Oracle Corporation on the work related to the transmission of changes associated with DTrace to upstream and plans for implementing dynamic debugging technology of DTrace over the standard Linux kernel infrastructure, namely using subsystems such as eBPF. Initially, the main problem with using DTrace in Linux was the compatibility at the licensing level, but in 2018, Oracle the DTrace code under GPLv2.
DTrace has been as part of the extended kernel for the Oracle Linux distribution, but for its use in other distributions, it requires the application of additional patches for the kernel, which limits the use of the indicated technology. For example, Oracle provides detailed instructions for installing and using DTrace in Fedora Linux. The installation requires building and using a Linux kernel rebuilt with . To automate the process of building the kernel with Oracle and Fedora patches, an .
eBPF is an interpreter of bytecode built into the Linux kernel that allows you to create handlers for network operations, track system performance, intercept system calls, control access, process events while preserving timestamps (perf_event_open), calculate the frequency and execution time of operations, and perform tracing using kprobes/uprobes/tracepoints. Due to the use of JIT compilation, bytecode is translated into machine instructions on the fly and executed with the performance of native code. DTrace can be implemented on top of eBPF, similar to how existing tracing tools work on eBPF. available tracing tools.
The DTrace technology was developed for the Solaris operating system to address dynamic tracing tasks of the system's kernel and end applications, allowing users to track system behavior in detail and diagnose problems in real time. During debugging, DTrace does not affect the operation of the investigated applications and has no impact on their performance, which enables the analysis of running systems on the fly. A strong point of DTrace is its high-level D language, similar to AWK, which makes it significantly easier to create tracing scripts than using the tools provided for eBPF to write handlers in C, Python, and Lua with external libraries.
Engineers from Oracle are also working on creating an eBPF backend for GCC and have already published to integrate eBPF support into GCC and the inclusion of code for eBPF support in GNU binutils. Initially, the backend for eBPF support is based on LLVM technologies, but Oracle is interested in developing native support for generating programs for eBPF in GCC, which will allow the use of a single toolchain for both Linux kernel compilation and eBPF program development.
In addition to the backend for generating bytecode, the patches proposed for GCC also include a port of libgcc for eBPF and utilities for generating ELF files, enabling code execution in the eBPF virtual machine using loaders provided by the kernel. Currently, only C language code can be translated to bytecode (not all language features are available), but in the future, an expansion of available C language capabilities, the addition of support for other languages, the creation of a simulator, and the integration of GCC support for debugging eBPF programs without loading into the kernel are expected.
Source: opennet.ru
