linux/samples/fprobe/fprobe_example.c

// SPDX-License-Identifier: GPL-2.0-only
/*
 * Here's a sample kernel module showing the use of fprobe to dump a
 * stack trace and selected registers when kernel_clone() is called.
 *
 * For more information on theory of operation of kprobes, see
 * Documentation/trace/kprobes.rst
 *
 * You will see the trace data in /var/log/messages and on the console
 * whenever kernel_clone() is invoked to create a new process.
 */

#define pr_fmt(fmt) …

#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/fprobe.h>
#include <linux/sched/debug.h>
#include <linux/slab.h>

#define BACKTRACE_DEPTH …
#define MAX_SYMBOL_LEN …
static struct fprobe sample_probe;
static unsigned long nhit;

static char symbol[MAX_SYMBOL_LEN] = …;
module_param_string(…);
MODULE_PARM_DESC(…) …;

static char nosymbol[MAX_SYMBOL_LEN] = …;
module_param_string(…);
MODULE_PARM_DESC(…) …;

static bool stackdump = …;
module_param(stackdump, bool, 0644);
MODULE_PARM_DESC(…) …;

static bool use_trace = …;
module_param(use_trace, bool, 0644);
MODULE_PARM_DESC(…) …;

static void show_backtrace(void)
{ … }

static int sample_entry_handler(struct fprobe *fp, unsigned long ip,
				unsigned long ret_ip,
				struct pt_regs *regs, void *data)
{ … }

static void sample_exit_handler(struct fprobe *fp, unsigned long ip,
				unsigned long ret_ip, struct pt_regs *regs,
				void *data)
{ … }

static int __init fprobe_init(void)
{ … }

static void __exit fprobe_exit(void)
{ … }

module_init(fprobe_init)
module_exit(fprobe_exit)
MODULE_DESCRIPTION(…) …;
MODULE_LICENSE(…) …;