Kprobes Printk Sample Driver

After recieving lots of input (including a name change) on the "noisy" driver, I am resending the code as the "Kprobes Printk" driver.

This is a sample kprobes driver that enables arbitrary printk's to be inserted in valid kernel mapped addresses, with all user space controls accessed via sysfs.

By building this driver into the kernel (or inserting it as a module), a new directory called "kprobes_printk" will be created in your sysfs root. On my system I see:

[root@penguin2 root]# tree /sys/kprobes_printk/
/sys/kprobes_printk/
`-- ctl

Printk probes can be inserted into add by writing a string of the format "add ADDRESS MESSAGE" to the 'ctl' file.

For example, I can do the following to make the string "sys_fork" printk'ed everytime somebody calls the fork system call:

[root@penguin2 root]# grep sys_fork /usr/src/linux/System.map c0107d50 T sys_fork
[root@penguin2 root]# echo "add 0xc0107d50 sys_fork" > /sys/kprobes_printk/ctl [root@penguin2 root]# tree /sys/kprobes_printk/ /sys/kprobes_printk/
|-- c0107d50
| `-- message
`-- ctl
[root@penguin2 root]# cat /sys/kprobes_printk/c0107d50/message sys_fork
[root@penguin2 root]# tail --lines=4 /var/log/messages

Nov 26 11:16:15 penguin2 su(pam_unix)[3422]: session opened for user root by rusty(uid=0)
Nov 26 11:23:01 penguin2 kernel: kp_pre_handler: sys_fork
Nov 26 11:23:35 penguin2 kernel: kp_pre_handler: sys_fork
Nov 26 11:24:40 penguin2 last message repeated 2 times

To delete a printk probe write a string of the format "del ADDRESS" to the 'ctl' file. On my system I do:

[root@penguin2 root]# echo "del 0xc0107d50" > /sys/kprobes_printk/ctl [root@penguin2 root]# tree /sys/kprobes_printk/ /sys/kprobes_printk/
`-- ctl

This driver depends on:
* Kprobes
* A tweak to traps.c that addes an exported function that enables kprobes_printk to verify user space is handing a valid kernel mapped address to insert a probe.
* A few tweaks to sysfs that Patrick Mochel has made to his tree, but are not in 2.5.49-bk1.

To make it easier for somebody to play with this, I have uploading all the needed patches for this to be built on a 2.5.49-bk1 tree.

Kprobes =>
http://www.stinkycat.com/patches/changes_to_bk1/kprobes-2.5.49-bk1.diff

Sysfs Tweaks =>
http://www.stinkycat.com/patches/changes_to_bk1/sysfs_tweaks_2.5.49-bk1.diff

Traps.c tweak =>
http://www.stinkycat.com/patches/changes_to_bk1/vka-2.5.49-bk1.diff

The driver itself (depends on all three above)=>
http://www.stinkycat.com/patches/changes_to_bk1/kprobes-printk-2.5.49-bk1.diff

Here is that last patch inlined:

# This is a BitKeeper generated patch for the following project:
# Project Name: Linux kernel tree
# This patch format is intended for GNU patch command version 2.5 or higher. # This patch includes the following deltas:
# ChangeSet 1.876 -> 1.877
# arch/i386/Kconfig 1.13 -> 1.14
# drivers/char/Makefile 1.46 -> 1.47
# (new) -> 1.1 drivers/char/kprobes_printk.c
#
# The following is the BitKeeper ChangeSet Log
# --------------------------------------------
# 02/11/26 rusty@penguin.(none) 1.877
# Adding KPROBES_PRINTK option to build the kprobes printk driver that

# enables arbitrary printk statements to be inserted into valid kernel
# address using kprobes.
# --------------------------------------------
#
diff -Nru a/arch/i386/Kconfig b/arch/i386/Kconfig
--- a/arch/i386/Kconfig	Tue Nov 26 10:54:44 2002
+++ b/arch/i386/Kconfig	Tue Nov 26 10:54:44 2002
@@ -1560,6 +1560,23 @@
 	  for kernel debugging, non-intrusive instrumentation and testing.  If
 	  in doubt, say "N".

+config KPROBES_PRINTK
+ tristate "Kprobes Printk Driver"
+ depends on KPROBES
+ help

+	  This kprobes sample driver enables arbitrary printk statements
+	  to be inserted at any address where a valid kprobe can be inserted.
+	  User space can access this functionality through sysfs.  For 
+	  details see <file:Documentation/kprobes_printk_sample.txt>.
+	   
+	  This driver is also available as a module ( = code which can be
+	  inserted in and removed from the running kernel whenever you want).
+	  The module will be called kprobes_printk.o.  If you want to compile 
+	  it as a module, say M here and read <file:Documentation/modules.txt>.

+
+ Inserting printk statements in very busy code is a quick way to
+ bring your system to it's knees. If in doubt, say "N".
+
config DEBUG_STACKOVERFLOW
bool "Check for stack overflows"
depends on DEBUG_KERNEL

diff -Nru a/drivers/char/Makefile b/drivers/char/Makefile
@@ -82,6 +82,7 @@
 obj-$(CONFIG_AGP) += agp/
 obj-$(CONFIG_DRM) += drm/
 obj-$(CONFIG_PCMCIA) += pcmcia/
+obj-$(CONFIG_KPROBES_PRINTK) += kprobes_printk.o
 
 
 # Files generated that shall be removed upon make clean