Hi,
Here is a couple of patches to fix kprobes and optprobe to work
on the kernel with CONFIG_RETHUNK and CONFIG_SLS.
With these configs, the kernel functions may includes padding INT3 in
the function code block (body) in addition to the gaps between functions.
Since kprobes on x86 has to ensure the probe address is a function
bondary, it decodes the instructions in the function until the address.
If it finds an INT3 which is not embedded by kprobe, it stops decoding
because usually the INT3 is used for debugging as a software breakpoint
and such INT3 will replace the first byte of an original instruction.
Without recovering it, kprobes can not continue to decode it. Thus the
kprobes returns -EILSEQ as below.
# echo "p:probe/vfs_truncate_L19 vfs_truncate+98" >> kprobe_events
sh: write error: Invalid or incomplete multibyte or wide character
Actually, those INT3s are just for padding and can be ignored.
To avoid this issue, if kprobe finds an INT3, it gets the address of
next non-INT3 byte, and search a branch which jumps to the address.
If there is the branch, these INT3 will be for padding, so it can be
skipped. [1/2]
Since the optprobe has similar issue, it also skips the padding INT3
in the same way. [2/2]
With thses fixes, kprobe and optprobe can probe the kernel again with
CONFIG_RETHUNK=y.
# echo "p:probe/vfs_truncate_L19 vfs_truncate+98" >> kprobe_events
# echo 1 > events/probe/vfs_truncate_L19/enable
# cat /sys/kernel/debug/kprobes/list
ffffffff81307b52 k vfs_truncate+0x62 [OPTIMIZED]
Thank you,
---
Masami Hiramatsu (Google) (2):
x86/kprobes: Fix kprobes instruction boudary check with CONFIG_RETHUNK
x86/kprobes: Fix optprobe optimization check with CONFIG_RETHUNK
arch/x86/kernel/kprobes/common.h | 67 +++++++++++++++++++++++++++
arch/x86/kernel/kprobes/core.c | 57 +++++++++++++----------
arch/x86/kernel/kprobes/opt.c | 93 ++++++++++++++------------------------
3 files changed, 133 insertions(+), 84 deletions(-)
--
Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx>
