Non-pessimal patching is possible
Posted Oct 23, 2008 14:39 UTC (Thu) by jreiser
Parent article: The source of the e1000e corruption bug
Extreme caution is required. Yes, but "live" patching can be done, perhaps including this case. I have done it when all writes are naturally aligned, when the updated code makes sense after any subset of individual writes, and when the requirements for multi-processor synchronization can be postponed (as for Read-Copy-Update).
In the particular case of x86, "call mcount" is five bytes: the one-byte opcode 0xe8, followed by four bytes of displacement. With a one-byte write, this can be changed to "test $displ,%eax" [opcode 0xe9] or "cmp $displ,%eax" [opcode 0x3d]. In this case both of these are equivalent to a no-op because of the software convention that the condition code is not busy (either as input or as output) at call. So, as long as mcount does not care about "extra" or "missing" calls [from caches or other processors] during a patch update, then live patching works and can be done inexpensively. Depending on the instruction-stream decoder, surrounding instructions, cache-line boundaries, etc., then the average time cost per patch site is most likely 0, 1/3, or 1/2 cycle; the maximum is 1 cycle.
to post comments)