3 ms·
Brendan answered with advantages, but for how: it's still just a software breakpoint, int3/0xCC on x86 as you say. But the round trip of dealing with that brea
by CUViper 11y ago
Brendan answered with advantages, but for how: it's still just a software breakpoint, int3/0xCC on x86 as you say. But the round trip of dealing with that breakpoint is much tighter, because the handler function is called directly in the kernel trap, without even a context switch. Uprobes has about the minimal overhead that a software breakpoint can possibly have, whereas involving a userspace debugger requires a bunch of syscalls and context switches every time.