Calling kernel functions from kprobes/jprobes

Calling kernel functions from kprobes/jprobes

[Samuel]

Hi,

I am using kprobes/jprobes to try and understand how IP options are handled in the kernel. From one of these probes I want to call another function inside the kernel, namely ip_options_get_from_user. It is defined in net/ipv4/ip_options.c and declared in include/net/ip.h. I have included the ip.h header file in my probe, but on compilation I get a warning saying the function is undefined. Also, inserting the probe fails - "Unknown symbol in module".

Any help would be appreciated.

BR,

Samuel Korpi

_______________________________________________
No banners. No pop-ups. No kidding.
Make My Way  your home on the Web - http://www.myway.com

Re: Calling kernel functions from kprobes/jprobes

[Alan Cox]

Ar Maw, 2006-06-27 am 04:00 -0400, ysgrifennodd Samuel:
> Hi,
> 
> I am using kprobes/jprobes to try and understand how IP options are
> handled in the kernel. From one of these probes I want to call another
> function inside the kernel, namely ip_options_get_from_user. It is
> defined in net/ipv4/ip_options.c and declared in include/net/ip.h. I
> have included the ip.h header file in my probe, but on compilation I
> get a warning saying the function is undefined. Also, inserting the
> probe fails - "Unknown symbol in module".

Not all symbols are visible or kept. If you want to explore the
internals of the kernel in more depth like this you might find building
user mode linux with debugging enabled and using gdb is both easier and
a lot more fun.

Alan

Re: Calling kernel functions from kprobes/jprobes

[Frank Ch. Eigler]

"Samuel" <samuelkorpi@myway.com> writes:

> [...]  I am using kprobes/jprobes to try and understand how IP
> options are handled in the kernel. From one of these probes I want
> to call another function inside the kernel, namely
> ip_options_get_from_user. [...]

Other than symbol exporting issues, you may encounter another problem
that we have encountered in systemtap (which is also a kprobes
client).  That is that the context where the kprobe was placed may be
such that calling most ordinary kernel routines is unsafe.  In
particular, ip_options_get_from_user may sleep, which may or may not
be legal from the context of the kprobe.  (In systemtap probes, we
don't permit anything to block/sleep/schedule, so instead suffer
absent-page errors.)

- FChE

Re: Calling kernel functions from kprobes/jprobes

[Samuel Korpi]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset="US-ASCII", Size: 763 bytes --]



 --- On Tue 06/27, Alan Cox < alan@lxorguk.ukuu.org.uk > wrote:

> Not all symbols are visible or kept. If you want to explore the internals of the
> kernel in more depth like this you might find building user mode linux with 
> debugging enabled and using gdb is both easier and a lot more fun.

Hmm. I´ll have to take a look at that. http://user-mode-linux.sourceforge.net/ seems to have something on the subject. Are there any other good places to look for info (tutorials etc.)?

However, just to make things clear - is there any way of finding out which symbols are visible to kernel modules?

Br,

Samuel Korpi

_______________________________________________
No banners. No pop-ups. No kidding.
Make My Way  your home on the Web - http://www.myway.com