About your comment on the architecture, I just want to clarify a few points. First, the architecture diagram you see at http://ltt.polymtl.ca/tracingwiki/images/4/46/Ts2009-Syst... focuses on tracing of userland. In this diagram, kernel tracing is contained within the "kernel trace facilities" box. For user-space tracing, where the goal is to get data out of the applications, it makes sense to consider than user-space is working. As you point out, this assumption makes less sense when we talk about tracing the kernel.
Second, more specifically about the LTTng kernel tracer, you are right in that the current mechanism used to extract data is a splice() system call controlled by a user-space daemon. However, alternate implementations of ltt-relay-alloc.c and ltt-relay-lockless.c could easily permit to use a high-speed debug interface. This has already been done with earlier LTTng versions for ARM.
The core of the LTTng kernel tracer therefore does not depend on userland. It's only the peripheral data extraction and trace control modules which depend on working userland. But they could be replaced easily by built-in kernel objects interacting directly with the LTTng kernel API. I made sure all operations we allow from interfaces presented to user-space are also doable from within the kernel.