instrumentation

[sj-i]

Let's say an extension is installed to the VM. All the extension has to do is incrementing an internal counter on every RINIT.
Then the timings of cache invalidation would be reliably detectable vie the counter.

There may be other ways to improve the performance and accuracy or functionality of sampling by combining it with some lightweight instrumentation.

Hook points for extensions exist in the VM even at runtime.
So we can inject some machine codes there.
In other words, installing and enabling an extension to a running VM on the fly is also possible.