Most tools which use bpf_get_stack or bpf_get_stackid symbolicate the stack - meaning the stack of addresses in the target process' address space is transformed into meaningful symbol names. The BPF_F_USER_BUILD_ID flag eases this process by finding the build_id of the file-backed vma which the address falls in and translating the address to an offset within the backing file. To be more specific, the offset is a "file offset" from the beginning of the backing file. The symbols in ET_DYN ELF objects have a st_value which is also described as an "offset" - but an offset in the process address space, relative to the base address of the object. It's necessary to translate between the "file offset" and "virtual address offset" during symbolication before they can be directly compared. Failure to do so can lead to confusing bugs, so this patch clarifies language in the documentation in an attempt to keep this from happening.
Showing the changes to tools/include/uapi/linux (1 of 2 files). Show all
Unified · Split
| @@ -3008,8 +3008,18 @@ union bpf_attr { · 3007 unmodified lines | ||
| 3008 | 3008 | * **BPF_F_USER_STACK** |
| 3009 | 3009 | * Collect a user space stack instead of a kernel stack. |
| 3010 | 3010 | * **BPF_F_USER_BUILD_ID** |
| 3011 | − * Collect buildid+offset instead of ips for user stack, | |
| 3012 | − * only valid if **BPF_F_USER_STACK** is also specified. | |
| 3011 | + * Collect (build_id, file_offset) instead of ips for user | |
| 3012 | + * stack, only valid if **BPF_F_USER_STACK** is also | |
| 3013 | + * specified. | |
| 3014 | + * | |
| 3015 | + * *file_offset* is an offset relative to the beginning | |
| 3016 | + * of the executable or shared object file backing the vma | |
| 3017 | + * which the *ip* falls in. It is *not* an offset relative | |
| 3018 | + * to that object's base address. Accordingly, it must be | |
| 3019 | + * adjusted by adding (sh_addr - sh_offset), where | |
| 3020 | + * sh_{addr,offset} correspond to the executable section | |
| 3021 | + * containing *file_offset* in the object, for comparisons | |
| 3022 | + * to symbols' st_value to be valid. | |
| 3013 | 3023 | * |
| 3014 | 3024 | * **bpf_get_stack**\ () can collect up to |
| 3015 | 3025 | * **PERF_MAX_STACK_DEPTH** both kernel and user frames, subject |