1/* 2 * Here's a sample kernel module showing the use of jprobes to dump 3 * the arguments of do_fork(). 4 * 5 * For more information on theory of operation of jprobes, see 6 * Documentation/kprobes.txt 7 * 8 * Build and insert the kernel module as done in the kprobe example. 9 * You will see the trace data in /var/log/messages and on the 10 * console whenever do_fork() is invoked to create a new process. 11 * (Some messages may be suppressed if syslogd is configured to 12 * eliminate duplicate messages.) 13 */ 14 15#include <linux/kernel.h> 16#include <linux/module.h> 17#include <linux/kprobes.h> 18 19/* 20 * Jumper probe for do_fork. 21 * Mirror principle enables access to arguments of the probed routine 22 * from the probe handler. 23 */ 24 25/* Proxy routine having the same arguments as actual do_fork() routine */ 26static long jdo_fork(unsigned long clone_flags, unsigned long stack_start, 27 struct pt_regs *regs, unsigned long stack_size, 28 int __user *parent_tidptr, int __user *child_tidptr) 29{ 30 printk(KERN_INFO "jprobe: clone_flags = 0x%lx, stack_size = 0x%lx," 31 " regs = 0x%p\n", 32 clone_flags, stack_size, regs); 33 34 /* Always end with a call to jprobe_return(). */ 35 jprobe_return(); 36 return 0; 37} 38 39static struct jprobe my_jprobe = { 40 .entry = jdo_fork, 41 .kp = { 42 .symbol_name = "do_fork", 43 }, 44}; 45 46static int __init jprobe_init(void) 47{ 48 int ret; 49 50 ret = register_jprobe(&my_jprobe); 51 if (ret < 0) { 52 printk(KERN_INFO "register_jprobe failed, returned %d\n", ret); 53 return -1; 54 } 55 printk(KERN_INFO "Planted jprobe at %p, handler addr %p\n", 56 my_jprobe.kp.addr, my_jprobe.entry); 57 return 0; 58} 59 60static void __exit jprobe_exit(void) 61{ 62 unregister_jprobe(&my_jprobe); 63 printk(KERN_INFO "jprobe at %p unregistered\n", my_jprobe.kp.addr); 64} 65 66module_init(jprobe_init) 67module_exit(jprobe_exit) 68MODULE_LICENSE("GPL"); 69