kprobe监控tcp_v4_connect

#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/kprobes.h>
#include <linux/init.h>
#include <linux/uaccess.h>
#include <linux/inet.h>
#include <net/inet_sock.h>
#include <linux/limits.h>

static char func_name[NAME_MAX] = "tcp_v4_connect";
module_param_string(func, func_name, NAME_MAX, 0644);
MODULE_PARM_DESC(func, "Function to kretprobe; this module will report the"
		               " function's execution time");

static struct kprobe kp = {
	.symbol_name	= func_name
};

static int handler_pre(struct kprobe *p, struct pt_regs *regs)
{
	struct sockaddr_in *usin = (struct sockaddr_in *)(regs->si);
	struct inet_sock *inet = inet_sk((struct sock *)(regs->di));
	__be16 sport = inet->inet_sport;
	__be32 saddr = inet->inet_saddr;
	__be32 daddr = usin->sin_addr.s_addr;

	printk(KERN_INFO "command: %s, pid: %d, src ip: %u.%u.%u.%u, src port: %d, dest ip: %u.%u.%u.%u, dest port: %d\n",
		   current->comm,
		   current->pid,
           ((unsigned char *)&saddr)[0],
           ((unsigned char *)&saddr)[1],
           ((unsigned char *)&saddr)[2],
           ((unsigned char *)&saddr)[3],
	       be16_to_cpu(sport),
	       ((unsigned char *)&daddr)[0],
	       ((unsigned char *)&daddr)[1],
	       ((unsigned char *)&daddr)[2],
	       ((unsigned char *)&daddr)[3],
	       be16_to_cpu(usin->sin_port));

	return 0;
}

static void handler_post(struct kprobe *p, struct pt_regs *regs,
			             unsigned long flags)
{
	printk(KERN_INFO "post_handler: p->addr = 0x%p, flags = 0x%lx\n",
		   p->addr, regs->flags);
}

static int handler_fault(struct kprobe *p, struct pt_regs *regs, int trapnr)
{
	printk(KERN_INFO "fault_handler: p->addr = 0x%p, trap #%d\n",
		   p->addr, trapnr);
	return 0;
}

static int __init kprobe_init(void)
{
	int ret;
	kp.pre_handler = handler_pre;
	kp.post_handler = handler_post;
	kp.fault_handler = handler_fault;

	ret = register_kprobe(&kp);
	if (ret < 0) {
		printk(KERN_INFO "register_kprobe failed, returned %d\n", ret);
		return ret;
	}
	printk(KERN_INFO "Planted kprobe at %p\n", kp.addr);
	return 0;
}

static void __exit kprobe_exit(void)
{
	unregister_kprobe(&kp);
	printk(KERN_INFO "kprobe at %p unregistered\n", kp.addr);
}

module_init(kprobe_init)
module_exit(kprobe_exit)
MODULE_LICENSE("GPL");

obj-m+=kprobe_sample.o
CONFIG_MODULE_SIG=n
all:
        make -C /lib/modules/$(shell uname -r)/build/ M=$(PWD) modules
clean:
        make -C /lib/modules/$(shell uname -r)/build/ M=$(PWD) clean

X86架构64位内核函数调用传参数使用的寄存器（calling.h）