2006-02-16 11:01:22

by Chuck Ebbert

[permalink] [raw]
Subject: i386 singlestep is borken

Playing around with singlestep on i386, I found this:

1. User sets TF and starts to singlestep through code,
handling SIGTRAPS as they occur.

2. Makes vsyscall; debug trap occurs in kernel mode and TF
is cleared. TIF_SINGLESTEP gets set so kernel will remember
to re-enable TF on return to user. But when user eflags
is saved on the stack, TF has already been cleared.

3. When user gets control back, TF is not re-enabled.

4. Even after user clears TF, TIF_SINGLESTEP remains set
for that thread.

None of this happens when using int80 because the flag
is cleared and re-enabled by the interrupt handler.
TIF_SINGLESTEP never gets set and doesn't need to be.

--
Chuck
"Equations are the Devil's sentences." --Stephen Colbert


2006-02-16 16:32:11

by Linus Torvalds

[permalink] [raw]
Subject: Re: i386 singlestep is borken



On Thu, 16 Feb 2006, Chuck Ebbert wrote:
>
> 2. Makes vsyscall; debug trap occurs in kernel mode and TF
> is cleared. TIF_SINGLESTEP gets set so kernel will remember
> to re-enable TF on return to user. But when user eflags
> is saved on the stack, TF has already been cleared.

This is exactly correct.

TF should be re-enabled by the "is there work to be done at system call
return time?" logic, which should mean that we go through
do_notify_resume() (which will set TF_MASK) and return with an "iret".

We can't return with a sysexit in the TF case, and setting TF on the stack
is thus useless.

> 3. When user gets control back, TF is not re-enabled.

Sounds like something is broken, but I don't see what.

I did check single-step over sysenter at some point (a long time ago), so
this has worked.

Linus