Kprobes: Difference between revisions

← Older edit

Revision as of 21:53, 6 October 2019 view source Dank (talk \| contribs) Bureaucrats, Administrators 11,302 edits No edit summary ← Older edit		Latest revision as of 03:41, 31 October 2019 view source Dank (talk \| contribs) Bureaucrats, Administrators 11,302 edits No edit summary
Line 1:		Line 1:
			[[File:Osseu-commonality.png\|thumb\|right\|Linux tracing systems]]

	Kprobes use the breakpoint mechanism to dynamically instrument Linux kernel code. Two types exist: <i>kprobes</i> can be attached to all but a few blacklisted instruction ranges in a running kernel, while <i>kretprobes</i> are attached to a function and run when it returns. This instrumentation can be packaged as a kernel module (using the <tt>register_probe</tt> and <tt>unregister_probe</tt> kernel API, as done by SystemTap), manipulated via debugfs (as done by ftrace), configured using the [[perf]] tool, or implemented as a <tt>BPF_PROG_TYPE_KPROBE</tt>-type [[eBPF]] program.		Kprobes use the breakpoint mechanism to dynamically instrument Linux kernel code. Two types exist: <i>kprobes</i> can be attached to all but a few blacklisted instruction ranges in a running kernel, while <i>kretprobes</i> are attached to a function and run when it returns. This instrumentation can be packaged as a kernel module (using the <tt>register_probe</tt> and <tt>unregister_probe</tt> kernel API, as done by SystemTap), manipulated via debugfs (as done by ftrace), configured using the [[perf]] tool, or implemented as a <tt>BPF_PROG_TYPE_KPROBE</tt>-type [[eBPF]] program.

Kprobes: Difference between revisions

Dank (talk | contribs)