Re: [RFC][PATCH 1/2] x86: Allow breakpoints to emulate call functions

[Steven Rostedt]

On Fri, 3 May 2019 09:20:55 -0700
Andy Lutomirski <luto@xxxxxxxxxxxxxx> wrote:

> So hereâs a somewhat nutty suggestion: how about we tweak the 32-bit entry code to emulate the sane 64-bit frame, not just for int3 but always?  Basically, the entry asm for entries from kernel mode would do, roughly:
> 
> push $0 ;dummy for call emulation
> push %ss
> push $0 ;a dummy for ESP
> push 3*4(%esp) ;EFLAGS
> push 3*4(%esp) ;CS
> push 3*4(%esp) ;EIP
> push %rax
> lea 7*4(%esp), %rax
> mov %rax, 4*4(%esp) ;ESP
> 
> And the exit asm would do a little dance to write EFLAGS, CS, and EIP to the right spot, then load ESP-3*4 into %esp and do IRET.
> 
> Now the annoying kernel_stack_pointer() hack can just go away, since regs->sp is always correct!
> 
> I probably screwed up some arithmetic there, but itâs the idea that counts :)

Yeah, as it will end up with:

 $0 ; dummy for call emulation
 %ss
 $0 ; dummy for ESP
 EIP
 $0
 %ss
 $0

As 3 only gets you over what you already pushed. I think 5*4 is what
you want.

I guess the real question is, what's the performance impact of doing
that? Although, this is only needed for kernel -> kernel exceptions,
which are hopefully a rarity.

-- Steve