KUtrace: Low-overhead Linux kernel tracing facility

Re:KUtrace: Low-overhead Linux kernel tracing facility by c0deR3D on Monday July 15, 2024 @08:33PM (#40972678)

Out of curious, does BPF now capable of capturing all the context switch events such as CPU trap?

Also, if the overhead is negligible, maybe the author can try to merge this into mainline with the use of static key to make the incurred overhead switchable. In spite of the static key, the degree of the accompanied inteferences on cache and branch predictor might be an intriguing topic though.

[ Parent | on HN ]

Re:KUtrace: Low-overhead Linux kernel tracing facility by tanelpoder on Monday July 15, 2024 @09:05PM (#40972861)

Lots of the low level exception/trap/fault handling functions are blacklisted, probably to avoid lockups and unwanted recursion mayhem:

  $ sudo wc -l /sys/kernel/debug/kprobes/blacklist 
  783 /sys/kernel/debug/kprobes/blacklist

Edit: Perhaps an alternative approach would be to attach probes to relevant (precise) PMU events. There's also this prototype of adding breakpoint/watchpoint support to eBPF [1]. But actually doing stuff within this context may get complicated very fast, so would need to be severely limited, if feasible at all.

[1] https://ebpf.io/summit-2020-slides/eBPF_Summit_2020-Lightnin...

[ Parent | on HN ]