This patch adds function-return probes (AKA exit probes) to kprobes. When establishing a probepoint at the entry to a function, you can also establish a handler to be run when the function returns. The subsequent post give example of how function-return probes can be used. Two new registration interfaces are added to kprobes: int register_kretprobe(struct kprobe *kp, struct rprobe *rp); Registers a probepoint at the entry to the function whose address is kp->addr. Each time that function returns, rp->handler will be run. int register_jretprobe(struct jprobe *jp, struct rprobe *rp); Like register_kretprobe, except a jprobe is established for the probed function. To unregister, you still use unregister_kprobe or unregister_jprobe. To probe only a function's returns, call register_kretprobe() and specify NULL handlers for the kprobe. The following fields of struct retprobe are of interest to the user: handler - This function is run after the ret instruction executes, but before control returns to the return address in the caller. maxactive - The maximum number of instances of the probed function that can be active concurrently. For example, if the function is non-recursive and is called with a spinlock or mutex held, maxactive = 1 should be enough. If the function is non-recursive and can never relinquish the CPU (e.g., via a semaphore or preemption), NR_CPUS should be enough. maxactive is used to determine how many rprobe_instance objects to allocate for this particular probed function. If maxactive <= 0, it is set to a default value. See register_kretprobe(). nmissed - Initialized to zero when the rprobe is registered, and incremented every time the probed function is entered but there is no rprobe_instance object available for establishing the function-return probe. kprobe - When the rprobe is registered, this field is set to the kprobe at the entry to the function. Signed-off-by: hien Nguyen