libsystrap icon indicating copy to clipboard operation
libsystrap copied to clipboard

Support jump- as well as trap-based instrumentation

Open stephenrkell opened this issue 3 years ago • 0 comments

Taking a double trap on each system call is fine for some applications, but it would be better to avoid the slowdown.

We could use a jump- or call-based instrumentation, but that is harder because we need five bytes at the syscall site, and the syscall instructions are only two. Some kind of instruction punning would be a good fit (see @iu-parfunc's 'liteinst' repo and PLDI '17 paper).

The simplest thing is to jump to a trampoline that builds an IBCS sigframe-like mcontext (is there a way to do this just by pushing registers?) and then a generic_syscall structure, then calls our replacement handler. In other words we fake it up to look just as if it were handling a SIGILL. It's not clear that this is possible, or how much faster it would be. The next step would be to save only the caller-save registers, so it looks much more like an ordinary call.

stephenrkell avatar Mar 16 '21 14:03 stephenrkell