Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752786AbbKLBIt (ORCPT ); Wed, 11 Nov 2015 20:08:49 -0500 Received: from mail-ob0-f174.google.com ([209.85.214.174]:33667 "EHLO mail-ob0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752699AbbKLBIr (ORCPT ); Wed, 11 Nov 2015 20:08:47 -0500 MIME-Version: 1.0 In-Reply-To: <20151109213109.639071d7@gandalf.local.home> References: <2095400880.57684.1447011457513.JavaMail.zimbra@efficios.com> <20151109110536.7bce67e8@gandalf.local.home> <5640F406.3020207@kernel.org> <20151109144309.361ab4e5@gandalf.local.home> <20151109161216.2af12ffd@gandalf.local.home> <20151109213109.639071d7@gandalf.local.home> From: Andy Lutomirski Date: Wed, 11 Nov 2015 17:08:27 -0800 Message-ID: Subject: Re: Compat syscall instrumentation and return from execve issue To: Steven Rostedt Cc: Andy Lutomirski , Mathieu Desnoyers , Thomas Gleixner , "Anvin, H. Peter" , lttng-dev , LKML Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1418 Lines: 38 On Mon, Nov 9, 2015 at 6:31 PM, Steven Rostedt wrote: > On Mon, 9 Nov 2015 17:51:25 -0800 > Andy Lutomirski wrote: > > >> do_syscall_32_irqs_on would call syscall_return_slowpath(regs, >> AUDIT_ARCH_I386). do_syscall_64 (which doesn't exist yet) would call >> syscall_return_slowpath(regs, AUDIT_ARCH_X86_64). >> > > OK, so you are saying that a execve that switches the current state > into ia32 will return from the do_syscall_64 regardless? Then we would > have to add tracepoints that would be for both ia32 and x86_64. But > that would solve the current issue at hand. > Indeed. Unlike fork/clone, execve is only magical insofar as it does magical things to task_struct and it enters in the 64-bit native case through a nasty asm path. The former has no effect on the entry code (except most likely blocking opportunistic sysret because we're a bit silly and it might break ABI to change that), and the latter barely matters for this purpose. In any event, I'm planning on getting rid of the asm stub for 4.5 if I can get the code written and tested in time. --Andy -- Andy Lutomirski AMA Capital Management, LLC -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/