search

ilammy / ftrace-hook

Using ftrace for function hooking in Linux kernel
GNU General Public License v2.0
253 stars 70 forks source link

Could ftrace instrumentation be compiled into kernel ? #7

Open soh0ro0t opened 5 years ago

soh0ro0t commented 5 years ago

Hi, I searched all the demo codes related to ftrace instrumentation, but all of that is compiled as a separate module, then using insmod to load it and rmmod to unload it, it does not satisfied me since I have to find a proper time to load this module. I wanna compile it into linux kernel as a whole stuff rather a independent driver, and I does have a try, while the result is kernel crashed at the point of 'fh_trace_thunk' , could you give me some advise?

ilammy commented 3 years ago

Alrighty... This is probably a very slow response but nevertheless!

I don't think it really makes sense to use hooks if you want to compile this thing into the kernel. Hooking is used to interpose your external code from the module into the kernel. If you can compile the kernel, it's much safer and easier to just patch the kernel directly to do what you would otherwise do by hooking.

As for why this module can't be reused as is, that's likely because fh_ftrace_thunk() by default detects recursion by checking if the caller is within the module. Compiling it with -DUSE_FENTRY_OFFSET=1 should disable that thing and it will probably work (I haven't checked yet).

wynn1212 commented 7 months ago

Thank you for this tips, can confirm it works after setting USE_FENTRY_OFFSET=1