Re: [9fans] dtrace for plan 9

[erik quanstrom <quanstro@quanstro.net>]

On Sun Nov  8 19:58:08 EST 2009, rminnich@gmail.com wrote:
> On Sun, Nov 8, 2009 at 4:07 PM,  <dave.l@mac.com> wrote:
>
> > I'd be happy to see a BPF-style filter in the kernel for filtering events
> > before chucking them up to userland,
>
> Point taken. I could pretty easily put a simple filter like that in
> devtrace. It's just a question of what's needed.

bpf-style filters address a situation where jitter is not
important, one potentally large packet is returned per
system call and there may be many filters sitting on the
same interfaces.

with devtrace, the situation is the opposite.  jitter is
important (to eliminate), 541 small fixed-sized events can
be returned per system call and there is one trace device
per system.

tracepoints can already be inserted on a single function
entry or exit and be filtered by pid.

the common problem between bpf and devtrace is
buffer space.  i haven't run into this problem yet, but
lowering KZERO by 256mb would be enough for an
additiona 7.4 million (32-bit) buffered tracepoints.

- erik