Re: System call instrumentation

[Masami Hiramatsu <mhiramat@redhat.com>]

Hi Ingo and Mathieu,

Ingo Molnar wrote:
> * Mathieu Desnoyers <mathieu.desnoyers@polymtl.ca> wrote:
> 
>> Ideally, I'd like to have this kind of high-level information :
>>
>> event name : kernel syscall
>> syscall name : open
>> arg1 (%s) : "somefile"    <-----
>> arg2 (%d) : flags
>> arg3 (%d) : mode
>>
>> However, "somefile" has to be read from userspace. With the protection 
>> involved, it would cause a performance impact to read it a second time 
>> rather than tracing the string once it's been copied to kernel-space.
> 
> performance is a secondary issue here, and copies are fast anyway _if_ 
> someone wants to trace a syscall. (because the first copy brings the 
> cacheline into the cache, subsequent copies are almost for free compared 
> to the first copy)

I think that the code duplication is also an issue.
If we introduce functions which copy userspace strings same as
original syscall functions, we have to maintain similar codes.
So, I think Mathieu's approach (separating syscall parameters from
syscall entering event) is enough reasonable.

BTW, it seems that using KERNEL_TRACE per thread flag might be a bit
tricky to trace all threads. Out of curiosity:-), why did not you use a
global percpu flag to do it?

Thanks,

-- 
Masami Hiramatsu

Software Engineer
Hitachi Computer Products (America) Inc.
Software Solutions Division

e-mail: mhiramat@redhat.com