search

foniod / redbpf

Rust library for building and running BPF/eBPF modules
Apache License 2.0
1.71k stars 136 forks source link

Attach a program to a raw perf event rather than a kernel or userspace function #338

Open pittma opened 2 years ago

pittma commented 2 years ago

Hey all, I've been digging around the redbpf source today, trying to track down a way to use it to map an ebpf program to a regular old perf event (a hardware event in my case). In the Python BCC library, you can use attach_perf_event_raw and map a perf_event_attr to a function:

prog_text="""
int hw_event(struct bpf_perf_event_data *ctx) {
    // do stuff with `ctx`
}
"""

attr = Perf.perf_event_attr()
attr.type=PerfType.RAW

# hw_hexcode here is the perf event + mask
attr.config = int(hw_hexcode, 16)

b = BPF(text=prog_text)
b.attach_perf_event_raw(perf_event_attr=attr, fn_name=hw_event, pid=pid, cpu=cpu)

How might I do this with redbpf?

GermanCoding commented 2 years ago

Hi,

as far as I know redBPF does not support raw tracepoints at this time. I had a look at the requirements and it does not look to be terribly different from what we already have, so likely doable, but it just isn't there at this time.

AlexandruCihodaru commented 2 years ago

Hello @GermanCoding I would like to contribute this. :D

GermanCoding commented 2 years ago

I am not a maintainer of redBPF, but sure go ahead. From my experience the maintainers do review and merge code.

Revisiting the original question, I think I misread it. I thought about raw tracepoints, but it looks like the actual question was about BPF_PROG_TYPE_PERF_EVENT (perf event programs). I don't remember redBPF support for these either.