Apparatus, device, method and computer program for modifying target application

Abstract

The present disclosure describes an apparatus, device, method and computer program for modifying a target application. Examples relate to apparatuses, devices, methods, and computer programs for modifying a target application. An apparatus for a computer system includes memory circuitry, machine-readable instructions, and processor circuitry to execute the machine-readable instructions to: launch a target application using a loader application; obtaining, by the loader application, information related to a kernel system call that has been made by the target application; and an instruction to modify, by the loader application, the target application based on information relating to a kernel system call that has been made by the target application, where the modified instruction is configured to trigger an operation equivalent to the kernel system call, where the operation is equivalent to the kernel system call while avoiding the context switching.

Description

Background Art

[0001] System calls are the main interface between user space applications and the kernel in the operating system (OS). When an application needs to access resources or perform privileged operations, the application makes a system call (abbreviated as "syscall"), which causes the Central Processing Unit (CPU) to switch from user mode to kernel mode and execute the corresponding kernel code to access resources and perform privileged operations. System calls are a useful design for simplifying the interface between user space and kernel space. However, it also introduces overhead when switching from kernel space to user space (or vice versa).

[0002] In data centers, a commonly used optimization technique is to use the so-called "kernel bypass" technology, which implements direct communication between user space and hardware acceleration through a specialized input / output (I / O) library. This approach allows applications to take advantage of hardware acceleration while reducing CPU load and enhancing overall performance. For example, the Data Plane Development Kit (DPDK) is a collection of libraries and drivers that facilitate network applications to bypass the kernel and execute workloads entirely in user space, thereby bringing faster packet processing and improved network performance. Based on DPDK, a variety of user space transmission control protocol / Internet protocol (TCP / IP) stacks have been developed, allowing applications to replace kernel space stacks with user space stacks to achieve significant performance gains. Since the TCP / IP stack relies on the Portable Operating System Interface (POSIX) system call interface, the implementation of intercepting system calls and replacing the system calls with kernel bypass becomes a simple but effective method for enhancing overall networking performance. In data centers, system call interception and kernel bypass technology has two main benefits: one benefit is performance improvement, and the second benefit is keeping existing applications unchanged without requiring recompilation of the applications.

[0003] There are several methods for implementing system call interception, including dynamic linking, library interpolation, "ptrace (process tracing)", KVM-based interception, etc. In general, there is no perfect solution for all use cases. Some interception methods focus on functionality, but have poor performance. For example, "ptrace" can be used to track and debug another process by intercepting system calls, but "ptrace" itself is also a system call, so additional system overhead is generated. In some cases, the performance of the interception method is good, but it is difficult to apply to all use cases. For example, a dynamically linked application can use the LD_PRELOAD (load_preload) instruction to replace the original libc library with an optimized library that uses kernel bypass. However, for statically linked applications (such as "Go" language applications), this approach does not work properly. BRIEF DESCRIPTION OF THE DRAWINGS

[0004] Some examples of apparatus and / or methods will be described below by way of example only and with reference to the accompanying drawings, in which:

[0005] Figure 1a A schematic diagram showing an example of an apparatus or device for a computer system;

[0006] Figure 1b A flowchart illustrating an example of a method for a computer system;

[0007] Figure 2 shows a typical binary layout in a workload on a Linux system;

[0008] Figure 3 shows the binary layout after hot patching;

[0009] Figure 4 An example hot patching process is shown;

[0010] Figure 5 A block diagram showing an electronic device including at least one electronic component and / or method described herein;

[0011] Figure 6 illustrates a computing device according to one implementation of the proposed concept; and

[0012] Figure 7 Examples of higher-level device applications for the disclosed examples are shown. DETAILED DESCRIPTION

[0013] Some examples are now described in more detail with reference to the accompanying drawings. However, other possible examples are not limited to the features of these embodiments described in detail. Other examples may include modifications of features and equivalents and alternatives of features. In addition, the terms used to describe certain examples herein should not limit further possible examples.

[0014] Throughout the description of the drawings, the same or similar reference numerals refer to the same or similar elements and / or features, which may be the same or implemented in a modified form while providing the same or similar functions. For clarity, the thickness of lines, layers and / or regions in the drawings may also be exaggerated.

[0015] When two elements A and B are combined using "or", this is to be understood as disclosing all possible combinations, i.e., only A, only B, and A and B, unless otherwise explicitly defined in individual cases. As an alternative wording for the same combination, "at least one of A and B" or "A and / or B" may be used. This applies equally to combinations of more than two elements.

[0016] If singular forms such as "a / an" and "the" are used and the use of only a single element is neither explicitly nor implicitly defined as mandatory, further examples may also use several elements to achieve the same function. If a function is described below as being achieved using multiple elements, further examples may use a single element or a single processing entity to achieve the same function. It is further understood that when the term "include", "including", "comprise" and / or "comprising" is used, it describes the presence of specified features, integers, steps, operations, processes, elements, components and / or groups thereof, but does not exclude the presence or addition of one or more other features, integers, steps, operations, processes, elements, components and / or groups thereof.

[0017] In the following description, specific details are set forth, but examples of the techniques described herein may be implemented without these specific details. Well-known circuits, structures, and techniques are not shown in detail to avoid obscuring an understanding of the present description. “An example / example,” “various examples / examples,” “some examples / examples,” and the like may include features, structures, or characteristics, but not every example necessarily includes these particular features, structures, or characteristics.

[0018] Some examples may have some, all, or none of the features described for other examples. "First," "second," "third," and the like describe common elements and indicate different instances of similar elements being referenced. Such adjectives do not imply that the elements so described must be in a given order, either temporally or spatially, in ranking, or in any other way. "Connected" may indicate that elements are in direct physical or electrical contact with each other, and "coupled" may indicate that elements cooperate or interact with each other, but these elements may or may not be in direct physical or electrical contact.

[0019] As used herein, the terms "operate," "execute," or "run" are used interchangeably when referring to software or firmware associated with a system, device, platform, or resource, and may refer to software or firmware stored in one or more computer-readable storage media accessible by a system, device, platform, or resource, even if the instructions contained in the software or firmware are not being actively executed by the system, device, platform, or resource.

[0020] The specification may use the phrases "in an example / example", "in various examples", "in some examples / examples", and / or "in various examples / examples", each of which may refer to one or more of the same or different examples. In addition, the terms "comprising", "including", "having", etc. as used with respect to the examples of the present disclosure are synonymous.

[0021] Figure 1a Schematic diagrams showing examples of apparatus 10 or devices 10 for use in computer systems 100, and schematic diagrams showing examples of computer systems 100 including such apparatus 10 or devices 10. Apparatus 10 includes circuitry for providing the functionality of apparatus 10. For example, the circuitry of apparatus 10 may be configured to provide the functionality of apparatus 10. For example, Figure 1aThe device 10 includes (optional) interface circuitry 12, processor circuitry 14, and memory circuitry 16. For example, processor circuitry 14 may be coupled to interface circuitry 12 and to memory circuitry 16. For example, processor circuitry 14 may provide the functionality of the device in conjunction with interface circuitry 12 (for communicating with another computer system or entity, or with other components of computer system 100) and memory circuitry 16 (for storing information such as machine-readable instructions). Likewise, device 10 may include means for providing the functionality of device 10. For example, the device may be configured to provide the functionality of device 10. Components of device 10 are defined as component means that may correspond to or be implemented by corresponding structural components of device 10. For example, Figure 1a The device 10 includes: a device for processing, which may correspond to the processor circuit system 14 or be implemented by the processor circuit system 14; (optionally) a device 12 for communication, which may correspond to the interface circuit system 12 or be implemented by the interface circuit system 12; and a device 16 for storing information, which may correspond to the memory or storage circuit 16 or be implemented by the memory or storage circuit 16. In general, the functions of the processor circuit system 14 or the device 14 for processing may be implemented by the processor circuit system 14 or the device 14 for processing executing machine-readable instructions. Therefore, any features attributed to the processor circuit system 14 or the device 14 for processing may be defined by one or more instructions of a plurality of machine-readable instructions. The device 10 or apparatus 10 may, for example, include machine-readable instructions (such as Figure 1a ), or includes machine-readable instructions within a storage circuit or device for persistently storing information (not shown).

