Skip to content
GitLab
Projects Groups Snippets
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in / Register
  • D dynamorio
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 1,467
    • Issues 1,467
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 44
    • Merge requests 44
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Packages and registries
    • Packages and registries
    • Package Registry
    • Infrastructure Registry
  • Monitor
    • Monitor
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Repository
  • Wiki
    • Wiki
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • DynamoRIO
  • dynamorio
  • Issues
  • #4700
Closed
Open
Issue created Jan 30, 2021 by Derek Bruening@derekbrueningContributor

every Win10 1511+ x64 syscall goes back to dispatch b/c the number is unknown

I thought this was already filed but I couldn't find an existing issue.

Every win10 x64 syscall is considered non-ignorable and does not go through shared_syscall, forcing a trip back to dispatch which kills performance.

It's because of the branch separating the mov immed from the syscall instr that was put in place in win10-TH2(1511) x64:

ntdll!NtSetInformationProcess:
00007ffc`babac320 4c8bd1          mov     r10,rcx
00007ffc`babac323 b81c000000      mov     eax,1Ch
00007ffc`babac328 f604250803fe7f01 test    byte ptr [SharedUserData+0x308 (00000000`7ffe0308)],1
00007ffc`babac330 7503            jne     ntdll!NtSetInformationProcess+0x15 (00007ffc`babac335)
00007ffc`babac332 0f05            syscall
00007ffc`babac334 c3              ret
00007ffc`babac335 cd2e            int     2Eh
00007ffc`babac337 c3              ret
interp: start_pc = 0x00007ffcbabac332
check_thread_vm_area: pc = 0x00007ffcbabac332
prepend_entry_to_fraglist: putting fragment @0x00007ffcbabac332 (shared) on vmarea 0x00007ffcbab11000-0x00007ffcbac2c000
check_thread_vm_area: check_stop = 0x00007ffcbac2c000
  0x00007ffcbabac332  0f 05                syscall  -> %rcx
interp: syscall @ 0x00007ffcbabac332
syscall # is -1
found non-ignorable system call 0xffffffff
ending bb at syscall & removing the interrupt itself
end_pc = 0x00007ffcbabac334

We need some cross-block state or backward decoding.

Assignee
Assign to
Time tracking