On Thu, 7 Nov 2024 16:46:47 +0100 Marco Elver <el...@google.com> wrote:
> > My concern is that we start adding tons of special-case > > tracepoints to the implementation of system calls which > > are redundant with the sys_enter/exit tracepoints. > > > > Why favor this approach rather than hooking on sys_enter/exit ? > > It's __extremely__ expensive when deployed at scale. See note in > commit description above. Agreed. The sys_enter/exit trace events make all syscalls go the slow path, which can be quite expensive. -- Steve
