System call instrumentation

[Ingo Molnar]

* Mathieu Desnoyers <mathieu.desnoyers@polymtl.ca> wrote:

> Ideally, I'd like to have this kind of high-level information :
> 
> event name : kernel syscall
> syscall name : open
> arg1 (%s) : "somefile"    <-----
> arg2 (%d) : flags
> arg3 (%d) : mode
> 
> However, "somefile" has to be read from userspace. With the protection 
> involved, it would cause a performance impact to read it a second time 
> rather than tracing the string once it's been copied to kernel-space.

performance is a secondary issue here, and copies are fast anyway _if_ 
someone wants to trace a syscall. (because the first copy brings the 
cacheline into the cache, subsequent copies are almost for free compared 
to the first copy)

	Ingo