Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

dynamic: x86_64: Optimize runtime dynamic patching #1747

Open
wants to merge 10 commits into
base: master
Choose a base branch
from

Conversation

clementguidi and others added 10 commits July 6, 2023 12:26
Glibc < 2.30 doen't provide wrappers for 'gettid()' and 'tgkill()' so we
define them.

Signed-off-by: Cl茅ment Guidi <cguidi@ciena.com>
Functions to setup real-time signals and broadcast signals to all
threads in an application. Useful for runtime synchronization
mechanisms.

Co-authored-by: Gabriel-Andrew Pollo-Guilbert <gabrielpolloguilbert@gmail.com>
Signed-off-by: Cl茅ment Guidi <cguidi@ciena.com>
Skip the functions where uftrace already injected a call to a
trampoline.

Signed-off-by: Cl茅ment Guidi <cguidi@ciena.com>
Refactor for more clarity.

Signed-off-by: Cl茅ment Guidi <cguidi@ciena.com>
Refactor 'patch_code' so it can later be used at runtime.

Co-authored-by: Gabriel-Andrew Pollo-Guilbert <gabrielpolloguilbert@gmail.com>
Signed-off-by: Cl茅ment Guidi <cguidi@ciena.com>
Check if instruction at a given address is ENDBR64.

Signed-off-by: Cl茅ment Guidi <cguidi@ciena.com>
When patching a function at runtime, first insert an int3 trap so any
incoming thread is diverted from the patching region, to avoid executing
partially modified code.

The trap handler emulates a call to the trampoline, thus enabling the
instrumentation.

The trap is eventually removed in subsequent commits.

Co-authored-by: Gabriel-Andrew Pollo-Guilbert <gabrielpolloguilbert@gmail.com>
Signed-off-by: Cl茅ment Guidi <cguidi@ciena.com>
When cross-modifying code, the software needs to ensure that all cores
will execute valid instructions at any time.

When modifications are not atomic, we issue a specific memory
barrier (or execute a serializing instruction on Linux < 4.16) to
serialize the execution across all cores. This flushes the different
caches, especially the processor pipelines that may have partially
fetched straddling instructions.

Co-authored-by: Gabriel-Andrew Pollo-Guilbert <gabrielpolloguilbert@gmail.com>
Signed-off-by: Cl茅ment Guidi <cguidi@ciena.com>
When patching at runtime, no thread can enter the patching region due to
the trap that is inserted at the start of it.

But threads that entered the region before the trap is installed can
still be executing instructions in the region.

We broadcast a real-time signal instruction all threads to check their
instruction pointer, and execute out-of-line if they are in the patching
region.

Co-authored-by: Gabriel-Andrew Pollo-Guilbert <gabrielpolloguilbert@gmail.com>
Signed-off-by: Cl茅ment Guidi <cguidi@ciena.com>
Synchronization requires sending signals to threads inside the process.
This is performed for every symbols, which means a lot of signal can be
sent. This has a major performance impact. This commit batches the
initial and final steps of the patching process so we only need to send
one signal per thread for every batch.

Co-authored-by: Gabriel-Andrew Pollo-Guilbert <gabrielpolloguilbert@gmail.com>
Signed-off-by: Cl茅ment Guidi <cguidi@ciena.com>
Copy link
Owner

@namhyung namhyung left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Right, I expect you do this kind of work. :) Will take a look later..

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants