RE: Improvement for post-handler only case in kprobes

["Stone, Joshua I" <joshua dot i dot stone at intel dot com>]

On Sunday, October 29, 2006 6:02 AM, Jun Koi wrote:
> [...]
> In case we only has post-handler (NOT pre-handler), we can eliminate
> the single-mode step in the following way:
> - Still put BreakPoint at the registered address.
> - After the single-step, remove the old BreakPoint and put it at the
> current EIP (this is the place we switch out with single-step). Next
> time, we only need to handle the breakpoint, as it is hit right after
> the "original" breakpoint. Hence we dont need to get into the
> single-step mode any more. Of course this improves the performance.

So you're basically suggesting to turn a post-handler on a instruction
into a pre-handler on the following instruction?

This is equivalent only if you can guarantee that the two instructions
will always execute together.  Thus the first instruction cannot be a
control instruction (branch, jump, etc.), and the second cannot be the
target of any control instruction.  You would have to do full
basic-block analysis to guarantee this condition.

In any case, I don't think you'll save anything, because whatever
instruction is replaced with a breakpoint still needs to be executed.
This happens out-of-line and single-stepped.


Josh