Re: [RFC][PATCH 1/2] x86: Allow breakpoints to emulate call functions

From: Peter Zijlstra
Date: Tue May 07 2019 - 07:33:07 EST


On Tue, May 07, 2019 at 09:18:51AM +0000, David Laight wrote:
> From: Peter Zijlstra
> > Sent: 07 May 2019 09:58
> ...
> > + /*
> > + * When we're here from kernel mode; the (exception) stack looks like:
> > + *
> > + * 4*4(%esp) - <previous context>
> > + * 3*4(%esp) - flags
> > + * 2*4(%esp) - cs
> > + * 1*4(%esp) - ip
> > + * 0*4(%esp) - orig_eax
>
> Am I right in thinking that this is the only 'INT3' stack frame that
> needs to be 'fiddled' with?
> And that the 'emulate a call instruction' has verified that is the case??
> So the %cs is always the kernel %cs.

Only the INT3 thing needs 'the gap', but the far bigger change here is
that kernel frames now have a complete pt_regs set and all sorts of
horrible crap can go away.

For 32bit 'the gap' happens naturally when building a 5 entry frame. Yes
it is possible to build a 5 entry frame on top of the old 3 entry one,
but why bother...