diff options
| author | Masami Hiramatsu <mhiramat@kernel.org> | 2017-10-05 19:16:37 -0400 |
|---|---|---|
| committer | Ingo Molnar <mingo@kernel.org> | 2017-10-20 05:02:55 -0400 |
| commit | 9b17374e11c7ce2cf0b2b990fa4aa0360921aa2b (patch) | |
| tree | 21e9e3899485ef3f1262650e3be5cb245aa070d5 /Documentation/kprobes.txt | |
| parent | 9be95bdc53c12ada23e39027237fd05e1393d893 (diff) | |
kprobes/docs: Remove jprobes related documents
Remove jprobes related documentation from kprobes.txt.
Also add some migration advice for the people who are
still using jprobes.
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Ananth N Mavinakayanahalli <ananth@linux.vnet.ibm.com>
Cc: Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
Cc: David S . Miller <davem@davemloft.net>
Cc: Ian McDonald <ian.mcdonald@jandi.co.nz>
Cc: Kees Cook <keescook@chromium.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Paul E . McKenney <paulmck@linux.vnet.ibm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephen Hemminger <stephen@networkplumber.org>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vlad Yasevich <vyasevich@gmail.com>
Link: http://lkml.kernel.org/r/150724539698.5014.7300022363980503141.stgit@devbox
[ Fixes to the new documentation. ]
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Diffstat (limited to 'Documentation/kprobes.txt')
| -rw-r--r-- | Documentation/kprobes.txt | 159 |
1 files changed, 57 insertions, 102 deletions
diff --git a/Documentation/kprobes.txt b/Documentation/kprobes.txt index 2335715bf471..22208bf2386d 100644 --- a/Documentation/kprobes.txt +++ b/Documentation/kprobes.txt | |||
| @@ -8,7 +8,7 @@ Kernel Probes (Kprobes) | |||
| 8 | 8 | ||
| 9 | .. CONTENTS | 9 | .. CONTENTS |
| 10 | 10 | ||
| 11 | 1. Concepts: Kprobes, Jprobes, Return Probes | 11 | 1. Concepts: Kprobes, and Return Probes |
| 12 | 2. Architectures Supported | 12 | 2. Architectures Supported |
| 13 | 3. Configuring Kprobes | 13 | 3. Configuring Kprobes |
| 14 | 4. API Reference | 14 | 4. API Reference |
| @@ -16,12 +16,12 @@ Kernel Probes (Kprobes) | |||
| 16 | 6. Probe Overhead | 16 | 6. Probe Overhead |
| 17 | 7. TODO | 17 | 7. TODO |
| 18 | 8. Kprobes Example | 18 | 8. Kprobes Example |
| 19 | 9. Jprobes Example | 19 | 9. Kretprobes Example |
| 20 | 10. Kretprobes Example | 20 | 10. Deprecated Features |
| 21 | Appendix A: The kprobes debugfs interface | 21 | Appendix A: The kprobes debugfs interface |
| 22 | Appendix B: The kprobes sysctl interface | 22 | Appendix B: The kprobes sysctl interface |
| 23 | 23 | ||
| 24 | Concepts: Kprobes, Jprobes, Return Probes | 24 | Concepts: Kprobes and Return Probes |
| 25 | ========================================= | 25 | ========================================= |
| 26 | 26 | ||
| 27 | Kprobes enables you to dynamically break into any kernel routine and | 27 | Kprobes enables you to dynamically break into any kernel routine and |
| @@ -32,12 +32,10 @@ routine to be invoked when the breakpoint is hit. | |||
| 32 | .. [1] some parts of the kernel code can not be trapped, see | 32 | .. [1] some parts of the kernel code can not be trapped, see |
| 33 | :ref:`kprobes_blacklist`) | 33 | :ref:`kprobes_blacklist`) |
| 34 | 34 | ||
| 35 | There are currently three types of probes: kprobes, jprobes, and | 35 | There are currently two types of probes: kprobes, and kretprobes |
| 36 | kretprobes (also called return probes). A kprobe can be inserted | 36 | (also called return probes). A kprobe can be inserted on virtually |
| 37 | on virtually any instruction in the kernel. A jprobe is inserted at | 37 | any instruction in the kernel. A return probe fires when a specified |
