Reputation: 1
I want to modify the third parameter of the below kernel function using bpftool.
int pcie_capability_read_word(struct pci_dev *dev, int pos, u16 *val);
I want to know if that is possible?
I know about bpf_override_return()
which can change the return values for some whitelisted functions but can we use bpf_probe_write_user()
to modify the parameters for the functions?
I tried writing this bpf program for the above use-case but I'm not sure if it would solve the purpose.
#define __TARGET_ARCH_x86
#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>
#include <linux/ptrace.h>
#include <linux/pci_regs.h>
typedef unsigned short u16;
SEC("kprobe/pcie_capability_read_word")
int inject_error(struct pt_regs *ctx) {
u16 *linkstat;
int pos;
linkstat = (u16 *)PT_REGS_PARM3(ctx);
pos = (int)PT_REGS_PARM2(ctx);
if (pos == PCI_EXP_LNKSTA) {
u16 custom_linkstat = 0x0001;
bpf_probe_write_kernel(linkstat, &custom_linkstat, sizeof(u16));
}
return 0;
}
Upvotes: 0
Views: 37