16:07 <lightydo> Hi, can someone provide an example of counting all sw page faults per process?

16:08 <lightydo> I am trying to see if I can replicate the work done by capsule8 (meltdown detection tool - https://github.com/capsule8/capsule8/blob/master/examples/meltdown/main.go) via systemtap.

16:11 <fche> lightydo, hi

16:13 <fche> https://sourceware.org/systemtap/examples/#memory/pfaults.stp <- this one's a very basic log

16:14 <fche> https://sourceware.org/systemtap/examples/#memory/numa_faults.stp <-- this one's more process-aggregated

16:15 <lightydo> Hi fche, I thought the approach would be to use something like : probe perf.sw.page_faults.counter("a") { }

16:15 <fche> that sort of thing would probably work too, so basically don't trap them all just try to collect counts

16:17 <lightydo> yes, the question is where to aggregate the counter... page_faults_cnt[pid()] <<< @perf("a")

16:19 <fche> those @perf("...") type count values are only accessible in userspace probes (due to limitations in older kernels; current kernel should let us remove that restrictions, but that's some work)

16:20 <fche> so basically probe process("...").function("main").return { } kind of thing

16:20 <fche> -or-

16:20 <fche> use systemwide (normal, .counter-less) perf probes, and then count counter hits against the then-current process

16:20 <fche> basically profiling

16:21 <fche> so then

16:21 <fche> # stap /usr/share/systemtap/examples/general/eventcount.stp 'perf.sw.page_faults'

16:24 <lightydo> thanks, i'll look into it.