@@ -8,20 +8,20 @@ Kernel Probes (Kprobes)
8
8
9
9
.. CONTENTS
10
10
11
- 1. Concepts: Kprobes, Jprobes, Return Probes
11
+ 1. Concepts: Kprobes, and Return Probes
12
12
2. Architectures Supported
13
13
3. Configuring Kprobes
14
14
4. API Reference
15
15
5. Kprobes Features and Limitations
16
16
6. Probe Overhead
17
17
7. TODO
18
18
8. Kprobes Example
19
- 9. Jprobes Example
20
- 10. Kretprobes Example
19
+ 9. Kretprobes Example
20
+ 10. Deprecated Features
21
21
Appendix A: The kprobes debugfs interface
22
22
Appendix B: The kprobes sysctl interface
23
23
24
- Concepts: Kprobes, Jprobes, Return Probes
24
+ Concepts: Kprobes and Return Probes
25
25
=========================================
26
26
27
27
Kprobes enables you to dynamically break into any kernel routine and
@@ -32,12 +32,10 @@ routine to be invoked when the breakpoint is hit.
32
32
.. [1] some parts of the kernel code can not be trapped, see
33
33
:ref:`kprobes_blacklist`)
34
34
35
- There are currently three types of probes: kprobes, jprobes, and
36
- kretprobes (also called return probes). A kprobe can be inserted
37
- on virtually any instruction in the kernel. A jprobe is inserted at
38
- the entry to a kernel function, and provides convenient access to the
39
- function's arguments. A return probe fires when a specified function
40
- returns.
35
+ There are currently two types of probes: kprobes, and kretprobes
36
+ (also called return probes). A kprobe can be inserted on virtually
37
+ any instruction in the kernel. A return probe fires when a specified
38
+ function returns.
41
39
42
40
In the typical case, Kprobes-based instrumentation is packaged as
43
41
a kernel module. The module's init function installs ("registers")
@@ -82,45 +80,6 @@ After the instruction is single-stepped, Kprobes executes the
82
80
"post_handler," if any, that is associated with the kprobe.
83
81
Execution then continues with the instruction following the probepoint.
84
82
85
- How Does a Jprobe Work?
86
- -----------------------
87
-
88
- A jprobe is implemented using a kprobe that is placed on a function's
89
- entry point. It employs a simple mirroring principle to allow
90
- seamless access to the probed function's arguments. The jprobe
91
- handler routine should have the same signature (arg list and return
92
- type) as the function being probed, and must always end by calling
93
- the Kprobes function jprobe_return().
94
-
95
- Here's how it works. When the probe is hit, Kprobes makes a copy of
96
- the saved registers and a generous portion of the stack (see below).
97
- Kprobes then points the saved instruction pointer at the jprobe's
98
- handler routine, and returns from the trap. As a result, control
99
- passes to the handler, which is presented with the same register and
100
- stack contents as the probed function. When it is done, the handler
101
- calls jprobe_return(), which traps again to restore the original stack
102
- contents and processor state and switch to the probed function.
103
-
104
- By convention, the callee owns its arguments, so gcc may produce code
105
- that unexpectedly modifies that portion of the stack. This is why
106
- Kprobes saves a copy of the stack and restores it after the jprobe
107
- handler has run. Up to MAX_STACK_SIZE bytes are copied -- e.g.,
108
- 64 bytes on i386.
109
-
110
- Note that the probed function's args may be passed on the stack
111
- or in registers. The jprobe will work in either case, so long as the
112
- handler's prototype matches that of the probed function.
113
-
114
- Note that in some architectures (e.g.: arm64 and sparc64) the stack
115
- copy is not done, as the actual location of stacked parameters may be
116
- outside of a reasonable MAX_STACK_SIZE value and because that location
117
- cannot be determined by the jprobes code. In this case the jprobes
118
- user must be careful to make certain the calling signature of the
119
- function does not cause parameters to be passed on the stack (e.g.:
120
- more than eight function arguments, an argument of more than sixteen
121
- bytes, or more than 64 bytes of argument data, depending on
122
- architecture).
123
-
124
83
Return Probes
125
84
-------------
126
85
@@ -245,8 +204,7 @@ Pre-optimization
245
204
After preparing the detour buffer, Kprobes verifies that none of the
246
205
following situations exist:
247
206
248
- - The probe has either a break_handler (i.e., it's a jprobe) or a
249
- post_handler.
207
+ - The probe has a post_handler.
250
208
- Other instructions in the optimized region are probed.
251
209
- The probe is disabled.
252
210
@@ -331,7 +289,7 @@ rejects registering it, if the given address is in the blacklist.
