This is still with a kernel entry, yes?Yes, this involves setting a breakpoint and trapping into the kernel
when it's hit. The 6-7x figure is with the current 2-trap approach
(breakpoint, single-step). Boosting could presumably make that more
like 12-14x.
Do you have plans for a variantI don't know of any such plans, but I'd be interested to read more of
that's completely in userspace?
your thoughts here. As I understand it, you've suggested replacing the
probed instruction with a jump into an instrumentation vma (the XOL
area, or something similar). Masami has demonstrated -- through his
djprobes enhancement to kprobes -- that this can be done for many x86
instructions.
What does the code in the jumped-to vma do?
Is the instrumentation code
that corresponds to the uprobe handlers encoded in an ad hoc .so?