linux-kernel - Re: [PATCH] tracing/x86: Update syscall trace events to handle new x86 syscall func names

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180417165843.GA14271@light.dominikbrodowski.net>
Date:   Tue, 17 Apr 2018 18:58:43 +0200
From:   Dominik Brodowski <linux@...inikbrodowski.net>
To:     Steven Rostedt <rostedt@...dmis.org>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Ingo Molnar <mingo@...nel.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        "H. Peter Anvin" <hpa@...or.com>, x86@...nel.org,
        Arnaldo Carvalho de Melo <acme@...nel.org>
Subject: Re: [PATCH] tracing/x86: Update syscall trace events to handle new
 x86 syscall func names

On Tue, Apr 17, 2018 at 12:39:27PM -0400, Steven Rostedt wrote:
> > > names, they do not match the default compare algorithm. As this was a
> > > problem for power pc, the algorithm can be overwritten by the architecture.
> > > The solution is to have x86 have its own algorithm to do the compare and
> > > this brings back the system call trace events.  
> > 
> > this lets me wonder *which* syscall "function" should be included in this
> > directory. Is it really the stub (__x64_sys_waitid, for example), or better
> > the sign-extending C function (__se_sys_waitid) which then calls an
> > internal helper (__do_sys_waitid). An additional advantage:
> > __se_sys_waitid would be available on x86 and, AFAICS, on all other archs.
> 
> It should include anything that uses the "SYSCALL_DEFINE#()" macros.

Well, that's not a 1:1, but a 1:several translation... SYSCALL_DEFINEx()
[SYSCALL_DEFINE0() is special] expands to

	__do_sys_waitid     # inlined helper doing actual work
	__se_sys_waitid     # C func calling inlined helper

on all architectures, with most (!= 64-bit x86) also having

	     sys_waitid	    # alias to __se_sys_waitid()

On 64-bit x86, it does not only extend to the two functions mentioned above,
but also to one or two stubs (depending on the configuration), namely

	  __x64_sys_waitid  # x64 64-bit-ptregs -> C stub
	 __ia32_sys_waitid  # ia32 32-bit-ptregs -> C stub

Thanks,
	Dominik