Re: [PATCH bpf-next v6 1/2] bpf: extend stackmap to save binary_build_id+offset instead of address

[Daniel Borkmann <daniel@iogearbox.net>]

On 03/14/2018 06:36 PM, Song Liu wrote:
>> On Mar 14, 2018, at 10:23 AM, Song Liu <songliubraving@fb.com> wrote:
>>
>> Currently, bpf stackmap store address for each entry in the call trace.
>> To map these addresses to user space files, it is necessary to maintain
>> the mapping from these virtual address to symbols in the binary. Usually,
>> the user space profiler (such as perf) has to scan /proc/pid/maps at the
>> beginning of profiling, and monitor mmap2() calls afterwards. Given the
>> cost of maintaining the address map, this solution is not practical for
>> system wide profiling that is always on.
>>
>> This patch tries to solve this problem with a variation of stackmap. This
>> variation is enabled by flag BPF_F_STACK_BUILD_ID. Instead of storing
>> addresses, the variation stores ELF file build_id + offset.
>>
>> Build_id is
>> only meaningful for user stack. If a kernel stack is added to a stackmap
>> with BPF_F_STACK_BUILD_ID, it will automatically fallback to only store
>> ip (status == BPF_STACK_BUILD_ID_IP).
> 
> I forgot to delete the paragraph above. Please let me know if I should 
> resend (or it can be removed when you apply it).

We can fix it up when applying, no problem.

Thanks,
Daniel