct pmc_syscall_args {
+#ifdef _KERNEL
+	struct sysmsg sysmsg;
+#endif
+	uint32_t	pmop_code;	/* one of PMC_OP_* */
+	void		*pmop_data;	/* syscall parameter */
+};
+
+/*
+ * Interface to processor specific s1tuff
+ */
+
+/*
+ * struct pmc_descr
+ *
+ * Machine independent (i.e., the common parts) of a human readable
+ * PMC description.
+ */
+
+struct pmc_descr {
+	char		pd_name[PMC_NAME_MAX]; /* name */
+	uint32_t	pd_caps;	/* capabilities */
+	enum pmc_class	pd_class;	/* class of the PMC */
+	uint32_t	pd_width;	/* width in bits */
+};
+
+/*
+ * struct pmc_target
+ *
+ * This structure records all the target processes associated with a
+ * PMC.
+ */
+
+struct pmc_target {
+	LIST_ENTRY(pmc_target)	pt_next;
+	struct pmc_process	*pt_process; /* target descriptor */
+};
+
+/*
+ * struct pmc
+ *
+ * Describes each allocated PMC.
+ *
+ * Each PMC has precisely one owner, namely the process that allocated
+ * the PMC.
+ *
+ * A PMC may be attached to multiple target processes.  The
+ * 'pm_targets' field links all the target processes being monitored
+ * by this PMC.
+ *
+ * The 'pm_savedvalue' field is protected by a mutex.
+ *
+ * On a multi-cpu machine, multiple target threads associated with a
+ * process-virtual PMC could be concurrently executing on different
+ * CPUs.  The 'pm_runcount' field is atomically incremented every time
+ * the PMC gets scheduled on a CPU and atomically decremented when it
+ * get descheduled.  Deletion of a PMC is only permitted when this
+ * field is '0'.
+ *
+ */
+
+struct pmc {
+	struct spinlock		lock;		/* protects all fields */
+	LIST_HEAD(,pmc_target)	pm_targets;	/* list of target processes */
+	LIST_ENTRY(pmc)       	pm_next;	/* owner's list */
+
+	/*
+	 * System-wide PMCs are allocated on a CPU and are not moved
+	 * around.  For system-wide PMCs we record the CPU the PMC was
+	 * allocated on in the 'CPU' field of the pmc ID.
+	 *
+	 * Virtual PMCs run on whichever CPU is currently executing
+	 * their targets' threads.  For these PMCs we need to save
+	 * their current PMC counter values when they are taken off
+	 * CPU.
+	 */
+
+	union {
+		pmc_value_t	pm_savedvalue;	/* Virtual PMCS */
+	} pm_gv;
+
+	/*
+	 * For sampling mode PMCs, we keep track of the PMC's "reload
+	 * count", which is the counter value to be loaded in when
+	 * arming the PMC for the next counting session.  For counting
+	 * modes on PMCs that are read-only (e.g., the x86 TSC), we
+	 * keep track of the initial value at the start of
+	 * counting-mode operation.
+	 */
+
+	union {
+		pmc_value_t	pm_reloadcount;	/* sampling PMC modes */
+		pmc_value_t	pm_initial;	/* counting PMC modes */
+	} pm_sc;
+
+	uint32_t	pm_stalled;	/* true for stalled sampling PMCs */
+	uint32_t	pm_caps;	/* PMC capabilities */
+	enum pmc_event	pm_event;	/* event being measured */
+	uint32_t	pm_flags;	/* additional flags PMC_F_... */
+	struct pmc_owner *pm_owner;	/* owner thread state */
+	uint32_t	pm_runcount;	/* #cpus currently on */
+	enum pmc_state	pm_state;	/* current PMC state */
+
+	/*
+	 * The PMC ID field encodes the row-index for the PMC, its
+	 * mode, class and the CPU# associated with the PMC.
+	 */
+
+	pmc_id_t	pm_id; 		/* allocated PMC id */
+
+	/* md extensions */
+	union pmc_md_pmc	pm_md;
+};
+
+/*
+ * Accessor macros for 'struct pmc'
+ */
+
+#define	PMC_TO_MODE(P)		PMC_ID_TO_MODE((P)->pm_id)
+#define	PMC_TO_CLASS(P)		PMC_ID_TO_CLASS((P)->pm_id)
+#define	PMC_TO_ROWINDEX(P)	PMC_ID_TO_ROWINDEX((P)->pm_id)
+#define	PMC_TO_CPU(P)		PMC_ID_TO_CPU((P)->pm_id)
+
+/*
+ * struct pmc_process
+ *
+ * Record a 'target' process being profiled.
+ *
+ * The target process being profiled could be different from the owner
+ * process which allocated the PMCs.  Each target process descriptor
+ * is associated with NHWPMC 'struct pmc *' pointers.  Each PMC at a
+ * given hardware row-index 'n' will use slot 'n' of the 'pp_pmcs[]'
+ * array.  The size of this structure is thus PMC architecture
+ * dependent.
+ *
+ * TODO: Only process-private counting mode PMCs may be attached to a
+ * process different from the allocator process (since we do not have
+ * the infrastructure to make sense of an interrupted PC value from a
+ * 'target' process (yet)).
+ *
+ */
+
+struct pmc_targetstate {
+	struct pmc	*pp_pmc;   /* target PMC */
+	pmc_value_t	pp_pmcval; /* per-process value */
+};
+
+struct pmc_process {
+	LIST_ENTRY(pmc_process) pp_next;	/* hash chain */
+	int		pp_refcnt;		/* reference count */
+	uint32_t	pp_flags; 		/* flags PMC_PP_* */
+	struct proc	*pp_proc;		/* target thread */
+	struct pmc_targetstate pp_pmcs[];       /* NHWPMCs */
+};
+
+#define	PMC_PP_ENABLE_MSR_ACCESS	0x00000001
+
+/*
+ * struct pmc_owner
+ *
+ * We associate a PMC with an 'owner' process.
+ *
+ * A process can be associated with 0..NCPUS*NHWPMC PMCs during its
+ * lifetime, where NCPUS is the numbers of CPUS in the system and
+ * NHWPMC is the number of hardware PMCs per CPU.  These are
+ * maintained in the list headed by the 'po_pmcs' to save on space.
+ *
+ */
+
+struct pmc_owner  {
+	LIST_ENTRY(pmc_owner)	po_next;	/* hash chain */
+	LIST_ENTRY(pmc_owner)	po_ssnext;	/* list of SS PMC owners */
+	LIST_HEAD(, pmc)	po_pmcs;	/* owned PMC list */
+	TAILQ_HEAD(, pmclog_buffer) po_logbuffers; /* (o) logbuffer list */
+	struct spinlock		po_lock;		/* spin lock for (o) */
+	struct proc		*po_owner;	/* owner proc */
+	uint32_t		po_flags;	/* (k) flags PMC_PO_* */
+	struct thread		*po_kthread;	/* (k) helper kthread */
+	struct pmclog_buffer	*po_curbuf;	/* current log buffer */
+	struct file		*po_file;	/* file reference */
+	int			po_error;	/* recorded error */
+	int			po_sscount;	/* # SS PMCs owned */
+};
+
+#define	PMC_PO_OWNS_LOGFILE		0x00000001 /* has a log file */
+#define	PMC_PO_IN_FLUSH			0x00000010 /* in the middle of a flush */
+
+/*
+ * struct pmc_hw -- describe the state of the PMC hardware
+ *
+ * When in use, a HW PMC is associated with one allocated 'struct pmc'
+ * pointed to by field 'phw_pmc'.  When inactive, this field is NULL.
+ *
+ * On an SMP box, one or more HW PMC's in process virtual mode with
+ * the same 'phw_pmc' could be executing on different CPUs.  In order
+ * to handle this case correctly, we need to ensure that only
+ * incremental counts get added to the saved value in the associated
+ * 'struct pmc'.  The 'phw_save' field is used to keep the saved PMC
+ * value at the time the hardware is started during this context
+ * switch (i.e., the difference between the new (hardware) count and
+ * the saved count is atomically added to the count field in 'struct
+ * pmc' at context switch time).
+ *
+ */
+
+struct pmc_hw {
+	uint32_t	phw_state;	/* see PHW_* macros below */
+	struct pmc	*phw_pmc;	/* current thread PMC */
+};
+
+#define	PMC_PHW_RI_MASK		0x000000FF
+#define	PMC_PHW_CPU_SHIFT	8
+#define	PMC_PHW_CPU_MASK	0x0000FF00
+#define	PMC_PHW_FLAGS_SHIFT	16
+#define	PMC_PHW_FLAGS_MASK	0xFFFF0000
+
+#define	PMC_PHW_INDEX_TO_STATE(ri)	((ri) & PMC_PHW_RI_MASK)
+#define	PMC_PHW_STATE_TO_INDEX(state)	((state) & PMC_PHW_RI_MASK)
+#define	PMC_PHW_CPU_TO_STATE(cpu)	(((cpu) << PMC_PHW_CPU_SHIFT) & \
+	PMC_PHW_CPU_MASK)
+#define	PMC_PHW_STATE_TO_CPU(state)	(((state) & PMC_PHW_CPU_MASK) >> \
+	PMC_PHW_CPU_SHIFT)
+#define	PMC_PHW_FLAGS_TO_STATE(flags)	(((flags) << PMC_PHW_FLAGS_SHIFT) & \
+	PMC_PHW_FLAGS_MASK)
+#define	PMC_PHW_STATE_TO_FLAGS(state)	(((state) & PMC_PHW_FLAGS_MASK) >> \
+	PMC_PHW_FLAGS_SHIFT)
+#define	PMC_PHW_FLAG_IS_ENABLED		(PMC_PHW_FLAGS_TO_STATE(0x01))
+#define	PMC_PHW_FLAG_IS_SHAREABLE	(PMC_PHW_FLAGS_TO_STATE(0x02))
+
+/*
+ * struct pmc_sample
+ *
+ * Space for N (tunable) PC samples and associated control data.
+ */
+
+struct pmc_sample {
+	uintfptr_t		ps_pc;		/* PC value at interrupt */
+	struct pmc		*ps_pmc;	/* interrupting PMC */
+	int			ps_usermode;	/* true for user mode PCs */
+	pid_t			ps_pid;		/* process PID or -1 */
+};
+
+struct pmc_samplebuffer {
+	struct pmc_sample * volatile ps_read;	/* read pointer */
+	struct pmc_sample * volatile ps_write;	/* write pointer */
+	struct pmc_sample	*ps_fence;	/* one beyond ps_samples[] */
+	struct pmc_sample	ps_samples[];	/* array of sample entries */
+};
+
+
+/*
+ * struct pmc_cpustate
+ *
+ * A CPU is modelled as a collection of HW PMCs with space for additional
+ * flags.
+ */
+
+struct pmc_cpu {
+	uint32_t	pc_state;	/* physical cpu number + flags */
+	struct pmc_samplebuffer *pc_sb; /* space for samples */
+	struct pmc_hw	*pc_hwpmcs[];	/* 'npmc' pointers */
+	/* other machine dependent fields come here */
+};
+
+#define	PMC_PCPU_CPU_MASK		0x000000FF
+#define	PMC_PCPU_FLAGS_MASK		0xFFFFFF00
+#define	PMC_PCPU_FLAGS_SHIFT		8
+#define	PMC_PCPU_STATE_TO_CPU(S)	((S) & PMC_PCPU_CPU_MASK)
+#define	PMC_PCPU_STATE_TO_FLAGS(S)	(((S) & PMC_PCPU_FLAGS_MASK) >> PMC_PCPU_FLAGS_SHIFT)
+#define	PMC_PCPU_FLAGS_TO_STATE(F)	(((F) << PMC_PCPU_FLAGS_SHIFT) & PMC_PCPU_FLAGS_MASK)
+#define	PMC_PCPU_CPU_TO_STATE(C)	((C) & PMC_PCPU_CPU_MASK)
+#define	PMC_PCPU_FLAG_HTT		(PMC_PCPU_FLAGS_TO_STATE(0x1))
+
+/*
+ * struct pmc_binding
+ *
+ * CPU binding information.
+ */
+
+struct pmc_binding {
+	int	pb_bound;	/* is bound? */
+	int	pb_cpu;		/* if so, to which CPU */
+};
+
+/*
+ * struct pmc_mdep
+ *
+ * Machine dependent bits needed per CPU type.
+ */
+
+struct pmc_mdep  {
+	uint32_t	pmd_cputype;    /* from enum pmc_cputype */
+	uint32_t	pmd_npmc;	/* max PMCs per CPU */
+	uint32_t	pmd_nclass;	/* # PMC classes supported */
+	struct pmc_classinfo  pmd_classes[PMC_CLASS_MAX];
+	int		pmd_nclasspmcs[PMC_CLASS_MAX];
+
+	/*
+	 * Methods
+	 */
+
+	int (*pmd_init)(int _cpu);    /* machine dependent initialization */
+	int (*pmd_cleanup)(int _cpu); /* machine dependent cleanup  */
+
+	/* thread context switch in/out */
+	int (*pmd_switch_in)(struct pmc_cpu *_p, struct pmc_process *_pp);
+	int (*pmd_switch_out)(struct pmc_cpu *_p, struct pmc_process *_pp);
+
+	/* configuring/reading/writing the hardware PMCs */
+	int (*pmd_config_pmc)(int _cpu, int _ri, struct pmc *_pm);
+	int (*pmd_get_config)(int _cpu, int _ri, struct pmc **_ppm);
+	int (*pmd_read_pmc)(int _cpu, int _ri, pmc_value_t *_value);
+	int (*pmd_write_pmc)(int _cpu, int _ri, pmc_value_t _value);
+
+	/* pmc allocation/release */
+	int (*pmd_allocate_pmc)(int _cpu, int _ri, struct pmc *_t,
+		const struct pmc_op_pmcallocate *_a);
+	int (*pmd_release_pmc)(int _cpu, int _ri, struct pmc *_pm);
+
+	/* starting and stopping PMCs */
+	int (*pmd_start_pmc)(int _cpu, int _ri);
+	int (*pmd_stop_pmc)(int _cpu, int _ri);
+
+	/* handle a PMC interrupt */
+	int (*pmd_intr)(int _cpu, uintptr_t _pc, int _usermode);
+
+	int (*pmd_describe)(int _cpu, int _ri, struct pmc_info *_pi,
+		struct pmc **_ppmc);
+
+	int (*pmd_get_msr)(int _ri, uint32_t *_msr);
+
+};
+
+/*
+ * Per-CPU state.  This is an array of 'mp_ncpu' pointers
+ * to struct pmc_cpu descriptors.
+ */
+
+extern struct pmc_cpu **pmc_pcpu;
+extern struct pmc_mdep *md;
+
+/* driver statistics */
+extern struct pmc_op_getdriverstats pmc_stats;
+
+/* XXX: remove -- agg */
+#define DEBUG 1
+#if	defined(DEBUG) && DEBUG
+
+/* debug flags, major flag groups */
+struct pmc_debugflags {
+	int	pdb_CPU;
+	int	pdb_CSW;
+	int	pdb_LOG;
+	int	pdb_MDP;
+	int	pdb_MOD;
+	int	pdb_OWN;
+	int	pdb_PMC;
+	int	pdb_PRC;
+	int	pdb_SAM;
+};
+
+extern struct pmc_debugflags pmc_debugflags;
+
+#define	PMC_DEBUG_STRSIZE		128
+#define	PMC_DEBUG_DEFAULT_FLAGS		{ 0, 0, 0, 0, 0, 0, 0 }
+
+#define	PMCDBG(M,N,L,F,...) do {					\
+	if (pmc_debugflags.pdb_ ## M & (1 << PMC_DEBUG_MIN_ ## N))	\
+		kprintf(#M ":" #N ":" #L  ": " F "\n", __VA_ARGS__);	\
+} while (0)
+
+/* Major numbers */
+#define	PMC_DEBUG_MAJ_CPU		0 /* cpu switches */
+#define	PMC_DEBUG_MAJ_CSW		1 /* context switches */
+#define	PMC_DEBUG_MAJ_LOG		2 /* logging */
+#define	PMC_DEBUG_MAJ_MDP		3 /* machine dependent */
+#define	PMC_DEBUG_MAJ_MOD		4 /* misc module infrastructure */
+#define	PMC_DEBUG_MAJ_OWN		5 /* owner */
+#define	PMC_DEBUG_MAJ_PMC		6 /* pmc management */
+#define	PMC_DEBUG_MAJ_PRC		7 /* processes */
+#define	PMC_DEBUG_MAJ_SAM		8 /* sampling */
+
+/* Minor numbers */
+
+/* Common (8 bits) */
+#define	PMC_DEBUG_MIN_ALL		0 /* allocation */
+#define	PMC_DEBUG_MIN_REL		1 /* release */
+#define	PMC_DEBUG_MIN_OPS		2 /* ops: start, stop, ... */
+#define	PMC_DEBUG_MIN_INI		3 /* init */
+#define	PMC_DEBUG_MIN_FND		4 /* find */
+
+/* MODULE */
+#define	PMC_DEBUG_MIN_PMH 	       14 /* pmc_hook */
+#define	PMC_DEBUG_MIN_PMS	       15 /* pmc_syscall */
+
+/* OWN */
+#define	PMC_DEBUG_MIN_ORM		8 /* owner remove */
+#define	PMC_DEBUG_MIN_OMR		9 /* owner maybe remove */
+
+/* PROCESSES */
+#define	PMC_DEBUG_MIN_TLK		8 /* link target */
+#define	PMC_DEBUG_MIN_TUL		9 /* unlink target */
+#define	PMC_DEBUG_MIN_EXT	       10 /* process exit */
+#define	PMC_DEBUG_MIN_EXC	       11 /* process exec */
+#define	PMC_DEBUG_MIN_FRK	       12 /* process fork */
+#define	PMC_DEBUG_MIN_ATT	       13 /* attach/detach */
+#define	PMC_DEBUG_MIN_SIG	       14 /* signalling */
+
+/* CONTEXT SWITCHES */
+#define	PMC_DEBUG_MIN_SWI		8 /* switch in */
+#define	PMC_DEBUG_MIN_SWO		9 /* switch out */
+
+/* PMC */
+#define	PMC_DEBUG_MIN_REG		8 /* pmc register */
+#define	PMC_DEBUG_MIN_ALR		9 /* allocate row */
+
+/* MACHINE DEPENDENT LAYER */
+#define	PMC_DEBUG_MIN_REA		8 /* read */
+#define	PMC_DEBUG_MIN_WRI		9 /* write */
+#define	PMC_DEBUG_MIN_CFG	       10 /* config */
+#define	PMC_DEBUG_MIN_STA	       11 /* start */
+#define	PMC_DEBUG_MIN_STO	       12 /* stop */
+#define	PMC_DEBUG_MIN_INT	       13 /* interrupts */
+
+/* CPU */
+#define	PMC_DEBUG_MIN_BND	       	8 /* bind */
+#define	PMC_DEBUG_MIN_SEL		9 /* select */
+
+/* LOG */
+#define	PMC_DEBUG_MIN_GTB		8 /* get buf */
+#define	PMC_DEBUG_MIN_SIO		9 /* schedule i/o */
+#define	PMC_DEBUG_MIN_FLS	       10 /* flush */
+#define	PMC_DEBUG_MIN_SAM	       11 /* sample */
+
+#else
+#define	PMCDBG(M,N,L,F,...)		/* nothing */
+#endif
+
+/* declare a dedicated memory pool */
+MALLOC_DECLARE(M_PMC);
+
+/*
+ * Functions
+ */
+
+struct pmc_mdep *pmc_md_initialize(void);	/* MD init function */
+int	pmc_getrowdisp(int _ri);
+int	pmc_process_interrupt(int _cpu, struct pmc *_pm, uintfptr_t _pc,
+    int _usermode);
+
+#endif /* _KERNEL */
+#endif /* _SYS_PMC_H_ */
diff --git a/sys/sys/pmckern.h b/sys/sys/pmckern.h
new file mode 100644
index 0000000..8ef7861
--- /dev/null
+++ b/sys/sys/pmckern.h
@@ -0,0 +1,125 @@
+/*-
+ * Copyright (c) 2003-2006, Joseph Koshy
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD: src/sys/sys/pmckern.h,v 1.6 2006/03/26 12:20:54 jkoshy Exp $
+ */
+
+/*
+ * PMC interface used by the base kernel.
+ */
+
+#ifndef _SYS_PMCKERN_H_
+#define _SYS_PMCKERN_H_
+
+#include <sys/param.h>
+#include <sys/kernel.h>
+#include <sys/lock.h>
+#include <sys/proc.h>
+
+#define	PMC_FN_PROCESS_EXEC		1
+#define	PMC_FN_CSW_IN			2
+#define	PMC_FN_CSW_OUT			3
+#define	PMC_FN_DO_SAMPLES		4
+#define	PMC_FN_KLD_LOAD			5
+#define	PMC_FN_KLD_UNLOAD		6
+#define	PMC_FN_MMAP			7
+#define	PMC_FN_MUNMAP			8
+
+struct pmckern_procexec {
+	int		pm_credentialschanged;
+	uintfptr_t	pm_entryaddr;
+};
+
+struct pmckern_map_in {
+	void		*pm_file;	/* filename or vnode pointer */
+	uintfptr_t	pm_address;	/* address object is loaded at */
+};
+
+struct pmckern_map_out {
+	uintfptr_t	pm_address;	/* start address of region */
+	size_t		pm_size;	/* size of unmapped region */
+};
+
+/* hook */
+extern int (*pmc_hook)(struct thread *_td, int _function, void *_arg);
+extern int (*pmc_intr)(int _cpu, uintptr_t _pc, int _usermode);
+
+/* catch-all lock */
+extern struct lock pmc_lock;
+
+/* Per-cpu flags indicating availability of sampling data */
+extern volatile cpumask_t pmc_cpumask;
+
+/* Count of system-wide sampling PMCs in existence */
+extern volatile int pmc_ss_count;
+
+/* kernel version number */
+extern const int pmc_kernel_version;
+
+/* Hook invocation; for use within the kernel */
+#define	PMC_CALL_HOOK(t, cmd, arg)		\
+do {						\
+	lockmgr(&pmc_lock, LK_SHARED);		\
+	if (pmc_hook != NULL)			\
+		(pmc_hook)((t), (cmd), (arg));	\
+	lockmgr(&pmc_lock, LK_RELEASE);		\
+} while (0)
+
+/* Hook invocation that needs an exclusive lock */
+#define	PMC_CALL_HOOK_X(t, cmd, arg)		\
+do {						\
+	lockmgr(&pmc_lock, LK_EXCLUSIVE);	\
+	if (pmc_hook != NULL)			\
+		(pmc_hook)((t), (cmd), (arg));	\
+	lockmgr(&pmc_lock, LK_RELEASE);		\
+} while (0)
+
+/*
+ * Some hook invocations (e.g., from context switch and clock handling
+ * code) need to be lock-free.
+ */
+#define	PMC_CALL_HOOK_UNLOCKED(t, cmd, arg)	\
+do {						\
+	if (pmc_hook != NULL)			\
+		(pmc_hook)((t), (cmd), (arg));	\
+} while (0)
+
+#define	PMC_SWITCH_CONTEXT(t,cmd)	PMC_CALL_HOOK_UNLOCKED(t,cmd,NULL)
+
+/* Check if a process is using HWPMCs.*/
+#define PMC_PROC_IS_USING_PMCS(p)				\
+	(__predict_false(atomic_load_acq_int(&(p)->p_flag) &	\
+	    P_HWPMC))
+
+#define	PMC_SYSTEM_SAMPLING_ACTIVE()		(pmc_ss_count > 0)
+
+/* Check if a CPU has recorded samples. */
+#define	PMC_CPU_HAS_SAMPLES(C)	(__predict_false(pmc_cpumask & (1 << (C))))
+
+/* helper functions */
+int	pmc_cpu_is_disabled(int _cpu);
+int	pmc_cpu_is_logical(int _cpu);
+
+#endif /* _SYS_PMCKERN_H_ */
diff --git a/sys/sys/pmclog.h b/sys/sys/pmclog.h
new file mode 100644
index 0000000..67e9788
--- /dev/null
+++ b/sys/sys/pmclog.h
@@ -0,0 +1,247 @@
+/*-
+ * Copyright (c) 2005-2006, Joseph Koshy
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD: src/sys/sys/pmclog.h,v 1.4 2006/03/28 16:20:29 jkoshy Exp $
+ */
+
+#ifndef	_SYS_PMCLOG_H_
+#define	_SYS_PMCLOG_H_
+
+#include <sys/pmc.h>
+
+enum pmclog_type {
+	/* V1 ABI */
+	PMCLOG_TYPE_CLOSELOG,
+	PMCLOG_TYPE_DROPNOTIFY,
+	PMCLOG_TYPE_INITIALIZE,
+	PMCLOG_TYPE_MAPPINGCHANGE, /* unused in v1 */
+	PMCLOG_TYPE_PCSAMPLE,
+	PMCLOG_TYPE_PMCALLOCATE,
+	PMCLOG_TYPE_PMCATTACH,
+	PMCLOG_TYPE_PMCDETACH,
+	PMCLOG_TYPE_PROCCSW,
+	PMCLOG_TYPE_PROCEXEC,
+	PMCLOG_TYPE_PROCEXIT,
+	PMCLOG_TYPE_PROCFORK,
+	PMCLOG_TYPE_SYSEXIT,
+	PMCLOG_TYPE_USERDATA,
+	/*
+	 * V2 ABI
+	 *
+	 * The MAP_{IN,OUT} event types obsolete the MAPPING_CHANGE
+	 * event type of the older (V1) ABI.