| 38 | the entry to a kernel function, and provides convenient access to the | 38 | function returns. |
| 39 | function's arguments. A return probe fires when a specified function | ||
| 40 | returns. | ||
| 41 | 39 | ||
| 42 | In the typical case, Kprobes-based instrumentation is packaged as | 40 | In the typical case, Kprobes-based instrumentation is packaged as |
| 43 | a kernel module. The module's init function installs ("registers") | 41 | a kernel module. The module's init function installs ("registers") |
| @@ -82,45 +80,6 @@ After the instruction is single-stepped, Kprobes executes the | |||
| 82 | "post_handler," if any, that is associated with the kprobe. | 80 | "post_handler," if any, that is associated with the kprobe. |
| 83 | Execution then continues with the instruction following the probepoint. | 81 | Execution then continues with the instruction following the probepoint. |
| 84 | 82 | ||
| 85 | How Does a Jprobe Work? | ||
| 86 | ----------------------- | ||
| 87 | |||
| 88 | A jprobe is implemented using a kprobe that is placed on a function's | ||
| 89 | entry point. It employs a simple mirroring principle to allow | ||
| 90 | seamless access to the probed function's arguments. The jprobe | ||
| 91 | handler routine should have the same signature (arg list and return | ||
| 92 | type) as the function being probed, and must always end by calling | ||
| 93 | the Kprobes function jprobe_return(). | ||
| 94 | |||
| 95 | Here's how it works. When the probe is hit, Kprobes makes a copy of | ||
| 96 | the saved registers and a generous portion of the stack (see below). | ||
| 97 | Kprobes then points the saved instruction pointer at the jprobe's | ||
| 98 | handler routine, and returns from the trap. As a result, control | ||
| 99 | passes to the handler, which is presented with the same register and | ||
| 100 | stack contents as the probed function. When it is done, the handler | ||
| 101 | calls jprobe_return(), which traps again to restore the original stack | ||
| 102 | contents and processor state and switch to the probed function. | ||
| 103 | |||
| 104 | By convention, the callee owns its arguments, so gcc may produce code | ||
| 105 | that unexpectedly modifies that portion of the stack. This is why | ||
| 106 | Kprobes saves a copy of the stack and restores it after the jprobe | ||
| 107 | handler has run. Up to MAX_STACK_SIZE bytes are copied -- e.g., | ||
| 108 | 64 bytes on i386. | ||
| 109 | |||
| 110 | Note that the probed function's args may be passed on the stack | ||
| 111 | or in registers. The jprobe will work in either case, so long as the | ||
| 112 | handler's prototype matches that of the probed function. | ||
| 113 | |||
| 114 | Note that in some architectures (e.g.: arm64 and sparc64) the stack | ||
| 115 | copy is not done, as the actual location of stacked parameters may be | ||
| 116 | outside of a reasonable MAX_STACK_SIZE value and because that location | ||
| 117 | cannot be determined by the jprobes code. In this case the jprobes | ||
| 118 | user must be careful to make certain the calling signature of the | ||
| 119 | function does not cause parameters to be passed on the stack (e.g.: | ||
| 120 | more than eight function arguments, an argument of more than sixteen | ||
| 121 | bytes, or more than 64 bytes of argument data, depending on | ||
| 122 | architecture). | ||
| 123 | |||
| 124 | Return Probes | 83 | Return Probes |
| 125 | ------------- | 84 | ------------- |
| 126 | 85 | ||
| @@ -245,8 +204,7 @@ Pre-optimization | |||
| 245 | After preparing the detour buffer, Kprobes verifies that none of the | 204 | After preparing the detour buffer, Kprobes verifies that none of the |
