Debugging Linux Kernel using KProbes - Dumping Stack on probe

You can print the stack in the kprobe handlers, which will give you call trace. dump_stack() is a function which should be used. To make this function work, we may need the following configuration:

Kernel hacking -> Kernel debugging
Kernel hacking -> Verbose BUG() reporting

Updated Sample code from the previous post:

#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/kprobes.h>

MODULE_LICENSE("GPL");
static unsigned int counter = 0;
static struct kprobe kp;

int pre_handler(struct kprobe *p, struct pt_regs *regs)
{
    printk(KERN_INFO"%s:counter:%d\n",__func__, counter++);
    dump_stack();
    return 0;
}

void post_handler(struct kprobe *p, struct pt_regs *regs, unsigned long flags)
{
    printk(KERN_INFO"%s:counter:%d\n",__func__, counter++);
    dump_stack();
}
static int test_kprobe_init(void)
{
    printk(KERN_INFO"%s: In init\n", __func__);
    kp.pre_handler = pre_handler;
    kp.post_handler = post_handler;
    kp.symbol_name = "_do_fork";
    register_kprobe(&kp);
    return 0;
}

static void test_kprobe_exit(void)
{
    unregister_kprobe(&kp);
    printk(KERN_INFO"%s: In exit\n", __func__);
}
module_init(test_kprobe_init);

module_exit(test_kprobe_exit);

Comments

Post a Comment

Popular posts from this blog

bb.utils.contains yocto

Difference between RDEPENDS and DEPENDS in Yocto

make config vs oldconfig vs defconfig vs menuconfig vs savedefconfig