+	 */
+	PMCLOG_TYPE_MAP_IN,
+	PMCLOG_TYPE_MAP_OUT
+};
+
+/*
+ * A log entry descriptor comprises of a 32 bit header and a 64 bit
+ * time stamp followed by as many 32 bit words are required to record
+ * the event.
+ *
+ * Header field format:
+ *
+ *  31           24           16                                   0
+ *   +------------+------------+-----------------------------------+
+ *   |    MAGIC   |    TYPE    |               LENGTH              |
+ *   +------------+------------+-----------------------------------+
+ *
+ * MAGIC 	is the constant PMCLOG_HEADER_MAGIC.
+ * TYPE  	contains a value of type enum pmclog_type.
+ * LENGTH	contains the length of the event record, in bytes.
+ */
+
+#define	PMCLOG_ENTRY_HEADER				\
+	uint32_t		pl_header;		\
+	uint32_t		pl_ts_sec;		\
+	uint32_t		pl_ts_nsec;
+
+
+/*
+ * The following structures are used to describe the size of each kind
+ * of log entry to sizeof().  To keep the compiler from adding
+ * padding, the fields of each structure are aligned to their natural
+ * boundaries, and the structures are marked as 'packed'.
+ *
+ * The actual reading and writing of the log file is always in terms
+ * of 4 byte quantities.
+ */
+
+struct pmclog_closelog {
+	PMCLOG_ENTRY_HEADER
+};
+
+struct pmclog_dropnotify {
+	PMCLOG_ENTRY_HEADER
+};
+
+struct pmclog_initialize {
+	PMCLOG_ENTRY_HEADER
+	uint32_t		pl_version;	/* driver version */
+	uint32_t		pl_cpu;		/* enum pmc_cputype */
+} __packed;
+
+struct pmclog_map_in {
+	PMCLOG_ENTRY_HEADER
+	uint32_t		pl_pid;
+	uintfptr_t		pl_start;	/* 8 byte aligned */
+	char			pl_pathname[PATH_MAX];
+} __packed;
+
+struct pmclog_map_out {
+	PMCLOG_ENTRY_HEADER
+	uint32_t		pl_pid;
+	uintfptr_t		pl_start;	/* 8 byte aligned */
+	uintfptr_t		pl_end;
+} __packed;
+
+struct pmclog_pcsample {
+	PMCLOG_ENTRY_HEADER
+	uint32_t		pl_pid;
+	uintfptr_t		pl_pc;		/* 8 byte aligned */
+	uint32_t		pl_pmcid;
+	uint32_t		pl_usermode;
+} __packed;
+
+struct pmclog_pmcallocate {
+	PMCLOG_ENTRY_HEADER
+	uint32_t		pl_pmcid;
+	uint32_t		pl_event;
+	uint32_t		pl_flags;
+} __packed;
+
+struct pmclog_pmcattach {
+	PMCLOG_ENTRY_HEADER
+	uint32_t		pl_pmcid;
+	uint32_t		pl_pid;
+	char			pl_pathname[PATH_MAX];
+} __packed;
+
+struct pmclog_pmcdetach {
+	PMCLOG_ENTRY_HEADER
+	uint32_t		pl_pmcid;
+	uint32_t		pl_pid;
+} __packed;
+
+struct pmclog_proccsw {
+	PMCLOG_ENTRY_HEADER
+	uint32_t		pl_pmcid;
+	uint64_t		pl_value;	/* keep 8 byte aligned */
+	uint32_t		pl_pid;
+} __packed;
+
+struct pmclog_procexec {
+	PMCLOG_ENTRY_HEADER
+	uint32_t		pl_pid;
+	uintfptr_t		pl_start;	/* keep 8 byte aligned */
+	uint32_t		pl_pmcid;
+	char			pl_pathname[PATH_MAX];
+} __packed;
+
+struct pmclog_procexit {
+	PMCLOG_ENTRY_HEADER
+	uint32_t		pl_pmcid;
+	uint64_t		pl_value;	/* keep 8 byte aligned */
+	uint32_t		pl_pid;
+} __packed;
+
+struct pmclog_procfork {
+	PMCLOG_ENTRY_HEADER
+	uint32_t		pl_oldpid;
+	uint32_t		pl_newpid;
+} __packed;
+
+struct pmclog_sysexit {
+	PMCLOG_ENTRY_HEADER
+	uint32_t		pl_pid;
+} __packed;
+
+struct pmclog_userdata {
+	PMCLOG_ENTRY_HEADER
+	uint32_t		pl_userdata;
+} __packed;
+
+union pmclog_entry {		/* only used to size scratch areas */
+	struct pmclog_closelog		pl_cl;
+	struct pmclog_dropnotify	pl_dn;
+	struct pmclog_initialize	pl_i;
+	struct pmclog_map_in		pl_mi;
+	struct pmclog_map_out		pl_mo;
+	struct pmclog_pcsample		pl_s;
+	struct pmclog_pmcallocate	pl_a;
+	struct pmclog_pmcattach		pl_t;
+	struct pmclog_pmcdetach		pl_d;
+	struct pmclog_proccsw		pl_c;
+	struct pmclog_procexec		pl_x;
+	struct pmclog_procexit		pl_e;
+	struct pmclog_procfork		pl_f;
+	struct pmclog_sysexit		pl_se;
+	struct pmclog_userdata		pl_u;
+};
+
+#define	PMCLOG_HEADER_MAGIC					0xEEU
+
+#define	PMCLOG_HEADER_TO_LENGTH(H)				\
+	((H) & 0x0000FFFF)
+#define	PMCLOG_HEADER_TO_TYPE(H)				\
+	(((H) & 0x00FF0000) >> 16)
+#define	PMCLOG_HEADER_TO_MAGIC(H)				\
+	(((H) & 0xFF000000) >> 24)
+#define	PMCLOG_HEADER_CHECK_MAGIC(H)				\
+	(PMCLOG_HEADER_TO_MAGIC(H) == PMCLOG_HEADER_MAGIC)
+
+#ifdef	_KERNEL
+
+/*
+ * Prototypes
+ */
+int	pmclog_configure_log(struct pmc_owner *_po, int _logfd);
+int	pmclog_deconfigure_log(struct pmc_owner *_po);
+int	pmclog_flush(struct pmc_owner *_po);
+void	pmclog_initialize(void);
+void	pmclog_process_closelog(struct pmc_owner *po);
+void	pmclog_process_dropnotify(struct pmc_owner *po);
+void	pmclog_process_map_in(struct pmc_owner *po, pid_t pid,
+    uintfptr_t start, const char *path);
+void	pmclog_process_map_out(struct pmc_owner *po, pid_t pid,
+    uintfptr_t start, uintfptr_t end);
+void	pmclog_process_pcsample(struct pmc *_pm, struct pmc_sample *_ps);
+void	pmclog_process_pmcallocate(struct pmc *_pm);
+void	pmclog_process_pmcattach(struct pmc *_pm, pid_t _pid, char *_path);
+void	pmclog_process_pmcdetach(struct pmc *_pm, pid_t _pid);
+void	pmclog_process_proccsw(struct pmc *_pm, struct pmc_process *_pp,
+    pmc_value_t _v);
+void	pmclog_process_procexec(struct pmc_owner *_po, pmc_id_t _pmid, pid_t _pid,
+    uintfptr_t _startaddr, char *_path);
+void	pmclog_process_procexit(struct pmc *_pm, struct pmc_process *_pp);
+void	pmclog_process_procfork(struct pmc_owner *_po, pid_t _oldpid, pid_t _newpid);
+void	pmclog_process_sysexit(struct pmc_owner *_po, pid_t _pid);
+int	pmclog_process_userlog(struct pmc_owner *_po,
+    struct pmc_op_writelog *_wl);
+void	pmclog_shutdown(void);
+#endif	/* _KERNEL */
+
+#endif	/* _SYS_PMCLOG_H_ */
diff --git a/sys/sys/proc.h b/sys/sys/proc.h
index 8d50470..a3a71f3 100644
--- a/sys/sys/proc.h
+++ b/sys/sys/proc.h
@@ -345,6 +345,7 @@ struct	proc {
 #define	P_WEXIT		0x02000	/* Working on exiting (master exit) */
 #define	P_EXEC		0x04000	/* Process called exec. */
 #define	P_CONTINUED	0x08000	/* Proc has continued from a stopped state. */
+#define	P_HWPMC		0x10000 /* Process is using HWPMCs */
 
 /* Should probably be changed into a hold count. */
 /* was	P_NOSWAP	0x08000	was: Do not swap upages; p->p_hold */
diff --git a/sys/sys/systm.h b/sys/sys/systm.h
index cd8abd1..c3eae65 100644
--- a/sys/sys/systm.h
+++ b/sys/sys/systm.h
@@ -149,6 +149,7 @@ void	mi_proc0init(struct globaldata *gd, struct user *proc0paddr);
 int	nullop (void);
 int	seltrue (cdev_t dev, int which);
 int	ureadc (int, struct uio *);
+void	hashdestroy(void *, struct malloc_type *, u_long);
 void	*hashinit (int count, struct malloc_type *type, u_long *hashmask);
 void	*phashinit (int count, struct malloc_type *type, u_long *nentries);
 void	*hashinit_ext (int count, size_t size,
diff --git a/sys/vm/vm_mmap.c b/sys/vm/vm_mmap.c
index 6c4c57b..03f79c5 100644
--- a/sys/vm/vm_mmap.c
+++ b/sys/vm/vm_mmap.c
@@ -46,6 +46,8 @@
  * Mapped file (mmap) interface to VM
  */
 
+#include "opt_hwpmc_hooks.h"
+
 #include <sys/param.h>
 #include <sys/kernel.h>
 #include <sys/systm.h>
@@ -78,6 +80,10 @@
 #include <vm/vm_page.h>
 #include <vm/vm_kern.h>
 
+#ifdef HWPMC_HOOKS
+#include <sys/pmckern.h>
+#endif
+
 #include <sys/file2.h>
 #include <sys/thread2.h>
 #include <sys/mplock2.h>
@@ -153,6 +159,10 @@ int
 kern_mmap(struct vmspace *vms, caddr_t uaddr, size_t ulen,
 	  int uprot, int uflags, int fd, off_t upos, void **res)
 {
+#ifdef HWPMC_HOOKS
+	struct pmckern_map_in pkm;
+	objtype_t handle_type;
+#endif
 	struct thread *td = curthread;
  	struct proc *p = td->td_proc;
 	struct file *fp = NULL;
@@ -261,6 +271,7 @@ kern_mmap(struct vmspace *vms, caddr_t uaddr, size_t ulen,
 		 * Mapping blank space is trivial.
 		 */
 		handle = NULL;
+		handle_type = OBJT_DEFAULT;
 		maxprot = VM_PROT_ALL;
 	} else {
 		/*
@@ -324,6 +335,7 @@ kern_mmap(struct vmspace *vms, caddr_t uaddr, size_t ulen,
 		 */
 		if (vp->v_type == VCHR && iszerodev(vp->v_rdev)) {
 			handle = NULL;
+			handle_type = OBJT_DEFAULT;
 			maxprot = VM_PROT_ALL;
 			flags |= MAP_ANON;
 			pos = 0;
@@ -382,6 +394,7 @@ kern_mmap(struct vmspace *vms, caddr_t uaddr, size_t ulen,
 				maxprot |= VM_PROT_WRITE;
 			}
 			handle = (void *)vp;
+			handle_type = OBJT_VNODE;
 		}
 	}
 
@@ -398,6 +411,15 @@ kern_mmap(struct vmspace *vms, caddr_t uaddr, size_t ulen,
 
 	error = vm_mmap(&vms->vm_map, &addr, size, prot, maxprot,
 			flags, handle, pos);
+#ifdef HWPMC_HOOKS
+	/* inform hwpmc(4) if an executable is being mapped */
+	if (error == 0 && handle_type == OBJT_VNODE &&
+	    (prot & PROT_EXEC)) {
+		pkm.pm_file = handle;
+		pkm.pm_address = (uintptr_t) addr;
+		PMC_CALL_HOOK(td, PMC_FN_MMAP, (void *) &pkm);
+	}
+#endif
 	if (error == 0)
 		*res = (void *)(addr + pageoff);
 done:
@@ -511,6 +533,10 @@ done:
 int
 sys_munmap(struct munmap_args *uap)
 {
+#ifdef HWPMC_HOOKS
+	struct pmckern_map_out pkm;
+	vm_map_entry_t entry;
+#endif
 	struct proc *p = curproc;
 	vm_offset_t addr;
 	vm_offset_t tmpaddr;
@@ -550,6 +576,26 @@ sys_munmap(struct munmap_args *uap)
 	if (!vm_map_check_protection(map, addr, addr + size, VM_PROT_NONE)) {
 		rel_mplock();
 		return (EINVAL);
+#ifdef HWPMC_HOOKS
+	/*
+	 * Inform hwpmc if the address range being unmapped contains
+	 * an executable region.
+	 */
+	if (vm_map_lookup_entry(map, addr, &entry)) {
+		for (;
+		     entry != &map->header && entry->start < addr + size;
+		     entry = entry->next) {
+			if (vm_map_check_protection(map, entry->start,
+				entry->end, VM_PROT_EXECUTE) == TRUE) {
+				pkm.pm_address = (uintptr_t) addr;
+				pkm.pm_size = (size_t) size;
+				PMC_CALL_HOOK(curthread, PMC_FN_MUNMAP,
+				    (void *) &pkm);
+				break;
+			}
+		}
+	}
+#endif
 	}
 	/* returns nothing but KERN_SUCCESS anyway */
 	vm_map_remove(map, addr, addr + size);
diff --git a/usr.sbin/pmccontrol/Makefile b/usr.sbin/pmccontrol/Makefile
new file mode 100644
index 0000000..2662704
--- /dev/null
+++ b/usr.sbin/pmccontrol/Makefile
@@ -0,0 +1,15 @@
+#
+# $FreeBSD: src/usr.sbin/pmccontrol/Makefile,v 1.2 2005-04-19 14:43:59 jkoshy Exp $
+#
+
+PROG=	pmccontrol
+MAN=	pmccontrol.8
+
+DPADD=	${LIBPMC}
+LDADD=	-lpmc
+
+WARNS?=	6
+
+SRCS=	pmccontrol.c
+
+.include <bsd.prog.mk>
diff --git a/usr.sbin/pmccontrol/pmccontrol.8 b/usr.sbin/pmccontrol/pmccontrol.8
new file mode 100644
index 0000000..13a206f
--- /dev/null
+++ b/usr.sbin/pmccontrol/pmccontrol.8
@@ -0,0 +1,127 @@
+.\" Copyright (c) 2003 Joseph Koshy.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\"
+.\" This software is provided by Joseph Koshy ``as is'' and
+.\" any express or implied warranties, including, but not limited to, the
+.\" implied warranties of merchantability and fitness for a particular purpose
+.\" are disclaimed.  in no event shall Joseph Koshy be liable
+.\" for any direct, indirect, incidental, special, exemplary, or consequential
+.\" damages (including, but not limited to, procurement of substitute goods
+.\" or services; loss of use, data, or profits; or business interruption)
+.\" however caused and on any theory of liability, whether in contract, strict
+.\" liability, or tort (including negligence or otherwise) arising in any way
+.\" out of the use of this software, even if advised of the possibility of
+.\" such damage.
+.\"
+.\" $FreeBSD: src/usr.sbin/pmccontrol/pmccontrol.8,v 1.2 2005-06-24 16:19:46 ru Exp $
+.\"
+.Dd December 15, 2003
+.Os
+.Dt PMCCONTROL 8
+.Sh NAME
+.Nm pmccontrol
+.Nd "control hardware performance monitoring counters"
+.Sh SYNOPSIS
+.Nm
+.Oo Fl c Ar cpu | Fl d Ar pmc | Fl e Ar pmc Oc ...
+.Nm
+.Fl l
+.Nm
+.Fl L
+.Nm
+.Fl s
+.Sh DESCRIPTION
+The
+.Nm
+utility controls the operation of the system's hardware performance
+monitoring counters.
+.Sh OPTIONS
+The
+.Nm
+utility processes options in command line order, so later options modify
+the effect of earlier ones.
+The following options are available:
+.Bl -tag -width indent
+.It Fl c Ar cpu
+Subsequent enable and disable options affect the CPU
+denoted by
+.Ar cpu .
+The argument
+.Ar cpu
+is either a number denoting a CPU number in the system, or the string
+.Dq Li * ,
+denoting all CPUs in the system.
+.It Fl d Ar pmc
+Disable PMC number
+.Ar pmc
+on the CPU specified by
+.Fl c ,
+preventing it from being used till subsequently re-enabled.
+The argument
+.Ar pmc
+is either a number denoting a specified PMC, or the string
+.Dq Li *
+denoting all the PMCs on the specified CPU.
+.Pp
+Only idle PMCs may be disabled.
+.\" XXX this probably needs to be fixed.
+.It Fl e Ar pmc
+Enable PMC number
+.Ar pmc ,
+on the CPU specified by
+.Fl c ,
+allowing it to be used in the future.
+The argument
+.Ar pmc
+is either a number denoting a specified PMC, or the string
+.Dq Li *
+denoting all the PMCs on the specified CPU.
+If PMC
+.Ar pmc
+is already enabled, this option has no effect.
+.It Fl l
+List available hardware performance counters and their current
+disposition.
+.It Fl L
+List available hardware performance counter classes and their
+supported event names.
+.It Fl s
+Print driver statistics maintained by
+.Xr hwpmc 4 .
+.El
+.Sh EXAMPLES
+To disable all PMCs on all CPUs, use the command:
+.Dl "pmccontrol -d*"
+.Pp
+To enable all PMCs on all CPUs, use:
+.Dl "pmccontrol -e*"
+.Pp
+To disable PMCs 0 and 1 on CPU 2, use:
+.Dl "pmccontrol -c2 -d0 -d1"
+.Pp
+To disable PMC 0 of CPU 0 only, and enable all other PMCS on all other
+CPUs, use:
+.Dl "pmccontrol -c* -e* -c0 -d0"
+.Sh DIAGNOSTICS
+.Ex -std
+.Sh SEE ALSO
+.Xr pmc 3 ,
+.Xr pmclog 3 ,
+.Xr hwpmc 4 ,
+.Xr pmcstat 8 ,
+.Xr sysctl 8
+.Sh HISTORY
+The
+.Nm
+utility first appeared in
+.Fx 6.0 .