| 246 | following situations exist: | 205 | following situations exist: |
| 247 | 206 | ||
| 248 | - The probe has either a break_handler (i.e., it's a jprobe) or a | 207 | - The probe has a post_handler. |
| 249 | post_handler. | ||
| 250 | - Other instructions in the optimized region are probed. | 208 | - Other instructions in the optimized region are probed. |
| 251 | - The probe is disabled. | 209 | - The probe is disabled. |
| 252 | 210 | ||
| @@ -331,7 +289,7 @@ rejects registering it, if the given address is in the blacklist. | |||
| 331 | Architectures Supported | 289 | Architectures Supported |
| 332 | ======================= | 290 | ======================= |
| 333 | 291 | ||
| 334 | Kprobes, jprobes, and return probes are implemented on the following | 292 | Kprobes and return probes are implemented on the following |
| 335 | architectures: | 293 | architectures: |
| 336 | 294 | ||
| 337 | - i386 (Supports jump optimization) | 295 | - i386 (Supports jump optimization) |
| @@ -446,27 +404,6 @@ architecture-specific trap number associated with the fault (e.g., | |||
| 446 | on i386, 13 for a general protection fault or 14 for a page fault). | 404 | on i386, 13 for a general protection fault or 14 for a page fault). |
| 447 | Returns 1 if it successfully handled the exception. | 405 | Returns 1 if it successfully handled the exception. |
| 448 | 406 | ||
| 449 | register_jprobe | ||
| 450 | --------------- | ||
| 451 | |||
| 452 | :: | ||
| 453 | |||
| 454 | #include <linux/kprobes.h> | ||
| 455 | int register_jprobe(struct jprobe *jp) | ||
| 456 | |||
| 457 | Sets a breakpoint at the address jp->kp.addr, which must be the address | ||
| 458 | of the first instruction of a function. When the breakpoint is hit, | ||
| 459 | Kprobes runs the handler whose address is jp->entry. | ||
| 460 | |||
| 461 | The handler should have the same arg list and return type as the probed | ||
| 462 | function; and just before it returns, it must call jprobe_return(). | ||
| 463 | (The handler never actually returns, since jprobe_return() returns | ||
| 464 | control to Kprobes.) If the probed function is declared asmlinkage | ||
| 465 | or anything else that affects how args are passed, the handler's | ||
| 466 | declaration must match. | ||
| 467 | |||
| 468 | register_jprobe() returns 0 on success, or a negative errno otherwise. | ||
| 469 | |||
| 470 | register_kretprobe | 407 | register_kretprobe |
| 471 | ------------------ | 408 | ------------------ |
| 472 | 409 | ||
| @@ -513,7 +450,6 @@ unregister_*probe | |||
| 513 | 450 | ||
| 514 | #include <linux/kprobes.h> | 451 | #include <linux/kprobes.h> |
| 515 | void unregister_kprobe(struct kprobe *kp); | 452 | void unregister_kprobe(struct kprobe *kp); |
| 516 | void unregister_jprobe(struct jprobe *jp); | ||
| 517 | void unregister_kretprobe(struct kretprobe *rp); | 453 | void unregister_kretprobe(struct kretprobe *rp); |
| 518 | 454 | ||
| 519 | Removes the specified probe. The unregister function can be called | 455 | Removes the specified probe. The unregister function can be called |
| @@ -532,7 +468,6 @@ register_*probes | |||
| 532 | #include <linux/kprobes.h> | 468 | #include <linux/kprobes.h> |
| 533 | int register_kprobes(struct kprobe **kps, int num); | 469 | int register_kprobes(struct kprobe **kps, int num); |
| 534 | int register_kretprobes(struct kretprobe **rps, int num); | 470 | int register_kretprobes(struct kretprobe **rps, int num); |
| 535 | int register_jprobes(struct jprobe **jps, int num); | ||
| 536 | 471 | ||
| 537 | Registers each of the num probes in the specified array. If any | 472 | Registers each of the num probes in the specified array. If any |
