Abstract: A monitoring interface, includes logic responsive to a pre-fork event, the pre-fork event responsive to a vfork system call. The pre-fork event includes indicia that identifies a child process to be created in accordance with the vfork system call. A method for controlling the execution of a child process created from a parent process, where the parent process is monitored by a software tool includes, receiving indicia that a vfork system call will be executed by the parent process, suspending execution of the parent process, extracting a process identifier from the indicia of the vfork system call, the process identifier corresponding to a child process to be generated by the parent process when the parent process executes the vfork system call, setting a process monitor thread to observe the child process, and resuming execution of the parent process to enable the parent process to execute past the vfork system call.

Abstract: A software tool includes logic configured to enable a child process that inherits the address space of a modified parent process to execute an unaltered version of the address space when the child process inherits the altered address space of the parent process. A method for processing breakpoint events in a child process created from a parent process, when the parent process is modified by a software tool includes, storing unmodified parent process code replaced by each occurrence of a breakpoint inserted into the address space during modification of the parent process, monitoring execution of a child process created by the parent process for an initial breakpoint in the address space, suspending execution of the child process in response to an initial breakpoint, replacing each occurrence of a breakpoint in the address space with the unmodified parent process code, and resuming execution of the child process.

Abstract: A method and system for reverting a process in an in-line instrumented state to an uninstrumented state. In one embodiment, the present invention modifies selected text segment portions from the process to be uninstrumented. The present embodiment then unmaps instrumented code space such that the instrumented code space is inaccessible to the process. In this embodiment, the present invention also cleans a call stack of the process by unwinding the call stack and resetting the storage locations for return pointers from the instrumented code space to uninstrumented code space.

Abstract: The present invention, in various embodiments, is directed to techniques for providing debugging capability for program code instrumentation. In one embodiment, an instrumentor inserts an instrumentation breakpoint at the beginning of a block of original code. When this breakpoint is reached during execution of the application program that includes the block of original code, the instrumenator, from the block of original code, generates a block of instrumented code. This block of instrumented code may include debugging breakpoints that are carried from the block of original code or are inserted into the block of instrumented code during debugging. After generating the instrumented code, the instrumentor executes the instrumented code until debugging breakpoints are reached that stop the program flow, thereby allowing a programmer to perform debugging functions at these debugging breakpoints.

Abstract: Method and apparatus for dynamic instrumentation of an executable application program. The application program includes a plurality of functions, each function having an entry point and an endpoint. When the application is executed, a shared memory segment is created for an instrumentation program and the application program. Upon initial invocation of the original functions in the application program, corresponding substitute functions are created in the shared memory segment, the substitute versions including instrumentation code. Thereafter, the substitute functions are executed in lieu of the original functions in the application program.

Abstract: Method and apparatus for handling calls from relocated instrumented functions to functions that expect a return pointer value in an original address space. In various embodiments of the invention, instrumented versions of selected functions of an executable program are generated and stored in a relocation address space. When a function is called by a function in the relocation address space, a return pointer register stores a first return-pointer value that is an address in the relocation address space. The address in the original address space that corresponds (logically) to the first return-pointer value is identified as an original return-pointer value. The first return-pointer value is associated with the original return-pointer value, references to the original return-pointer value are substituted for references to the first return-pointer value, and the instruction at the address indicated by the original return-pointer value is replaced with a breakpoint.

Abstract: A debug interface, includes logic responsive to a pre-fork event, the pre-fork event responsive to a fork instruction call wherein the pre-fork event includes indicia that identifies a child process to be created in accordance with the fork instruction call. A method for controlling the execution of a child process created from a parent process, where the parent process is instrumented by a software tool includes, receiving indicia that a fork instruction will be executed by the parent process, suspending execution of the parent process, extracting a process identifier from the indicia of the fork instruction, the process identifier corresponding to a child process to be generated by the parent process when the parent process executes the fork instruction, setting a process monitor thread to observe the child process, and resuming execution of the parent process to enable the parent process to execute the fork instruction.