+.Sh AUTHORS
+.An Joseph Koshy Aq jkoshy@FreeBSD.org
diff --git a/usr.sbin/pmccontrol/pmccontrol.c b/usr.sbin/pmccontrol/pmccontrol.c
new file mode 100644
index 0000000..593f81b
--- /dev/null
+++ b/usr.sbin/pmccontrol/pmccontrol.c
@@ -0,0 +1,480 @@
+/*-
+ * Copyright (c) 2003,2004 Joseph Koshy
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ */
+
+#include <sys/cdefs.h>
+/*__FBSDID("$FreeBSD: src/usr.sbin/pmccontrol/pmccontrol.c,v 1.6 2006-02-27 14:25:32 jkoshy Exp $");*/
+
+#include <sys/types.h>
+#include <sys/queue.h>
+#include <sys/sysctl.h>
+
+#include <assert.h>
+#include <err.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <limits.h>
+#include <pmc.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sysexits.h>
+#include <unistd.h>
+
+/* Compile time defaults */
+
+#define	PMCC_PRINT_USAGE	0
+#define	PMCC_PRINT_EVENTS	1
+#define	PMCC_LIST_STATE 	2
+#define	PMCC_ENABLE_DISABLE	3
+#define	PMCC_SHOW_STATISTICS	4
+
+#define	PMCC_CPU_ALL		-1
+#define	PMCC_CPU_WILDCARD	'*'
+
+#define	PMCC_PMC_ALL		-1
+#define	PMCC_PMC_WILDCARD	'*'
+
+#define	PMCC_OP_IGNORE		0
+#define	PMCC_OP_DISABLE		1
+#define	PMCC_OP_ENABLE		2
+
+#define	PMCC_PROGRAM_NAME	"pmccontrol"
+
+STAILQ_HEAD(pmcc_op_list, pmcc_op) head = STAILQ_HEAD_INITIALIZER(head);
+
+struct pmcc_op {
+	char	op_cpu;
+	char	op_pmc;
+	char	op_op;
+	STAILQ_ENTRY(pmcc_op) op_next;
+};
+
+/* Function Prototypes */
+#if	DEBUG
+static void	pmcc_init_debug(void);
+#endif
+
+static int	pmcc_do_list_state(void);
+static int	pmcc_do_enable_disable(struct pmcc_op_list *);
+static int	pmcc_do_list_events(void);
+
+/* Globals */
+
+static char usage_message[] =
+	"Usage:\n"
+	"       " PMCC_PROGRAM_NAME " -L\n"
+	"       " PMCC_PROGRAM_NAME " -l\n"
+	"       " PMCC_PROGRAM_NAME " -s\n"
+	"       " PMCC_PROGRAM_NAME " [-e pmc | -d pmc | -c cpu] ...";
+
+#if DEBUG
+FILE *debug_stream = NULL;
+#endif
+
+#if DEBUG
+#define DEBUG_MSG(...)					                \
+	(void) fprintf(debug_stream, "[pmccontrol] " __VA_ARGS__);
+#else
+#define DEBUG_MSG(m)		/*  */
+#endif /* !DEBUG */
+
+int pmc_syscall = -1;
+
+#define PMC_CALL(cmd, params)						\
+if ((error = syscall(pmc_syscall, PMC_OP_##cmd, (params))) != 0)	\
+{									\
+	DEBUG_MSG("ERROR: syscall [" #cmd "]");				\
+	exit(EX_OSERR);							\
+}
+
+#if DEBUG
+/* log debug messages to a separate file */
+static void
+pmcc_init_debug(void)
+{
+	char *fn;
+
+	fn = getenv("PMCCONTROL_DEBUG");
+	if (fn != NULL)
+	{
+		debug_stream = fopen(fn, "w");
+		if (debug_stream == NULL)
+			debug_stream = stderr;
+	} else
+		debug_stream = stderr;
+}
+#endif
+
+static int
+pmcc_do_enable_disable(struct pmcc_op_list *op_list)
+{
+	unsigned char op;
+	int c, error, i, j, ncpu, npmc, t;
+	int cpu, pmc;
+	struct pmcc_op *np;
+	unsigned char *map;
+
+	if ((ncpu = pmc_ncpu()) < 0)
+		err(EX_OSERR, "Unable to determine the number of cpus");
+
+	/* determine the maximum number of PMCs in any CPU */
+	npmc = 0;
+	for (c = 0; c < ncpu; c++) {
+		if ((t = pmc_npmc(c)) < 0)
+			err(EX_OSERR, "Unable to determine the number of PMCs in "
+			    "CPU %d", c);
+		npmc = t > npmc ? t : npmc;
+	}
+
+	if (npmc == 0)
+		errx(EX_CONFIG, "No PMCs found");
+
+	if ((map = malloc(npmc * ncpu)) == NULL)
+		err(EX_SOFTWARE, "Out of memory");
+
+	(void) memset(map, PMCC_OP_IGNORE, npmc*ncpu);
+
+	error = 0;
+	STAILQ_FOREACH(np, op_list, op_next) {
+
+		cpu = np->op_cpu;
+		pmc = np->op_pmc;
+		op  = np->op_op;
+
+		if (cpu >= ncpu)
+			errx(EX_DATAERR, "CPU id too large: \"%d\"", cpu);
+
+		if (pmc >= npmc)
+			errx(EX_DATAERR, "PMC id too large: \"%d\"", pmc);
+
+#define MARKMAP(M,C,P,V)	do {				\
+		*((M) + (C)*npmc + (P)) = (V);			\
+} while (0)
+
+#define	SET_PMCS(C,P,V)		do {				\
+		if ((P) == PMCC_PMC_ALL) {			\
+			for (j = 0; j < npmc; j++)		\
+				MARKMAP(map, (C), j, (V));	\
+		} else						\
+			MARKMAP(map, (C), (P), (V));		\
+} while (0)
+
+#define MAP(M,C,P)	(*((M) + (C)*npmc + (P)))
+
+		if (cpu == PMCC_CPU_ALL)
+			for (i = 0; i < ncpu; i++)
+				SET_PMCS(i, pmc, op);
+		else
+			SET_PMCS(cpu, pmc, op);
+	}
+
+	/* Configure PMCS */
+	for (i = 0; i < ncpu; i++)
+		for (j = 0; j < npmc; j++) {
+			unsigned char b;
+
+			b = MAP(map, i, j);
+
+			error = 0;
+
+			if (b == PMCC_OP_ENABLE)
+				error = pmc_enable(i, j);
+			else if (b == PMCC_OP_DISABLE)
+				error = pmc_disable(i, j);
+
+			if (error < 0)
+				err(EX_OSERR, "%s of PMC %d on CPU %d failed",
+				    b == PMCC_OP_ENABLE ? "Enable" :
+				    "Disable", j, i);
+		}
+
+	return error;
+}
+
+static int
+pmcc_do_list_state(void)
+{
+	size_t dummy;
+	int c, cpu, n, npmc, ncpu;
+	unsigned int logical_cpus_mask;
+	struct pmc_info *pd;
+	struct pmc_pmcinfo *pi;
+	const struct pmc_cpuinfo *pc;
+
+	if (pmc_cpuinfo(&pc) != 0)
+		err(EX_OSERR, "Unable to determine CPU information");
+
+	dummy = sizeof(logical_cpus_mask);
+	if (sysctlbyname("machdep.logical_cpus_mask", &logical_cpus_mask,
+		&dummy, NULL, 0) < 0)
+		logical_cpus_mask = 0;
+
+	ncpu = pc->pm_ncpu;
+
+	for (c = cpu = 0; cpu < ncpu; cpu++) {
+#if	defined(__i386__) || defined(__amd64__)
+		if (pc->pm_cputype == PMC_CPU_INTEL_PIV &&
+		    (logical_cpus_mask & (1 << cpu)))
+			continue; /* skip P4-style 'logical' cpus */
+#endif
+		if (pmc_pmcinfo(cpu, &pi) < 0)
+			err(EX_OSERR, "Unable to get PMC status for CPU %d",
+			    cpu);
+
+		printf("#CPU %d:\n", c++);
+		npmc = pmc_npmc(cpu);
+		printf("#N  NAME             CLASS  STATE    ROW-DISP\n");
+
+		for (n = 0; n < npmc; n++) {
+			pd = &pi->pm_pmcs[n];
+
+			printf(" %-2d %-16s %-6s %-8s %-10s",
+			    n,
+			    pd->pm_name,
+			    pmc_name_of_class(pd->pm_class),
+			    pd->pm_enabled ? "ENABLED" : "DISABLED",
+			    pmc_name_of_disposition(pd->pm_rowdisp));
+
+			if (pd->pm_ownerpid != -1) {
+			        printf(" (pid %d)", pd->pm_ownerpid);
+				printf(" %-32s",
+				    pmc_name_of_event(pd->pm_event));
+				if (PMC_IS_SAMPLING_MODE(pd->pm_mode))
+					printf(" (reload count %jd)",
+					    pd->pm_reloadcount);
+			}
+			printf("\n");
+		}
+		free(pi);
+	}
+	return 0;
+}
+
+static int
+pmcc_do_list_events(void)
+{
+	enum pmc_class c;
+	unsigned int i, j, nevents;
+	const char **eventnamelist;
+	const struct pmc_cpuinfo *ci;
+
+	if (pmc_cpuinfo(&ci) != 0)
+		err(EX_OSERR, "Unable to determine CPU information");
+
+	eventnamelist = NULL;
+
+	for (i = 0; i < ci->pm_nclass; i++) {
+		c = ci->pm_classes[i].pm_class;
+
+		printf("%s\n", pmc_name_of_class(c));
+		if (pmc_event_names_of_class(c, &eventnamelist, &nevents) < 0)
+			err(EX_OSERR, "ERROR: Cannot find information for "
+			    "event class \"%s\"", pmc_name_of_class(c));
+
+		for (j = 0; j < nevents; j++)
+			printf("\t%s\n", eventnamelist[j]);
+
+		free(eventnamelist);
+	}
+	return 0;
+}
+
+static int
+pmcc_show_statistics(void)
+{
+
+	struct pmc_driverstats gms;
+
+	if (pmc_get_driver_stats(&gms) < 0)
+		err(EX_OSERR, "ERROR: cannot retrieve driver statistics");
+
+	/*
+	 * Print statistics.
+	 */
+
+#define	PRINT(N,V)	(void) printf("%-40s %d\n", (N), gms.pm_##V)
+	PRINT("interrupts processed:", intr_processed);
+	PRINT("non-PMC interrupts:", intr_ignored);
+	PRINT("sampling stalls due to space shortages:", intr_bufferfull);
+	PRINT("system calls:", syscalls);
+	PRINT("system calls with errors:", syscall_errors);
+	PRINT("buffer requests:", buffer_requests);
+	PRINT("buffer requests failed:", buffer_requests_failed);
+	PRINT("sampling log sweeps:", log_sweeps);
+
+	return 0;
+}
+
+/*
+ * Main
+ */
+
+int
+main(int argc, char **argv)
+{
+	int error, command, currentcpu, option, pmc;
+	char *dummy;
+	struct pmcc_op *p;
+
+#if DEBUG
+	pmcc_init_debug();
+#endif
+
+	/* parse args */
+
+	currentcpu = PMCC_CPU_ALL;
+	command    = PMCC_PRINT_USAGE;
+	error      = 0;
+
+	STAILQ_INIT(&head);
+
+	while ((option = getopt(argc, argv, ":c:d:e:lLs")) != -1)
+		switch (option) {
+		case 'L':
+			if (command != PMCC_PRINT_USAGE) {
+				error = 1;
+				break;
+			}
+			command = PMCC_PRINT_EVENTS;
+			break;
+
+		case 'c':
+			if (command != PMCC_PRINT_USAGE &&
+			    command != PMCC_ENABLE_DISABLE) {
+				error = 1;
+				break;
+			}
+			command = PMCC_ENABLE_DISABLE;
+
+			if (*optarg == PMCC_CPU_WILDCARD)
+				currentcpu = PMCC_CPU_ALL;
+			else {
+				currentcpu = strtoul(optarg, &dummy, 0);
+				if (*dummy != '\0' || currentcpu < 0)
+					errx(EX_DATAERR,
+					    "\"%s\" is not a valid CPU id",
+					    optarg);
+			}
+			break;
+
+		case 'd':
+		case 'e':
+			if (command != PMCC_PRINT_USAGE &&
+			    command != PMCC_ENABLE_DISABLE) {
+				error = 1;
+				break;
+			}
+			command = PMCC_ENABLE_DISABLE;
+
+			if (*optarg == PMCC_PMC_WILDCARD)
+				pmc = PMCC_PMC_ALL;
+			else {
+				pmc = strtoul(optarg, &dummy, 0);
+				if (*dummy != '\0' || pmc < 0)
+					errx(EX_DATAERR,
+					    "\"%s\" is not a valid PMC id",
+					    optarg);
+			}
+
+			if ((p = malloc(sizeof(*p))) == NULL)
+				err(EX_SOFTWARE, "Out of memory");
+
+			p->op_cpu = currentcpu;
+			p->op_pmc = pmc;
+			p->op_op  = option == 'd' ? PMCC_OP_DISABLE :
+			    PMCC_OP_ENABLE;
+
+			STAILQ_INSERT_TAIL(&head, p, op_next);
+			break;
+
+		case 'l':
+			if (command != PMCC_PRINT_USAGE) {
+				error = 1;
+				break;
+			}
+			command = PMCC_LIST_STATE;
+			break;
+
+		case 's':
+			if (command != PMCC_PRINT_USAGE) {
+				error = 1;
+				break;
+			}
+			command = PMCC_SHOW_STATISTICS;
+			break;
+
+		case ':':
+			errx(EX_USAGE,
+			    "Missing argument to option '-%c'", optopt);
+			break;
+
+		case '?':
+			warnx("Unrecognized option \"-%c\"", optopt);
+			errx(EX_USAGE, usage_message);
+			break;
+
+		default:
+			error = 1;
+			break;
+
+		}
+
+	if (command == PMCC_PRINT_USAGE)
+		(void) errx(EX_USAGE, usage_message);
+
+	if (error)
+		exit(EX_USAGE);
+
+	if (pmc_init() < 0)
+		err(EX_UNAVAILABLE,
+		    "Initialization of the pmc(3) library failed");
+
+	switch (command) {
+	case PMCC_LIST_STATE:
+		error = pmcc_do_list_state();
+		break;
+	case PMCC_PRINT_EVENTS:
+		error = pmcc_do_list_events();
+		break;
+	case PMCC_SHOW_STATISTICS:
+		error = pmcc_show_statistics();
+		break;
+	case PMCC_ENABLE_DISABLE:
+		if (STAILQ_EMPTY(&head))
+			errx(EX_USAGE, "No PMCs specified to enable or disable");
+		error = pmcc_do_enable_disable(&head);
+		break;
+	default:
+		assert(0);
+
+	}
+
+	if (error != 0)
+		err(EX_OSERR, "Command failed");
+	exit(0);
+}
diff --git a/usr.sbin/pmcstat/Makefile b/usr.sbin/pmcstat/Makefile
new file mode 100644
index 0000000..89ecb44
--- /dev/null
+++ b/usr.sbin/pmcstat/Makefile
@@ -0,0 +1,15 @@
+#
+# $FreeBSD: src/usr.sbin/pmcstat/Makefile,v 1.4 2007-04-27 12:09:31 jkoshy Exp $
+#
+
+PROG=	pmcstat
+MAN=	pmcstat.8
+
+DPADD=	${LIBPMC} ${LIBM}
+LDADD=	-lkvm -lpmc -lm
+
+WARNS?=	6
+
+SRCS=	pmcstat.c pmcstat.h pmcstat_log.c
+
+.include <bsd.prog.mk>
diff --git a/usr.sbin/pmcstat/pmcstat.8 b/usr.sbin/pmcstat/pmcstat.8
new file mode 100644
index 0000000..8faa193
--- /dev/null
+++ b/usr.sbin/pmcstat/pmcstat.8
@@ -0,0 +1,328 @@
+.\" Copyright (c) 2003-2007 Joseph Koshy.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\"
+.\" This software is provided by Joseph Koshy ``as is'' and
+.\" any express or implied warranties, including, but not limited to, the
+.\" implied warranties of merchantability and fitness for a particular purpose
+.\" are disclaimed.  in no event shall Joseph Koshy be liable
+.\" for any direct, indirect, incidental, special, exemplary, or consequential
+.\" damages (including, but not limited to, procurement of substitute goods
+.\" or services; loss of use, data, or profits; or business interruption)
+.\" however caused and on any theory of liability, whether in contract, strict
+.\" liability, or tort (including negligence or otherwise) arising in any way
+.\" out of the use of this software, even if advised of the possibility of
+.\" such damage.
+.\"
+.\" $FreeBSD: src/usr.sbin/pmcstat/pmcstat.8,v 1.12 2007-04-27 12:09:31 jkoshy Exp $
+.\"
+.Dd April 23, 2007
+.Os
+.Dt PMCSTAT 8
+.Sh NAME
+.Nm pmcstat
+.Nd "performance measurement with performance monitoring hardware"
+.Sh SYNOPSIS
+.Nm
+.Op Fl C
+.Op Fl D Ar pathname
+.Op Fl E
+.Op Fl M Ar mapfilename
+.Op Fl O Ar logfilename
+.Op Fl P Ar event-spec
+.Op Fl R Ar logfilename
+.Op Fl S Ar event-spec
+.Op Fl W
+.Op Fl c Ar cpu-spec
+.Op Fl d
+.Op Fl g
+.Op Fl k Ar kerneldir
+.Op Fl n Ar rate
+.Op Fl o Ar outputfile
+.Op Fl p Ar event-spec
+.Op Fl q
+.Op Fl r Ar fsroot
+.Op Fl s Ar event-spec
+.Op Fl t Ar process-spec
+.Op Fl v
+.Op Fl w Ar secs
+.Op Ar command Op Ar args
+.Sh DESCRIPTION
+The
+.Nm
+utility measures system performance using the facilities provided by
+.Xr hwpmc 4 .
+.Pp
+The
+.Nm
+utility can measure both hardware events seen by the system as a
+whole, and those seen when a specified set of processes are executing
+on the system's CPUs.
+If a specific set of processes is being targeted (for example,
+if the
+.Fl t Ar process-spec
+option is specified, or if a command line is specified using
+.Ar command ) ,
+then measurement occurs till
+.Ar command
+exits, or till all target processes specified by the
+.Fl t Ar process-spec
+options exit, or till the
+.Nm
+utility is interrupted by the user.
+If a specific set of processes is not targeted for measurement, then
+.Nm
+will perform system-wide measurements till interrupted by the
+user.
+.Pp
+A given invocation of
+.Nm
+can mix allocations of system-mode and process-mode PMCs, of both
+counting and sampling flavors.
+The values of all counting PMCs are printed in human readable form
+at regular intervals by
+.Nm .
+The output of sampling PMCs may be configured to go to a log file for
+subsequent offline analysis, or, at the expense of greater
+overhead, may be configured to be printed in text form on the fly.
+.Pp
+Hardware events to measure are specified to
+.Nm
+using event specifier strings
+.Ar event-spec .
+The syntax of these event specifiers is machine dependent and is
+documented in
+.Xr pmc 3 .
+.Pp
+A process-mode PMC may be configured to be inheritable by the target
+process' current and future children.
+.Sh OPTIONS
+The following options are available:
+.Bl -tag -width indent
+.It Fl C
+Toggle between showing cumulative or incremental counts for
+subsequent counting mode PMCs specified on the command line.
+The default is to show incremental counts.
+.It Fl D Ar pathname
+Create files with per-program samples in the directory named
+by
+.Ar pathname .
+The default is to create these files in the current directory.
+.It Fl E
+Toggle showing per-process counts at the time a tracked process
+exits for subsequent process-mode PMCs specified on the command line.
+This option is useful for mapping the performance characteristics of a
+complex pipeline of processes when used in conjunction with the
+.Fl d
+option.
+The default is to not to enable per-process tracking.
+.It Fl M Ar mapfilename
+Write the mapping between executable objects encountered in the event
+log and the abbreviated pathnames used for
+.Xr gprof 1
+profiles to file
+.Ar mapfilename .
+If this option is not specified, mapping information is not written.
+Argument
+.Ar mapfilename
+may be a
+.Dq Li -
+in which case this mapping information is sent to the output
+file configured by the
+.Fl o
+option.
+.It Fl O Ar logfilename
+Send logging output to file
+.Ar logfilename .
+If
+.Ar logfilename
+is of the form
+.Ar hostname Ns : Ns Ar port ,
+where
+.Ar hostname
+does not start with a
+.Ql \&.
+or a
+.Ql / ,
+then
+.Nm
+will open a network socket to host
+.Ar hostname
+on port
+.Ar port .
+.Pp
+If the
+.Fl O
+option is not specified and one of the logging options is requested,
+then
+.Nm
+will print a textual form of the logged events to the configured
+output file.
+.It Fl P Ar event-spec
+Allocate a process mode sampling PMC measuring hardware events
+specified in
+.Ar event-spec .
+.It Fl R Ar logfilename
+Perform offline analysis using sampling data in file
+.Ar logfilename .
+.It Fl S Ar event-spec
+Allocate a system mode sampling PMC measuring hardware events
+specified in
+.Ar event-spec .
+.It Fl W
+Toggle logging the incremental counts seen by the threads of a
+tracked process each time they are scheduled on a CPU.
+This is an experimental feature intended to help analyse the
+dynamic behaviour of processes in the system.
+It may incur substantial overhead if enabled.
+The default is for this feature to be disabled.
+.It Fl c Ar cpu-spec
+Set the cpus for subsequent system mode PMCs specified on the
+command line to
+.Ar cpu-spec .
+Argument
+.Ar cpu-spec
+is a comma separated list of CPU numbers, or the literal
+.Sq *
+denoting all CPUs.
+The default is to allocate system mode PMCs on all CPUs.
+.It Fl d
+Toggle between process mode PMCs measuring events for the target
+process' current and future children or only measuring events for
+the target process.
+The default is to measure events for the target process alone.
+.It Fl g
+Produce flat execution profiles in a format compatible with
+.Xr gprof 1 .
+A separate profile file is generated for each executable object
+encountered.
+Profile files are placed in sub-directories named by their PMC
+event name.
+.It Fl k Ar kerneldir
+Set the pathname of the kernel directory to argument
+.Ar kerneldir .
+This directory specifies where
+.Nm
+should look for the kernel and its modules.
+The default is
+.Pa /boot/kernel .
+.It Fl n Ar rate
+Set the default sampling rate for subsequent sampling mode
+PMCs specified on the command line.
+The default is to configure PMCs to sample the CPU's instruction
+pointer every 65536 events.
+.It Fl o Ar outputfile
+Send counter readings and textual representations of logged data
+to file
+.Ar outputfile .
+The default is to send output to
+.Pa stderr .
+.It Fl p Ar event-spec
+Allocate a process mode counting PMC measuring hardware events
+specified in
+.Ar event-spec .
+.It Fl q
+Decrease verbosity.
+.It Fl r Ar fsroot
+Set the top of the filesystem hierarchy under which executables
+are located to argument
+.Ar fsroot .
+The default is
+.Pa / .
+.It Fl s Ar event-spec
+Allocate a system mode counting PMC measuring hardware events
+specified in
+.Ar event-spec .
+.It Fl t Ar process-spec
+Attach process mode PMCs to the processes named by argument
+.Ar process-spec .
+Argument
+.Ar process-spec
+may be a non-negative integer denoting a specific process id, or a
+regular expression for selecting processes based on their command names.
+.It Fl v
+Increase verbosity.
+.It Fl w Ar secs
+Print the values of all counting mode PMCs every
+.Ar secs
+seconds.
+The argument
+.Ar secs
+may be a fractional value.
+The default interval is 5 seconds.
+.El
+.Pp
+If
+.Ar command
+is specified, it is executed using
+.Xr execvp 3 .
+.Sh EXAMPLES
+To perform system-wide statistical sampling on an AMD Athlon CPU with
+samples taken every 32768 instruction retirals and data being sampled
+to file
+.Pa sample.stat ,
+use:
+.Dl "pmcstat -O sample.stat -n 32768 -S k7-retired-instructions"
+.Pp
+To execute
+.Nm mozilla
+and measure the number of data cache misses suffered
+by it and its children every 12 seconds on an AMD Athlon, use:
+.Dl "pmcstat -d -w 12 -p k7-dc-misses mozilla"
+.Pp
+To measure processor instructions retired for all processes named
+.Dq emacs
+use:
+.Dl "pmcstat -t '^emacs$' -p instructions"
+.Pp
+To count instruction tlb-misses on CPUs 0 and 2 on a Intel
+Pentium Pro/Pentium III SMP system use:
+.Dl "pmcstat -c 0,2 -s p6-itlb-miss"
+.Pp
+To perform system-wide sampling on all configured processors
+based on processor instructions retired use:
+.Dl "pmcstat -S instructions -O /tmp/sample.out"
+.Pp
+To send the generated event log to a remote machine use:
+.Dl "pmcstat -S instructions -O remotehost:port"
+On the remote machine, the sample log can be collected using
+.Xr nc 1 :
+.Dl "nc -l remotehost port > /tmp/sample.out"
+.Pp
+To generate
+.Xr gprof 1
+compatible flat profiles from a sample file use:
+.Dl "pmcstat -R /tmp/sample.out -g"
+.Sh DIAGNOSTICS
+.Ex -std
+.Sh SEE ALSO
+.Xr gprof 1 ,
+.Xr nc 1 ,
+.Xr execvp 3 ,
+.Xr pmc 3 ,
+.Xr pmclog 3 ,
+.Xr hwpmc 4 ,
+.Xr pmccontrol 8 ,
+.Xr sysctl 8
+.Sh HISTORY
+The
+.Nm
+utility first appeared in
+.Fx 6.0 .
+It is
+.Ud
+.Sh AUTHORS
+.An Joseph Koshy Aq jkoshy@FreeBSD.org
+.Sh BUGS
+The
+.Nm
+utility cannot yet analyse
+.Xr hwpmc 4
+logs generated by non-native architectures.
diff --git a/usr.sbin/pmcstat/pmcstat.c b/usr.sbin/pmcstat/pmcstat.c
new file mode 100644
index 0000000..0780c60
--- /dev/null
+++ b/usr.sbin/pmcstat/pmcstat.c
@@ -0,0 +1,1230 @@
+/*-
+ * Copyright (c) 2003-2007, Joseph Koshy
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+/*__FBSDID("$FreeBSD: src/usr.sbin/pmcstat/pmcstat.c,v 1.17 2007-04-27 12:09:31 jkoshy Exp $");*/
+
+#include <sys/types.h>
+#include <sys/event.h>
+#include <sys/param.h>
+#include <sys/queue.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
+#include <sys/sysctl.h>
+#include <sys/time.h>
+#include <sys/ttycom.h>
+#include <sys/user.h>
+#include <sys/wait.h>
+
+#include <assert.h>
+#include <err.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <kvm.h>
+#include <libgen.h>
+#include <limits.h>
+#include <math.h>
+#include <pmc.h>
+#include <pmclog.h>
+#include <regex.h>
+#include <signal.h>
+#include <stdarg.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sysexits.h>
+#include <unistd.h>
+
+#include "pmcstat.h"
+
+/*
+ * A given invocation of pmcstat(8) can manage multiple PMCs of both
+ * the system-wide and per-process variety.  Each of these could be in
+ * 'counting mode' or in 'sampling mode'.
+ *
+ * For 'counting mode' PMCs, pmcstat(8) will periodically issue a
+ * pmc_read() at the configured time interval and print out the value
+ * of the requested PMCs.
+ *
+ * For 'sampling mode' PMCs it can log to a file for offline analysis,
+ * or can analyse sampling data "on the fly", either by converting
+ * samples to printed textual form or by creating gprof(1) compatible
+ * profiles, one per program executed.  When creating gprof(1)
+ * profiles it can optionally merge entries from multiple processes
+ * for a given executable into a single profile file.
+ *
+ * pmcstat(8) can also execute a command line and attach PMCs to the
+ * resulting child process.  The protocol used is as follows:
+ *
+ * - parent creates a socketpair for two way communication and
+ *   fork()s.
+ * - subsequently:
+ *
+ *   /Parent/				/Child/
+ *
+ *   - Wait for childs token.
+ *					- Sends token.
+ *					- Awaits signal to start.
+ *  - Attaches PMCs to the child's pid
+ *    and starts them. Sets up
+ *    monitoring for the child.
+ *  - Signals child to start.
+ *					- Recieves signal, attempts exec().
+ *
+ * After this point normal processing can happen.
