[RFC 0/3] Kprobes: support for userspace probes

[Prasanna S Panchamukhi <prasanna at in dot ibm dot com>]

Hi All,

Please find the details of the userspace probes below.
Also I have tried to implement the same to demonistrate
this design, in 3 patches for linux kernel version 2.6.13.

1. Provides interface to insert probes when pages are in memory.
2. Adds a feature to insert probes on pages not present in the memory.
3. Provides the callback functions to be executed.

Individual patches will provide you more information.

Please review and provide your comments.

Thanks
Prasanna

Dprobes: Support for  user space probes
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
	Dprobes allows instrumentation of user space applications 
dynamically. Probes can be inserted into all executables and shared
libraries at runtime with minimal disruption. In dprobes, probe 
handlers are specified using special program language RPN Reverse 
Polish Notation. The dprobes kernel module accepts this rpn program 
file through an ioctl interface. The rpn file is processed and probes
are inserted within the running application and shared libraries.
Probes are inserted by inserting int3/breakpoint instruction at the 
user specified address. When the user space probes is hit the dprobes
replaces the int3/breakpoint instruction by the original instruction 
and single steps on the original instruction. After single stepping 
the int3/breakpoint instruction is inserted back again at that 
location. When the probe gets fired the dprobes callback function is 
executed which collects the requested data. In kernel version 2.6, 
dprobes is implemented over simple and light weight kprobes interface.
Kprobes provides four new interfaces to insert, remove probes and also
to add and delete the probes from the probes list. 

New User space probes description
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
	Similar to dprobes, instrumentation of user space application 
is accomplished by inserting int3/breakpoint instruction at the 
specified offset within the memory page for a given application.
Instead of replacing original instruction with int3/breakpoint 
instruction, jump instruction can be also used to replace the original
instruction. But there are other issues, such as atomically replacing 
the original instruction with jump instruction's, since other cpus 
might see the stale data during replacement. Also jump instruction 
is not the smallest instruction, hence if the probe point is at the 
page boundary the jump instruction gets split into two pages.
Probes are defined global, which means that probes are visible to all 
the process that execute the same application/executable program.
Probes are inherited when the process /running application having 
probes forks(). New design allows the probes to be inserted on the 
pages that are present in the memory and also the pages that are not 
present in the memory during the registration time. This 
implementation allows probes to be inserted on the shared libraries. 
Similar to kernel probes (Kprobes), user space probes also provides 
multiple probes to inserted at the same address, Multiple probes 
feature in user space probes uses the underlying kprobes multiple 
probes feature.  User space probes is build on top of existing kprobes
 mechanism, but it single steps on line instead.
-- 

Prasanna S Panchamukhi
Linux Technology Center
India Software Labs, IBM Bangalore
Ph: 91-80-25044636
<prasanna@in.ibm.com>