331
289
Architectures Supported
332
290
=======================
333
291
334
- Kprobes, jprobes, and return probes are implemented on the following
292
+ Kprobes and return probes are implemented on the following
335
293
architectures:
336
294
337
295
- i386 (Supports jump optimization)
@@ -446,27 +404,6 @@ architecture-specific trap number associated with the fault (e.g.,
446
404
on i386, 13 for a general protection fault or 14 for a page fault).
447
405
Returns 1 if it successfully handled the exception.
448
406
449
- register_jprobe
450
- ---------------
451
-
452
- ::
453
-
454
- #include <linux/kprobes.h>
455
- int register_jprobe(struct jprobe *jp)
456
-
457
- Sets a breakpoint at the address jp->kp.addr, which must be the address
458
- of the first instruction of a function. When the breakpoint is hit,
459
- Kprobes runs the handler whose address is jp->entry.
460
-
461
- The handler should have the same arg list and return type as the probed
462
- function; and just before it returns, it must call jprobe_return().
463
- (The handler never actually returns, since jprobe_return() returns
464
- control to Kprobes.) If the probed function is declared asmlinkage
465
- or anything else that affects how args are passed, the handler's
466
- declaration must match.
467
-
468
- register_jprobe() returns 0 on success, or a negative errno otherwise.
469
-
470
407
register_kretprobe
471
408
------------------
472
409
@@ -513,7 +450,6 @@ unregister_*probe
513
450
514
451
#include <linux/kprobes.h>
515
452
void unregister_kprobe(struct kprobe *kp);
516
- void unregister_jprobe(struct jprobe *jp);
517
453
void unregister_kretprobe(struct kretprobe *rp);
518
454
519
455
Removes the specified probe. The unregister function can be called
@@ -532,7 +468,6 @@ register_*probes
532
468
#include <linux/kprobes.h>
533
469
int register_kprobes(struct kprobe **kps, int num);
534
470
int register_kretprobes(struct kretprobe **rps, int num);
535
- int register_jprobes(struct jprobe **jps, int num);
536
471
537
472
Registers each of the num probes in the specified array. If any
538
473
error occurs during registration, all probes in the array, up to
@@ -555,7 +490,6 @@ unregister_*probes
555
490
#include <linux/kprobes.h>
556
491
void unregister_kprobes(struct kprobe **kps, int num);
557
492
void unregister_kretprobes(struct kretprobe **rps, int num);
558
- void unregister_jprobes(struct jprobe **jps, int num);
559
493
560
494
Removes each of the num probes in the specified array at once.
561
495
@@ -574,7 +508,6 @@ disable_*probe
574
508
#include <linux/kprobes.h>
575
509
int disable_kprobe(struct kprobe *kp);
576
510
int disable_kretprobe(struct kretprobe *rp);
577
- int disable_jprobe(struct jprobe *jp);
578
511
579
512
Temporarily disables the specified ``*probe``. You can enable it again by using
580
513
enable_*probe(). You must specify the probe which has been registered.
@@ -587,20 +520,17 @@ enable_*probe
587
520
#include <linux/kprobes.h>
588
521
int enable_kprobe(struct kprobe *kp);
589
522
int enable_kretprobe(struct kretprobe *rp);
590
- int enable_jprobe(struct jprobe *jp);
591
523
592
524
Enables ``*probe`` which has been disabled by disable_*probe(). You must specify
593
525
the probe which has been registered.
594
526
595
527
Kprobes Features and Limitations
596
528
================================
597
529
598
- Kprobes allows multiple probes at the same address. Currently,
599
- however, there cannot be multiple jprobes on the same function at
600
- the same time. Also, a probepoint for which there is a jprobe or
601
- a post_handler cannot be optimized. So if you install a jprobe,
602
- or a kprobe with a post_handler, at an optimized probepoint, the
603
- probepoint will be unoptimized automatically.
530
+ Kprobes allows multiple probes at the same address. Also,
531
+ a probepoint for which there is a post_handler cannot be optimized.
532
+ So if you install a kprobe with a post_handler, at an optimized
533
+ probepoint, the probepoint will be unoptimized automatically.
604
534
605
535
In general, you can install a probe anywhere in the kernel.
606
536
In particular, you can probe interrupt handlers. Known exceptions
@@ -662,7 +592,7 @@ We're unaware of other specific cases where this could be a problem.
662
592
If, upon entry to or exit from a function, the CPU is running on
663
593
a stack other than that of the current task, registering a return
664
594
probe on that function may produce undesirable results. For this
665
- reason, Kprobes doesn't support return probes (or kprobes or jprobes )
595
+ reason, Kprobes doesn't support return probes (or kprobes)
666
596
on the x86_64 version of __switch_to(); the registration functions
667
597
return -EINVAL.
668
598
@@ -706,24 +636,24 @@ Probe Overhead
706
636
On a typical CPU in use in 2005, a kprobe hit takes 0.5 to 1.0
707
637
microseconds to process. Specifically, a benchmark that hits the same
708
638
probepoint repeatedly, firing a simple handler each time, reports 1-2
709
- million hits per second, depending on the architecture. A jprobe or
710
- return-probe hit typically takes 50-75% longer than a kprobe hit.
