0

I'm trying to track the life span of a user thread in a kernel module. I want to detect when a user thread is no longer executing (exit() has been called). How would I go about doing that? I'm digging into the kernel source code as I write this, but there's a lot to take in!

I did find task_struct.vfork_done, and it looks like something I can hook into. Am I on the right track?

Jörgen Sigvardsson
  • 4,839
  • 3
  • 28
  • 51

1 Answers1

1

Before anything, let me confirm that by 'no longer executing' you mean the process has been signaled to die and will soon expire. If I were you, I would register a notification chain within a simple misc driver module.

I would then trigger the notification from within the signal handling code of the kernel when the process under question has been signalled with a fatal signal. I would specifically tinker with the function get_signal_to_deliver (kernel/signal.c). I've recently answered a similar query here

Community
  • 1
  • 1
AjB
  • 890
  • 13
  • 34
  • By "no longer executing", I mean a thread that will no longer run in user code (i.e., main isn't in its callstack, nor is any signal handlers or atexit callbacks). Sounds like your answer covers it. I'll mark it as accepted, because it sounds plausible, and at the very least, it gives me some research material. Thanks! – Jörgen Sigvardsson Jan 15 '14 at 19:38
  • @Jorgen Im glad you found my answer useful Jorgen. There could be other ways of doing it but I think this could be the easiest or the most straightforward. Your query is quite interesting. What is it for by the way (if I may ask)? Do let me know how did you finally manage it? Do you blog somewhere? – AjB Jan 16 '14 at 02:06
  • I'm working on a profiler tool for a client that runs code in an embedded real time system. The idea is to simulate what happens when the L1-cache goes cold, and see what impact it has on the overall execution. The code under test is critical, so they really need to know down to the microsecond what effect(s) cold cache has. There are scenarios when the thread being profiled/tested may not be able to clean up associated kernel resources (my stuff), so I want a failsafe. – Jörgen Sigvardsson Jan 16 '14 at 12:21
  • I don't really blog, because I'm a terrible writer. :) – Jörgen Sigvardsson Jan 16 '14 at 12:22