{"id":15056982,"url":"https://github.com/rinhizakura/kmemsnoop","last_synced_at":"2025-10-04T17:08:25.043Z","repository":{"id":237985599,"uuid":"795639024","full_name":"RinHizakura/kmemsnoop","owner":"RinHizakura","description":"Install a hardware breakpoint in Linux kernel for tracing/debugging","archived":false,"fork":false,"pushed_at":"2025-04-20T06:47:29.000Z","size":880,"stargazers_count":22,"open_issues_count":0,"forks_count":0,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-04-20T07:39:45.638Z","etag":null,"topics":["ebpf","linux"],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/RinHizakura.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-05-03T17:52:37.000Z","updated_at":"2025-04-20T06:47:32.000Z","dependencies_parsed_at":"2024-05-19T18:28:55.346Z","dependency_job_id":"ea0487d2-80b4-43c4-aced-a2f0d45705c8","html_url":"https://github.com/RinHizakura/kmemsnoop","commit_stats":null,"previous_names":["rinhizakura/memwatch","rinhizakura/kmemsnoop"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/RinHizakura/kmemsnoop","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/RinHizakura%2Fkmemsnoop","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/RinHizakura%2Fkmemsnoop/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/RinHizakura%2Fkmemsnoop/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/RinHizakura%2Fkmemsnoop/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/RinHizakura","download_url":"https://codeload.github.com/RinHizakura/kmemsnoop/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/RinHizakura%2Fkmemsnoop/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":278343086,"owners_count":25971400,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-04T02:00:05.491Z","response_time":63,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ebpf","linux"],"created_at":"2024-09-24T21:59:45.010Z","updated_at":"2025-10-04T17:08:25.024Z","avatar_url":"https://github.com/RinHizakura.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# kmemsnoop\n\n## Introduction\n\nOn specific processors, hardware breakpoint registers are supported to monitor\nmemory access or instruction execution in hardware manner. The great advantage\nof using these is that it causes little overhead on trace.\n\nWith the `kmemsnoop`, you can easily install a hardware\nbreakpoint/watchpoint in Linux kernel, as long as it is supported for your\nplatform. This enables us to trace/debug the running Linux kernel without KGDB\nor hardware debugger.\n\n## Usage\n\n### Prerequisite\n\n`kmemsnoop` relies on\n[eBPF CO-RE(Compile Once – Run Everywhere)](https://docs.kernel.org/bpf/libbpf/libbpf_overview.html#bpf-co-re-compile-once-run-everywhere)\nto enable complete kernel tracing, so the following kernel config **must**\nbe required.\n\n```\nCONFIG_DEBUG_INFO_BTF=y\nCONFIG_PAHOLE_HAS_SPLIT_BTF=y\nCONFIG_DEBUG_INFO_BTF_MODULES=y\n```\n\nBesides, you may want to expose more kernel symbols to userspace with the\nfollowing settings. These are convenient for you to find the address of\nkernel symbols from `/proc/kallsyms` instead of inspecting the vmlinux source.\nOn top of that, `/proc/kallsyms` makes kernel tracing with\n[KASLR](https://en.wikipedia.org/wiki/Address_space_layout_randomization)\nenabled possible.\n\n```\nCONFIG_KALLSYMS=y\nCONFIG_KALLSYMS_ALL=y\n```\n\n(Optional) `kmemsnoop` tool support a special type of expression called\n**kexpr**. It allows you to access specific kind of object in the kernel(e.g.\na `struct task_struct` from task pid), and set watchpoint on the object member\nwith the given expression. In order to use this feature, you need to enable\n`/proc/kcore` to make access the kernel objects possible.\n\n```\nCONFIG_PROC_KCORE=y\n```\n\n### Build\n\nThese dependencies are required to build kmemsnoop.\n\n```\n$ sudo apt install automake clang llvm libelf1 libelf-dev zlib1g-dev\n```\n\nYou will also need bpftool for the generating of vmlinux.h.\n\n```\n$ git clone https://github.com/libbpf/bpftool.git\n$ cd bpftool\n$ git submodule update --init\n$ cd src\n$ make\n$ sudo make install\n```\n\nAfter the installation of these dependencies, you should be able to build\n`kmemsnoop` now.