Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add /allpdata linker flag for all ebpf kernel driver component functions to facilitate fbt like functionality #3852

Draft
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

abeltrano
Copy link
Contributor

@abeltrano abeltrano commented Sep 19, 2024

Description

Note: fbt instrumentation uses unwind information from the pdata image section to get information about function prologue and epilogues; this is sometime unavailable for leaf functions not calling any imported API since they may not have unwind information, hence, /allpdata forces this information to be generated for all functions.

Testing

  • Validated fbt probes for ebfcore are enumerated using dtrace (eg. dtrace -ln "fbt:ebpfcore::").
  • Compared change in image size to baseline, confirming no change in release builds:
Image Baseline
Size (bytes)
/allpdata
Size (bytes)
Change
(bytes)
EbpfCore.sys
     Debug 623,568 624,624 +1,056
     Release 302,328 302,328 0
     NativeOnly 282,184 282,184 0
netebpfext.sys
     Debug 240,824 241,336 +512
     Release 138,584 138,584 0
     NativeOnly 138,584 138,584 0

Documentation

  • None

Installation

  • None

@dthaler
Copy link
Collaborator

dthaler commented Sep 20, 2024

Per https://github.com/microsoft/ebpf-for-windows/blob/main/CONTRIBUTING.md#contributing-code, please also file an issue that this is addressing so it can be discussed and triaged in the weekly triage meeting. Thanks!

@abeltrano
Copy link
Contributor Author

Per https://github.com/microsoft/ebpf-for-windows/blob/main/CONTRIBUTING.md#contributing-code, please also file an issue that this is addressing so it can be discussed and triaged in the weekly triage meeting. Thanks!

#3856 created, thanks.

@shankarseal shankarseal changed the title Enable dtrace function boundary tracing (fbt) for all ebpf kernel driver component functions Add /allpdata linker flag for all ebpf kernel driver component functions to facilitate fbt like functionality Sep 23, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Add ability to trace all functions in eBPF kernel drivers
2 participants