问题描述
在Linux内核中有kprobe事件支持ftrace的情况下，使用跟踪点事件的用例是什么?似乎可以使用kprobe事件使用"tracepoint事件"完成所有操作，因为可以将kprobe事件设置在可用tracepoint事件的同一点.
What are the use-cases for using tracepoint events when kprobe events support for ftrace is available in Linux kernel? It seems everything that is possible to be done using 'tracepoint events' is possible using kprobe events, since one can set up a kprobe event to at the same point where tracepoint event is available.
我错过了什么吗?
推荐答案
由于kprobes跟踪任意函数，因此依赖它们的工具可以轻松地从一个Linux版本过渡到另一个Linux版本.例如，可以更改函数名称或其参数之一，或者可以删除整个函数.这种变化经常发生，并且可能破坏基于kprobe的工具.
Since kprobes trace arbitrary functions, tools relying on them may easily break from one Linux version to the next. For instance, the name of the function or one of its arguments can be changed, or the whole function might be removed. This sort of change happens frequently and can break kprobe-based tools.
相反，跟踪点更稳定.它们应基本保持相同并提供相同的信息.此外，它们已已记录；您可以在/sys/kernel/debug/tracing中找到跟踪点提供的信息的类型和位置:
Conversely, tracepoints are more stable. They should remain mostly the same and provide the same information. In addition, they are documented; you can find the type and location of information provided by tracepoints in /sys/kernel/debug/tracing:
# cat /sys/kernel/debug/tracing/events/skb/kfree_skb/format
name: kfree_skb
ID: 1122
format:
field:unsigned short common_type; offset:0; size:2; signed:0;
field:unsigned char common_flags; offset:2; size:1; signed:0;
field:unsigned char common_preempt_count; offset:3; size:1; signed:0;
field:int common_pid; offset:4; size:4; signed:1;
field:void * skbaddr; offset:8; size:8; signed:0;
field:void * location; offset:16; size:8; signed:0;
field:unsigned short protocol; offset:24; size:2; signed:0;
print fmt: "skbaddr=%p protocol=%u location=%p", REC->skbaddr, REC->protocol, REC->location
这篇关于kprobes支持ftrace之后，Linux内核中的跟踪点是否冗余?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！