Commit bf8f6e5b authored by Ananth N Mavinakayanahalli's avatar Ananth N Mavinakayanahalli Committed by Linus Torvalds
Browse files

Kprobes: The ON/OFF knob thru debugfs 



This patch provides a debugfs knob to turn kprobes on/off

o A new file /debug/kprobes/enabled indicates if kprobes is enabled or
  not (default enabled)
o Echoing 0 to this file will disarm all installed probes
o Any new probe registration when disabled will register the probe but
  not arm it. A message will be printed out in such a case.
o When a value 1 is echoed to the file, all probes (including ones
  registered in the intervening period) will be enabled
o Unregistration will happen irrespective of whether probes are globally
  enabled or not.
o Update Documentation/kprobes.txt to reflect these changes. While there
  also update the doc to make it current.

We are also looking at providing sysrq key support to tie to the disabling
feature provided by this patch.

[akpm@linux-foundation.org: Use bool like a bool!]
[akpm@linux-foundation.org: add printk facility levels]
[cornelia.huck@de.ibm.com: Add the missing arch_trampoline_kprobe() for s390]
Signed-off-by: default avatarAnanth N Mavinakayanahalli <ananth@in.ibm.com>
Signed-off-by: default avatarSrinivasa DS <srinivasa@in.ibm.com>
Signed-off-by: default avatarCornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 4c4308cb

Documentation/kprobes.txt

+31 −3
Original line number Diff line number Diff line
@@ -14,6 +14,7 @@ CONTENTS 
8. Kprobes Example

9. Jprobes Example

10. Kretprobes Example

Appendix A: The kprobes debugfs interface



1. Concepts: Kprobes, Jprobes, Return Probes
@@ -349,9 +350,12 @@ for instrumentation and error reporting.) 


If the number of times a function is called does not match the number

of times it returns, registering a return probe on that function may

produce undesirable results.  We have the do_exit() case covered.

do_execve() and do_fork() are not an issue.  We're unaware of other

specific cases where this could be a problem.

produce undesirable results. In such a case, a line:

kretprobe BUG!: Processing kretprobe d000000000041aa8 @ c00000000004f48c

gets printed. With this information, one will be able to correlate the

exact instance of the kretprobe that caused the problem. We have the

do_exit() case covered. do_execve() and do_fork() are not an issue.

We're unaware of other specific cases where this could be a problem.



If, upon entry to or exit from a function, the CPU is running on

a stack other than that of the current task, registering a return
@@ -614,3 +618,27 @@ http://www-106.ibm.com/developerworks/library/l-kprobes.html?ca=dgr-lnxw42Kprobe 
http://www.redhat.com/magazine/005mar05/features/kprobes/

http://www-users.cs.umn.edu/~boutcher/kprobes/

http://www.linuxsymposium.org/2006/linuxsymposium_procv2.pdf (pages 101-115)





Appendix A: The kprobes debugfs interface



With recent kernels (> 2.6.20) the list of registered kprobes is visible

under the /debug/kprobes/ directory (assuming debugfs is mounted at /debug).



/debug/kprobes/list: Lists all registered probes on the system



c015d71a  k  vfs_read+0x0

c011a316  j  do_fork+0x0

c03dedc5  r  tcp_v4_rcv+0x0



The first column provides the kernel address where the probe is inserted.

The second column identifies the type of probe (k - kprobe, r - kretprobe

and j - jprobe), while the third column specifies the symbol+offset of

the probe. If the probed function belongs to a module, the module name

is also specified.



/debug/kprobes/enabled: Turn kprobes ON/OFF



Provides a knob to globally turn registered kprobes ON or OFF. By default,

all kprobes are enabled. By echoing "0" to this file, all registered probes

will be disarmed, till such time a "1" is echoed to this file.

arch/i386/kernel/kprobes.c

+5 −0
Original line number Diff line number Diff line
@@ -743,6 +743,11 @@ int __kprobes longjmp_break_handler(struct kprobe *p, struct pt_regs *regs) 
	return 0;

}



int __kprobes arch_trampoline_kprobe(struct kprobe *p)

{

	return 0;

}



int __init arch_init_kprobes(void)

{

	return 0;

arch/ia64/kernel/kprobes.c

+9 −0
Original line number Diff line number Diff line
@@ -1012,3 +1012,12 @@ int __init arch_init_kprobes(void) 
		(kprobe_opcode_t *)((struct fnptr *)kretprobe_trampoline)->ip;

	return register_kprobe(&trampoline_p);

}



int __kprobes arch_trampoline_kprobe(struct kprobe *p)

{

	if (p->addr ==

		(kprobe_opcode_t *)((struct fnptr *)kretprobe_trampoline)->ip)

		return 1;



	return 0;

}

arch/powerpc/kernel/kprobes.c

+8 −0
Original line number Diff line number Diff line
@@ -550,3 +550,11 @@ int __init arch_init_kprobes(void) 
{

	return register_kprobe(&trampoline_p);

}



int __kprobes arch_trampoline_kprobe(struct kprobe *p)

{

	if (p->addr == (kprobe_opcode_t *)&kretprobe_trampoline)

		return 1;



	return 0;

}

arch/s390/kernel/kprobes.c

+7 −0
Original line number Diff line number Diff line
@@ -661,3 +661,10 @@ int __init arch_init_kprobes(void) 
{

	return register_kprobe(&trampoline_p);

}



int __kprobes arch_trampoline_kprobe(struct kprobe *p)

{

	if (p->addr == (kprobe_opcode_t *) & kretprobe_trampoline)

		return 1;

	return 0;

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE