Using dynamic kernel tracing
kprobes is a kernel debugging facility that allows us to dynamically break into almost any kernel function (except kprobe itself) to collect debugging and profiling information non-disruptively. Some architectures keep an array of blacklisted functions, which cannot be probed using kprobe, but on ARM the list is empty.
Because kprobes can be used to change a function's data and registers, it should only be used in development environments.
There are three types of probes:
- kprobes: This is the kernel probe which can be inserted into any location with more than one- kprobeadded at a single location, if needed.
- jprobe: This is the jumper probe inserted at the entry point of a kernel function to provide access to its arguments. Only one- jprobemay be added at a given location.
- kretprobe: This is the return probe which triggers on a function return. Also, only one- kretprobemay be added to the same location.
They are packaged into a kernel module, with the init function...
 
                                             
             
             
             
             
             
             
             
             
             
             
             
             
             
             
             
             
             
             
             
             
             
             
             
             
             
             
             
             
             
             
             
             
             
             
             
             
             
             
             
             
             
             
             
             
             
             
             
             
             
             
             
             
             
     
         
                 
                 
                