 1#include <stdio.h>
 2#include <string.h>
 3#include <sys/mman.h>
 4#include <stdint.h>
 5#include <assert.h>
 6
 7#define STRINGIFY(s) #s
 8#define TOSTRING(s)  STRINGIFY(s)
 9
10void padding() {
11  asm volatile(
12    ".fill " TOSTRING(PADDING) ", 1, 0x90"
13  );
14}
15
16__attribute__((noinline)) void foo() {
17  printf("In old function %s\n", __func__);
18}
19
20__attribute__((noinline)) void foo_new() {
21  printf("In new function %s\n", __func__);
22}
23
24// 48 b8 (64-bit imm)   movabs $imm,%rax
25// ff e0                jmpq   *%rax
26const char PATCH[] = "\x48\xb8--------\xff\xe0";
27
28void DSU(void *func, void *func_new) {
29  int flag = PROT_WRITE | PROT_READ | PROT_EXEC, rc, np;
30
31  // Grant write permission to the memory
32  // We must handle boundary cases
33  uintptr_t fn = (uintptr_t)func;
34  uintptr_t base = fn & ~0xfff;
35  if (fn + sizeof(PATCH) > base + 4096) {
36    np = 2;
37  } else {
38    np = 1;
39  }
40  printf("np = %d\n", np);
41
42  rc = mprotect((void *)base, np * 4096, flag);
43  assert(rc == 0);  // Not expecting a failure
44  
45  // Patch the first instruction (this is UB in C spec)
46  memcpy(func, PATCH, sizeof(PATCH));
47  memcpy((char *)func + 2, &func_new, sizeof(func_new));
48
49  // Revoke the write permission
50  rc = mprotect((void *)base, np * 4096, PROT_READ | PROT_EXEC);
51  assert(rc == 0);  // Not expecting a failure
52}
53
54int main() {
55  setbuf(stdout, NULL);
56  foo();
57  DSU(foo, foo_new);  // Dynamic software update
58  foo();
59}
18. 操作系统实验生存指南¶

Take-away Messages¶
