Skip to content

Helper function bpf_get_stack



Copyright (c) 2015 The Libbpf Authors. All rights reserved.

Return a user or a kernel stack in bpf program provided buffer. To achieve this, the helper needs ctx, which is a pointer to the context on which the tracing program is executed. To store the stacktrace, the bpf program provides buf with a nonnegative size.

The last argument, flags, holds the number of stack frames to skip (from 0 to 255), masked with BPF_F_SKIP_FIELD_MASK. The next bits can be used to set the following flags:


    Collect a user space stack instead of a kernel stack.


    Collect (build_id, file_offset) instead of ips for user stack, only valid if BPF_F_USER_STACK is also specified.

    file_offset is an offset relative to the beginning of the executable or shared object file backing the vma which the ip falls in. It is not an offset relative to that object's base address. Accordingly, it must be adjusted by adding (sh_addr - sh_offset), where sh_{addr,offset} correspond to the executable section containing file_offset in the object, for comparisons to symbols' st_value to be valid.

bpf_get_stack() can collect up to PERF_MAX_STACK_DEPTH both kernel and user frames, subject to sufficient large buffer size. Note that this limit can be controlled with the sysctl program, and that it should be manually increased in order to profile long user stacks (such as stacks for Java programs). To do so, use:

# sysctl kernel.perf_event_max_stack=<new value>


The non-negative copied buf length equal to or less than size on success, or a negative error in case of failure.

static long (* const bpf_get_stack)(void *ctx, void *buf, __u32 size, __u64 flags) = (void *) 67;


Docs could be improved

This part of the docs is incomplete, contributions are very welcome

Program types

This helper call can be used in the following program types:


Docs could be improved

This part of the docs is incomplete, contributions are very welcome