Gustavo Silva's Techie Blog

Introduction

Processes are the soul of any operating system. One of the major tasks of any operating system is the process management.

At kernel-space level processes are usually called tasks. In GNU/Linux OS each process is identified by a unique Process ID (PID). If you type $ ps -e you will see every process on the system.

This time we will implement a module to backtrace a process (given its PID) until reach its first parent process.

An easy and fast way to access the kernel-space at the user-space level is using the Process File System (procfs).

The Process File System is a Virtual File System (so it is a pseudo-filesystem) used to configure kernel parameters and to obtain information about the system. The information in the Process File System is generated on the fly at the moment it is accessed. The procfs is mounted on the /proc directory.

What is this post about?

What we are going to do here is:

• Implement a kernel module that creates, reads and writes /proc entries.
• Using the echo command a PID will be written to the /proc entry. This PID is the one we want to get the backtrace.
• Using the cat command the back trace will be read from the /proc entry.

Hands at work

First of all we need to create and initialize a proc entry, the proc_dir_entry structure is used for this purpose:

Once we declared our Proc_Parent_Process variable we also shall create a function to read from user-space and write to kernel-space (write data to an entry for this case) and other function to read from kernel-space (read data from an entry for this case) and write to user-space, so for this case we create the following callback functions:

Before we continue we have to notice a little detail here, even when we already declared the Proc_Parent_Process variable we have not crated the proc entry yet. To create the proc entry an to assign this one to the Proc_Parent_Process we use the create_proc_entry function:

OK, at this moment we have what we need to create a proc entry, of course we have to define our read and write functions but at least we can perform the creation and initialization of our proc entry into the init function:

In this case our entry is called parent_process.

Now lets see how to remove the proc entry once we do not need it more. To remove the proc entry we just need to use the remove_proc_entry function:

The arguments mean the same as they mean in the create_proc_entry function declaration. Lets see how our exit function looks:

Perfect! Now we just need to define our read and write functions to start playing around with the echo and cat commands
The definition of our functions is as follows:

Notice that besides Proc_Parent_Process we also shall declare and define the following variables:

OK, now lets see how to use this module.

In your terminal you can type the ps command to see a list of all processes and their PIDs running on the system, then choose anyone and write it to your proc entry.

$ ps -e

You can download this kernel module and the hello one together with their Makefiles and README files from HERE.

I hope someday it helps someone somewhere around the world.
Thanks!