Re: [PATCH 1/3] x86_64,entry: Fix RCX for traced syscalls

2015-01-07 Thread Borislav Petkov
On Tue, Jan 06, 2015 at 08:00:41PM +0100, Borislav Petkov wrote: > I'll redo the whole games tomorrow. Ok I can't reproduce today either. Let's ascribe it to this particular test box being funny or something in 3.19-rcs. We can look at it if it happens again. Thanks. -- Regards/Gruss, Bori

Re: [PATCH 1/3] x86_64,entry: Fix RCX for traced syscalls

2015-01-06 Thread Borislav Petkov
On Tue, Jan 06, 2015 at 10:43:57AM -0800, Andy Lutomirski wrote: > Sure, but the code would be simpler if we shoved that value in the > EFLAGS slot. There probably is some reason for that but it's not like we can change it :-) > Hmm. I added and pushed a test for fork, but that didn't turn > any

Re: [PATCH 1/3] x86_64,entry: Fix RCX for traced syscalls

2015-01-06 Thread Andy Lutomirski
On Jan 6, 2015 7:34 AM, "Borislav Petkov" wrote: > > On Mon, Jan 05, 2015 at 12:31:15PM -0800, Andy Lutomirski wrote: > > Do you have context tracking on? > > Yap, it is enabled for whatever reason: > CONFIG_CONTEXT_TRACKING=y > CONFIG_CONTEXT_TRACKING_FORCE=y > CONFIG_HAVE_CONTEXT_TRACKING=y I'l

Re: [PATCH 1/3] x86_64,entry: Fix RCX for traced syscalls

2015-01-06 Thread Borislav Petkov
On Mon, Jan 05, 2015 at 12:31:15PM -0800, Andy Lutomirski wrote: > Do you have context tracking on? Yap, it is enabled for whatever reason: CONFIG_CONTEXT_TRACKING=y CONFIG_CONTEXT_TRACKING_FORCE=y CONFIG_HAVE_CONTEXT_TRACKING=y > I assume that's in the historical tree? Yeah. > > [ 180.059170]

Re: [PATCH 1/3] x86_64,entry: Fix RCX for traced syscalls

2015-01-05 Thread Andy Lutomirski
On Mon, Jan 5, 2015 at 4:59 AM, Borislav Petkov wrote: > On Fri, Nov 07, 2014 at 03:58:17PM -0800, Andy Lutomirski wrote: >> The int_ret_from_sys_call and syscall tracing code disagrees with >> the sysret path as to the value of RCX. >> >> The Intel SDM, the AMD APM, and my laptop all agree that s

Re: [PATCH 1/3] x86_64,entry: Fix RCX for traced syscalls

2015-01-05 Thread Borislav Petkov
On Fri, Nov 07, 2014 at 03:58:17PM -0800, Andy Lutomirski wrote: > The int_ret_from_sys_call and syscall tracing code disagrees with > the sysret path as to the value of RCX. > > The Intel SDM, the AMD APM, and my laptop all agree that sysret > returns with RCX == RIP. The syscall tracing code do

[PATCH 1/3] x86_64,entry: Fix RCX for traced syscalls

2014-11-07 Thread Andy Lutomirski
The int_ret_from_sys_call and syscall tracing code disagrees with the sysret path as to the value of RCX. The Intel SDM, the AMD APM, and my laptop all agree that sysret returns with RCX == RIP. The syscall tracing code does not respect this property. For example, this program: int main() {