Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

dynamic: x86_64: Fall back to original patching strategy when target is not running #1750

Open
wants to merge 18 commits into
base: master
Choose a base branch
from
Open

dynamic: x86_64: Fall back to original patching strategy when target is not running #1750

wants to merge 18 commits into from

Commits on Jul 6, 2023

  1. dynamic: Don't patch all functions by default 

    Originally, when the user asks to only unpatch functions, uftrace would
patch all other functions by default. This is counter-intuitive,
especially when using the agent to unpatch at runtime. The user doesn't
expect functions to be patched when they only unpatch funtions.

This commit removes this behavior, and requires the user to explicitly
define functions to patch.

Co-authored-by: Gabriel-Andrew Pollo-Guilbert <gabrielpolloguilbert@gmail.com>
Signed-off-by: Cl茅ment Guidi <cguidi@ciena.com>
    @clementguidi @gpollo
    clementguidi and gpollo committed Jul 6, 2023
    Configuration menu
    Copy the full SHA
    884f5ba View commit details
    Browse the repository at this point in the history

  2. dynamic: Don't unpatch unmatched functions 

    Libmcount would try to unpatch by default any function that is not
matched by the user patch or unpatch options.

We remove this implicit behavior, so the user explicitly choses which
function to unpatch.

Signed-off-by: Cl茅ment Guidi <cguidi@ciena.com>
    @clementguidi
    clementguidi committed Jul 6, 2023
    Configuration menu
    Copy the full SHA
    fccda9b View commit details
    Browse the repository at this point in the history

  3. dynamic: Refactor 'match_pattern_list' 

    Return whether a symbol is positively or negatively matched against a
pattern list, or not matched at all.

Co-authored-by: Gabriel-Andrew Pollo-Guilbert <gabrielpolloguilbert@gmail.com>
Signed-off-by: Cl茅ment Guidi <cguidi@ciena.com>
    @clementguidi @gpollo
    clementguidi and gpollo committed Jul 6, 2023
    Configuration menu
    Copy the full SHA
    422713e View commit details
    Browse the repository at this point in the history

  4. utils: Implement syscall wrappers for glibc < 2.30 

    Glibc < 2.30 doen't provide wrappers for 'gettid()' and 'tgkill()' so we
define them.

Signed-off-by: Cl茅ment Guidi <cguidi@ciena.com>
    @clementguidi
    clementguidi committed Jul 6, 2023
    Configuration menu
    Copy the full SHA
    8b49427 View commit details
    Browse the repository at this point in the history

  5. utils: Define signal related functions 

    Functions to setup real-time signals and broadcast signals to all
threads in an application. Useful for runtime synchronization
mechanisms.

Co-authored-by: Gabriel-Andrew Pollo-Guilbert <gabrielpolloguilbert@gmail.com>
Signed-off-by: Cl茅ment Guidi <cguidi@ciena.com>
    @clementguidi @gpollo
    clementguidi and gpollo committed Jul 6, 2023
    Configuration menu
    Copy the full SHA
    8a4ddf3 View commit details
    Browse the repository at this point in the history

  6. dynamic: x86_64: Skip already patched functions 

    Skip the functions where uftrace already injected a call to a
trampoline.

Signed-off-by: Cl茅ment Guidi <cguidi@ciena.com>
    @clementguidi
    clementguidi committed Jul 6, 2023
    Configuration menu
    Copy the full SHA
    3eca789 View commit details
    Browse the repository at this point in the history

  7. dynamic: x86_64: Refactor 'get_target_address' 

    Refactor for more clarity.

Signed-off-by: Cl茅ment Guidi <cguidi@ciena.com>
    @clementguidi
    clementguidi committed Jul 6, 2023
    Configuration menu
    Copy the full SHA
    efc15f6 View commit details
    Browse the repository at this point in the history

  8. dynamic: x86_64: Refactor 'patch_code' 

    Refactor 'patch_code' so it can later be used at runtime.

Co-authored-by: Gabriel-Andrew Pollo-Guilbert <gabrielpolloguilbert@gmail.com>
Signed-off-by: Cl茅ment Guidi <cguidi@ciena.com>
    @clementguidi @gpollo
    clementguidi and gpollo committed Jul 6, 2023
    Configuration menu
    Copy the full SHA
    3c86dea View commit details
    Browse the repository at this point in the history

  9. dynamic: x86_64: Factor out 'check_endbr64' 

    Check if instruction at a given address is ENDBR64.

Signed-off-by: Cl茅ment Guidi <cguidi@ciena.com>
    @clementguidi
    clementguidi committed Jul 6, 2023
    Configuration menu
    Copy the full SHA
    a52ccc5 View commit details
    Browse the repository at this point in the history

  10. dynamic: x86_64: Protect patch zone with trap 

    When patching a function at runtime, first insert an int3 trap so any
incoming thread is diverted from the patching region, to avoid executing
partially modified code.

The trap handler emulates a call to the trampoline, thus enabling the
instrumentation.

The trap is eventually removed in subsequent commits.

