kprobe_example.c 3.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * NOTE: This example is works on x86 and powerpc.
  4. * Here's a sample kernel module showing the use of kprobes to dump a
  5. * stack trace and selected registers when kernel_clone() is called.
  6. *
  7. * For more information on theory of operation of kprobes, see
  8. * Documentation/trace/kprobes.rst
  9. *
  10. * You will see the trace data in /var/log/messages and on the console
  11. * whenever kernel_clone() is invoked to create a new process.
  12. */
  13. #include <linux/kernel.h>
  14. #include <linux/module.h>
  15. #include <linux/kprobes.h>
  16. #define MAX_SYMBOL_LEN 64
  17. static char symbol[MAX_SYMBOL_LEN] = "kernel_clone";
  18. module_param_string(symbol, symbol, sizeof(symbol), 0644);
  19. /* For each probe you need to allocate a kprobe structure */
  20. static struct kprobe kp = {
  21. .symbol_name = symbol,
  22. };
  23. /* kprobe pre_handler: called just before the probed instruction is executed */
  24. static int __kprobes handler_pre(struct kprobe *p, struct pt_regs *regs)
  25. {
  26. #ifdef CONFIG_X86
  27. pr_info("<%s> pre_handler: p->addr = 0x%p, ip = %lx, flags = 0x%lx\n",
  28. p->symbol_name, p->addr, regs->ip, regs->flags);
  29. #endif
  30. #ifdef CONFIG_PPC
  31. pr_info("<%s> pre_handler: p->addr = 0x%p, nip = 0x%lx, msr = 0x%lx\n",
  32. p->symbol_name, p->addr, regs->nip, regs->msr);
  33. #endif
  34. #ifdef CONFIG_MIPS
  35. pr_info("<%s> pre_handler: p->addr = 0x%p, epc = 0x%lx, status = 0x%lx\n",
  36. p->symbol_name, p->addr, regs->cp0_epc, regs->cp0_status);
  37. #endif
  38. #ifdef CONFIG_ARM64
  39. pr_info("<%s> pre_handler: p->addr = 0x%p, pc = 0x%lx,"
  40. " pstate = 0x%lx\n",
  41. p->symbol_name, p->addr, (long)regs->pc, (long)regs->pstate);
  42. #endif
  43. #ifdef CONFIG_S390
  44. pr_info("<%s> pre_handler: p->addr, 0x%p, ip = 0x%lx, flags = 0x%lx\n",
  45. p->symbol_name, p->addr, regs->psw.addr, regs->flags);
  46. #endif
  47. /* A dump_stack() here will give a stack backtrace */
  48. return 0;
  49. }
  50. /* kprobe post_handler: called after the probed instruction is executed */
  51. static void __kprobes handler_post(struct kprobe *p, struct pt_regs *regs,
  52. unsigned long flags)
  53. {
  54. #ifdef CONFIG_X86
  55. pr_info("<%s> post_handler: p->addr = 0x%p, flags = 0x%lx\n",
  56. p->symbol_name, p->addr, regs->flags);
  57. #endif
  58. #ifdef CONFIG_PPC
  59. pr_info("<%s> post_handler: p->addr = 0x%p, msr = 0x%lx\n",
  60. p->symbol_name, p->addr, regs->msr);
  61. #endif
  62. #ifdef CONFIG_MIPS
  63. pr_info("<%s> post_handler: p->addr = 0x%p, status = 0x%lx\n",
  64. p->symbol_name, p->addr, regs->cp0_status);
  65. #endif
  66. #ifdef CONFIG_ARM64
  67. pr_info("<%s> post_handler: p->addr = 0x%p, pstate = 0x%lx\n",
  68. p->symbol_name, p->addr, (long)regs->pstate);
  69. #endif
  70. #ifdef CONFIG_S390
  71. pr_info("<%s> pre_handler: p->addr, 0x%p, flags = 0x%lx\n",
  72. p->symbol_name, p->addr, regs->flags);
  73. #endif
  74. }
  75. /*
  76. * fault_handler: this is called if an exception is generated for any
  77. * instruction within the pre- or post-handler, or when Kprobes
  78. * single-steps the probed instruction.
  79. */
  80. static int handler_fault(struct kprobe *p, struct pt_regs *regs, int trapnr)
  81. {
  82. pr_info("fault_handler: p->addr = 0x%p, trap #%dn", p->addr, trapnr);
  83. /* Return 0 because we don't handle the fault. */
  84. return 0;
  85. }
  86. /* NOKPROBE_SYMBOL() is also available */
  87. NOKPROBE_SYMBOL(handler_fault);
  88. static int __init kprobe_init(void)
  89. {
  90. int ret;
  91. kp.pre_handler = handler_pre;
  92. kp.post_handler = handler_post;
  93. kp.fault_handler = handler_fault;
  94. ret = register_kprobe(&kp);
  95. if (ret < 0) {
  96. pr_err("register_kprobe failed, returned %d\n", ret);
  97. return ret;
  98. }
  99. pr_info("Planted kprobe at %p\n", kp.addr);
  100. return 0;
  101. }
  102. static void __exit kprobe_exit(void)
  103. {
  104. unregister_kprobe(&kp);
  105. pr_info("kprobe at %p unregistered\n", kp.addr);
  106. }
  107. module_init(kprobe_init)
  108. module_exit(kprobe_exit)
  109. MODULE_LICENSE("GPL");