| 538 | error occurs during registration, all probes in the array, up to | 473 | error occurs during registration, all probes in the array, up to |
| @@ -555,7 +490,6 @@ unregister_*probes | |||
| 555 | #include <linux/kprobes.h> | 490 | #include <linux/kprobes.h> |
| 556 | void unregister_kprobes(struct kprobe **kps, int num); | 491 | void unregister_kprobes(struct kprobe **kps, int num); |
| 557 | void unregister_kretprobes(struct kretprobe **rps, int num); | 492 | void unregister_kretprobes(struct kretprobe **rps, int num); |
| 558 | void unregister_jprobes(struct jprobe **jps, int num); | ||
| 559 | 493 | ||
| 560 | Removes each of the num probes in the specified array at once. | 494 | Removes each of the num probes in the specified array at once. |
| 561 | 495 | ||
| @@ -574,7 +508,6 @@ disable_*probe | |||
| 574 | #include <linux/kprobes.h> | 508 | #include <linux/kprobes.h> |
| 575 | int disable_kprobe(struct kprobe *kp); | 509 | int disable_kprobe(struct kprobe *kp); |
| 576 | int disable_kretprobe(struct kretprobe *rp); | 510 | int disable_kretprobe(struct kretprobe *rp); |
| 577 | int disable_jprobe(struct jprobe *jp); | ||
| 578 | 511 | ||
| 579 | Temporarily disables the specified ``*probe``. You can enable it again by using | 512 | Temporarily disables the specified ``*probe``. You can enable it again by using |
| 580 | enable_*probe(). You must specify the probe which has been registered. | 513 | enable_*probe(). You must specify the probe which has been registered. |
| @@ -587,7 +520,6 @@ enable_*probe | |||
| 587 | #include <linux/kprobes.h> | 520 | #include <linux/kprobes.h> |
| 588 | int enable_kprobe(struct kprobe *kp); | 521 | int enable_kprobe(struct kprobe *kp); |
| 589 | int enable_kretprobe(struct kretprobe *rp); | 522 | int enable_kretprobe(struct kretprobe *rp); |
| 590 | int enable_jprobe(struct jprobe *jp); | ||
| 591 | 523 | ||
| 592 | Enables ``*probe`` which has been disabled by disable_*probe(). You must specify | 524 | Enables ``*probe`` which has been disabled by disable_*probe(). You must specify |
| 593 | the probe which has been registered. | 525 | the probe which has been registered. |
| @@ -595,12 +527,10 @@ the probe which has been registered. | |||
| 595 | Kprobes Features and Limitations | 527 | Kprobes Features and Limitations |
| 596 | ================================ | 528 | ================================ |
| 597 | 529 | ||
| 598 | Kprobes allows multiple probes at the same address. Currently, | 530 | Kprobes allows multiple probes at the same address. Also, |
| 599 | however, there cannot be multiple jprobes on the same function at | 531 | a probepoint for which there is a post_handler cannot be optimized. |
| 600 | the same time. Also, a probepoint for which there is a jprobe or | 532 | So if you install a kprobe with a post_handler, at an optimized |
| 601 | a post_handler cannot be optimized. So if you install a jprobe, | 533 | probepoint, the probepoint will be unoptimized automatically. |
| 602 | or a kprobe with a post_handler, at an optimized probepoint, the | ||
| 603 | probepoint will be unoptimized automatically. | ||
| 604 | 534 | ||
| 605 | In general, you can install a probe anywhere in the kernel. | 535 | In general, you can install a probe anywhere in the kernel. |
| 606 | In particular, you can probe interrupt handlers. Known exceptions | 536 | In particular, you can probe interrupt handlers. Known exceptions |
| @@ -662,7 +592,7 @@ We're unaware of other specific cases where this could be a problem. | |||
| 662 | If, upon entry to or exit from a function, the CPU is running on | 592 | If, upon entry to or exit from a function, the CPU is running on |
