Currently, stackmap and bpf_get_stackid helper are provided for bpf program to get the stack trace. This approach has a limitation though. If two stack traces have the same hash, only one will get stored in the stackmap table, so some stack traces are missing from user perspective.
This patch implements a new helper, bpf_get_stack, will send stack traces directly to bpf program. The bpf program is able to see all stack traces, and then can do in-kernel processing or send stack traces to user space through shared map or bpf_perf_event_output. Patches #1 and #2 implemented the core kernel support. Patch #3 synced the new helper to tools headers. Patches #4 and #5 added a test in samples/bpf by attaching to a kprobe, and Patch #6 added a test in tools/bpf by attaching to a tracepoint. Yonghong Song (6): bpf: change prototype for stack_map_get_build_id_offset bpf: add bpf_get_stack helper tools/bpf: add bpf_get_stack helper to tools headers samples/bpf: move common-purpose perf_event functions to bpf_load.c samples/bpf: add a test for bpf_get_stack helper tools/bpf: add a test case for bpf_get_stack helper include/linux/bpf.h | 1 + include/linux/filter.h | 3 +- include/uapi/linux/bpf.h | 17 ++- kernel/bpf/stackmap.c | 69 ++++++++-- kernel/bpf/syscall.c | 12 +- kernel/bpf/verifier.c | 3 + kernel/trace/bpf_trace.c | 50 +++++++- samples/bpf/Makefile | 4 + samples/bpf/bpf_load.c | 104 +++++++++++++++ samples/bpf/bpf_load.h | 5 + samples/bpf/trace_get_stack_kern.c | 80 ++++++++++++ samples/bpf/trace_get_stack_user.c | 150 ++++++++++++++++++++++ samples/bpf/trace_output_user.c | 113 ++-------------- tools/include/uapi/linux/bpf.h | 17 ++- tools/testing/selftests/bpf/bpf_helpers.h | 2 + tools/testing/selftests/bpf/test_progs.c | 41 +++++- tools/testing/selftests/bpf/test_stacktrace_map.c | 20 ++- 17 files changed, 568 insertions(+), 123 deletions(-) create mode 100644 samples/bpf/trace_get_stack_kern.c create mode 100644 samples/bpf/trace_get_stack_user.c -- 2.9.5