ftrace_modify_call(9)

πŸ“¦ version 7.3.1, in nixpkgs unstable

πŸ’… ftrace_modify_call β€” Kernel API Manual (yes bestie, we're in the kernel now)

okay so real talk, this page is ftrace_modify_call(9) from the Kernel API Manual, and it's giving "surgery on a live function call" energy. buckle up πŸŽ€


✨ NAME ✨

ftrace_modify_call β€” convert from one addr to another (no nop)

like, we're literally swapping out one call target for a different one. no nop shenanigans here, we're going straight from addr to addr πŸ¦‹


🌸 SYNOPSIS 🌸

int ftrace_modify_call (struct dyn_ftrace *rec , unsigned long old_addr
, unsigned long addr );

three args, one int coming back at you. periodt.


🫢 ARGUMENTS 🫢

  • rec β€” the call site record (e.g. mcount/fentry). this is, like, the main character of the whole operation πŸ’…
  • old_addr β€” the address that's expected to be currently called to. key word: expected πŸ‘€
  • addr β€” the address to change to. this is where we're headed, bestie ✨

πŸ”₯ DESCRIPTION πŸ”₯

okay so listen. this is a very sensitive operation and great care needs to be taken by the arch. the arch has to do this properly, no cap. 😭

here's the whole ritual: the operation should carefully read the location, then check to see if what is read is indeed what we expect it to be, and then β€” only on success of the compare β€” it should write to the location. read, compare, then write. in that order. don't skip steps, i'm begging πŸ™ˆ

when using call ops, this gets called when the associated ops change β€” even when (addr == old_addr). yeah, even then. it still runs. iconic behavior honestly πŸ’€

also: the code segment at rec->ip should be a caller to old_addr. that's the vibe check it has to pass 🧚

⚠️ now the part where you actually pay attention, bestie. Return must be: - 0 on success πŸŽ‰ - -EFAULT on error reading the location - -EINVAL on a failed compare of the contents - -EPERM on error writing to the location Any other value will be considered a failure. every last one. no exceptions, no "but it almost worked", nothing. fr fr πŸ“

πŸ’œ SEE ALSO πŸ’œ

Kernel file ./include/linux/ftrace.h

go read those too, iykyk πŸ“š


and that's the whole page, bestie! this one lives over in ./include/linux and it's dated October 2026 🌈⭐ mwah, slay, go patch your kernel carefully πŸ’–

πŸ“¦ where this page comes from