aboutsummaryrefslogtreecommitdiffstats
path: root/Documentation/kprobes.txt
diff options
context:
space:
mode:
authorMasami Hiramatsu <mhiramat@kernel.org>2017-10-05 19:16:37 -0400
committerIngo Molnar <mingo@kernel.org>2017-10-20 05:02:55 -0400
commit9b17374e11c7ce2cf0b2b990fa4aa0360921aa2b (patch)
tree21e9e3899485ef3f1262650e3be5cb245aa070d5 /Documentation/kprobes.txt
parent9be95bdc53c12ada23e39027237fd05e1393d893 (diff)
kprobes/docs: Remove jprobes related documents
Remove jprobes related documentation from kprobes.txt. Also add some migration advice for the people who are still using jprobes. Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org> Cc: Alexei Starovoitov <ast@kernel.org> Cc: Ananth N Mavinakayanahalli <ananth@linux.vnet.ibm.com> Cc: Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com> Cc: David S . Miller <davem@davemloft.net> Cc: Ian McDonald <ian.mcdonald@jandi.co.nz> Cc: Kees Cook <keescook@chromium.org> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Paul E . McKenney <paulmck@linux.vnet.ibm.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Stephen Hemminger <stephen@networkplumber.org> Cc: Steven Rostedt <rostedt@goodmis.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Vlad Yasevich <vyasevich@gmail.com> Link: http://lkml.kernel.org/r/150724539698.5014.7300022363980503141.stgit@devbox [ Fixes to the new documentation. ] Signed-off-by: Ingo Molnar <mingo@kernel.org>
Diffstat (limited to 'Documentation/kprobes.txt')
-rw-r--r--Documentation/kprobes.txt159
1 files changed, 57 insertions, 102 deletions
diff --git a/Documentation/kprobes.txt b/Documentation/kprobes.txt
index 2335715bf471..22208bf2386d 100644
--- a/Documentation/kprobes.txt
+++ b/Documentation/kprobes.txt
@@ -8,7 +8,7 @@ Kernel Probes (Kprobes)
8 8
9.. CONTENTS 9.. CONTENTS
10 10
11 1. Concepts: Kprobes, Jprobes, Return Probes 11 1. Concepts: Kprobes, and Return Probes
12 2. Architectures Supported 12 2. Architectures Supported
13 3. Configuring Kprobes 13 3. Configuring Kprobes
14 4. API Reference 14 4. API Reference
@@ -16,12 +16,12 @@ Kernel Probes (Kprobes)
16 6. Probe Overhead 16 6. Probe Overhead
17 7. TODO 17 7. TODO
18 8. Kprobes Example 18 8. Kprobes Example
19 9. Jprobes Example 19 9. Kretprobes Example
20 10. Kretprobes Example 20 10. Deprecated Features
21 Appendix A: The kprobes debugfs interface 21 Appendix A: The kprobes debugfs interface
22 Appendix B: The kprobes sysctl interface 22 Appendix B: The kprobes sysctl interface
23 23
24Concepts: Kprobes, Jprobes, Return Probes 24Concepts: Kprobes and Return Probes
25========================================= 25=========================================
26 26
27Kprobes enables you to dynamically break into any kernel routine and 27Kprobes enables you to dynamically break into any kernel routine and
@@ -32,12 +32,10 @@ routine to be invoked when the breakpoint is hit.
32.. [1] some parts of the kernel code can not be trapped, see 32.. [1] some parts of the kernel code can not be trapped, see
33 :ref:`kprobes_blacklist`) 33 :ref:`kprobes_blacklist`)
34 34
35There are currently three types of probes: kprobes, jprobes, and 35There are currently two types of probes: kprobes, and kretprobes
36kretprobes (also called return probes). A kprobe can be inserted 36(also called return probes). A kprobe can be inserted on virtually
37on virtually any instruction in the kernel. A jprobe is inserted at 37any instruction in the kernel. A return probe fires when a specified
38the entry to a kernel function, and provides convenient access to the 38function returns.
39function's arguments. A return probe fires when a specified function
40returns.
41 39
42In the typical case, Kprobes-based instrumentation is packaged as 40In the typical case, Kprobes-based instrumentation is packaged as
43a kernel module. The module's init function installs ("registers") 41a kernel module. The module's init function installs ("registers")
@@ -82,45 +80,6 @@ After the instruction is single-stepped, Kprobes executes the
82"post_handler," if any, that is associated with the kprobe. 80"post_handler," if any, that is associated with the kprobe.
83Execution then continues with the instruction following the probepoint. 81Execution then continues with the instruction following the probepoint.
84 82
85How Does a Jprobe Work?
86-----------------------
87
88A jprobe is implemented using a kprobe that is placed on a function's
89entry point. It employs a simple mirroring principle to allow
90seamless access to the probed function's arguments. The jprobe
91handler routine should have the same signature (arg list and return
92type) as the function being probed, and must always end by calling
93the Kprobes function jprobe_return().
