Relief for insomniac tracepoints

Gee, really?

Kernel people have been saying "Systemtap is obsolete! Use ebpf-tools! Use bpftrace!"

So I tried to convert a few of my simplest trace programs from systemtap to run as bpftrace scripts and found that it was *not possible to read the value of a short null terminated C string from userspace in bpftrace*. At least when I tried it.

perf isn't a lot better there either. Got static tracepoints with char* arguments? Good luck with that. It doesn't know how to capture the duration of a syscall without a lot of help or post-processing either. (strace -c can, but is expensive and limited).

I can't help wish various interested parties would actually finish one trace framework before replacing it with another that - again - only services the needs of kernel hackers.

So yeah. I can't say I'm entirely shocked that it might be desirable to read userspace memory when doing full-system tracing, complex program flow analysis, targeted performance work, etc.