Re: Why do kprobes and uprobes singlestep?

[Andy Lutomirski]

> On Mar 2, 2021, at 12:25 PM, Oleg Nesterov <oleg@xxxxxxxxxx> wrote:
> 
> On 03/01, Andy Lutomirski wrote:
>> 
>>> On Mon, Mar 1, 2021 at 8:51 AM Oleg Nesterov <oleg@xxxxxxxxxx> wrote:
>>> 
>>> But I guess this has nothing to do with uprobes, they do not single-step
>>> in kernel mode, right?
>> 
>> They single-step user code, though, and the code that makes this work
>> is quite ugly.  Single-stepping on x86 is a mess.
> 
> But this doesn't really differ from, say, gdb doing si ? OK, except uprobes
> have to hook DIE_DEBUG. Nevermind...

Also, gdb doing so isn’t great either.  Single stepping over a pushf instruction, signal delivery, or a syscall on x86 is a mess.

> 
>>>> Uprobes seem to single-step user code for no discernable reason.
>>>> (They want to trap after executing an out of line instruction, AFAICT.
>>>> Surely INT3 or even CALL after the out-of-line insn would work as well
>>>> or better.)
>>> 
>>> Uprobes use single-step from the very beginning, probably because this
>>> is the most simple and "standard" way to implement xol.
>>> 
>>> And please note that CALL/JMP/etc emulation was added much later to fix the
>>> problems with non-canonical addresses, and this emulation it still incomplete.
>> 
>> Is there something like a uprobe test suite?
> 
> Afaik, no.
> 
>> How maintained /
> 
> Add Srikar who sent the initial implementation. I can only say that I am glad that
> ./scripts/get_maintainer.pl no longer mentions me ;) I did some changes (including
> emulation) but a) this was a long ago and b) only because I was forced^W asked to
> fix the numerous bugs in this code.
> 
>> actively used is uprobe?
> 
> I have no idea, sorry ;)
> 
> Oleg.
>