linux-kernel - Re: Why do kprobes and uprobes singlestep?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <F8EFE97F-B738-4CDF-A7E0-B1F73152CD7F@amacapital.net>
Date:   Tue, 2 Mar 2021 12:35:54 -0800
From:   Andy Lutomirski <luto@...capital.net>
To:     Oleg Nesterov <oleg@...hat.com>
Cc:     Andy Lutomirski <luto@...nel.org>,
        Masami Hiramatsu <mhiramat@...nel.org>,
        Peter Zijlstra <peterz@...radead.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Anil S Keshavamurthy <anil.s.keshavamurthy@...el.com>,
        "David S. Miller" <davem@...emloft.net>, X86 ML <x86@...nel.org>,
        Andrew Cooper <andrew.cooper3@...rix.com>
Subject: Re: Why do kprobes and uprobes singlestep?



> On Mar 2, 2021, at 12:25 PM, Oleg Nesterov <oleg@...hat.com> wrote:
> 
> On 03/01, Andy Lutomirski wrote:
>> 
>>> On Mon, Mar 1, 2021 at 8:51 AM Oleg Nesterov <oleg@...hat.com> wrote:
>>> 
>>> But I guess this has nothing to do with uprobes, they do not single-step
>>> in kernel mode, right?
>> 
>> They single-step user code, though, and the code that makes this work
>> is quite ugly.  Single-stepping on x86 is a mess.
> 
> But this doesn't really differ from, say, gdb doing si ? OK, except uprobes
> have to hook DIE_DEBUG. Nevermind...

Also, gdb doing so isn’t great either.  Single stepping over a pushf instruction, signal delivery, or a syscall on x86 is a mess.

> 
>>>> Uprobes seem to single-step user code for no discernable reason.
>>>> (They want to trap after executing an out of line instruction, AFAICT.
>>>> Surely INT3 or even CALL after the out-of-line insn would work as well
>>>> or better.)
>>> 
>>> Uprobes use single-step from the very beginning, probably because this
>>> is the most simple and "standard" way to implement xol.
>>> 
>>> And please note that CALL/JMP/etc emulation was added much later to fix the
>>> problems with non-canonical addresses, and this emulation it still incomplete.
>> 
>> Is there something like a uprobe test suite?
> 
> Afaik, no.
> 
>> How maintained /
> 
> Add Srikar who sent the initial implementation. I can only say that I am glad that
> ./scripts/get_maintainer.pl no longer mentions me ;) I did some changes (including
> emulation) but a) this was a long ago and b) only because I was forced^W asked to
> fix the numerous bugs in this code.
> 
>> actively used is uprobe?
> 
> I have no idea, sorry ;)
> 
> Oleg.
>