v0.6.0

Release Highlight

• Support TCP-based readiness probe 3f7b9f3
• Support speeding up attach time with BPF_TRACE_KPROBE_MULTI 87ed510

TCP-based readiness probe

Previously, it was difficult to automate the ipftrace2 tracing because it was missing the way to signal ready state (Trace Ready! text is for humans, not for machines). To resolve this problem, we introduce a TCP-based readiness probe feature. When the --enable-probe-server option is specified, ipftrace2 starts the TCP server (it closes the connection immediately after accepting) when it becomes ready for tracing. For example, we can do something like this.

# Launch function tracer
ipft -m 1 --enable-probe-server > /tmp/trace.txt &

# Wait for tracer to be ready
until nc -z 127.0.0.1 13720; do sleep 2s; done

# Make some traffic
ping -c 1 -m 1 127.0.0.1

# Stop tracer
pkill -e -TERM ipft

# Wait for ipft to finish
wait

# Dump trace
cat /tmp/trace.txt

When we want to change the port number, we can use --probe-server-port.

BPF_TRACE_KPROBE_MULTI support

BPF_TRACE_KPROBE_MULTI is a new attach type for kprobe programs that allows us to attach multiple program at once and dramatically improves the time takes to attach. ipftrace2 is a perfect use case of this feature. Now when we use the function tracer, ipftrace2 automatically probes the kernel feature and uses BPF_TRACE_KPROBE_MULTI when possible. Otherwise, falls back to bare kprobe. We can also explicitly specify them with -b option.

The below video clips show the difference between kprobe and kprobe-multi attach and detach time in my local development environment. With kprobe-multi, we can see dramatic improvement for both attach and detach time.