Skip to content

Commit 6256e66

Browse files
mhiramatPeter Zijlstra
authored andcommitted
x86/kprobes: Use int3 instead of debug trap for single-step
Use int3 instead of debug trap exception for single-stepping the probed instructions. Some instructions which change the ip registers or modify IF flags are emulated because those are not able to be single-stepped by int3 or may allow the interrupt while single-stepping. This actually changes the kprobes behavior. - kprobes can not probe following instructions; int3, iret, far jmp/call which get absolute address as immediate, indirect far jmp/call, indirect near jmp/call with addressing by memory (register-based indirect jmp/call are OK), and vmcall/vmlaunch/vmresume/vmxoff. - If the kprobe post_handler doesn't set before registering, it may not be called in some case even if you set it afterwards. (IOW, kprobe booster is enabled at registration, user can not change it) But both are rare issue, unsupported instructions will not be used in the kernel (or rarely used), and post_handlers are rarely used (I don't see it except for the test code). Suggested-by: Andy Lutomirski <luto@kernel.org> Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://lkml.kernel.org/r/161469874601.49483.11985325887166921076.stgit@devnote2
1 parent a194acd commit 6256e66

File tree

3 files changed

+353
-188
lines changed

3 files changed

+353
-188
lines changed

arch/x86/include/asm/kprobes.h

Lines changed: 16 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -65,10 +65,22 @@ struct arch_specific_insn {
6565
* a post_handler).
6666
*/
6767
unsigned boostable:1;
68-
unsigned if_modifier:1;
69-
unsigned is_call:1;
70-
unsigned is_pushf:1;
71-
unsigned is_abs_ip:1;
68+
unsigned char size; /* The size of insn */
69+
union {
70+
unsigned char opcode;
71+
struct {
72+
unsigned char type;
73+
} jcc;
74+
struct {
75+
unsigned char type;
76+
unsigned char asize;
77+
} loop;
78+
struct {
79+
unsigned char reg;
80+
} indirect;
81+
};
82+
s32 rel32; /* relative offset must be s32, s16, or s8 */
83+
void (*emulate_op)(struct kprobe *p, struct pt_regs *regs);
7284
/* Number of bytes of text poked */
7385
int tp_len;
7486
};
@@ -107,7 +119,6 @@ extern int kprobe_fault_handler(struct pt_regs *regs, int trapnr);
107119
extern int kprobe_exceptions_notify(struct notifier_block *self,
108120
unsigned long val, void *data);
109121
extern int kprobe_int3_handler(struct pt_regs *regs);
110-
extern int kprobe_debug_handler(struct pt_regs *regs);
111122

112123
#else
113124

0 commit comments

Comments
 (0)