Where have all the kprobes gone
summary
Many BPF-attached tracing probes silently drop execution because different attach layers enforce different re-entry checks and some layers never exported miss stats. Legacy perf + SET_BPF ioctl had limits, but miss counts on perf links are now retrievable via the BPF tool link after adding counters to link objects. kprobes block nested kprobes at the CPU level, kprobe_multi and uprobes use different checks, and a surprising hard limit of 64-depth uprobe return limit can overflow. The key distinction is per-cpu vs per-program re-entry checks.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:25Kprobe nesting issue
- 4:19Kprobe attach layers
- 9:42BPF program execution checks
- 15:46Probe attach layer overview
- 19:17Mist counter improvements
- 23:30Ftrace recursion lock discussion
- 27:19Q&A
related talks
37mState of kprobes/trampolines batch attachment
34mTracing: The Bane of You Security Folks
32meBPF: The Next Power Tool of SREs
51meBPF Warfare - Detecting Kernel & eBPF Rootkits with Tracee
31meBPF for Observability: The Good, the Bad, and the Ugly
28mBeyond Power and Magic: Forging Stable eBPF Tools for the Post-Demon King Era
27mDetecting Double Free With BPF
32mContainer Escape Paths Nobody Monitors: Abusing Linux Debug Interfaces