Experiences with kprobes

[Baruch Even]

Frank Ch. Eigler wrote:
>>I guess it doesn't align with the systemtap group objectives but I'd be 
>>happy to see a static instrumentation tool for the kernel to allow me to 
>>insert the code I need after compilation. Hopefully such a method would 
>>have a lower overhead.
> 
> Could you explain what you mean?  Inserting code after compilation is
> normally called dynamic, not static instrumentation.  (We are actually
> interested in supporting static instrumentation in some form.)

I understand static vs. dynamic as in changing the kernel image before 
booting it vs. changing it after boot (in run-time). Kprobes is dynamic 
obviously and that seems to be the source of a large part of the overhead.

I was looking into kernel image modification before booting and then 
supposedly I don't need to use interrupts but only add instructions 
in-place to do the analysis.

I've found a few that do it dynamically, and one that does it static, 
but it requires patches to the tool-chain and I'm not sure it works on 
the kernel. http://www.elis.ugent.be/fit/

I'm now looking to evaluate AspectC++ to do this at the source code 
level, though they only claim to only work with gcc 2.95.

Baruch