Struct StackTraceMap 

pub struct StackTraceMap<T> { /* private fields */ }

A hash map of kernel or user space stack traces.

Stack trace maps can be used to store stack traces captured by eBPF programs, which can be useful for profiling, to associate a trace to an event, etc. You can capture traces calling stack_id = bpf_get_stackid(ctx, map, flags) from eBPF, and then you can retrieve the traces from their stack ids.

Minimum kernel version

The minimum kernel version required to use this feature is 4.6.

Examples

use aya::maps::StackTraceMap;
use aya::util::kernel_symbols;

let mut stack_traces = StackTraceMap::try_from(bpf.map("STACK_TRACES").unwrap())?;
// load kernel symbols from /proc/kallsyms
let ksyms = kernel_symbols()?;

// NOTE: you typically send stack_ids from eBPF to user space using other maps
let stack_id = 1234;
let mut stack_trace = stack_traces.get(&stack_id, 0)?;

// here we resolve symbol names using kernel symbols. If this was a user space stack (for
// example captured from a uprobe), you'd have to load the symbols using some other mechanism
// (eg loading the target binary debuginfo)
for frame in stack_trace.frames() {
    if let Some(sym) = ksyms.range(..=frame.ip).next_back().map(|(_, s)| s) {
        println!(
            "{:#x} {}",
            frame.ip,
            sym
        );
    } else {
        println!(
            "{:#x}",
            frame.ip
        );
    }
}

Implementations

impl<T: Borrow<MapData>> StackTraceMap<T>

pub fn get(&self, stack_id: &u32, flags: u64) -> Result<StackTrace, MapError>

Returns the stack trace with the given stack_id.

Errors

Returns MapError::KeyNotFound if there is no stack trace with the given stack_id, or MapError::SyscallError if bpf_map_lookup_elem fails.

pub fn iter(&self) -> MapIter<'_, u32, StackTrace, Self>

An iterator visiting all (stack_id, stack_trace) pairs in arbitrary order. The iterator item type is Result<(u32, StackTrace), MapError>.

pub fn stack_ids(&self) -> MapKeys<'_, u32>

An iterator visiting all the stack_ids in arbitrary order. The iterator element type is Result<u32, MapError>.

impl<T: BorrowMut<MapData>> StackTraceMap<T>

pub fn remove(&mut self, stack_id: &u32) -> Result<(), MapError>

Removes the stack trace with the given stack_id.

impl<T: Borrow<MapData>> StackTraceMap<T>

pub fn pin<P: AsRef<Path>>(self, path: P) -> Result<(), PinError>

Pins the map to a BPF filesystem.

When a map is pinned it will remain loaded until the corresponding file is deleted. All parent directories in the given path must already exist.

Trait Implementations

impl<T: Debug> Debug for StackTraceMap<T>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'a, T: Borrow<MapData>> IntoIterator for &'a StackTraceMap<T>

type Item = Result<(u32, StackTrace), MapError>

The type of the elements being iterated over.

type IntoIter = MapIter<'a, u32, StackTrace, StackTraceMap<T>>

Which kind of iterator are we turning this into?

fn into_iter(self) -> Self::IntoIter

Creates an iterator from a value.

impl<T: Borrow<MapData>> IterableMap<u32, StackTrace> for StackTraceMap<T>

fn map(&self) -> &MapData

Get a generic map handle

fn get(&self, key: &u32) -> Result<StackTrace, MapError>

Get the value for the provided key

impl<'a> TryFrom<&'a Map> for StackTraceMap<&'a MapData>

type Error = MapError

The type returned in the event of a conversion error.

fn try_from(map: &'a Map) -> Result<Self, Self::Error>

Performs the conversion.

impl<'a> TryFrom<&'a mut Map> for StackTraceMap<&'a mut MapData>

type Error = MapError

The type returned in the event of a conversion error.

fn try_from(map: &'a mut Map) -> Result<Self, Self::Error>

Performs the conversion.

impl TryFrom<Map> for StackTraceMap<MapData>

type Error = MapError

The type returned in the event of a conversion error.

fn try_from(map: Map) -> Result<Self, Self::Error>

Performs the conversion.