Kprobes: Difference between revisions
| Line 9: | Line 9: | ||
==Working with kprobes== | ==Working with kprobes== | ||
The primary means for working with kprobes from userspace is [[sysfs]] and the [[perf]] tool. | To add, trace, and destroy a kprobe, use the <tt>kprobe</tt> binary (sometimes known as <tt>kprobe-perf</tt>) from the [[perf]] toolkit. | ||
The primary means for working with longterm kprobes from userspace is [[sysfs]] and the [[perf]] tool. | |||
{|class="wikitable" | {|class="wikitable" | ||
! Task !! sysfs !! perf | ! Task !! sysfs !! perf | ||
|- | |- | ||
| List | | List functions suitable for probing | ||
|| read <tt>/sys/kernel/debug/tracing/available_filter_functions</tt> | |||
|| <tt>perf probe -F</tt> (note: in my experience, this always lacks a few available from the sysfs list. i'm unsure why.) | |||
|- | |- | ||
| Enable kprobe || <tt | | List enabled kprobes || read <tt>/sys/kernel/debug/tracing/kprobe_events</tt> || <tt>perf probe -l</tt> | ||
|- | |||
| Enable kprobe || write <tt>/sys/kernel/debug/tracing/kprobe_events</tt> | |||
|| <tt>perf probe -a</tt> | || <tt>perf probe -a</tt> | ||
|- | |||
|} | |} | ||