+ */
+
+/* Globals */
+
+int	pmcstat_interrupt = 0;
+int	pmcstat_displayheight = DEFAULT_DISPLAY_HEIGHT;
+int	pmcstat_sockpair[NSOCKPAIRFD];
+int	pmcstat_kq;
+kvm_t	*pmcstat_kvm;
+struct kinfo_proc *pmcstat_plist;
+
+void
+pmcstat_attach_pmcs(struct pmcstat_args *a)
+{
+	struct pmcstat_ev *ev;
+	struct pmcstat_target *pt;
+	int count;
+
+	/* Attach all process PMCs to target processes. */
+	count = 0;
+	STAILQ_FOREACH(ev, &a->pa_events, ev_next) {
+		if (PMC_IS_SYSTEM_MODE(ev->ev_mode))
+			continue;
+		SLIST_FOREACH(pt, &a->pa_targets, pt_next)
+			if (pmc_attach(ev->ev_pmcid, pt->pt_pid) == 0)
+				count++;
+			else if (errno != ESRCH)
+				err(EX_OSERR, "ERROR: cannot attach pmc "
+				    "\"%s\" to process %d", ev->ev_name,
+				    (int) pt->pt_pid);
+	}
+
+	if (count == 0)
+		errx(EX_DATAERR, "ERROR: No processes were attached to.");
+}
+
+
+void
+pmcstat_cleanup(struct pmcstat_args *a)
+{
+	struct pmcstat_ev *ev, *tmp;
+
+	/* release allocated PMCs. */
+	STAILQ_FOREACH_MUTABLE(ev, &a->pa_events, ev_next, tmp)
+	    if (ev->ev_pmcid != PMC_ID_INVALID) {
+		if (pmc_release(ev->ev_pmcid) < 0)
+			err(EX_OSERR, "ERROR: cannot release pmc "
+			    "0x%x \"%s\"", ev->ev_pmcid, ev->ev_name);
+		free(ev->ev_name);
+		free(ev->ev_spec);
+		STAILQ_REMOVE(&a->pa_events, ev, pmcstat_ev, ev_next);
+		free(ev);
+	    }
+
+	/* de-configure the log file if present. */
+	if (a->pa_flags & (FLAG_HAS_PIPE | FLAG_HAS_OUTPUT_LOGFILE))
+		(void) pmc_configure_logfile(-1);
+
+	if (a->pa_logparser) {
+		pmclog_close(a->pa_logparser);
+		a->pa_logparser = NULL;
+	}
+
+	if (a->pa_flags & (FLAG_HAS_PIPE | FLAG_HAS_OUTPUT_LOGFILE))
+		pmcstat_shutdown_logging(a);
+}
+
+void
+pmcstat_clone_event_descriptor(struct pmcstat_args *a, struct pmcstat_ev *ev,
+    uint32_t cpumask)
+{
+	int cpu;
+	struct pmcstat_ev *ev_clone;
+
+	while ((cpu = ffs(cpumask)) > 0) {
+		cpu--;
+
+		if ((ev_clone = malloc(sizeof(*ev_clone))) == NULL)
+			errx(EX_SOFTWARE, "ERROR: Out of memory");
+		(void) memset(ev_clone, 0, sizeof(*ev_clone));
+
+		ev_clone->ev_count = ev->ev_count;
+		ev_clone->ev_cpu   = cpu;
+		ev_clone->ev_cumulative = ev->ev_cumulative;
+		ev_clone->ev_flags = ev->ev_flags;
+		ev_clone->ev_mode  = ev->ev_mode;
+		ev_clone->ev_name  = strdup(ev->ev_name);
+		ev_clone->ev_pmcid = ev->ev_pmcid;
+		ev_clone->ev_saved = ev->ev_saved;
+		ev_clone->ev_spec  = strdup(ev->ev_spec);
+
+		STAILQ_INSERT_TAIL(&a->pa_events, ev_clone, ev_next);
+
+		cpumask &= ~(1 << cpu);
+	}
+}
+
+void
+pmcstat_create_process(struct pmcstat_args *a)
+{
+	char token;
+	pid_t pid;
+	struct kevent kev;
+	struct pmcstat_target *pt;
+
+	if (socketpair(AF_UNIX, SOCK_STREAM, 0, pmcstat_sockpair) < 0)
+		err(EX_OSERR, "ERROR: cannot create socket pair");
+
+	switch (pid = fork()) {
+	case -1:
+		err(EX_OSERR, "ERROR: cannot fork");
+		/*NOTREACHED*/
+
+	case 0:		/* child */
+		(void) close(pmcstat_sockpair[PARENTSOCKET]);
+
+		/* Write a token to tell our parent we've started executing. */
+		if (write(pmcstat_sockpair[CHILDSOCKET], "+", 1) != 1)
+			err(EX_OSERR, "ERROR (child): cannot write token");
+
+		/* Wait for our parent to signal us to start. */
+		if (read(pmcstat_sockpair[CHILDSOCKET], &token, 1) < 0)
+			err(EX_OSERR, "ERROR (child): cannot read token");
+		(void) close(pmcstat_sockpair[CHILDSOCKET]);
+
+		/* exec() the program requested */
+		execvp(*a->pa_argv, a->pa_argv);
+		/* and if that fails, notify the parent */
+		kill(getppid(), SIGCHLD);
+		err(EX_OSERR, "ERROR: execvp \"%s\" failed", *a->pa_argv);
+		/*NOTREACHED*/
+
+	default:	/* parent */
+		(void) close(pmcstat_sockpair[CHILDSOCKET]);
+		break;
+	}
+
+	/* Ask to be notified via a kevent when the target process exits. */
+	EV_SET(&kev, pid, EVFILT_PROC, EV_ADD|EV_ONESHOT, NOTE_EXIT, 0,
+	    NULL);
+	if (kevent(pmcstat_kq, &kev, 1, NULL, 0, NULL) < 0)
+		err(EX_OSERR, "ERROR: cannot monitor child process %d", pid);
+
+	if ((pt = malloc(sizeof(*pt))) == NULL)
+		errx(EX_SOFTWARE, "ERROR: Out of memory.");
+
+	pt->pt_pid = pid;
+	SLIST_INSERT_HEAD(&a->pa_targets, pt, pt_next);
+
+	/* Wait for the child to signal that its ready to go. */
+	if (read(pmcstat_sockpair[PARENTSOCKET], &token, 1) < 0)
+		err(EX_OSERR, "ERROR (parent): cannot read token");
+
+	return;
+}
+
+void
+pmcstat_find_targets(struct pmcstat_args *a, const char *spec)
+{
+	int n, nproc, pid, rv;
+	struct pmcstat_target *pt;
+	char errbuf[_POSIX2_LINE_MAX], *end;
+	static struct kinfo_proc *kp;
+	regex_t reg;
+	regmatch_t regmatch;
+
+	/* First check if we've been given a process id. */
+      	pid = strtol(spec, &end, 0);
+	if (end != spec && pid >= 0) {
+		if ((pt = malloc(sizeof(*pt))) == NULL)
+			goto outofmemory;
+		pt->pt_pid = pid;
+		SLIST_INSERT_HEAD(&a->pa_targets, pt, pt_next);
+		return;
+	}
+
+	/* Otherwise treat arg as a regular expression naming processes. */
+	if (pmcstat_kvm == NULL) {
+		if ((pmcstat_kvm = kvm_openfiles(NULL, "/dev/null", NULL, 0,
+		    errbuf)) == NULL)
+			err(EX_OSERR, "ERROR: Cannot open kernel \"%s\"",
+			    errbuf);
+		if ((pmcstat_plist = kvm_getprocs(pmcstat_kvm, KERN_PROC_ALL,
+		    0, &nproc)) == NULL)
+			err(EX_OSERR, "ERROR: Cannot get process list: %s",
+			    kvm_geterr(pmcstat_kvm));
+	}
+
+	if ((rv = regcomp(&reg, spec, REG_EXTENDED|REG_NOSUB)) != 0) {
+		regerror(rv, &reg, errbuf, sizeof(errbuf));
+		err(EX_DATAERR, "ERROR: Failed to compile regex \"%s\": %s",
+		    spec, errbuf);
+	}
+
+	for (n = 0, kp = pmcstat_plist; n < nproc; n++, kp++) {
+		if ((rv = regexec(&reg, kp->kp_comm, 1, &regmatch, 0)) == 0) {
+			if ((pt = malloc(sizeof(*pt))) == NULL)
+				goto outofmemory;
+			pt->pt_pid = kp->kp_pid;
+			SLIST_INSERT_HEAD(&a->pa_targets, pt, pt_next);
+		} else if (rv != REG_NOMATCH) {
+			regerror(rv, &reg, errbuf, sizeof(errbuf));
+			errx(EX_SOFTWARE, "ERROR: Regex evalation failed: %s",
+			    errbuf);
+		}
+	}
+
+	regfree(&reg);
+
+	return;
+
+ outofmemory:
+	errx(EX_SOFTWARE, "Out of memory.");
+	/*NOTREACHED*/
+}
+
+uint32_t
+pmcstat_get_cpumask(const char *cpuspec)
+{
+	uint32_t cpumask;
+	int cpu;
+	const char *s;
+	char *end;
+
+	s = cpuspec;
+	cpumask = 0ULL;
+
+	do {
+		cpu = strtol(s, &end, 0);
+		if (cpu < 0 || end == s)
+			errx(EX_USAGE, "ERROR: Illegal CPU specification "
+			    "\"%s\".", cpuspec);
+		cpumask |= (1 << cpu);
+		s = end + strspn(end, ", \t");
+	} while (*s);
+
+	return (cpumask);
+}
+
+void
+pmcstat_kill_process(struct pmcstat_args *a)
+{
+	struct pmcstat_target *pt;
+
+	assert(a->pa_flags & FLAG_HAS_COMMANDLINE);
+
+	/*
+	 * If a command line was specified, it would be the very first
+	 * in the list, before any other processes specified by -t.
+	 */
+	pt = SLIST_FIRST(&a->pa_targets);
+	assert(pt != NULL);
+
+	if (kill(pt->pt_pid, SIGINT) != 0)
+		err(EX_OSERR, "ERROR: cannot signal child process");
+}
+
+void
+pmcstat_start_pmcs(struct pmcstat_args *a)
+{
+	struct pmcstat_ev *ev;
+
+	STAILQ_FOREACH(ev, &args.pa_events, ev_next) {
+
+	    assert(ev->ev_pmcid != PMC_ID_INVALID);
+
+	    if (pmc_start(ev->ev_pmcid) < 0) {
+	        warn("ERROR: Cannot start pmc 0x%x \"%s\"",
+		    ev->ev_pmcid, ev->ev_name);
+		pmcstat_cleanup(a);
+		exit(EX_OSERR);
+	    }
+	}
+
+}
+
+void
+pmcstat_print_headers(struct pmcstat_args *a)
+{
+	struct pmcstat_ev *ev;
+	int c, w;
+
+	(void) fprintf(a->pa_printfile, PRINT_HEADER_PREFIX);
+
+	STAILQ_FOREACH(ev, &a->pa_events, ev_next) {
+		if (PMC_IS_SAMPLING_MODE(ev->ev_mode))
+			continue;
+
+		c = PMC_IS_SYSTEM_MODE(ev->ev_mode) ? 's' : 'p';
+
+		if (ev->ev_fieldskip != 0)
+			(void) fprintf(a->pa_printfile, "%*s",
+			    ev->ev_fieldskip, "");
+		w = ev->ev_fieldwidth - ev->ev_fieldskip - 2;
+
+		if (c == 's')
+			(void) fprintf(a->pa_printfile, "s/%02d/%-*s ",
+			    ev->ev_cpu, w-3, ev->ev_name);
+		else
+			(void) fprintf(a->pa_printfile, "p/%*s ", w,
+			    ev->ev_name);
+	}
+
+	(void) fflush(a->pa_printfile);
+}
+
+void
+pmcstat_print_counters(struct pmcstat_args *a)
+{
+	int extra_width;
+	struct pmcstat_ev *ev;
+	pmc_value_t value;
+
+	extra_width = sizeof(PRINT_HEADER_PREFIX) - 1;
+
+	STAILQ_FOREACH(ev, &a->pa_events, ev_next) {
+
+		/* skip sampling mode counters */
+		if (PMC_IS_SAMPLING_MODE(ev->ev_mode))
+			continue;
+
+		if (pmc_read(ev->ev_pmcid, &value) < 0)
+			err(EX_OSERR, "ERROR: Cannot read pmc "
+			    "\"%s\"", ev->ev_name);
+
+		(void) fprintf(a->pa_printfile, "%*ju ",
+		    ev->ev_fieldwidth + extra_width,
+		    (uintmax_t) ev->ev_cumulative ? value :
+		    (value - ev->ev_saved));
+
+		if (ev->ev_cumulative == 0)
+			ev->ev_saved = value;
+		extra_width = 0;
+	}
+
+	(void) fflush(a->pa_printfile);
+}
+
+/*
+ * Print output
+ */
+
+void
+pmcstat_print_pmcs(struct pmcstat_args *a)
+{
+	static int linecount = 0;
+
+	/* check if we need to print a header line */
+	if (++linecount > pmcstat_displayheight) {
+		(void) fprintf(a->pa_printfile, "\n");
+		linecount = 1;
+	}
+	if (linecount == 1)
+		pmcstat_print_headers(a);
+	(void) fprintf(a->pa_printfile, "\n");
+
+	pmcstat_print_counters(a);
+
+	return;
+}
+
+/*
+ * Do process profiling
+ *
+ * If a pid was specified, attach each allocated PMC to the target
+ * process.  Otherwise, fork a child and attach the PMCs to the child,
+ * and have the child exec() the target program.
+ */
+
+void
+pmcstat_start_process(void)
+{
+	/* Signal the child to proceed. */
+	if (write(pmcstat_sockpair[PARENTSOCKET], "!", 1) != 1)
+		err(EX_OSERR, "ERROR (parent): write of token failed");
+
+	(void) close(pmcstat_sockpair[PARENTSOCKET]);
+}
+
+void
+pmcstat_show_usage(void)
+{
+	errx(EX_USAGE,
+	    "[options] [commandline]\n"
+	    "\t Measure process and/or system performance using hardware\n"
+	    "\t performance monitoring counters.\n"
+	    "\t Options include:\n"
+	    "\t -C\t\t (toggle) show cumulative counts\n"
+	    "\t -D path\t create profiles in directory \"path\"\n"
+	    "\t -E\t\t (toggle) show counts at process exit\n"
+	    "\t -M file\t print executable/gmon file map to \"file\"\n"
+	    "\t -O file\t send log output to \"file\"\n"
+	    "\t -P spec\t allocate a process-private sampling PMC\n"
+	    "\t -R file\t read events from \"file\"\n"
+	    "\t -S spec\t allocate a system-wide sampling PMC\n"
+	    "\t -W\t\t (toggle) show counts per context switch\n"
+	    "\t -c cpu-list\t set cpus for subsequent system-wide PMCs\n"
+	    "\t -d\t\t (toggle) track descendants\n"
+	    "\t -g\t\t produce gprof(1) compatible profiles\n"
+	    "\t -k dir\t\t set the path to the kernel\n"
+	    "\t -n rate\t set sampling rate\n"
+	    "\t -o file\t send print output to \"file\"\n"
+	    "\t -p spec\t allocate a process-private counting PMC\n"
+	    "\t -q\t\t suppress verbosity\n"
+	    "\t -r fsroot\t specify FS root directory\n"
+	    "\t -s spec\t allocate a system-wide counting PMC\n"
+	    "\t -t pid\t\t attach to running process with pid \"pid\"\n"
+	    "\t -v\t\t increase verbosity\n"
+	    "\t -w secs\t set printing time interval"
+	);
+}
+
+/*
+ * Main
+ */
+
+int
+main(int argc, char **argv)
+{
+	double interval;
+	int option, npmc, ncpu;
+	int c, check_driver_stats, current_cpu, current_sampling_count;
+	int do_print, do_descendants;
+	int do_logproccsw, do_logprocexit;
+	size_t dummy;
+	int pipefd[2];
+	int use_cumulative_counts;
+	uint32_t cpumask;
+	char *end, *tmp;
+	const char *errmsg;
+	enum pmcstat_state runstate;
+	struct pmc_driverstats ds_start, ds_end;
+	struct pmcstat_ev *ev;
+	struct sigaction sa;
+	struct kevent kev;
+	struct winsize ws;
+	struct stat sb;
+	char buffer[PATH_MAX];
+
+	check_driver_stats      = 0;
+	current_cpu 		= 0;
+	current_sampling_count  = DEFAULT_SAMPLE_COUNT;
+	do_descendants          = 0;
+	do_logproccsw           = 0;
+	do_logprocexit          = 0;
+	use_cumulative_counts   = 0;
+	args.pa_required	= 0;
+	args.pa_flags		= 0;
+	args.pa_verbosity	= 1;
+	args.pa_logfd		= -1;
+	args.pa_fsroot		= "";
+	args.pa_kernel		= strdup("/boot/kernel");
+	args.pa_samplesdir	= ".";
+	args.pa_printfile	= stderr;
+	args.pa_interval	= DEFAULT_WAIT_INTERVAL;
+	args.pa_mapfilename	= NULL;
+	STAILQ_INIT(&args.pa_events);
+	SLIST_INIT(&args.pa_targets);
+	bzero(&ds_start, sizeof(ds_start));
+	bzero(&ds_end, sizeof(ds_end));
+	ev = NULL;
+
+	dummy = sizeof(ncpu);
+	if (sysctlbyname("hw.ncpu", &ncpu, &dummy, NULL, 0) < 0)
+		err(EX_OSERR, "ERROR: Cannot determine #cpus");
+	cpumask = (1 << ncpu) - 1;
+
+	while ((option = getopt(argc, argv,
+	    "CD:EM:O:P:R:S:Wc:dgk:n:o:p:qr:s:t:vw:")) != -1)
+		switch (option) {
+		case 'C':	/* cumulative values */
+			use_cumulative_counts = !use_cumulative_counts;
+			args.pa_required |= FLAG_HAS_COUNTING_PMCS;
+			break;
+
+		case 'c':	/* CPU */
+
+			if (optarg[0] == '*' && optarg[1] == '\0')
+				cpumask = (1 << ncpu) - 1;
+			else
+				cpumask = pmcstat_get_cpumask(optarg);
+
+			args.pa_required |= FLAG_HAS_SYSTEM_PMCS;
+			break;
+
+		case 'D':
+			if (stat(optarg, &sb) < 0)
+				err(EX_OSERR, "ERROR: Cannot stat \"%s\"",
+				    optarg);
+			if (!S_ISDIR(sb.st_mode))
+				errx(EX_USAGE, "ERROR: \"%s\" is not a "
+				    "directory.", optarg);
+			args.pa_samplesdir = optarg;
+			args.pa_flags     |= FLAG_HAS_SAMPLESDIR;
+			args.pa_required  |= FLAG_DO_GPROF;
+			break;
+
+		case 'd':	/* toggle descendents */
+			do_descendants = !do_descendants;
+			args.pa_required |= FLAG_HAS_PROCESS_PMCS;
+			break;
+
+		case 'g':	/* produce gprof compatible profiles */
+			args.pa_flags |= FLAG_DO_GPROF;
+			break;
+
+		case 'k':	/* pathname to the kernel */
+			free(args.pa_kernel);
+			args.pa_kernel = strdup(optarg);
+			args.pa_required |= FLAG_DO_GPROF;
+			args.pa_flags    |= FLAG_HAS_KERNELPATH;
+			break;
+
+		case 'E':	/* log process exit */
+			do_logprocexit = !do_logprocexit;
+			args.pa_required |= (FLAG_HAS_PROCESS_PMCS |
+			    FLAG_HAS_COUNTING_PMCS | FLAG_HAS_OUTPUT_LOGFILE);
+			break;
+
+		case 'M':	/* mapfile */
+			args.pa_mapfilename = optarg;
+			break;
+
+		case 'p':	/* process virtual counting PMC */
+		case 's':	/* system-wide counting PMC */
+		case 'P':	/* process virtual sampling PMC */
+		case 'S':	/* system-wide sampling PMC */
+			if ((ev = malloc(sizeof(*ev))) == NULL)
+				errx(EX_SOFTWARE, "ERROR: Out of memory.");
+
+			switch (option) {
+			case 'p': ev->ev_mode = PMC_MODE_TC; break;
+			case 's': ev->ev_mode = PMC_MODE_SC; break;
+			case 'P': ev->ev_mode = PMC_MODE_TS; break;
+			case 'S': ev->ev_mode = PMC_MODE_SS; break;
+			}
+
+			if (option == 'P' || option == 'p') {
+				args.pa_flags |= FLAG_HAS_PROCESS_PMCS;
+				args.pa_required |= (FLAG_HAS_COMMANDLINE |
+				    FLAG_HAS_TARGET);
+			}
+
+			if (option == 'P' || option == 'S') {
+				args.pa_flags |= FLAG_HAS_SAMPLING_PMCS;
+				args.pa_required |= (FLAG_HAS_PIPE |
+				    FLAG_HAS_OUTPUT_LOGFILE);
+			}
+
+			if (option == 'p' || option == 's')
+				args.pa_flags |= FLAG_HAS_COUNTING_PMCS;
+
+			if (option == 's' || option == 'S')
+				args.pa_flags |= FLAG_HAS_SYSTEM_PMCS;
+
+			ev->ev_spec  = strdup(optarg);
+
+			if (option == 'S' || option == 'P')
+				ev->ev_count = current_sampling_count;
+			else
+				ev->ev_count = -1;
+
+			if (option == 'S' || option == 's')
+				ev->ev_cpu = ffs(cpumask) - 1;
+			else
+				ev->ev_cpu = PMC_CPU_ANY;
+
+			ev->ev_flags = 0;
+			if (do_descendants)
+				ev->ev_flags |= PMC_F_DESCENDANTS;
+			if (do_logprocexit)
+				ev->ev_flags |= PMC_F_LOG_PROCEXIT;
+			if (do_logproccsw)
+				ev->ev_flags |= PMC_F_LOG_PROCCSW;
+
+			ev->ev_cumulative  = use_cumulative_counts;
+
+			ev->ev_saved = 0LL;
+			ev->ev_pmcid = PMC_ID_INVALID;
+
+			/* extract event name */
+			c = strcspn(optarg, ", \t");
+			ev->ev_name = malloc(c + 1);
+			(void) strncpy(ev->ev_name, optarg, c);
+			*(ev->ev_name + c) = '\0';
+
+			STAILQ_INSERT_TAIL(&args.pa_events, ev, ev_next);
+
+			if (option == 's' || option == 'S')
+				pmcstat_clone_event_descriptor(&args, ev,
+				    cpumask & ~(1 << ev->ev_cpu));
+
+			break;
+
+		case 'n':	/* sampling count */
+			current_sampling_count = strtol(optarg, &end, 0);
+			if (*end != '\0' || current_sampling_count <= 0)
+				errx(EX_USAGE,
+				    "ERROR: Illegal count value \"%s\".",
+				    optarg);
+			args.pa_required |= FLAG_HAS_SAMPLING_PMCS;
+			break;
+
+		case 'o':	/* outputfile */
+			if (args.pa_printfile != NULL)
+				(void) fclose(args.pa_printfile);
+			if ((args.pa_printfile = fopen(optarg, "w")) == NULL)
+				errx(EX_OSERR, "ERROR: cannot open \"%s\" for "
+				    "writing.", optarg);
+			args.pa_flags |= FLAG_DO_PRINT;
+			break;
+
+		case 'O':	/* sampling output */
+			if (args.pa_outputpath)
+				errx(EX_USAGE, "ERROR: option -O may only be "
+				    "specified once.");
+			args.pa_outputpath = optarg;
+			args.pa_flags |= FLAG_HAS_OUTPUT_LOGFILE;
+			break;
+
+		case 'q':	/* quiet mode */
+			args.pa_verbosity = 0;
+			break;
+
+		case 'r':	/* root FS path */
+			args.pa_fsroot = optarg;
+			break;
+
+		case 'R':	/* read an existing log file */
+			if (args.pa_logparser != NULL)
+				errx(EX_USAGE, "ERROR: option -R may only be "
+				    "specified once.");
+			args.pa_inputpath = optarg;
+			if (args.pa_printfile == stderr)
+				args.pa_printfile = stdout;
+			args.pa_flags |= FLAG_READ_LOGFILE;
+			break;
+
+		case 't':	/* target pid or process name */
+			pmcstat_find_targets(&args, optarg);
+
+			args.pa_flags |= FLAG_HAS_TARGET;
+			args.pa_required |= FLAG_HAS_PROCESS_PMCS;
+			break;
+
+		case 'v':	/* verbose */
+			args.pa_verbosity++;
+			break;
+
+		case 'w':	/* wait interval */
+			interval = strtod(optarg, &end);
+			if (*end != '\0' || interval <= 0)
+				errx(EX_USAGE, "ERROR: Illegal wait interval "
+				    "value \"%s\".", optarg);
+			args.pa_flags |= FLAG_HAS_WAIT_INTERVAL;
+			args.pa_required |= FLAG_HAS_COUNTING_PMCS;
+			args.pa_interval = interval;
+			break;
+
+		case 'W':	/* toggle LOG_CSW */
+			do_logproccsw = !do_logproccsw;
+			args.pa_required |= (FLAG_HAS_PROCESS_PMCS |
+			    FLAG_HAS_COUNTING_PMCS | FLAG_HAS_OUTPUT_LOGFILE);
+			break;
+
+		case '?':
+		default:
+			pmcstat_show_usage();
+			break;
+
+		}
+
+	args.pa_argc = (argc -= optind);
+	args.pa_argv = (argv += optind);
+
+	if (argc)	/* command line present */
+		args.pa_flags |= FLAG_HAS_COMMANDLINE;
+
+	/*
+	 * Check invocation syntax.
