Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 32 additions & 0 deletions Documentation/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -237,7 +237,39 @@ The following table shows the results. svc-hook reduces throughput by 0.9% and 0

Based on the experimental results above, we consider that the system call hooks applied by svc-hook do not significantly negate the performance of hook-applied application programs.

## Overhead Comparision with ASC-Hook

ASC-Hook[asc-hook] is another binary-rewirting-based system call hook mechanism. It uses a `br x8` primitive for the `svc` instruction replacement.

### Overhead of Trampoline Execution

We measure the time to hook the `getpid` system call using ASC-Hook. The experiment setup is exactly same with the experiment mentioned in the section 4.1 in our paper.

- ASC-Hook: 39 nsec
- svc-hook: 14 nsec
- LD_PRELOAD: 3 nsec

The time delta with LD_PRELOAD is the pure overhead of going through the trampoline code.
The delta is 36 nsec and 11 nsec for ASC-Hook and svc-hook. As we can see, svc-hook has less overhead compared with ASC-Hook.

### Performance of Initial Setup

We also measure the time to finish the execution of the initial setup function which injected by the LD_PRELOAD trick.

- ASC-Hook: 1890 milisec
- svc-hook: 25 milisec

The result shows that svc-hook is 75 times faster than ASC-Hook to finish the initial setup.

We consider that the primary reason of the difference is that ASC-Hook requires disassemble process in nature to find the instructions that assign the system call numbers to the x8 register. On the other hand, svc-hook uses simple binary pattern match to identify target instructions because it only need to find `svc` instructions,

### Summary

We consider svc-hook has less overhead compared with ASC-Hook in both trampoline code execution and initial setup.

[sqlite]: https://sqlite.org
[postgresql]: https://www.postgresql.org
[samba]: https://www.samba.org
[sqlite-bench]: https://github.com/ukontainer/sqlite-bench/tree/78e6cdc3d8791c28730f35ba0bd527d34aed2af4

[asc-hook]: https://github.com/shinya2001/ASC-Hook
3 changes: 2 additions & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -100,8 +100,9 @@ When the target process executes a system call, it branches to the trampoline, w

## Further Reading

- [My blog post (ja)](https://retrage.github.io/2024/07/31/svc-hook.html/): An initial introduction to svc-hook.
- [svc-hook: hooking system calls on ARM64 by binary rewriting](https://dl.acm.org/doi/10.1145/3721462.3770771): Our paper at ACM/IFIP Middleware 2025.
- [Supplemental Documentation](/Documentation/README.md): Supplemental documentation for svc-hook experimental results.
- [My blog post (ja)](https://retrage.github.io/2024/07/31/svc-hook.html/): An initial introduction to svc-hook.

## License

Expand Down