i386 singlestep is borken

i386 singlestep is borken

[Chuck Ebbert]

Playing around with singlestep on i386, I found this:

1. User sets TF and starts to singlestep through code,
   handling SIGTRAPS as they occur.

2. Makes vsyscall; debug trap occurs in kernel mode and TF
   is cleared.  TIF_SINGLESTEP gets set so kernel will remember
   to re-enable TF on return to user.  But when user eflags
   is saved on the stack, TF has already been cleared.

3. When user gets control back, TF is not re-enabled.

4. Even after user clears TF, TIF_SINGLESTEP remains set
   for that thread.

None of this happens when using int80 because the flag
is cleared and re-enabled by the interrupt handler.
TIF_SINGLESTEP never gets set and doesn't need to be.

-- 
Chuck
"Equations are the Devil's sentences."  --Stephen Colbert

Re: i386 singlestep is borken

[Linus Torvalds]

On Thu, 16 Feb 2006, Chuck Ebbert wrote:
> 
> 2. Makes vsyscall; debug trap occurs in kernel mode and TF
>    is cleared.  TIF_SINGLESTEP gets set so kernel will remember
>    to re-enable TF on return to user.  But when user eflags
>    is saved on the stack, TF has already been cleared.

This is exactly correct. 

TF should be re-enabled by the "is there work to be done at system call 
return time?" logic, which should mean that we go through 
do_notify_resume() (which will set TF_MASK) and return with an "iret".

We can't return with a sysexit in the TF case, and setting TF on the stack 
is thus useless.

> 3. When user gets control back, TF is not re-enabled.

Sounds like something is broken, but I don't see what.

I did check single-step over sysenter at some point (a long time ago), so 
this has worked.

		Linus