Skip to content

Helper function bpf_get_task_stack

v5.9

Definition

Copyright (c) 2015 The Libbpf Authors. All rights reserved.

Return a user or a kernel stack in bpf program provided buffer. Note: the user stack will only be populated if the task is the current task; all other tasks will return -EOPNOTSUPP. To achieve this, the helper needs task, which is a valid pointer to struct task_struct. To store the stacktrace, the bpf program provides buf with a nonnegative size.

The last argument, flags, holds the number of stack frames to skip (from 0 to 255), masked with BPF_F_SKIP_FIELD_MASK. The next bits can be used to set the following flags:

BPF_F_USER_STACK

    Collect a user space stack instead of a kernel stack. The task must be the current task.

BPF_F_USER_BUILD_ID

    Collect buildid+offset instead of ips for user stack, only valid if BPF_F_USER_STACK is also specified.

bpf_get_task_stack() can collect up to PERF_MAX_STACK_DEPTH both kernel and user frames, subject to sufficient large buffer size. Note that this limit can be controlled with the sysctl program, and that it should be manually increased in order to profile long user stacks (such as stacks for Java programs). To do so, use:

# sysctl kernel.perf_event_max_stack=<new value>

Returns

The non-negative copied buf length equal to or less than size on success, or a negative error in case of failure.

static long (* const bpf_get_task_stack)(struct task_struct *task, void *buf, __u32 size, __u64 flags) = (void *) 141;

Usage

Docs could be improved

This part of the docs is incomplete, contributions are very welcome

Program types

This helper call can be used in the following program types:

Example

Docs could be improved

This part of the docs is incomplete, contributions are very welcome