Re: [RFC PATCH -tip 0/5] kprobes: Abolish jprobe APIs

From: Ingo Molnar
Date: Sat Oct 07 2017 - 04:55:15 EST



* Steven Rostedt <rostedt@xxxxxxxxxxx> wrote:

> On Fri, 6 Oct 2017 13:49:59 +0900
> Masami Hiramatsu <mhiramat@xxxxxxxxxx> wrote:
>
> > Steve, could you write a documentation how to use ftrace callback?
> > I think I should update the Documentation/kprobes.txt so that jprobe
> > user can easily migrate on that.
>
> I decided to do this now. Here's a first draft. What do you think?
>
> -- Steve
>
> Using ftrace to hook to functions
> =================================
>
> Copyright 2017 VMware Inc.
> Author: Steven Rostedt <srostedt@xxxxxxxxxxx>
> License: The GNU Free Documentation License, Version 1.2
> (dual licensed under the GPL v2)
>
> Written for: 4.14
>
> Introduction
> ------------
>
> The ftrace infrastructure was originially created to attach hooks to the
> beginning of functions in order to record and trace the flow of the kernel.
> But hooks to the start of a function can have other use cases. Either
> for live kernel patching, or for security monitoring. This document describes
> how to use ftrace to implement your own function hooks.
>
>
> The ftrace context
> ==================
>
> WARNING: The ability to add a callback to almost any function within the
> kernel comes with risks. A callback can be called from any context
> (normal, softirq, irq, and NMI). Callbacks can also be called just before
> going to idle, during CPU bring up and takedown, or going to user space.
> This requires extra care to what can be done inside a callback. A callback
> can be called outside the protective scope of RCU.
>
> The ftrace infrastructure has some protections agains recursions and RCU
> but one must still be very careful how they use the callbacks.
>
>
> The ftrace_ops structure
> ========================
>
> To register a function callback, a ftrace_ops is required. This structure
> is used to tell ftrace what function should be called as the callback
> as well as what protections the callback will perform and not require
> ftrace to handle.

So the text first starts talking about 'hooks' then uses the 'callback'
terminology in the rest of th document. Could we please change it all to
'callback'?

[ This is a pet peeve of mine as 'hook' gives me the cringe! ;-) ]

Thanks,

Ingo