94
95Here's how it works. When the probe is hit, Kprobes makes a copy of
96the saved registers and a generous portion of the stack (see below).
97Kprobes then points the saved instruction pointer at the jprobe's
98handler routine, and returns from the trap. As a result, control
99passes to the handler, which is presented with the same register and
100stack contents as the probed function. When it is done, the handler
101calls jprobe_return(), which traps again to restore the original stack
102contents and processor state and switch to the probed function.
103
104By convention, the callee owns its arguments, so gcc may produce code
105that unexpectedly modifies that portion of the stack. This is why
106Kprobes saves a copy of the stack and restores it after the jprobe
107handler has run. Up to MAX_STACK_SIZE bytes are copied -- e.g.,
10864 bytes on i386.
109
110Note that the probed function's args may be passed on the stack
111or in registers. The jprobe will work in either case, so long as the
112handler's prototype matches that of the probed function.
113
114Note that in some architectures (e.g.: arm64 and sparc64) the stack
115copy is not done, as the actual location of stacked parameters may be
116outside of a reasonable MAX_STACK_SIZE value and because that location
117cannot be determined by the jprobes code. In this case the jprobes
118user must be careful to make certain the calling signature of the
119function does not cause parameters to be passed on the stack (e.g.:
120more than eight function arguments, an argument of more than sixteen
121bytes, or more than 64 bytes of argument data, depending on
122architecture).
123
124Return Probes 83Return Probes
125------------- 84-------------
126 85
@@ -245,8 +204,7 @@ Pre-optimization
245After preparing the detour buffer, Kprobes verifies that none of the 204After preparing the detour buffer, Kprobes verifies that none of the
246following situations exist: 205following situations exist:
247 206
248- The probe has either a break_handler (i.e., it's a jprobe) or a 207- The probe has a post_handler.
249 post_handler.
250- Other instructions in the optimized region are probed. 208- Other instructions in the optimized region are probed.
251- The probe is disabled. 209- The probe is disabled.
252 210
@@ -331,7 +289,7 @@ rejects registering it, if the given address is in the blacklist.
331Architectures Supported 289Architectures Supported
332======================= 290=======================
333 291
334Kprobes, jprobes, and return probes are implemented on the following 292Kprobes and return probes are implemented on the following
335architectures: 293architectures:
336 294
337- i386 (Supports jump optimization) 295- i386 (Supports jump optimization)
@@ -446,27 +404,6 @@ architecture-specific trap number associated with the fault (e.g.,
446on i386, 13 for a general protection fault or 14 for a page fault). 404on i386, 13 for a general protection fault or 14 for a page fault).
447Returns 1 if it successfully handled the exception. 405Returns 1 if it successfully handled the exception.
448 406
449register_jprobe
450---------------
451
452::
453
454 #include <linux/kprobes.h>
455 int register_jprobe(struct jprobe *jp)
456
457Sets a breakpoint at the address jp->kp.addr, which must be the address
458of the first instruction of a function. When the breakpoint is hit,
459Kprobes runs the handler whose address is jp->entry.
460
461The handler should have the same arg list and return type as the probed
462function; and just before it returns, it must call jprobe_return().
463(The handler never actually returns, since jprobe_return() returns
464control to Kprobes.) If the probed function is declared asmlinkage
465or anything else that affects how args are passed, the handler's
466declaration must match.
467
468register_jprobe() returns 0 on success, or a negative errno otherwise.
469
470register_kretprobe 407register_kretprobe
471------------------ 408------------------
472 409
@@ -513,7 +450,6 @@ unregister_*probe
513 450
514 #include <linux/kprobes.h> 451 #include <linux/kprobes.h>
515 void unregister_kprobe(struct kprobe *kp); 452 void unregister_kprobe(struct kprobe *kp);
516 void unregister_jprobe(struct jprobe *jp);
517 void unregister_kretprobe(struct kretprobe *rp); 453 void unregister_kretprobe(struct kretprobe *rp);
518 454
519Removes the specified probe. The unregister function can be called 455Removes the specified probe. The unregister function can be called
@@ -532,7 +468,6 @@ register_*probes
532 #include <linux/kprobes.h> 468 #include <linux/kprobes.h>
533 int register_kprobes(struct kprobe **kps, int num); 469 int register_kprobes(struct kprobe **kps, int num);
534 int register_kretprobes(struct kretprobe **rps, int num); 470 int register_kretprobes(struct kretprobe **rps, int num);
535 int register_jprobes(struct jprobe **jps, int num);
536 471
537Registers each of the num probes in the specified array. If any 472Registers each of the num probes in the specified array. If any
538error occurs during registration, all probes in the array, up to 473error occurs during registration, all probes in the array, up to
@@ -555,7 +490,6 @@ unregister_*probes
555 #include <linux/kprobes.h> 490 #include <linux/kprobes.h>
556 void unregister_kprobes(struct kprobe **kps, int num); 491 void unregister_kprobes(struct kprobe **kps, int num);
557 void unregister_kretprobes(struct kretprobe **rps, int num); 492 void unregister_kretprobes(struct kretprobe **rps, int num);
558 void unregister_jprobes(struct jprobe **jps, int num);
559 493
560Removes each of the num probes in the specified array at once. 494Removes each of the num probes in the specified array at once.
