Re: [PATCH -tip v5 4/7] tracing: add kprobe-based event tracer

[Ingo Molnar <mingo@elte.hu>]

* Christoph Hellwig <hch@infradead.org> wrote:

> On Fri, May 08, 2009 at 08:48:59PM -0400, Masami Hiramatsu wrote:
> > Add kprobes based event tracer on ftrace.
> > 
> > This tracer is similar to the events tracer which is based on 
> > Tracepoint infrastructure. Instead of Tracepoint, this tracer is 
> > based on kprobes(kprobe and kretprobe). It probes anywhere where 
> > kprobes can probe(this means, all functions body except for 
> > __kprobes functions).
> 
> That's some pretty cool functionality, especially together with 
> patch 7.

Yes. I insisted on this model, because this is essentially 
kprobes-done-right. Exposing unsafe kernel instrumentation APIs was 
a big mistake to merge upstream, it delayed the proper design of 
this stuff by almost a decade.

There's two more details to be solved before this can go into the 
tracing tree.

> But as with so many tracing bits in the kernel it's just lowlevel 
> bits without a good user interface.  We'd really need some 
> high-level way for sysadmins/developers to use it.  E.g. a version 
> of the systemtap compiler that doesn't build a kernel module but 
> instead uses the event tracer + the kprobes tracer.

Yes, exactly.

> Or a model like Tom's zedtrace where a perl script would do the 
> dwarf lookups and generates these probes in addition to the 
> filtered event traces.

Correct, that's the other, IMHO superior direction that is being 
pursued. If you look at the evolution of the filter code it gives 
the seeds for safe scripting done in the kernel.

Such filters/scripts can then be reused for a whole lot more stuff, 
such as security rules. (netfilters could use it too, etc.)

	Ingo