eBPF User Stack Trace Issue and Solutions
summary
Two concrete solutions address bpf inability to unwind user stacks without frame pointers: PR #4463 captures user registers and part of the user stack in the BPF program and performs DWARF unwinding via libunwind in user space, giving accurate traces but adding memory and CPU overhead; PR #4679 implements a stack-scan that collects any text addresses found on the user stack, producing heuristic traces that work on binaries without unwind info but include false positives; both integrate with BCC, one fixes missing C++ new operator frames, and kernel support (post-6.1) affects deployment.
AI-written summary · about
chapters (8)
- 0:00eBPF user stack trace issues
- 1:06Motivation and background
- 2:53Stack frames and unwinding
- 5:00eBPF tools architecture issue
- 7:30Solution for no unwind tables
- 10:53Solution for no unwind info
- 16:07Implementation details
- 17:44Q&A
related talks
23mOverflowing the kernel stack with BPF
32mDeveloping eBPF profiler for polyglot cloud-native appli...
42mKernel Analysis Using eBPF
25mAn introduction to bpftrace tracing language
34mWhat's new in the BPF world?
25mKernel tracing with BPF
28mbpftrace: what is it, what's new, and where is it going
46mbpftrace internals