one option here is not allow page faults and system wide system
calls. system wide tracing needs mmap; page faults for a task can
use write(). I left that option in case something like this came up.
So maybe splice() sounds like the right long term solution after all?
:-/
Right until you put a tracepoint (kprobe) somewhere in whatever function
is used to transfer a single page into/from a splice pipe.
That ought to be a far less common occurance than tracing page faults
though.
You can always screw yourself over using this stuff, no exceptions.
Granted, as the many notrace markings demonstrate this stuff really wants
to observe itself observing itself all the time! :)