Can I use eBPF to replace a kernel function?
Can I use eBPF to reimplement a kernel function and jump to the reimplemented function when the original function is called, skipping t开发者_如何学Che original function altogether?
For example, there is a kernel function A:
void A()
{
xxx;
}
Can I use eBPF to reimplement function A as ebpf_A, so that when function A is called, ebpf_A is executed instead of A? So I can do some other things in ebpf_A.
If I can, how can I do it?
精彩评论