tracepoint support

[brendangregg]

Primarily so that tools are much more stable, but there's also some tracepoints that are easier to fetch as tracepoints than kprobes.

[brendangregg]

Asking for future reference: is it possible this can be done with just bcc changes, and not require kernel changes?

Eg, I'd take bpf_attach_kprobe() from src/cc/libbpf.c, and have it work on tracepoints (it already enables probes from /sys/kernel/debug/tracing/events/, so it doesn't look far off). Then add the bpf_attach_kprobe wrappers in src/python/bcc/init.py.

[4ast]

I think attaching to native tracepoints is must have as well, but as workaround we can use such hack. I mean enable a tracepoint via debugfs and kprobe into raw tracepoint handler. It will be more reliable from kernel to kernel, but not officially stable hook.

[brendangregg]

Does it need kprobes? Instead of mucking with kprobe_events, I was thinking it could write 1 to the tracepoint enable file (eg, /sys/kernel/debug/tracing/events/block/block_rq_insert/enable), then feed that path (/sys/kernel/debug/tracing/events/block/block_rq_insert) to bpf_attach_tracing_event(). And maybe it'd just work. ... I should try it.

[4ast]

perf_event_open() will be able to open such event, but bpf program will not be called. For 'trace_kfree_skb' tracepoint the opening of such perf_event will lead to call into perf_trace_kfree_skb() function, but currently there is no hook for bpf there. We can add kprobe to this perf_trace_kfree_skb() as a hack.

[tuxology]

I remember, till 3.17-rcX, there as a patchset submitted by @4ast with BPF_PROG_TYPE_TRACING as a type to attach to events. Something like https://lkml.org/lkml/2014/7/18/10 We need something like that with bcc now to make our lives easier.

[brendangregg]

In case anyone is looking, a short term workaround for tracepoint support is being developed as #419 .

[brendangregg]

closed, fixed, by #590, #596, #602, #608