Skip to content

[WIP][WP] Implementation of Otel 4947 thread context#48446

Open
Gui774ume wants to merge 14 commits into
mainfrom
will/implement-otel-4947
Open

[WIP][WP] Implementation of Otel 4947 thread context#48446
Gui774ume wants to merge 14 commits into
mainfrom
will/implement-otel-4947

Conversation

@Gui774ume

@Gui774ume Gui774ume commented Mar 26, 2026

Copy link
Copy Markdown
Contributor

What does this PR do?

Adds support for reading span/trace IDs from native applications using the OpenTelemetry Thread Local Context Record format (OTel spec PR #4947) in the CWS eBPF security module.

The implementation adds a new eBPF read path that:

  1. Discovers the OTel TLSDESC TLS variable offset (registered by user-space via a new eRPC operation)
  2. Reads the thread pointer (fsbase) from task_struct->thread.fsbase
  3. Dereferences the TLS pointer to locate the OTel Thread Local Context Record
  4. Validates the record (valid == 1) and converts W3C byte-order trace-id/span-id to the existing native-endian span_context_t format

The existing Datadog proprietary span TLS mechanism is preserved — fill_span_context() tries the Datadog path first, then falls back to OTel. All downstream code (event structs, unmarshallers, hooks) is unchanged since the output remains the same
24-byte span_context_t.

This targets native applications using ELF TLSDESC (C, C++, Rust, Java/JNI, .NET/FFI, Python native extensions). Support for additional runtimes (Go via pprof labels, Node.js via runtime internals) will be added separately. Currently x86_64 only
— ARM64 (tpidr_el0) is deferred.

Motivation

The OpenTelemetry specification defines a standard mechanism for SDKs to publish thread-level trace context (trace ID, span ID) through ELF Thread Local Storage so that out-of-process readers like eBPF probes can correlate security events with
distributed traces. Supporting this standard allows CWS to automatically pick up span context from any OTel-instrumented native application without requiring Datadog-specific instrumentation.

Describe how you validated your changes

  • All modified Go packages (probe/erpc, probe/constantfetch, ebpf/probes, ptracer, probe) build cleanly
  • The C syscall tester compiles successfully with the new otel-span-open command
  • Added a functional test (TestOTelSpan) that:
    • Creates a __thread TLS variable in C, computes its offset from fsbase via arch_prctl(ARCH_GET_FS)
    • Registers the offset with eBPF via the new REGISTER_OTEL_TLS_OP eRPC operation
    • Fills an OTel Thread Local Context Record with a known trace ID and span ID in W3C byte order
    • Triggers an open() syscall and verifies the correct trace/span IDs appear in the captured security event
  • Existing TestSpan test continues to work (Datadog proprietary path is unchanged)

Additional Notes

  • The task_struct->thread.fsbase offset is resolved using two separate BTF lookups (task_struct.thread + thread_struct.fsbase) because the BTF constant fetcher only recurses into anonymous struct members, and thread is a named member
  • Fallback offset functions return ErrorSentinel — BTF is strongly preferred for these offsets since task_struct.thread varies significantly with kernel config
  • The OTel record's attrs-data field (custom attributes) is not read — only trace-id and span-id are extracted
  • The fill_span_context() behavior has a minor semantic change: if the Datadog TLS is registered but returns all-zero context (no active span), it now falls through to try OTel before returning zeros
  • The dd-trace-go tracer exposes only the span ID and the local root span ID (i.e. the upper 64 bits of the 128 bits trace ID), see here.

@Gui774ume Gui774ume added this to the 7.79.0 milestone Mar 26, 2026
@Gui774ume Gui774ume requested a review from a team as a code owner March 26, 2026 17:37
@Gui774ume Gui774ume added changelog/no-changelog No changelog entry needed component/system-probe team/agent-security qa/done QA done before merge and regressions are covered by tests labels Mar 26, 2026
@dd-octo-sts dd-octo-sts Bot added the internal Identify a non-fork PR label Mar 26, 2026
@github-actions github-actions Bot added the long review PR is complex, plan time to review it label Mar 26, 2026

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5891c761c2

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment on lines +81 to +82
u64 thread_offset = get_task_struct_thread_offset();
u64 fsbase_offset = get_thread_struct_fsbase_offset();

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Guard OTel fsbase reads behind resolved offsets

These offsets are consumed unconditionally, but the commit only requests them on amd64 (probe_ebpf.go) and the new fallback getters return ErrorSentinel (constantfetch/fallback.go), which is later materialized as 0 in constant editors. If a process sends REGISTER_OTEL_TLS_OP on an unsupported/missing-offset environment (e.g., arm64 or x86_64 kernels where BTF lookup fails), this path reads task + 0 instead of task->thread.fsbase, so OTel context extraction becomes incorrect and can mis-associate or drop span correlation. The OTel path should be disabled unless both offsets are successfully resolved.

