Skip to content

feat: support real-time profile#11414

Draft
kylewanginchina wants to merge 5 commits intomainfrom
support-real-time-profile
Draft

feat: support real-time profile#11414
kylewanginchina wants to merge 5 commits intomainfrom
support-real-time-profile

Conversation

@kylewanginchina
Copy link
Contributor

This PR is for:

  • Agent

Support real-time profile

Checklist

  • Added unit test.

Backport to branches

kylewanginchina and others added 5 commits February 28, 2026 15:53
Set PROC_EVENT_HANDLE_DELAY to 0 so interpreter and memory profiling
events are processed within the next ~100ms event loop cycle instead
of waiting 120 seconds. This enables sub-second uprobe attachment for
newly started processes.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
New event type and library_load_event_t struct to support real-time
detection of dynamically loaded shared libraries via _dl_open uretprobe.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…tion

Add a uretprobe program (dl_open_uretprobe) that fires when _dl_open()
returns after dynamically loading a shared library. The program emits an
EVENT_TYPE_LIB_LOAD event with the process PID via the socket_data perf
buffer, enabling user-space to detect runtime dlopen() calls and re-scan
the process for newly loaded libraries.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add library_load_event() handler that calls extended_process_exec() to
re-trigger the process initialization pipeline when a dlopen is detected.
This allows the profiler to rescan the process memory maps and attach
uprobes for newly loaded shared libraries at runtime.

Also register EVENT_TYPE_LIB_LOAD dispatch in register_events_handle()
alongside the existing process exec/exit event handling.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Register an eBPF process event callback (exec/exit) through the existing
register_event_handle C FFI. Events are forwarded via a lock-free channel
to the ProcessListener thread, which drains them every 1-second cycle and
incrementally updates per-feature PID filter maps via process_single_pid().

This reduces the latency for new process detection from up to 10 seconds
(full /proc scan interval) to approximately 1 second, while retaining the
10-second full scan as a fallback for correctness.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@kylewanginchina kylewanginchina force-pushed the support-real-time-profile branch from 5b577df to 98c8f6d Compare February 28, 2026 10:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant