GILK: A dynamic instrumentation tool for the Linux Kernel

Abstract. This document describes a novel instrumentation tool for the Linux Kernel and Intel x86 architecture. We describe how the tool allows a stock Linux kernel to be modied while in execution. A convenient graphical interface allows the user to browse the control- ow graph of each kernel function, and insert user-specied instrumentation before or after any basic block. The instruments are implemented as kernel modules and, as such, are written in `C ' with access to all parts of the kernel. The Intel x86 architecture poses a particular problem, due to variable length instructions, which this paper addresses for the rst time. We evaluate the potential of the tool for performance instrumentation, and compare it with an alternative. Finally we present a short case study illustrating its use in understanding i/o behaviour in the kernel. The source code is freely available for download.