+	 */
+
+	/* disallow -O and -R together */
+	if (args.pa_outputpath && args.pa_inputpath)
+		errx(EX_USAGE, "ERROR: options -O and -R are mutually "
+		    "exclusive.");
+
+	if (args.pa_flags & FLAG_READ_LOGFILE) {
+		errmsg = NULL;
+		if (args.pa_flags & FLAG_HAS_COMMANDLINE)
+			errmsg = "a command line specification";
+		else if (args.pa_flags & FLAG_HAS_TARGET)
+			errmsg = "option -t";
+		else if (!STAILQ_EMPTY(&args.pa_events))
+			errmsg = "a PMC event specification";
+		if (errmsg)
+			errx(EX_USAGE, "ERROR: option -R may not be used with "
+			    "%s.", errmsg);
+	} else if (STAILQ_EMPTY(&args.pa_events))
+		/* All other uses require a PMC spec. */
+		pmcstat_show_usage();
+
+	/* check for -t pid without a process PMC spec */
+	if ((args.pa_required & FLAG_HAS_TARGET) &&
+	    (args.pa_flags & FLAG_HAS_PROCESS_PMCS) == 0)
+		errx(EX_USAGE, "ERROR: option -t requires a process mode PMC "
+		    "to be specified.");
+
+	/* check for process-mode options without a command or -t pid */
+	if ((args.pa_required & FLAG_HAS_PROCESS_PMCS) &&
+	    (args.pa_flags & (FLAG_HAS_COMMANDLINE | FLAG_HAS_TARGET)) == 0)
+		errx(EX_USAGE, "ERROR: options -d, -E, -p, -P, and -W require "
+		    "a command line or target process.");
+
+	/* check for -p | -P without a target process of some sort */
+	if ((args.pa_required & (FLAG_HAS_COMMANDLINE | FLAG_HAS_TARGET)) &&
+	    (args.pa_flags & (FLAG_HAS_COMMANDLINE | FLAG_HAS_TARGET)) == 0)
+		errx(EX_USAGE, "ERROR: options -P and -p require a "
+		    "target process or a command line.");
+
+	/* check for process-mode options without a process-mode PMC */
+	if ((args.pa_required & FLAG_HAS_PROCESS_PMCS) &&
+	    (args.pa_flags & FLAG_HAS_PROCESS_PMCS) == 0)
+		errx(EX_USAGE, "ERROR: options -d, -E, and -W require a "
+		    "process mode PMC to be specified.");
+
+	/* check for -c cpu and not system mode PMCs */
+	if ((args.pa_required & FLAG_HAS_SYSTEM_PMCS) &&
+	    (args.pa_flags & FLAG_HAS_SYSTEM_PMCS) == 0)
+		errx(EX_USAGE, "ERROR: option -c requires at least one "
+		    "system mode PMC to be specified.");
+
+	/* check for counting mode options without a counting PMC */
+	if ((args.pa_required & FLAG_HAS_COUNTING_PMCS) &&
+	    (args.pa_flags & FLAG_HAS_COUNTING_PMCS) == 0)
+		errx(EX_USAGE, "ERROR: options -C, -W, -o and -w require at "
+		    "least one counting mode PMC to be specified.");
+
+	/* check for sampling mode options without a sampling PMC spec */
+	if ((args.pa_required & FLAG_HAS_SAMPLING_PMCS) &&
+	    (args.pa_flags & FLAG_HAS_SAMPLING_PMCS) == 0)
+		errx(EX_USAGE, "ERROR: options -n and -O require at least "
+		    "one sampling mode PMC to be specified.");
+
+	/* check if -g is being used correctly */
+	if ((args.pa_flags & FLAG_DO_GPROF) &&
+	    !(args.pa_flags & (FLAG_HAS_SAMPLING_PMCS|FLAG_READ_LOGFILE)))
+		errx(EX_USAGE, "ERROR: option -g requires sampling PMCs or -R "
+		    "to be specified.");
+
+	/* check if -O was spuriously specified */
+	if ((args.pa_flags & FLAG_HAS_OUTPUT_LOGFILE) &&
+	    (args.pa_required & FLAG_HAS_OUTPUT_LOGFILE) == 0)
+		errx(EX_USAGE,
+		    "ERROR: option -O is used only with options "
+		    "-E, -P, -S and -W.");
+
+	/* -D dir and -k kernel path require -g or -R */
+	if ((args.pa_flags & FLAG_HAS_KERNELPATH) &&
+	    (args.pa_flags & FLAG_DO_GPROF) == 0 &&
+	    (args.pa_flags & FLAG_READ_LOGFILE) == 0)
+	    errx(EX_USAGE, "ERROR: option -k is only used with -g/-R.");
+
+	if ((args.pa_flags & FLAG_HAS_SAMPLESDIR) &&
+	    (args.pa_flags & FLAG_DO_GPROF) == 0 &&
+	    (args.pa_flags & FLAG_READ_LOGFILE) == 0)
+	    errx(EX_USAGE, "ERROR: option -D is only used with -g/-R.");
+
+	/* -M mapfile requires -g or -R */
+	if (args.pa_mapfilename != NULL &&
+	    (args.pa_flags & FLAG_DO_GPROF) == 0 &&
+	    (args.pa_flags & FLAG_READ_LOGFILE) == 0)
+	    errx(EX_USAGE, "ERROR: option -M is only used with -g/-R.");
+
+	/*
+	 * Disallow textual output of sampling PMCs if counting PMCs
+	 * have also been asked for, mostly because the combined output
+	 * is difficult to make sense of.
+	 */
+	if ((args.pa_flags & FLAG_HAS_COUNTING_PMCS) &&
+	    (args.pa_flags & FLAG_HAS_SAMPLING_PMCS) &&
+	    ((args.pa_flags & FLAG_HAS_OUTPUT_LOGFILE) == 0))
+		errx(EX_USAGE, "ERROR: option -O is required if counting and "
+		    "sampling PMCs are specified together.");
+
+	/*
+	 * Check if "-k kerneldir" was specified, and if whether 'kerneldir'
+	 * actually refers to a a file.  If so, use `dirname path` to determine
+	 * the kernel directory.
+	 */
+	if (args.pa_flags & FLAG_HAS_KERNELPATH) {
+		(void) snprintf(buffer, sizeof(buffer), "%s%s", args.pa_fsroot,
+		    args.pa_kernel);
+		if (stat(buffer, &sb) < 0)
+			err(EX_OSERR, "ERROR: Cannot locate kernel \"%s\"",
+			    buffer);
+		if (!S_ISREG(sb.st_mode) && !S_ISDIR(sb.st_mode))
+			errx(EX_USAGE, "ERROR: \"%s\": Unsupported file type.",
+			    buffer);
+		if (!S_ISDIR(sb.st_mode)) {
+			tmp = args.pa_kernel;
+			args.pa_kernel = strdup(dirname(args.pa_kernel));
+			free(tmp);
+			(void) snprintf(buffer, sizeof(buffer), "%s%s",
+			    args.pa_fsroot, args.pa_kernel);
+			if (stat(buffer, &sb) < 0)
+				err(EX_OSERR, "ERROR: Cannot stat \"%s\"",
+				    buffer);
+			if (!S_ISDIR(sb.st_mode))
+				errx(EX_USAGE, "ERROR: \"%s\" is not a "
+				    "directory.", buffer);
+		}
+	}
+
+	/* if we've been asked to process a log file, do that and exit */
+	if (args.pa_flags & FLAG_READ_LOGFILE) {
+		/*
+		 * Print the log in textual form if we haven't been
+		 * asked to generate gmon.out files.
+		 */
+		if ((args.pa_flags & FLAG_DO_GPROF) == 0)
+			args.pa_flags |= FLAG_DO_PRINT;
+
+		pmcstat_initialize_logging(&args);
+		args.pa_logfd = pmcstat_open_log(args.pa_inputpath,
+		    PMCSTAT_OPEN_FOR_READ);
+		if ((args.pa_logparser = pmclog_open(args.pa_logfd)) == NULL)
+			err(EX_OSERR, "ERROR: Cannot create parser");
+		pmcstat_process_log(&args);
+		pmcstat_shutdown_logging(&args);
+		exit(EX_OK);
+	}
+
+	/* otherwise, we've been asked to collect data */
+	if (pmc_init() < 0)
+		err(EX_UNAVAILABLE,
+		    "ERROR: Initialization of the pmc(3) library failed");
+
+	if ((npmc = pmc_npmc(0)) < 0) /* assume all CPUs are identical */
+		err(EX_OSERR, "ERROR: Cannot determine the number of PMCs "
+		    "on CPU %d", 0);
+
+	/* Allocate a kqueue */
+	if ((pmcstat_kq = kqueue()) < 0)
+		err(EX_OSERR, "ERROR: Cannot allocate kqueue");
+
+	/*
+	 * Configure the specified log file or setup a default log
+	 * consumer via a pipe.
+	 */
+	if (args.pa_required & FLAG_HAS_OUTPUT_LOGFILE) {
+		if (args.pa_outputpath)
+			args.pa_logfd = pmcstat_open_log(args.pa_outputpath,
+			    PMCSTAT_OPEN_FOR_WRITE);
+		else {
+			/*
+			 * process the log on the fly by reading it in
+			 * through a pipe.
+			 */
+			if (pipe(pipefd) < 0)
+				err(EX_OSERR, "ERROR: pipe(2) failed");
+
+			if (fcntl(pipefd[READPIPEFD], F_SETFL, O_NONBLOCK) < 0)
+				err(EX_OSERR, "ERROR: fcntl(2) failed");
+
+			EV_SET(&kev, pipefd[READPIPEFD], EVFILT_READ, EV_ADD,
+			    0, 0, NULL);
+
+			if (kevent(pmcstat_kq, &kev, 1, NULL, 0, NULL) < 0)
+				err(EX_OSERR, "ERROR: Cannot register kevent");
+
+			args.pa_logfd = pipefd[WRITEPIPEFD];
+
+			args.pa_flags |= (FLAG_HAS_PIPE | FLAG_DO_PRINT);
+			args.pa_logparser = pmclog_open(pipefd[READPIPEFD]);
+		}
+
+		if (pmc_configure_logfile(args.pa_logfd) < 0)
+			err(EX_OSERR, "ERROR: Cannot configure log file");
+	}
+
+	/* remember to check for driver errors if we are sampling or logging */
+	check_driver_stats = (args.pa_flags & FLAG_HAS_SAMPLING_PMCS) ||
+	    (args.pa_flags & FLAG_HAS_OUTPUT_LOGFILE);
+
+	/*
+	 * Allocate PMCs.
+	 */
+
+	STAILQ_FOREACH(ev, &args.pa_events, ev_next) {
+	    if (pmc_allocate(ev->ev_spec, ev->ev_mode,
+		    ev->ev_flags, ev->ev_cpu, &ev->ev_pmcid) < 0)
+		    err(EX_OSERR, "ERROR: Cannot allocate %s-mode pmc with "
+			"specification \"%s\"",
+			PMC_IS_SYSTEM_MODE(ev->ev_mode) ? "system" : "process",
+			ev->ev_spec);
+
+	    if (PMC_IS_SAMPLING_MODE(ev->ev_mode) &&
+		pmc_set(ev->ev_pmcid, ev->ev_count) < 0)
+		    err(EX_OSERR, "ERROR: Cannot set sampling count "
+			"for PMC \"%s\"", ev->ev_name);
+	}
+
+	/* compute printout widths */
+	STAILQ_FOREACH(ev, &args.pa_events, ev_next) {
+		int counter_width;
+		int display_width;
+		int header_width;
+
+		(void) pmc_width(ev->ev_pmcid, &counter_width);
+		header_width = strlen(ev->ev_name) + 2; /* prefix '%c/' */
+		display_width = (int) floor(counter_width / 3.32193) + 1;
+
+		if (PMC_IS_SYSTEM_MODE(ev->ev_mode))
+			header_width += 3; /* 2 digit CPU number + '/' */
+
+		if (header_width > display_width) {
+			ev->ev_fieldskip = 0;
+			ev->ev_fieldwidth = header_width;
+		} else {
+			ev->ev_fieldskip = display_width -
+			    header_width;
+			ev->ev_fieldwidth = display_width;
+		}
+	}
+
+	/*
+	 * If our output is being set to a terminal, register a handler
+	 * for window size changes.
+	 */
+
+	if (isatty(fileno(args.pa_printfile))) {
+
+		if (ioctl(fileno(args.pa_printfile), TIOCGWINSZ, &ws) < 0)
+			err(EX_OSERR, "ERROR: Cannot determine window size");
+
+		pmcstat_displayheight = ws.ws_row - 1;
+
+		EV_SET(&kev, SIGWINCH, EVFILT_SIGNAL, EV_ADD, 0, 0, NULL);
+
+		if (kevent(pmcstat_kq, &kev, 1, NULL, 0, NULL) < 0)
+			err(EX_OSERR, "ERROR: Cannot register kevent for "
+			    "SIGWINCH");
+	}
+
+	EV_SET(&kev, SIGINT, EVFILT_SIGNAL, EV_ADD, 0, 0, NULL);
+	if (kevent(pmcstat_kq, &kev, 1, NULL, 0, NULL) < 0)
+		err(EX_OSERR, "ERROR: Cannot register kevent for SIGINT");
+
+	EV_SET(&kev, SIGIO, EVFILT_SIGNAL, EV_ADD, 0, 0, NULL);
+	if (kevent(pmcstat_kq, &kev, 1, NULL, 0, NULL) < 0)
+		err(EX_OSERR, "ERROR: Cannot register kevent for SIGIO");
+
+	/*
+	 * An exec() failure of a forked child is signalled by the
+	 * child sending the parent a SIGCHLD.  We don't register an
+	 * actual signal handler for SIGCHLD, but instead use our
+	 * kqueue to pick up the signal.
+	 */
+	EV_SET(&kev, SIGCHLD, EVFILT_SIGNAL, EV_ADD, 0, 0, NULL);
+	if (kevent(pmcstat_kq, &kev, 1, NULL, 0, NULL) < 0)
+		err(EX_OSERR, "ERROR: Cannot register kevent for SIGCHLD");
+
+	/* setup a timer if we have counting mode PMCs needing to be printed */
+	if ((args.pa_flags & FLAG_HAS_COUNTING_PMCS) &&
+	    (args.pa_required & FLAG_HAS_OUTPUT_LOGFILE) == 0) {
+		EV_SET(&kev, 0, EVFILT_TIMER, EV_ADD, 0,
+		    args.pa_interval * 1000, NULL);
+
+		if (kevent(pmcstat_kq, &kev, 1, NULL, 0, NULL) < 0)
+			err(EX_OSERR, "ERROR: Cannot register kevent for "
+			    "timer");
+	}
+
+	/* attach PMCs to the target process, starting it if specified */
+	if (args.pa_flags & FLAG_HAS_COMMANDLINE)
+		pmcstat_create_process(&args);
+
+	if (check_driver_stats && pmc_get_driver_stats(&ds_start) < 0)
+		err(EX_OSERR, "ERROR: Cannot retrieve driver statistics");
+
+	/* Attach process pmcs to the target process. */
+	if (args.pa_flags & FLAG_HAS_TARGET) {
+		if (SLIST_EMPTY(&args.pa_targets))
+			errx(EX_DATAERR, "ERROR: No matching target "
+			    "processes.");
+		else
+			pmcstat_attach_pmcs(&args);
+
+		if (pmcstat_kvm) {
+			kvm_close(pmcstat_kvm);
+			pmcstat_kvm = NULL;
+		}
+	}
+
+	/* start the pmcs */
+	pmcstat_start_pmcs(&args);
+
+	/* start the (commandline) process if needed */
+	if (args.pa_flags & FLAG_HAS_COMMANDLINE)
+		pmcstat_start_process();
+
+	/* initialize logging if printing the configured log */
+	if ((args.pa_flags & FLAG_DO_PRINT) &&
+	    (args.pa_flags & (FLAG_HAS_PIPE | FLAG_HAS_OUTPUT_LOGFILE)))
+		pmcstat_initialize_logging(&args);
+
+	/* Handle SIGINT using the kqueue loop */
+	sa.sa_handler = SIG_IGN;
+	sa.sa_flags   = 0;
+	(void) sigemptyset(&sa.sa_mask);
+
+	if (sigaction(SIGINT, &sa, NULL) < 0)
+		err(EX_OSERR, "ERROR: Cannot install signal handler");
+
+	/*
+	 * loop till either the target process (if any) exits, or we
+	 * are killed by a SIGINT.
+	 */
+	runstate = PMCSTAT_RUNNING;
+	do_print = 0;
+	do {
+		if ((c = kevent(pmcstat_kq, NULL, 0, &kev, 1, NULL)) <= 0) {
+			if (errno != EINTR)
+				err(EX_OSERR, "ERROR: kevent failed");
+			else
+				continue;
+		}
+
+		if (kev.flags & EV_ERROR)
+			errc(EX_OSERR, kev.data, "ERROR: kevent failed");
+
+		switch (kev.filter) {
+		case EVFILT_PROC:  /* target has exited */
+			if (args.pa_flags & (FLAG_HAS_OUTPUT_LOGFILE |
+				FLAG_HAS_PIPE))
+				runstate = pmcstat_close_log(&args);
+			else
+				runstate = PMCSTAT_FINISHED;
+			do_print = 1;
+			break;
+
+		case EVFILT_READ:  /* log file data is present */
+			runstate = pmcstat_process_log(&args);
+			break;
+
+		case EVFILT_SIGNAL:
+			if (kev.ident == SIGCHLD) {
+				/*
+				 * The child process sends us a
+				 * SIGCHLD if its exec() failed.  We
+				 * wait for it to exit and then exit
+				 * ourselves.
+				 */
+				(void) wait(&c);
+				runstate = PMCSTAT_FINISHED;
+			} else if (kev.ident == SIGIO) {
+				/*
+				 * We get a SIGIO if a PMC loses all
+				 * of its targets, or if logfile
+				 * writes encounter an error.
+				 */
+				if (args.pa_flags & (FLAG_HAS_OUTPUT_LOGFILE |
+				    FLAG_HAS_PIPE)) {
+					runstate = pmcstat_close_log(&args);
+					if (args.pa_flags &
+					    (FLAG_DO_PRINT|FLAG_DO_GPROF))
+						pmcstat_process_log(&args);
+				}
+				do_print = 1; /* print PMCs at exit */
+				runstate = PMCSTAT_FINISHED;
+			} else if (kev.ident == SIGINT) {
+				/* Kill the child process if we started it */
+				if (args.pa_flags & FLAG_HAS_COMMANDLINE)
+					pmcstat_kill_process(&args);
+				runstate = PMCSTAT_FINISHED;
+			} else if (kev.ident == SIGWINCH) {
+				if (ioctl(fileno(args.pa_printfile),
+					TIOCGWINSZ, &ws) < 0)
+				    err(EX_OSERR, "ERROR: Cannot determine "
+					"window size");
+				pmcstat_displayheight = ws.ws_row - 1;
+			} else
+				assert(0);
+
+			break;
+
+		case EVFILT_TIMER: /* print out counting PMCs */
+			do_print = 1;
+			break;
+
+		}
+
+		if (do_print &&
+		    (args.pa_required & FLAG_HAS_OUTPUT_LOGFILE) == 0) {
+			pmcstat_print_pmcs(&args);
+			if (runstate == PMCSTAT_FINISHED && /* final newline */
+			    (args.pa_flags & FLAG_DO_PRINT) == 0)
+				(void) fprintf(args.pa_printfile, "\n");
+			do_print = 0;
+		}
+
+	} while (runstate != PMCSTAT_FINISHED);
+
+	/* flush any pending log entries */
+	if (args.pa_flags & (FLAG_HAS_OUTPUT_LOGFILE | FLAG_HAS_PIPE))
+		pmc_flush_logfile();
+
+	pmcstat_cleanup(&args);
+
+	free(args.pa_kernel);
+
+	/* check if the driver lost any samples or events */
+	if (check_driver_stats) {
+		if (pmc_get_driver_stats(&ds_end) < 0)
+			err(EX_OSERR, "ERROR: Cannot retrieve driver "
+			    "statistics");
+		if (ds_start.pm_intr_bufferfull != ds_end.pm_intr_bufferfull &&
+		    args.pa_verbosity > 0)
+			warnx("WARNING: some samples were dropped.  Please "
+			    "consider tuning the \"kern.hwpmc.nsamples\" "
+			    "tunable.");
+		if (ds_start.pm_buffer_requests_failed !=
+		    ds_end.pm_buffer_requests_failed &&
+		    args.pa_verbosity > 0)
+			warnx("WARNING: some events were discarded.  Please "
+			    "consider tuning the \"kern.hwpmc.nbuffers\" "
+			    "tunable.");
+	}
+
+	exit(EX_OK);
+}
diff --git a/usr.sbin/pmcstat/pmcstat.h b/usr.sbin/pmcstat/pmcstat.h
new file mode 100644
index 0000000..0e5cb67
--- /dev/null
+++ b/usr.sbin/pmcstat/pmcstat.h
@@ -0,0 +1,143 @@
+/*-
+ * Copyright (c) 2005-2007, Joseph Koshy
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD: src/usr.sbin/pmcstat/pmcstat.h,v 1.5 2007-04-27 12:09:31 jkoshy Exp $
+ */
+
+#ifndef	_PMCSTAT_H_
+#define	_PMCSTAT_H_
+
+#define	FLAG_HAS_TARGET			0x00000001	/* process target */
+#define	FLAG_HAS_WAIT_INTERVAL		0x00000002	/* -w secs */
+#define	FLAG_HAS_OUTPUT_LOGFILE		0x00000004	/* -O file or pipe */
+#define	FLAG_HAS_COMMANDLINE		0x00000008	/* command */
+#define	FLAG_HAS_SAMPLING_PMCS		0x00000010	/* -S or -P */
+#define	FLAG_HAS_COUNTING_PMCS		0x00000020	/* -s or -p */
+#define	FLAG_HAS_PROCESS_PMCS		0x00000040	/* -P or -p */
+#define	FLAG_HAS_SYSTEM_PMCS		0x00000080	/* -S or -s */
+#define	FLAG_HAS_PIPE			0x00000100	/* implicit log */
+#define	FLAG_READ_LOGFILE		0x00000200	/* -R file */
+#define	FLAG_DO_GPROF			0x00000400	/* -g */
+#define	FLAG_HAS_SAMPLESDIR		0x00000800	/* -D dir */
+#define	FLAG_HAS_KERNELPATH		0x00001000	/* -k kernel */
+#define	FLAG_DO_PRINT			0x00002000	/* -o */
+
+#define	DEFAULT_SAMPLE_COUNT		65536
+#define	DEFAULT_WAIT_INTERVAL		5.0
+#define	DEFAULT_DISPLAY_HEIGHT		23
+#define	DEFAULT_BUFFER_SIZE		4096
+
+#define	PRINT_HEADER_PREFIX		"# "
+#define	READPIPEFD			0
+#define	WRITEPIPEFD			1
+#define	NPIPEFD				2
+
+#define	NSOCKPAIRFD			2
+#define	PARENTSOCKET			0
+#define	CHILDSOCKET			1
+
+#define	PMCSTAT_OPEN_FOR_READ		0
+#define	PMCSTAT_OPEN_FOR_WRITE		1
+#define	PMCSTAT_DEFAULT_NW_HOST		"localhost"
+#define	PMCSTAT_DEFAULT_NW_PORT		"9000"
+#define	PMCSTAT_NHASH			256
+#define	PMCSTAT_HASH_MASK		0xFF
+
+#define	PMCSTAT_LDD_COMMAND		"/usr/bin/ldd"
+
+#define	PMCSTAT_PRINT_ENTRY(A,T,...) do {				\
+		fprintf((A)->pa_printfile, "%-8s", T);			\
+		fprintf((A)->pa_printfile, " "  __VA_ARGS__);		\
+		fprintf((A)->pa_printfile, "\n");			\
+	} while (0)
+
+enum pmcstat_state {
+	PMCSTAT_FINISHED = 0,
+	PMCSTAT_EXITING  = 1,
+	PMCSTAT_RUNNING  = 2
+};
+
+struct pmcstat_ev {
+	STAILQ_ENTRY(pmcstat_ev) ev_next;
+	int		ev_count; /* associated count if in sampling mode */
+	uint32_t	ev_cpu;	  /* cpus for this event */
+	int		ev_cumulative;  /* show cumulative counts */
+	int		ev_flags; /* PMC_F_* */
+	int		ev_fieldskip;   /* #leading spaces */
+	int		ev_fieldwidth;  /* print width */
+	enum pmc_mode	ev_mode;  /* desired mode */
+	char	       *ev_name;  /* (derived) event name */
+	pmc_id_t	ev_pmcid; /* allocated ID */
+	pmc_value_t	ev_saved; /* for incremental counts */
+	char	       *ev_spec;  /* event specification */
+};
+
+struct pmcstat_target {
+	SLIST_ENTRY(pmcstat_target) pt_next;
+	pid_t		pt_pid;
+};
+
+struct pmcstat_args {
+	int	pa_flags;		/* argument flags */
+	int	pa_required;		/* required features */
+	int	pa_verbosity;		/* verbosity level */
+	FILE	*pa_printfile;		/* where to send printed output */
+	int	pa_logfd;		/* output log file */
+	char	*pa_inputpath;		/* path to input log */
+	char	*pa_outputpath;		/* path to output log */
+	void	*pa_logparser;		/* log file parser */
+	const char	*pa_fsroot;	/* FS root where executables reside */
+	char	*pa_kernel;		/* pathname of the kernel */
+	const char	*pa_samplesdir;	/* directory for profile files */
+	const char	*pa_mapfilename;/* mapfile name */
+	double	pa_interval;		/* printing interval in seconds */
+	int	pa_argc;
+	char	**pa_argv;
+	STAILQ_HEAD(, pmcstat_ev) pa_events;
+	SLIST_HEAD(, pmcstat_target) pa_targets;
+} args;
+
+/* Function prototypes */
+void	pmcstat_attach_pmcs(struct pmcstat_args *_a);
+void	pmcstat_cleanup(struct pmcstat_args *_a);
+void	pmcstat_clone_event_descriptor(struct pmcstat_args *_a,
+    struct pmcstat_ev *_ev, uint32_t _cpumask);
+int	pmcstat_close_log(struct pmcstat_args *_a);
+void	pmcstat_create_process(struct pmcstat_args *_a);
+void	pmcstat_find_targets(struct pmcstat_args *_a, const char *_arg);
+void	pmcstat_initialize_logging(struct pmcstat_args *_a);
+void	pmcstat_kill_process(struct pmcstat_args *_a);
+int	pmcstat_open_log(const char *_p, int _mode);
+void	pmcstat_print_counters(struct pmcstat_args *_a);
+void	pmcstat_print_headers(struct pmcstat_args *_a);
+void	pmcstat_print_pmcs(struct pmcstat_args *_a);
+void	pmcstat_show_usage(void);
+void	pmcstat_shutdown_logging(struct pmcstat_args *_a);
+void	pmcstat_start_pmcs(struct pmcstat_args *_a);
+void	pmcstat_start_process(void);
+int	pmcstat_process_log(struct pmcstat_args *_a);
+uint32_t pmcstat_get_cpumask(const char *_a);
+
+#endif	/* _PMCSTAT_H_ */
diff --git a/usr.sbin/pmcstat/pmcstat_log.c b/usr.sbin/pmcstat/pmcstat_log.c
new file mode 100644
index 0000000..3bce86f
--- /dev/null
+++ b/usr.sbin/pmcstat/pmcstat_log.c
@@ -0,0 +1,1863 @@
+/*-
+ * Copyright (c) 2005-2006, Joseph Koshy
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/*
+ * Transform a hwpmc(4) log into human readable form, and into
+ * gprof(1) compatible profiles.