\n\n```\n$ make\n```\n\n### Execute\n\n```\n$ kmemsnoop --help\n\nUsage: kmemsnoop [OPTIONS] \u003cBP\u003e \u003cEXPR\u003e\n\nArguments:\n  \u003cBP\u003e    type of the watchpoint [possible values: r1, w1, rw1, x1, r2, w2, rw2, x2, r4, w4, rw4, x4, r8, w8, rw8, x8]\n  \u003cEXPR\u003e  expression of watchpoint(kernel symbol or addess by default)\n\nOptions:\n  -v, --vmlinux \u003cVMLINUX\u003e    vmlinux path of running kernel(need nokaslr)\n      --pid-task \u003cPID_TASK\u003e  kexpr: use 'struct task_struct' from pid\n      --pci-dev \u003cPCI_DEV\u003e    kexpr: 'struct pci_dev' from the device name\n      --usb-dev \u003cUSB_DEV\u003e    kexpr: 'struct usb_device' from the device name\n      --plat-dev \u003cPLAT_DEV\u003e  kexpr: 'struct platform_device' from the device name\n  -h, --help                 Print help\n```\n\n* `EXPR` is the expression to describe the watchpoint. If not using the \"kexpr\"\noptions(e.g. `--pid-task`), it can be the name of kernel symbol or addess value\nin hex. If using the \"kexpr\", it is the expression dereferenced from the\ngiven structure according the option.\n* `BP` is the type of watchpoint. For example, r8 means to watch a read\noperation from the base of `EXPR` with 8 bytes length.\n\nOptions:\n* `VMLINUX` is the path of `vmlinux` file for getting the address of kernel\nsymbol instead of using `/proc/kallsyms`. To use this option, you need to\nadd `nokaslr` to kernel bootargs because the address on kernel symbol will be\nrandom without it.\n* `PID_TASK` allows you to watch the field which is dereferenced from a\n`struct task_struct` by `EXPR`. The `struct task_struct` comes from the task\nwhose pid is `PID_TASK`.\n* `PCI_DEV` allows you to watch the field which is dereferenced from a\n`struct pci_dev` by `EXPR`. The `struct pci_dev` comes from the device with\nname `PCI_DEV`. Check `/sys/bus/pci/devices/` for the valid name.\n* `USB_DEV` allows you to watch the field which is dereferenced from a\n`struct usb_device` by `EXPR`. The `struct usb_device` comes from the device with\nname `USB_DEV`. Check `/sys/bus/usb/devices/` for the valid name.\n* `PLAT_DEV` allows you to watch the field which is dereferenced from a\n`struct platform_device` by `EXPR`. The `struct platform_device` comes from the\ndevice with name `PLAT_DEV`. Check `/sys/bus/platform/devices/` for the valid name.\n\n### Examples\n\nIf you want to trace the execution of kernel function `schduler_tick()`.\n\n```\n$ sudo kmemsnoop x8 scheduler_tick\n```\n\nIf you want to trace the read and write access for kernel variable\n`sysctl_sched_cfs_bandwidth_slice`.\n\n```\n$ sudo kmemsnoop rw4 sysctl_sched_cfs_bandwidth_slice -v vmlinux\n\n# You can run the following command to trigger the watchpoint!\n$ cat /proc/sys/kernel/sched_cfs_bandwidth_slice_us\n```\n\nIf you want to watch the object under `struct task_struct`, for example, the\n`\u0026task-\u003eon_rq` of task pid 1.\n\n```\n$ sudo kmemsnoop --pid-task 1 rw4 \\\u0026on_rq\n```\n\n\nIf you want to watch the object point by a pointer under `task_struct`(not the\npointer itself), for example, the `task-\u003eparent` of task pid 1.\n\n```\n$ sudo kmemsnoop --pid-task 1 rw8 parent\n```\n\nIf you want to watch the field inside the struct in `task_struct`, for example,\n`\u0026task-\u003ese.nr_migrations`.\n\n```\n$ sudo kmemsnoop --pid-task 1 rw8 \\\u0026se.nr_migrations\n```\n\nIf you want to watch the field inside the struct which can be referenced from\nthe `task_struct`, for example, `\u0026task-\u003emm-\u003etask_size`.\n\n```\n$ sudo kmemsnoop --pid-task 1 rw8 \"\\\u0026mm-\u003etask_size\"\n```\n\nIf you want to trace the field `vendor` under `struct pci_dev` for PCI device\n`0001:00:00.0`.\n\n```\n$ sudo kmemsnoop --pci-dev 0000:00:00.0 rw2 \\\u0026vendor\n\n# You can run the following command to trigger the watchpoint!\n$ cat /sys/bus/pci/devices/0000:00:00.0/vendor\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frinhizakura%2Fkmemsnoop","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frinhizakura%2Fkmemsnoop","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frinhizakura%2Fkmemsnoop/lists"}