Skip to content

Instantly share code, notes, and snippets.

@grantseltzer
Created October 6, 2020 15:21
Show Gist options
  • Save grantseltzer/f4524e148135c84091dccd0952d79945 to your computer and use it in GitHub Desktop.
Save grantseltzer/f4524e148135c84091dccd0952d79945 to your computer and use it in GitHub Desktop.
Using Go BCC for instrumenting tail calls
package main
import (
"io/ioutil"
"log"
"time"
"github.com/iovisor/gobpf/bcc"
)
func main() {
content, err := ioutil.ReadFile("./program.c")
if err != nil {
log.Fatal(err)
}
mod := bcc.NewModule(string(content), nil)
sfd, err := mod.LoadKprobe("tail_call")
if err != nil {
log.Fatal(err)
}
progTable := bcc.NewTable(mod.TableId("prog_array"), mod)
progTable.Set([]byte{2}, []byte{byte(sfd)})
dfd, err := mod.LoadKprobe("do_tail_call")
if err != nil {
log.Fatal(err)
}
err = mod.AttachKprobe("__x64_sys_getcwd", dfd, 2)
if err != nil {
log.Fatal(err)
}
time.Sleep(time.Minute)
}
#include <uapi/linux/ptrace.h>
#include <net/sock.h>
#include <bcc/proto.h>
#include <linux/bpf.h>
#include <linux/kernel.h>
#include <uapi/linux/bpf.h>
BPF_PROG_ARRAY(prog_array, 10);
int tail_call(void *ctx) {
bpf_trace_printk("tail-call\n");
return 0;
}
int do_tail_call(void *ctx) {
bpf_trace_printk("Original program\n");
prog_array.call(ctx, 1);
return 0;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment