Advanced BPF profiling techniques: how to escape the curse of NMI and fetch ELF...
summary
Shows how a profiler moves from sampling to reliable user-memory reads by combining perf-event sampling + ring buffer postprocessing with new kernel-side helpers: BPF task_work resume/signal APIs let code scheduled from NMI run in a sleepable context so page faults are allowed; bpf_ptr_from_file + bpf_ptr_read expose ELF contents and build IDs on demand; a task VM iterator finds executable VMAs and thread-local variable symbols at runtime. Prototype runs at Meta and proves deterministic stack and TLS reads without expensive upfront ELF preprocessing.
AI-written summary · about
chapters (6)
- 0:00Introduction to BPF profiling
- 7:50Extending profiling context
- 14:39Escaping NMI restrictions
- 25:32ELF parsing in BPF
- 34:43Summary and future work
- 36:30Q&A
related talks
36mDeveloping Continuous eBPF Profiler to look Beneath the Kernel to Beyond the Clouds
36mObservability and performance analysis with BPF
32mBPF: Introduction, Programming Tips and Tricks
35mPerformance Insights into eBPF Step by Step
46mbpftrace internals
32meBPF: The Next Power Tool of SREs
22mDWARFs and ELFs on the Cloud - eBPF Profiling Adventures in Observability at...
25mKernel tracing with BPF