[dtrace-discuss] what is differenct between syscall::write:entry fbt::write:entry

[Adam Leventhal]

On Tue, Dec 25, 2007 at 05:13:08AM -0800, wan_jm wrote:
> what is differenct between syscall::write:entry fbt::write:entry
> 
> are the two probe fires at the same place.

While the two probes fire at the same place with respect to user-land code,
they correspond to different locations in the kernel's execution and to
probes with quite different uses. The first is from the syscall provider
which only provides probes related to system calls; the probe arguments are
the arguments to the system calls. The second is from the fbt provider
(function boundry tracing) which makes probes available at the entry and
return for (nearly) every function in the kernel. While the write(2)
system call happens to be implemented by a function in the kernel called
write, there's no guarantee of this correlation. For example, the prof(2)
syscall is implemented in the kernel by a function call profil.

Further, the two providers have different stabilities; you can write a
script which uses syscall::write:entry and know that it will continue to
work on future versions of Solaris (and on other operating systems).
Conversely, the fbt::write:entry probe might not exist on future or other
systems.

Adam

-- 
Adam Leventhal, FishWorks                        http://blogs.sun.com/ahl