DTrace and eBPF: new challenges
summary
DTrace reaches 98% feature parity and now runs on upstream kernels after removing non-upstream patches, but generating BPF from scripts hits the verifier hard: the verifier’s 1,000,000 instruction limit and weak range tracking cause rejects for loops and inlined logic, forcing careful code generation. Probe creation and BPF attach errors return opaque ENOENT/EINVAL, kprobe/uprobe installation is slow for 10–20k functions, so Ftrace registration is recommended, and symbol lookup breaks when modules are built‑in versus loadable—proposal: ship a linker map file per kernel to map built‑in symbols.
AI-written summary · about
chapters (6)
- 0:00Introduction to DTrace
- 2:09DTrace current status
- 3:12BPF verifier challenges
- 8:50Probe creation issues
- 12:45Module symbol naming problem
- 17:18Linker map for built-in modules
related talks
51meBPF Warfare - Detecting Kernel & eBPF Rootkits with Tracee
34mTracing: The Bane of You Security Folks
32mChallenges of Deploying eBPF-based Tracing in Embedded Systems, and Alternatives in Embe...
33meBPF: exploring use case of BPF kernel infrastructure
36mDebugging with eBPF on Arm Platforms
40mExploring Runtime Security and Forensic using eBPF
32meBPF: The Next Power Tool of SREs
29meBPF on the Rise - Getting Started