Fast (Trapless) Kernel Probes Everywhere
summary
Replaces trap-based Kprobes with direct control-flow rewrites and selective padding to avoid double-trap overhead: a compiler LLVM machine IR pass inserts selective nop insertion only where needed, then rewrites instructions to calls/jumps into a single global 96-byte trampoline that saves registers. Implementation on Linux Kprobes increases trapless coverage from ~79% to 96%, speeds a single probe ~10x, cuts KCFI overhead on benchmarks by ~1.4x on average and up to 3x.
AI-written summary · about
chapters (12)
- 0:00Fast trapless kernel probes intro
- 1:05Traditional kernel probes with traps
- 2:10Trap-based kernel probe limits
- 3:15Trap-free probes with direct jumps
- 4:37Key insight: fewer noops
- 5:41Direct jump rewriting challenges
- 7:25LLVM passes for selective noops
- 9:13Optimizing kernel instructions
- 9:55Uno K Probe scalability
- 10:57Performance evaluation results
- 11:42KFI performance gains
- 12:46Conclusion and future work
related talks
34mTracing: The Bane of You Security Folks
55mRecent Advances in Linux Tracing
38mThe Next Linux Superpower: eBPF Primer
25mKernel tracing with BPF
27mLow-Overhead Tracing Using eBPF for Observability into Kubernetes Apps and Services
31mFantastic tracepoints and where to find them
46mbpftrace internals
35mLinux Tracing updates