Re: [PATCH -tip v5 00/10] kprobes: Kprobes jump optimization support

Masami Hiramatsu
2009-11-24T16:04:56Z

Ingo Molnar wrote:
>
> * Frederic Weisbecker <fweisbec@gmail.com> wrote:
>
>> On Tue, Nov 24, 2009 at 03:03:19AM +0100, Frederic Weisbecker wrote:
>>> On Mon, Nov 23, 2009 at 06:21:16PM -0500, Masami Hiramatsu wrote:
>>>> When the optimized-kprobe is hit before optimization, its handler
>>>> changes IP(instruction pointer) to copied code and exits. So, the
>>>> instructions which were copied to detour buffer are executed on the detour
>>>> buffer.
>>>
>>>
>>>
>>> Hm, why is it playing such hybrid game there?
>>> If I understand well, we have executed int 3, executed the
>>> handler and we jump back to the detour buffer?
>>>
>>
>> I got it, I think. We have instructions to patch. And the above turn
>> this area into dead code, safe to patch.
>>
>> But still, stop_machine() seem to make it not necessary anymore.
>
> i think 'sending an IPI to all online CPUs' might be an adequate
> sequence to make sure patching effects have propagated. I.e. an
> smp_call_function() with a dummy function?

Hmm, I assume that you mean waiting for all int3 handler.

We have to separate below issues:
- int3-based multi-bytes code replacement
- multi-instruction replacement with int3-detour code

The former is implemented on patch 9/10 and 10/10. As you can see,
these patches are RFC status, because I'd like to wait for official
reply of safeness from processor architects.
And it may be able to use a dummy IPI for 2nd IPI because it
just for waiting int3 interrupts. But again, it is just estimated that
replacing with/recovering from int3 is automatically synchronized...

However, at least stop_machine() method is officially described
at "7.1.3 Handling Self- and Cross-Modifying Code" on the intel's
software developer's manual 3A . So currently we can use it.

For the latter issue, as I explained on previous reply, we need
to wait all running interrupts including hardware interrupts.
Thus I used synchronize_sched().

Thank you,