linux/samples/kprobes/kprobe_example.c

// SPDX-License-Identifier: GPL-2.0-only
/*
 * Here's a sample kernel module showing the use of kprobes to dump a
 * stack trace and selected registers when kernel_clone() is called.
 *
 * For more information on theory of operation of kprobes, see
 * Documentation/trace/kprobes.rst
 *
 * You will see the trace data in /var/log/messages and on the console
 * whenever kernel_clone() is invoked to create a new process.
 */

#define pr_fmt(fmt) …

#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/kprobes.h>

static char symbol[KSYM_NAME_LEN] = …;
module_param_string(…);

/* For each probe you need to allocate a kprobe structure */
static struct kprobe kp = …;

/* kprobe pre_handler: called just before the probed instruction is executed */
static int __kprobes handler_pre(struct kprobe *p, struct pt_regs *regs)
{ … }

/* kprobe post_handler: called after the probed instruction is executed */
static void __kprobes handler_post(struct kprobe *p, struct pt_regs *regs,
				unsigned long flags)
{ … }

static int __init kprobe_init(void)
{ … }

static void __exit kprobe_exit(void)
{ … }

module_init(kprobe_init)
module_exit(kprobe_exit)
MODULE_DESCRIPTION(…) …;
MODULE_LICENSE(…) …;