Profiling Internals: Hardware Timers and eBPF

The text discusses the mechanisms of CPU profiling, focusing on hardware timers and eBPF technology. It explains how modern operating systems use hardware timers to facilitate non-cooperative multitasking, allowing multiple tasks to appear as if running simultaneously by periodically halting the CPU to switch tasks. Profiling utilizes these timers to measure elapsed time, employing Linux's perf events to register events that trigger code execution at specific intervals. Traditional profilers like perf rely on frame-pointer-based unwinding or DWARF-based methods, which can be resource-intensive and limited by context switching. However, the introduction of eBPF, an extension of the classic BPF initially used for network analysis, allows for more efficient profiling by enabling user-mode programs to attach custom logic to kernel events without context switching. eBPF programs are verified for safety and run directly in the kernel, making them capable of unwinding stacks and passing data to user-mode profilers like Parca without the overhead of copying data between processes. This approach enhances performance while maintaining system stability, as eBPF is not Turing-complete and cannot crash the kernel. The text concludes by highlighting the collaboration of hardware timers and eBPF in modern CPU profilers, supported by an AI usage disclaimer about the article's preparation.