[0022] In a first aspect of the present disclosure, the processor circuit system 14 or the device for processing 14 is used to start the target application 102 using the loader application 101. In this first aspect, the processor circuit system 14 or the device for processing 14 is used to obtain information related to the kernel system call that has been made by the target application through the loader application. In this first aspect, the processor circuit system 14 or the device for processing 14 is used to modify the instructions of the target application based on the information related to the kernel system call that has been made by the target application through the loader application. The modified instructions are configured to trigger an operation equivalent to a kernel system call, wherein the operation is equivalent to a kernel system call while avoiding context switching.

[0023] In a second aspect of the present disclosure, the processor circuitry 14 or means for processing 14 is used to intercept, through the kernel system call handler 103, kernel system calls that have been made by the target application 102 that has been launched by the loader application 101. In this second aspect, the processor circuitry 14 or means for processing 14 is used to provide information related to the kernel system calls that have been made by the target application to the loader application through the kernel system call handler.

[0024] Figure 1b A flowchart of an example of a corresponding method for a computer system (e.g., for computer system 100) is shown. According to a first aspect, the method includes: 110: starting a target application 102 by a loader application 101; 160: obtaining, by the loader application, information related to a kernel system call that has been made by the target application; and 180: modifying, by the loader application, instructions of the target application based on the information related to the kernel system call that has been made by the target application. According to a second aspect, the method includes: 130: intercepting, by a kernel system call handler 103, a kernel system call that has been made by a target application 102 that has been started by the loader application 101; and 150: providing, by the kernel system call handler, information related to the kernel system call that has been made by the target application to the loader application.

[0025] In the following, the functionality of the apparatus 10, device 10, computer system 100, method and corresponding computer program will be described in more detail with reference to the apparatus 10. Features introduced in conjunction with the apparatus 10 may also be included in the corresponding device 10, computer system 100, method and computer program.

[0026] The examples of the present disclosure are based on the following discovery: when user space code is used to replace kernel functions, context switches between user space and kernel space can be avoided. Kernel space and user space are terms used to describe different areas of memory in operating system (OS) architectures, especially in systems using a monolithic kernel such as Linux or Unix. They are used to separate the kernel (the core part of the operating system) from user applications to improve security and stability.

[0027] Kernel space is an area of ​​memory dedicated to the kernel, which is the core part of the OS responsible for managing the resources of the system (such as memory, processor, peripheral devices). The code running in kernel space has full access to the hardware and can execute privileged CPU instructions. Since the kernel operates with high-level privileges, it can perform tasks such as managing hardware devices, scheduling processes, and facilitating communication between hardware and software. In contrast, user space is the area where user applications run. Since these applications cannot directly access system resources, they are limited in what they can do to the hardware. Alternatively, they usually interact with the kernel through a set of well-defined system calls, which helps to maintain the security and stability of the system. A system call is a request made by an application for a service executed by the kernel.

[0028] A context switch occurs when the operating system switches the CPU from one process or thread to another. Context switches are necessary when multitasking between multiple processes, when a high priority process needs to run, or when an application makes a system call that is being handled by the kernel. Context switches between user space applications and the kernel introduce overhead for several reasons, such as state saving and restoring, flushing of the Translation Lookaside Buffer (TLB), cache pollution, pipeline flushing, etc.

[0029] In order to avoid context switching, a kernel bypass mechanism can be used, which is usually implemented as a user space library that implements functions equivalent to one or more system calls without involving the kernel (thereby avoiding context switching). For example, the kernel bypass mechanism can realize direct communication between user space and hardware acceleration through a specialized user space I / O library, which realizes interaction with hardware without involving the kernel. This approach allows applications to take advantage of hardware acceleration while reducing CPU load and enhancing overall performance. For example, DPDK is a collection of libraries and drivers that facilitate network applications to bypass the kernel and execute workloads completely in user space, thereby bringing faster packet processing and improved network performance. Based on DPDK, a variety of user space TCP / IP stacks have been developed so that applications can replace kernel space stacks with user space stacks to achieve significant performance gains.

[0030] In other ways, such libraries have been used as a plug-and-play alternative for dynamically linked applications. Dynamically linked applications are programs that rely on shared libraries for some of their functions. Unlike statically linked applications that incorporate copies of required libraries into the executable file itself, dynamically linked applications call external library files at runtime. Therefore, instead of using the library (such as libc) that the dynamically linked application was originally built to, a kernel bypass version of the library can be used, which at least partially avoids the use of system calls and instead provides direct communication with the corresponding hardware. However, this approach is only feasible for dynamically linked applications. For statically linked applications that contain libraries that are compiled to be relative, this approach cannot be used.

[0031] The present disclosure provides a method that is applicable to both statically linked applications and dynamically linked applications and can be used to implement kernel bypass technology in the case of any application. As outlined above, two aspects are discussed in the present disclosure - a first aspect implemented in user space and a second aspect implemented in kernel space. Since both kernel space and user space are executed in the same computer system, the device can perform both user space aspects and kernel space aspects.

[0032] The proposed concept is based on modifying the target application, i.e., adapting it to be an application that uses a kernel bypass mechanism. To perform such modification, the target application is loaded by a loader application that shares the same address space (i.e., the target application is executed in the same virtual address space as the loader application, and vice versa). In other words, the target application can be started so that the target application shares an address space with the loader application. In addition to enabling the target application, the processing circuit system can also use the loader application to register the target application at the kernel system call handler and load user space libraries for providing operations equivalent to kernel system calls. For example, in combination with Figure 4 As outlined, registering a target application may be performed by invoking an intercept manager, which is used to control a kernel system call handler.

[0033] When the target application executes a system call (for example, by calling a corresponding function in a system library such as libc), the system call can now be intercepted by a kernel system call handler (i.e., a system call handler implemented in kernel space). The system call handler is a component within the operating system kernel that manages the process of transitioning from user space to kernel space to satisfy system call requests made by the user level. In the present case, this particular kernel system call handler is used to capture (i.e., "trap") one or more predefined system calls called by the target application, and is used to pass information related to the kernel system call that has been made by the target application (such as the parameters of the system call, and / or the address of the instruction that called the system call) back to the loader application. In other words, the processor circuit system can intercept the kernel system call that has been made by the target application through the kernel system call handler 103, and provide the loader application with information related to the kernel system call that has been made by the target application through the kernel system call handler. Accordingly, if Figure 1b As shown in , the method may include: 130: intercepting, by the kernel system call handler 103, a kernel system call that has been made by the target application; and 150: providing, by the kernel system call handler, to the loader application, information related to the kernel system call that has been made by the target application. In fact, the information related to the kernel system call that has been made by the target application can be obtained by the loader application from the kernel system call handler 103. For example, the kernel system call handler can be triggered by a call hook installed in the kernel 104 being executed by the computer system. For example, if a system call is made by the target application and is replaceable by a corresponding operation equivalent to the kernel system call, the kernel system call handler 103 can process (all) incoming system calls and provide the loader application with information related to the kernel system call that has been made by the target application. For example, in the Linux operating system, if combined with Figures 2 to 4 As discussed in more detail, kernel system call handlers can be implemented using eBPF.

