将 eBPF 可观测性扩展到非标准执行环境

中文摘要 AI 辅助

eBPF 对非标准执行环境（NEEs）如 TEEs 或 LibOSes 的可观测性受到其非常规的异常处理和内存访问机制的限制，这些机制限制了标准 Linux 工具的使用。本文引入了两种机制，使基于 eBPF 的可观测性能够用于 NEEs：（1）内核内存扩展，用于从 eBPF 程序安全地访问 NEE 内存；（2）轻量级灵活探针性能测量单元（LWFP PMU），通过以下 LWFP 为 NEEs 提供灵活和通用的探测：简单（SLWFP）、飞地（ELWFP）和扩展（ExLWFP）探针。我们通过开发用于追踪、带 Flame Graphs 的栈采样、动态插桩、时序分析以及支持 Intel SGX 飞地和 LibOSes 的 USDT 的工具，证明了这些扩展的实用性。性能测量表明，SLWFP 探针实现了 394 纳秒的延迟，优于 uprobes，后者延迟高出 25%，而 ELWFP 探针的延迟约为 2.8 微秒，这对于飞地可观测性来说是实用的。SLWFP 的加入对现有 uprobe 性能引入了可忽略的开销。总的来说，这项工作通过为多样化的 NEE 硬件和软件架构启用通用且可复用的 eBPF 工具，为弥合 NEE 工具与 Linux 可观测性工具之间长期存在的差距奠定了基础。

英文摘要

eBPF observability of non-standard execution environments (NEEs) like TEEs or LibOSes is hindered by their unconventional exception-handling and memory-access mechanisms that limit standard Linux tooling. This work introduces two mechanisms that enable eBPF-based observability for NEEs: (1) kernel memory extensions for safely accessing NEE memory from eBPF programs, and (2) a lightweight flexible probe performance measurement unit (LWFP PMU) that provides flexible and generic probing, for NEEs, through the following LWFP: simple (SLWFP), enclave (ELWFP) and extended (ExLWFP) probes. We demonstrate the practicality of these extensions by developing tooling for tracing, stack sampling with Flame Graphs, dynamic instrumentation, timing analysis, and USDT support for Intel SGX enclaves and LibOSes. Performance measurements show that SLWFP probes achieve a latency of 394 ns, outperforming uprobes, which exhibit 25% higher latency, while ELWFP probes incur a latency ~2.8 microseconds, which is practical for enclave observability. The addition of SLWFP introduces negligible overhead to existing uprobe performance. Taken together, this work lays the foundation for closing the long-standing gap between NEE tooling and Linux observability tooling by enabling generic and reusable eBPF tooling for diverse NEE hardware and software architectures.

发表机构

• TU Dresden（德累斯顿工业大学）

机构由 AI 辅助整理，请以论文原文为准。