RE: reducing cost of user-space probes

["O Mahony, Billy" <billy.o.mahony@intel.com>]

Hi David,

Thanks for that tip. I'll read up on it.

Cheers,
Billy

> -----Original Message-----
> From: Josh Stone [mailto:jistone@redhat.com]
> Sent: Monday, April 24, 2017 7:38 PM
> To: David Smith <dsmith@redhat.com>; O Mahony, Billy
> <billy.o.mahony@intel.com>
> Cc: systemtap@sourceware.org
> Subject: Re: reducing cost of user-space probes
> 
> On 04/24/2017 08:49 AM, David Smith wrote:
> >> Does this mean that each time the probe is hit that a system call is made
> to this new .ko module? That would surely mean quite a lot of overhead. If
> this is correct, can this overhead be avoided for user space probes.
> >
> > The default "linux" runtime generates source for a kernel module,
> > compiles and installs it behind the scenes. That's how the default
> > runtime works. A system call is not made to the kernel module every
> > time the probe is hit (even it it wanted to, kernel modules can't call
> > system calls). Systemtap uses a kernel feature called 'uprobes' to
> > handle user-space probe hits.
> 
> It's not a syscall, rather an int3 trap, but the overhead is roughly the same.
> You pay the cost of a transition to and from ring0 *every* time, even if you
> otherwise short-circuit the probe with 'next' or similar.
> 
> This is where "stap --runtime=dyninst" might shine, as the probe executes
> entirely in-process.