libsystrap
libsystrap copied to clipboard
Support jump- as well as trap-based instrumentation
Taking a double trap on each system call is fine for some applications, but it would be better to avoid the slowdown.
We could use a jump- or call-based instrumentation, but that is harder because we need five bytes at the syscall site, and the syscall instructions are only two. Some kind of instruction punning would be a good fit (see @iu-parfunc's 'liteinst' repo and PLDI '17 paper).
The simplest thing is to jump to a trampoline that builds an IBCS sigframe-like mcontext
(is there a way to do this just by pushing registers?) and then a generic_syscall
structure, then calls our replacement handler. In other words we fake it up to look just as if it were handling a SIGILL. It's not clear that this is possible, or how much faster it would be. The next step would be to save only the caller-save registers, so it looks much more like an ordinary call.