[RFC PATCH v2 06/11] ptwrite uprobes: Add basic memory references
From: Andi Kleen
Date: Thu Sep 17 2026 - 20:31:01 EST
Add support for memory references. Currently this is only
simple cases, no indirect memory references or strings,
that would require saving/restoring registers. Only 8 and 4 byte
memory references are supported.
This doesn't have any fault handling yet, so a bad reference
in the probe could result in crashing the application.
It increases the kernel memory overhead of each probe to roughly
1 KB.
Assisted-by: omp:gpt-5.6-luna
Signed-off-by: Andi Kleen <ak@xxxxxxxxxx>
---
Documentation/trace/uprobetracer.rst | 7 ++
arch/x86/include/asm/uprobes.h | 2 +-
arch/x86/kernel/uprobes.c | 90 +++++++++++++++++---
include/linux/uprobes.h | 4 +-
samples/uprobe-ptwrite/uprobe_ptwrite_test.c | 40 ++++++++-
5 files changed, 128 insertions(+), 15 deletions(-)
diff --git a/Documentation/trace/uprobetracer.rst b/Documentation/trace/uprobetracer.rst
index 56d951d1fa5b..5d891a96c4fe 100644
--- a/Documentation/trace/uprobetracer.rst
+++ b/Documentation/trace/uprobetracer.rst
@@ -94,6 +94,13 @@ Requirements and restrictions:
- The probe site must be a 5-byte NOP or a punnable instruction (see
ptwrite-uprobes.rst). For five ``0x90`` bytes from GCC's
``-fpatchable-function-entry=5``, append ``%multinop`` to the offset.
+- FETCHARGS: register names (``%di``, ``%r8``, ...), ``$stack`` (the
+ stack pointer value), immediates (``\IMM``), and memory sources:
+ ``$stackN`` (the Nth stack slot, ``[%rsp + 8N]``) and ``+off(FETCHARG)``
+ dereferences (for example, ``+8(%di)`` = ``[%rdi + 8]``). ``u64`` sources
+ use ``ptwriteq``; ``u32``/``s32``/``x32`` sources use ``ptwritel`` and read
+ four bytes. Strings, bitfields, and indirect dereferences are not supported.
+- Memory accesses can fault.
- The event does not produce ring-buffer records. It provides a type registry
(``events/GRP/EVENT/format``) and the wire ``event_id``
(``events/GRP/EVENT/id``) for an external decoder. Filters and perf
diff --git a/arch/x86/include/asm/uprobes.h b/arch/x86/include/asm/uprobes.h
index b51907c1d465..e5a668ba5ad6 100644
--- a/arch/x86/include/asm/uprobes.h
+++ b/arch/x86/include/asm/uprobes.h
@@ -45,7 +45,7 @@ struct uprobe_xol_ops;
*/
struct uprobe_ptwrite_arch {
u8 stub[UPROBE_PTWRITE_STUB_SIZE];
- u16 stub_len; /* code + data + fault table, whole block */
+ u16 stub_len; /* code + data, whole block */
u8 jmp_off; /* offset of the final jmp's rel32 field */
u8 ndata; /* number of u64 data slots */
u8 orig[MAX_UINSN_BYTES]; /* pristine file bytes, before generic analysis */
diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
index 7fcdc4bf5197..0029b66cd64e 100644
--- a/arch/x86/kernel/uprobes.c
+++ b/arch/x86/kernel/uprobes.c
@@ -1365,7 +1365,10 @@ static const struct {
{ .off = offsetof(struct pt_regs, r15), .idx = 15 },
};
-/* Compile the register, stack-pointer, and immediate fetch forms. */
+/*
+ * Compile one tracefs fetch arg (arch-neutral form, see
+ * uprobe_ptwrite_fetch) into a ptwrite descriptor entry.
+ */
int arch_uprobe_ptwrite_fetch(struct uprobe_ptwrite_arg *a,
const struct uprobe_ptwrite_fetch *f)
{
@@ -1373,6 +1376,7 @@ int arch_uprobe_ptwrite_fetch(struct uprobe_ptwrite_arg *a,
switch (f->kind) {
case UPROBE_PTW_FETCH_REG:
+ case UPROBE_PTW_FETCH_MEMREG:
for (i = 0; i < ARRAY_SIZE(ptwrite_reg_map); i++) {
if (ptwrite_reg_map[i].off == f->reg) {
idx = ptwrite_reg_map[i].idx;
@@ -1380,15 +1384,23 @@ int arch_uprobe_ptwrite_fetch(struct uprobe_ptwrite_arg *a,
}
}
if (idx < 0)
- return -EINVAL;
- a->src = UPROBE_PTW_SRC_REG;
+ return -EINVAL; /* not an x86-64 GPR */
+ a->src = f->kind == UPROBE_PTW_FETCH_REG ?
