RE: reducing cost of user-space probes

["O Mahony, Billy" <billy dot o dot mahony at intel dot com>]

Hi David,

My unbuntu packaged systemtap doesn't have dyninst support:

   $ sudo stap -v --dyninst ./vswitch.stp
   ERROR: --runtime=dyninst unavailable; this build lacks DYNINST feature
   Systemtap translator/driver (version 2.9/0.165, Debian version 2.9-2ubuntu2 (xenial))
   Copyright (C) 2005-2015 Red Hat, Inc. and others
   This is free software; see the source for copying conditions.
   enabled features: AVAHI LIBSQLITE3 NLS NSS TR1_UNORDERED_MAP

Before I get stuck into building from source - Is there a dyninst-devel package for Ubuntu about? I see there is dyninst 8.x package for Ubuntu 12 but I'm not sure I want to install them directly.

Thanks,
Billy

> -----Original Message-----
> From: O Mahony, Billy
> Sent: Tuesday, April 25, 2017 10:11 AM
> To: Josh Stone <jistone@redhat.com>; David Smith <dsmith@redhat.com>
> Cc: systemtap@sourceware.org
> Subject: RE: reducing cost of user-space probes
> 
> Hi David,
> 
> Thanks for that tip. I'll read up on it.
> 
> Cheers,
> Billy
> 
> > -----Original Message-----
> > From: Josh Stone [mailto:jistone@redhat.com]
> > Sent: Monday, April 24, 2017 7:38 PM
> > To: David Smith <dsmith@redhat.com>; O Mahony, Billy
> > <billy.o.mahony@intel.com>
> > Cc: systemtap@sourceware.org
> > Subject: Re: reducing cost of user-space probes
> >
> > On 04/24/2017 08:49 AM, David Smith wrote:
> > >> Does this mean that each time the probe is hit that a system call
> > >> is made
> > to this new .ko module? That would surely mean quite a lot of
> > overhead. If this is correct, can this overhead be avoided for user space
> probes.
> > >
> > > The default "linux" runtime generates source for a kernel module,
> > > compiles and installs it behind the scenes. That's how the default
> > > runtime works. A system call is not made to the kernel module every
> > > time the probe is hit (even it it wanted to, kernel modules can't
> > > call system calls). Systemtap uses a kernel feature called 'uprobes'
> > > to handle user-space probe hits.
> >
> > It's not a syscall, rather an int3 trap, but the overhead is roughly the same.
> > You pay the cost of a transition to and from ring0 *every* time, even
> > if you otherwise short-circuit the probe with 'next' or similar.
> >
> > This is where "stap --runtime=dyninst" might shine, as the probe
> > executes entirely in-process.