Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
From:   Andy Lutomirski <luto@amacapital.net>
Mime-Version: 1.0 (1.0)
Subject: Re: Why do kprobes and uprobes singlestep?
Date:   Tue, 2 Mar 2021 12:35:54 -0800
Message-Id: <F8EFE97F-B738-4CDF-A7E0-B1F73152CD7F@amacapital.net>
References: <20210302202508.GA21871@redhat.com>
Cc:     Andy Lutomirski <luto@kernel.org>,
        Masami Hiramatsu <mhiramat@kernel.org>,
        Peter Zijlstra <peterz@infradead.org>,
        LKML <linux-kernel@vger.kernel.org>,
        Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>,
        "David S. Miller" <davem@davemloft.net>, X86 ML <x86@kernel.org>,
        Andrew Cooper <andrew.cooper3@citrix.com>
In-Reply-To: <20210302202508.GA21871@redhat.com>
To:     Oleg Nesterov <oleg@redhat.com>
Precedence: bulk


> On Mar 2, 2021, at 12:25 PM, Oleg Nesterov <oleg@redhat.com> wrote:
>=20
> =EF=BB=BFOn 03/01, Andy Lutomirski wrote:
>>=20
>>> On Mon, Mar 1, 2021 at 8:51 AM Oleg Nesterov <oleg@redhat.com> wrote:
>>>=20
>>> But I guess this has nothing to do with uprobes, they do not single-step=

>>> in kernel mode, right?
>>=20
>> They single-step user code, though, and the code that makes this work
>> is quite ugly.  Single-stepping on x86 is a mess.
>=20
> But this doesn't really differ from, say, gdb doing si ? OK, except uprobe=
s
> have to hook DIE_DEBUG. Nevermind...

Also, gdb doing so isn=E2=80=99t great either.  Single stepping over a pushf=
 instruction, signal delivery, or a syscall on x86 is a mess.

>=20
>>>> Uprobes seem to single-step user code for no discernable reason.
>>>> (They want to trap after executing an out of line instruction, AFAICT.
>>>> Surely INT3 or even CALL after the out-of-line insn would work as well
>>>> or better.)
>>>=20
>>> Uprobes use single-step from the very beginning, probably because this
>>> is the most simple and "standard" way to implement xol.
>>>=20
>>> And please note that CALL/JMP/etc emulation was added much later to fix t=
he
>>> problems with non-canonical addresses, and this emulation it still incom=
plete.
>>=20
>> Is there something like a uprobe test suite?
>=20
> Afaik, no.
>=20
>> How maintained /
>=20
> Add Srikar who sent the initial implementation. I can only say that I am g=
lad that
> ./scripts/get_maintainer.pl no longer mentions me ;) I did some changes (i=
ncluding
> emulation) but a) this was a long ago and b) only because I was forced^W a=
sked to
> fix the numerous bugs in this code.
>=20
>> actively used is uprobe?
>=20
> I have no idea, sorry ;)
>=20
> Oleg.
>=20