From what I understand, on x86, uprobe
places an int3
instruction at the user specified location, and handles that exception when it is hit, somewhat similar to kprobe
in that regard.
What I do not understand, it how the do_int3()
execption handler tells uprobe
when it is hit. In comparison, for kprobe
, there is call to kprobe_int3_handler
inside do_int3
, so my question is, how and where does uprobe
register its handlers?
Here is the do_int3
from kernel 5.7 on x86:
dotraplinkage void notrace do_int3(struct pt_regs *regs, long error_code){ if (poke_int3_handler(regs)) return; if (!user_mode(regs)) { rcu_nmi_enter(); preempt_disable(); } RCU_LOCKDEP_WARN(!rcu_is_watching(), "entry code didn't wake RCU");#ifdef CONFIG_KGDB_LOW_LEVEL_TRAP if (kgdb_ll_trap(DIE_INT3, "int3", regs, error_code, X86_TRAP_BP, SIGTRAP) == NOTIFY_STOP) goto exit;#endif /* CONFIG_KGDB_LOW_LEVEL_TRAP */#ifdef CONFIG_KPROBES if (kprobe_int3_handler(regs)) goto exit;#endif if (notify_die(DIE_INT3, "int3", regs, error_code, X86_TRAP_BP, SIGTRAP) == NOTIFY_STOP) goto exit; cond_local_irq_enable(regs); do_trap(X86_TRAP_BP, SIGTRAP, "int3", regs, error_code, 0, NULL); cond_local_irq_disable(regs);exit: if (!user_mode(regs)) { preempt_enable_no_resched(); rcu_nmi_exit(); }}