3

I would like to filter my ebpf with address in stack, by example if stack trace contain the address of _do_fork then write to map.

I seen this https://www.kernel.org/doc/html/latest/bpf/bpf_design_QA.html#q-can-bpf-programs-access-stack-pointer saying that it isn't possible to get adresses. But I also seen this https://www.spinics.net/lists/netdev/msg497159.html "The bpf program is able to see all stack traces, and then can do in-kernel processing or send stack traces to user space through". So I'm confused. The final question is how we can get adresses of stack trace in-kernel with bpf_get_stack, if it is possible?

thanks in advance

LeChatP
  • 33
  • 5

1 Answers1

2

It is possible to access the stack traces.

The first link you mention (bpf_design_QA) does not refer to the program being traced, it deals with the stack pointer used by the BPF program itself when performing the tracing operation. But as mentioned in the commit log for bpf_get_stack(), you can get access to the stack.

There is some documentation for the BPF helpers, such as bpf_get_stack(), available online. You probably want to have a look at code samples using it too.

I don't have much experience myself with tracing stack, but it seems that very few tools doing so are actually using thie bpf_get_stack() helper. Instead, tools from bcc like profile or from kernel samples like offwaketime (BPF side, user space side) are generally using stack trace maps (BPF_MAP_TYPE_STACK_TRACE), so you may want to have a look at this too (bcc even offers a specific API for them).

Qeole
  • 8,284
  • 1
  • 24
  • 52