Abstract: A software tool includes logic configured to enable a child process that inherits the address space of a modified parent process to execute an unaltered version of the address space when the child process inherits the altered address space of the parent process. A method for processing breakpoint events in a child process created from a parent process, when the parent process is modified by a software tool includes, storing unmodified parent process code replaced by each occurrence of a breakpoint inserted into the address space during modification of the parent process, monitoring execution of a child process created by the parent process for an initial breakpoint in the address space, suspending execution of the child process in response to an initial breakpoint, replacing each occurrence of a breakpoint in the address space with the unmodified parent process code, and resuming execution of the child process.

Abstract: A pair of functions setjmp( ) and longjmp( ) shares the data related to the program context. When instrumentation starts, the instrumentation tool creates the instrumented code, resulting in two sets of program code, e.g., the original code and the instrumented code. Functions setjmp( ) and longjmp( ) in the instrumented code may be referred to as functions setjmp′( ) and longjmp′( ), respectively. In one embodiment, when function setjmp′( ) is reached, but before being executed, the setjmp′-continued location is identified, and based on this setjmp′-continued location, the corresponding setjmp-continued location is also identified and saved for later use. When un-instrumentation occurs, the instrumented code is discarded, execution reverts to the original code, and function longjmp( ) is executed, which, based on the saved information, causes execution to continue at the setjmp-continued location.

Abstract: A computer-implemented method for examining a software program using dynamic instrumentation and instruction pointer sampling. In one embodiment, the method includes the step of inserting probe code into a program during runtime. A performance analysis tool is used to collect data resulting from execution of the probe code. The performance analysis tool is also used to collect instruction pointer samples from the execution. The collected data and the instruction pointer samples are then combined.

Abstract: A method and system for reverting a process in an in-line instrumented state to an uninstrumented state. In one embodiment, the present invention modifies selected text segment portions from the process to be uninstrumented. The present embodiment then unmaps instrumented code space such that the instrumented code space is inaccessible to the process. In this embodiment, the present invention also cleans a call stack of the process by unwinding the call stack and resetting the storage locations for return pointers from the instrumented code space to uninstrumented code space.

Abstract: Method and apparatus for handling calls from relocated instrumented functions to functions that expect a return pointer value in an original address space. In various embodiments of the invention, instrumented versions of selected functions of an executable program are generated and stored in a relocation address space. When a function is called by a function in the relocation address space, a return pointer register stores a first return-pointer value that is an address in the relocation address space. The address in the original address space that corresponds (logically) to the first return-pointer value is identified as an original return-pointer value. The first return-pointer value is associated with the original return-pointer value, references to the original return-pointer value are substituted for references to the first return-pointer value, and the instruction at the address indicated by the original return-pointer value is replaced with a breakpoint.

Abstract: Method and apparatus for dynamic instrumentation of an executable application program. The application program includes a plurality of functions, each function having an entry point and an endpoint. When the application is executed, a shared memory segment is created for an instrumentation program and the application program. Upon initial invocation of the original functions in the application program, corresponding substitute functions are created in the shared memory segment, the substitute versions including instrumentation code. Thereafter, the substitute functions are executed in lieu of the original functions in the application program.

Abstract: The present invention, in various embodiments, is directed to techniques for providing debugging capability for program code instrumentation. In one embodiment, an instrumentor inserts an instrumentation breakpoint at the beginning of a block of original code. When this breakpoint is reached during execution of the application program that includes the block of original code, the instrumenator, from the block of original code, generates a block of instrumented code. This block of instrumented code may include debugging breakpoints that are carried from the block of original code or are inserted into the block of instrumented code during debugging. After generating the instrumented code, the instrumentor executes the instrumented code until debugging breakpoints are reached that stop the program flow, thereby allowing a programmer to perform debugging functions at these debugging breakpoints.