Kprobes – limitations and downsides
We do realize that no single feature can do anything and everything – in the words of Frederick J Brooks (in his incomparable book The Mythical Man Month): "there is no silver bullet".
As we've seen, certain kernel/module functions cannot be probed, including the following:
- Functions marked with the
__kprobes
ornokprobe_inline
annotation. - Functions marked via the
NOKPROBE_SYMBOL()
macro. - The pseudofile
/sys/kernel/debug/kprobes/blacklist
holds the names of functions that can't be probed. (Incidentally, ourch4/kprobes/4_kprobe_helper/kp_load.sh
script checks this against the function attempting to be probed). Also, some inline functions might not be able to be probed.
There's more to note on the point of using k[ret]probes on production systems due to the possibility of stability issues; the next section throws some light on this.
Interface stability
We know that kernel APIs...