리눅스, kprobes/kretprobes : [레지스터에서?] 프로브 함수의 인수를 복구하는 방법?

Question

/*kprobe_example.c*/ 
#define FUNCNAME alloc_file /* Find something better. printk() isnt recommended */ 
#include <linux/kernel.h> 
#include <linux/module.h> 
#include <linux/kprobes.h> 
#include <linux/kallsyms.h> 
#include <linux/sched.h> 
/*For each probe you need to allocate a kprobe structure*/ 
static struct kprobe kp; 

/*kprobe pre_handler: called just before the probed instruction is 
executed*/ 
int handler_pre(struct kprobe *p, struct pt_regs *regs) 
{ 
//  dump_stack(); 
     return 0; 
} 

/*kprobe post_handler: called after the probed instruction is executed*/ 
void handler_post(struct kprobe *p, struct pt_regs *regs, unsigned long 
flags) 
{ 

} 

/* fault_handler: this is called if an exception is generated for any 
* instruction within the pre- or post-handler, or when Kprobes 
* single-steps the probed instruction. 
*/ 
int handler_fault(struct kprobe *p, struct pt_regs *regs, int trapnr) 
{ 
     /* Return 0 because we don't handle the fault. */ 
     return 0; 
} 

int init_module(void) 
{ 
     int ret; 
     kp.pre_handler = handler_pre; 
     kp.post_handler = handler_post; 
     kp.fault_handler = handler_fault; 
     kp.addr = (kprobe_opcode_t*) kallsyms_lookup_name(FUNCNAME); 
     /* register the kprobe now */ 
     if (!kp.addr) { 
       printk("Couldn't find %s to plant kprobe\n", FUNCNAME); 
       return -1; 
     } 
     if ((ret = register_kprobe(&kp) < 0)) { 
       printk("register_kprobe failed, returned %d\n", ret); 
       return -1; 
     } 
     printk("kprobe registered\n"); 
     return 0; 
} 

void cleanup_module(void) 
{ 
     unregister_kprobe(&kp); 
     printk("kprobe unregistered\n"); 
} 

MODULE_LICENSE("GPL"); 

질문은 간단합니다. 포인터 (probed (intercepted) function)의 인수가 필요합니다. 레지스터를 가져 오거나 복구 할 수있는 방법이 있습니까?

Answer 1

답변은 jprobes입니다.

잡힌 및 반환 값을 수정하려면 프로브를위한 더 나은 장소 (더 나은 이해를 위해 http://lwn.net/Articles/132196/ 참조)을 발견해야한다고, my_jprobe.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name(FUNCAME);

또 다른 문제가없는 redhat's example code 두려워합니다.