| 663 | a stack other than that of the current task, registering a return | 593 | a stack other than that of the current task, registering a return |
| 664 | probe on that function may produce undesirable results. For this | 594 | probe on that function may produce undesirable results. For this |
| 665 | reason, Kprobes doesn't support return probes (or kprobes or jprobes) | 595 | reason, Kprobes doesn't support return probes (or kprobes) |
| 666 | on the x86_64 version of __switch_to(); the registration functions | 596 | on the x86_64 version of __switch_to(); the registration functions |
| 667 | return -EINVAL. | 597 | return -EINVAL. |
| 668 | 598 | ||
| @@ -706,24 +636,24 @@ Probe Overhead | |||
| 706 | On a typical CPU in use in 2005, a kprobe hit takes 0.5 to 1.0 | 636 | On a typical CPU in use in 2005, a kprobe hit takes 0.5 to 1.0 |
| 707 | microseconds to process. Specifically, a benchmark that hits the same | 637 | microseconds to process. Specifically, a benchmark that hits the same |
| 708 | probepoint repeatedly, firing a simple handler each time, reports 1-2 | 638 | probepoint repeatedly, firing a simple handler each time, reports 1-2 |
| 709 | million hits per second, depending on the architecture. A jprobe or | 639 | million hits per second, depending on the architecture. A return-probe |
| 710 | return-probe hit typically takes 50-75% longer than a kprobe hit. | 640 | hit typically takes 50-75% longer than a kprobe hit. |
| 711 | When you have a return probe set on a function, adding a kprobe at | 641 | When you have a return probe set on a function, adding a kprobe at |
| 712 | the entry to that function adds essentially no overhead. | 642 | the entry to that function adds essentially no overhead. |
| 713 | 643 | ||
| 714 | Here are sample overhead figures (in usec) for different architectures:: | 644 | Here are sample overhead figures (in usec) for different architectures:: |
| 715 | 645 | ||
| 716 | k = kprobe; j = jprobe; r = return probe; kr = kprobe + return probe | 646 | k = kprobe; r = return probe; kr = kprobe + return probe |
| 717 | on same function; jr = jprobe + return probe on same function:: | 647 | on same function |
| 718 | 648 | ||
| 719 | i386: Intel Pentium M, 1495 MHz, 2957.31 bogomips | 649 | i386: Intel Pentium M, 1495 MHz, 2957.31 bogomips |
| 720 | k = 0.57 usec; j = 1.00; r = 0.92; kr = 0.99; jr = 1.40 | 650 | k = 0.57 usec; r = 0.92; kr = 0.99 |
| 721 | 651 | ||
| 722 | x86_64: AMD Opteron 246, 1994 MHz, 3971.48 bogomips | 652 | x86_64: AMD Opteron 246, 1994 MHz, 3971.48 bogomips |
| 723 | k = 0.49 usec; j = 0.76; r = 0.80; kr = 0.82; jr = 1.07 | 653 | k = 0.49 usec; r = 0.80; kr = 0.82 |
| 724 | 654 | ||
| 725 | ppc64: POWER5 (gr), 1656 MHz (SMT disabled, 1 virtual CPU per physical CPU) | 655 | ppc64: POWER5 (gr), 1656 MHz (SMT disabled, 1 virtual CPU per physical CPU) |
| 726 | k = 0.77 usec; j = 1.31; r = 1.26; kr = 1.45; jr = 1.99 | 656 | k = 0.77 usec; r = 1.26; kr = 1.45 |
| 727 | 657 | ||
| 728 | Optimized Probe Overhead | 658 | Optimized Probe Overhead |
| 729 | ------------------------ | 659 | ------------------------ |
| @@ -755,11 +685,6 @@ Kprobes Example | |||
| 755 | 685 | ||
| 756 | See samples/kprobes/kprobe_example.c | 686 | See samples/kprobes/kprobe_example.c |
| 757 | 687 | ||
| 758 | Jprobes Example | ||
| 759 | =============== | ||
| 760 | |||
| 761 | See samples/kprobes/jprobe_example.c | ||
| 762 | |||
| 763 | Kretprobes Example | 688 | Kretprobes Example |
| 764 | ================== | 689 | ================== |
| 765 | 690 | ||
| @@ -772,6 +697,37 @@ For additional information on Kprobes, refer to the following URLs: | |||
