Re: [PATCH] kprobes: add kprobe_is_function_probed()

[Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>]

(2014/10/22 15:02), Jiri Kosina wrote:
> On Wed, 22 Oct 2014, Masami Hiramatsu wrote:
> 
>>> Add a function that allows external users (such as live patching 
>>> mechanisms) to check whether a given function (identified by symbol name) 
>>> has a kprobe installed in it.
>>
>> Actually, we've already exported the list of kprobes with probe points
>> (symbols) via debugfs. Please check /sys/kernel/debug/kprobes/list :)
> 
> Yes, I know, and kprobe_is_function_probed() is performing very similar 
> thing that show_kprobe_addr() is doing.
> But we'd like to be able to check this from within a kernel module (the 
> patch module) and issue WARN().
> 
> Otherwise we'll need to have a machinery in userspace before insmod which 
> will look up the functions in the module and compare them to the 
> debufs-provided interface.
> 
> Also, I don't think we want to be dependent on debugfs being mounted and 
> discoverable, etc ...

OK, and even if so, since there is no user of this function, at this point
we can not merge this. I'd like to wait until live patching.

BTW, if your tool is in kernel, you can use get_kprobe(addr) to check
there is kprobes on a given address. And of course you can use kallsyms
to get the address range of given function. Moreover, as Josh pointed,
there are several same name functions in kernel. I think this kind of
function should better provide address-base interface.

Thank you,

-- 
Masami HIRAMATSU
Software Platform Research Dept. Linux Technology Research Center
Hitachi, Ltd., Yokohama Research Laboratory
E-mail: masami.hiramatsu.pt@hitachi.com