Documentation/trace/kprobes.rst

38 any instruction in the kernel.  A return probe fires when a specified
65 instruction and replaces the first byte(s) of the probed instruction
66 with a breakpoint instruction (e.g., int3 on i386 and x86_64).
68 When a CPU hits the breakpoint instruction, a trap occurs, the CPU's
74 Next, Kprobes single-steps its copy of the probed instruction.
75 (It would be simpler to single-step the actual instruction in place,
77 instruction.  This would open a small time window when another CPU
80 After the instruction is single-stepped, Kprobes executes the
82 Execution then continues with the instruction following the probepoint.
88 register set, including instruction pointer. This operation requires
94 If you change the instruction pointer (and set up other related
114 is an arbitrary piece of code -- typically just a nop instruction.
117 When the probed function executes its return instruction, control
120 kretprobe, then sets the saved instruction pointer to the saved return
176 instruction instead of a breakpoint instruction at each probepoint.
192   instruction (the "optimized region") lies entirely within one function.
193   (A jump instruction is multiple bytes, and so may overlay multiple
200   - the function contains no instruction that causes an exception (since
206 - For each instruction in the optimized region, Kprobes verifies that
207   the instruction can be executed out of line.
213 instruction sequence:
238 Kprobes returns control to the original instruction path by setting
239 the CPU's instruction pointer to the copied code in the detour buffer
245 The Kprobe-optimizer doesn't insert the jump instruction immediately;
254 the optimized region with a jump instruction to the detour buffer,
267 .. [3] Please imagine that the 2nd instruction is interrupted and then
268    the optimizer replaces the 2nd instruction with the jump *address*
270    returns to original address, there is no valid instruction,
366 calls kp->pre_handler.  After the probed instruction is single-stepped, Kprobe
390       does not validate if the kprobe.addr is at an instruction boundary.
608 explain it, we introduce some terminology. Imagine a 3-instruction
610 instruction.
630 a 5-byte jump instruction. So there are several limitations.
633 b) The instructions in DCR must not include a call instruction.
634 c) JTPR must not be targeted by any jump or call instruction.
637 Anyway, these limitations are checked by the in-kernel instruction