State of kprobes/trampolines batch attachment
summary
Kernel adds a fast batch attach path for kprobes using ftrace: a new kpro_multi link and register_fprobe wrapper let one syscall attach a BPF program to many symbols, with self-tests showing ~50,000 functions attached in under a second. Users include bpftrace and Tetragon (Redstone patches queued). Work on BPF jump trampolines yields generic trampolines that expose IP, args and per-site cookies, but multi-attach mixing raises splitting, locking and complexity issues and remains unresolved.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 0:23Batch attachment goals
- 2:10kprobes batch attachment
- 7:31kprobes multi-link API
- 11:48Current users and usage
- 12:09Jump line batch attachment status
- 16:28Multi-trampoline attachment
- 23:22Trampoline mixing complexity
- 30:18Ftrace limitations and concerns
- 36:39Q&A
related talks
34mWhat's new in the BPF world?
27mWhere have all the kprobes gone
34mTracing: The Bane of You Security Folks
25mKernel tracing with BPF
46mbpftrace internals
30mxprobes: Hybrid User/Kernel eBPF Probes for Cross-Layer Observability
25mAn introduction to bpftrace tracing language
19mDTrace and eBPF: new challenges