Useful? React with 👍 / 👎.

@agent-platform-auto-pr

agent-platform-auto-pr Bot commented Mar 26, 2026

Copy link
Copy Markdown
Contributor

Files inventory check summary

File checks results against ancestor f053e31a:

Results for datadog-agent_7.81.0~devel.git.326.75c8f98.pipeline.115898007-1_amd64.deb:

Detected file changes:

1 Changed files:

  • opt/datadog-agent/embedded/share/system-probe/ebpf/runtime-security-fentry.o:
    • Size changed: +12.46% (948.45 KiB) (7.43 MiB -> 8.36 MiB)

@agent-platform-auto-pr

agent-platform-auto-pr Bot commented Mar 26, 2026

Copy link
Copy Markdown
Contributor

Static quality checks

❌ Please find below the results from static quality gates
Comparison made with ancestor 9101702
📊 Static Quality Gates Dashboard
🔗 SQG Job

Error

Quality gate Change Size (prev → curr → max)
agent_deb_amd64 (per-PR threshold) +2.76 MiB (0.37% increase, -57.71% of buffer) 746.015 → 748.776 → 750.800
agent_deb_amd64_fips (on disk) +2.76 MiB (0.39% increase, -544.09% of buffer) 703.793 → 706.551 → 704.300
agent_rpm_amd64 (per-PR threshold) +2.76 MiB (0.37% increase, -57.88% of buffer) 745.999 → 748.760 → 750.770
agent_rpm_amd64_fips (on disk) +2.76 MiB (0.39% increase, -527.16% of buffer) 703.777 → 706.535 → 704.300
agent_rpm_arm64 (on disk) +2.76 MiB (0.38% increase, -300.13% of buffer) 723.582 → 726.338 → 724.500
agent_rpm_arm64_fips (on disk) +2.76 MiB (0.40% increase, -748.42% of buffer) 684.502 → 687.258 → 684.870
agent_suse_amd64 (per-PR threshold) +2.76 MiB (0.37% increase, -57.88% of buffer) 745.999 → 748.760 → 750.770
agent_suse_amd64_fips (on disk) +2.76 MiB (0.39% increase, -527.16% of buffer) 703.777 → 706.535 → 704.300
agent_suse_arm64 (on disk) +2.76 MiB (0.38% increase, -300.13% of buffer) 723.582 → 726.338 → 724.500
agent_suse_arm64_fips (on disk) +2.76 MiB (0.40% increase, -748.42% of buffer) 684.502 → 687.258 → 684.870
docker_agent_amd64 (on disk) +2.76 MiB (0.34% increase, -1676.39% of buffer) 806.175 → 808.937 → 806.340
docker_agent_arm64 (on disk) +2.76 MiB (0.34% increase, -176.66% of buffer) 808.560 → 811.316 → 810.120
docker_agent_jmx_amd64 (on disk) +2.76 MiB (0.28% increase, -546.93% of buffer) 997.095 → 999.857 → 997.600
docker_agent_jmx_arm64 (on disk) +2.76 MiB (0.28% increase, -178.78% of buffer) 988.258 → 991.015 → 989.800
Gate failure full details
Quality gate Error type Error message
agent_deb_amd64 PerPRThresholdExceeded On-disk size increase of 2.76 MiB exceeds the per-PR threshold of 600.0 KiB
agent_deb_amd64_fips AbsoluteLimitExceeded static_quality_gate_agent_deb_amd64_fips failed!
Disk size 706.6 MB exceeds limit of 704.3 MB by 2.3 MB
agent_rpm_amd64 PerPRThresholdExceeded On-disk size increase of 2.76 MiB exceeds the per-PR threshold of 600.0 KiB
agent_rpm_amd64_fips AbsoluteLimitExceeded static_quality_gate_agent_rpm_amd64_fips failed!
Disk size 706.5 MB exceeds limit of 704.3 MB by 2.2 MB
agent_rpm_arm64 AbsoluteLimitExceeded static_quality_gate_agent_rpm_arm64 failed!
Disk size 726.3 MB exceeds limit of 724.5 MB by 1.8 MB
agent_rpm_arm64_fips AbsoluteLimitExceeded static_quality_gate_agent_rpm_arm64_fips failed!
Disk size 687.3 MB exceeds limit of 684.9 MB by 2.4 MB
agent_suse_amd64 PerPRThresholdExceeded On-disk size increase of 2.76 MiB exceeds the per-PR threshold of 600.0 KiB
agent_suse_amd64_fips AbsoluteLimitExceeded static_quality_gate_agent_suse_amd64_fips failed!
Disk size 706.5 MB exceeds limit of 704.3 MB by 2.2 MB
agent_suse_arm64 AbsoluteLimitExceeded static_quality_gate_agent_suse_arm64 failed!
Disk size 726.3 MB exceeds limit of 724.5 MB by 1.8 MB
agent_suse_arm64_fips AbsoluteLimitExceeded static_quality_gate_agent_suse_arm64_fips failed!
Disk size 687.3 MB exceeds limit of 684.9 MB by 2.4 MB
docker_agent_amd64 AbsoluteLimitExceeded static_quality_gate_docker_agent_amd64 failed!
Disk size 808.9 MB exceeds limit of 806.3 MB by 2.6 MB
docker_agent_arm64 AbsoluteLimitExceeded static_quality_gate_docker_agent_arm64 failed!
Disk size 811.3 MB exceeds limit of 810.1 MB by 1.2 MB
docker_agent_jmx_amd64 AbsoluteLimitExceeded static_quality_gate_docker_agent_jmx_amd64 failed!
Disk size 999.9 MB exceeds limit of 997.6 MB by 2.3 MB
docker_agent_jmx_arm64 AbsoluteLimitExceeded static_quality_gate_docker_agent_jmx_arm64 failed!
Disk size 991.0 MB exceeds limit of 989.8 MB by 1.2 MB