+ */
+
+#include <sys/cdefs.h>
+/*__FBSDID("$FreeBSD: src/usr.sbin/pmcstat/pmcstat_log.c,v 1.10 2006-04-05 15:12:25 jkoshy Exp $");*/
+
+#include <sys/param.h>
+#include <sys/endian.h>
+#include <sys/gmon.h>
+#include <sys/imgact_aout.h>
+#include <sys/imgact_elf.h>
+#include <sys/mman.h>
+#include <sys/pmc.h>
+#include <sys/queue.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+
+#include <netinet/in.h>
+
+#include <assert.h>
+#include <err.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <libgen.h>
+#include <limits.h>
+#include <netdb.h>
+#include <pmc.h>
+#include <pmclog.h>
+#include <sysexits.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include "pmcstat.h"
+
+#define	min(A,B)		((A) < (B) ? (A) : (B))
+#define	max(A,B)		((A) > (B) ? (A) : (B))
+
+/*
+ * PUBLIC INTERFACES
+ *
+ * pmcstat_initialize_logging()	initialize this module, called first
+ * pmcstat_shutdown_logging()		orderly shutdown, called last
+ * pmcstat_open_log()			open an eventlog for processing
+ * pmcstat_process_log()		print/convert an event log
+ * pmcstat_close_log()			finish processing an event log
+ *
+ * IMPLEMENTATION OF GMON OUTPUT
+ *
+ * We correlate each 'sample' seen in the event log back to an
+ * executable object in the system. Executable objects include:
+ * 	- program executables,
+ *	- shared libraries loaded by the runtime loader,
+ *	- dlopen()'ed objects loaded by the program,
+ *	- the runtime loader itself,
+ *	- the kernel and kernel modules.
+ *
+ * Each such executable object gets one 'gmon.out' profile, per PMC in
+ * use.  Creation of 'gmon.out' profiles is done lazily.  The
+ * 'gmon.out' profiles generated for a given sampling PMC are
+ * aggregates of all the samples for that particular executable
+ * object.
+ *
+ * Each process that we know about is treated as a set of regions that
+ * map to executable objects.  Processes are described by
+ * 'pmcstat_process' structures.  Executable objects are tracked by
+ * 'pmcstat_image' structures.  The kernel and kernel modules are
+ * common to all processes (they reside at the same virtual addresses
+ * for all processes).  Individual processes can have their text
+ * segments and shared libraries loaded at process-specific locations.
+ *
+ * A given executable object can be in use by multiple processes
+ * (e.g., libc.so) and loaded at a different address in each.
+ * pmcstat_pcmap structures track per-image mappings.
+ *
+ * The sample log could have samples from multiple PMCs; we
+ * generate one 'gmon.out' profile per PMC.
+ */
+
+typedef const void *pmcstat_interned_string;
+
+/*
+ * 'pmcstat_pmcrecord' is a mapping from PMC ids to human-readable
+ * names.
+ */
+
+struct pmcstat_pmcrecord {
+	LIST_ENTRY(pmcstat_pmcrecord)	pr_next;
+	pmc_id_t			pr_pmcid;
+	pmcstat_interned_string	pr_pmcname;
+};
+
+static LIST_HEAD(,pmcstat_pmcrecord)	pmcstat_pmcs =
+	LIST_HEAD_INITIALIZER(&pmcstat_pmcs);
+
+
+/*
+ * struct pmcstat_gmonfile tracks a given 'gmon.out' file.  These
+ * files are mmap()'ed in as needed.
+ */
+
+struct pmcstat_gmonfile {
+	LIST_ENTRY(pmcstat_gmonfile)	pgf_next; /* list of entries */
+	int		pgf_overflow;	/* whether a count overflowed */
+	pmc_id_t	pgf_pmcid;	/* id of the associated pmc */
+	size_t		pgf_nbuckets;	/* #buckets in this gmon.out */
+	unsigned int	pgf_nsamples;	/* #samples in this gmon.out */
+	pmcstat_interned_string pgf_name;	/* pathname of gmon.out file */
+	size_t		pgf_ndatabytes;	/* number of bytes mapped */
+	void		*pgf_gmondata;	/* pointer to mmap'ed data */
+};
+
+/*
+ * A 'pmcstat_image' structure describes an executable program on
+ * disk.  'pi_execpath' is a cookie representing the pathname of
+ * the executable.  'pi_start' and 'pi_end' are the least and greatest
+ * virtual addresses for the text segments in the executable.
+ * 'pi_gmonlist' contains a linked list of gmon.out files associated
+ * with this image.
+ */
+
+enum pmcstat_image_type {
+	PMCSTAT_IMAGE_UNKNOWN = 0,	/* never looked at the image */
+	PMCSTAT_IMAGE_INDETERMINABLE,	/* can't tell what the image is */
+	PMCSTAT_IMAGE_ELF32,		/* ELF 32 bit object */
+	PMCSTAT_IMAGE_ELF64,		/* ELF 64 bit object */
+	PMCSTAT_IMAGE_AOUT		/* AOUT object */
+};
+
+struct pmcstat_image {
+	LIST_ENTRY(pmcstat_image) pi_next;	/* hash link */
+	TAILQ_ENTRY(pmcstat_image) pi_lru;	/* LRU list */
+	pmcstat_interned_string	pi_execpath;/* cookie */
+	pmcstat_interned_string pi_samplename;  /* sample path name */
+
+	enum pmcstat_image_type pi_type;	/* executable type */
+
+	/*
+	 * Executables have pi_start and pi_end; these are zero
+	 * for shared libraries.
+	 */
+	uintfptr_t	pi_start;		/* start address (inclusive) */
+	uintfptr_t	pi_end;			/* end address (exclusive) */
+	uintfptr_t	pi_entry;		/* entry address */
+	uintfptr_t	pi_vaddr;		/* virtual address where loaded */
+	int		pi_isdynamic;		/* whether a dynamic
+						 * object */
+	int		pi_iskernelmodule;
+	pmcstat_interned_string pi_dynlinkerpath; /* path in .interp */
+
+	/*
+	 * An image can be associated with one or more gmon.out files;
+	 * one per PMC.
+	 */
+	LIST_HEAD(,pmcstat_gmonfile) pi_gmlist;
+};
+
+/*
+ * All image descriptors are kept in a hash table.
+ */
+static LIST_HEAD(,pmcstat_image)	pmcstat_image_hash[PMCSTAT_NHASH];
+static TAILQ_HEAD(,pmcstat_image)	pmcstat_image_lru =
+	TAILQ_HEAD_INITIALIZER(pmcstat_image_lru);
+
+/*
+ * A 'pmcstat_pcmap' structure maps a virtual address range to an
+ * underlying 'pmcstat_image' descriptor.
+ */
+struct pmcstat_pcmap {
+	TAILQ_ENTRY(pmcstat_pcmap) ppm_next;
+	uintfptr_t	ppm_lowpc;
+	uintfptr_t	ppm_highpc;
+	struct pmcstat_image *ppm_image;
+};
+
+/*
+ * A 'pmcstat_process' structure models processes.  Each process is
+ * associated with a set of pmcstat_pcmap structures that map
+ * addresses inside it to executable objects.  This set is implemented
+ * as a list, kept sorted in ascending order of mapped addresses.
+ *
+ * 'pp_pid' holds the pid of the process.  When a process exits, the
+ * 'pp_isactive' field is set to zero, but the process structure is
+ * not immediately reclaimed because there may still be samples in the
+ * log for this process.
+ */
+
+struct pmcstat_process {
+	LIST_ENTRY(pmcstat_process) pp_next;	/* hash-next */
+	pid_t			pp_pid;		/* associated pid */
+	int			pp_isactive;	/* whether active */
+	uintfptr_t		pp_entryaddr;	/* entry address */
+	TAILQ_HEAD(,pmcstat_pcmap) pp_map;	/* address range map */
+};
+
+#define	PMCSTAT_ALLOCATE		1
+
+/*
+ * All process descriptors are kept in a hash table.
+ */
+static LIST_HEAD(,pmcstat_process) pmcstat_process_hash[PMCSTAT_NHASH];
+
+static struct pmcstat_process *pmcstat_kernproc; /* kernel 'process' */
+
+/* Misc. statistics */
+static struct pmcstat_stats {
+	int ps_exec_aout;	/* # a.out executables seen */
+	int ps_exec_elf;	/* # elf executables seen */
+	int ps_exec_errors;	/* # errors processing executables */
+	int ps_exec_indeterminable; /* # unknown executables seen */
+	int ps_samples_total;	/* total number of samples processed */
+	int ps_samples_unknown_offset;	/* #samples not in any map */
+	int ps_samples_indeterminable;	/* #samples in indeterminable images */
+} pmcstat_stats;
+
+/*
+ * Prototypes
+ */
+
+static void	pmcstat_gmon_create_file(struct pmcstat_gmonfile *_pgf,
+    struct pmcstat_image *_image);
+static pmcstat_interned_string pmcstat_gmon_create_name(const char *_sd,
+    struct pmcstat_image *_img, pmc_id_t _pmcid);
+static void	pmcstat_gmon_map_file(struct pmcstat_gmonfile *_pgf);
+static void	pmcstat_gmon_unmap_file(struct pmcstat_gmonfile *_pgf);
+
+static void pmcstat_image_determine_type(struct pmcstat_image *_image,
+    struct pmcstat_args *_a);
+static struct pmcstat_image *pmcstat_image_from_path(pmcstat_interned_string
+    _path, int _iskernelmodule);
+static void pmcstat_image_get_aout_params(struct pmcstat_image *_image,
+    struct pmcstat_args *_a);
+static void pmcstat_image_get_elf_params(struct pmcstat_image *_image,
+    struct pmcstat_args *_a);
+static void	pmcstat_image_increment_bucket(struct pmcstat_pcmap *_pcm,
+    uintfptr_t _pc, pmc_id_t _pmcid, struct pmcstat_args *_a);
+static void	pmcstat_image_link(struct pmcstat_process *_pp,
+    struct pmcstat_image *_i, uintfptr_t _lpc);
+
+static void	pmcstat_pmcid_add(pmc_id_t _pmcid,
+    pmcstat_interned_string _name, struct pmcstat_args *_a);
+static const char *pmcstat_pmcid_to_name(pmc_id_t _pmcid);
+
+static void	pmcstat_process_aout_exec(struct pmcstat_process *_pp,
+    struct pmcstat_image *_image, uintfptr_t _entryaddr,
+    struct pmcstat_args *_a);
+static void	pmcstat_process_elf_exec(struct pmcstat_process *_pp,
+    struct pmcstat_image *_image, uintfptr_t _entryaddr,
+    struct pmcstat_args *_a);
+static void	pmcstat_process_exec(struct pmcstat_process *_pp,
+    pmcstat_interned_string _path, uintfptr_t _entryaddr,
+    struct pmcstat_args *_ao);
+static struct pmcstat_process *pmcstat_process_lookup(pid_t _pid,
+    int _allocate);
+static struct pmcstat_pcmap *pmcstat_process_find_map(
+    struct pmcstat_process *_p, uintfptr_t _pc);
+
+static int	pmcstat_string_compute_hash(const char *_string);
+static void pmcstat_string_initialize(void);
+static pmcstat_interned_string pmcstat_string_intern(const char *_s);
+static pmcstat_interned_string pmcstat_string_lookup(const char *_s);
+static int	pmcstat_string_lookup_hash(pmcstat_interned_string _is);
+static void pmcstat_string_shutdown(void);
+static const char *pmcstat_string_unintern(pmcstat_interned_string _is);
+
+
+/*
+ * A simple implementation of interned strings.  Each interned string
+ * is assigned a unique address, so that subsequent string compares
+ * can be done by a simple pointer comparision instead of using
+ * strcmp().  This speeds up hash table lookups and saves memory if
+ * duplicate strings are the norm.
+ */
+struct pmcstat_string {
+	LIST_ENTRY(pmcstat_string)	ps_next;	/* hash link */
+	int		ps_len;
+	int		ps_hash;
+	char		*ps_string;
+};
+
+static LIST_HEAD(,pmcstat_string)	pmcstat_string_hash[PMCSTAT_NHASH];
+
+/*
+ * Compute a 'hash' value for a string.
+ */
+
+static int
+pmcstat_string_compute_hash(const char *s)
+{
+	int hash;
+
+	for (hash = 0; *s; s++)
+		hash ^= *s;
+
+	return (hash & PMCSTAT_HASH_MASK);
+}
+
+/*
+ * Intern a copy of string 's', and return a pointer to the
+ * interned structure.
+ */
+
+static pmcstat_interned_string
+pmcstat_string_intern(const char *s)
+{
+	struct pmcstat_string *ps;
+	const struct pmcstat_string *cps;
+	int hash, len;
+
+	if ((cps = pmcstat_string_lookup(s)) != NULL)
+		return (cps);
+
+	hash = pmcstat_string_compute_hash(s);
+	len  = strlen(s);
+
+	if ((ps = malloc(sizeof(*ps))) == NULL)
+		err(EX_OSERR, "ERROR: Could not intern string");
+	ps->ps_len = len;
+	ps->ps_hash = hash;
+	ps->ps_string = strdup(s);
+	LIST_INSERT_HEAD(&pmcstat_string_hash[hash], ps, ps_next);
+	return ((pmcstat_interned_string) ps);
+}
+
+static const char *
+pmcstat_string_unintern(pmcstat_interned_string str)
+{
+	const char *s;
+
+	s = ((const struct pmcstat_string *) str)->ps_string;
+	return (s);
+}
+
+static pmcstat_interned_string
+pmcstat_string_lookup(const char *s)
+{
+	struct pmcstat_string *ps;
+	int hash, len;
+
+	hash = pmcstat_string_compute_hash(s);
+	len = strlen(s);
+
+	LIST_FOREACH(ps, &pmcstat_string_hash[hash], ps_next)
+	    if (ps->ps_len == len && ps->ps_hash == hash &&
+		strcmp(ps->ps_string, s) == 0)
+		    return (ps);
+	return (NULL);
+}
+
+static int
+pmcstat_string_lookup_hash(pmcstat_interned_string s)
+{
+	const struct pmcstat_string *ps;
+
+	ps = (const struct pmcstat_string *) s;
+	return (ps->ps_hash);
+}
+
+/*
+ * Initialize the string interning facility.
+ */
+
+static void
+pmcstat_string_initialize(void)
+{
+	int i;
+
+	for (i = 0; i < PMCSTAT_NHASH; i++)
+		LIST_INIT(&pmcstat_string_hash[i]);
+}
+
+/*
+ * Destroy the string table, free'ing up space.
+ */
+
+static void
+pmcstat_string_shutdown(void)
+{
+	int i;
+	struct pmcstat_string *ps, *pstmp;
+
+	for (i = 0; i < PMCSTAT_NHASH; i++)
+		LIST_FOREACH_MUTABLE(ps, &pmcstat_string_hash[i], ps_next,
+		    pstmp) {
+			LIST_REMOVE(ps, ps_next);
+			free(ps->ps_string);
+			free(ps);
+		}
+}
+
+/*
+ * Create a gmon.out file and size it.
+ */
+
+static void
+pmcstat_gmon_create_file(struct pmcstat_gmonfile *pgf,
+    struct pmcstat_image *image)
+{
+	int fd;
+	size_t count;
+	struct gmonhdr gm;
+	const char *pathname;
+	char buffer[DEFAULT_BUFFER_SIZE];
+
+	pathname = pmcstat_string_unintern(pgf->pgf_name);
+	if ((fd = open(pathname, O_RDWR|O_NOFOLLOW|O_CREAT,
+		 S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH)) < 0)
+		err(EX_OSERR, "ERROR: Cannot open \"%s\"", pathname);
+
+	gm.lpc = image->pi_start;
+	gm.hpc = image->pi_end;
+	gm.ncnt = (pgf->pgf_nbuckets * sizeof(HISTCOUNTER)) +
+	    sizeof(struct gmonhdr);
+	gm.version = GMONVERSION;
+	gm.profrate = 0;		/* use ticks */
+	gm.spare[0] = gm.spare[1] = 0;
+
+	/* Write out the gmon header */
+	if (write(fd, &gm, sizeof(gm)) < 0)
+		goto error;
+
+	/* Zero fill the samples[] array */
+	(void) memset(buffer, 0, sizeof(buffer));
+
+	count = pgf->pgf_ndatabytes - sizeof(struct gmonhdr);
+	while (count > sizeof(buffer)) {
+		if (write(fd, &buffer, sizeof(buffer)) < 0)
+			goto error;
+		count -= sizeof(buffer);
+	}
+
+	if (write(fd, &buffer, count) < 0)
+		goto error;
+
+	/* TODO size the arc table */
+
+	(void) close(fd);
+
+	return;
+
+ error:
+	err(EX_OSERR, "ERROR: Cannot write \"%s\"", pathname);
+}
+
+/*
+ * Determine the full pathname of a gmon.out file for a given
+ * (image,pmcid) combination.  Return the interned string.
+ */
+
+pmcstat_interned_string
+pmcstat_gmon_create_name(const char *samplesdir, struct pmcstat_image *image,
+    pmc_id_t pmcid)
+{
+	const char *pmcname;
+	char fullpath[PATH_MAX];
+
+	pmcname = pmcstat_pmcid_to_name(pmcid);
+
+	(void) snprintf(fullpath, sizeof(fullpath),
+	    "%s/%s/%s", samplesdir, pmcname,
+	    pmcstat_string_unintern(image->pi_samplename));
+
+	return (pmcstat_string_intern(fullpath));
+}
+
+
+/*
+ * Mmap in a gmon.out file for processing.
+ */
+
+static void
+pmcstat_gmon_map_file(struct pmcstat_gmonfile *pgf)
+{
+	int fd;
+	const char *pathname;
+
+	pathname = pmcstat_string_unintern(pgf->pgf_name);
+
+	/* the gmon.out file must already exist */
+	if ((fd = open(pathname, O_RDWR | O_NOFOLLOW, 0)) < 0)
+		err(EX_OSERR, "ERROR: cannot open \"%s\"", pathname);
+
+	pgf->pgf_gmondata = mmap(NULL, pgf->pgf_ndatabytes,
+	    PROT_READ|PROT_WRITE, MAP_NOSYNC|MAP_SHARED, fd, 0);
+
+	if (pgf->pgf_gmondata == MAP_FAILED)
+		err(EX_OSERR, "ERROR: cannot map \"%s\"", pathname);
+
+	(void) close(fd);
+}
+
+/*
+ * Unmap a gmon.out file after sync'ing its data to disk.
+ */
+
+static void
+pmcstat_gmon_unmap_file(struct pmcstat_gmonfile *pgf)
+{
+	(void) msync(pgf->pgf_gmondata, pgf->pgf_ndatabytes,
+	    MS_SYNC);
+	(void) munmap(pgf->pgf_gmondata, pgf->pgf_ndatabytes);
+	pgf->pgf_gmondata = NULL;
+}
+
+/*
+ * Determine whether a given executable image is an A.OUT object, and
+ * if so, fill in its parameters from the text file.
+ * Sets image->pi_type.
+ */
+
+static void
+pmcstat_image_get_aout_params(struct pmcstat_image *image,
+    struct pmcstat_args *a)
+{
+	int fd;
+	ssize_t nbytes;
+	struct exec ex;
+	const char *path;
+	char buffer[PATH_MAX];
+
+	path = pmcstat_string_unintern(image->pi_execpath);
+	assert(path != NULL);
+
+	if (image->pi_iskernelmodule)
+		errx(EX_SOFTWARE, "ERROR: a.out kernel modules are "
+		    "unsupported \"%s\"", path);
+
+	(void) snprintf(buffer, sizeof(buffer), "%s%s",
+	    a->pa_fsroot, path);
+
+	if ((fd = open(buffer, O_RDONLY, 0)) < 0 ||
+	    (nbytes = read(fd, &ex, sizeof(ex))) < 0) {
+		warn("WARNING: Cannot determine type of \"%s\"", path);
+		image->pi_type = PMCSTAT_IMAGE_INDETERMINABLE;
+		if (fd != -1)
+			(void) close(fd);
+		return;
+	}
+
+	(void) close(fd);
+
+	if ((unsigned) nbytes != sizeof(ex) ||
+	    N_BADMAG(ex))
+		return;
+
+	image->pi_type = PMCSTAT_IMAGE_AOUT;
+
+	/* TODO: the rest of a.out processing */
+
+	return;
+}
+
+/*
+ * Examine an ELF file to determine the size of its text segment.
