Skip to content

fix(ebpf): use raw bpf_map_lookup_elem for inner shard lookup to fix …#74

Merged
zz85 merged 3 commits intomainfrom
make-verifier-happy
Feb 21, 2026
Merged

fix(ebpf): use raw bpf_map_lookup_elem for inner shard lookup to fix …#74
zz85 merged 3 commits intomainfrom
make-verifier-happy

Conversation

@zz85
Copy link
Owner

@zz85 zz85 commented Feb 21, 2026

…26x verifier slowdown

The typed Array::get() API from Brskt's aya-ebpf PR (aya-rs/aya#1446), when used for the inner map lookup in shard_lookup(), generates BPF bytecode that causes the kernel verifier's state exploration to explode. Although the typed and raw code paths produce identical branch counts (199 conditional jumps in profile_cpu), the typed path inserts extra intermediate instructions between the outer and inner bpf_map_lookup_elem calls — notably binary search midpoint calculations that the compiler reorders into the gap. This different code structure causes the verifier to track exponentially more register states at join points inside the DWARF binary search loop.

Measured on kernel 6.14, 16 CPUs:

Version profile_cpu.load() (ms) Total (ms)
Pre-merge (raw lookups) 345 408
Post-merge (typed Array::get()) 10.65s 10.7s
This fix (typed outer, raw inner) 345 403

The fix keeps the Brskt typed ArrayOfMaps<Array> for map definitions and the outer map lookup, but reverts the inner map lookup to raw bpf_map_lookup_elem. This preserves the cleaner map definition API while keeping the BPF bytecode verifier-friendly.

All 16 e2e tests pass, 51 unit tests pass, fmt and clippy clean.

Summary by CodeRabbit

  • Refactor
    • Streamlined internal map lookup logic to improve reliability with the eBPF verifier and pointer handling, while preserving external behavior and public APIs.
    • Adjusted imports and internal helpers to support the new lookup path; no user-visible API or control-flow changes.

…26x verifier slowdown

The typed Array::get() API from Brskt's aya-ebpf fork, when used for
the inner map lookup in shard_lookup(), generates BPF bytecode that
causes the kernel verifier's state exploration to explode. Although the
typed and raw code paths produce identical branch counts (199
conditional jumps in profile_cpu), the typed path inserts extra
intermediate instructions between the outer and inner
bpf_map_lookup_elem calls — notably binary search midpoint calculations
that the compiler reorders into the gap. This different code structure
causes the verifier to track exponentially more register states at join
points inside the DWARF binary search loop.

Measured on kernel 6.14, 16 CPUs:

  Version                          profile_cpu.load()   Total
  ────────────────────────────     ──────────────────   ─────
  Pre-merge (raw lookups)          ~345ms               ~408ms
  Post-merge (typed Array::get())  10.65s               10.7s
  This fix (typed outer, raw inner) ~345ms              ~403ms

The fix keeps the Brskt typed ArrayOfMaps<Array<UnwindEntry>> for map
definitions and the outer map lookup, but reverts the inner map lookup
to raw bpf_map_lookup_elem. This preserves the cleaner map definition
API while keeping the BPF bytecode verifier-friendly.

All 16 e2e tests pass, 51 unit tests pass, fmt and clippy clean.
@coderabbitai
Copy link

coderabbitai bot commented Feb 21, 2026

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)
  • profile-bee/ebpf-bin/profile-bee.bpf.o is excluded by !**/*.o

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

Replaced typed inner-map Array lookups in shard_lookup with raw bpf_map_lookup_elem on inner map pointers, reading UnwindEntry via read_unaligned; added the helper import and updated docs to describe outer ArrayOfMaps + raw inner lookup flow.

Changes

Cohort / File(s) Summary
eBPF Map Lookup Refactor
profile-bee-ebpf/src/lib.rs
Reworked shard_lookup to use bpf_map_lookup_elem on inner map pointers instead of Array::get(); read UnwindEntry with read_unaligned; updated docs and added bpf_map_lookup_elem to imports.
Binary imports update
profile-bee/bin/profile-bee.rs
Added InnerMap to aya::maps imports (import surface change only).
Runtime imports reorganization
profile-bee/src/ebpf.rs
Adjusted aya::maps imports—added InnerMap and separated StackTraceMap into its own line (no logic change).

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

Poem

🐇 I hop where pointers hide and hum,

I swap the typed for helper-sum.
With bpf_map_lookup in paw so spry,
Unaligned reads wink an honest sky,
A tiny trace — a rabbit's sigh.

🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title directly addresses the main technical change: switching from typed Array::get() to raw bpf_map_lookup_elem for inner shard lookup. The change is specific and clearly identifies the primary fix.
Docstring Coverage ✅ Passed Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch make-verifier-happy

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
profile-bee-ebpf/src/lib.rs (1)

1095-1108: Ensure the prebuilt eBPF binary is rebuilt and committed.

The shard_lookup change alters the compiled BPF bytecode. The prebuilt object at profile-bee/ebpf-bin/profile-bee.bpf.o is embedded at compile time and must stay in sync — users running cargo install on stable Rust depend on it.

Run cargo xtask build-ebpf --release and commit the updated binary.

Based on learnings: "Prebuilt eBPF binaries are embedded at compile time in profile-bee/ebpf-bin/profile-bee.bpf.o. Keep in sync with profile-bee-ebpf/ changes via cargo xtask build-ebpf --release."

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@profile-bee-ebpf/src/lib.rs` around lines 1095 - 1108, The change to
shard_lookup modifies the compiled BPF bytecode so you must rebuild the prebuilt
embedded eBPF object and commit the updated artifact; run the build task (cargo
xtask build-ebpf --release) in the ebpf crate to produce a new eBPF object that
matches the updated shard_lookup and then replace the committed prebuilt eBPF
object in the repo with that new build and commit it.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@profile-bee-ebpf/src/lib.rs`:
- Around line 1095-1108: The change to shard_lookup modifies the compiled BPF
bytecode so you must rebuild the prebuilt embedded eBPF object and commit the
updated artifact; run the build task (cargo xtask build-ebpf --release) in the
ebpf crate to produce a new eBPF object that matches the updated shard_lookup
and then replace the committed prebuilt eBPF object in the repo with that new
build and commit it.

zz85 added 2 commits February 21, 2026 02:36
The upstream aya dependency (hashmapofmaps-new branch) moved the fd()
method behind the InnerMap trait. Import it in both call sites to fix
the CI build.
@zz85 zz85 merged commit 1922b86 into main Feb 21, 2026
5 checks passed
@zz85 zz85 deleted the make-verifier-happy branch February 21, 2026 03:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant