Enabling or disabling tracing

Tue, 24 Sep 2024 14:51:04 +0200

It is possible to use /sys/kernel/debug/tracing/tracing_on to enable or disable tracing for debugging purpose.

# Enabling tracing
$ echo 1 > /sys/kernel/debug/tracing/tracing_on

# Disabling tracing
$ echo 0 > /sys/kernel/debug/tracing/tracing_on

Resources Link to heading

ftrace - Function Tracer

Creating a basic eBPF app in C

Mon, 23 Sep 2024 17:10:40 +0200

This is a basic eBPF program binding xdp on your preferred interface (default is lo), and will print some trace in /sys/kernel/debug/tracing/trace_pipe for each packet received.

Kernel Link to heading

The eBPF program (ie: kernel part) is looking as the following:

#include <stddef.h>

#include <linux/bpf.h>
#include <linux/in.h>
#include <linux/if_ether.h>
#include <linux/ip.h>

#include <bpf/bpf_helpers.h>
#include <bpf/bpf_endian.h>

SEC("xdp")
int basic(struct xdp_md *ctx)
{
    bpf_printk("hello xdp");

    return XDP_PASS;
}

char _license[] SEC("license") = "GPL";

Userland Link to heading

#include <stdio.h>
#include <unistd.h>
#include <net/if.h>

#include "basic_kern.skel.h"

int main(int argc, char **argv)
{
    char *interface_name = "lo";
    struct basic_kern *skel;
    int ret = 0;

    if (argc > 1) {
        interface_name = argv[argc - 1];
    }

    unsigned int ifindex = if_nametoindex(interface_name);
    
    if (ifindex == 0) {
        fprintf(stderr, "ERROR: failed to retrieve interface index of %s", interface_name);
        return 1;
    }

    skel = basic_kern__open();
    if (!skel) {
        fprintf(stderr, "ERROR: failed to open BPF skeleton\n");
        return 1;
    }

    ret = basic_kern__load(skel);
    if (ret) {
        fprintf(stderr, "Failed to load BPF skeleton\n");
        goto cleanup;
    }

    bpf_program__attach_xdp(skel->progs.basic, ifindex);

    // ... read the trace output, sleep, do whatever is needed to avoid program to quit

cleanup:
    basic_kern__destroy(skel);
    return ret;
}

Note: the basic_kern.skel.h file is generated with bpftool:

eBPF on mkz.me

Enabling or disabling tracing

Resources Link to heading

Creating a basic eBPF app in C

Kernel Link to heading

Userland Link to heading