3

I am reading about kprobes BPF program type, and am wondering if it is possible to not just intercept a function call for tracing purposes or collect some low-level information (registers, stack etc.), but substitute a call and execute instead of the actual function?

Does kprobe provide this capability or I'm looking at the wrong tool?

1
  • You could also take a look at Ftrace and how it is used in Livepatch to replace the kernel functions.
    – Eugene
    Mar 17, 2018 at 14:29

1 Answer 1

6

No, kprobes BPF programs have only read access to the syscall parameters and return value, they cannot modify registers and therefore cannot intercept function calls. This is a limitation imposed by the BPF verifier.

Kernel modules, however, can intercept function calls using kprobes.

4
  • thanks for feedback! So I guess kernel.org/doc/Documentation/kprobes.txt is the starting point.
    – Mark
    Mar 16, 2018 at 13:09
  • 3
    Yep. You might be interested in this StackOverflow answer too.
    – pchaigno
    Mar 16, 2018 at 14:00
  • 1
    Well, yes, one could change IP register in a kprobe's pre-handler to redirect execution to your function instead of the original one, However, I would also take a look at Ftrace, which can also be used to substitute the functions. Perhaps, this could be easier to use, but that is a matter of taste. In fact, live patching already does this with Ftrace.
    – Eugene
    Mar 17, 2018 at 14:27
  • This is inaccurate today. “uprobes” feature in eBPF doesn’t exactly that.
    – shadyabhi
    Jul 10, 2021 at 7:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.