search

iovisor / bcc

BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more
Apache License 2.0
20.64k stars 3.89k forks source link

BCC Event Timing #2405

Open kmahmou1 opened 5 years ago

kmahmou1 commented 5 years ago

I am using BCC Python Interface to record DTrace probes. Along with the event information, I receive the monotonic time.

What I want is: I want to change the source of bcc/bpftrace to read event time in my own way. For example, using Assembly “RDTSCP“.

Any pointers on how to do thaaaat?

palmtenor commented 5 years ago

I don't think BCC, or more precisely BPF Tracing supports customized clock source at this point.

However, I don't see an immediate reason why Kernel can't be configured just like ftrace's trace_clock where bpf_ktime_get_ns could return timestamp from a different clock. Feel free to propose a Kernel patch if you feel so.

yonghong-song commented 5 years ago

The bpf_ktime_get_ns specifically calls ktime_get_mono_fast_ns.

BPF_CALL_0(bpf_ktime_get_ns)
{
        /* NMI safe access to clock monotonic */
        return ktime_get_mono_fast_ns();
}

I am not sure whether you can easily change this mono timer or not. You can try to change the kernel clock source to see whether it makes a difference or not.

Currently, there is no way to do RDTSCP inside the bpf program.