Note that there are some explanatory texts on larger screens.

plurals
  1. POHow is x86 instruction cache synchronized?
    primarykey
    data
    text
    <p>I like examples, so I wrote a bit of self-modifying code in c...</p> <pre><code>#include &lt;stdio.h&gt; #include &lt;sys/mman.h&gt; // linux int main(void) { unsigned char *c = mmap(NULL, 7, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE| MAP_ANONYMOUS, -1, 0); // get executable memory c[0] = 0b11000111; // mov (x86_64), immediate mode, full-sized (32 bits) c[1] = 0b11000000; // to register rax (000) which holds the return value // according to linux x86_64 calling convention c[6] = 0b11000011; // return for (c[2] = 0; c[2] &lt; 30; c[2]++) { // incr immediate data after every run // rest of immediate data (c[3:6]) are already set to 0 by MAP_ANONYMOUS printf("%d ", ((int (*)(void)) c)()); // cast c to func ptr, call ptr } putchar('\n'); return 0; } </code></pre> <p>...which works, apparently:</p> <pre><code>&gt;&gt;&gt; gcc -Wall -Wextra -std=c11 -D_GNU_SOURCE -o test test.c; ./test 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 </code></pre> <p>But honestly, I didn't <em>expect</em> it to work at all. I expected the instruction containing <code>c[2] = 0</code> to be cached upon the first call to <code>c</code>, after which all consecutive calls to <code>c</code> would ignore the repeated changes made to <code>c</code> (unless I somehow explicitedly invalidated the cache). Luckily, my cpu appears to be smarter than that.</p> <p>I guess the cpu compares RAM (assuming <code>c</code> even resides in RAM) with the instruction cache whenever the instruction pointer makes a large-ish jump (as with the call to the mmapped memory above), and invalidates the cache when it doesn't match (all of it?), but I'm hoping to get more precise information on that. In particular, I'd like to know if this behavior can be considered predictable (barring any differences of hardware and os), and relied on?</p> <p>(I probably should refer to the Intel manual, but that thing is thousands of pages long and I tend to get lost in it...)</p>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload