A while back, I let myself be convinced that kprobes genuinely need to single-step the kernel on occasion, and I decided that this sucked but I could live with it. it would, however, be Really Really Nice (tm) if we could have a rule that anyone running x86 Linux who single-steps the kernel (e.g. kgdb and nothing else) gets to keep all the pieces when the system falls apart around them. Specifically, if we don't allow kernel single-stepping and if we suitably limit kernel instruction breakpoints (the latter isn't actually a major problem), then we don't really really need to use IRET to return to the kernel, and that means we can avoid some massive NMI nastiness.
But I was contemplating the code, and I'm no longer convinced. Uprobes seem to single-step user code for no discernable reason. (They want to trap after executing an out of line instruction, AFAICT. Surely INT3 or even CALL after the out-of-line insn would work as well or better.) Why does kprobe single-step? I spend a while staring at the code, and it was entirely unclear to me what the purpose of the single-step is. --Andy
