ilammy / ftrace-hook

Using ftrace for function hooking in Linux kernel

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Add support for kernel version <= 2.6.32

CaledoniaProject opened this issue · comments

Can you add an example that works on 2.6.32?

Hm... I'm not sure whether ftrace on 2.6.32 has necessary features, but I'll try checking it.

If that does not work then I guess you rely on the traditional splicing technique for hooks.

No idea why you need such an old kernel, but whatever. Embedded people may be weird.

I've tried building a vanilla 2.6.32 kernel on my Debian 9 box...

  • Made sure to enable CONFIG_FUNCTION_TRACER in Kconfig.
  • Compilation does not work with gcc 6 (it builds PIE code by default, and the kernel is missing some versioned headers). Using 4.8 seems to be fine (though it spits out tons of warnings about some gfp_t macro).
  • Next there were some issues with kernel/timeconst.pl which uses deprecated defined(@thing) expressions. Ccommenting out these lines did the trick.
  • And after that more issues with architecture definitions in arch/x86/vdso/Makefile. Replacing /-m elf_i386/-m32/, /-m elf_x86_64/-m64/ there seems to work.
  • Finally able to compile the kernel, booting up... and systemd segfaults because of reasons.

Thanks @ilammy, CentOS 6 ship 2.6.32 kernel by default, you can install kernel & kernel-devel packages to test it ...

Oh, so that's about distro-specific 2.6.32. That makes it easier. As far as I know, what RHEL (and CentOS by extension) ship as 2.6.32 is actually very heavy patched 2.6.32 so I'm not even sure it can be called 2.6.32.

Anyway, back to your request... I installed CentOS 6.10 (x86_64) with 2.6.32-754.6.3.el6 kernel. It seems some newer ftrace features are missing in this kernel. I'll see what can be done with that. Maybe they could be replicated in the module, but if they actually require some ftrace functionality then it may not be possible without using a custom kernel.

Yes, not all ftrace flags are available in 2.6.32, I'm not sure if it would work either.

AFAIK kernel functions like register_ftrace_function/unregister_ftrace_function in include/linux/ftrace.h were added since Linux 3.7, so it may not work in old kernel without extra hacking.

Yes, the support of ftrace is incomplete in CentOS 6.X, let's close this thread