Question

I want to trace with a LKM the sys_connect and sys_accept right after these system calls return.
I found that kprobes can give you access to the registers when a probed system call returns, by defining a post handler.

My problem is that I don’t know how to get the system call parameters from the data that I have in the post handler (i.e. the struct pt_regs)
The post handler is defined like that:

void post_handler(struct kprobe *p, struct pt_regs *regs, unsigned long flags);

Answer 1

This structure is architecture dependent so I will just assume you are on x86.

On entry:

  orig_eax = syscall_nr;
  ebx = 1st argument of the function;
  ecx = 2nd arg...
  edx = 3rd arg...
  esi = 4th arg...
  edi = 5th arg... (you are lucky, on other arch this can be on the stack...)

On exit:

  orig_eax = return value of the function

You cannot assume that the value inside ebx,ecx,edx… still points to the argument of the function on exit (i.e. when your post_handler is called) so here you would need to register two handlers, one on entry, from which you can can save a pointer to the struct socket, and one on exit, from which you will actually inspect the content of the struct socket now that it’s been filled. To pass data between the two handlers, you can use the filed data of the kretprobe_instance structure. Don’t forget to increase the data_size filed of the struct kretprobe when you register your kretprobe.

This might seem a little complex but it should be alright once you are a bit more familiar with it.

Please also remember that if the only thing you need to do is trace those events, you might just use the ftrace infrastructure in sysfs and with minimum efforts get the trace that you want.