Kprobe mechanism to intercept do_page_fault

Question

Im trying to intercept the __do_page_fault() method in linux kernel. The normal way to register kprobes , i.e. defining kp.addr as

kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("__do_page_fault");

is not working. What's the proper way to do this?

Edit: Any other method of intercepting do_page_fault will also work for me.

Please specify what you mean by "not working". Is there an error? Something else? — ptd, Jan 16 '15 at 22:02
On doing insmod, I get the error: "ERROR: could not insert module : Invalid parameters" — Sayak, Jan 16 '15 at 22:18

score 1 · Accepted Answer · answered Jan 18 '15 at 04:09

1

This error usually comes when GPL licenses are not used in the module. Adding the following lines in your module should remove this error :

MODULE_LICENSE("GPL");
MODULE_LICENSE("GPL v2");

answered Jan 18 '15 at 04:09

S_S

1

Well I find that (at least) on a recent kernel (i'm looking at 4.4.0-rc6 source), the __do_page_fault routine is marked with NOKPROBE_SYMBOL(__do_page_fault); macro at the end of the function definition. Further, /sys/kernel/debug/kprobes/blacklist confirms it's blacklisted. So, just curious, how's it working ?? – kaiwan Jan 15 '16 at 11:08

1 Answers1