Re: [RFC]-Approaches to user space probes

[Keshavamurthy Anil S <anil dot s dot keshavamurthy at intel dot com>]

On Fri, Jan 27, 2006 at 10:45:02AM -0800, Stone, Joshua I wrote:
> Prasanna S Panchamukhi wrote:
> > 	1. Attaching or loading the application into the tool.
> > 	2. Using a jump instruction to a trampoline and trampoline
> > 	   executing the instrumented code.
> > 	3. Using a breakpoint instruction and changing the instruction
> > 	   point to the instrumentaiton code which is part of user
> > 	   address space.
> > 	4. Using a breakpoint instruction and executing the
> > 	   instrumentation code within the breakpoint handler.
> 
> An advantage I see in 4 is the ability to have scripts with a mix of
> kernel & user probes.  This could let you do some interesting
> correlations, perhaps something like:
Sure, their is some advantange in 4, but the thing we need to see
is whether this apporach suits probing different kinds of 
application(mainly java apps).


> 
>   # Figure out if calls to strlen are causing page faults, and by whom
>   global in_strlen, strlen_pagefaults
Very nice example, but I see a problem in your script,
let me know how this problem can be addressed.

>   probe user.module("/lib/libc.so.6").function("strlen") {
>       in_strlen[tid()] = 1
Setting a variable in function entry probe and 
later trying to reset in the function return probe
is very problematic.	
>   }

>   probe kernel.function("do_page_fault") {
>       if (in_strlen[tid()])
>           strlen_pagefaults[execname()] <<< 1
>   }
>   probe user.module("/lib/libc.so.6").function("strlen").return {
>       delete in_strlen[tid()]
If in the user program, strlen() is called only once and 
assuming that the return probe failed to initialize due to
no kretprobe instance, your return probe handler will
never gets fired and your hence in_strlen[tid()] will
never gets reset and  the pagefault count will have 
wrong value.
>   }
>   probe end {
>       foreach (name in strlen_pagefaults)
>           printf("%s: %d\n", name, strlen_pagefaults[name])
>   }
> 
> I don't think this sort of thing would be easy to implement with 1-3.
> You might be able to record timestamps and try to correlate the data
> later, but that's not as reliable.
> 
> Josh