[0034] The information related to the kernel system call made by the target application is then used to modify the target application. For this purpose, it can include two pieces of information-information related to the system call that has been made, and information related to the location of the instruction that has made the system call. These two pieces of information can be compiled by the kernel system call handler. They can be included in the context of the so-called kernel system call. For example, the context of the kernel system call may include information related to the system call being made (including (one or more) parameters of the system call) and information related to the user space application (i.e., the target application) that calls the system call (including the address of the instruction that has made the system call (or the address after the instruction)). For example, the processor circuit system can determine the context of the kernel system call based on the intercepted system call, and provide the information related to the kernel system call made by the target application together with the information related to the context of the kernel system call. Accordingly, the method (e.g., in both aspects) may include: 140: determining, by the kernel system call handler, a context of the kernel system call based on the intercepted system call; and 150: providing information related to the kernel system call that has been made by the target application together with information related to the context of the kernel system call. The modification of the instruction may be performed based on the context of the kernel system call.

[0035] Now, the loader application may use information related to the context of the kernel system call to determine which instruction(s) of the target application are to be modified. For example, the processor circuit system may determine the location of the instruction to be modified in the memory based on the context of the kernel system call. Accordingly, the method may include: 170: the loader application determines the location of the instruction to be modified in the memory based on the context of the kernel system call. In addition to the syscall that has been made (that is, which system call has been made), this location can also be used to modify the target application in the memory.

[0036] Now, the target application can be modified in the memory by the loader application using information related to the kernel system call made by the target application. The loader application modifies the instructions of the target application based on the information related to the kernel system call made by the target application. Specifically, the instructions that have made the system call can be modified, that is, replaced by the modified instructions of the operation in the user space library previously loaded by the call. For this purpose, a hot patching method can be used. In other words, the instructions can be modified by hot patching the target application. In the context of modifying the application in the user space, hot patching refers to the process of updating the running application or patching the running application without stopping, restarting or otherwise interrupting the services provided by the running application. The core idea is to change the code while the code is running in a way that is transparent to the end user, usually aiming to apply bug fixes, security patches or functional enhancements. Depending on the nature of the operating system, runtime environment and the application being patched, there are various technologies for hot patching. In the current context, function interpolation and / or binary rewriting techniques can be used to hot patch the target application. The commonality of these two techniques is that the target application is modified only in memory, ie the modified application is not written to the disk. In fact, the instructions can be modified (only) in the launched instance of the target application.

[0037] In many cases, in order to provide a certain level of platform independence, applications usually do not explicitly call system calls. Alternatively, system calls are usually called by functions that are part of a standard library (such as libc for the C programming language) that depends on the OS, and the application calls the function of the library. More generally, the instructions that have made system calls (and the instructions to be modified thereby) can be parts of the libraries that are linked to the target application (statically or even dynamically). In other words, the original instructions of the target application that is being modified for modification can be parts of the libraries that are linked (statically) by the target application. Now, the instructions can be replaced by instructions provided by the user space library, and the instructions provided by the user space library, for example, provide instructions for access to hardware (e.g., networking hardware, migration hardware, accelerator hardware, etc.) that are equivalent to system calls. Accordingly, the modified instructions can start operations provided by the user space library. The user space library can provide access to hardware (e.g., networking hardware, migration hardware, accelerator hardware, etc.) without the need for system calls being made. In fact, operations equivalent to kernel system calls (being provided by user space libraries) may be based on kernel bypass mechanisms and thus may circumvent context switching.

[0038] Once the application is modified, the modified application uses the modified instructions instead of the original instructions, i.e., thereby triggering user space operations instead of kernel space operations. In other words, after the modification of the target application, the modified instructions instead of the original instructions of the target application being modified for modification can be used by the target application. Since the target application is executed using the processor circuit system, the processor circuit system can use the modified instructions instead of the original instructions of the target application being modified for modification when executing the target application. Accordingly, as Figure 1b As further shown, the method may include: 190 : using, by the target application, the modified instructions instead of the original instructions of the target application being modified.

[0039] The interface circuit system 12 or the means for communicating 12 may correspond to one or more inputs and / or outputs for receiving and / or transmitting information within a module, between modules, or between modules of different entities, which information may be in the form of digital (bit) values ​​according to a specified code. For example, the interface circuit system 12 or the means for communicating 12 may include a circuit system configured to receive and / or transmit information.

[0040] For example, the processor circuit system 14 or the means for processing 14 may be implemented using one or more processing units, one or more processing devices, any means for processing (such as a processor, a computer, or a programmable hardware component that can operate with correspondingly adapted software). In other words, the described functions of the processor circuit system 14 or the means for processing may also be implemented using software, which is then executed on one or more programmable hardware components. Such hardware components may include general-purpose processors, digital signal processors (DSPs), microcontrollers, etc.

[0041] For example, the memory circuitry 16 or means for storing information 16 may be a volatile memory, for example a random access memory, such as a dynamic random-access memory (DRAM).

[0042] For example, computer system 100 may be one of a workstation computer system, a server computer system, a personal computer system, a portable computer system, a mobile device, a smart phone, a tablet computer, or a laptop computer.

[0043] related to the concept proposed or the context above or below (e.g. Figures 2 to 7) In conjunction with one or more examples described in the foregoing, the apparatus 10, device 10, computer system 100, method and computer program are mentioned for more details and aspects. The apparatus 10, device 10, computer system 100, method and computer program may include one or more additional optional features corresponding to one or more aspects of the proposed concept or one or more examples described above or below.

[0044] Examples of the present disclosure relate to the concept of hot-patch based system call interception for kernel bypass mechanism with unparalleled performance and universal applicability.

[0045] In order to improve the performance of data center networking and storage workloads, the present disclosure provides an innovative system call interception method that is not only as efficient as dynamic linking, but also can be universally applied to all applications, regardless of whether the applications are statically built or rely on dynamic libraries.

[0046] In the present disclosure, an example solution is proposed for a high-performance and universally applicable system call interception mechanism, which can be implemented using a hot patch mechanism. It can effectively and efficiently intercept system calls for any programming language, with unparalleled performance. Therefore, it can serve as a comprehensive implementation that can be applied to all devices with high performance.

[0047] In general, there are several existing methods for implementing system call interception. For example, LD_PRELOAD (load_preload) can be used to preload customized libc (that is, a system library referenced by a program using the C programming language) to first load an optimized version of the system call. However, this approach is only applicable to dynamically linked applications, and LD_PRELOAD cannot be used for statically linked applications. For example, the Go language uses static links for system calls, so that LD_PRELOAD cannot be applied to Go language programs. Alternatively, the "ptrace" command can be used to intercept system calls. However, since ptrace itself is a system call, the system call is used to intercept another system call, resulting in increased overhead and thus performance degradation. Alternatively, a kernel-based virtual machine (KVM) can be used, such as using the VMX hardware visualization provided by gvisor to intercept system calls so that the system call falls from a non-root context to a root context. However, if it is hardware-based interception, the overhead is usually greater than the overhead caused by the original system call. Alternatively, Just-in-Time (JIT) or Ahead-of-Time (AOT) binary scanning and translation can be used, where the software application is scanned and analyzed, and where system calls are intercepted / replaced with optimized slave code. However, AOT takes time before starting the program and is not suitable for programs that generate new code at runtime. Although JIT compilation can solve the problem of dynamically generated code, JIT compilation is usually slow.

[0048] The present disclosure proposes an innovative system call interception mechanism based on hot patching technology. Different from static library interpolation, hot patching can be used to dynamically locate the system call instruction context of interest and application in the execution path and replace it with an improved version implemented in the user space library.

[0049] In order to keep the application unchanged, a call hook can be installed inside the kernel (for example, in Linux, eBPF hooks can be used; in other OS, corresponding mechanisms can also be used), which monitors the system calls of the application. When the system call hook identifies the system call to be intercepted, it can deliver a signal to the middleware in the user space, which indicates the current patch position via the system call context and dynamically patches the application instructions. As a result, the system call of interest (that is, the system call that can be replaced in the user space) is intercepted, and the application can then call the optimized user space library without any context switching afterwards.

[0050] The proposed concept provides an improved way to implement syscall interception with reduced overhead. Such a solution can provide the following benefits: for example, by accelerating data center networking and providing storage acceleration to speed up system call level binary compatible applications in the implementation.

