Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Content-Type: text/plain;
        charset=utf-8
Mime-Version: 1.0 (1.0)
Subject: Re: [RFC PATCH] ptrace: add PTRACE_GET_SYSCALL_INFO request
From:   Andy Lutomirski <luto@amacapital.net>
In-Reply-To: <20181107164443.GA8726@redhat.com>
Date:   Wed, 7 Nov 2018 12:20:18 -0800
Cc:     Elvira Khabirova <lineprinter@altlinux.org>, rostedt@goodmis.org,
        mingo@redhat.com, linux-kernel@vger.kernel.org, ldv@altlinux.org,
        esyr@redhat.com, luto@kernel.org, strace-devel@lists.strace.io
Content-Transfer-Encoding: quoted-printable
Message-Id: <35B601B0-4D56-4706-B7A1-C9A522AB2D6F@amacapital.net>
References: <20181107042751.3b519062@akathisia> <20181107112100.GA20419@redhat.com> <3BDB914D-12F3-4703-A033-EBE02226EC45@amacapital.net> <20181107164443.GA8726@redhat.com>
To:     Oleg Nesterov <oleg@redhat.com>
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk


> On Nov 7, 2018, at 8:44 AM, Oleg Nesterov <oleg@redhat.com> wrote:
>=20
>> On 11/07, Andy Lutomirski wrote:
>>=20
>>=20
>>>> On Nov 7, 2018, at 3:21 AM, Oleg Nesterov <oleg@redhat.com> wrote:
>>>>=20
>>>> On 11/07, Elvira Khabirova wrote:
>>>>=20
>>>> In short, if a 64-bit task performs a syscall through int 0x80, its tra=
cer
>>>> has no reliable means to find out that the syscall was, in fact,
>>>> a compat syscall, and misidentifies it.
>>>> * Syscall-enter-stop and syscall-exit-stop look the same for the tracer=
.
>>>=20
>>> Yes, this was discussed many times...
>>>=20
>>> So perhaps it makes sense to encode compat/is_enter in ->ptrace_message,=

>>> debugger can use PTRACE_GETEVENTMSG to get this info.
>>=20
>> As I said before, I strongly object to the use of =E2=80=9Ccompat=E2=80=9D=
 here.
>=20
> Not sure I understand you... I do not like "compat" too, but this patch us=
es
> is_compat/etc and I agree with any naming.

My point is: returning a value to user code that is:

0 if the kernel and tracee are 32-bit
0 if the kernel and tracer are 64-but
1 if the kernel is 64-bit and the tracer is 32-bit
? If the tracer is arm64 ILP32

Is not a good design.  And 32-bit builds of strace will not appreciate it.

The API should return a value that, at least on a given overall architecture=
 and preferably globally, indicates the syscall arch.  While oddly named, au=
dit_arch fits the bill nicely, and we already require it to have the right s=
emantics for seccomp support.