On Wed, Mar 08, 2017 at 08:39:55PM -0800, Andrew Lutomirski wrote:
> On Wed, Mar 8, 2017 at 3:41 PM, Dmitry V. Levin wrote:
[...]
> > Is there any progress with this (or any alternative) solution?
> >
> > I see the kernel side has changed a bit, and the strace part
> > is in a better shape than 5 years ago (although I'm biased of course),
> > but I don't see any kernel interface that would allow strace to reliably
> > recognize this 0x80 case.
>
> I am strongly opposed to fudging registers to half-arsedly slightly
> improve the epicly crappy ptrace(2) interface for syscalls.
>
> To fix this right, please just add PTRACE_GET_SYSCALL_INFO or similar
> to, in one shot, read out all the syscall details. This means: arch,
> no, arg0..arg5, and *whether it's entry or exit*. I propose returning
> this structure:
>
> struct ptrace_syscall_info {
> u8 op; /* 0 for entry, 1 for exit */
> u8 pad0;
> u16 pad1;
> u32 pad2;
> union {
> struct seccomp_data syscall_entry;
> s64 syscall_exit_retval;
> };
> };
>
> because struct seccomp_data already gets this right. There's plenty
> of opportunity to fine-tune this. Now it works on all architectures.Unfortunately, the API is missing. Unlike syscall_get_nr(), syscall_get_arch() works with the current task only so there is no API to get the arch identifier for the given task that would work on all architectures. -- ldv
pgpkmPAKkKJMR.pgp
Description: PGP signature