+ * Sets image->pi_type if anything conclusive can be determined about
+ * this image.
+ */
+
+static void
+pmcstat_image_get_elf_params(struct pmcstat_image *image,
+    struct pmcstat_args *a)
+{
+	int fd, i;
+	const char *path;
+	void *mapbase;
+	uintfptr_t minva, maxva;
+	const Elf_Ehdr *h;
+	const Elf_Phdr *ph;
+	const Elf_Shdr *sh;
+#if	defined(__amd64__)
+	const Elf32_Ehdr *h32;
+	const Elf32_Phdr *ph32;
+	const Elf32_Shdr *sh32;
+#endif
+	enum pmcstat_image_type image_type;
+	struct stat st;
+	char buffer[PATH_MAX];
+
+	assert(image->pi_type == PMCSTAT_IMAGE_UNKNOWN);
+
+	minva = ~(uintfptr_t) 0;
+	maxva = (uintfptr_t) 0;
+	path = pmcstat_string_unintern(image->pi_execpath);
+
+	assert(path != NULL);
+
+	/*
+	 * Look for kernel modules under FSROOT/KERNELPATH/NAME,
+	 * and user mode executable objects under FSROOT/PATHNAME.
+	 */
+	if (image->pi_iskernelmodule)
+		(void) snprintf(buffer, sizeof(buffer), "%s%s/%s",
+		    a->pa_fsroot, a->pa_kernel, path);
+	else
+		(void) snprintf(buffer, sizeof(buffer), "%s%s",
+		    a->pa_fsroot, path);
+
+	if ((fd = open(buffer, O_RDONLY, 0)) < 0 ||
+	    fstat(fd, &st) < 0 ||
+	    (mapbase = mmap(0, st.st_size, PROT_READ, MAP_SHARED,
+		fd, 0)) == MAP_FAILED) {
+		warn("WARNING: Cannot determine type of \"%s\"", buffer);
+		image->pi_type = PMCSTAT_IMAGE_INDETERMINABLE;
+		if (fd != -1)
+			(void) close(fd);
+		return;
+	}
+
+	(void) close(fd);
+
+	/* Punt on non-ELF objects */
+	h = (const Elf_Ehdr *) mapbase;
+	if (!IS_ELF(*h))
+		return;
+
+	/*
+	 * We only handle executable ELF objects and kernel
+	 * modules.
+	 */
+	if (h->e_type != ET_EXEC && h->e_type != ET_DYN &&
+	    !(image->pi_iskernelmodule && h->e_type == ET_REL))
+		return;
+
+	image->pi_isdynamic = 0;
+	image->pi_dynlinkerpath = NULL;
+	image->pi_vaddr = 0;
+
+#define	GET_VA(H, SH, MINVA, MAXVA) do {				\
+		for (i = 0; i < (H)->e_shnum; i++)			\
+			if ((SH)[i].sh_flags & SHF_EXECINSTR) {		\
+				(MINVA) = min((MINVA),(SH)[i].sh_addr);	\
+				(MAXVA) = max((MAXVA),(SH)[i].sh_addr +	\
+				    (SH)[i].sh_size);			\
+			}						\
+	} while (0)
+
+
+#define	GET_PHDR_INFO(H, PH, IMAGE) do {				\
+		for (i = 0; i < (H)->e_phnum; i++) {			\
+			switch ((PH)[i].p_type) {			\
+			case PT_DYNAMIC:				\
+				image->pi_isdynamic = 1;		\
+				break;					\
+			case PT_INTERP:					\
+				image->pi_dynlinkerpath =		\
+				    pmcstat_string_intern(		\
+					(char *) mapbase +		\
+					(PH)[i].p_offset);		\
+				break;					\
+			case PT_LOAD:					\
+				if ((PH)[i].p_offset == 0)		\
+				    image->pi_vaddr = 			\
+					(PH)[i].p_vaddr;		\
+				break;					\
+			}						\
+		}							\
+	} while (0)
+
+	switch (h->e_machine) {
+#if	defined(__amd64__)
+	case EM_386:
+	case EM_486:
+		/* a 32 bit executable */
+		h32 = (const Elf32_Ehdr *) h;
+		sh32 = (const Elf32_Shdr *)((uintptr_t) mapbase + h32->e_shoff);
+
+		GET_VA(h32, sh32, minva, maxva);
+
+		image->pi_entry = h32->e_entry;
+
+		if (h32->e_type == ET_EXEC) {
+			ph32 = (const Elf32_Phdr *)((uintptr_t) mapbase +
+			    h32->e_phoff);
+			GET_PHDR_INFO(h32, ph32, image);
+		}
+		image_type = PMCSTAT_IMAGE_ELF32;
+		break;
+#endif
+	default:
+		sh = (const Elf_Shdr *)((uintptr_t) mapbase + h->e_shoff);
+
+		GET_VA(h, sh, minva, maxva);
+
+		image->pi_entry = h->e_entry;
+
+		if (h->e_type == ET_EXEC) {
+			ph = (const Elf_Phdr *)((uintptr_t) mapbase +
+			    h->e_phoff);
+			GET_PHDR_INFO(h, ph, image);
+		}
+		image_type = PMCSTAT_IMAGE_ELF64;
+		break;
+	}
+
+#undef	GET_PHDR_INFO
+#undef	GET_VA
+
+	image->pi_start = minva;
+	image->pi_end   = maxva;
+	image->pi_type  = image_type;
+
+	if (munmap(mapbase, st.st_size) < 0)
+		err(EX_OSERR, "ERROR: Cannot unmap \"%s\"", path);
+	return;
+}
+
+/*
+ * Given an image descriptor, determine whether it is an ELF, or AOUT.
+ * If no handler claims the image, set its type to 'INDETERMINABLE'.
+ */
+
+static void
+pmcstat_image_determine_type(struct pmcstat_image *image,
+    struct pmcstat_args *a)
+{
+	assert(image->pi_type == PMCSTAT_IMAGE_UNKNOWN);
+
+	/* Try each kind of handler in turn */
+	if (image->pi_type == PMCSTAT_IMAGE_UNKNOWN)
+		pmcstat_image_get_elf_params(image, a);
+	if (image->pi_type == PMCSTAT_IMAGE_UNKNOWN)
+		pmcstat_image_get_aout_params(image, a);
+
+	/*
+	 * Otherwise, remember that we tried to determine
+	 * the object's type and had failed.
+	 */
+	if (image->pi_type == PMCSTAT_IMAGE_UNKNOWN)
+		image->pi_type = PMCSTAT_IMAGE_INDETERMINABLE;
+}
+
+/*
+ * Locate an image descriptor given an interned path, adding a fresh
+ * descriptor to the cache if necessary.  This function also finds a
+ * suitable name for this image's sample file.
+ *
+ * We defer filling in the file format specific parts of the image
+ * structure till the time we actually see a sample that would fall
+ * into this image.
+ */
+
+static struct pmcstat_image *
+pmcstat_image_from_path(pmcstat_interned_string internedpath,
+    int iskernelmodule)
+{
+	int count, hash, nlen;
+	struct pmcstat_image *pi;
+	char *sn;
+	char name[NAME_MAX];
+
+	hash = pmcstat_string_lookup_hash(internedpath);
+
+	/* First, look for an existing entry. */
+	LIST_FOREACH(pi, &pmcstat_image_hash[hash], pi_next)
+	    if (pi->pi_execpath == internedpath &&
+		  pi->pi_iskernelmodule == iskernelmodule) {
+		    /* move descriptor to the head of the lru list */
+		    TAILQ_REMOVE(&pmcstat_image_lru, pi, pi_lru);
+		    TAILQ_INSERT_HEAD(&pmcstat_image_lru, pi, pi_lru);
+		    return (pi);
+	    }
+
+	/*
+	 * Allocate a new entry and place at the head of the hash and
+	 * LRU lists.
+	 */
+	pi = malloc(sizeof(*pi));
+	if (pi == NULL)
+		return (NULL);
+
+	pi->pi_type = PMCSTAT_IMAGE_UNKNOWN;
+	pi->pi_execpath = internedpath;
+	pi->pi_start = ~0;
+	pi->pi_entry = ~0;
+	pi->pi_end = 0;
+	pi->pi_iskernelmodule = iskernelmodule;
+
+	/*
+	 * Look for a suitable name for the sample files associated
+	 * with this image: if `basename(path)`+".gmon" is available,
+	 * we use that, otherwise we try iterating through
+	 * `basename(path)`+ "~" + NNN + ".gmon" till we get a free
+	 * entry.
+	 */
+	if ((sn = basename(pmcstat_string_unintern(internedpath))) == NULL)
+		err(EX_OSERR, "ERROR: Cannot process \"%s\"",
+		    pmcstat_string_unintern(internedpath));
+
+	nlen = strlen(sn);
+	nlen = min(nlen, (int) (sizeof(name) - sizeof(".gmon")));
+
+	snprintf(name, sizeof(name), "%.*s.gmon", nlen, sn);
+
+	/* try use the unabridged name first */
+	if (pmcstat_string_lookup(name) == NULL)
+		pi->pi_samplename = pmcstat_string_intern(name);
+	else {
+		/*
+		 * Otherwise use a prefix from the original name and
+		 * upto 3 digits.
+		 */
+		nlen = strlen(sn);
+		nlen = min(nlen, (int) (sizeof(name)-sizeof("~NNN.gmon")));
+		count = 0;
+		do {
+			if (++count > 999)
+				errx(EX_CANTCREAT, "ERROR: cannot create a gmon "
+				    "file for \"%s\"", name);
+			snprintf(name, sizeof(name), "%.*s~%3.3d.gmon",
+			    nlen, sn, count);
+			if (pmcstat_string_lookup(name) == NULL) {
+				pi->pi_samplename = pmcstat_string_intern(name);
+				count = 0;
+			}
+		} while (count > 0);
+	}
+
+
+	LIST_INIT(&pi->pi_gmlist);
+
+	LIST_INSERT_HEAD(&pmcstat_image_hash[hash], pi, pi_next);
+	TAILQ_INSERT_HEAD(&pmcstat_image_lru, pi, pi_lru);
+
+	return (pi);
+}
+
+/*
+ * Increment the bucket in the gmon.out file corresponding to 'pmcid'
+ * and 'pc'.
+ */
+
+static void
+pmcstat_image_increment_bucket(struct pmcstat_pcmap *map, uintfptr_t pc,
+    pmc_id_t pmcid, struct pmcstat_args *a)
+{
+	struct pmcstat_image *image;
+	struct pmcstat_gmonfile *pgf;
+	uintfptr_t bucket;
+	HISTCOUNTER *hc;
+
+	assert(pc >= map->ppm_lowpc && pc < map->ppm_highpc);
+
+	image = map->ppm_image;
+
+	/*
+	 * If this is the first time we are seeing a sample for
+	 * this executable image, try determine its parameters.
+	 */
+	if (image->pi_type == PMCSTAT_IMAGE_UNKNOWN)
+		pmcstat_image_determine_type(image, a);
+
+	assert(image->pi_type != PMCSTAT_IMAGE_UNKNOWN);
+
+	/* Ignore samples in images that we know nothing about. */
+	if (image->pi_type == PMCSTAT_IMAGE_INDETERMINABLE) {
+		pmcstat_stats.ps_samples_indeterminable++;
+		return;
+	}
+
+	/*
+	 * Find the gmon file corresponding to 'pmcid', creating it if
+	 * needed.
+	 */
+	LIST_FOREACH(pgf, &image->pi_gmlist, pgf_next)
+	    if (pgf->pgf_pmcid == pmcid)
+		    break;
+
+	/* If we don't have a gmon.out file for this PMCid, create one */
+	if (pgf == NULL) {
+		if ((pgf = calloc(1, sizeof(*pgf))) == NULL)
+			err(EX_OSERR, "ERROR:");
+
+		pgf->pgf_gmondata = NULL;	/* mark as unmapped */
+		pgf->pgf_name = pmcstat_gmon_create_name(a->pa_samplesdir,
+		    image, pmcid);
+		pgf->pgf_pmcid = pmcid;
+		assert(image->pi_end > image->pi_start);
+		pgf->pgf_nbuckets = (image->pi_end - image->pi_start) /
+		    FUNCTION_ALIGNMENT;	/* see <machine/profile.h> */
+		pgf->pgf_ndatabytes = sizeof(struct gmonhdr) +
+		    pgf->pgf_nbuckets * sizeof(HISTCOUNTER);
+		pgf->pgf_nsamples = 0;
+
+		pmcstat_gmon_create_file(pgf, image);
+
+		LIST_INSERT_HEAD(&image->pi_gmlist, pgf, pgf_next);
+	}
+
+	/*
+	 * Map the gmon file in if needed.  It may have been mapped
+	 * out under memory pressure.
+	 */
+	if (pgf->pgf_gmondata == NULL)
+		pmcstat_gmon_map_file(pgf);
+
+	assert(pgf->pgf_gmondata != NULL);
+
+	/*
+	 *
+	 */
+
+	bucket = (pc - map->ppm_lowpc) / FUNCTION_ALIGNMENT;
+
+	assert(bucket < pgf->pgf_nbuckets);
+
+	hc = (HISTCOUNTER *) ((uintptr_t) pgf->pgf_gmondata +
+	    sizeof(struct gmonhdr));
+
+	/* saturating add */
+	if (hc[bucket] < 0xFFFFU)  /* XXX tie this to sizeof(HISTCOUNTER) */
+		hc[bucket]++;
+	else /* mark that an overflow occurred */
+		pgf->pgf_overflow = 1;
+
+	pgf->pgf_nsamples++;
+}
+
+/*
+ * Record the fact that PC values from 'start' to 'end' come from
+ * image 'image'.
+ */
+
+static void
+pmcstat_image_link(struct pmcstat_process *pp, struct pmcstat_image *image,
+    uintfptr_t start)
+{
+	struct pmcstat_pcmap *pcm, *pcmnew;
+	uintfptr_t offset;
+
+	assert(image->pi_type != PMCSTAT_IMAGE_UNKNOWN &&
+	    image->pi_type != PMCSTAT_IMAGE_INDETERMINABLE);
+
+	if ((pcmnew = malloc(sizeof(*pcmnew))) == NULL)
+		err(EX_OSERR, "ERROR: Cannot create a map entry");
+
+	/*
+	 * Adjust the map entry to only cover the text portion
+	 * of the object.
+	 */
+
+	offset = start - image->pi_vaddr;
+	pcmnew->ppm_lowpc  = image->pi_start + offset;
+	pcmnew->ppm_highpc = image->pi_end + offset;
+	pcmnew->ppm_image  = image;
+
+	assert(pcmnew->ppm_lowpc < pcmnew->ppm_highpc);
+
+	/* Overlapped mmap()'s are assumed to never occur. */
+	TAILQ_FOREACH(pcm, &pp->pp_map, ppm_next)
+	    if (pcm->ppm_lowpc >= pcmnew->ppm_highpc)
+		    break;
+
+	if (pcm == NULL)
+		TAILQ_INSERT_TAIL(&pp->pp_map, pcmnew, ppm_next);
+	else
+		TAILQ_INSERT_BEFORE(pcm, pcmnew, ppm_next);
+}
+
+/*
+ * Unmap images in the range [start..end) associated with process
+ * 'pp'.
+ */
+
+static void
+pmcstat_image_unmap(struct pmcstat_process *pp, uintfptr_t start,
+    uintfptr_t end)
+{
+	struct pmcstat_pcmap *pcm, *pcmtmp, *pcmnew;
+
+	assert(pp != NULL);
+	assert(start < end);
+
+	/*
+	 * Cases:
+	 * - we could have the range completely in the middle of an
+	 *   existing pcmap; in this case we have to split the pcmap
+	 *   structure into two (i.e., generate a 'hole').
+	 * - we could have the range covering multiple pcmaps; these
+	 *   will have to be removed.
+	 * - we could have either 'start' or 'end' falling in the
+	 *   middle of a pcmap; in this case shorten the entry.
+	 */
+
+	TAILQ_FOREACH_MUTABLE(pcm, &pp->pp_map, ppm_next, pcmtmp) {
+		assert(pcm->ppm_lowpc < pcm->ppm_highpc);
+		if (pcm->ppm_highpc <= start)
+			continue;
+		if (pcm->ppm_lowpc > end)
+			return;
+		if (pcm->ppm_lowpc >= start && pcm->ppm_highpc <= end) {
+			/*
+			 * The current pcmap is completely inside the
+			 * unmapped range: remove it entirely.
+			 */
+			TAILQ_REMOVE(&pp->pp_map, pcm, ppm_next);
+			free(pcm);
+		} else if (pcm->ppm_lowpc < start && pcm->ppm_highpc > end) {
+			/*
+			 * Split this pcmap into two; curtail the
+			 * current map to end at [start-1], and start
+			 * the new one at [end].
+			 */
+			if ((pcmnew = malloc(sizeof(*pcmnew))) == NULL)
+				err(EX_OSERR, "ERROR: Cannot split a map "
+				    "entry");
+
+			pcmnew->ppm_image = pcm->ppm_image;
+
+			pcmnew->ppm_lowpc = end;
+			pcmnew->ppm_highpc = pcm->ppm_highpc;
+
+			pcm->ppm_highpc = start;
+
+			TAILQ_INSERT_AFTER(&pp->pp_map, pcm, pcmnew, ppm_next);
+
+			return;
+		} else if (pcm->ppm_lowpc < start)
+			pcm->ppm_lowpc = start;
+		else if (pcm->ppm_highpc > end)
+			pcm->ppm_highpc = end;
+		else
+			assert(0);
+	}
+}
+
+/*
+ * Add a {pmcid,name} mapping.
+ */
+
+static void
+pmcstat_pmcid_add(pmc_id_t pmcid, pmcstat_interned_string ps,
+    struct pmcstat_args *a)
+{
+	struct pmcstat_pmcrecord *pr;
+	struct stat st;
+	char fullpath[PATH_MAX];
+
+	LIST_FOREACH(pr, &pmcstat_pmcs, pr_next)
+	    if (pr->pr_pmcid == pmcid) {
+		    pr->pr_pmcname = ps;
+		    return;
+	    }
+
+	if ((pr = malloc(sizeof(*pr))) == NULL)
+		err(EX_OSERR, "ERROR: Cannot allocate pmc record");
+
+	pr->pr_pmcid = pmcid;
+	pr->pr_pmcname = ps;
+	LIST_INSERT_HEAD(&pmcstat_pmcs, pr, pr_next);
+
+	(void) snprintf(fullpath, sizeof(fullpath), "%s/%s", a->pa_samplesdir,
+	    pmcstat_string_unintern(ps));
+
+	/* If the path name exists, it should be a directory */
+	if (stat(fullpath, &st) == 0 && S_ISDIR(st.st_mode))
+		return;
+
+	if (mkdir(fullpath, S_IRWXU|S_IRGRP|S_IXGRP|S_IROTH|S_IXOTH) < 0)
+		err(EX_OSERR, "ERROR: Cannot create directory \"%s\"",
+		    fullpath);
+}
+
+/*
+ * Given a pmcid in use, find its human-readable name.
+ */
+
+static const char *
+pmcstat_pmcid_to_name(pmc_id_t pmcid)
+{
+	struct pmcstat_pmcrecord *pr;
+	char fullpath[PATH_MAX];
+
+	LIST_FOREACH(pr, &pmcstat_pmcs, pr_next)
+	    if (pr->pr_pmcid == pmcid)
+		    return (pmcstat_string_unintern(pr->pr_pmcname));
+
+	/* create a default name and add this entry */
+	if ((pr = malloc(sizeof(*pr))) == NULL)
+		err(EX_OSERR, "ERROR: ");
+	pr->pr_pmcid = pmcid;
+
+	(void) snprintf(fullpath, sizeof(fullpath), "%X", (unsigned int) pmcid);
+	pr->pr_pmcname = pmcstat_string_intern(fullpath);
+
+	LIST_INSERT_HEAD(&pmcstat_pmcs, pr, pr_next);
+
+	return (pmcstat_string_unintern(pr->pr_pmcname));
+}
+
+/*
+ * Associate an AOUT image with a process.
+ */
+
+static void
+pmcstat_process_aout_exec(struct pmcstat_process *pp,
+    struct pmcstat_image *image, uintfptr_t entryaddr,
+    struct pmcstat_args *a)
+{
+	(void) pp;
+	(void) image;
+	(void) entryaddr;
+	(void) a;
+	/* TODO Implement a.out handling */
+}
+
+/*
+ * Associate an ELF image with a process.
+ */
+
+static void
+pmcstat_process_elf_exec(struct pmcstat_process *pp,
+    struct pmcstat_image *image, uintfptr_t entryaddr,
+    struct pmcstat_args *a)
+{
+	uintmax_t libstart;
+	struct pmcstat_image *rtldimage;
+
+	assert(image->pi_type == PMCSTAT_IMAGE_ELF32 ||
+	    image->pi_type == PMCSTAT_IMAGE_ELF64);
+
+	/* Create a map entry for the base executable. */
+	pmcstat_image_link(pp, image, image->pi_vaddr);
+
+	/*
+	 * For dynamically linked executables we need to:
+	 * (a) find where the dynamic linker was mapped to for this
+	 *     process,
+	 * (b) find all the executable objects that the dynamic linker
+	 *     brought in.
+	 */
+
+	if (image->pi_isdynamic) {
+
+		/*
+		 * The runtime loader gets loaded just after the maximum
+		 * possible heap address.  Like so:
+		 *
+		 * [  TEXT DATA BSS HEAP -->*RTLD  SHLIBS   <--STACK]
+		 * ^					            ^
+		 * 0				   VM_MAXUSER_ADDRESS
+
+		 *
+		 * The exact address where the loader gets mapped in
+		 * will vary according to the size of the executable
+		 * and the limits on the size of the process'es data
+		 * segment at the time of exec().  The entry address
+		 * recorded at process exec time corresponds to the
+		 * 'start' address inside the dynamic linker.  From
+		 * this we can figure out the address where the
+		 * runtime loader's file object had been mapped to.
+		 */
+		rtldimage = pmcstat_image_from_path(image->pi_dynlinkerpath,
+		    0);
+		if (rtldimage == NULL) {
+			warnx("WARNING: Cannot find image for \"%s\".",
+			    pmcstat_string_unintern(image->pi_dynlinkerpath));
+			pmcstat_stats.ps_exec_errors++;
+			return;
+		}
+
+		if (rtldimage->pi_type == PMCSTAT_IMAGE_UNKNOWN)
+			pmcstat_image_get_elf_params(rtldimage, a);
+
+		if (rtldimage->pi_type != PMCSTAT_IMAGE_ELF32 &&
+		    rtldimage->pi_type != PMCSTAT_IMAGE_ELF64) {
+			warnx("WARNING: rtld not an ELF object \"%s\".",
+			    pmcstat_string_unintern(image->pi_dynlinkerpath));
+			return;
+		}
+
+		libstart = entryaddr - rtldimage->pi_entry;
+		pmcstat_image_link(pp, rtldimage, libstart);
+	}
+}
+
+/*
+ * Find the process descriptor corresponding to a PID.  If 'allocate'
+ * is zero, we return a NULL if a pid descriptor could not be found or
+ * a process descriptor process.  If 'allocate' is non-zero, then we
+ * will attempt to allocate a fresh process descriptor.  Zombie
+ * process descriptors are only removed if a fresh allocation for the
+ * same PID is requested.
