title: How to use tracepoints in Kernel Module
body: <p>I have started to learn these things recently. Regarding this matter, I came across plenty of resources regarding kprobes, BPF, eBPF, tracepoints and perf.</p>
  
  <p>I wanted to test some irq events in the kernel (before it arrived to the device driver). Thus, I created a trace event in the kernel in the do_IRQ() function.</p>
  
  <p>I have declared my tracepoint in the Kernel as:</p>
  
  <pre><code>TRACE_EVENT(vector_irq_rcv,
  
          TP_PROTO(unsigned int vector, unsigned int irq),
  
          TP_ARGS(vector, irq),
  
          TP_STRUCT__entry(
                  __field(    unsigned int, vector    )
                  __field(    unsigned int, irq       )
          ),
  
          TP_fast_assign(
                  __entry-&gt;vector     =   vector;
                  __entry-&gt;irq        =   irq;
          ),
  
          TP_printk("irq=%u cpu=%u",
                  __entry-&gt;irq, __entry-&gt;vector)
  );
  </code></pre>
  
  <p>To check this, I tried the following snippet with eBPF.</p>
  
  <pre><code>...
  
  bpf_text = """
  #include &lt;linux/netdevice.h&gt;
  #include &lt;uapi/linux/ptrace.h&gt;
  
  typedef struct my_stats {
      u32 irq;
      u32 ts;
  } my_stat;
  
  BPF_HASH(irq_rcv_stats, u32, my_stat);
  
  TRACEPOINT_PROBE(irq_vectors, vector_irq_rcv) {
  
      if(!(args-&gt;irq == 65)) return 0;
  
      u32 pid = bpf_get_current_pid_tgid();
      my_stat val = {};
      val.ts = bpf_ktime_get_ns();
      val.irq = args-&gt;irq;
      irq_rcv_stats.update(&amp;pid, &amp;val);
  
      // bpf_trace_printk("IRQ %d encountered ; Vector = %d \\n", args-&gt;irq, args-&gt;vector);
      return 0;
  }
  """
  ...
  </code></pre>
  
  <p>Here, I am listening for IRQ events on a particular IRQ number. This works well for me, for the time being.</p>
  
  <p>Now, I was trying to attach this tracepoint in a kernel module (just the way we attach a kprobe in the kernel module). Is that even possible? 
  At the moment, I have used perf for this, but it created some jitter. As I was evaluating some jitter sensitive tasks, I was hoping that I could use this tracepoint in the Kernel module.</p>
  
  <p>I would appreciate any inputs or suggestions on this matter.</p>
  
  <p>Thanks,
  Cooshal.</p>