+ UPROBE_PTW_SRC_REG : UPROBE_PTW_SRC_MEM;
a->reg = idx;
+ if (f->kind == UPROBE_PTW_FETCH_MEMREG)
+ a->val = (u64)(s32)f->imm;
break;
- case UPROBE_PTW_FETCH_STACKP:
+ case UPROBE_PTW_FETCH_STACKP: /* $stack: SP value, never faults */
a->src = UPROBE_PTW_SRC_REG;
a->reg = 4; /* rsp */
break;
- case UPROBE_PTW_FETCH_IMM:
+ case UPROBE_PTW_FETCH_STACKN: /* [rsp + imm] */
+ a->src = UPROBE_PTW_SRC_MEM;
+ a->reg = 4; /* rsp */
+ a->val = f->imm;
+ break;
+ case UPROBE_PTW_FETCH_IMM: /* \IMM */
a->src = UPROBE_PTW_SRC_IMM;
a->val = f->imm;
break;
@@ -1398,6 +1410,26 @@ int arch_uprobe_ptwrite_fetch(struct uprobe_ptwrite_arg *a,
return 0;
}
+/*
+ * Worst-case stub block: header ptwriteq (9) + max memory args (10 bytes
+ * each, including a SIB byte) + final jmp (5), rounded up; data adds one
+ * header slot and one slot per immediate. Keep the bound below the stub size.
+ */
+static_assert((((9 + UPROBE_PTWRITE_MAX_ARGS * 10 + 5 + 7) & ~7) +
+ 8 * (1 + UPROBE_PTWRITE_MAX_ARGS)) <= UPROBE_PTWRITE_STUB_SIZE,
+ "worst-case ptwrite stub block exceeds UPROBE_PTWRITE_STUB_SIZE");
+
+static bool ptwrite_has_room(const u8 *base, const u8 *p, size_t len)
+{
+ return p >= base && (size_t)(p - base) <=
+ sizeof(((struct uprobe_ptwrite_arch *)0)->stub) - len;
+}
+
+#define PTW_NEED(_len) do { \
+ if (!ptwrite_has_room(code, p, (_len))) \
+ return -E2BIG; \
+ } while (0)
+
int arch_uprobe_ptwrite_prepare(struct arch_uprobe *auprobe,
const struct uprobe_ptwrite_desc *desc)
{
@@ -1414,7 +1446,7 @@ int arch_uprobe_ptwrite_prepare(struct arch_uprobe *auprobe,
return -EINVAL;
if (desc->nargs > UPROBE_PTWRITE_MAX_ARGS)
return -E2BIG;
- if (desc->flags)
+ if (desc->flags & ~UPROBE_PTWRITE_FL_ALLOW_MEM)
return -EINVAL;
/* The generic registration path copied these bytes before this hook. */
@@ -1431,24 +1463,62 @@ int arch_uprobe_ptwrite_prepare(struct arch_uprobe *auprobe,
return -E2BIG;
n_imm++;
break;
+ case UPROBE_PTW_SRC_MEM:
+ if (!(desc->flags & UPROBE_PTWRITE_FL_ALLOW_MEM))
+ return -EINVAL;
+ if (desc->args[i].reg > 15)
+ return -EINVAL;
+ if (desc->args[i].size != 4 &&
+ desc->args[i].size != 8)
+ return -EINVAL;
+ break;
default:
return -EINVAL;
}
}
/* header word emission (disp32 patched below) */
+ PTW_NEED(9);
p += ptwrite_emit_riprel(p, 0);
for (i = 0; i < desc->nargs; i++) {
- if (desc->args[i].src == UPROBE_PTW_SRC_REG) {
+ switch (desc->args[i].src) {
+ case UPROBE_PTW_SRC_REG:
+ PTW_NEED(5);
p += ptwrite_emit_reg(p, desc->args[i].reg);
- } else {
+ break;
+ case UPROBE_PTW_SRC_IMM:
+ if (imm_idx >= ARRAY_SIZE(imm_off))
+ return -E2BIG;
+ PTW_NEED(9);
imm_off[imm_idx++] = p - code;
p += ptwrite_emit_riprel(p, 0);
+ break;
+ case UPROBE_PTW_SRC_MEM: {
+ u8 reg = desc->args[i].reg;
+ bool wide = desc->args[i].size == 8;
+ unsigned int arg_len = (wide ? 9 : 8) +
+ ((reg & 7) == 4) + (!wide && (reg & 8));
+
+ PTW_NEED(arg_len);
+ *p++ = 0xf3;
+ if (wide)
+ *p++ = (reg & 8) ? 0x49 : 0x48; /* REX.W */
+ else if (reg & 8)
+ *p++ = 0x41; /* REX.B only (32-bit operand) */
+ *p++ = 0x0f;
+ *p++ = 0xae;
+ *p++ = 0xa0 | (reg & 7); /* mod 10, reg /4, rm reg */
+ if ((reg & 7) == 4) /* SIB escape: base rsp/esp/r12 */
+ *p++ = 0x24;
+ p += 4;
