[RFC PATCH 0/2] x86/kprobes: add exception opcode detector and boost more opcodes

From: Jinghao Jia
Date: Sat Jan 27 2024 - 00:56:53 EST


Hi everyone,

This patch set makes the following 2 changes:

- It adds an exception opcode detector to prevent kprobing on INTs and UDs.
These opcodes serves special purposes in the kernel and kprobing them
will also cause the stack trace to be polluted by the copy buffer
address. This is suggested by Masami.

- At the same time, this patch set also boosts more opcodes from the group
2/3/4/5. The newly boosted opcodes are all arithmetic instructions with
semantics that are easy to reason about, and therefore, they are able to
be boosted and executed out-of-line. These instructions were not boosted
previously because they use opcode extensions that are not handled by the
kernel. But now with the instruction decoder they can be easily handled.
Boosting (and further jump optimizing) these instructions leads to a 10x
performance gain for a single probe on QEMU.

Jinghao Jia (2):
x86/kprobes: Prohibit kprobing on INT and UD
x86/kprobes: boost more instructions from grp2/3/4/5

arch/x86/kernel/kprobes/core.c | 54 ++++++++++++++++++++++++++--------
1 file changed, 41 insertions(+), 13 deletions(-)

--
2.43.0