Show HN: xstack – Passive eBPF Linux stack profiling without tracepoints

Here's the latest eBPF performance tool of mine - xstack. It's a minimal tool, just 165 lines of eBPF C and under 500 lines of userland C code (including all comments and boilerplate!). It uses the libbpf and (Rust) BlazeSym libraries though (which are a lot of code).

The point (and difference) of this tool is that it can sample both the kernel and userspace stack traces of all threads in your system.

Traditionally, the "bpf_get_stack()" helper can not read userspace stack traces of other tasks in Linux, but since Linux 5.18 we can combine sleepable eBPF task iterator programs with a new "bpf_copy_from_user_task()" helper to read whatever we want from the userspace memory of any other process.

That includes stack areas - so currently whenever the target executable was compiled with frame pointers enabled, you can easily do passive-sampling stack profiling - without slowing the other processes down - at all!

Despite the Linux kernel 5.18 requirement, it actually works on RHEL 9.5+ (and clones) too. RedHat apparently ported the entire eBPF 6.8 subsystem to their RHEL 9.5+ 5.14 kernels. Feedback and testing results appreciated.