[0051] The present disclosure provides an example method for a system based on a hot patch system call interception mechanism. Each example of the present disclosure has three key components, namely: middleware software (i.e., loader application) hereinafter, represented as a platform abstract layer (PAL), a system call hook (i.e., a kernel system call handler), and an eBPF loader. These components will be explained first, and then the detailed workflow in the system call interception will be explained below.

[0052] Figure 2 A typical binary layout in a workload in a Linux system is shown. Application 210 calls libc 211, and inside libc 211, the system call is implemented using the "syscall" instruction in an x86-64 computer system, or "int 80h" in an x86 32-bit computer system. After the system call is triggered, the corresponding interrupt handler 221 is called in kernel space 220.

[0053] Since the new loader fully controls the application execution environment of application 310 (such as Figure 3 As shown), so when the system call hook 321 delivers the current system call context from kernel space 320, the new loader can patch the original system call binary code in the statically linked libc311 (to user space code), which can jump to the optimized "kernel bypass code" 330 and then return. Figure 3 Shows the binary layout after hot patching. Patching is a one-time action, and after that, no system calls are required.

[0054] Figure 4 An example hot patching process is shown. Figure 4 A first process 410 is shown with a statically linked application 411 , a Linux PAL 412 , and kernel bypass code 413 . Figure 4 A second process 420 having an intercept manager 421 is further shown. Figure 4 Further shown is a kernel 430 having a system call hook 431 .

[0055] The Platform Abstraction Layer (PAL) 412 is an abstraction layer that provides a platform-level interface to the application 411 so that the application is non-intrusive and transparent to the system call interception. When the application is started, the PAL acts as a "loader". It can load the application and control the binary execution code in the memory of the control application. Thereafter, the PAL passes the execution path to the application, and the application can start running natively. The PAL 412 can be considered as the underlying library layer of the application, and it runs in the same process space as the application 411 and has priority in processing signals (from the kernel system call hook 431).

[0056] The system call hook 431 is a kernel space component that monitors system calls of interest and delivers signals to the application PAL layer 412. Typically in x86-64, when an application 411 calls a system call, the "syscall" instruction will be executed, and the execution path goes from ring 3 to ring 0, and the kernel takes over execution. The system call hook 431 can be invoked to handle the system call, wherein the system call hook checks whether the system call is one of the system calls configured for hot patching. If so, the corresponding context can be delivered to the PAL 412. The system call hook can be a general method for taking over the kernel inside the system call processing. For example, in order to provide such functionality, the conceptual proof implementation of the proposed concept uses the "eBPF" mechanism in Linux to implement the system call hook. The system call hook is programmed to use eBPF "attach_kprobe" to monitor any system call of interest and deliver signals via the eBPF helper.

[0057] Interception manager 421 is the control plane in the proposed concept, is used to provide user space configuration capability to manage system call interception, such as system call identifier, process identifier and user space library through optimized version.It allows user-defined system call interception strategy, and can manage system call hook components such as load / unload and update function.Interception manager 421 works closely with system hook, to provide user-defined and highly efficient system call interception implementation.Interception manager is usually operated in an independent process.

[0058] In the following, the system call interception process is described. Based on the above component introduction, as an example, the system call interception can be adopted Figure 4 The following workflow is performed as shown in . In an example implementation, this workflow is implemented in Linux using eBPF as the system call monitoring mechanism. The proposed mechanism can be scaled for other operating systems with similar mechanisms.

[0059] At operation 0, intercept manager 421 loads eBPF-based system call hook 431 inside kernel 430. PAL 412 loads application 411 and registers information such as process ID / system call ID to intercept manager so that system call hook monitoring required system call. PAL also loads "kernel bypass code" 413 in the same process. This kernel bypass code 413 is used to replace existing system calls to achieve the desired execution acceleration. PAL 412 redirects the execution path to the application, and the application is opened natively. PAL is then set to the background and can be triggered by signal SIGILL (signal illegal). For example, Linux PAL 412 can load application 411 and kernel bypass code into memory and change the page permission defined in the executable and linking format (Executable and Linking Format, ELF) header.

[0060] At operation 1 , during runtime of the application 411 , the application invokes a system call, and the execution flow goes to the kernel 430 , where the system call is trapped to the system call hook 431 .

[0061] At operation 2, the system call hook 431 takes over the execution flow. When the system call hook 431 identifies that the trapped system call is a system call defined for interception, the system call hook 431 delivers the signal SIGILL to the PAL 412, which is registered by the PAL in operation 0.

[0062] At operation 3, after the PAL 412 receives the signal, it locates the current application execution context and patches the instruction space of the application 411 to invoke the “kernel bypass code” 413 by changing the behavior of the application.

[0063] At operation 4 , the PAL 412 returns from signal processing and passes the execution flow to the application 411 .

[0064] At operation 5, the application 411 executes the patched code, jumping to the "kernel bypass code" 413, which is an optimized version of the original system call and is executed only in user space.

[0065] At operation 6, the "kernel bypass code" 413 performs actions for the system call and returns to the original location of the application to continue executing further instructions of the application. Now, the entire process is user space only.

[0066] For example, in operation 3, the following design may be used to apply the patch. The "kernel bypass code" 413 may expose a POSIX application programming interface (API) to the application and perform the same tasks that the application would expect when invoking a system call to the kernel. Typically, the parameters of the POSIX API may be similar to the system call interface. For example, the kernel bypass code "sendto" defined in the header file may be:

[0067] ssize_t sendto(int sockfd,const void buf[.len],size_t len,int flags,const struct sockaddr*dest_addr,socklen_t addrlen);

[0068] The sendto system call definition can be:

[0069] SYSCALL_DEFINE6(sendto,int,fd,void__user*,buff,size_t,len,unsignedint,flags,struct sockaddr__user*,addr,int,addr_len)

[0070] Obviously, the sendto parameters are the same.

[0071] Using the above operations, one or more of the following benefits can be achieved compared to other applications - the proposed concept is application-competitive, can provide improved performance by performing patching once and always running the patched version, and is suitable for both statically linked applications and dynamically linked applications regardless of the application programming language used.

[0072] "eBPF" is a topic of interest in networking innovation. Examples of the proposed concept utilize this system call interception mechanism to accelerate unmodified applications using "kernel bypass" optimization. The proposed concept is based on using system call hooks to establish a kernel bypass mechanism, capturing the execution path to the kernel space only once, and after the hot patch, there is no more kernel execution, so there is no kernel context switch cost. Specifically, in the Linux system call hook, when the kernel notifies the application to perform a hot patch, the eBPF helper "bpf_send_signal" can be called. The present disclosure proposes a mechanism that utilizes "system call interception" and "hot patching" to provide seamless acceleration of applications via kernel bypass optimization.

[0073] Although similar concepts are used as security components in Endpoint Detection and Response (EDR), in contrast to the proposed concept, EDR continuously monitors "endpoints" to mitigate malicious network threats without patching the target application. Taking OpenEDR as an example, the process monitor has a similar process to inject a dynamically linked library (DLL) to perform process monitoring as follows. OpenEDR uses the injected DLL (a library that is injected into different processes and hooks API calls) and a loader for the injected DLL (a driver component that loads the injected DLL into each new process). The proposed concept also implements a new loader to load the process, which fully controls the CPU scheduler, memory allocation, etc. of the process. Since the loader controls everything about the process, it makes it possible to dynamically update the executable binary of the application for hot patching (referred to as "libos" in some academic papers). In EDR, the EDR loader is only used to load the injected DLL to replace the original DLL call without modifying the application. The proposed concept does not focus on dynamic library hooking, but on static API hooking, because simple preloading of modified libraries is not feasible here. Since the API is statically linked with the original application, it is difficult to distinguish from the binary code level. The proposed concept utilizes system call interception and then locates the API binary for hot patching. After the hot patching mechanism, there is no more hooking. In contrast, EDR needs to continue to hook the original API.

