I know that Kprobes can be used to probe any kernel function. But after going through its documents I realise that it is mostly a kind of passive entity. It simply puts a probe in the middle of an execution sequence.
But what if I want to invoke any kernel function directly without bothering about the execution sequence.
How can I achieve that?
Updated:
Note: I want to invoke any kernel function inside my kernel module and not from any user space application.
Kernel functions cannot be simply invoked from applications that live in user space. System calls are the only functions in user space that can request kernel services.
To call kernel functions directly, if you are interested in kernel programming, you must implement a kernel module. This is a starting point.
EDIT
As you have specified that you want to call kernel functions from within a module, then there is no problem at all. Just follow the link I posted above for the documentation.
what if I want to invoke any kernel function directly
Not all functions can be used directly at least.
Consider the following points when calling a kernel function in your case.
kernel function from different module can be used only if it is exported using EXPORT_SYMBOL family of macros.
static functions can't be used directly outside of that file.
Example
Function definition (i2c_smbus_read_byte_data)
http://lxr.free-electrons.com/source/drivers/i2c/i2c-core.c#L2689
Used here
http://lxr.free-electrons.com/source/drivers/i2c/i2c-core.c#L350
Related
Problem Statement
I'm trying to get the address of a running thread's start_routine as passed in the pthread_create() call.
Research so far
It is apparently not in /proc/[tid]/stat or /proc/[tid]/status.
I found that start_routine is a member of struct pthread and gets set by pthread_create.[1]
If I knew the address of this struct, I could read the start_routine address.
I also found td_thr_get_info defined in the debugging library thread_db.h.[2]
It fills a struct with information about the thread, including the start function.[3] But it needs a struct td_thragent as an argument and I don't know how to create it properly.
Links
[1] http://fxr.watson.org/fxr/source/nptl/pthread_create.c?v=GLIBC27;im=excerpts#L455
[2] http://fxr.watson.org/fxr/source/nptl_db/td_thr_get_info.c?v=GLIBC27#L27
[3] See comment, because I'm not allowed to post more than 2 links.
You probably can't, and I could even imagine a very wild scenario where it could not exist at the moment you are querying it.
Let's suppose that the initial thread start routine void*foo_start(void*) is in some dlopen-ed dynamic shared library libfoo.so.
Let's imagine that foo_start is making a tail-recursive call to bar, and that bar function is dlclose-ing libfoo.so and later calling some of your routine querying that start. It is an wild address in some defunct segment (which has been munmap-ed by dlclose called by bar)!
So, even if you hack your libc to retrieve the start routine of a thread, that does not make much sense. BTW, you could look into MUSL libc, its src/thread/pthread_create.c file is quite readable.
NB: on some occasions, recent GCC (e.g. 4.8 or 4.9) when asked to optimize a lot (e.g. -O3) are able to generate tail recursive calls from C code.
I'm new to kernel and driver programming, so i hope my question is not too simple.
I'm working with a madwifi driver, in order to add some functionalities of my own. In my code i added some variables and structures that need to be initialized before the actual code starts.
While working i have encountered the following question:
where is the best place to put the functions that in charge of initializing this variables/structures?
As far as i know, there is a special macro *module_init* which is being executed upon loading the module to the kernel, however, i could not find it in the madwifi driver code. What i have found instead is another famous macro, the *exit_module* though.
so my questions are:
Is it recommended to add an init_module and do all my initializations there?
Is it recommended to use the exit_module to free the allocated memory?
Thanks for the help!
Omer
Every module (driver) defines two functions, one to be invoked when the module is loaded into the kernel and one for when the module is removed.
module_init() and module_exit() are the two special kernel macros to declare two functions for these roles.
I suppose your driver has init function. init() functions are generally used to initialize or register your driver.
Also check for the probe() function. If your driver can support multiple devices, once driver is registered, kernel calls probe() once for each device. This probe function starts the per-device initialization: initializing hardware, allocating resources, and registering the device with the kernel as a block or network device or whatever it is.
As I said in my comment, the initialization code can be in the init_module function.
Regarding your questions:
The module initialization function (init_module) is the right
place for driver-level initialization. It's recommended to use it,
unless your needs are trivial enough for C static variable
initialization.
The cleanup function (cleanup_module) must make
sure that the driver has released any resource it has allocated.
It's the right place to free anything allocated during
initialization.
I am interested in replacing a system call with a custom that I will implement in linux kernel 3.
I read that the sys call table is no longer exposed.
Any ideas?
any reference to this http://www.linuxtopia.org/online_books/linux_kernel/linux_kernel_module_programming_2.6/x978.html example but for kernel 3 will be appreciated :)
Thank you!
I would recommend using kprobes for this kind of job, you can easily break on any kernel address (or symbol...) and alter the execution path, all of this at runtime, with a kernel module if you need to :)
Kprobes work by dynamically replacing an instruction (e.g. first instruction of your syscall entry) by a break (e.g. int3 on x86). Inside the do_int3 handler, a notifier notifies kprobes, which in turn passes the execution to your registered function, from which point you can do almost anything.
A very good documentation is given in Documentation/kprobes.txt so as a tiny example in samples/kprobes/kprobes_example.c (in this example they break on do_fork to log each fork on the system). It has a very simple API and is very portable nowdays.
Warning: If you need to alter the execution path, make sure your kprobes are not optimized (i.e. a jmp instruction to your handler replaces the instruction you break onto instead of an int3) otherwize you won't be able to really alter the execution easily (after the ret of your function, the syscall function will still be executed as usual). If you are only interested in tracing, then this is fine and you can safely ignore this issue.
Write a LKM that would be better optio.What do you mean by replace,do you want to add a new one.
I am trying to communicate with an arduino using the code from,
http://todbot.com/blog/2006/12/06/arduino-serial-c-code-to-talk-to-arduino/
which uses termios to open and talk to an arduino in a non blocking way which works fine. What I was wondering is when on Java using rxtx I can register a callback function that is called when ever there is data on the line so that I don't have to manually check. I googled but could not find any info on how to register a callback function?
I am on Linux/OS X and I am trying to avoid launching a new thread just to watch/read data on the line.
Posix itself does not define a way to assign a callback function to be called when serial data arrives. The standard way to do this type of processing if you don't want to use a seperate thread is to use the select library function. This allows you program to define a set of file descriptors your program is interested in and then go to sleep. Select will automatically wake up your process if something interesting happens to one of the file descriptors you've declared interest in (such as new data becoming available for reading). This avoids having to busy-wait and poll multiple descriptors for activity.
Another option would be to use a library like libevent which sits on top of the Posix layer and provides the callback infrastructure. http://monkey.org/~provos/libevent/
Boost.Asio can provide callback functionality when using serial ports. It runs on Linux and Mac OS X.
i want to redirect the function calls of the real function calls from the system dll.i am working with portable-executable ,i can get IAT of the system dll(advapi32.dll),here the function address calls the system memory address ,i want to redirect to what i specified address..how can its possible ?....
That depends. Do you want to do it cross system or for a specific process?
Do you want to pre-edit the file (and if so which one - the dll or the executable)? Or do you want to do this hooking at runtime (dynamic code injection)?
There a few good starting points in code project:
http://www.codeproject.com/KB/system/hooksys.aspx
http://www.codeproject.com/KB/threads/winspy.aspx
But this is a broad subject, so you might need to ask more specific questions.
These techniques can be abused (especially with advapi32), so I strongly urge you not to.
Use Deviare API Hook and get that working with 10 lines of code.