feat: use of span-id for trace to profile correlation

* host/host.go
* interpreter/apmint/apmint.go
* reporter/iface.go
* support/ebpf/interpreter_dispatcher.ebpf.c
* support/ebpf/tracer.ebpf.debug.amd64
* support/ebpf/tracer.ebpf.release.amd64
* support/ebpf/types.h
* tracehandler/tracehandler.go
* tracer/tracer.go

Author: elsa

host/host.go

@@ -56,4 +56,5 @@ type Trace struct {
 	APMRuntimeID     string
 	APMTraceID       libpf.APMTraceID
 	APMTransactionID libpf.APMTransactionID
+	APMSpanID        libpf.APMSpanID
 }

interpreter/apmint/apmint.go

@@ -161,6 +161,7 @@ func (i *Instance) Detach(ebpf interpreter.EbpfHandler, pid libpf.PID) error {
 
 // NotifyAPMAgent sends out collected traces to the connected APM agent.
 // This is only called when layout-minor-version=1 (elastic's original Process Storage layout)
+// TODO: add support for span ID
 func (i *Instance) NotifyAPMAgent(
 	pid libpf.PID, rawTrace *host.Trace, umTraceHash libpf.TraceHash, count uint16) {
 	if rawTrace.APMTransactionID == libpf.InvalidAPMSpanID || i.socket == nil {

reporter/iface.go

@@ -39,6 +39,7 @@ type TraceEventMeta struct {
 	APMRuntimeID     string
 	APMTraceID       libpf.APMTraceID
 	APMTransactionID libpf.APMTransactionID
+	APMSpanID        libpf.APMSpanID
 }
 
 type TraceReporter interface {

support/ebpf/interpreter_dispatcher.ebpf.c

@@ -163,13 +163,15 @@ void maybe_add_apm_info(Trace *trace) {
     trace->apm_trace_id.as_int.hi = corr_buf.trace_id.as_int.hi;
     trace->apm_trace_id.as_int.lo = corr_buf.trace_id.as_int.lo;
     trace->apm_transaction_id.as_int = corr_buf.transaction_id.as_int;
+    trace->apm_span_id.as_int = corr_buf.span_id.as_int;
   }
 
   increment_metric(metricID_UnwindApmIntReadSuccesses);
 
   // WARN: we print this as little endian
-  DEBUG_PRINT("APM transaction ID: %016llX, flags: 0x%02X",
-              trace->apm_transaction_id.as_int, corr_buf.trace_flags);
+  DEBUG_PRINT("APM transaction ID: %016llX, APM span ID: %016llX, flags: 0x%02X",
+              trace->apm_transaction_id.as_int, trace->apm_span_id.as_int,
+              corr_buf.trace_flags);
 }
 
 SEC("perf_event/unwind_stop")

support/ebpf/tracer.ebpf.debug.amd64

@@ -524,6 +524,8 @@ typedef struct Trace {
   u64 ktime;
   // The current COMM of the thread of this Trace.
   char comm[COMM_LEN];
+  // APM span ID or all-zero if not present.
+  ApmSpanID apm_span_id;
   // APM transaction ID or all-zero if not present.
   ApmSpanID apm_transaction_id;
   // APM trace ID or all-zero if not present.

support/ebpf/tracer.ebpf.release.amd64

@@ -130,6 +130,7 @@ func (m *traceHandler) HandleTrace(bpfTrace *host.Trace) {
 		APMRuntimeID:     "", // filled in below
 		APMTraceID:       bpfTrace.APMTraceID,
 		APMTransactionID: bpfTrace.APMTransactionID,
+		APMSpanID:        bpfTrace.APMSpanID,
 	}
 
 	if !m.reporter.SupportsReportTraceEvent() {

support/ebpf/types.h

@@ -861,6 +861,7 @@ func (t *Tracer) loadBpfTrace(raw []byte) *host.Trace {
 		APMRuntimeID:     C.GoString((*C.char)(unsafe.Pointer(&ptr.apm_runtime_id))),
 		APMTraceID:       *(*libpf.APMTraceID)(unsafe.Pointer(&ptr.apm_trace_id)),
 		APMTransactionID: *(*libpf.APMTransactionID)(unsafe.Pointer(&ptr.apm_transaction_id)),
+		APMSpanID:        *(*libpf.APMSpanID)(unsafe.Pointer(&ptr.apm_span_id)),
 		PID:              libpf.PID(ptr.pid),
 		TID:              libpf.PID(ptr.tid),
 		KTime:            times.KTime(ptr.ktime),
@@ -874,6 +875,7 @@ func (t *Tracer) loadBpfTrace(raw []byte) *host.Trace {
 	ptr.apm_runtime_id = [128]C.char{}
 	ptr.apm_trace_id = C.ApmTraceID{}
 	ptr.apm_transaction_id = C.ApmSpanID{}
+	ptr.apm_span_id = C.ApmSpanID{}
 	ptr.ktime = 0
 	trace.Hash = host.TraceHash(xxh3.Hash128(raw).Lo)