Reputation: 778
I have started to learn these things recently. Regarding this matter, I came across plenty of resources regarding kprobes, BPF, eBPF, tracepoints and perf.
I wanted to test some irq events in the kernel (before it arrived to the device driver). Thus, I created a trace event in the kernel in the do_IRQ() function.
I have declared my tracepoint in the Kernel as:
TRACE_EVENT(vector_irq_rcv,
TP_PROTO(unsigned int vector, unsigned int irq),
TP_ARGS(vector, irq),
TP_STRUCT__entry(
__field( unsigned int, vector )
__field( unsigned int, irq )
),
TP_fast_assign(
__entry->vector = vector;
__entry->irq = irq;
),
TP_printk("irq=%u cpu=%u",
__entry->irq, __entry->vector)
);
To check this, I tried the following snippet with eBPF.
...
bpf_text = """
#include <linux/netdevice.h>
#include <uapi/linux/ptrace.h>
typedef struct my_stats {
u32 irq;
u32 ts;
} my_stat;
BPF_HASH(irq_rcv_stats, u32, my_stat);
TRACEPOINT_PROBE(irq_vectors, vector_irq_rcv) {
if(!(args->irq == 65)) return 0;
u32 pid = bpf_get_current_pid_tgid();
my_stat val = {};
val.ts = bpf_ktime_get_ns();
val.irq = args->irq;
irq_rcv_stats.update(&pid, &val);
// bpf_trace_printk("IRQ %d encountered ; Vector = %d \\n", args->irq, args->vector);
return 0;
}
"""
...
Here, I am listening for IRQ events on a particular IRQ number. This works well for me, for the time being.
Now, I was trying to attach this tracepoint in a kernel module (just the way we attach a kprobe in the kernel module). Is that even possible? At the moment, I have used perf for this, but it created some jitter. As I was evaluating some jitter sensitive tasks, I was hoping that I could use this tracepoint in the Kernel module.
I would appreciate any inputs or suggestions on this matter.
Thanks, Cooshal.
Upvotes: 0
Views: 1369