From: "Markus Ongyerth" <bpf@ongy.net>
To: "Alexei Starovoitov" <alexei.starovoitov@gmail.com>
Cc: bpf <bpf@vger.kernel.org>
Subject: Re: HELP: bpf_probe_user_write for registers
Date: Mon, 30 Nov 2020 05:33:27 +0100 [thread overview]
Message-ID: <3bb48133-2853-41fd-9bc4-8ea7c6d5bd5b@www.fastmail.com> (raw)
In-Reply-To: <CAADnVQ+2DiSH42cSjQ2fNEEc217c6C+SPEqSEzBJb22aZdm3kA@mail.gmail.com>
On Sun, Nov 29, 2020, at 23:22, Alexei Starovoitov wrote:
> On Sun, Nov 29, 2020 at 10:38 AM Markus Ongyerth <bpf@ongy.net> wrote:
> >
> > Hi,
> >
> > I've been looking into introspecting and possibly convincing an application to behave slightly different with bpf measures.
> >
> > I found `bpf_probe_user_write` but as far as I can tell, that only works for memory areas.
> > Is there an alternative that can be used on registers as well?
>
> fyi bpf_probe_write_user() warns in dmesg.
I've seen the note about that. I don't really mind, since it's not spammy but once when the code is loaded.
> That was done on purpose to avoid usage of this helper in production code.
> A new helper can be added to adjust user regs, but it will have similar warning.
> It's better to discuss the use case first.
> Do you envision user regs to be changed after uprobe in an arbitrary location
> or in some fixed place and only particular regs?
My current usecase needs to be able to set PT_REGS_PARM2 and PT_REG_PARM4 I think in specific function entry uprobes to modify an argument usually passed in a register by ABI.
And that's what I'd use for playing around with things in general I think. Arbitrary registers at arbitrary points sounds like fund but also way more dangerous.
next prev parent reply other threads:[~2020-11-30 4:37 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-11-29 18:34 HELP: bpf_probe_user_write for registers Markus Ongyerth
2020-11-29 22:22 ` Alexei Starovoitov
2020-11-30 4:33 ` Markus Ongyerth [this message]
2020-12-01 2:27 ` Alexei Starovoitov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3bb48133-2853-41fd-9bc4-8ea7c6d5bd5b@www.fastmail.com \
--to=bpf@ongy.net \
--cc=alexei.starovoitov@gmail.com \
--cc=bpf@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).