[0074] Figure 5 is a block diagram of an electronic device 500 that includes at least one electronic component and / or method described herein. The electronic device 500 is merely an example of an electronic device in which the forms of the electronic components and / or methods described herein can be used. Examples of the electronic device 500 include, but are not limited to, a personal computer, a tablet computer, a mobile phone, a gaming device, an MP3 or other digital music player, etc. In this example, the electronic device 500 includes a data processing system that includes a system bus 502 for coupling the various components of the electronic device 500. The system bus 502 provides communication links between the various components of the electronic device 500 and can be implemented as a single bus, as a combination of busses, or in any other suitable manner.

[0075] The electronic assembly 510 as described herein may be coupled to the system bus 502. The electronic assembly 510 may include any circuit or combination of circuits. In one embodiment, the electronic assembly 510 includes a processor 512, which may be of any type. As used herein, "processor" means any type of computing circuit, such as, but not limited to, a microprocessor, a microcontroller, a complex instruction set computing (CISC) microprocessor, a reduced instruction set computing (RISC) microprocessor, a very long instruction word (VLIW) microprocessor, a graphics microprocessor, a digital signal processor (DSP), a multi-core processor, or any other type of processor or processing circuit.

[0076] Other types of circuits that may be included in electronic assembly 510 are custom circuits, application-specific integrated circuits (ASICs), and the like, such as, for example, one or more circuits (such as communication circuit 514) for wireless devices such as mobile phones, tablet computers, laptop computers, two-way radios, and similar electronic systems. The IC may perform any other type of function.

[0077] The electronic device 500 may also include an external memory 520, which may include one or more memory elements suitable for a particular application, such as a main memory 522 in the form of random-access memory (RAM), one or more hard drives 524 and / or one or more drives for handling removable media 526 such as compact disks (CDs), flash memory cards, digital video disks (DVDs), etc.

[0078] The electronic device 500 may also include a display device 516, one or more speakers 518, and a keyboard and / or controller 530, which may include a mouse, a trackball, a touch screen, a voice recognition device, or any other device that permits a system user to input information into the electronic device 500 and receive information from the electronic device 500.

[0079] Figure 6A computing device 600 according to one implementation of the invention is illustrated. The computing device 600 houses a board 602. The board 602 may include a number of components, including, but not limited to, a processor 604 and at least one communication chip 606. The processor 604 is physically and electrically coupled to the board 602. In some implementations, at least one communication chip 606 is also physically and electrically coupled to the board 602. In further implementations, the communication chip 606 is part of the processor 604. Depending on its application, the computing device 600 may include other components that may or may not be physically and electrically coupled to the board 602. These other components include, but are not limited to, volatile memory (e.g., DRAM), non-volatile memory (e.g., ROM), flash memory, graphics processor, digital signal processor, cryptographic processor, chipset, antenna, display, touch screen display, touch screen controller, battery, audio codec, video codec, power amplifier, global positioning system (GPS) device, compass, accelerometer, gyroscope, speaker, camera, and mass storage device (such as hard disk drive, compact disk (CD), digital versatile disk (DVD), etc.). Communication chip 606 implements wireless communication for transferring data to and from computing device 600. The term "wireless" and its derivatives may be used to describe circuits, devices, systems, methods, techniques, communication channels, etc. that can communicate data through non-solid media by using modulated electromagnetic radiation. The term does not imply that the associated device does not contain any wires, but in some embodiments, the associated device may not contain any wires. The communication chip 606 may implement any of a variety of wireless standards or protocols, including but not limited to Wi-Fi (IEEE 802.11 series), WiMAX (IEEE 802.16 series), IEEE 802.20, long term evolution (LTE), Ev-DO, HSPA+, HSDPA+, HSUPA+, EDGE, GSM, GPRS, CDMA, TDMA, DECT, Bluetooth and its derivatives, and any other wireless protocols designated as 3G, 4G, 5G and higher generations. The computing device 600 may include multiple communication chips 606. For example, a first communication chip 606 may be dedicated to shorter-range wireless communications, such as Wi-Fi and Bluetooth; while a second communication chip 606 may be dedicated to longer-range wireless communications, such as GPS, EDGE, GPRS, CDMA, WiMAX, LTE, Ev-DO, etc. The processor 604 of the computing device 600 includes an integrated circuit encapsulated within the processor 604.In some implementations of the present invention, the integrated circuit die of the processor includes one or more devices assembled in a P0P package based on ePLB or eWLB, and according to an implementation of the present invention, the package includes a mold layer that directly contacts the substrate. The term "processor" may refer to any device or part of a device that processes electronic data from registers and / or memories to convert the electronic data into other electronic data that can be stored in registers and / or memories. The communication chip 606 also includes an integrated circuit die encapsulated in the communication chip 606. According to another implementation of the present invention, the integrated circuit die of the communication chip includes one or more devices assembled in a P0P package based on ePLB or eWLB, and according to an implementation of the present invention, the package includes a mold layer that directly contacts the substrate.

[0080] Figure 7 Included to illustrate examples of higher-level device applications for the disclosed examples. In an embodiment, computing system 700 includes, but is not limited to, a desktop computer. In an embodiment, system 700 includes, but is not limited to, a laptop computer. In an embodiment, system 700 includes, but is not limited to, a netbook. In an embodiment, system 700 includes, but is not limited to, a tablet. In an embodiment, system 700 includes, but is not limited to, a notebook computer. In an embodiment, system 700 includes, but is not limited to, a personal digital assistant (PDA). In an embodiment, system 700 includes, but is not limited to, a server. In an embodiment, system 700 includes, but is not limited to, a workstation. In an embodiment, system 700 includes, but is not limited to, a cellular phone. In an embodiment, system 700 includes, but is not limited to, a mobile computing device. In an embodiment, system 700 includes, but is not limited to, a smart phone. In an embodiment, system 700 includes, but is not limited to, an Internet appliance.

[0081] In an embodiment, the processor 710 has one or more processing cores 712 and 712N, where 712N represents the Nth processor core inside the processor 710, where N is a positive integer. In an embodiment, the electronic device system 700 uses a MAA device embodiment, which includes multiple processors, including 710 and 705, where the processor 705 has logic similar to or the same as the logic of the processor 710. In an embodiment, the processing core 712 includes, but is not limited to, pre-fetch logic for fetching instructions, decoding logic for decoding instructions, execution logic for executing instructions, and the like. In an embodiment, the processor 710 has a cache memory 716 for caching at least one of instructions and data of the device in the system 700. The cache memory 716 can be organized into a hierarchical architecture including one or more levels of cache memory.

[0082] In an embodiment, the processor 710 includes a memory controller 714 that is operable to perform functions that enable the processor 710 to access and communicate with a memory 730, which includes at least one of a volatile memory 732 and a non-volatile memory 734. In an embodiment, the processor 710 is coupled to the memory 730 and the chipset 720. The processor 710 may also be coupled to a wireless antenna 778 to communicate with any device configured to transmit wireless signals and receive wireless signals. In an embodiment, the wireless antenna interface 778 operates according to, but is not limited to, the IEEE 802.11 standard and its related family of standards, Home Plug AV (HPAV), Ultra Wide Band (UWB), Bluetooth, WiMax, or any form of wireless communication protocol.

[0083] In an embodiment, the volatile memory 732 includes, but is not limited to, a synchronous dynamic random access memory (SDRAM), a dynamic random access memory (DRAM), a RAMBUS dynamic random access memory (RDRAM), and / or any other type of random access memory device. The non-volatile memory 734 includes, but is not limited to, a flash memory, a phase change memory (PCM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), or any other type of non-volatile memory device.

