x86/kprobes: Use int3 instead of debug trap for single-step
authorMasami Hiramatsu <mhiramat@kernel.org>
Tue, 2 Mar 2021 15:25:46 +0000 (00:25 +0900)
committerPeter Zijlstra <peterz@infradead.org>
Tue, 23 Mar 2021 15:07:56 +0000 (16:07 +0100)
commit6256e668b7af9d81472e03c6a171630c08f8858a
tree1d687fd9f6b8f49949034a72272924a28f488ee2
parenta194acd316f93f3435a64de3b37dca2b5a77b338
x86/kprobes: Use int3 instead of debug trap for single-step

Use int3 instead of debug trap exception for single-stepping the
probed instructions. Some instructions which change the ip
registers or modify IF flags are emulated because those are not
able to be single-stepped by int3 or may allow the interrupt
while single-stepping.

This actually changes the kprobes behavior.

- kprobes can not probe following instructions; int3, iret,
  far jmp/call which get absolute address as immediate,
  indirect far jmp/call, indirect near jmp/call with addressing
  by memory (register-based indirect jmp/call are OK), and
  vmcall/vmlaunch/vmresume/vmxoff.

- If the kprobe post_handler doesn't set before registering,
  it may not be called in some case even if you set it afterwards.
  (IOW, kprobe booster is enabled at registration, user can not
   change it)

But both are rare issue, unsupported instructions will not be
used in the kernel (or rarely used), and post_handlers are
rarely used (I don't see it except for the test code).

Suggested-by: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/161469874601.49483.11985325887166921076.stgit@devnote2
arch/x86/include/asm/kprobes.h
arch/x86/kernel/kprobes/core.c
arch/x86/kernel/traps.c