Probe points

[William Cohen]

I have been thinking a bit about the definition of "probe points" for 
instrumentation providers.

Probe points are not really points or locations in code, but really a 
constraint on system state. For example "probe 
kernel.function("blah").entry" would fire the probe handler when a 
processor enters function blah(). No surprise there. However, for 
something like "kprobe kernel.variable("abcde").read" the one thing that 
is know for sure is that something has read (or is attempting to read) 
the variable abcde.

There are lots of other aspects of system state that are not known when 
the constraint is met. However, the point of the probe handler to gather 
other pieces of system state given that constraint.

There is some fuzziness between "probe point" and "probe handler". It 
may be easier to have a predicate in the body of the "probe handler" to 
check for a constraint. One example of this is to have a probe at a 
function entry and have the probe handler check to see if it is a 
particular caller and only log data for that particular caller.

There is also fuzziness in machine state. An example of this is the 
performance monitoring sampling mechanism. The sample is taken when a 
certain number of events (e.g. number of memory access) occur. However, 
the sample does not point to the exact instruction that pushed the count 
over the interval; it may be earlier or later than the the sampled 
instruction. With multiple processors in the machines there are other 
possibilities for state to change while the probe handler is operating.

Trying out some examples here:

"kernel.function("blah").entry" contraints:
	At the first instruction of fucntion blah
	all arguments for function blah available

"kernel.function("blah").exit" contraints:
	after last instruction of function blah
	before instruction after caller call
	return value available

"kernel.condition(global_variable<50)"
	when variable on left changes evaluate expression
	could implement with watch points
	also do condition check when module first started
	when probe fires, know that global_variable was less than 50.



-Will