support for BPF_MAP_TYPE_STACK_TRACE

[liyan-ah]

need to get user stack and transfer to user-space code. found none BPF_MAP_TYPE_STACK_TRACE examples. any one has some examples?

[thediveo]

Okay, got it working for me now, so here's an outline of how to use BPF_MAP_TYPE_STACK_TRACE, for the benefit of others coming to this question.

ebpf kernel space

Define a map of type BPF_MAP_TYPE_STACK_TRACE, with the key being a u32 we later get from bpf_get_stackid(), and the value being a fixed-size array of u64 (the instruction pointers, or "ips"):

typedef u64 stack[100];

struct {
    __uint(type, BPF_MAP_TYPE_STACK_TRACE);
    __type(key, u32);
    __type(value, stack);
    __uint(max_entries, 1 << 14);
} stacks SEC(".maps");

You'll probably want to have some BPF_MAP_TYPE_RINGBUF for sending events to user space with some event-specific data and including a u32 as the stack ID/key into the stacks map.

To collect a stack backtrace, simply call u32 stackid = bpf_get_stackid(ctx, &stacks, 0); and send the stack ID over to user space.

user space

Say, in user space you got a var event bpfEvent including the Stackid from bpf_get_stackid. To fetch the fixed-size array of instruction pointers representing the stack trace:

ips := make([]uint64, 100)
err := objs.Stacks.Lookup(event.Stackid, ips)

If there was no error, then ips will contain the stack trace addresses, starting with index 0. The "unused" part up to the total length (of 100 in this example) is zeroed, so you'll need to stop there.