Static quality gates prevent the PR to merge!
You can check the static quality gates confluence page for guidance. We also have a toolbox page available to list tools useful to debug the size increase.
Please either fix the size violation or request an exception.

Successful checks

Info

Quality gate Change Size (prev → curr → max)
agent_msi +6.0 KiB (0.00% increase, -0.04% of buffer) 610.189 → 610.195 → 624.040
18 successful checks with minimal change (< 2 KiB)
Quality gate Current Size
agent_heroku_amd64 310.716 MiB
docker_cluster_agent_amd64 207.074 MiB
docker_cluster_agent_arm64 221.016 MiB
docker_cws_instrumentation_amd64 7.154 MiB
docker_cws_instrumentation_arm64 6.689 MiB
docker_dogstatsd_amd64 39.499 MiB
docker_dogstatsd_arm64 37.690 MiB
docker_host_profiler_amd64 302.092 MiB
docker_host_profiler_arm64 313.593 MiB
dogstatsd_deb_amd64 30.155 MiB
dogstatsd_deb_arm64 28.280 MiB
dogstatsd_rpm_amd64 30.155 MiB
dogstatsd_suse_amd64 30.155 MiB
iot_agent_deb_amd64 44.500 MiB
iot_agent_deb_arm64 41.464 MiB
iot_agent_deb_armhf 42.177 MiB
iot_agent_rpm_amd64 44.500 MiB
iot_agent_suse_amd64 44.500 MiB

@cit-pr-commenter-54b7da

cit-pr-commenter-54b7da Bot commented Mar 26, 2026

Copy link
Copy Markdown

Regression Detector

Regression Detector Results

Metrics dashboard
Target profiles
Run ID: 3ffe3114-574e-4fb4-b3cc-503ac3302591

Baseline: f053e31
Comparison: 75c8f98
Diff

Optimization Goals: ✅ No significant changes detected

Experiments ignored for regressions

Regressions in experiments with settings containing erratic: true are ignored.

perf experiment goal Δ mean % Δ mean % CI trials links
docker_containers_cpu % cpu utilization -2.00 [-4.89, +0.89] 1 Logs

