This is the mail archive of the
systemtap@sourceware.org
mailing list for the systemtap project.
Re: Does this work? "dcprobes" an x86-hack simple djprobes-equivalent?
- From: Masami Hiramatsu <masami dot hiramatsu dot pt at hitachi dot com>
- To: karim at opersys dot com
- Cc: Richard J Moore <richardj_moore at uk dot ibm dot com>, Mathieu Desnoyers <mathieu dot desnoyers at polymtl dot ca>, "Frank Ch. Eigler" <fche at redhat dot com>, Ingo Molnar <mingo at elte dot hu>, Ingo Molnar <mingo at redhat dot com>, linux-kernel <linux-kernel at vger dot kernel dot org>, SystemTAP <systemtap at sources dot redhat dot com>, Satoshi Oshima <soshima at redhat dot com>, "Martin J. Bligh" <mbligh at mbligh dot org>, Prasanna S Panchamukhi <prasanna at in dot ibm dot com>, Tom Zanussi <zanussi at us dot ibm dot com>, Michel Dagenais <michel dot dagenais at polymtl dot ca>, William Cohen <wcohen at redhat dot com>, Alan Cox <alan at lxorguk dot ukuu dot org dot uk>, Andrew Morton <akpm at osdl dot org>, Christoph Hellwig <hch at infradead dot org>
- Date: Thu, 28 Sep 2006 11:30:32 +0900
- Subject: Re: Does this work? "dcprobes" an x86-hack simple djprobes-equivalent?
- Organization: Systems Development Lab., Hitachi, Ltd., Japan
- References: <45163D3D.4010108@opersys.com>
Hi Karim,
Thank you for new idea.
I discussed your proposal deeply with my coworkers.
I think your approach has following advantages/disadvantages/problem;
<advantages>
(a) Able to be inserted into the target address of the branch.
(b) So, binary analysis tool becomes simple.
<disadvantages>
(c) Implementation is much complicated.
(d) Highly depend on the x86 arch.
(e) Bigger overhead than djprobe.
(f) There will be side effect(*)
<problem>
(g) User applications can modify LDT. (ex. wine)
I think the dcprobe will work, but, unfortunately, it has
an vulnerability by the problem (g).
(*) In the following code:
---
a=0
do {
...
a++;
}while (a <= 100)
---
In case of inserting dcprobe at the 1st line (a=0),
it will replace 2nd (or more) instructions.
In this case, the fix up routine (based on int3)
will be invoked one hundred times.
Thanks,
--
Masami HIRAMATSU
2nd Research Dept.
Hitachi, Ltd., Systems Development Laboratory
E-mail: masami.hiramatsu.pt@hitachi.com