[v2,0/3] x86/kprobes: add exception opcode detector and boost more opcodes

Message

Jinghao Jia Feb. 4, 2024, 3:12 a.m. UTC

Hi everyone,

This patch set makes the following 3 changes:

- It refactors the can_probe and can_boost function to make them return
  bool instead of int. Both functions are just using int as bool so let's
  make them return a real boolean value.

- It adds an exception opcode detector to prevent kprobing on INTs and UDs.
  These opcodes serves special purposes in the kernel and kprobing them
  will also cause the stack trace to be polluted by the copy buffer
  address. This is suggested by Masami.

- At the same time, this patch set also boosts more opcodes from the group
  2/3/4/5. The newly boosted opcodes are all arithmetic instructions with
  semantics that are easy to reason about, and therefore, they are able to
  be boosted and executed out-of-line. These instructions were not boosted
  previously because they use opcode extensions that are not handled by the
  kernel. But now with the instruction decoder they can be easily handled.
  Boosting (and further jump optimizing) these instructions leads to a 10x
  performance gain for a single probe on QEMU.

Changelog:
---
v1 -> v2
v1: https://lore.kernel.org/linux-trace-kernel/[e-mail]/

- Address feedback from Xin:
  - Change return type of is_exception_insn from int to bool.

- Address feedback from Masami:
  - Improve code style in is_exception_insn.
  - Move instruction boundary check of the target address (addr == paddr)
    right after the decoding loop to avoid decoding if the target address
    is not a valid instruction boundary.
  - Document instruction encoding differences between AMD and Intel for
    instruction group 2 and 3 in can_boost.

- Add an extra patch to change the return type of can_probe and can_boost
  from int to bool based on v1 discussion.

- Improve code comments in general.

Jinghao Jia (3):
  x86/kprobes: Refactor can_{probe,boost} return type to bool
  x86/kprobes: Prohibit kprobing on INT and UD
  x86/kprobes: Boost more instructions from grp2/3/4/5

 arch/x86/kernel/kprobes/common.h |  2 +-
 arch/x86/kernel/kprobes/core.c   | 98 ++++++++++++++++++++++----------
 2 files changed, 69 insertions(+), 31 deletions(-)

--
2.43.0