561 495
@@ -574,7 +508,6 @@ disable_*probe
574 #include <linux/kprobes.h> 508 #include <linux/kprobes.h>
575 int disable_kprobe(struct kprobe *kp); 509 int disable_kprobe(struct kprobe *kp);
576 int disable_kretprobe(struct kretprobe *rp); 510 int disable_kretprobe(struct kretprobe *rp);
577 int disable_jprobe(struct jprobe *jp);
578 511
579Temporarily disables the specified ``*probe``. You can enable it again by using 512Temporarily disables the specified ``*probe``. You can enable it again by using
580enable_*probe(). You must specify the probe which has been registered. 513enable_*probe(). You must specify the probe which has been registered.
@@ -587,7 +520,6 @@ enable_*probe
587 #include <linux/kprobes.h> 520 #include <linux/kprobes.h>
588 int enable_kprobe(struct kprobe *kp); 521 int enable_kprobe(struct kprobe *kp);
589 int enable_kretprobe(struct kretprobe *rp); 522 int enable_kretprobe(struct kretprobe *rp);
590 int enable_jprobe(struct jprobe *jp);
591 523
592Enables ``*probe`` which has been disabled by disable_*probe(). You must specify 524Enables ``*probe`` which has been disabled by disable_*probe(). You must specify
593the probe which has been registered. 525the probe which has been registered.
@@ -595,12 +527,10 @@ the probe which has been registered.
595Kprobes Features and Limitations 527Kprobes Features and Limitations
596================================ 528================================
597 529
598Kprobes allows multiple probes at the same address. Currently, 530Kprobes allows multiple probes at the same address. Also,
599however, there cannot be multiple jprobes on the same function at 531a probepoint for which there is a post_handler cannot be optimized.
600the same time. Also, a probepoint for which there is a jprobe or 532So if you install a kprobe with a post_handler, at an optimized
601a post_handler cannot be optimized. So if you install a jprobe, 533probepoint, the probepoint will be unoptimized automatically.
602or a kprobe with a post_handler, at an optimized probepoint, the
603probepoint will be unoptimized automatically.
604 534
605In general, you can install a probe anywhere in the kernel. 535In general, you can install a probe anywhere in the kernel.
606In particular, you can probe interrupt handlers. Known exceptions 536In particular, you can probe interrupt handlers. Known exceptions
@@ -662,7 +592,7 @@ We're unaware of other specific cases where this could be a problem.
662If, upon entry to or exit from a function, the CPU is running on 592If, upon entry to or exit from a function, the CPU is running on
663a stack other than that of the current task, registering a return 593a stack other than that of the current task, registering a return
664probe on that function may produce undesirable results. For this 594probe on that function may produce undesirable results. For this
665reason, Kprobes doesn't support return probes (or kprobes or jprobes) 595reason, Kprobes doesn't support return probes (or kprobes)
666on the x86_64 version of __switch_to(); the registration functions 596on the x86_64 version of __switch_to(); the registration functions
667return -EINVAL. 597return -EINVAL.
668 598
@@ -706,24 +636,24 @@ Probe Overhead
706On a typical CPU in use in 2005, a kprobe hit takes 0.5 to 1.0 636On a typical CPU in use in 2005, a kprobe hit takes 0.5 to 1.0
707microseconds to process. Specifically, a benchmark that hits the same 637microseconds to process. Specifically, a benchmark that hits the same
708probepoint repeatedly, firing a simple handler each time, reports 1-2 638probepoint repeatedly, firing a simple handler each time, reports 1-2
709million hits per second, depending on the architecture. A jprobe or 639million hits per second, depending on the architecture. A return-probe
710return-probe hit typically takes 50-75% longer than a kprobe hit. 640hit typically takes 50-75% longer than a kprobe hit.
711When you have a return probe set on a function, adding a kprobe at 641When you have a return probe set on a function, adding a kprobe at
712the entry to that function adds essentially no overhead. 642the entry to that function adds essentially no overhead.