Co-authored-by: Gabriel-Andrew Pollo-Guilbert <gabrielpolloguilbert@gmail.com>
Signed-off-by: Cl茅ment Guidi <cguidi@ciena.com>
    @clementguidi @gpollo
    clementguidi and gpollo committed Jul 6, 2023
    Configuration menu
    Copy the full SHA
    550af6a View commit details
    Browse the repository at this point in the history

  11. dynamic: x86_64: Synchronize cores when patching 

    When cross-modifying code, the software needs to ensure that all cores
will execute valid instructions at any time.

When modifications are not atomic, we issue a specific memory
barrier (or execute a serializing instruction on Linux < 4.16) to
serialize the execution across all cores. This flushes the different
caches, especially the processor pipelines that may have partially
fetched straddling instructions.

Co-authored-by: Gabriel-Andrew Pollo-Guilbert <gabrielpolloguilbert@gmail.com>
Signed-off-by: Cl茅ment Guidi <cguidi@ciena.com>
    @clementguidi @gpollo
    clementguidi and gpollo committed Jul 6, 2023
    Configuration menu
    Copy the full SHA
    f94c9fe View commit details
    Browse the repository at this point in the history

  12. dynamic: x86_64: Move threads out of patching zone 

    When patching at runtime, no thread can enter the patching region due to
the trap that is inserted at the start of it.

But threads that entered the region before the trap is installed can
still be executing instructions in the region.

We broadcast a real-time signal instruction all threads to check their
instruction pointer, and execute out-of-line if they are in the patching
region.

Co-authored-by: Gabriel-Andrew Pollo-Guilbert <gabrielpolloguilbert@gmail.com>
Signed-off-by: Cl茅ment Guidi <cguidi@ciena.com>
    @clementguidi @gpollo
    clementguidi and gpollo committed Jul 6, 2023
    Configuration menu
    Copy the full SHA
    c4929b8 View commit details
    Browse the repository at this point in the history

  13. dynamic: Batch function patching process 

    Synchronization requires sending signals to threads inside the process.
This is performed for every symbols, which means a lot of signal can be
sent. This has a major performance impact. This commit batches the
initial and final steps of the patching process so we only need to send
one signal per thread for every batch.

Co-authored-by: Gabriel-Andrew Pollo-Guilbert <gabrielpolloguilbert@gmail.com>
Signed-off-by: Cl茅ment Guidi <cguidi@ciena.com>
    @clementguidi @gpollo
    clementguidi and gpollo committed Jul 6, 2023
    Configuration menu
    Copy the full SHA
    c826911 View commit details
    Browse the repository at this point in the history

  14. dynamic: x86_64: Full-dynamic runtime unpatching 

    This commit add for dynamically unpatching functions for the x86_64
architecture. The process is executed concurrently by replacing using a
trap to resolve race conditions between thread (similar to how optimized
kprobes are done).

Co-authored-by: Gabriel-Andrew Pollo-Guilbert <gabrielpolloguilbert@gmail.com>
Signed-off-by: Cl茅ment Guidi <cguidi@ciena.com>
    @clementguidi @gpollo
    clementguidi and gpollo committed Jul 6, 2023
    Configuration menu
    Copy the full SHA
    5f3d756 View commit details
    Browse the repository at this point in the history

  15. dynamic: Batch function unpatching process 

    Synchronization requires sending signals to threads inside the process.
This is performed for every symbols, which means a lot of signal can be
sent. This has a major performance impact. This commit batches the
initial and final steps of the patching process so we only need to send
one signal per thread for every batch.

Co-authored-by: Gabriel-Andrew Pollo-Guilbert <gabrielpolloguilbert@gmail.com>
Signed-off-by: Cl茅ment Guidi <cguidi@ciena.com>
    @clementguidi @gpollo
    clementguidi and gpollo committed Jul 6, 2023
    Configuration menu
    Copy the full SHA
    06d2cdf View commit details
    Browse the repository at this point in the history

  16. uftrace: Apply dynamic (un)patching at runtime 

    Add support for the '--patch' and '--unpatch' options in the client.
When used, the agent patches or unpatches symbols on the fly.

Co-authored-by: Gabriel-Andrew Pollo-Guilbert <gabrielpolloguilbert@gmail.com>
Signed-off-by: Cl茅ment Guidi <cguidi@ciena.com>
    @clementguidi @gpollo
    clementguidi and gpollo committed Jul 6, 2023
    Configuration menu
    Copy the full SHA
    fe06e08 View commit details
    Browse the repository at this point in the history

  17. mcount: Use flag to indicate if target is running 

    Use a global flag to indicate the state of the target. When the target
is not running, tasks such as dynamic patching can be performed with
less constraints.

If libmcount.so is dynamically injected (not implemented yet), the
'mcount_target_running' flag indicates that libmcount has to be
initialized in a running target.

Signed-off-by: Cl茅ment Guidi <cguidi@ciena.com>
    @clementguidi
    clementguidi committed Jul 6, 2023
    Configuration menu
    Copy the full SHA
    24d7b8e View commit details
    Browse the repository at this point in the history

  18. dynamic: x86_64: Use soft patching in cold targets 

    When patching a binary before its execution, we can skip the
serialization and critical zone exclusion steps. These steps are only
use full when cross-modification occurs, at runtime.

Signed-off-by: Cl茅ment Guidi <cguidi@ciena.com>
    @clementguidi
    clementguidi committed Jul 6, 2023
    Configuration menu
    Copy the full SHA
    e5bbd27 View commit details
    Browse the repository at this point in the history