Add support for kernel version <= 2.6.32

ilammy / ftrace-hook

Using ftrace for function hooking in Linux kernel

GNU General Public License v2.0

252 stars 70 forks source link

Add support for kernel version <= 2.6.32 #1

Closed CaledoniaProject closed 5 years ago

CaledoniaProject commented 5 years ago

Can you add an example that works on 2.6.32?

ilammy commented 5 years ago

Hm... I'm not sure whether ftrace on 2.6.32 has necessary features, but I'll try checking it.

If that does not work then I guess you rely on the traditional splicing technique for hooks.

ilammy commented 5 years ago

No idea why you need such an old kernel, but whatever. Embedded people may be weird.

I've tried building a vanilla 2.6.32 kernel on my Debian 9 box...

Made sure to enable CONFIG_FUNCTION_TRACER in Kconfig.
Compilation does not work with gcc 6 (it builds PIE code by default, and the kernel is missing some versioned headers). Using 4.8 seems to be fine (though it spits out tons of warnings about some gfp_t macro).
Next there were some issues with kernel/timeconst.pl which uses deprecated defined(@thing) expressions. Ccommenting out these lines did the trick.
And after that more issues with architecture definitions in arch/x86/vdso/Makefile. Replacing /-m elf_i386/-m32/, /-m elf_x86_64/-m64/ there seems to work.
Finally able to compile the kernel, booting up... and systemd segfaults because of reasons.

CaledoniaProject commented 5 years ago

Thanks @ilammy, CentOS 6 ship 2.6.32 kernel by default, you can install kernel & kernel-devel packages to test it ...

ilammy commented 5 years ago

Oh, so that's about distro-specific 2.6.32. That makes it easier. As far as I know, what RHEL (and CentOS by extension) ship as 2.6.32 is actually very heavy patched 2.6.32 so I'm not even sure it can be called 2.6.32.

Anyway, back to your request... I installed CentOS 6.10 (x86_64) with 2.6.32-754.6.3.el6 kernel. It seems some newer ftrace features are missing in this kernel. I'll see what can be done with that. Maybe they could be replicated in the module, but if they actually require some ftrace functionality then it may not be possible without using a custom kernel.

CaledoniaProject commented 5 years ago

Yes, not all ftrace flags are available in 2.6.32, I'm not sure if it would work either.

evilpan commented 5 years ago

AFAIK kernel functions like register_ftrace_function/unregister_ftrace_function in include/linux/ftrace.h were added since Linux 3.7, so it may not work in old kernel without extra hacking.

CaledoniaProject commented 5 years ago

Yes, the support of ftrace is incomplete in CentOS 6.X, let's close this thread