kprobe
also: kernel probe, kretprobe
A dynamic kernel debugging mechanism that allows you to insert instrumentation points into running kernel code without recompiling or reloading modules. Kprobes capture function arguments, return values, and execution flow for performance analysis and troubleshooting.
Kprobes is a lightweight, dynamic tracing infrastructure built into the Linux kernel that enables non-invasive inspection of kernel functions at runtime. When a kprobe is inserted at a specific kernel address, execution is temporarily diverted to a handler function you define, allowing you to log data, modify variables, or trigger actions without stopping the kernel.
There are two main types: kprobes (for function entry points) and kretprobes (for function returns). For example, to trace calls to the do_sys_open() function, you would insert a kprobe that fires whenever that function is invoked, capturing its arguments in your handler.
Kprobes are commonly accessed through ftrace or perf tools, or via the debugfs interface at /sys/kernel/debug/kprobes/. They are essential for performance profiling, bug diagnosis, and understanding kernel behavior in production systems without the overhead of traditional kernel debugging.