Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add ability to trace all functions in eBPF kernel drivers #3856

Open
abeltrano opened this issue Sep 20, 2024 · 4 comments · May be fixed by #3852
Open

Add ability to trace all functions in eBPF kernel drivers #3856

abeltrano opened this issue Sep 20, 2024 · 4 comments · May be fixed by #3852
Assignees
Labels
enhancement New feature or request P2 triaged Discussed in a triage meeting
Milestone

Comments

@abeltrano
Copy link
Contributor

Describe the feature you'd like supported

Performance investigation can benefit from accurate measurement of time spent in a particular function. This is especially important for hot execution paths called from eBPF extensions.
 
dtrace can be used to trace most user and kernel functions using Function Boundary Tracing (fbt). Fbt instrumentation uses unwind information from the pdata image section to get information about function prologue and epilogues; this is sometime unavailable for leaf functions not calling any imported API since they may not have unwind information.

The eBPF kernel drivers should be modified such that tracing tools such as dtrace can be used to trace all functions.

Proposed solution

The /allpdata linker flag forces inclusion of all functions in the pdata section, thus enabling FBT tracing of any function.

Additional context

No response

@dthaler
Copy link
Collaborator

dthaler commented Sep 20, 2024

If dtrace is later implemented on top of ebpf, would this cause a circular dependency?
Or how would it work? I.e., what happens if you try to trace the dtrace implementation with dtrace today?

@abeltrano
Copy link
Contributor Author

abeltrano commented Sep 20, 2024

If dtrace is later implemented on top of ebpf,

When I briefly discussed this with @Alan-Jowett, he mentioned that implementing dtrace with ebpf was proposed in the past. Seems like an interesting idea. I believe he mentioned the primary reasoning against this approach was concern about having an "interpreter" in the kernel, though don't know if that's still true today. Do you know if there is serious interest in this possibility today, or was your question more out of curiosity?

would this cause a circular dependency? Or how would it work? I.e., what happens if you try to trace the dtrace implementation with dtrace today?

Good question, I don't know, but I believe I saw something in the dtrace docs that excludes tracing its own impl. I'll look into this more deeply to understand this better and report back.

@shankarseal
Copy link
Collaborator

The /allpdata linker flag generates stack unwinding information that can be consumed by dtrace among other tools. This is not specific to dtrace.
The point about cyclic dependency will be considered if/when dtrace is implemented using eBPF.

@Alan-Jowett
Copy link
Member

Here is more information about pdata for reference:
https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#the-pdata-section

@shankarseal shankarseal added the triaged Discussed in a triage meeting label Sep 23, 2024
@shankarseal shankarseal added the P2 label Sep 23, 2024
@shankarseal shankarseal modified the milestones: 2409, 2410 Sep 23, 2024
@Alan-Jowett Alan-Jowett modified the milestones: 2410, 2411 Oct 30, 2024
@shankarseal shankarseal modified the milestones: 2411, 2501 Nov 2, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request P2 triaged Discussed in a triage meeting
Projects
None yet
4 participants