Developing eBPF profiler for polyglot cloud-native appli...
summary
An eBPF-based profiler is built that generates per-binary unwind tables from DWARF/eh_frame and loads them into kernel maps so user-space stack walking works without frame pointers; samples come from perf events and stacks are aggregated via ring buffer. Implementation splits into ~250 C lines for BPF and ~8k Go for table generation, currently x86_64-only, tested on small binaries, and imposes a 130000-entry per-binary limit requiring sharding; it uses unwind tables in eBPF maps, supports DWARF eh_frame, and faces verifier and kernel-compatibility issues.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:49What are profilers
- 6:04Debugging formats ELF and DWARF
- 8:33Frame pointers in x86_64
- 11:50Industry reality on frame pointers
- 15:01Kernel stack unwinding without frame pointers
- 19:56eBPF stack traces with frame pointers
- 20:37eBPF stack unwinding without frame pointers
- 27:44Future work and testing
- 29:32Q&A
related talks
32meBPF: BPF kernel infrastructure
42mKernel Analysis Using eBPF
36mDebugging with eBPF on Arm Platforms
34mBeyond the Hype: Cloud Native eBPF
25mKernel tracing with BPF
36mDebugging with eBPF on Arm Platforms
27mLow-Overhead Tracing Using eBPF for Observability into Kubernetes Apps and Services
31meBPF 101