LWN: Comments on "Uprobes in 3.5"

Uprobes in 3.5

uronce — Sun, 19 May 2019 09:37:26 +0000

The breakpoint instruction in x86 is 0xcc: https://elixir.bootlin.com/linux/latest/source/arch/x86/i...,
while in ARM is: https://elixir.bootlin.com/linux/latest/source/arch/arm/i....

Uprobes in 3.5

uronce — Sun, 19 May 2019 09:31:01 +0000

Setting a uprobe for a binary does not modify the on-disk binary file directly.
It sets the probe for (inode, offset) in a kernel internal data structure, inode is the inode for the binary file, offset is the instruction offset in the binary file.
Since the binary is memory mapped for execution, when the probed instruction is accessed through mmap, https://elixir.bootlin.com/linux/latest/source/kernel/eve... will replace the original instruction with "0xcc" (int3).
So if a uprobe is set for binary /tmp/test, then mv /tmp/test /home/test, then run /home/test, the probe still works, because the inode does not change after mv.

Uprobes in 3.5

andreoli — Wed, 12 Dec 2012 09:49:19 +0000

Hi,

you might want to try out fulltrace, available at the following address:
https://github.com/andreoli/fulltrace

Fulltrace is a complete program, library and kernel tracer. Given a command, it dynamically finds all functions invoked by it, by any library it uses and by the kernel. It only requires a recent Linux kernel (>=3.5) compiled with ftrace and uprobes support. Note: this is still very experimental (consider it "proof-of-concept" code) and needs a lot of work.
Any suggestion is more than welcome.

Uprobes in 3.5

slashdot — Sat, 09 Jun 2012 22:54:42 +0000

Isn't using perf_paranoid for this a disastrous choice?

AFAICT uprobe insertion is equivalent to root, since you can modify bytes in the middle of instructions, and thus alter the behavior of any process.

On the other hand, currently perf_paranoid only gives access to PMU, which can normally only be use to DoS the system at worst.

Uprobes in 3.5

fuhchee — Tue, 05 Jun 2012 13:45:58 +0000

"it has been simplified, made more robust, and integrated into the existing events infrastructure"

While the last of those is definitely true, the first may just be due to equivalent functionality being deferred, and the second is way too early to say.

Uprobes in 3.5

razb — Sun, 03 Jun 2012 20:11:58 +0000

I think it would be nice to have a tui/gui for this tool. it would be difficult to set a trace to the regular user.