4 ms·

Why now, and why DTrace (vs BPF)? Looking at the doc [1]: > Check that you are running a supported version of Windows. The current download of DTrace is suppor

Why now, and why DTrace (vs BPF)? Looking at the doc [1]: > Check that you are running a supported version of Windows. The current download of DTrace is supported in the Insider builds of 20H1 Windows after version 18980 and Windows Server Build 18975. Installing this version of DTrace on older versions of Windows can lead to system instability and is not recommended. The archived version of DTrace for 19H1 is available at Archived Download DTrace on Windows. Note that this version of DTrace is no longer supported. So it's not "now", but has been there for a while. Also it might not be very helpful to align with BPF anyway as the kernel itself is totally different thus any tool reuse wouldn't be very practical. [1] https://docs.microsoft.com/en-us/windows-hardware/drivers/devtest/dtrace https://docs.microsoft.com/en-us/windows-hardware/drivers/de...

stevemk14ebr 4y ago
Dtrace was added to windows before the bpf system was. This is a bit over two years old now.
- flakiness 4y ago
  You made me realize that Windows does supprot BPF! I saw that before but forgot about that. Thanks for the reminder! Such a crazy operating system (an applause.) https://cloudblogs.microsoft.com/opensource/2021/05/10/making-ebpf-work-on-windows/ https://cloudblogs.microsoft.com/opensource/2021/05/10/makin...
0mp 4y ago
It probably helps that OpenDTrace has a published specification that you can use to not only to reimplement bits of DTrace from scratch but also to agree on a common behavior across many operating systems: https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-924.pdf https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-924.pdf
rurban 4y ago
Why? Because dtrace is portable, has been ported to all major OS, and safe, and has a lot of bindings in a lot of apps and libs already. It seemlessly integrates kernel and Userland calls. whilst eBPF is Linux only, and completely insecure. with almost none existing userland bindings.
- mdaverde 4y ago
  eBPF is not Linux only. Windows is investing into integrating it to their OS and some efforts have begun applying it to the BSDs. There's even a recent initiative to standardize the eBPF runtime. eBPF can work with Dtrace's USDTs as well as dynamic u(ret)probes. Dtrace on Linux is built on top of eBPF.

stevemk14ebr 4y ago

Dtrace was added to windows before the bpf system was. This is a bit over two years old now.

flakiness 4y ago
You made me realize that Windows does supprot BPF! I saw that before but forgot about that. Thanks for the reminder! Such a crazy operating system (an applause.) https://cloudblogs.microsoft.com/opensource/2021/05/10/making-ebpf-work-on-windows/ https://cloudblogs.microsoft.com/opensource/2021/05/10/makin...

0mp 4y ago

It probably helps that OpenDTrace has a published specification that you can use to not only to reimplement bits of DTrace from scratch but also to agree on a common behavior across many operating systems: https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-924.pdf https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-924.pdf

rurban 4y ago

Why? Because dtrace is portable, has been ported to all major OS, and safe, and has a lot of bindings in a lot of apps and libs already. It seemlessly integrates kernel and Userland calls. whilst eBPF is Linux only, and completely insecure. with almost none existing userland bindings.

mdaverde 4y ago
eBPF is not Linux only. Windows is investing into integrating it to their OS and some efforts have begun applying it to the BSDs. There's even a recent initiative to standardize the eBPF runtime. eBPF can work with Dtrace's USDTs as well as dynamic u(ret)probes. Dtrace on Linux is built on top of eBPF.