1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
|
#define STP_NETLINK_ONLY
#define STP_NUM_STRINGS 1
#include "runtime.h"
#define KEY1_TYPE STRING
#include "map-keys.c"
#define VALUE_TYPE INT64
#include "map-values.c"
#define VALUE_TYPE STAT
#include "map-values.c"
#include "map.c"
#include "probes.c"
MODULE_DESCRIPTION("SystemTap probe: test4");
MODULE_AUTHOR("Martin Hunt <hunt@redhat.com>");
MAP opens, reads, writes;
asmlinkage long inst_sys_open (const char __user * filename, int flags, int mode)
{
_stp_map_key_str (opens, current->comm);
_stp_map_add_int64 (opens, 1);
jprobe_return();
return 0;
}
asmlinkage ssize_t inst_sys_read (unsigned int fd, char __user * buf, size_t count)
{
_stp_map_key_str (reads, current->comm);
_stp_map_add_int64_stat (reads, count);
jprobe_return();
return 0;
}
asmlinkage ssize_t inst_sys_write (unsigned int fd, const char __user * buf, size_t count)
{
_stp_map_key_str (writes, current->comm);
_stp_map_add_int64_stat (writes, count);
jprobe_return();
return 0;
}
static struct jprobe stp_probes[] = {
{
.kp.addr = (kprobe_opcode_t *)"sys_open",
.entry = (kprobe_opcode_t *) inst_sys_open
},
{
.kp.addr = (kprobe_opcode_t *)"sys_read",
.entry = (kprobe_opcode_t *) inst_sys_read
},
{
.kp.addr = (kprobe_opcode_t *)"sys_write",
.entry = (kprobe_opcode_t *) inst_sys_write
},
};
#define MAX_STP_ROUTINE (sizeof(stp_probes)/sizeof(struct jprobe))
static int pid;
module_param(pid, int, 0);
MODULE_PARM_DESC(pid, "daemon pid");
int init_module(void)
{
int ret;
if (!pid) {
printk("init: Can't start without daemon pid\n");
return -1;
}
if (_stp_transport_open(n_subbufs, subbuf_size, pid) < 0) {
printk("init: Couldn't open transport\n");
return -1;
}
opens = _stp_map_new_str (1000, INT64);
reads = _stp_map_new_str (1000, HSTAT_LOG, 8);
writes = _stp_map_new_str (1000, HSTAT_LOG, 8);
ret = _stp_register_jprobes (stp_probes, MAX_STP_ROUTINE);
return ret;
}
static void probe_exit (void)
{
_stp_unregister_jprobes (stp_probes, MAX_STP_ROUTINE);
_stp_map_print (opens,"%d opens by process \"%1s\"");
_stp_map_print (reads,"reads by process \"%1s\": %C. Total bytes=%S. Average: %A\n%H");
_stp_map_print (writes,"writes by process \"%1s\": %C. Total bytes=%S. Average: %A\n%H");
_stp_map_del (opens);
_stp_map_del (reads);
_stp_map_del (writes);
}
void cleanup_module(void)
{
_stp_transport_close();
}
MODULE_LICENSE("GPL");
|
