minor nit with decoding popf instruction - was Re: ptrace single-stepping change breaks Wine

John Kacur
2005-01-07T05:02:00Z

On Fri, 2004-12-31 at 17:01, Linus Torvalds wrote:
> On Fri, 31 Dec 2004, Davide Libenzi wrote:
> >
> > I don't think Linus ever posted a POPF-only patch. Try to comment those
> > lines in his POPF patch ...
>
> Here the two patches are independently, if people want to take a look.
>
> If somebody wants to split (and test) the TF-careful thing further (the
> "send_sigtrap()" changes are independent, I think), that would be
> wonderful... Hint hint.
>
> Linus

+static inline int is_at_popf(struct task_struct *child, struct pt_regs
*regs)
+{
+ int i, copied;
+ unsigned char opcode[16];
+ unsigned long addr = convert_eip_to_linear(child, regs);
+
+ copied = access_process_vm(child, addr, opcode, sizeof(opcode),
0);
+ for (i = 0; i < copied; i++) {
+ switch (opcode[i]) {
+ /* popf */
+ case 0x9d:
+ return 1;
+ /* opcode and address size prefixes */
+ case 0x66: case 0x67:
+ continue;
+ /* irrelevant prefixes (segment overrides and repeats)
*/
+ case 0x26: case 0x2e:
+ case 0x36: case 0x3e:
+ case 0x64: case 0x65:
+ case 0xf0: case 0xf2: case 0xf3:
+ continue;
+
+ /*
+ * pushf: NOTE! We should probably not let
+ * the user see the TF bit being set. But
+ * it's more pain than it's worth to avoid
+ * it, and a debugger could emulate this
+ * all in user space if it _really_ cares.
+ */
+ case 0x9c:
+ default:
+ return 0;
+ }
+ }
+ return 0;
+}

In order to avoid false positives, I think you should remove the line
case 0xf0: case 0xf2: case 0xf3:

0xf0 corresponds to the lock prefix which would trigger an invalid
opcode exception with a popf instruction.

0xf2 and 0xf3 correspond to the repeat prefixes and are also not valid
with popf