parca-agent

We write quite a bit of BPF at work for the Parca-Agent project[1]. And we find that even C is sometimes too high level of a language paired with modern optimization techniques as the code you write often doesn’t come out that way the other and and we have to resort to weird hacks or write assembly directly to appease the verifier. Apart from that, the usual qualms one might have about C are not really relevant in eBPF land, so I’ve actually found it the nicest experience writing C I’ve ever had, the verifier is just the price we have to pay. [1] https://github.com/parca-dev/parca-agent

I happen to work on a system-wide profiler[1] that is eBPF-based, and what we do is load our bpf programs on various kernels[2] using qemu. This is important as the jit and verifier change significantly across kernel versions and we want to make sure we maintain compatibility. [1] https://github.com/parca-dev/parca-agent [2] https://github.com/parca-dev/parca-agent/blob/54434c02773a8a...

If that's true, you should probably update the docs. Everything I could find implied dotnet, jvm, python were still unsupported. For example, the roadmap section of the readme mentions most of these as future targets but nothing even mentions dotnet. However I did find your tickets and a demo being merged in which makes dotnet seem maybe supported? Ticket: https://github.com/parca-dev/parca-agent/issues/161 Demo: https://github.com/parca-dev/parca-demo/pull/18

Since pprof is supported you could use parca-agent [1], an eBPF-based profiler that I happen to work on, as when you browse the debug UI on port 7071 you can download a pprof formatted profile for any process running on the machine. Supports Go, Rust, C++, C, Ruby, Python, C#, Java, Julia, Erlang, Nodejs, wasmtime, and more. [1] https://github.com/parca-dev/parca-agent [2] https://www.parca.dev/

The pervasive lack of frame pointers is the reason why we've developed a custom format derived from DWARF unwind information thanks to some insights: DWARF unwind information is incredibly flexible, it supports many architecture and allows restoring any arbitrary register. But we only need 3: the frame pointer, the stack pointer, and in non-x86 the return address. While DWARF unwind info doesn't use that many bytes, but unfortunately reading and parsing that information is quite expensive. For that reason I've developed a new unwinder that uses custom unwind information derived from DWARF (https://www.polarsignals.com/blog/posts/2022/11/29/profiling..., previously discussed in https://news.ycombinator.com/item?id=33788794) that runs in BPF. This new compact representation can be binary searched easily and each unwind row has a size of 16

I find this surprising! Was this for off the shelf applications or some custom binaries? We see DWARF expressions such as `DW_CFA_def_cfa_expression` on the regular. See the "Test Plan" section and commit messages of the PR that introduced support for this particular opcode, as well as the simple executable that shows this opcode [0] and its printed unwind table [1] [0]: https://github.com/parca-dev/parca-agent/pull/1058 [1]: https://github.com/parca-dev/testdata/blob/7f9206570a743206f...

Author here! This project looks interesting and as you mention it seems conceptually similar! I would agree with that quote, generally speaking, but I think it really depends on a binary to binary basis. Some binaries outsource most of the work to dynamic libraries. Unfortunately, DWARF expressions are typically emitted for these program counter ranges, so it's desirable to at least implement a subset of expressions [0]. Even if that's not the case, we want to produce profiles that are as accurate as possible :) You are totally right, they were discussing kernel stacks where stakes are higher as it needs to work perfectly, otherwise kernel live patching would not reliably work, among others. The kernel has now some unwind table format, that can be used in x86_64, called ORC [1]. That being said the parser for DWARF would still have to liv

repo: https://github.com/parca-dev/parca-agent