This is the mail archive of the
systemtap@sourceware.org
mailing list for the systemtap project.
Re: [PATCH -tip v5 4/7] tracing: add kprobe-based event tracer
- From: Ingo Molnar <mingo at elte dot hu>
- To: Christoph Hellwig <hch at infradead dot org>
- Cc: Masami Hiramatsu <mhiramat at redhat dot com>, Steven Rostedt <rostedt at goodmis dot org>, lkml <linux-kernel at vger dot kernel dot org>, systemtap <systemtap at sources dot redhat dot com>, kvm <kvm at vger dot kernel dot org>, Ananth N Mavinakayanahalli <ananth at in dot ibm dot com>, Frederic Weisbecker <fweisbec at gmail dot com>, Tom Zanussi <tzanussi at gmail dot com>
- Date: Mon, 11 May 2009 12:53:37 +0200
- Subject: Re: [PATCH -tip v5 4/7] tracing: add kprobe-based event tracer
- References: <20090509004829.5505.38720.stgit@localhost.localdomain> <20090509004859.5505.18729.stgit@localhost.localdomain> <20090511093224.GC23875@infradead.org>
* Christoph Hellwig <hch@infradead.org> wrote:
> On Fri, May 08, 2009 at 08:48:59PM -0400, Masami Hiramatsu wrote:
> > Add kprobes based event tracer on ftrace.
> >
> > This tracer is similar to the events tracer which is based on
> > Tracepoint infrastructure. Instead of Tracepoint, this tracer is
> > based on kprobes(kprobe and kretprobe). It probes anywhere where
> > kprobes can probe(this means, all functions body except for
> > __kprobes functions).
>
> That's some pretty cool functionality, especially together with
> patch 7.
Yes. I insisted on this model, because this is essentially
kprobes-done-right. Exposing unsafe kernel instrumentation APIs was
a big mistake to merge upstream, it delayed the proper design of
this stuff by almost a decade.
There's two more details to be solved before this can go into the
tracing tree.
> But as with so many tracing bits in the kernel it's just lowlevel
> bits without a good user interface. We'd really need some
> high-level way for sysadmins/developers to use it. E.g. a version
> of the systemtap compiler that doesn't build a kernel module but
> instead uses the event tracer + the kprobes tracer.
Yes, exactly.
> Or a model like Tom's zedtrace where a perl script would do the
> dwarf lookups and generates these probes in addition to the
> filtered event traces.
Correct, that's the other, IMHO superior direction that is being
pursued. If you look at the evolution of the filter code it gives
the seeds for safe scripting done in the kernel.
Such filters/scripts can then be reused for a whole lot more stuff,
such as security rules. (netfilters could use it too, etc.)
Ingo