| 772 | - http://www-users.cs.umn.edu/~boutcher/kprobes/ | 697 | - http://www-users.cs.umn.edu/~boutcher/kprobes/ |
| 773 | - http://www.linuxsymposium.org/2006/linuxsymposium_procv2.pdf (pages 101-115) | 698 | - http://www.linuxsymposium.org/2006/linuxsymposium_procv2.pdf (pages 101-115) |
| 774 | 699 | ||
| 700 | Deprecated Features | ||
| 701 | =================== | ||
| 702 | |||
| 703 | Jprobes is now a deprecated feature. People who are depending on it should | ||
| 704 | migrate to other tracing features or use older kernels. Please consider to | ||
| 705 | migrate your tool to one of the following options: | ||
| 706 | |||
| 707 | - Use trace-event to trace target function with arguments. | ||
| 708 | |||
| 709 | trace-event is a low-overhead (and almost no visible overhead if it | ||
| 710 | is off) statically defined event interface. You can define new events | ||
| 711 | and trace it via ftrace or any other tracing tools. | ||
| 712 | |||
| 713 | See the following urls: | ||
| 714 | |||
| 715 | - https://lwn.net/Articles/379903/ | ||
| 716 | - https://lwn.net/Articles/381064/ | ||
| 717 | - https://lwn.net/Articles/383362/ | ||
| 718 | |||
| 719 | - Use ftrace dynamic events (kprobe event) with perf-probe. | ||
| 720 | |||
| 721 | If you build your kernel with debug info (CONFIG_DEBUG_INFO=y), you can | ||
| 722 | find which register/stack is assigned to which local variable or arguments | ||
| 723 | by using perf-probe and set up new event to trace it. | ||
| 724 | |||
| 725 | See following documents: | ||
| 726 | |||
| 727 | - Documentation/trace/kprobetrace.txt | ||
| 728 | - Documentation/trace/events.txt | ||
| 729 | - tools/perf/Documentation/perf-probe.txt | ||
| 730 | |||
| 775 | 731 | ||
| 776 | The kprobes debugfs interface | 732 | The kprobes debugfs interface |
| 777 | ============================= | 733 | ============================= |
| @@ -783,14 +739,13 @@ under the /sys/kernel/debug/kprobes/ directory (assuming debugfs is mounted at / | |||
| 783 | /sys/kernel/debug/kprobes/list: Lists all registered probes on the system:: | 739 | /sys/kernel/debug/kprobes/list: Lists all registered probes on the system:: |
| 784 | 740 | ||
| 785 | c015d71a k vfs_read+0x0 | 741 | c015d71a k vfs_read+0x0 |
| 786 | c011a316 j do_fork+0x0 | ||
| 787 | c03dedc5 r tcp_v4_rcv+0x0 | 742 | c03dedc5 r tcp_v4_rcv+0x0 |
| 788 | 743 | ||
| 789 | The first column provides the kernel address where the probe is inserted. | 744 | The first column provides the kernel address where the probe is inserted. |
| 790 | The second column identifies the type of probe (k - kprobe, r - kretprobe | 745 | The second column identifies the type of probe (k - kprobe and r - kretprobe) |
| 791 | and j - jprobe), while the third column specifies the symbol+offset of | 746 | while the third column specifies the symbol+offset of the probe. |
| 792 | the probe. If the probed function belongs to a module, the module name | 747 | If the probed function belongs to a module, the module name is also |
| 793 | is also specified. Following columns show probe status. If the probe is on | 748 | specified. Following columns show probe status. If the probe is on |
| 794 | a virtual address that is no longer valid (module init sections, module | 749 | a virtual address that is no longer valid (module init sections, module |
| 795 | virtual addresses that correspond to modules that've been unloaded), | 750 | virtual addresses that correspond to modules that've been unloaded), |
| 796 | such probes are marked with [GONE]. If the probe is temporarily disabled, | 751 | such probes are marked with [GONE]. If the probe is temporarily disabled, |
