-
-
Notifications
You must be signed in to change notification settings - Fork 84
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
9222c27
commit cc79223
Showing
1 changed file
with
30 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,30 @@ | ||
# tailcall example | ||
|
||
This is an example demonstrating userspace to kernel tailcall. | ||
|
||
## Usage | ||
|
||
``` | ||
make -j$(nproc) | ||
``` | ||
|
||
### Terminal 1 | ||
``` | ||
bpftime load ./tailcall_minimal | ||
``` | ||
|
||
### Terminal 2 | ||
|
||
``` | ||
bpftime start ./victim | ||
``` | ||
|
||
### Behavior | ||
|
||
See `/sys/kernel/debug/tracing/trace_pipe ` and check whether there are lines containing `Invoked!` | ||
|
||
## About this example | ||
|
||
`tailcall_minimal.bpf.c` itself is a uprobe ebpf program. It will be triggered when `./victim:add_func` was invoked, and it will run `bpf_tail_call` to call a kernel ebpf program, whose kernel fd is stored in the prog array. | ||
|
||
`tailcall_minimal.c` is a loader program. It executes the original syscall, loads an ebpf program into kernel (which printf `Invoked!` to trace_pipe), and stores kernel fd into the userspace prog array |