+ break;
+ }
}
}
/* final jmp back to probe+5; rel32 patched per-mm at install */
+ PTW_NEED(5);
*p++ = 0xe9;
if (p - code > U8_MAX)
return -E2BIG;
@@ -1460,7 +1530,8 @@ int arch_uprobe_ptwrite_prepare(struct arch_uprobe *auprobe,
return -E2BIG;
/* data slots: header, then imm values in emission order */
- hdr = ((u64)desc->event_id << 48) | ((u64)desc->nargs << 40);
+ hdr = ((u64)desc->event_id << 48) | ((u64)desc->nargs << 40) |
+ UPROBE_PTW_HDR_MAGIC;
*(u64 *)(code + data_off) = hdr;
/* patch the header's disp32: hdr slot - end of header insn */
@@ -1755,7 +1826,6 @@ int arch_uprobe_uninstall_ptwrite(struct arch_uprobe *auprobe,
UPROBE_SWBP_INSN, false, false, false, false, NULL);
}
-
static bool __is_optimized(struct mm_struct *mm, uprobe_opcode_t *insn, unsigned long vaddr)
{
struct __packed __arch_relative_insn {
diff --git a/include/linux/uprobes.h b/include/linux/uprobes.h
index 6fa70f3f648c..f6ffb0637991 100644
--- a/include/linux/uprobes.h
+++ b/include/linux/uprobes.h
@@ -213,10 +213,10 @@ enum uprobe_ptwrite_src {
struct uprobe_ptwrite_arg {
u8 src; /* enum uprobe_ptwrite_src */
- u8 reg; /* x86-64 GPR index (0=rax..15=r15) for SRC_REG */
+ u8 reg; /* x86-64 GPR index (0=rax..15=r15) for SRC_REG/SRC_MEM */
u8 size; /* declared type size 1/2/4/8 (decoder hint) */
u8 reserved;
- u64 val; /* SRC_IMM: constant; SRC_REG: unused */
+ u64 val; /* SRC_IMM: constant, SRC_MEM: disp32 (low 32 bits) */
};
struct uprobe_ptwrite_desc {
diff --git a/samples/uprobe-ptwrite/uprobe_ptwrite_test.c b/samples/uprobe-ptwrite/uprobe_ptwrite_test.c
index 94d01bf18faa..55e23ff27dd5 100644
--- a/samples/uprobe-ptwrite/uprobe_ptwrite_test.c
+++ b/samples/uprobe-ptwrite/uprobe_ptwrite_test.c
@@ -11,9 +11,11 @@
* Usage (module params):
* path=/path/to/prog file to probe
* offset=0xADDR file offset of the probe site
- * args="r0,r1,i0x42" comma-separated;
+ * args="r0,r1,i0x42,m3,m2:0x8,m4:0x10:4" comma-separated;
* r<N> = x86-64 GPR index 0..15,
* i<hex> = immediate constant,
+ * m<N>[:<disp>][:<size>] = memory arg [reg + disp32],
+ * size 4 (u32 load) or 8 (u64 load, default)
* event_id=0x1234 identifier carried in the PTW header word
*/
#include <linux/module.h>
@@ -81,7 +83,41 @@ static int parse_probe_args(void)
}
a->src = UPROBE_PTW_SRC_IMM;
a->val = v;
-
+ } else if (tok[0] == 'm') {
+ /*
+ * m<R>[:<disp>][:<size>]: memory arg [reg + disp32],
+ * size 4 (u32 load) or 8 (u64 load, default)
+ */
+ char *colon = strchr(tok, ':');
+ char *szs = NULL;
+ unsigned long reg;
+ long long disp = 0;
+ unsigned long size = 8;
+
+ if (colon) {
+ *colon = '\0';
+ szs = strchr(colon + 1, ':');
+ if (szs)
+ *szs++ = '\0';
+ }
+ if (kstrtoul(tok + 1, 10, ®) || reg > 15) {
+ pr_err("bad mem reg '%s'\n", tok);
+ goto err;
+ }
+ if (colon && kstrtoll(colon + 1, 0, &disp)) {
+ pr_err("bad mem disp '%s'\n", colon + 1);
+ goto err;
+ }
+ if (szs && (kstrtoul(szs, 10, &size) ||
+ (size != 4 && size != 8))) {
+ pr_err("bad mem size '%s'\n", szs);
+ goto err;
+ }
+ a->src = UPROBE_PTW_SRC_MEM;
+ a->reg = reg;
+ a->val = (u64)(s32)disp;
+ a->size = size;
+ desc.flags |= UPROBE_PTWRITE_FL_ALLOW_MEM;
} else {
pr_err("bad arg '%s'\n", tok);
goto err;
--
2.54.0