Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Initial try for .eh_frame/.debug_frame based stack unwinding using eBPF #346

Closed
wants to merge 2 commits into from

Conversation

kakkoyun
Copy link
Member

@kakkoyun kakkoyun commented Apr 13, 2022

Signed-off-by: Kemal Akkoyun kakkoyun@gmail.com

blocked by xref: aquasecurity/libbpfgo#93

Fixes #293

  • Convince eBPF verifier that I'm not trying to harm anyone
  • Make sure it is locally testable Use kernel 5.10 for minikube.iso. kubernetes/minikube#12707
  • Support multiple kernel versions (>= 4.19, >= 5.2 (with BTF maps))
  • Increase memlock rlimit dynamically
  • Move process discovery before attaching the eBPF program
    • Test for the simple case
  • Rebase
  • Split and commit BTF, Linux 5.2+ changes
  • Implement BPF map of maps after we have the support in libbpf-go: Utilize New CreateMap API implementing bpf_map_create, Type/name accessors aquasecurity/libbpfgo#138
  • SystemdUnit .PID() implement
  • Use perf_map to find out executable
  • Handle unwinding information of dynamically linked libraries (multiple mappings)
  • Test and prove it works visually
  • Add debug_frame support
  • Conclude and properly vendor delve/dwarf package and ask upstream if they have these changes
  • Clean up TODO comments in code

@kakkoyun
Copy link
Member Author

I have re-created the previous #150 PR by squashing the previous commits. To make the rebase easier and cleaner. I'll extract certain features from this before rebasing.

.golangci.yml Outdated Show resolved Hide resolved
deploy/dev.jsonnet Outdated Show resolved Hide resolved
pkg/debuginfo/debuginfo.go Outdated Show resolved Hide resolved
scripts/check-license.sh Outdated Show resolved Hide resolved

p.loopReport(t, err)
}
}

func (p *CgroupProfiler) profileLoop(ctx context.Context, now time.Time, counts, stackTraces *bpf.BPFMap) error {
func (p *CgroupProfiler) initAndLoadBPFModule() (*bpf.Module, error) {
btfSupported, err := p.isBTFSupported()
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@kakkoyun Separate as another PR

pkg/agent/profile.go Outdated Show resolved Hide resolved
pkg/debuginfo/debuginfo.go Outdated Show resolved Hide resolved
Signed-off-by: Kemal Akkoyun <kakkoyun@gmail.com>

Split simple cpu profiling and cpu profiling with unwinding

Signed-off-by: Kemal Akkoyun <kakkoyun@gmail.com>

Fix communication issues with kernel space

Signed-off-by: Kemal Akkoyun <kakkoyun@gmail.com>

Send eh_frame of all mappings

Signed-off-by: Kemal Akkoyun <kakkoyun@gmail.com>

Add debug prints back

Signed-off-by: Kemal Akkoyun <kakkoyun@gmail.com>

Remove build id flag

Signed-off-by: Kemal Akkoyun <kakkoyun@gmail.com>

Use fork of delve, rather than vendoring a single package

Signed-off-by: Kemal Akkoyun <kakkoyun@gmail.com>
@kakkoyun kakkoyun force-pushed the bpf_stack_unwinding branch 2 times, most recently from dff0bee to 89d3996 Compare April 21, 2022 15:26
Signed-off-by: Kemal Akkoyun <kakkoyun@gmail.com>
@kakkoyun
Copy link
Member Author

kakkoyun commented Jul 19, 2022

Superseded by #600

@kakkoyun kakkoyun closed this Jul 19, 2022
u64 res = 0;
switch (ins->op) {
case 1: // OpUndefined: Undefined register.
if (bpf_probe_read(&addr, 8, &unsafe_ptr) == 0)
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@kakkoyun kakkoyun deleted the bpf_stack_unwinding branch May 17, 2023 09:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
experiment Experimental features or Proof of Concepts
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Add eh_frame based stack unwinding
1 participant