kprobes

Kprobes is a dynamic instrumentation framework built into the Linux kernel that enables probing of kernel code at runtime without rebuilding or restarting the system. By inserting probes at almost any kernel instruction, developers can collect data, diagnose issues, or observe behavior with minimal intrusion. Kprobes are used for debugging, performance analysis, and fault isolation, and they support both development and production environments.

Mechanism and behavior: a kprobe places a breakpoint instruction at a chosen kernel address. When execution reaches the probe, the processor traps into the kernel’s probe handler. The pre_handler runs before the probed instruction, and the post_handler runs after the instruction has executed. A fault_handler can be installed to manage any exceptions that occur during probing. Probes can retrieve or modify register and memory state, and they can influence the flow of execution, though they must be careful not to sleep or perform unsafe operations inside handlers. After handling, normal execution resumes, with the option to adjust the program counter to skip or reexecute instructions.

Probes and variants: the generic kprobe provides instrumentation at an arbitrary address or symbol. Related forms include jprobe, historically used for tracing function entry, and kretprobe, which probes function return to capture exit information. Uprobes extend similar ideas to user-space processes, enabling instrumentation of user applications from the kernel.

Usage and tools: kprobes are exposed through a kernel API (for example, register_kprobe and related callbacks). They underpin several tracing and profiling tools in the Linux ecosystem, enabling dynamic, low-overhead data collection. Limitations include potential performance impact on hot paths, architectural differences in probe handling, and the requirement that handlers avoid sleeping or performing unsafe operations in interrupt context.

See also: uprobes, kretprobe, jprobe, ftrace, SystemTap, and eBPF-based tracing ecosystems.