+ */
+
+static struct pmcstat_process *
+pmcstat_process_lookup(pid_t pid, int allocate)
+{
+	uint32_t hash;
+	struct pmcstat_pcmap *ppm, *ppmtmp;
+	struct pmcstat_process *pp, *pptmp;
+
+	hash = (uint32_t) pid & PMCSTAT_HASH_MASK;	/* simplicity wins */
+
+	LIST_FOREACH_MUTABLE(pp, &pmcstat_process_hash[hash], pp_next, pptmp)
+	    if (pp->pp_pid == pid) {
+		    /* Found a descriptor, check and process zombies */
+		    if (allocate && pp->pp_isactive == 0) {
+			    /* remove maps */
+			    TAILQ_FOREACH_MUTABLE(ppm, &pp->pp_map, ppm_next,
+				ppmtmp) {
+				    TAILQ_REMOVE(&pp->pp_map, ppm, ppm_next);
+				    free(ppm);
+			    }
+			    /* remove process entry */
+			    LIST_REMOVE(pp, pp_next);
+			    free(pp);
+			    break;
+		    }
+		    return (pp);
+	    }
+
+	if (!allocate)
+		return (NULL);
+
+	if ((pp = malloc(sizeof(*pp))) == NULL)
+		err(EX_OSERR, "ERROR: Cannot allocate pid descriptor");
+
+	pp->pp_pid = pid;
+	pp->pp_isactive = 1;
+
+	TAILQ_INIT(&pp->pp_map);
+
+	LIST_INSERT_HEAD(&pmcstat_process_hash[hash], pp, pp_next);
+	return (pp);
+}
+
+/*
+ * Associate an image and a process.
+ */
+
+static void
+pmcstat_process_exec(struct pmcstat_process *pp,
+    pmcstat_interned_string path, uintfptr_t entryaddr,
+    struct pmcstat_args *a)
+{
+	struct pmcstat_image *image;
+
+	if ((image = pmcstat_image_from_path(path, 0)) == NULL) {
+		pmcstat_stats.ps_exec_errors++;
+		return;
+	}
+
+	if (image->pi_type == PMCSTAT_IMAGE_UNKNOWN)
+		pmcstat_image_determine_type(image, a);
+
+	assert(image->pi_type != PMCSTAT_IMAGE_UNKNOWN);
+
+	switch (image->pi_type) {
+	case PMCSTAT_IMAGE_ELF32:
+	case PMCSTAT_IMAGE_ELF64:
+		pmcstat_stats.ps_exec_elf++;
+		pmcstat_process_elf_exec(pp, image, entryaddr, a);
+		break;
+
+	case PMCSTAT_IMAGE_AOUT:
+		pmcstat_stats.ps_exec_aout++;
+		pmcstat_process_aout_exec(pp, image, entryaddr, a);
+		break;
+
+	case PMCSTAT_IMAGE_INDETERMINABLE:
+		pmcstat_stats.ps_exec_indeterminable++;
+		break;
+
+	default:
+		err(EX_SOFTWARE, "ERROR: Unsupported executable type for "
+		    "\"%s\"", pmcstat_string_unintern(path));
+	}
+}
+
+
+/*
+ * Find the map entry associated with process 'p' at PC value 'pc'.
+ */
+
+static struct pmcstat_pcmap *
+pmcstat_process_find_map(struct pmcstat_process *p, uintfptr_t pc)
+{
+	struct pmcstat_pcmap *ppm;
+
+	TAILQ_FOREACH(ppm, &p->pp_map, ppm_next) {
+		if (pc >= ppm->ppm_lowpc && pc < ppm->ppm_highpc)
+			return (ppm);
+		if (pc < ppm->ppm_lowpc)
+			return (NULL);
+	}
+
+	return (NULL);
+}
+
+
+
+static int
+pmcstat_convert_log(struct pmcstat_args *a)
+{
+	uintfptr_t pc;
+	pid_t pid;
+	struct pmcstat_image *image;
+	struct pmcstat_process *pp, *ppnew;
+	struct pmcstat_pcmap *ppm, *ppmtmp;
+	struct pmclog_ev ev;
+	pmcstat_interned_string image_path;
+
+	while (pmclog_read(a->pa_logparser, &ev) == 0) {
+		assert(ev.pl_state == PMCLOG_OK);
+
+		switch (ev.pl_type) {
+		case PMCLOG_TYPE_INITIALIZE:
+			if ((ev.pl_u.pl_i.pl_version & 0xFF000000) !=
+			    PMC_VERSION_MAJOR << 24 && a->pa_verbosity > 0)
+				warnx("WARNING: Log version 0x%x does not "
+				    "match compiled version 0x%x.",
+				    ev.pl_u.pl_i.pl_version,
+				    PMC_VERSION_MAJOR);
+			break;
+		case PMCLOG_TYPE_MAP_IN:
+			/*
+			 * Introduce an address range mapping for a
+			 * userland process or the kernel (pid == -1).
+			 *
+			 * We always allocate a process descriptor so
+			 * that subsequent samples seen for this
+			 * address range are mapped to the current
+			 * object being mapped in.
+			 */
+			pid = ev.pl_u.pl_mi.pl_pid;
+			if (pid == -1)
+				pp = pmcstat_kernproc;
+			else
+				pp = pmcstat_process_lookup(pid,
+				    PMCSTAT_ALLOCATE);
+
+			assert(pp != NULL);
+
+			image_path = pmcstat_string_intern(ev.pl_u.pl_mi.
+			    pl_pathname);
+			image = pmcstat_image_from_path(image_path, pid == -1);
+			if (image->pi_type == PMCSTAT_IMAGE_UNKNOWN)
+				pmcstat_image_determine_type(image, a);
+			if (image->pi_type != PMCSTAT_IMAGE_INDETERMINABLE)
+				pmcstat_image_link(pp, image,
+				    ev.pl_u.pl_mi.pl_start);
+			break;
+
+		case PMCLOG_TYPE_MAP_OUT:
+			/*
+			 * Remove an address map.
+			 */
+			pid = ev.pl_u.pl_mo.pl_pid;
+			if (pid == -1)
+				pp = pmcstat_kernproc;
+			else
+				pp = pmcstat_process_lookup(pid, 0);
+
+			if (pp == NULL)	/* unknown process */
+				break;
+
+			pmcstat_image_unmap(pp, ev.pl_u.pl_mo.pl_start,
+			    ev.pl_u.pl_mo.pl_end);
+			break;
+
+		case PMCLOG_TYPE_PCSAMPLE:
+
+			/*
+			 * We bring in the gmon file for the image
+			 * currently associated with the PMC & pid
+			 * pair and increment the appropriate entry
+			 * bin inside this.
+			 */
+			pmcstat_stats.ps_samples_total++;
+
+			pc = ev.pl_u.pl_s.pl_pc;
+			pp = pmcstat_process_lookup(ev.pl_u.pl_s.pl_pid,
+			    PMCSTAT_ALLOCATE);
+			if ((ppm = pmcstat_process_find_map(pp, pc)) == NULL &&
+			    (ppm = pmcstat_process_find_map(pmcstat_kernproc,
+				pc)) == NULL) {	/* unknown process,offset pair */
+				pmcstat_stats.ps_samples_unknown_offset++;
+				break;
+			}
+
+			pmcstat_image_increment_bucket(ppm, pc,
+			    ev.pl_u.pl_s.pl_pmcid, a);
+
+			break;
+
+		case PMCLOG_TYPE_PMCALLOCATE:
+			/*
+			 * Record the association pmc id between this
+			 * PMC and its name.
+			 */
+			pmcstat_pmcid_add(ev.pl_u.pl_a.pl_pmcid,
+			    pmcstat_string_intern(ev.pl_u.pl_a.pl_evname), a);
+			break;
+
+		case PMCLOG_TYPE_PROCEXEC:
+
+			/*
+			 * Change the executable image associated with
+			 * a process.
+			 */
+			pp = pmcstat_process_lookup(ev.pl_u.pl_x.pl_pid,
+			    PMCSTAT_ALLOCATE);
+
+			/* delete the current process map */
+			TAILQ_FOREACH_MUTABLE(ppm, &pp->pp_map, ppm_next, ppmtmp) {
+				TAILQ_REMOVE(&pp->pp_map, ppm, ppm_next);
+				free(ppm);
+			}
+
+			/* associate this process  image */
+			image_path = pmcstat_string_intern(
+				ev.pl_u.pl_x.pl_pathname);
+			assert(image_path != NULL);
+			pmcstat_process_exec(pp, image_path,
+			    ev.pl_u.pl_x.pl_entryaddr, a);
+			break;
+
+		case PMCLOG_TYPE_PROCEXIT:
+
+			/*
+			 * Due to the way the log is generated, the
+			 * last few samples corresponding to a process
+			 * may appear in the log after the process
+			 * exit event is recorded.  Thus we keep the
+			 * process' descriptor and associated data
+			 * structures around, but mark the process as
+			 * having exited.
+			 */
+			pp = pmcstat_process_lookup(ev.pl_u.pl_e.pl_pid, 0);
+			if (pp == NULL)
+				break;
+			pp->pp_isactive = 0;	/* mark as a zombie */
+			break;
+
+		case PMCLOG_TYPE_SYSEXIT:
+			pp = pmcstat_process_lookup(ev.pl_u.pl_se.pl_pid, 0);
+			if (pp == NULL)
+				break;
+			pp->pp_isactive = 0;	/* make a zombie */
+			break;
+
+		case PMCLOG_TYPE_PROCFORK:
+
+			/*
+			 * Allocate a process descriptor for the new
+			 * (child) process.
+			 */
+			ppnew =
+			    pmcstat_process_lookup(ev.pl_u.pl_f.pl_newpid,
+				PMCSTAT_ALLOCATE);
+
+			/*
+			 * If we had been tracking the parent, clone
+			 * its address maps.
+			 */
+			pp = pmcstat_process_lookup(ev.pl_u.pl_f.pl_oldpid, 0);
+			if (pp == NULL)
+				break;
+			TAILQ_FOREACH(ppm, &pp->pp_map, ppm_next)
+			    pmcstat_image_link(ppnew, ppm->ppm_image,
+				ppm->ppm_lowpc);
+			break;
+
+		default:	/* other types of entries are not relevant */
+			break;
+		}
+	}
+
+	if (ev.pl_state == PMCLOG_EOF)
+		return (PMCSTAT_FINISHED);
+	else if (ev.pl_state == PMCLOG_REQUIRE_DATA)
+		return (PMCSTAT_RUNNING);
+
+	err(EX_DATAERR, "ERROR: event parsing failed (record %jd, "
+	    "offset 0x%jx)", (uintmax_t) ev.pl_count + 1, ev.pl_offset);
+}
+
+/*
+ * Print log entries as text.
+ */
+
+static int
+pmcstat_print_log(struct pmcstat_args *a)
+{
+	struct pmclog_ev ev;
+
+	while (pmclog_read(a->pa_logparser, &ev) == 0) {
+		assert(ev.pl_state == PMCLOG_OK);
+		switch (ev.pl_type) {
+		case PMCLOG_TYPE_CLOSELOG:
+			PMCSTAT_PRINT_ENTRY(a,"closelog",);
+			break;
+		case PMCLOG_TYPE_DROPNOTIFY:
+			PMCSTAT_PRINT_ENTRY(a,"drop",);
+			break;
+		case PMCLOG_TYPE_INITIALIZE:
+			PMCSTAT_PRINT_ENTRY(a,"initlog","0x%x \"%s\"",
+			    ev.pl_u.pl_i.pl_version,
+			    pmc_name_of_cputype(ev.pl_u.pl_i.pl_arch));
+			break;
+		case PMCLOG_TYPE_MAP_IN:
+			PMCSTAT_PRINT_ENTRY(a,"map-in","%d %p \"%s\"",
+			    ev.pl_u.pl_mi.pl_pid,
+			    (void *) ev.pl_u.pl_mi.pl_start,
+			    ev.pl_u.pl_mi.pl_pathname);
+			break;
+		case PMCLOG_TYPE_MAP_OUT:
+			PMCSTAT_PRINT_ENTRY(a,"map-out","%d %p %p",
+			    ev.pl_u.pl_mo.pl_pid,
+			    (void *) ev.pl_u.pl_mo.pl_start,
+			    (void *) ev.pl_u.pl_mo.pl_end);
+			break;
+		case PMCLOG_TYPE_PCSAMPLE:
+			PMCSTAT_PRINT_ENTRY(a,"sample","0x%x %d %p %c",
+			    ev.pl_u.pl_s.pl_pmcid,
+			    ev.pl_u.pl_s.pl_pid,
+			    (void *) ev.pl_u.pl_s.pl_pc,
+			    ev.pl_u.pl_s.pl_usermode ? 'u' : 's');
+			break;
+		case PMCLOG_TYPE_PMCALLOCATE:
+			PMCSTAT_PRINT_ENTRY(a,"allocate","0x%x \"%s\" 0x%x",
+			    ev.pl_u.pl_a.pl_pmcid,
+			    ev.pl_u.pl_a.pl_evname,
+			    ev.pl_u.pl_a.pl_flags);
+			break;
+		case PMCLOG_TYPE_PMCATTACH:
+			PMCSTAT_PRINT_ENTRY(a,"attach","0x%x %d \"%s\"",
+			    ev.pl_u.pl_t.pl_pmcid,
+			    ev.pl_u.pl_t.pl_pid,
+			    ev.pl_u.pl_t.pl_pathname);
+			break;
+		case PMCLOG_TYPE_PMCDETACH:
+			PMCSTAT_PRINT_ENTRY(a,"detach","0x%x %d",
+			    ev.pl_u.pl_d.pl_pmcid,
+			    ev.pl_u.pl_d.pl_pid);
+			break;
+		case PMCLOG_TYPE_PROCCSW:
+			PMCSTAT_PRINT_ENTRY(a,"cswval","0x%x %d %jd",
+			    ev.pl_u.pl_c.pl_pmcid,
+			    ev.pl_u.pl_c.pl_pid,
+			    ev.pl_u.pl_c.pl_value);
+			break;
+		case PMCLOG_TYPE_PROCEXEC:
+			PMCSTAT_PRINT_ENTRY(a,"exec","0x%x %d %p \"%s\"",
+			    ev.pl_u.pl_x.pl_pmcid,
+			    ev.pl_u.pl_x.pl_pid,
+			    (void *) ev.pl_u.pl_x.pl_entryaddr,
+			    ev.pl_u.pl_x.pl_pathname);
+			break;
+		case PMCLOG_TYPE_PROCEXIT:
+			PMCSTAT_PRINT_ENTRY(a,"exitval","0x%x %d %jd",
+			    ev.pl_u.pl_e.pl_pmcid,
+			    ev.pl_u.pl_e.pl_pid,
+			    ev.pl_u.pl_e.pl_value);
+			break;
+		case PMCLOG_TYPE_PROCFORK:
+			PMCSTAT_PRINT_ENTRY(a,"fork","%d %d",
+			    ev.pl_u.pl_f.pl_oldpid,
+			    ev.pl_u.pl_f.pl_newpid);
+			break;
+		case PMCLOG_TYPE_USERDATA:
+			PMCSTAT_PRINT_ENTRY(a,"userdata","0x%x",
+			    ev.pl_u.pl_u.pl_userdata);
+			break;
+		case PMCLOG_TYPE_SYSEXIT:
+			PMCSTAT_PRINT_ENTRY(a,"exit","%d",
+			    ev.pl_u.pl_se.pl_pid);
+			break;
+		default:
+			fprintf(a->pa_printfile, "unknown %d",
+			    ev.pl_type);
+		}
+	}
+
+	if (ev.pl_state == PMCLOG_EOF)
+		return (PMCSTAT_FINISHED);
+	else if (ev.pl_state ==  PMCLOG_REQUIRE_DATA)
+		return (PMCSTAT_RUNNING);
+
+	err(EX_DATAERR, "ERROR: event parsing failed "
+	    "(record %jd, offset 0x%jx)",
+	    (uintmax_t) ev.pl_count + 1, ev.pl_offset);
+	/*NOTREACHED*/
+}
+
+/*
+ * Public Interfaces.
+ */
+
+/*
+ * Close a logfile, after first flushing all in-module queued data.
+ */
+
+int
+pmcstat_close_log(struct pmcstat_args *a)
+{
+	if (pmc_flush_logfile() < 0 ||
+	    pmc_configure_logfile(-1) < 0)
+		err(EX_OSERR, "ERROR: logging failed");
+	a->pa_flags &= ~(FLAG_HAS_OUTPUT_LOGFILE | FLAG_HAS_PIPE);
+	return (a->pa_flags & FLAG_HAS_PIPE ? PMCSTAT_EXITING :
+	    PMCSTAT_FINISHED);
+}
+
+
+
+/*
+ * Open a log file, for reading or writing.
+ *
+ * The function returns the fd of a successfully opened log or -1 in
+ * case of failure.
+ */
+
+int
+pmcstat_open_log(const char *path, int mode)
+{
+	int error, fd;
+	size_t hlen;
+	const char *p, *errstr;
+	struct addrinfo hints, *res, *res0;
+	char hostname[MAXHOSTNAMELEN];
+
+	errstr = NULL;
+	fd = -1;
+
+	/*
+	 * If 'path' is "-" then open one of stdin or stdout depending
+	 * on the value of 'mode'.
+	 * 
+	 * If 'path' contains a ':' and does not start with a '/' or '.',
+	 * and is being opened for writing, treat it as a "host:port"
+	 * specification and open a network socket.
+	 *
+	 * Otherwise, treat 'path' as a file name and open that.
+	 */
+	if (path[0] == '-' && path[1] == '\0')
+		fd = (mode == PMCSTAT_OPEN_FOR_READ) ? 0 : 1;
+	else if (mode == PMCSTAT_OPEN_FOR_WRITE && path[0] != '/' &&
+	    path[0] != '.' && strchr(path, ':') != NULL) {
+
+		p = strrchr(path, ':');
+		hlen = p - path;
+		if (p == path || hlen >= sizeof(hostname)) {
+			errstr = strerror(EINVAL);
+			goto done;
+		}
+
+		assert(hlen < sizeof(hostname));
+		(void) strncpy(hostname, path, hlen);
+		hostname[hlen] = '\0';
+
+		(void) memset(&hints, 0, sizeof(hints));
+		hints.ai_family = AF_UNSPEC;
+		hints.ai_socktype = SOCK_STREAM;
+		if ((error = getaddrinfo(hostname, p+1, &hints, &res0)) != 0) {
+			errstr = gai_strerror(error);
+			goto done;
+		}
+
+		fd = -1;
+		for (res = res0; res; res = res->ai_next) {
+			if ((fd = socket(res->ai_family, res->ai_socktype,
+			    res->ai_protocol)) < 0) {
+				errstr = strerror(errno);
+				continue;
+			}
+			if (connect(fd, res->ai_addr, res->ai_addrlen) < 0) {
+				errstr = strerror(errno);
+				(void) close(fd);
+				fd = -1;
+				continue;
+			}
+			errstr = NULL;
+			break;
+		}
+		freeaddrinfo(res0);
+
+	} else if ((fd = open(path, mode == PMCSTAT_OPEN_FOR_READ ?
+		    O_RDONLY : (O_WRONLY|O_CREAT|O_TRUNC),
+		    S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH)) < 0)
+			errstr = strerror(errno);
+
+  done: 
+	if (errstr)
+		errx(EX_OSERR, "ERROR: Cannot open \"%s\" for %s: %s.", path,
+		    (mode == PMCSTAT_OPEN_FOR_READ ? "reading" : "writing"),
+		    errstr);
+
+	return (fd);
+}
+
+/*
+ * Process a log file in offline analysis mode.
+ */
+
+int
+pmcstat_process_log(struct pmcstat_args *a)
+{
+
+	/*
+	 * If gprof style profiles haven't been asked for, just print the
+	 * log to the current output file.
+	 */
+	if (a->pa_flags & FLAG_DO_PRINT)
+		return (pmcstat_print_log(a));
+	else
+		/* convert the log to gprof compatible profiles */
+		return (pmcstat_convert_log(a));
+}
+
+/*
+ * Initialize module.
+ */
+
+void
+pmcstat_initialize_logging(struct pmcstat_args *a)
+{
+	int i;
+
+	(void) a;
+
+	/* use a convenient format for 'ldd' output */
+	if (setenv("LD_TRACE_LOADED_OBJECTS_FMT1","%o \"%p\" %x\n",1) != 0)
+		err(EX_OSERR, "ERROR: Cannot setenv");
+
+	/* Initialize hash tables */
+	pmcstat_string_initialize();
+	for (i = 0; i < PMCSTAT_NHASH; i++) {
+		LIST_INIT(&pmcstat_image_hash[i]);
+		LIST_INIT(&pmcstat_process_hash[i]);
+	}
+
+	/*
+	 * Create a fake 'process' entry for the kernel with pid -1.
+	 * hwpmc(4) will subsequently inform us about where the kernel
+	 * and any loaded kernel modules are mapped.
+	 */
+	if ((pmcstat_kernproc = pmcstat_process_lookup((pid_t) -1,
+		 PMCSTAT_ALLOCATE)) == NULL)
+		err(EX_OSERR, "ERROR: Cannot initialize logging");
+}
+
+/*
+ * Shutdown module.
+ */
+
+void
+pmcstat_shutdown_logging(struct pmcstat_args *a)
+{
+	int i;
+	FILE *mf;
+	struct pmcstat_gmonfile *pgf, *pgftmp;
+	struct pmcstat_image *pi, *pitmp;
+	struct pmcstat_process *pp, *pptmp;
+
+	/* determine where to send the map file */
+	mf = NULL;
+	if (a->pa_mapfilename != NULL)
+		mf = (strcmp(a->pa_mapfilename, "-") == 0) ?
+		    a->pa_printfile : fopen(a->pa_mapfilename, "w");
+
+	if (mf == NULL && a->pa_flags & FLAG_DO_GPROF &&
+	    a->pa_verbosity >= 2)
+		mf = a->pa_printfile;
+
+	if (mf)
+		(void) fprintf(mf, "MAP:\n");
+
+	for (i = 0; i < PMCSTAT_NHASH; i++) {
+		LIST_FOREACH_MUTABLE(pi, &pmcstat_image_hash[i], pi_next, pitmp) {
+
+			if (mf)
+				(void) fprintf(mf, " \"%s\" => \"%s\"",
+				    pmcstat_string_unintern(pi->pi_execpath),
+				    pmcstat_string_unintern(pi->pi_samplename));
+
+			/* flush gmon.out data to disk */
+			LIST_FOREACH_MUTABLE(pgf, &pi->pi_gmlist, pgf_next,
+			    pgftmp) {
+				pmcstat_gmon_unmap_file(pgf);
+			    	LIST_REMOVE(pgf, pgf_next);
+				if (mf)
+					(void) fprintf(mf, " %s/%d",
+					    pmcstat_pmcid_to_name(pgf->pgf_pmcid),
+					    pgf->pgf_nsamples);
+				if (pgf->pgf_overflow && a->pa_verbosity >= 1)
+					warnx("WARNING: profile \"%s\" "
+					    "overflowed.",
+					    pmcstat_string_unintern(
+					        pgf->pgf_name));
+			    	free(pgf);
+			}
+
+			if (mf)
+				(void) fprintf(mf, "\n");
+
+			LIST_REMOVE(pi, pi_next);
+			free(pi);
+		}
+		LIST_FOREACH_MUTABLE(pp, &pmcstat_process_hash[i], pp_next,
+		    pptmp) {
+			LIST_REMOVE(pp, pp_next);
+			free(pp);
+		}
+	}
+
+	pmcstat_string_shutdown();
+
+	/*
+	 * Print errors unless -q was specified.  Print all statistics
+	 * if verbosity > 1.
+	 */
+#define	PRINT(N,V,A) do {						\
+		if (pmcstat_stats.ps_##V || (A)->pa_verbosity >= 2)	\
+			(void) fprintf((A)->pa_printfile, " %-40s %d\n",\
+			    N, pmcstat_stats.ps_##V);			\
+	} while (0)
+
+	if (a->pa_verbosity >= 1 && a->pa_flags & FLAG_DO_GPROF) {
+		(void) fprintf(a->pa_printfile, "CONVERSION STATISTICS:\n");
+		PRINT("#exec/a.out", exec_aout, a);
+		PRINT("#exec/elf", exec_elf, a);
+		PRINT("#exec/unknown", exec_indeterminable, a);
+		PRINT("#exec handling errors", exec_errors, a);
+		PRINT("#samples/total", samples_total, a);
+		PRINT("#samples/unclaimed", samples_unknown_offset, a);
+		PRINT("#samples/unknown-object", samples_indeterminable, a);
+	}
+
+	if (mf)
+		(void) fclose(mf);
+}
-- 
1.7.0.5

