Re: core files

Jakub Jelinek (jj@sunsite.ms.mff.cuni.cz)
Wed, 30 Dec 1998 11:13:13 +0100 (CET)


>
> Hi Chris,
>
> > The speed would suck rocks. Run squid or netscape under strace and
> > you'll see what I mean.
>
> strace does a lot more work than necessary for this kind of filtering.
> It fetches all the arguments and *data* for the system call through a
> straw one word wide named PTRACE_PEEKDATA. A 'ucore' program wouldn't
> have to do that, because almost all the time, all it needs is ORIG_EAX.
>
> Run strace under strace and you'll see what I mean.

It has to schedule for every syscall, that is the major overhead. Normally,
simple system calls should be nearly as fast as normal subroutine calls, but
such ucore program would definitely kill it.
On the other side, if some kind of corename patch makes it into the kernel
and administrator chooses to put all core files e.g to
/tmp/cores/core.<pid>, then some ucore program can poll on /tmp/cores and
once it notices a new file created there, just spawn a debugger or whatever
the user wants (not that I'd like to do it on my machines).
But such thing should be implemented in userland, why to bloat the kernel.

Cheers,
Jakub
___________________________________________________________________
Jakub Jelinek | jj@sunsite.mff.cuni.cz | http://sunsite.mff.cuni.cz
Administrator of SunSITE Czech Republic, MFF, Charles University
___________________________________________________________________
UltraLinux | http://ultra.linux.cz/ | http://ultra.penguin.cz/
Linux version 2.1.130 on a sparc64 machine (3958.37 BogoMips)
___________________________________________________________________

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/