Hi, my name is Henry and I'm a kernel newbie. Recently plagued by a perplexing issue where *something* would step the clock on an important server by exactly 5 minutes at infrequent, unpredictable intervals, I put together my first kernel module - a trivial hook into do_settimeofday via a jprobe, that prints the PID, process name and time adjustment to the kernel message log. Here's what I have so far: https://github.com/henryhallam/timepolice Questions: 1. Is a module using kprobes/jprobes the right way to do it, vs adding printks to linux/time/timekeeping.c? 2. If a module is the way to go, would it be better to create a read/write /proc entry to allow enabling and disabling, rather than inserting the module to enable and removing to disable? 3. Is this sort of thing worth submitting to mainline? What are the next steps for that, after choosing a better name, changing the silly load/unload messages and ensuring it passes checkpatch.pl? Thanks!
On Wed, Apr 16, 2014 at 4:27 PM, <Valdis.Kletnieks@vt.edu> wrote:
On Wed, 16 Apr 2014 14:27:50 -0700, Henry Hallam said:
3. Is this sort of thing worth submitting to mainline?
Don't bother doing it unless you have first verified that it plays nice with xntpd.
It does; it's strictly instrumentation, and ntpd uses adjtime rather than settimeofday anyway. NTP behaves as normal with the module installed. Thanks, Henry
On Wed, Apr 16, 2014 at 02:27:50PM -0700, Henry Hallam wrote:
Hi, my name is Henry and I'm a kernel newbie.
Hello, Henry.
Recently plagued by a perplexing issue where *something* would step the clock on an important server by exactly 5 minutes at infrequent, unpredictable intervals, I put together my first kernel module - a trivial hook into do_settimeofday via a jprobe, that prints the PID, process name and time adjustment to the kernel message log.
Here's what I have so far: https://github.com/henryhallam/timepolice
Questions:
1. Is a module using kprobes/jprobes the right way to do it, vs adding printks to linux/time/timekeeping.c?
Have you taken a look at the various kernel tracing features? I suspect you could do exactly what you want without modifying the kernel at all using the function tracer. Josh
Thanks Josh. I had not, and I appreciate the pointer. Henry On Fri, Apr 18, 2014 at 1:51 PM, Josh Cartwright <joshc@eso.teric.us> wrote:
On Wed, Apr 16, 2014 at 02:27:50PM -0700, Henry Hallam wrote:
Hi, my name is Henry and I'm a kernel newbie.
Hello, Henry.
Recently plagued by a perplexing issue where *something* would step the clock on an important server by exactly 5 minutes at infrequent, unpredictable intervals, I put together my first kernel module - a trivial hook into do_settimeofday via a jprobe, that prints the PID, process name and time adjustment to the kernel message log.
Here's what I have so far: https://github.com/henryhallam/timepolice
Questions:
1. Is a module using kprobes/jprobes the right way to do it, vs adding printks to linux/time/timekeeping.c?
Have you taken a look at the various kernel tracing features? I suspect you could do exactly what you want without modifying the kernel at all using the function tracer.
Josh
participants (3)
-
Henry Hallam -
Josh Cartwright -
Valdis.Kletnieks＠vt.edu