Playing around with singlestep on i386, I found this:
1. User sets TF and starts to singlestep through code,
handling SIGTRAPS as they occur.
2. Makes vsyscall; debug trap occurs in kernel mode and TF
is cleared. TIF_SINGLESTEP gets set so kernel will remember
to re-enable TF on return to user. But when user eflags
is saved on the stack, TF has already been cleared.
3. When user gets control back, TF is not re-enabled.
4. Even after user clears TF, TIF_SINGLESTEP remains set
for that thread.
None of this happens when using int80 because the flag
is cleared and re-enabled by the interrupt handler.
TIF_SINGLESTEP never gets set and doesn't need to be.
--
Chuck
"Equations are the Devil's sentences." --Stephen Colbert
On Thu, 16 Feb 2006, Chuck Ebbert wrote:
>
> 2. Makes vsyscall; debug trap occurs in kernel mode and TF
> is cleared. TIF_SINGLESTEP gets set so kernel will remember
> to re-enable TF on return to user. But when user eflags
> is saved on the stack, TF has already been cleared.
This is exactly correct.
TF should be re-enabled by the "is there work to be done at system call
return time?" logic, which should mean that we go through
do_notify_resume() (which will set TF_MASK) and return with an "iret".
We can't return with a sysexit in the TF case, and setting TF on the stack
is thus useless.
> 3. When user gets control back, TF is not re-enabled.
Sounds like something is broken, but I don't see what.
I did check single-step over sysenter at some point (a long time ago), so
this has worked.
Linus