jprobe_example.c 1.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869
  1. /*
  2. * Here's a sample kernel module showing the use of jprobes to dump
  3. * the arguments of do_fork().
  4. *
  5. * For more information on theory of operation of jprobes, see
  6. * Documentation/kprobes.txt
  7. *
  8. * Build and insert the kernel module as done in the kprobe example.
  9. * You will see the trace data in /var/log/messages and on the
  10. * console whenever do_fork() is invoked to create a new process.
  11. * (Some messages may be suppressed if syslogd is configured to
  12. * eliminate duplicate messages.)
  13. */
  14. #include <linux/kernel.h>
  15. #include <linux/module.h>
  16. #include <linux/kprobes.h>
  17. /*
  18. * Jumper probe for do_fork.
  19. * Mirror principle enables access to arguments of the probed routine
  20. * from the probe handler.
  21. */
  22. /* Proxy routine having the same arguments as actual do_fork() routine */
  23. static long jdo_fork(unsigned long clone_flags, unsigned long stack_start,
  24. struct pt_regs *regs, unsigned long stack_size,
  25. int __user *parent_tidptr, int __user *child_tidptr)
  26. {
  27. printk(KERN_INFO "jprobe: clone_flags = 0x%lx, stack_size = 0x%lx,"
  28. " regs = 0x%p\n",
  29. clone_flags, stack_size, regs);
  30. /* Always end with a call to jprobe_return(). */
  31. jprobe_return();
  32. return 0;
  33. }
  34. static struct jprobe my_jprobe = {
  35. .entry = jdo_fork,
  36. .kp = {
  37. .symbol_name = "do_fork",
  38. },
  39. };
  40. static int __init jprobe_init(void)
  41. {
  42. int ret;
  43. ret = register_jprobe(&my_jprobe);
  44. if (ret < 0) {
  45. printk(KERN_INFO "register_jprobe failed, returned %d\n", ret);
  46. return -1;
  47. }
  48. printk(KERN_INFO "Planted jprobe at %p, handler addr %p\n",
  49. my_jprobe.kp.addr, my_jprobe.entry);
  50. return 0;
  51. }
  52. static void __exit jprobe_exit(void)
  53. {
  54. unregister_jprobe(&my_jprobe);
  55. printk(KERN_INFO "jprobe at %p unregistered\n", my_jprobe.kp.addr);
  56. }
  57. module_init(jprobe_init)
  58. module_exit(jprobe_exit)
  59. MODULE_LICENSE("GPL");