How to Discover Hardware PMU Counters and Tracepoints in Linux Using perf list

In Linux performance engineering and low-level software profiling, configuring the perf subsystem to capture meaningful system telemetry requires knowing exactly what events the host hardware and kernel support. Depending on whether you are running on an Intel Core, AMD Zen, or ARM Neoverse processor, available hardware counters vary substantially. Furthermore, dynamic kernel tracepoints, eBPF probes, and software counters differ across Linux kernel releases and distribution builds. Before constructing complex sampling sessions with perf record or perf stat, performance engineers use the perf list command. This discovery utility enumerates all supported hardware Performance Monitoring Unit (PMU) events, kernel tracepoints, raw event codes, and JSON-defined architectural metric groups.

Understanding Linux perf Event Categories

The Linux perf infrastructure categorizes performance events into distinct subsystems:

• Hardware Events: Direct architectural performance counters provided by the physical CPU core PMU (e.g., cpu-cycles, instructions, cache-references, cache-misses, branch-instructions).
• Software Events: Low-level kernel state counters maintained inside the operating system (e.g., page-faults, context-switches, cpu-migrations, minor-faults).
• Hardware Cache Events: Specialized microarchitectural events tracking specific cache hierarchies and operations (e.g., L1-dcache-loads, L1-icache-load-misses, dTLB-load-misses).
• Kernel Tracepoints: Static instrumentation hooks embedded directly in kernel source code (e.g., sched:sched_switch, syscalls:sys_enter_openat, block:block_rq_issue).
• Raw Hardware Events (rNNN): Vendor-specific hex event codes specified directly in Intel or AMD architectural manuals when human-readable event aliases are absent.
• Metric Groups: High-level calculated metrics that combine multiple raw counters (e.g., IPC, Topdown_L1, Memory_BW, Frontend_Bound).

Basic Usage and Listing All Supported Events

To inspect all events currently supported and enabled on your active Linux system, execute:

perf list

The terminal outputs a categorized list of hundreds or thousands of available events, annotated with descriptions and subsystem classifications.

Listing Specific Event Types

Because the full output of perf list can be overwhelming, the utility provides category filters:

# Enumerate only architectural hardware events
perf list hw

# Enumerate software kernel events
perf list sw

# Enumerate hardware cache events
perf list cache

# Enumerate kernel tracepoints
perf list tracepoint

# Enumerate pre-configured performance metrics
perf list metric

Searching and Filtering Events by Keyword

When investigating a specific subsystem—such as Translation Lookaside Buffer (TLB) misses, branch prediction, or disk I/O—filter events directly by passing a search string to perf list:

# Search for all TLB-related events
perf list tlb

# Search for branch misprediction events
perf list branch

# Search for kernel virtual filesystem tracepoints
perf list vfs

The output highlights matching events across all categories:

  dTLB-load-misses                                   [Hardware cache event]
  dTLB-loads                                         [Hardware cache event]
  iTLB-load-misses                                   [Hardware cache event]
  tlb:tlb_flush                                      [Tracepoint event]

Discovering TopDown Microarchitecture Analysis Metrics

Modern Intel and AMD processors support the TopDown Microarchitecture Analysis Method (TMAM). This methodology classifies CPU execution pipelines into four fundamental bottlenecks: Frontend Bound, Bad Speculation, Backend Bound, and Retiring. You can inspect available TopDown metric groups using perf list:

perf list TopdownL1

Representative output demonstrates how high-level metrics are mapped:

Metric Groups:

TopdownL1:
  Backend_Bound
       [Fraction of slots where the core was unable to execute due to pipeline stalls]
  Bad_Speculation
       [Fraction of slots wasted due to incorrect branch predictions]
  Frontend_Bound
       [Fraction of slots where the core was unable to fetch instructions]
  Retiring
       [Fraction of slots spent executing useful instructions]

You can profile these metric groups directly using perf stat -M TopdownL1 ./my_application.

Querying Raw Hardware PMU Event Codes (rNNN Syntax)

Silicon vendors frequently publish specialized microarchitectural counters in hardware optimization manuals before Linux kernel patches introduce named aliases. In perf, any raw event can be targeted using the rNNN syntax, where NNN represents the hexadecimal event select and unit mask (umask).

To verify if your hardware PMU supports raw counters and uncore events:

perf list pmu

On Intel systems, this reveals core and uncore PMUs such as cpu_core, uncore_imc (integrated memory controller), and uncore_cbox.

Verifying Privileges and Hardware Access

Access to physical hardware counters is governed by Linux kernel security controls. If perf list hw returns empty lists or fails with permission errors, verify your system’s paranoid settings:

# Inspect current paranoid level
cat /proc/sys/kernel/perf_event_paranoid

# Set to 1 to allow non-root users access to hardware counters
sudo sysctl kernel.perf_event_paranoid=1

By using perf list to survey available PMU hardware counters, tracepoints, and metric groups, Linux performance engineers can formulate precise, targeted profiling experiments, unmasking microarchitectural bottlenecks with maximum precision.