ebpf not displaying output with tracing_pipe

26 Views Asked by At

Here is my program which monitors unlinkat i tried both do_unlinkat as well as __x64_sys_unlinkat (no luck) My actual issue got removed

My issue is sudo cat /sys/kernel/debug/tracing/trace_pipe shows no output

#include "vmlinux.h"
   #include <bpf/bpf_helpers.h>
   #include <bpf/bpf_tracing.h>
   #include <bpf/bpf_core_read.h>

   char LICENSE[] SEC("license") = "Dual BSD/GPL";


   SEC("kprobe/__x64_sys_unlinkat")
   //SEC("kprobe/do_unlinkat")
   //int BPF_KPROBE(do_unlinkat, int dfd, struct filename *name)
   int BPF_KPROBE(__x64_sys_unlinkat, int dfd, struct filename *name)
   {
       pid_t pid;
       const char *filename;

       pid = bpf_get_current_pid_tgid() >> 32;
       /* this gets the name member from struct filename *name. */
       filename = BPF_CORE_READ(name, name);
       bpf_printk("KPROBE ENTRY pid = %d, filename = %s\n", pid, filename);
       return 0;
   }

   SEC("kretprobe/do_unlinkat")
   int BPF_KRETPROBE(do_unlinkat_exit, long ret)
   {
      pid_t pid;

      pid = bpf_get_current_pid_tgid() >> 32;
      bpf_printk("KPROBE EXIT: pid = %d, ret = %ld\n", pid, ret);
     return 0;
  }


I run following commands
touch t1
rm -f t1

sudo cat /sys/kernel/debug/tracing/tracing_on
1

strace shows unlinkat is called
strace rm -f t1
execve("/usr/bin/rm", ["rm", "-f", "t1"], 0x7ffd280b3020 /* 24 vars */) = 0
brk(NULL)                               = 0x592e960fe000
arch_prctl(0x3001 /* ARCH_??? */, 0x7ffc317b67c0) = -1 EINVAL (Invalid argument)
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x73c3571a0000
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
newfstatat(3, "", {st_mode=S_IFREG|0644, st_size=66643, ...}, AT_EMPTY_PATH) = 0
mmap(NULL, 66643, PROT_READ, MAP_PRIVATE, 3, 0) = 0x73c35718f000
close(3)                                = 0
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\237\2\0\0\0\0\0"..., 832) = 832
pread64(3, "\6\0\0\0\4\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0"..., 784, 64) = 784
pread64(3, "\4\0\0\0 \0\0\0\5\0\0\0GNU\0\2\0\0\300\4\0\0\0\3\0\0\0\0\0\0\0"..., 48, 848) = 48
pread64(3, "\4\0\0\0\24\0\0\0\3\0\0\0GNU\0\302\211\332Pq\2439\235\350\223\322\257\201\326\243\f"..., 68, 896) = 68
newfstatat(3, "", {st_mode=S_IFREG|0755, st_size=2220400, ...}, AT_EMPTY_PATH) = 0
pread64(3, "\6\0\0\0\4\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0"..., 784, 64) = 784
mmap(NULL, 2264656, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x73c356e00000
mprotect(0x73c356e28000, 2023424, PROT_NONE) = 0
mmap(0x73c356e28000, 1658880, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x28000) = 0x73c356e28000
mmap(0x73c356fbd000, 360448, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1bd000) = 0x73c356fbd000
mmap(0x73c357016000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x215000) = 0x73c357016000
mmap(0x73c35701c000, 52816, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x73c35701c000
close(3)                                = 0
mmap(NULL, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x73c35718c000
arch_prctl(ARCH_SET_FS, 0x73c35718c740) = 0
set_tid_address(0x73c35718ca10)         = 13695
set_robust_list(0x73c35718ca20, 24)     = 0
rseq(0x73c35718d0e0, 0x20, 0, 0x53053053) = 0
mprotect(0x73c357016000, 16384, PROT_READ) = 0
mprotect(0x592e94b36000, 4096, PROT_READ) = 0
mprotect(0x73c3571da000, 8192, PROT_READ) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
munmap(0x73c35718f000, 66643)           = 0
getrandom("\x6b\x16\x35\xef\x46\xd2\xd0\xa8", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x592e960fe000
brk(0x592e9611f000)                     = 0x592e9611f000
openat(AT_FDCWD, "/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = 3
newfstatat(3, "", {st_mode=S_IFREG|0644, st_size=5712208, ...}, AT_EMPTY_PATH) = 0
mmap(NULL, 5712208, PROT_READ, MAP_PRIVATE, 3, 0) = 0x73c356800000
close(3)                                = 0
ioctl(0, TCGETS, {B38400 opost isig icanon echo ...}) = 0
newfstatat(AT_FDCWD, "t1", {st_mode=S_IFREG|0664, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlinkat(AT_FDCWD, "t1", 0)             = 0
lseek(0, 0, SEEK_CUR)                   = -1 ESPIPE (Illegal seek)
close(0)                                = 0
close(1)                                = 0
close(2)                                = 0
exit_group(0)                           = ?
+++ exited with 0 +++

however sudo cat /sys/kernel/debug/tracing/trace_pipe shows no output I have same issue with a lot of function calls not only unlink_at what am i missing please

sudo cat /sys/kernel/debug/tracing/tracing_on 1

This is a Ununtu 22.04 uname -r 6.5.0-26-generic

0

There are 0 best solutions below