What's does KPROBE_ENTRY mean?

What's does KPROBE_ENTRY mean?

[jidong xiao]

I searched in linux kernel 2.6.10, didn't find it, then I tried
2.6.20, it is there. But I am not familiar with assembly language, so
can anybody kindly explain it, I don't know the difference between
KPROBE_ENTRY and ENTRY, however, I can find both of these items in
some files, such as arch/x86_64/kernel/entry.S.

Thank you.

Regards
Jason Xiao

Re: What's does KPROBE_ENTRY mean?

[jidong xiao]

Anyone can help this?

On 6/21/07, jidong xiao <jidong.xiao@gmail.com> wrote:
> I searched in linux kernel 2.6.10, didn't find it, then I tried
> 2.6.20, it is there. But I am not familiar with assembly language, so
> can anybody kindly explain it, I don't know the difference between
> KPROBE_ENTRY and ENTRY, however, I can find both of these items in
> some files, such as arch/x86_64/kernel/entry.S.
>
> Thank you.
>
> Regards
> Jason Xiao
>

Re: What's does KPROBE_ENTRY mean?

[Paul Mundt]

On Thu, Jul 26, 2007 at 01:43:10PM +0800, jidong xiao wrote:
> Anyone can help this?
> 
> On 6/21/07, jidong xiao <jidong.xiao@gmail.com> wrote:
> > I searched in linux kernel 2.6.10, didn't find it, then I tried
> > 2.6.20, it is there. But I am not familiar with assembly language, so
> > can anybody kindly explain it, I don't know the difference between
> > KPROBE_ENTRY and ENTRY, however, I can find both of these items in
> > some files, such as arch/x86_64/kernel/entry.S.
> >
KPROBE_ENTRY() is the assembly equivalent of __kprobes, it places the
symbol in a special section (.kprobes.text) where probes can't be
inserted. This is usually helpful in cases where inserting the probe may
lead to recursion or other undesirable behaviour.

See include/linux/linkage.h and include/linux/kprobes.h.

Re: What's does KPROBE_ENTRY mean?

[jidong xiao]

Thanks.So if I don't care any probes, and I actually don't need to
take use of kprobes, then I can use the functions defined through
KPROBE_ENTRY() the same way as those defined via ENTRY(), right?

Regards
Jason Xiao

On 7/26/07, Paul Mundt <lethal@linux-sh.org> wrote:
> On Thu, Jul 26, 2007 at 01:43:10PM +0800, jidong xiao wrote:
> > Anyone can help this?
> >
> > On 6/21/07, jidong xiao <jidong.xiao@gmail.com> wrote:
> > > I searched in linux kernel 2.6.10, didn't find it, then I tried
> > > 2.6.20, it is there. But I am not familiar with assembly language, so
> > > can anybody kindly explain it, I don't know the difference between
> > > KPROBE_ENTRY and ENTRY, however, I can find both of these items in
> > > some files, such as arch/x86_64/kernel/entry.S.
> > >
> KPROBE_ENTRY() is the assembly equivalent of __kprobes, it places the
> symbol in a special section (.kprobes.text) where probes can't be
> inserted. This is usually helpful in cases where inserting the probe may
> lead to recursion or other undesirable behaviour.
>
> See include/linux/linkage.h and include/linux/kprobes.h.
>

Re: What's does KPROBE_ENTRY mean?

[Paul Mundt]

On Thu, Jul 26, 2007 at 02:50:38PM +0800, jidong xiao wrote:
> Thanks.So if I don't care any probes, and I actually don't need to
> take use of kprobes, then I can use the functions defined through
> KPROBE_ENTRY() the same way as those defined via ENTRY(), right?
> 
Yes, there's nothing special about KPROBE_ENTRY() other than the section
placement. It even wraps in to ENTRY() after the .pushsection.

As you can see from kernel/kprobes.c:

	static int __kprobes in_kprobes_functions(unsigned long addr)
	{
		if (addr >= (unsigned long)__kprobes_text_start &&
		    addr < (unsigned long)__kprobes_text_end)
			return -EINVAL;
		return 0;
	}


...

and in __register_kprobe():

        if (!kernel_text_address((unsigned long) p->addr) ||
            in_kprobes_functions((unsigned long) p->addr))
                return -EINVAL;

So the only behavioural change for these symbols is that insertion of
probes is prohibited. There is nothing inherently special about them
otherwise, and platforms that don't enable kprobes aren't going to
care either.

One curious thing is that while KPROBE_ENTRY() unconditionally does
a .pushsection .kprobes.text, __kprobes does this conditionally
depending on CONFIG_KPROBES. While this doesn't hurt anything, it's
inconsistent to say the least. We should probably either make __kprobes
explicitly always use .kprobes.text, or just wrap KPROBE_ENTRY to ENTRY
directly and forego the .pushsection when CONFIG_KPROBES=n.