Ananth N Mavinakayanahalli | 804defe | 2008-03-04 14:28:38 -0800 | [diff] [blame] | 1 | /* |
| 2 | * Here's a sample kernel module showing the use of jprobes to dump |
Petr Mladek | 54aea45 | 2015-10-01 15:37:11 -0700 | [diff] [blame^] | 3 | * the arguments of _do_fork(). |
Ananth N Mavinakayanahalli | 804defe | 2008-03-04 14:28:38 -0800 | [diff] [blame] | 4 | * |
| 5 | * For more information on theory of operation of jprobes, see |
| 6 | * Documentation/kprobes.txt |
| 7 | * |
| 8 | * Build and insert the kernel module as done in the kprobe example. |
| 9 | * You will see the trace data in /var/log/messages and on the |
Petr Mladek | 54aea45 | 2015-10-01 15:37:11 -0700 | [diff] [blame^] | 10 | * console whenever _do_fork() is invoked to create a new process. |
Ananth N Mavinakayanahalli | 804defe | 2008-03-04 14:28:38 -0800 | [diff] [blame] | 11 | * (Some messages may be suppressed if syslogd is configured to |
| 12 | * eliminate duplicate messages.) |
| 13 | */ |
| 14 | |
| 15 | #include <linux/kernel.h> |
| 16 | #include <linux/module.h> |
| 17 | #include <linux/kprobes.h> |
| 18 | |
| 19 | /* |
Petr Mladek | 54aea45 | 2015-10-01 15:37:11 -0700 | [diff] [blame^] | 20 | * Jumper probe for _do_fork. |
Ananth N Mavinakayanahalli | 804defe | 2008-03-04 14:28:38 -0800 | [diff] [blame] | 21 | * Mirror principle enables access to arguments of the probed routine |
| 22 | * from the probe handler. |
| 23 | */ |
| 24 | |
Petr Mladek | 54aea45 | 2015-10-01 15:37:11 -0700 | [diff] [blame^] | 25 | /* Proxy routine having the same arguments as actual _do_fork() routine */ |
| 26 | static long j_do_fork(unsigned long clone_flags, unsigned long stack_start, |
Michael Ellerman | e8ac6ea | 2014-09-24 16:08:33 +1000 | [diff] [blame] | 27 | unsigned long stack_size, int __user *parent_tidptr, |
| 28 | int __user *child_tidptr) |
Ananth N Mavinakayanahalli | 804defe | 2008-03-04 14:28:38 -0800 | [diff] [blame] | 29 | { |
Michael Ellerman | e8ac6ea | 2014-09-24 16:08:33 +1000 | [diff] [blame] | 30 | pr_info("jprobe: clone_flags = 0x%lx, stack_start = 0x%lx " |
| 31 | "stack_size = 0x%lx\n", clone_flags, stack_start, stack_size); |
Ananth N Mavinakayanahalli | 804defe | 2008-03-04 14:28:38 -0800 | [diff] [blame] | 32 | |
| 33 | /* Always end with a call to jprobe_return(). */ |
| 34 | jprobe_return(); |
| 35 | return 0; |
| 36 | } |
| 37 | |
| 38 | static struct jprobe my_jprobe = { |
Petr Mladek | 54aea45 | 2015-10-01 15:37:11 -0700 | [diff] [blame^] | 39 | .entry = j_do_fork, |
Ananth N Mavinakayanahalli | 804defe | 2008-03-04 14:28:38 -0800 | [diff] [blame] | 40 | .kp = { |
Petr Mladek | 54aea45 | 2015-10-01 15:37:11 -0700 | [diff] [blame^] | 41 | .symbol_name = "_do_fork", |
Ananth N Mavinakayanahalli | 804defe | 2008-03-04 14:28:38 -0800 | [diff] [blame] | 42 | }, |
| 43 | }; |
| 44 | |
| 45 | static int __init jprobe_init(void) |
| 46 | { |
| 47 | int ret; |
| 48 | |
| 49 | ret = register_jprobe(&my_jprobe); |
| 50 | if (ret < 0) { |
| 51 | printk(KERN_INFO "register_jprobe failed, returned %d\n", ret); |
| 52 | return -1; |
| 53 | } |
| 54 | printk(KERN_INFO "Planted jprobe at %p, handler addr %p\n", |
| 55 | my_jprobe.kp.addr, my_jprobe.entry); |
| 56 | return 0; |
| 57 | } |
| 58 | |
| 59 | static void __exit jprobe_exit(void) |
| 60 | { |
| 61 | unregister_jprobe(&my_jprobe); |
| 62 | printk(KERN_INFO "jprobe at %p unregistered\n", my_jprobe.kp.addr); |
| 63 | } |
| 64 | |
| 65 | module_init(jprobe_init) |
| 66 | module_exit(jprobe_exit) |
| 67 | MODULE_LICENSE("GPL"); |