| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Fri, 14 Mar 2014 12:50:40 +0900
From: AKASHI Takahiro <takahiro.akashi@...aro.org>
To: Will Deacon <will.deacon@....com>
CC: "rostedt@...dmis.org" <rostedt@...dmis.org>,
"fweisbec@...il.com" <fweisbec@...il.com>,
"mingo@...hat.com" <mingo@...hat.com>,
Catalin Marinas <Catalin.Marinas@....com>,
"tim.bird@...ymobile.com" <tim.bird@...ymobile.com>,
"gkulkarni@...iumnetworks.com" <gkulkarni@...iumnetworks.com>,
"dsaxena@...aro.org" <dsaxena@...aro.org>,
"arndb@...db.de" <arndb@...db.de>,
"linux-arm-kernel@...ts.infradead.org"
<linux-arm-kernel@...ts.infradead.org>,
"linaro-kernel@...ts.linaro.org" <linaro-kernel@...ts.linaro.org>,
"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v6 7/7] arm64: ftrace: Add system call tracepoint
On 03/14/2014 01:25 AM, Will Deacon wrote:
> On Thu, Mar 13, 2014 at 10:13:50AM +0000, AKASHI Takahiro wrote:
>> This patch allows system call entry or exit to be traced as ftrace events,
>> ie. sys_enter_*/sys_exit_*, if CONFIG_FTRACE_SYSCALLS is enabled.
>> Those events appear and can be controlled under
>> ${sysfs}/tracing/events/syscalls/
>>
>> Please note that we can't trace compat system calls here because
>> AArch32 mode does not share the same syscall table with AArch64.
>> Just define ARCH_TRACE_IGNORE_COMPAT_SYSCALLS in order to avoid unexpected
>> results (bogus syscalls reported or even hang-up).
>>
>> Signed-off-by: AKASHI Takahiro <takahiro.akashi@...aro.org>
>> ---
>> arch/arm64/Kconfig | 1 +
>> arch/arm64/include/asm/ftrace.h | 20 ++++++++++++++++
>> arch/arm64/include/asm/syscall.h | 1 +
>> arch/arm64/include/asm/unistd.h | 2 ++
>> arch/arm64/kernel/ptrace.c | 48 ++++++++++++++++++++++----------------
>> 5 files changed, 52 insertions(+), 20 deletions(-)
>>
>> diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
>> index 6954959..b1dcdb4 100644
>> --- a/arch/arm64/Kconfig
>> +++ b/arch/arm64/Kconfig
>> @@ -43,6 +43,7 @@ config ARM64
>> select HAVE_MEMBLOCK
>> select HAVE_PATA_PLATFORM
>> select HAVE_PERF_EVENTS
>> + select HAVE_SYSCALL_TRACEPOINTS
>> select IRQ_DOMAIN
>> select MODULES_USE_ELF_RELA
>> select NO_BOOTMEM
>> diff --git a/arch/arm64/include/asm/ftrace.h b/arch/arm64/include/asm/ftrace.h
>> index c44c4b1..4ef06f1 100644
>> --- a/arch/arm64/include/asm/ftrace.h
>> +++ b/arch/arm64/include/asm/ftrace.h
>> @@ -44,6 +44,26 @@ static inline unsigned long ftrace_call_adjust(unsigned long addr)
>> #define CALLER_ADDR4 ((unsigned long)return_address(4))
>> #define CALLER_ADDR5 ((unsigned long)return_address(5))
>> #define CALLER_ADDR6 ((unsigned long)return_address(6))
>> +
>> +#include <asm/compat.h>
>> +
>> +/*
>> + * Because AArch32 mode does not share the same syscall table with AArch64,
>> + * tracing compat syscalls may result in reporting bogus syscalls or even
>> + * hang-up, so just do not trace them.
>> + * See kernel/trace/trace_syscalls.c
>> + *
>> + * x86 code says:
>> + * If the user realy wants these, then they should use the
>> + * raw syscall tracepoints with filtering.
>
> Fair enough.
>
>> + */
>> +#define ARCH_TRACE_IGNORE_COMPAT_SYSCALLS 1
>
> You don't need the '1' here.
OK.
>> +static inline bool arch_trace_is_compat_syscall(struct pt_regs *regs)
>> +{
>> + if (is_compat_task())
>> + return true;
>> + return false;
>> +}
>
> return is_compat_task();
Fix it.
>> #endif /* ifndef __ASSEMBLY__ */
>>
>> #endif /* __ASM_FTRACE_H */
>> diff --git a/arch/arm64/include/asm/syscall.h b/arch/arm64/include/asm/syscall.h
>> index 70ba9d4..383771e 100644
>> --- a/arch/arm64/include/asm/syscall.h
>> +++ b/arch/arm64/include/asm/syscall.h
>> @@ -18,6 +18,7 @@
>>
>> #include <linux/err.h>
>>
>> +extern const void *sys_call_table[];
>>
>> static inline int syscall_get_nr(struct task_struct *task,
>> struct pt_regs *regs)
>> diff --git a/arch/arm64/include/asm/unistd.h b/arch/arm64/include/asm/unistd.h
>> index 82ce217..c335479 100644
>> --- a/arch/arm64/include/asm/unistd.h
>> +++ b/arch/arm64/include/asm/unistd.h
>> @@ -28,3 +28,5 @@
>> #endif
>> #define __ARCH_WANT_SYS_CLONE
>> #include <uapi/asm/unistd.h>
>> +
>> +#define NR_syscalls (__NR_syscalls)
>> diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
>> index 9993a8f..9c52b3e 100644
>> --- a/arch/arm64/kernel/ptrace.c
>> +++ b/arch/arm64/kernel/ptrace.c
>> @@ -41,6 +41,9 @@
>> #include <asm/traps.h>
>> #include <asm/system_misc.h>
>>
>> +#define CREATE_TRACE_POINTS
>> +#include <trace/events/syscalls.h>
>> +
>> /*
>> * TODO: does not yet catch signals sent when the child dies.
>> * in exit.c or in signal.c.
>> @@ -1062,29 +1065,31 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
>> {
>> unsigned long saved_reg;
>>
>> - if (!test_thread_flag(TIF_SYSCALL_TRACE))
>> - return regs->syscallno;
>> + if (test_thread_flag(TIF_SYSCALL_TRACE)) {
>> + /*
>> + * A scrach register (ip(r12) on AArch32, x7 on AArch64) is
>> + * used to denote syscall entry/exit:
>> + * 0 -> entry
>> + */
>> + if (is_compat_task()) {
>
> if (arch_trace_is_compat_syscall())
I don't mind either way, but this part of code comes from the original
syscall_trace() (ie. ptrace stuff), and has nothing to do with ftrace events.
(You know, arch_trace_is_compat_syscall() is currently defined in asm/ftrace.h.)
So I'd like to keep it unchanged unless you really want.
> With those changes:
>
> Acked-by: Will Deacon <will.deacon@....com>
Thank you,
-Takahiro AKASHI
> Will
>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists