kprobe

kprobe是内核提供的探测内核代码的一种机制，有助于开发人员跟踪内核代码运行状态。

1,three types

--Kprobes, Jprobes, Return Probes

2, arch support

--- i386
---arm

---...

 

3,configs

--CONFIG_KPROBES

--CONFIG_MODULES

--CONFIG_MODULE_UNLOAD

--CONFIG_KALLSYMS

--CONFIG_KALLSYMS_ALL

--CONFIG_DEBUG_INFO

 

4,API

register_kprobe

#include
int register_kprobe(struct kprobe *kp);

 

 

User's pre-handler (kp->pre_handler):

#include
#include
int pre_handler(struct kprobe *p, struct pt_regs *regs);

 

User's post-handler (kp->post_handler):

#include
#include
void post_handler(struct kprobe *p, struct pt_regs *regs,
        unsigned long flags);

 

User's fault-handler (kp->fault_handler):

#include
#include
int fault_handler(struct kprobe *p, struct pt_regs *regs, int trapnr);

 

 

register_jprobe

#include
int register_jprobe(struct jprobe *jp)

 

register_kretprobe

#include
int register_kretprobe(struct kretprobe *rp);

 

User's return-probe handler (rp->handler):

#include
#include
int kretprobe_handler(struct kretprobe_instance *ri, struct pt_regs *regs);

 

unregister_*probe

#include
void unregister_kprobe(struct kprobe *kp);
void unregister_jprobe(struct jprobe *jp);
void unregister_kretprobe(struct kretprobe *rp);

 

register_*probes
#include
int register_kprobes(struct kprobe **kps, int num);
int register_kretprobes(struct kretprobe **rps, int num);
int register_jprobes(struct jprobe **jps, int num);

 

unregister_*probes
#include
void unregister_kprobes(struct kprobe **kps, int num);
void unregister_kretprobes(struct kretprobe **rps, int num);
void unregister_jprobes(struct jprobe **jps, int num);

 

disable_*probe
#include
int disable_kprobe(struct kprobe *kp);
int disable_kretprobe(struct kretprobe *rp);
int disable_jprobe(struct jprobe *jp);

 

enable_*probe
#include
int enable_kprobe(struct kprobe *kp);
int enable_kretprobe(struct kretprobe *rp);
int enable_jprobe(struct jprobe *jp);

 

http://lxr.linux.no/linux+v2.6.31/samples/kprobes/

 

http://lxr.linux.no/linux+v2.6.31/Documentation/kprobes.txt