I'm trying to attach to a kprobe event for purposes of tooling, but I'm not too familiar with kprobe events. I've read that the list of registered kprobes are available in /sys/kernel/debug/kprobes/list however sudo less /sys/kernel/debug/krpobes/list shows that there are no registered kprobes. I've confirmed that krpobes/enabled is 1. Am I doing something horribly wrong?
/sys/kernel/debug/kprobes/list has the list of registered kprobes, not available kprobe hooks (cf. the The kprobes debugfs interface section of the kprobes documentation).
I don't think there's a list of available kprobe hooks somewhere. However, /sys/kernel/debug/tracing/available_filter_functions has a list of kprobe hooks available through ftrace. Most available functions should be in there. Otherwise, you can check the list of complete exposed functions in /proc/kallsyms and verify they are not blacklisted in /sys/kernel/debug/krpobes/blacklist. If a function is not in /proc/kallsyms, it's likely because is was inlined at compile time.
Am I doing something horribly wrong?
So, no, nothing horrible :-)