Re: [PATCH -tip v5 07/10] kprobes/x86: Support kprobes jump optimization on x86

Frederic Weisbecker
2009-11-24T03:14:56Z

On Mon, Nov 23, 2009 at 06:22:11PM -0500, Masami Hiramatsu wrote:
> Introduce x86 arch-specific optimization code, which supports both of
> x86-32 and x86-64.
>
> This code also supports safety checking, which decodes whole of a function
> in which probe is inserted, and checks following conditions before
> optimization:
> - The optimized instructions which will be replaced by a jump instruction
> don't straddle the function boundary.
> - There is no indirect jump instruction, because it will jumps into
> the address range which is replaced by jump operand.
> - There is no jump/loop instruction which jumps into the address range
> which is replaced by jump operand.
> - Don't optimize kprobes if it is in functions into which fixup code will
> jumps.
>
> This uses stop_machine() for corss modifying code from int3 to jump.
> It doesn't allow us to modify code on NMI/SMI path. However, since
> kprobes itself doesn't support NMI/SMI code probing, it's not a
> problem.
>
> Changes in v5:
> - Introduce stop_machine-based jump replacing.

I realize now that int 3 live patching doesn't need stop_machine().
But still, I don't understand the int 3 unecessary step.

You first force int 3 patching, and later try to optimize
with a jump, using stop_machine().

But why the int 3 is a necessary first step? I guess it was
necessary first when you used it as a gate:

- patch with int 3, go to handler, go to old instruction
that was patched, jump to original code that folows
instruction that was patched
- set up detour buffer, execute handler (from int 3)
then route to detour buffer, and original code that
follows
- the code to be patched with the jump is now a
dead code, jump to it

And now that you use stop_machine(), the complexity could be
reduced to:

- decide kprobe mode
- if int 3, then do like usual
- if jmp, then prepare detour buffer, and patch with the jump,
without worrying about routing int 3 to the detour buffer
to create a dead code area. It is now safe because of stop_machine()

Of course it's possible I completely misunderstood the whole
thing :)