[0084] The memory 730 stores information and instructions to be executed by the processor 710. In an embodiment, the memory 730 may also store temporary variables or other intermediate information while the processor 710 executes instructions. In the illustrated embodiment, the chipset 720 is connected to the processor 710 via point-to-point (PtP or PP) interfaces 717 and 722. Any of these PtP embodiments may be implemented using the MAA device embodiments as described in the present disclosure. The chipset 720 enables the processor 710 to connect to other elements of the MAA device embodiments in the system 700. In an embodiment, the interfaces 717 and 722 are based on, for example, The UE may operate with a PtP communication protocol such as QuickPath Interconnect (QPI), etc. In other embodiments, a different interconnect may be used.

[0085] In an embodiment, chipset 720 is operable to communicate with processor 710, 705N, display device 740, and other devices 772, 776, 774, 760, 762, 764, 766, and 777, etc. Chipset 720 may also be coupled to wireless antenna 778 to communicate with any device configured to at least one of transmit and receive wireless signals.

[0086] The chipset 720 is connected to a display device 740 via an interface 726. The display 740 may be, for example, a liquid crystal display (LCD), a plasma display, a cathode ray tube (CRT) display, or any other form of visual display device. In an embodiment, the processor 710 and the chipset 720 are combined as a MAA device in the system. Additionally, the chipset 720 is connected to one or more buses 750 and 755 that interconnect various elements 774, 760, 762, 764, and 766. The buses 750 and 755 may be interconnected together via a bus bridge 772 (such as at least one MAA device embodiment). In an embodiment, the chipset 720 is coupled to a non-volatile memory 760, (one or more) mass storage devices 762, a keyboard / mouse 766, and a network interface 766 through at least one of the interfaces 724 and 774, a smart TV 776, and a consumer electronic product 777.

[0087] In an embodiment, the mass storage device 762 includes, but is not limited to, a solid-state drive, a hard disk drive, a universal serial bus flash drive, or any other form of computer data storage medium. In one embodiment, the network interface 766 is implemented by any type of well-known network interface standards, including but not limited to Ethernet interfaces, universal serial bus (USB) interfaces, peripheral component interconnect (PCI) Express interfaces, wireless interfaces, and / or any other suitable type of interfaces. In one embodiment, the wireless interface operates according to, but is not limited to, the IEEE 802.11 standard and its related standard families, Home Plug AV (HPAV), Ultra Wide Band (UWB), Bluetooth, WiMax, or any form of wireless communication protocol.

[0088] Although Figure 7 The modules shown in are depicted as separate blocks within the MAA device embodiment in computing system 700, but the functions performed by some of these blocks may be integrated into a single semiconductor circuit, or may be implemented using two or more separate integrated circuits. For example, although cache memory 716 is depicted as a separate block within processor 710, cache memory 716 (or selected aspects of 716) may be incorporated into processor core 712.

[0089] Aspects and features described in relation to a particular one of the preceding examples may be combined with one or more of the further examples to replace the same or similar features of the further examples or to introduce these features in addition to the further examples.

[0090] In the following, some examples of the proposed concept are presented:

[0091] An example (e.g., Example 1) relates to an apparatus (10) for a computer system (100), the apparatus comprising a memory circuit system (16), machine-readable instructions, and a processor circuit system (14), the processor circuit system being used to execute the machine-readable instructions to: start a target application (102) using a loader application (101); obtain, by the loader application, information related to a kernel system call that has been made by the target application; and modify, by the loader application, instructions of the target application based on the information related to the kernel system call that has been made by the target application, wherein the modified instructions are configured to trigger an operation equivalent to a kernel system call, wherein the operation is equivalent to a kernel system call while avoiding context switching.

[0092] Another example (e.g., Example 2) relates to the aforementioned example (e.g., Example 1) or to any other example, further including: after modification of the target application, the modified instructions are used by the target application instead of the original instructions of the target application being modified.

[0093] Another example (e.g., Example 3) relates to the preceding example (e.g., Example 2) or to any other example, further comprising: a processor circuit system for executing machine-readable instructions to perform: modified instructions used by a target application instead of original instructions of the target application being modified.

[0094] Another example (e.g., Example 4) relates to the preceding example (e.g., any one of Examples 1 to 3) or to any other example, further including: the original instructions of the target application being modified are part of a library being statically linked by the target application.

[0095] Another example (eg, Example 5) relates to the preceding example (eg, any one of Examples 1 to 4) or to any other example, further comprising: the instruction is modified by hot-patching the target application.

[0096] Another example (eg, Example 6) relates to the preceding example (eg, any one of Examples 1 to 5) or to any other example, further comprising: the instruction is modified in the launched instance of the target application.

[0097] Another example (eg, Example 7) relates to the preceding example (eg, any one of Examples 1 to 6) or to any other example, further comprising: the modified instruction initiates an operation provided by a user space library.

[0098] Another example (eg, Example 8) relates to the preceding example (eg, any one of Examples 1 to 7) or to any other example, further comprising: an operation equivalent to a kernel system call is based on a kernel bypass mechanism.

[0099] Another example (eg, Example 9) relates to the preceding example (eg, any one of Examples 1 to 8) or to any other example, further comprising: information related to kernel system calls that have been made by the target application is obtained from a kernel system call handler (103).

[0100] Another example (e.g., Example 10) relates to the preceding examples (e.g., any one of Examples 1 to 9) or to any other example, further comprising: information related to a kernel system call that has been made by the target application includes a context of the kernel system call, wherein modification of the instruction is based on the context of the kernel system call.

[0101] Another example (Example 11) relates to the preceding example (e.g., Example 10) or to any other example, further comprising: a processor circuit system for executing machine-readable instructions to: determine a location in a memory of instructions to be modified based on the context of a kernel system call.

[0102] Another example (eg, Example 12) relates to the preceding example (eg, any one of Examples 1 to 11) or to any other example, further comprising: the target application is started so that the target application shares an address space with the loader application.

[0103] Another example (e.g., Example 13) relates to the preceding example (e.g., any one of Examples 1 to 12) or to any other example, further comprising: a processor circuit system for executing machine-readable instructions to perform: intercepting, by a kernel system call handler (103), a kernel system call that has been made by a target application; and providing, by the kernel system call handler, information related to the kernel system call that has been made by the target application to a loader application.

[0104] Another example (eg, Example 14) relates to the preceding example (eg, Example 13) or to any other example, further comprising: the kernel system call handler is triggered by a call hook installed in a kernel (104) being executed by the computer system.

[0105] Another example (e.g., Example 15) relates to the preceding examples (e.g., one of Example 13 or Example 14) or to any other example, further including: a processor circuit system for executing machine-readable instructions to: determine a context of a kernel system call based on an intercepted system call; and provide information related to a kernel system call that has been made by a target application together with information related to the context of the kernel system call.

[0106] An example (e.g., Example 16) relates to an apparatus (10) for a computer system (100), the apparatus (10) comprising a memory circuit system (16), machine-readable instructions, and a processor circuit system (14), the processor circuit system being used to execute the machine-readable instructions to perform: intercepting, by a kernel system call handler (103), a kernel system call already made by a target application (102) already started by a loader application (101); and providing, by the kernel system call handler, to the loader application, information related to the kernel system call already made by the target application.

[0107] Another example (eg, Example 17) relates to the preceding example (eg, Example 16) or to any other example, further comprising: the kernel system call handler is triggered by a call hook installed in a kernel (104) being executed by the computer system.

[0108] Another example (e.g., Example 18) relates to the preceding examples (e.g., one of Example 16 or Example 17) or to any other example, further including: a processor circuit system for executing machine-readable instructions to: determine a context of a kernel system call based on an intercepted system call; and provide information related to a kernel system call that has been made by a target application together with information related to the context of the kernel system call.

[0109] An example (e.g., Example 19) relates to an apparatus (10) for a computer system (100), the apparatus comprising a processor circuit system (14) configured to: start a target application (102) using a loader application (101); obtain, by the loader application, information related to a kernel system call that has been made by the target application; and modify, by the loader application, instructions of the target application based on the information related to the kernel system call that has been made by the target application, wherein the modified instructions are configured to trigger an operation equivalent to a kernel system call, wherein the operation is equivalent to a kernel system call while avoiding context switching.

