Skip to contentSkip to conversation

kprobes - user space probes for 2.5.44

PATCH In review Vamsi Krishna S . 1 participant 1 message Oct 22, 2002 kprobes

lore
Share & tools
lore

Vamsi Krishna S .

author
#0 lore raw

PATCH 4/4 kprobes - user space probes for 2.5.44

Here is the patch that enhances base kprobes infrastructure to enable user space probes.

I have taken the approach of tacking user space extensions to struct kprobe to minimise code duplication, while the most intutive approach could have been to define a new struct uprobe.

The code which will be part the new dprobes external driver, to exploit this interface is yet to be written. It will be done once the interface is accepeted.

Comments welcome.
-
Vamsi Krishna S.
Linux Technology Center,
IBM Software Lab, Bangalore.
Ph: +91 80 5044959
Internet: [email protected]
--

arch/i386/kernel/kprobes.c +15 -5
diff -urN -X /home/vamsi/.dontdiff 44-pure/arch/i386/kernel/kprobes.c 44-kprobes/arch/i386/kernel/kprobes.c
@@ -33,8 +33,12 @@
 
 static inline void disarm_kprobe(struct kprobe *p, struct pt_regs *regs)
 {
-	*p->addr = p->opcode;
-	regs->eip = (unsigned long)p->addr;
+	if (!p->at.inode) {
+		/* remember the address to be used when rearming the probe. */
+		p->at.addr = (void *)(regs->eip - 1);
+	}
+	*p->at.addr = p->opcode;
+	regs->eip = (unsigned long)p->at.addr;
 }
 
 /*

@@ -99,7 +103,7 @@
 static void rearm_kprobe(struct kprobe *p, struct pt_regs *regs)
 {
 	regs->eflags &= ~TF_MASK;
-	*p->addr = BREAKPOINT_INSTRUCTION;
+	*p->at.addr = BREAKPOINT_INSTRUCTION;
 }
 	
 /*

@@ -121,8 +125,14 @@
 	 * trap occurs in kernel space.
 	 */
 	if (current_kprobe->opcode == 0x9c) { /* pushfl */
-		regs->esp &= ~(TF_MASK | IF_MASK);
-		regs->esp |= kprobe_old_eflags;
+		unsigned long *tos;
+
+		if (regs->eip > PAGE_OFFSET)
+			tos = &regs->esp;
+		else
+			tos = (unsigned long *)regs->esp;
+		*tos &= ~(TF_MASK | IF_MASK);
+		*tos |= kprobe_old_eflags;
 	}
 
 	rearm_kprobe(current_kprobe, regs);
include/linux/kprobes.h +8 -2
diff -urN -X /home/vamsi/.dontdiff 44-pure/include/linux/kprobes.h 44-kprobes/include/linux/kprobes.h
@@ -2,6 +2,7 @@
 #define _LINUX_KPROBES_H
 #include <linux/config.h>
 #include <linux/list.h>
+#include <linux/fs.h>
 #include <linux/notifier.h>
 #include <linux/smp.h>
 #include <asm/kprobes.h>

@@ -14,13 +15,18 @@
 				      unsigned long flags);
 typedef int (*kprobe_fault_handler_t)(struct kprobe *, struct pt_regs *,
 				      int trapnr);
+struct probe_at {
+	kprobe_opcode_t *addr;
+	struct inode *inode;	/* for user space probes */
+	unsigned long offset;	/* for user space probes */
+};
 
 struct kprobe {
 	struct list_head list;
 
 	/* location of the probe point */
-	kprobe_opcode_t *addr;
-
+	struct probe_at at;
+ 
 	 /* Called before addr is executed. */
 	kprobe_pre_handler_t pre_handler;
kernel/kprobes.c +78 -10

122 lines not on this page · raw message