Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Masami Hiramatsu <mhiramat@kernel.org>
To:     Andy Lutomirski <luto@kernel.org>, Ingo Molnar <mingo@kernel.org>
Cc:     Oleg Nesterov <oleg@redhat.com>,
        Masami Hiramatsu <mhiramat@kernel.org>,
        Peter Zijlstra <peterz@infradead.org>,
        LKML <linux-kernel@vger.kernel.org>,
        Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>,
        "David S . Miller" <davem@davemloft.net>, X86 ML <x86@kernel.org>,
        Andrew Cooper <andrew.cooper3@citrix.com>,
        Steven Rostedt <rostedt@goodmis.org>
Subject: [RFC PATCH 0/1] x86/kprobes: Remoev single-step trap from x86 kprobes
Date:   Mon,  1 Mar 2021 23:08:04 +0900
Message-Id: <161460768474.430263.18425867006584111900.stgit@devnote2>
In-Reply-To: <20210225112245.607c70ec13cf8d279390e89e@kernel.org>
References: <20210225112245.607c70ec13cf8d279390e89e@kernel.org>
User-Agent: StGit/0.19
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
Precedence: bulk

Hi Andy,

Here is the patch to remove the single-step debug trap from the x86 kprobe.
This uses int3 as you suggested instead of the debug trap, for removing the
iret which returns to kernel.
Some instructions must be emulated and some instructions becomes not able
to be probed, but as far as I can see those are not rare case.

TODOs/discussions
 - extend kprobe debugfs interface to show the arch-dependent flags, like
   [BOOST], [EMULATE].
 - Consider this emulation code split into a file and share it with uprobe
   (uprobe already has its own emulator) and alternatives (it has int3_emulate_*)
   but it can be overengineering.
 - Add testcases for emulator. Current kprobe smoke test is not arch specific.
   Maybe better to probe an assembly target code so that it can test "boosted",
   "emulated" or "int3-single-stepped" cases.

Thank you,

---

Masami Hiramatsu (1):
      x86/kprobes: Use int3 instead of debug trap for single-step


 arch/x86/include/asm/kprobes.h |   21 +-
 arch/x86/kernel/kprobes/core.c |  515 ++++++++++++++++++++++++++--------------
 arch/x86/kernel/traps.c        |    3 
 3 files changed, 351 insertions(+), 188 deletions(-)

--
Masami Hiramatsu (Linaro) <mhiramat@kernel.org>