[0110] An example (e.g., Example 20) relates to an apparatus (10) for a computer system (100), the apparatus comprising a processor circuit system (14) configured to: intercept, by a kernel system call handler (103), a kernel system call that has been made by a target application (102) that has been started by a loader application (101); and provide, by the kernel system call handler, to the loader application, information related to the kernel system call that has been made by the target application.

[0111] An example (e.g., Example 21) relates to an apparatus (10) for a computer system (100), the apparatus comprising an apparatus (14) for processing, the apparatus being used to: start a target application (102) using a loader application (101); obtain, by the loader application, information related to a kernel system call that has been made by the target application; and modify, by the loader application, instructions of the target application based on the information related to the kernel system call that has been made by the target application, wherein the modified instructions are configured to trigger an operation equivalent to a kernel system call, wherein the operation is equivalent to a kernel system call while avoiding context switching.

[0112] An example (e.g., Example 22) relates to a device (10) for a computer system (100), the device comprising a device for processing (14), the device for processing being used to: intercept, by a kernel system call handler (103), a kernel system call that has been made by a target application (102) that has been started by a loader application (101); and provide, by the kernel system call handler, to the loader application, information related to the kernel system call that has been made by the target application.

[0113] An example (e.g., Example 23) relates to a method for a computer system (100), the method comprising: launching (110) a target application (102) by a loader application (101); obtaining (160) information related to a kernel system call that has been made by the target application by the loader application; and modifying (180) instructions of the target application based on the information related to the kernel system call that has been made by the target application by the loader application, wherein the modified instructions are configured to trigger an operation equivalent to the kernel system call, wherein the operation is equivalent to the kernel system call while avoiding context switching.

[0114] Another example (e.g., Example 24) relates to the aforementioned example (e.g., Example 23) or to any other example, further including: after modification of the target application, the modified instructions are used by the target application instead of the original instructions of the target application being modified, and the method includes: the modified instructions are used (190) by the target application instead of the original instructions of the target application being modified.

[0115] Another example (e.g., Example 25) relates to the aforementioned examples (e.g., one of Example 23 or Example 24) or to any other example, further comprising: information related to a kernel system call that has been made by a target application includes a context of the kernel system call, wherein modification of the instruction is based on the context of the kernel system call, the method comprising: determining (170) by the loader application the location of the instruction to be modified in the memory based on the context of the kernel system call.

[0116] Another example (e.g., Example 26) relates to the preceding examples (e.g., any one of Examples 23 to 25) or to any other example, further comprising: intercepting (130) a kernel system call made by a target application by a kernel system call handler (103); and providing information related to the kernel system call made by the target application to the loader application by the kernel system call handler.

[0117] Another example (e.g., Example 27) relates to the preceding example (e.g., Example 26) or to any other example, further comprising: determining (140) a context of a kernel system call based on the intercepted system call; and providing (150) information related to the kernel system call that has been made by the target application together with information related to the context of the kernel system call.

[0118] An example (e.g., Example 28) relates to a method (10) for a computer system (100), the method comprising: intercepting (130) by a kernel system call handler (103) a kernel system call that has been made by a target application (102) that has been started by a loader application (101); and providing (150) by the kernel system call handler to the loader application information related to the kernel system call that has been made by the target application.

[0119] Another example (e.g., Example 29) relates to the preceding example (e.g., Example 28) or to any other example, further comprising: determining (140) a context of a kernel system call based on the intercepted system call; and providing (150) information related to the kernel system call that has been made by the target application together with information related to the context of the kernel system call.

[0120] Another example (e.g., Example 30) relates to a non-transitory computer-readable medium comprising program code that, when executed on a processor, a computer, or a programmable hardware component, causes the processor, the computer, or the programmable hardware component to perform a method as described in one of Examples 23 to 27 (or according to any other example) and at least one of the methods as described in one of Examples 28 or 29 (or according to any other example).

[0121] Another example (eg, Example 31) relates to a computer system comprising at least one of the apparatuses or devices according to one of Examples 1 to 22 (or according to any other example).

[0122] Another example (eg, Example 32) relates to a computer system configured to perform at least one of the methods described in one of Examples 23 to 27 (or in accordance with any other example).

[0123] Another example (e.g., Example 33) relates to a non-transitory machine-readable storage medium comprising program code that, when executed, causes a machine to perform at least one of the methods described in one of Examples 23 to 27 and one of the methods described in one of Examples 28 or 29.

[0124] Another example (e.g., Example 34) relates to a computer program having program code for performing, when the computer program is executed on a computer, a processor, or a programmable hardware component, at least one of the methods described in one of Examples 23 to 27 and one of the methods described in one of Examples 28 or 29.

[0125] Another example (e.g., Example 35) relates to a machine-readable storage device comprising machine-readable instructions that, when executed, implement a method as claimed in the appended claims or shown in any example, or realize an apparatus as claimed in the appended claims or shown in any example.

[0126] An example (eg, Example A1) relates to a method of hot-patching-based system call interception for a kernel bypass mechanism according to one of the examples of this specification.

[0127] An example (eg, Example A2) relates to an apparatus for hot-patching-based system call interception for a kernel bypass mechanism according to one of the examples of this specification.

[0128] An example (eg, Example A3) relates to a system for hot-patching-based system call interception for a kernel bypass mechanism according to one of the examples of this specification.

[0129] An example (eg, Example A4) relates to a computer program for hot-patching-based system call interception for a kernel bypass mechanism according to one of the examples of this specification.

[0130] An example (eg, Example A5) relates to a machine-readable medium comprising code that, when executed, causes the machine to perform any of the methods of hot-patch-based system call interception for a kernel bypass mechanism according to one of the examples of this specification.

[0131] Examples may further be or relate to (computer) programs, including program code, which is used to perform one or more of the above methods when the program is executed on a computer, a processor or other programmable hardware component. Thus, the steps, operations or processes of the different methods in the methods described above can also be performed by a programmed computer, a processor or other programmable hardware component. Examples may also cover program storage devices, such as digital data storage media, which are machine-readable, processor-readable or computer-readable, and encode and / or contain machine-executable, processor-executable or computer-executable programs and instructions. For example, a program storage device may include or may be a digital storage device, a magnetic storage medium (such as a disk and a tape), a hard drive or an optically readable digital data storage medium. Other examples may also include a computer, a processor, a control unit, a (field) programmable logic array ((field) programmable logic array, (F) PLA), a (field) programmable gate array ((field) programmable gate array, (F) PGA), a graphics processor unit (GPU), an application-specific integrated circuit (ASIC), an integrated circuit (IC), or a system-on-a-chip (SoC) system programmed to perform the steps of the method described above.

[0132] It is also understood that the disclosure of several steps, processes, operations or functions disclosed in the specification or claims should not be interpreted as implying that these operations must be in the described order, unless explicitly stated in a separate use case or necessary for technical reasons. Therefore, the previous description does not limit the performance of several steps or functions to a certain order. In addition, in other examples, a single step, function, process or operation may include and / or be decomposed into sub-steps, sub-functions, sub-processes or sub-operations.

[0133] If some aspects have been described in conjunction with a device or system, these aspects should also be understood as descriptions of corresponding methods. For example, a block, device, or functional aspects of a device or system may correspond to features (such as method steps) of a corresponding method. Accordingly, aspects described in conjunction with a method should also be understood as descriptions of properties or functional features of the corresponding block, corresponding element, corresponding device, or corresponding system.

[0134] As used herein, the term "module" refers to a logic for performing one or more operations in accordance with the present disclosure that can be implemented using hardware components or devices, software or firmware running on a processing unit, or a combination thereof. Software and firmware can be embodied as instructions and / or data stored on a non-transient computer-readable storage medium. As used herein, the term "circuitry" can include, alone or in any combination, non-programmable (hard-wired) circuitry, programmable circuitry (such as a processing unit), state machine circuitry, and / or firmware storing instructions that can be executed by a programmable circuit. The modules described herein can be embodied together or individually as circuitry forming part of a computing system. Thus, any one of the modules can be implemented as a circuitry. A computing system that is referred to as being programmed for executing a method can be programmed to execute the method via software, hardware, firmware, or a combination thereof.

