reducing cost of user-space probes

[Josh Stone]

On 04/24/2017 08:49 AM, David Smith wrote:
>> Does this mean that each time the probe is hit that a system call is made to this new .ko module? That would surely mean quite a lot of overhead. If this is correct, can this overhead be avoided for user space probes.
> 
> The default "linux" runtime generates source for a kernel module,
> compiles and installs it behind the scenes. That's how the default
> runtime works. A system call is not made to the kernel module every
> time the probe is hit (even it it wanted to, kernel modules can't call
> system calls). Systemtap uses a kernel feature called 'uprobes' to
> handle user-space probe hits.

It's not a syscall, rather an int3 trap, but the overhead is roughly the
same.  You pay the cost of a transition to and from ring0 *every* time,
even if you otherwise short-circuit the probe with 'next' or similar.

This is where "stap --runtime=dyninst" might shine, as the probe
executes entirely in-process.