The problem is that it then does not properly mix with other events outside of the
control of the application.
For example if there are two apps both generating user events, but there's no
connection with them, a system-wide tracer wont get a properly ordered set of events
- both apps will trace into their own buffers. So if we have:
CPU1
app1: "user event X"
app2: "user event Y"
Then a 'trace --all' system-wide tracing session will not get proper ordering
between app1 and app2's events. It only gets timestamps - which may or may not be
correct.
User-space tracing schemes tend to be clumsy and limiting. There's other
disadvantages as well: approaches that expose a named pipe in /tmp or an shmem
region are not transparent and robust either: if user-space owns a pending buffer
then bugs in the apps can corrupt the trace buffer, can prevent its flushing when
the app goes down due to an app bug (and when the trace would be the most useful),
etc. etc.
Also, in general their deployment isnt particularly fast nor lightweight - while
prctl() is available everywhere.
And when it comes to tracing/instrumentation, if we make deployment too complex,
people will simply not use it - and we all use. A prctl() isnt particularly sexy
design, but it's a task/process event that we are generating (so related to prctls),
plus it's available everywhere and is very easy to deploy.
Thanks,
Ingo
--