[0135] Any of the disclosed methods (or portions thereof) may be implemented as computer-executable instructions or computer program products. Such instructions may enable a computing system or one or more processing units capable of executing computer-executable instructions to perform any of the disclosed methods. As used herein, the term "computer" refers to any computing system or device described or mentioned herein. Thus, the term "computer-executable instructions" refers to instructions that can be executed by any computing system or device described or mentioned herein.

[0136] Computer executable instructions may be, for example, part of an operating system of a computing system, an application stored locally on a computing system, or a remote application accessible to a computing system (e.g., via a web browser). Any of the methods described herein may be performed by computer executable instructions executed by a single computing system or by one or more networked computing systems operating in a network environment. Computer executable instructions and updates to computer executable instructions may be downloaded from a remote server to a computing system.

[0137] In addition, it should be understood that implementation of the disclosed techniques is not limited to any particular computer language or program. For example, the disclosed techniques can be implemented by software written in C++, C#, Java, Perl, Python, JavaScript, Adobe Flash, C#, assembly language, or any other programming language. Likewise, the disclosed techniques are not limited to any particular computer system or any particular type of hardware.

[0138] In addition, any of the software-based examples (including, for example, computer-executable instructions for causing a computer to perform any of the disclosed methods) can be uploaded, downloaded, or remotely accessed via suitable communication means. Such suitable communication means include, for example, the Internet, the World Wide Web, an intranet, cables (including fiber optic cables), magnetic communications, electromagnetic communications (including RF, microwave, ultrasonic, and infrared communications), electronic communications, or other such communication means.

[0139] The disclosed methods, apparatuses, and systems should not be interpreted as limiting in any way. Instead, the present disclosure is directed to all novel and non-obvious features and aspects of each disclosed example, individually and in various combinations and sub-combinations with each other. The disclosed methods, apparatuses, and systems are not limited to any specific aspect or feature or combination thereof, nor do the disclosed examples require the existence of any one or more specific advantages or the resolution of any one or more specific problems.

[0140] The theories of operation, scientific principles, or other theoretical descriptions presented herein with reference to the devices or methods of the present disclosure are provided for the purpose of better understanding and are not intended to limit the scope. The devices and methods in the appended claims are not limited to those devices and methods that function in the manner described by such theories of operation.

[0141] The attached claims are hereby included in the detailed description, wherein each claim itself can serve as a separate example. It should be noted that although a dependent claim refers to a specific combination with one or more other claims in the claims, other examples may also include a combination of the dependent claim with the subject matter of any other dependent or independent claim. Such combinations are expressly proposed here, unless it is stated in individual cases that a specific combination is not intended. In addition, even if a claim is not directly limited to referring to any other independent claim, the features of the claim should also be included with respect to any other independent claim.

Claims

1. An apparatus for a computer system, the apparatus comprising memory circuitry, machine-readable instructions, and processor circuitry, the processor circuitry being configured to execute the machine-readable instructions to: Use the loader application to launch the target application; obtaining, by the loader application, information related to kernel system calls that have been made by the target application; and The loader application modifies instructions of the target application based on information related to the kernel system call that has been made by the target application, wherein the modified instructions are configured to trigger an operation equivalent to the kernel system call, wherein the operation is equivalent to the kernel system call while avoiding context switching.

2. The device according to claim 1, wherein: After the modification of the target application, the modified instructions are used by the target application instead of the original instructions of the target application being modified by the modification.

3. The device according to claim 2, wherein: The processor circuitry is for executing the machine-readable instructions to cause the modified instructions to be used by the target application instead of the original instructions of the target application being modified by the modification.

4. The device according to claim 1, wherein: The original instructions of the target application that are modified by the modification are part of a library that is being statically linked by the target application.

5. The device according to claim 1, wherein: The instructions are modified by hot-patching the target application.

6. The device according to claim 1, wherein: The instructions are modified in the launched instance of the target application.

7. The device according to claim 1, wherein: The modified instructions initiate operations provided by a user space library.

8. The device according to claim 1, wherein: The operation equivalent to the kernel system call is based on a kernel bypass mechanism.

9. The device according to claim 1, wherein: Information about the kernel system call that has been made by the target application is obtained from a kernel system call handler.

10. The device according to claim 1, wherein: The information related to the kernel system call that has been made by the target application includes a context of the kernel system call, wherein the modification of the instruction is based on the context of the kernel system call.

11. The device according to claim 10, wherein: The processor circuitry is configured to execute the machine-readable instructions to: determine a location in memory of instructions to be modified based on a context of the kernel system call.

12. The device according to claim 1, wherein: The target application is started such that the target application shares an address space with the loader application.

13. The device according to claim 1, wherein: The processor circuit system is used to execute the machine-readable instructions to: intercept the kernel system call made by the target application by a kernel system call handler; and provide information related to the kernel system call made by the target application to the loader application by the kernel system call handler.

14. The device according to claim 13, wherein: The kernel system call handler is triggered by a call hook installed in a kernel being executed by the computer system.

15. The device according to claim 13, wherein: The processor circuit system is used to execute the machine-readable instructions to: determine the context of the kernel system call based on the intercepted system call; and provide information related to the kernel system call made by the target application together with information related to the context of the kernel system call.

16. An apparatus for a computer system, the apparatus comprising memory circuitry, machine-readable instructions, and processor circuitry, the processor circuitry being configured to execute the machine-readable instructions to: intercepting, by the kernel system call handler, a kernel system call that has been made by the target application that has been launched by the loader application; and The loader application is provided by the kernel system call handler with information related to the kernel system call that has been made by the target application.

17. The device according to claim 16, wherein: The kernel system call handler is triggered by a call hook installed in a kernel being executed by the computer system.

18. The device according to claim 16, wherein: The processor circuit system is used to execute the machine-readable instructions to: determine the context of the kernel system call based on the intercepted system call; and provide information related to the kernel system call made by the target application together with information related to the context of the kernel system call.

19. A method for a computer system, the method comprising: The target application is started by the loader application; obtaining, by the loader application, information related to kernel system calls that have been made by the target application; as well as The loader application modifies instructions of the target application based on information related to the kernel system call that has been made by the target application, wherein the modified instructions are configured to trigger an operation equivalent to the kernel system call, wherein the operation is equivalent to the kernel system call while avoiding context switching.

20. The method according to claim 19, further comprising: After modification of the target application, the modified instructions are used by the target application instead of the original instructions of the target application being modified by the modification, and the method includes: the target application uses the modified instructions instead of the original instructions of the target application being modified by the modification.

21. The method of claim 19, further comprising: The information related to the kernel system call made by the target application includes the context of the kernel system call, wherein the modification of the instruction is based on the context of the kernel system call, and the method includes: the loader application determines the location of the instruction to be modified in the memory based on the context of the kernel system call.

22. The method of claim 19, further comprising: intercepting, by a kernel system call handler, the kernel system call that has been made by the target application; and providing, by the kernel system call handler, to the loader application information related to the kernel system call that has been made by the target application.

23. The method of claim 19, further comprising: Based on the intercepted system call, determining the context of the kernel system call; and providing information related to the context of the kernel system call to information related to the kernel system call that has been made by the target application.

24. A method for a computer system, the method comprising: intercepting, by the kernel system call handler, a kernel system call already made by a target application already started by the loader application; as well as The loader application is provided by the kernel system call handler with information related to the kernel system call that has been made by the target application.

25. A non-transitory computer readable medium comprising a program code which, when executed on a processor, a computer or a programmable hardware component, causes the processor, the computer or the programmable hardware component to perform the method of one of claims 19-24.

Images