[RFC] ptwrite uprobes
From: Andi Kleen
Date: Mon Aug 31 2026 - 16:21:45 EST
uprobes currently always require entering the kernel to log anything.
While that works well, it is rather slow.
Modern Intel CPUs have the ptwrite instruction, which can log data to
the Processor Trace buffer without entering the kernel.
This patch adds support in uprobes to patch in ptwrites instead of
the normal probes. If a user collects Processor Trace with perf
the logged data will appear in the PT log, otherwise the instructions
will be nops.
The benefit is much faster logging, but it also has a lot of
limitations. There is little filtering (other than what perf or
PT can do), no EBPF, there are restrictions on what can be logged,
and of course it depends on PT being recorded.
Still I find it useful.
For more details and performance numbers see the Documentation patch,
but it's multiple orders of magnitude faster than classic uprobes.
This patchkit touches a variety of areas: perf tools, x86 generic,
uprobes. It currently relies on a separately posted bug fix ("RCU safety
for maple tree iterators"). The patchkit is on the larger
side, and maybe it should be split up. But I wanted to keep it together
at least for the first post. Some of the earlier patches are generic
fixes for uprobes.
Comments appreciated.
-Andi Kleen