Djprobe - Probing the Kernel With the Smallest OverheadMasami Hiramatsu (firstname.lastname@example.org)
Direct Jump Probe (djprobe) is an enhancement of kprobes. Djprobe uses a jump instruction instead of a break-point to probe point for reducing probing overhead. We already have the kprobes, which is very useful to insert probes into anywhere in the kernel. Even though the kprobe "booster" speeds up probing, there is still too much probing overhead to trace tens of thousands events per second for measuring performance without considerable effects.
In this presentation, we will discuss how djprobe is designed to insert a jump and how the safeness of insertion, cross self-modification and etc., are checked. we also gives how you use djprobe to speed probing up and shows the performance improvement of djprobe comparing with kprobes.