Article 5DN6H Kprobe was created but didn't return any trace data

Kprobe was created but didn't return any trace data

by
pjhades
from LinuxQuestions.org on (#5DN6H)
I'm learning kprobes on CentOS 7 (Linux 4.16.6):

Code:root@host # uname -r
4.16.6-1.el7.elrepo.x86_64Following the document, I added a kprobe to trace sys_clone calls:

Code:root@host # grep sys_clone /proc/kallsyms
ffffffff81084c70 T sys_clone
root@host # echo 'p:testprobe sys_clone' >/sys/kernel/tracing/kprobe_events
root@host # cat /sys/kernel/tracing/kprobe_events
p:kprobes/testprobe sys_clone
root@host # cat /sys/kernel/tracing/events/kprobes/testprobe/id
1874Now after enabling it and then triggering it by running whatever commands in another terminal, trace_pipe did not contain any data:

Code:root@host # echo 1 > /sys/kernel/tracing/events/kprobes/testprobe/enable
root@host # cat /sys/kernel/tracing/tracing_on
1
root@host # cat /sys/kernel/tracing/events/kprobes/testprobe/enable
1
root@host # cat /sys/kernel/tracing/events/kprobes/enable
1
root@host # cat /sys/kernel/tracing/trace_pipe
^C <-- it blocks hereThe kernel configuration looked fine:

Code:root@host # grep KPROBE /boot/config-4.16.6-1.el7.elrepo.x86_64
CONFIG_KPROBES=y
CONFIG_KPROBES_ON_FTRACE=y
CONFIG_HAVE_KPROBES=y
CONFIG_HAVE_KPROBES_ON_FTRACE=y
CONFIG_KPROBE_EVENTS=y
# CONFIG_BPF_KPROBE_OVERRIDE is not setI noticed that the installed kprobe above had a different address in /sys/kernel/debug/kprobes/list:

Code:# cat /sys/kernel/debug/kprobes/list
00000000da58e98c k SyS_clone+0x0 [DISABLED][FTRACE]Here the address 00000000da58e98c differs from ffffffff81084c70 shown by /proc/kallsyms

My questions:
1) What could be the possible cause of kprobes not working?
2) Why do /sys/kernel/debug/kprobes/list and /proc/kallsyms report different addresses?latest?d=yIl2AUoC8zA latest?i=aYXiIE4EDLY:tz_KWg1MYb4:F7zBnMy latest?i=aYXiIE4EDLY:tz_KWg1MYb4:V_sGLiP latest?d=qj6IDK7rITs latest?i=aYXiIE4EDLY:tz_KWg1MYb4:gIN9vFwaYXiIE4EDLY
External Content
Source RSS or Atom Feed
Feed Location https://feeds.feedburner.com/linuxquestions/latest
Feed Title LinuxQuestions.org
Feed Link https://www.linuxquestions.org/questions/
Reply 0 comments