0 views collected around this technical thread.
This article provides a comprehensive overview of Linux kernel tracing mechanisms—including probes, tracepoints, kprobes, uprobes, and ftrace—explaining their principles, implementation details, practical tools, and real‑world case studies for performance optimization, fault diagnosis, and security monitoring.
This article provides a comprehensive overview of ftrace, explaining its architecture, tracer types, configuration steps, and practical usage examples for debugging, performance analysis, and kernel development on Linux systems.
This article explains the Linux kernel ftrace architecture, covering ring buffer principles and code, tracer implementations (function, function_graph, irq_off), trace events, dynamic and static instrumentation, and kprobe mechanisms, illustrating how tracing is integrated, managed, and optimized for various execution contexts.
This article guides you through installing BCC, creating simple and complex eBPF programs with C and Python, explains eBPF architecture, source‑code organization, and demonstrates real‑world tracing examples for kernel diagnostics and performance monitoring.
The article describes an eBPF‑based, language‑agnostic traffic recording framework that hooks low‑level socket operations and thread identifiers to capture complete request‑response flows across Java, PHP, and Go services without modifying application code, dramatically lowering implementation and maintenance costs for cloud‑native traffic replay.
eBPF, a safe, high‑performance Linux kernel extension evolving from the 1993 Berkeley Packet Filter to modern dynamic tracing, underpins Didi’s HuaTuo platform, which consolidates bytecode management, fast data processing, stability self‑healing, and container insight to solve traffic replay, topology, security, and root‑cause analysis challenges across cloud‑native services, with plans to broaden business use and community collaboration.
The article details how Linux’s function‑graph ftrace tracer works on ARM64, explaining required kernel configs, how -pg inserts _mcount calls, the runtime patching of ftrace_graph_caller, register usage for argument passing, and return handling, and why shadow‑call‑stack must be disabled to enable precise call‑graph and timing analysis.