dtrace discuss - Aug 2006 - Why an arg in a syscall:::entry probe might not be in memory

I was taking a guess as to why an arg (i.e. the name a file to open) in 
a syscall:::entry probe might not be in real memory at the time the 
probe fires.  The two reasons I came up with are: 1) the string was a 
constant and on a page that hasn''t been accessed yet, or 2)
it''s been a
while since the page has been accessed and it got paged out.

Does this seem reasonable, or am I missing another big reason?

Thanks,
Chip

On Mon, Aug 14, 2006 at 01:14:52PM -0500, Chip Bennett
wrote:
> I was taking a guess as to why an arg (i.e. the name a file to open) in 
> a syscall:::entry probe might not be in real memory at the time the 
> probe fires.  The two reasons I came up with are: 1) the string was a 
> constant and on a page that hasn''t been accessed yet, or 2)
it''s been a
> while since the page has been accessed and it got paged out.
> 
> Does this seem reasonable, or am I missing another big reason?
Those are the big two -- with the first being far, far more likely.  The
way to work around this (as I imagine you know) is to stash the address
on the entry and then do the copyin() on the return (when you know that
the kernel has done the blocking copyin() for you).

	- Bryan

--------------------------------------------------------------------------
Bryan Cantrill, Solaris Kernel Development.       http://blogs.sun.com/bmc