How Kprobe and Uprobe insert debugging prinkk in executable — Do they extend the address space of running Module or Program

Question

I just could not wrap my head around the idea of debuggers and probing tools.

How is it technically possible to insert debugging printk statements inside running kernel module or user space applications -- using Kprobe and Uprobe. what terminology is used to define the behavior of Kprobe and Uprobe in terms Memory -- how is it possible to stretch the address space in program running state.

Answer 1

There are usually single-byte instructions that cause a breakpoint (software interrupt) and then there are some debug registers in the processor too.

With these it is possible to insert a trap that jumps to kernel trap handler anywhere in memory without extending any "memory space" - you just set the debug registers or replace the desired instruction at the breakpoint with that trap instruction.

Within the kernel trap handler the kernel would get to know the exact address where the fault occurred and therefore inspect the state of the registers and so forth. In case of a trap by a single-byte instruction or so, you'd replace the trap instruction with the original one; possibly use a processor trick to single step it; and then replace with the trap instruction again...