samples/kprobes/jprobe_example.c

   1 /*
   2  * Here's a sample kernel module showing the use of jprobes to dump
   3  * the arguments of do_fork().
   4  *
   5  * For more information on theory of operation of jprobes, see
   6  * Documentation/kprobes.txt
   7  *
   8  * Build and insert the kernel module as done in the kprobe example.
   9  * You will see the trace data in /var/log/messages and on the
  10  * console whenever do_fork() is invoked to create a new process.
  11  * (Some messages may be suppressed if syslogd is configured to
  12  * eliminate duplicate messages.)
  13  */
  14
  15 #include <linux/kernel.h>
  16 #include <linux/module.h>
  17 #include <linux/kprobes.h>
  18
  19 /*
  20  * Jumper probe for do_fork.
  21  * Mirror principle enables access to arguments of the probed routine
  22  * from the probe handler.
  23  */
  24
  25 /* Proxy routine having the same arguments as actual do_fork() routine */
  26 static long jdo_fork(unsigned long clone_flags, unsigned long stack_start,
  27               struct pt_regs *regs, unsigned long stack_size,
  28               int __user *parent_tidptr, int __user *child_tidptr)
  29 {
  30         printk(KERN_INFO "jprobe: clone_flags = 0x%lx, stack_size = 0x%lx,"
  31                         " regs = 0x%p\n",
  32                clone_flags, stack_size, regs);
  33
  34         /* Always end with a call to jprobe_return(). */
  35         jprobe_return();
  36         return 0;
  37 }
  38
  39 static struct jprobe my_jprobe = {
  40         .entry                  = jdo_fork,
  41         .kp = {
  42                 .symbol_name    = "do_fork",
  43         },
  44 };
  45
  46 static int __init jprobe_init(void)
  47 {
  48         int ret;
  49
  50         ret = register_jprobe(&my_jprobe);
  51         if (ret < 0) {
  52                 printk(KERN_INFO "register_jprobe failed, returned %d\n", ret);
  53                 return -1;
  54         }
  55         printk(KERN_INFO "Planted jprobe at %p, handler addr %p\n",
  56                my_jprobe.kp.addr, my_jprobe.entry);
  57         return 0;
  58 }
  59
  60 static void __exit jprobe_exit(void)
  61 {
  62         unregister_jprobe(&my_jprobe);
  63         printk(KERN_INFO "jprobe at %p unregistered\n", my_jprobe.kp.addr);
  64 }
  65
  66 module_init(jprobe_init)
  67 module_exit(jprobe_exit)
  68 MODULE_LICENSE("GPL");