Lots of the low level exception/trap/fault handling functions are blacklisted, probably to avoid lockups and unwanted recursion mayhem: $ sudo wc -l /sys/ker

Lots of the low level exception/trap/fault handling functions are blacklisted, probably to avoid lockups and unwanted recursion mayhem: $ sudo wc -l /sys/kernel/debug/kprobes/blacklist 783 /sys/kernel/debug/kprobes/blacklist Edit: Perhaps an alternative approach would be to attach probes to relevant (precise) PMU events. There's also this prototype of adding breakpoint/watchpoint support to eBPF [1]. But actually doing stuff within this context may get complicated very fast, so would need to be severely limited, if feasible at all. [1] https://ebpf.io/summit-2020-slides/eBPF_Summit_2020-Lightning-Manali_Shukla-Hardware_Breakpoint_implementation_in_BCC.pdf https://ebpf.io/summit-2020-slides/eBPF_Summit_2020-Lightnin...