Re: [Patch 00/11] Hardware Breakpoint interfaces

Alan Stern
2009-04-09T20:50:47Z

On Tue, 7 Apr 2009, K.Prasad wrote:

> A slight change though...writes to DR0-DR3 may fail if the address is
> invalid. This behaviour is true even in existing implementation of
> ptrace_set_debugreg().

That's okay.

> > >
> > > /* Lazy debug register switching */
> > > if (per_cpu(last_debugged_task, get_cpu()) != current) {
> > > switch_to_none_hw_breakpoint();
> > > put_cpu_no_resched();
> > > }
> >
> > I just noticed that the lines saving DR7 and setting it to 0 need to
> > come here. Otherwise switch_to_none_hw_breakpoint() might set DR7 back
> > to a nonzero value, and it might not match the value stored in dr7.
> >
>
> arch_uninstall_thread_hw_breakpoint()<--switch_to_none_hw_breakpoint()
> will store 'kdr7' (which contains all kernel-space breakpoints in
> encoded format) to DR7 physical register. Given that the current()
> process should not have TIF_DEBUG() set (if it were set,
> switch_to_thread_hw_breakpoint() would have been invoked to set
> last_debugged_task), we will wipe out all user-space breakpoints and
> store only kdr7.

No, you don't understand. The code looks like this:

> + get_debugreg(dr7, 7);
> +
> + /* Disable breakpoints during exception handling */
> + set_debugreg(0UL, 7);
...
> + /* Lazy debug register switching */
> + if (per_cpu(last_debugged_task, get_cpu()) != current) {
> + switch_to_none_hw_breakpoint();
> + put_cpu_no_resched();
> + }
...
> + set_debugreg(dr7, 7);
> + return rc;

The first few lines will set dr7 to a value which includes the user
breakpoints and will set DR7 to 0. The next few lines will set DR7 to
kdr7, which might be non-zero. This is wrong; we need DR7 to be 0.
Then the second-to-last line will set DR7 back to dr7, which is also
wrong -- it should be set to kdr7.

> > For each breakpoint where we decide it's a case of lazy DR switching or
> > we invoke a "triggered" callback, the corresponding bit in dr6 should
> > be cleared. This is a way of indicating to do_debug() that the handler
> > has taken care of these causes of the exception.
> >
> > Similarly, the kprobe routine should clear the single-step bit in dr6
> > when it handles a single-step exception. When the notifier chain
> > completes, the only bits remaining in dr6 should be for events that
> > still need to be handled.
> >
> > Alan Stern
> >
>
> This does sound like good design, but unfortunately there are pieces in
> do_debug() which rely upon bits in dr6 being set even after the actual
> breakpoint is handled (the get_si_code() is one such example).

If necessary, do_debug() can keep two copies of dr6: the original
version read from DR6 and the version modified by the notification
handlers.

> Do we go about changing them to use thread->debugreg6 instead of dr6? If
> yes, wouldn't that be better done outside the HW Breakpoint patches as a
> part of some cleanup initiative?

Should they use thread->debugreg6? If they should, then change them.
And no, the change should not be in a separate patch; it should be part
of your series. Otherwise there would be intermediate kernels that
behaved incorrectly.

Alan Stern