Em Sat, Jan 11, 2020 at 12:52:13AM +0900, Masami Hiramatsu escreveu: > On Fri, 10 Jan 2020 15:02:34 +0100 Peter Zijlstra <pet...@infradead.org> > wrote: > > Again, this only allows attaching to previously created kprobes, it does > > not allow creating kprobes, right?
> > That is; I don't think CAP_SYS_PERFMON should be allowed to create > > kprobes. > > As might be clear; I don't actually know what the user-ABI is for > > creating kprobes. > There are 2 ABIs nowadays, ftrace and ebpf. perf-probe uses ftrace interface > to > define new kprobe events, and those events are treated as completely same as > tracepoint events. On the other hand, ebpf tries to define new probe event > via perf_event interface. Above one is that interface. IOW, it creates new > kprobe. Masami, any plans to make 'perf probe' use the perf_event_open() interface for creating kprobes/uprobes? - Arnaldo
