IBM developerWorks has published a brief article about Kprobes, described as a “lightweight, non-disruptive” debugging tool that can be used to dynamically insert breakpoints into a running Linux kernel, freeing hackers from constant kernel rebuilds and reboots, among other advantages.

Kprobes is installed by patching the kernel source, and building and running the resulting kernel. The user then writes Kprobe modules, simple applications that specify kernel routine addresses where the probe will be inserted. Kprobe modules are registered with init_module, after which printk's will appear on the console or in dmesg output after any shell command is run, according to the article. The Kprobe module can be unregistered with unregister_kprobe(&kp);.

The article goes on to discuss inserting breakpoints at a calculated offset within a function, dumping kernel data structures, and using the Alt+SysRq+W command to list all inserted kernel probes.

The article concludes by listing several significant Kprobe features and benefits, including freedom from system dependencies, minimal affect on system performance, and more.

Read “Kernel debugging with Kprobes”

 
This article was originally published on LinuxDevices.com and has been donated to the open source community by QuinStreet Inc. Please visit LinuxToday.com for up-to-date news and articles about Linux and open source.