All your tracing are belong to BPF

Summary: Trail of Bits published a step-by-step guide to writing BPF tracing tools directly with LLVM and the bpf() system call, avoiding specialized libraries. The post walks through loading an empty BPF program, attaching it to a tracepoint via debugfs, printing output with bpf_trace_printk, and using maps as key-value storage shared between kernel and user mode.
What you should know: BPF programs hook directly into kernel code, and the in-kernel verifier is what stands between a malformed program and a system crash or slowdown - the post notes programs are capped at 512 bytes of stack and 4096 opcodes on older kernels.

Read the original at Trail of Bits Blog ↗