/*
   * Here's a sample kernel module showing the use of jprobes to dump
   * the arguments of do_fork().
   *
   * For more information on theory of operation of jprobes, see
   * Documentation/kprobes.txt
   *
   * Build and insert the kernel module as done in the kprobe example.
   * You will see the trace data in /var/log/messages and on the
   * console whenever do_fork() is invoked to create a new process.
   * (Some messages may be suppressed if syslogd is configured to
   * eliminate duplicate messages.)
   */
  
  #include <linux/kernel.h>
  #include <linux/module.h>
  #include <linux/kprobes.h>
  
  /*
   * Jumper probe for do_fork.
   * Mirror principle enables access to arguments of the probed routine
   * from the probe handler.
   */
  
  /* Proxy routine having the same arguments as actual do_fork() routine */
  static long jdo_fork(unsigned long clone_flags, unsigned long stack_start,
  	      struct pt_regs *regs, unsigned long stack_size,
  	      int __user *parent_tidptr, int __user *child_tidptr)
  {
  	printk(KERN_INFO "jprobe: clone_flags = 0x%lx, stack_size = 0x%lx,"
  			" regs = 0x%p
  ",
  	       clone_flags, stack_size, regs);
  
  	/* Always end with a call to jprobe_return(). */
  	jprobe_return();
  	return 0;
  }
  
  static struct jprobe my_jprobe = {
  	.entry			= jdo_fork,
  	.kp = {
  		.symbol_name	= "do_fork",
  	},
  };
  
  static int __init jprobe_init(void)
  {
  	int ret;
  
  	ret = register_jprobe(&my_jprobe);
  	if (ret < 0) {
  		printk(KERN_INFO "register_jprobe failed, returned %d
  ", ret);
  		return -1;
  	}
  	printk(KERN_INFO "Planted jprobe at %p, handler addr %p
  ",
  	       my_jprobe.kp.addr, my_jprobe.entry);
  	return 0;
  }
  
  static void __exit jprobe_exit(void)
  {
  	unregister_jprobe(&my_jprobe);
  	printk(KERN_INFO "jprobe at %p unregistered
  ", my_jprobe.kp.addr);
  }
  
  module_init(jprobe_init)
  module_exit(jprobe_exit)
  MODULE_LICENSE("GPL");