linux-kernel - [PATCH] [RFC] tracehook: Hook in syscall tracing markers.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 21 Sep 2008 11:16:30 +0900
From:	Paul Mundt <lethal@...ux-sh.org>
To:	linux-kernel@...r.kernel.org
Cc:	Linus Torvalds <torvalds@...ux-foundation.org>,
	Mathieu Desnoyers <compudj@...stal.dyndns.org>,
	"Frank Ch. Eigler" <fche@...hat.com>,
	Roland McGrath <roland@...hat.com>
Subject: [PATCH] [RFC] tracehook: Hook in syscall tracing markers.

At kernel summit, the idea that syscall tracing was generally desirable
for tracing was mentioned several times, as was the argument that kernel
developers aren't placing markers in meaningful locations. This is a
simple patch to try and do that for the syscall case.

Presently LTTng attempts to litter these trace markers all over the
architecture code, primarily to get around the fact that there was no
generic way to get at this information before. Now that platforms are
starting to do their syscall entry/exit notifiers through tracehook and
we have the asm/syscall.h interface, all of this information can be
generically abstracted.

Signed-off-by: Paul Mundt <lethal@...ux-sh.org>

---

 include/linux/tracehook.h |    7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/include/linux/tracehook.h b/include/linux/tracehook.h
index 6186a78..481ff45 100644
--- a/include/linux/tracehook.h
+++ b/include/linux/tracehook.h
@@ -49,6 +49,9 @@
 #include <linux/sched.h>
 #include <linux/ptrace.h>
 #include <linux/security.h>
+#include <linux/marker.h>
+#include <asm/syscall.h>
+
 struct linux_binprm;
 
 /**
@@ -112,6 +115,8 @@ static inline __must_check int tracehook_report_syscall_entry(
 	struct pt_regs *regs)
 {
 	ptrace_report_syscall(regs);
+	trace_mark(kernel_arch_syscall_entry, "syscall_id %ld ip #p%ld",
+		   syscall_get_nr(NULL, regs), instruction_pointer(regs));
 	return 0;
 }
 
@@ -135,6 +140,8 @@ static inline __must_check int tracehook_report_syscall_entry(
 static inline void tracehook_report_syscall_exit(struct pt_regs *regs, int step)
 {
 	ptrace_report_syscall(regs);
+	trace_mark(kernel_arch_syscall_exit, "ret %ld",
+		   syscall_get_return_value(NULL, regs));
 }
 
 /**
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/