Fine details of change detection per experiment

perf experiment goal Δ mean % Δ mean % CI trials links
quality_gate_idle_all_features memory utilization +4.47 [+4.43, +4.50] 1 Logs bounds checks dashboard
file_tree memory utilization +3.62 [+3.51, +3.72] 1 Logs
otlp_ingest_logs memory utilization +0.84 [+0.75, +0.94] 1 Logs
docker_containers_memory memory utilization +0.29 [+0.19, +0.40] 1 Logs
uds_dogstatsd_20mb_12k_contexts_20_senders memory utilization +0.21 [+0.16, +0.26] 1 Logs
ddot_metrics_sum_cumulative memory utilization +0.14 [-0.02, +0.29] 1 Logs
ddot_metrics_sum_delta memory utilization +0.11 [-0.08, +0.30] 1 Logs
file_to_blackhole_500ms_latency egress throughput +0.06 [-0.34, +0.46] 1 Logs
ddot_metrics_sum_cumulativetodelta_exporter memory utilization +0.06 [-0.18, +0.29] 1 Logs
file_to_blackhole_100ms_latency egress throughput +0.02 [-0.12, +0.16] 1 Logs
uds_dogstatsd_to_api_v3 ingress throughput +0.01 [-0.19, +0.21] 1 Logs
uds_dogstatsd_to_api ingress throughput +0.01 [-0.19, +0.21] 1 Logs
tcp_dd_logs_filter_exclude ingress throughput +0.01 [-0.09, +0.11] 1 Logs
file_to_blackhole_1000ms_latency egress throughput -0.03 [-0.48, +0.42] 1 Logs
ddot_metrics memory utilization -0.03 [-0.22, +0.15] 1 Logs
file_to_blackhole_0ms_latency egress throughput -0.04 [-0.54, +0.46] 1 Logs
otlp_ingest_metrics memory utilization -0.04 [-0.20, +0.12] 1 Logs
quality_gate_idle memory utilization -0.09 [-0.14, -0.04] 1 Logs bounds checks dashboard
ddot_logs memory utilization -0.16 [-0.22, -0.09] 1 Logs
quality_gate_metrics_logs memory utilization -0.18 [-0.42, +0.06] 1 Logs bounds checks dashboard
quality_gate_logs % cpu utilization -1.45 [-2.46, -0.44] 1 Logs bounds checks dashboard
tcp_syslog_to_blackhole ingress throughput -1.54 [-1.72, -1.35] 1 Logs
docker_containers_cpu % cpu utilization -2.00 [-4.89, +0.89] 1 Logs

Bounds Checks: ❌ Failed

perf experiment bounds_check_name replicates_passed observed_value links
docker_containers_cpu simple_check_run 10/10 714 ≥ 26
docker_containers_memory memory_usage 10/10 248.71MiB ≤ 370MiB
docker_containers_memory simple_check_run 10/10 708 ≥ 26
file_to_blackhole_0ms_latency memory_usage 10/10 0.16GiB ≤ 1.20GiB
file_to_blackhole_0ms_latency missed_bytes 10/10 0B = 0B
file_to_blackhole_1000ms_latency memory_usage 10/10 0.20GiB ≤ 1.20GiB
file_to_blackhole_1000ms_latency missed_bytes 10/10 0B = 0B
file_to_blackhole_100ms_latency memory_usage 10/10 0.17GiB ≤ 1.20GiB
file_to_blackhole_100ms_latency missed_bytes 10/10 0B = 0B
file_to_blackhole_500ms_latency memory_usage 10/10 0.18GiB ≤ 1.20GiB
file_to_blackhole_500ms_latency missed_bytes 10/10 0B = 0B
quality_gate_idle intake_connections 10/10 3 ≤ 4 bounds checks dashboard
quality_gate_idle memory_usage 10/10 144.99MiB ≤ 147MiB bounds checks dashboard
quality_gate_idle total_bytes_received 10/10 741.31KiB ≤ 819.20KiB bounds checks dashboard
quality_gate_idle_all_features intake_connections 10/10 3 ≤ 4 bounds checks dashboard
quality_gate_idle_all_features memory_usage 5/10 512.16MiB > 495MiB bounds checks dashboard
quality_gate_idle_all_features total_bytes_received 10/10 0.96MiB ≤ 1.25MiB bounds checks dashboard
quality_gate_logs intake_connections 10/10 3 ≤ 6 bounds checks dashboard
quality_gate_logs memory_usage 10/10 174.79MiB ≤ 195MiB bounds checks dashboard
quality_gate_logs missed_bytes 10/10 0B = 0B bounds checks dashboard
quality_gate_logs total_bytes_received 10/10 264.39MiB ≤ 292MiB bounds checks dashboard
quality_gate_metrics_logs cpu_usage 10/10 354.19 ≤ 2000 bounds checks dashboard
quality_gate_metrics_logs intake_connections 10/10 3 ≤ 6 bounds checks dashboard
quality_gate_metrics_logs memory_usage 10/10 375.46MiB ≤ 430MiB bounds checks dashboard
quality_gate_metrics_logs missed_bytes 10/10 0B = 0B bounds checks dashboard
quality_gate_metrics_logs total_bytes_received 10/10 0.94GiB ≤ 1.04GiB bounds checks dashboard

