Skip to content

RFC x86/kprobes: Remoev single-step trap from x86 kprobes

Masami Hiramatsu bpf lkml 1 version In review

Get series with b4
b4 am 161460768474.430263.18425867006584111900.stgit@devnote2

Versions newest first

  1. v1 RFC Latest1 patch 6 repliesIn review

Patches in v1 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/1x86/kprobes: Use int3 instead of debug trap for single-steparch/x86/include/asm/kprobes.h arch/x86/kernel/kprobes/core.c arch/x86/kernel/traps.c+351 -1886 replies

Reviews trailers per patch

The patch has a Reviewed-by or Acked-by.

PatchPeter Zijlstra (Intel)
1/1A-b

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes.

Read the v1 thread

Cover letter [RFC PATCH 0/1] x86/kprobes: Remoev single-step trap from x86 kprobes

Hi Andy,

Here is the patch to remove the single-step debug trap from the x86 kprobe. This uses int3 as you suggested instead of the debug trap, for removing the iret which returns to kernel.
Some instructions must be emulated and some instructions becomes not able to be probed, but as far as I can see those are not rare case.

TODOs/discussions
- extend kprobe debugfs interface to show the arch-dependent flags, like [BOOST], [EMULATE].
- Consider this emulation code split into a file and share it with uprobe (uprobe already has its own emulator) and alternatives (it has int3_emulate_*) but it can be overengineering.
- Add testcases for emulator. Current kprobe smoke test is not arch specific. Maybe better to probe an assembly target code so that it can test "boosted", "emulated" or "int3-single-stepped" cases.

Thank you,

---

Masami Hiramatsu (1):
x86/kprobes: Use int3 instead of debug trap for single-step

 arch/x86/include/asm/kprobes.h |   21 +-
 arch/x86/kernel/kprobes/core.c |  515 ++++++++++++++++++++++++++--------------
 arch/x86/kernel/traps.c        |    3 
 3 files changed, 351 insertions(+), 188 deletions(-)

--
Masami Hiramatsu (Linaro) <[email protected]>