ext_ktrace

This project aims to provide a set of components for adding trace support to the Rust kernel.

Components

• ktracepoint: A Rust crate for implementing tracepoints in the kernel. This crate provides a flexible and efficient way to add tracing capabilities to your kernel, similar to Linux kernel's tracepoint mechanism.
• kprobe: A Rust crate for implementing kprobes/uprobes in the kernel. This crate provides a way to dynamically instrument kernel functions and collect data at runtime.
• bpf-basic: A Rust library providing basic abstractions and utilities for eBPF (Extended Berkeley Packet Filter) programming.
• tp-lexer: A Rust library for parsing and evaluating filter expressions for tracepoints.
• ksym: A Rust library for generating symbol tables for operating systems, similar to Linux's kallsyms.

Roadmap

• Implement basic kprobe support
• Implement basic tracepoint support
• Implement basic eBPF map and helper functions
• Implement basic eBPF support in some kernels
  • Monolithic kernels
    • DragonOS
    • Starry
    • Alien
  • Unikernel
    • Hermit
• Implement more eBPF maps and helper functions
  • ringbuf
• Implement other kernel hooks
  • rawtracepoint
  • uprobe
  • uretprobe
  • perf events

License

This project is licensed under the MIT License. See the LICENSE file for the full license text.

Reference

• https://docs.cilium.io/en/stable/reference-guides/bpf/architecture/
• https://blog.spoock.com/2024/01/11/bpf-tail-call-intro/