eunomia-bpf / bpftime

Userspace eBPF runtime for fast Uprobe & Syscall hook & Extensions
https://eunomia.dev/bpftime/
MIT License
741 stars 73 forks source link

[FEATURE] Support kernel helper 'bpf_get_stackid' #140

Open Mr-dot-lu opened 7 months ago

Mr-dot-lu commented 7 months ago

In some AI and big data scenarios, to improve memory application performance, some software takes over memory management instead of using the memory application interface provided by the OS. Whether bpf-time can support the bpf_get_stackid helper to obtain application software stacks to support memory profiling in the preceding scenarios.

struct { uint(type, BPF_MAP_TYPE_STACK_TRACE); uint(key_size, sizeof(u32)); uint(value_size, PERF_MAX_STACK_DEPTH * sizeof(u64)); uint(max_entries, MAX_PERCPU_SAMPLE_COUNT); } stackmap SEC(".maps");

bpf_section("tracepoint/[application-malloc]") { int user_stack_id = bpf_get_stackid(ctx, &stackmap, USER_STACKID_FLAGS);

// insert 'user_stack_id' to 'buf', and output to ebpf userspace

bpf_perf_event_output(ctx, map, BPF_F_CURRENT_CPU, buf, size);

}

Officeyutong commented 7 months ago

It seems possible to be achived through gumbacktrace provided by frida https://github.com/frida/frida-gum/blob/main/gum/gumbacktracer.h