LXR linux/samples/kprobes/jprobe

   1/*
   2 * Here's a sample kernel module showing the use of jprobes to dump
   3 * the arguments of _do_fork().
   4 *
   5 * For more information on theory of operation of jprobes, see
   6 * Documentation/kprobes.txt
   7 *
   8 * Build and insert the kernel module as done in the kprobe example.
   9 * You will see the trace data in /var/log/messages and on the
  10 * console whenever _do_fork() is invoked to create a new process.
  11 * (Some messages may be suppressed if syslogd is configured to
  12 * eliminate duplicate messages.)
  13 */
  14
  15#include <linux/kernel.h>
  16#include <linux/module.h>
  17#include <linux/kprobes.h>
  18
  19/*
  20 * Jumper probe for _do_fork.
  21 * Mirror principle enables access to arguments of the probed routine
  22 * from the probe handler.
  23 */
  24
  25/* Proxy routine having the same arguments as actual _do_fork() routine */
  26static long j_do_fork(unsigned long clone_flags, unsigned long stack_start,
  27              unsigned long stack_size, int __user *parent_tidptr,
  28              int __user *child_tidptr, unsigned long tls)
  29{
  30        pr_info("jprobe: clone_flags = 0x%lx, stack_start = 0x%lx "
  31                "stack_size = 0x%lx\n", clone_flags, stack_start, stack_size);
  32
  33        /* Always end with a call to jprobe_return(). */
  34        jprobe_return();
  35        return 0;
  36}
  37
  38static struct jprobe my_jprobe = {
  39        .entry                  = j_do_fork,
  40        .kp = {
  41                .symbol_name    = "_do_fork",
  42        },
  43};
  44
  45static int __init jprobe_init(void)
  46{
  47        int ret;
  48
  49        ret = register_jprobe(&my_jprobe);
  50        if (ret < 0) {
  51                pr_err("register_jprobe failed, returned %d\n", ret);
  52                return -1;
  53        }
  54        pr_info("Planted jprobe at %p, handler addr %p\n",
  55               my_jprobe.kp.addr, my_jprobe.entry);
  56        return 0;
  57}
  58
  59static void __exit jprobe_exit(void)
  60{
  61        unregister_jprobe(&my_jprobe);
  62        pr_info("jprobe at %p unregistered\n", my_jprobe.kp.addr);
  63}
  64
  65module_init(jprobe_init)
  66module_exit(jprobe_exit)
  67MODULE_LICENSE("GPL");
  68