![]() | |||||||||||
Messages in this thread Complete thread (EXPERIMENTAL) |
Andrew Morton wrote:
On Tue, 19 Sep 2006 09:04:43 -0700
Martin Bligh <mbligh@google.com> wrote: It seems like all we'd need to do
is "list all references to function, freeze kernel, update all references, continue" "overwrite first 5 bytes of old function with `jmp new_function'". Yes, that's simple. but slower, as you have a double jump. Probably a damned sight faster than int3 though. M. The advantage of using int3 over jmp to launch the instrumented module is that int3 (or breakpoint in most architectures) is an atomic operation to insert. I am getting some more ideas... 1. Copy the original functions, instrument them and insert them as a part of kernel module with different name prefix. 2. Insert breakpoint only on those routines at runtime. 3. When the breakpoint gets hit, change the instruction pointer to the instrumented routine. No need to single step at all. Adv: Can be enabled/disabled dynamically by inserting/removing breakpoints. No overhead of single stepping. No restriction of running the handler in interrupt context. You can have pre-compiled instrumented routines. This mechanism can be used for pre-defined set of routines and for arbiratory probe points, you can use kprobes/jprobes/systemtap. No need to be super-user for predefined breakpoints. Dis: Maintainence of the code, since it can code base need to be duplicated and instrumented. The above idea is similar to runtime or dynamic patching, but here we use int3(breakpoint) rather than jump instruction. Please correct me if I am wrong. Please let me know if need more information. Thanks Prasanna -- Prasanna S.P. Linux Technology Center India Software Labs, IBM Bangalore Email: prasanna@in.ibm.com Ph: 91-80-41776329 | ||||||||||
![]() | |||||||||||
| Last update: 2006-09-19 17:13 [W:0.340 / U:0.060 seconds] ©2003-2005 Jasper Spaans | |||||||||||