713 643
714Here are sample overhead figures (in usec) for different architectures:: 644Here are sample overhead figures (in usec) for different architectures::
715 645
716 k = kprobe; j = jprobe; r = return probe; kr = kprobe + return probe 646 k = kprobe; r = return probe; kr = kprobe + return probe
717 on same function; jr = jprobe + return probe on same function:: 647 on same function
718 648
719 i386: Intel Pentium M, 1495 MHz, 2957.31 bogomips 649 i386: Intel Pentium M, 1495 MHz, 2957.31 bogomips
720 k = 0.57 usec; j = 1.00; r = 0.92; kr = 0.99; jr = 1.40 650 k = 0.57 usec; r = 0.92; kr = 0.99
721 651
722 x86_64: AMD Opteron 246, 1994 MHz, 3971.48 bogomips 652 x86_64: AMD Opteron 246, 1994 MHz, 3971.48 bogomips
723 k = 0.49 usec; j = 0.76; r = 0.80; kr = 0.82; jr = 1.07 653 k = 0.49 usec; r = 0.80; kr = 0.82
724 654
725 ppc64: POWER5 (gr), 1656 MHz (SMT disabled, 1 virtual CPU per physical CPU) 655 ppc64: POWER5 (gr), 1656 MHz (SMT disabled, 1 virtual CPU per physical CPU)
726 k = 0.77 usec; j = 1.31; r = 1.26; kr = 1.45; jr = 1.99 656 k = 0.77 usec; r = 1.26; kr = 1.45
727 657
728Optimized Probe Overhead 658Optimized Probe Overhead
729------------------------ 659------------------------
@@ -755,11 +685,6 @@ Kprobes Example
755 685
756See samples/kprobes/kprobe_example.c 686See samples/kprobes/kprobe_example.c
757 687
758Jprobes Example
759===============
760
761See samples/kprobes/jprobe_example.c
762
763Kretprobes Example 688Kretprobes Example
764================== 689==================
765 690
@@ -772,6 +697,37 @@ For additional information on Kprobes, refer to the following URLs:
772- http://www-users.cs.umn.edu/~boutcher/kprobes/ 697- http://www-users.cs.umn.edu/~boutcher/kprobes/
773- http://www.linuxsymposium.org/2006/linuxsymposium_procv2.pdf (pages 101-115) 698- http://www.linuxsymposium.org/2006/linuxsymposium_procv2.pdf (pages 101-115)
774 699
700Deprecated Features
701===================
702
703Jprobes is now a deprecated feature. People who are depending on it should
704migrate to other tracing features or use older kernels. Please consider to
705migrate your tool to one of the following options:
706
707- Use trace-event to trace target function with arguments.
708
709 trace-event is a low-overhead (and almost no visible overhead if it
710 is off) statically defined event interface. You can define new events
711 and trace it via ftrace or any other tracing tools.
712
713 See the following urls:
714
715 - https://lwn.net/Articles/379903/
716 - https://lwn.net/Articles/381064/
717 - https://lwn.net/Articles/383362/
718
719- Use ftrace dynamic events (kprobe event) with perf-probe.
720
721 If you build your kernel with debug info (CONFIG_DEBUG_INFO=y), you can
722 find which register/stack is assigned to which local variable or arguments
723 by using perf-probe and set up new event to trace it.
724
725 See following documents:
726
727 - Documentation/trace/kprobetrace.txt
728 - Documentation/trace/events.txt
729 - tools/perf/Documentation/perf-probe.txt
730
775 731
776The kprobes debugfs interface 732The kprobes debugfs interface
777============================= 733=============================
@@ -783,14 +739,13 @@ under the /sys/kernel/debug/kprobes/ directory (assuming debugfs is mounted at /
783/sys/kernel/debug/kprobes/list: Lists all registered probes on the system:: 739/sys/kernel/debug/kprobes/list: Lists all registered probes on the system::
784 740
785 c015d71a k vfs_read+0x0 741 c015d71a k vfs_read+0x0
786 c011a316 j do_fork+0x0
787 c03dedc5 r tcp_v4_rcv+0x0 742 c03dedc5 r tcp_v4_rcv+0x0
788 743
789The first column provides the kernel address where the probe is inserted. 744The first column provides the kernel address where the probe is inserted.
790The second column identifies the type of probe (k - kprobe, r - kretprobe 745The second column identifies the type of probe (k - kprobe and r - kretprobe)
791and j - jprobe), while the third column specifies the symbol+offset of 746while the third column specifies the symbol+offset of the probe.
792the probe. If the probed function belongs to a module, the module name 747If the probed function belongs to a module, the module name is also
793is also specified. Following columns show probe status. If the probe is on 748specified. Following columns show probe status. If the probe is on
794a virtual address that is no longer valid (module init sections, module 749a virtual address that is no longer valid (module init sections, module
795virtual addresses that correspond to modules that've been unloaded), 750virtual addresses that correspond to modules that've been unloaded),
796such probes are marked with [GONE]. If the probe is temporarily disabled, 751such probes are marked with [GONE]. If the probe is temporarily disabled,