Explanation

Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%

Performance changes are noted in the perf column of each table:

  • ✅ = significantly better comparison variant performance
  • ❌ = significantly worse comparison variant performance
  • ➖ = no significant change in performance

A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".

For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:

  1. Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.

  2. Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.

  3. Its configuration does not mark it "erratic".

CI Pass/Fail Decision

Failed. Some Quality Gates were violated.

  • quality_gate_idle_all_features, bounds check memory_usage: 5/10 replicas passed. Failed 5 which is > 0. Gate FAILED.
  • quality_gate_idle_all_features, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
  • quality_gate_idle_all_features, bounds check intake_connections: 10/10 replicas passed. Gate passed.
  • quality_gate_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
  • quality_gate_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_logs, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
  • quality_gate_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
  • quality_gate_idle, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
  • quality_gate_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_idle, bounds check intake_connections: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.

@Gui774ume Gui774ume force-pushed the will/implement-otel-4947 branch 2 times, most recently from cba421b to d7cfb97 Compare April 10, 2026 17:39
@Gui774ume Gui774ume requested review from a team as code owners April 10, 2026 17:39
@Gui774ume Gui774ume requested a review from AmitaiBl April 10, 2026 17:39
@Gui774ume Gui774ume changed the title [WP] Implementation of Otel 4947 thread context [WIP][WP] Implementation of Otel 4947 thread context Apr 10, 2026
@Gui774ume Gui774ume force-pushed the will/implement-otel-4947 branch 4 times, most recently from c0a283b to 9748486 Compare April 10, 2026 21:38
@Gui774ume Gui774ume requested a review from a team as a code owner April 10, 2026 21:38
Comment thread docs/cloud-workload-security/backend_linux.md Outdated
Comment thread docs/cloud-workload-security/backend_linux.md Outdated
@Gui774ume Gui774ume force-pushed the will/implement-otel-4947 branch from 9748486 to 4575111 Compare May 26, 2026 16:54
@Gui774ume Gui774ume requested a review from a team as a code owner May 26, 2026 16:54
@Gui774ume Gui774ume requested a review from hush-hush May 26, 2026 16:54
@datadog-datadog-prod-us1

datadog-datadog-prod-us1 Bot commented May 26, 2026

Copy link
Copy Markdown
Contributor

Pipelines

Fix all issues with BitsAI

⚠️ Warnings

🚦 146 Pipeline jobs failed

DataDog/datadog-agent | bazel:run-gazelle   View in Datadog   GitLab

🔧 Fix in code (Fix with Cursor). Dependency manager encountered an error in BUILD.bazel. Please run 'bazel run //:gazelle' to fix it.

DataDog/datadog-agent | bazel:test:linux-amd64   View in Datadog   GitLab

🔧 Fix in code (Fix with Cursor). Panic: trimmed map name 'syscall_monitor' not unique in bpf_maps_generator.go:123

DataDog/datadog-agent | bazel:test:linux-arm64   View in Datadog   GitLab

🔧 Fix in code (Fix with Cursor). Panic: the trimmed map name 'syscall_monitor' is not unique at pkg/security/secl/model/bpf_maps_generator/bpf_maps_generator.go:123

View all 146 failed jobs.

ℹ️ Info

🎯 Code Coverage (details)
Patch Coverage: 12.66%
Overall Coverage: 50.38% (-0.04%)

Useful? React with 👍 / 👎

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 75c8f98 | Docs | Datadog PR Page | Give us feedback!

@Gui774ume Gui774ume force-pushed the will/implement-otel-4947 branch from faf5501 to 6aa569a Compare May 28, 2026 10:11
@Gui774ume Gui774ume requested a review from a team as a code owner May 28, 2026 15:00
@Gui774ume Gui774ume force-pushed the will/implement-otel-4947 branch from b9c9c8f to 07480cb Compare May 29, 2026 12:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants