microsoft / microsoft/ebpf-for-windows

Add diagnostic events for eBPF extension entry points and exit points

Open
#3,829 0 comments 0 reactions 1 assignee Claimed by @mtfriesen View on GitHub
enhancement P2 triaged
Dominant language
C
Stars
3.6k
Forks
311
Avg merge
6d 10h
Merged PRs (30d)
21

Description

### Describe the feature you'd like supported

eBPF supports an arbitrary number of extensions, and at the moment there are no diagnostic events within eBPF to trace each time an extension calls batch_invoke(), batch_start(), etc. This would be useful to solve at the eBPF runtime layer, rather than each extension devising its own logging scheme.

### Proposed solution

Add enter/exit traces for each eBPF entrypoint from an extension. Manifested ETW events have lower CPU and memory cost than the existing TraceLogging infrastructure within eBPF (but higher development costs) and since this is a hot and performance-sensitive code path, it may be worth setting up a manifest for hot code path diagnostics.

The diagnostics should include common ETW fields (timestamp, CPU, thread, etc.) along with unique identifiers for the eBPF program and extension.

### Additional context

Helpers functions implemented within extensions should perform their own logging. It may also be useful to add logs for eBPF internal subroutines or eBPF helper functions.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.