639
+ million hits per second, depending on the architecture. A return-probe
640
+ hit typically takes 50-75% longer than a kprobe hit.
711
641
When you have a return probe set on a function, adding a kprobe at
712
642
the entry to that function adds essentially no overhead.
713
643
714
644
Here are sample overhead figures (in usec) for different architectures::
715
645
716
- k = kprobe; j = jprobe; r = return probe; kr = kprobe + return probe
717
- on same function; jr = jprobe + return probe on same function::
646
+ k = kprobe; r = return probe; kr = kprobe + return probe
647
+ on same function
718
648
719
649
i386: Intel Pentium M, 1495 MHz, 2957.31 bogomips
720
- k = 0.57 usec; j = 1.00; r = 0.92; kr = 0.99; jr = 1.40
650
+ k = 0.57 usec; r = 0.92; kr = 0.99
721
651
722
652
x86_64: AMD Opteron 246, 1994 MHz, 3971.48 bogomips
723
- k = 0.49 usec; j = 0.76; r = 0.80; kr = 0.82; jr = 1.07
653
+ k = 0.49 usec; r = 0.80; kr = 0.82
724
654
725
655
ppc64: POWER5 (gr), 1656 MHz (SMT disabled, 1 virtual CPU per physical CPU)
726
- k = 0.77 usec; j = 1.31; r = 1.26; kr = 1.45; jr = 1.99
656
+ k = 0.77 usec; r = 1.26; kr = 1.45
727
657
728
658
Optimized Probe Overhead
729
659
------------------------
@@ -755,11 +685,6 @@ Kprobes Example
755
685
756
686
See samples/kprobes/kprobe_example.c
757
687
758
- Jprobes Example
759
- ===============
760
-
761
- See samples/kprobes/jprobe_example.c
762
-
763
688
Kretprobes Example
764
689
==================
765
690
@@ -772,6 +697,37 @@ For additional information on Kprobes, refer to the following URLs:
772
697
- http://www-users.cs.umn.edu/~boutcher/kprobes/
773
698
- http://www.linuxsymposium.org/2006/linuxsymposium_procv2.pdf (pages 101-115)
774
699
700
+ Deprecated Features
701
+ ===================
702
+
703
+ Jprobes is now a deprecated feature. People who are depending on it should
704
+ migrate to other tracing features or use older kernels. Please consider to
705
+ migrate your tool to one of the following options:
706
+
707
+ - Use trace-event to trace target function with arguments.
708
+
709
+ trace-event is a low-overhead (and almost no visible overhead if it
710
+ is off) statically defined event interface. You can define new events
711
+ and trace it via ftrace or any other tracing tools.
712
+
713
+ See the following urls:
714
+
715
+ - https://lwn.net/Articles/379903/
716
+ - https://lwn.net/Articles/381064/
717
+ - https://lwn.net/Articles/383362/
718
+
719
+ - Use ftrace dynamic events (kprobe event) with perf-probe.
720
+
721
+ If you build your kernel with debug info (CONFIG_DEBUG_INFO=y), you can
722
+ find which register/stack is assigned to which local variable or arguments
723
+ by using perf-probe and set up new event to trace it.
724
+
725
+ See following documents:
726
+
727
+ - Documentation/trace/kprobetrace.txt
728
+ - Documentation/trace/events.txt
729
+ - tools/perf/Documentation/perf-probe.txt
730
+
775
731
776
732
The kprobes debugfs interface
777
733
=============================
@@ -783,14 +739,13 @@ under the /sys/kernel/debug/kprobes/ directory (assuming debugfs is mounted at /
783
739
/sys/kernel/debug/kprobes/list: Lists all registered probes on the system::
784
740
785
741
c015d71a k vfs_read+0x0
786
- c011a316 j do_fork+0x0
787
742
c03dedc5 r tcp_v4_rcv+0x0
788
743
789
744
The first column provides the kernel address where the probe is inserted.
790
- The second column identifies the type of probe (k - kprobe, r - kretprobe
791
- and j - jprobe), while the third column specifies the symbol+offset of
792
- the probe. If the probed function belongs to a module, the module name
793
- is also specified. Following columns show probe status. If the probe is on
745
+ The second column identifies the type of probe (k - kprobe and r - kretprobe)
746
+ while the third column specifies the symbol+offset of the probe.
747
+ If the probed function belongs to a module, the module name is also
748
+ specified. Following columns show probe status. If the probe is on
794
749
a virtual address that is no longer valid (module init sections, module
795
750
virtual addresses that correspond to modules that've been unloaded),
796
751
such probes are marked with [GONE]. If the probe is temporarily disabled,
0 commit comments