Although dynamic tracing is a very useful feature, custom kernel modules is not a user-friendly interface. Fortunately, the Linux kernel has been extended with the support of
kprobe events, which allow us to set
kprobes probes using a
To make use of this feature, we need to configure our kernel with the
CONFIG_KPROBE_EVENT configuration variable.
debugfs interface adds probes via the
/sys/kernel/debug/tracing/kprobe_events file. For example, to add a
example_probe to the
do_sys_open function, you can execute the following command:
# echo 'p:example_probe do_sys_open dfd=%r0 filename=%r1 flags=%r2 mode=%r3' > /sys/kernel/debug/tracing/kprobe_events
The probe ...