On Tue, Aug 30, 2016 at 4:28 PM, Steven Rostedt [off-list ref] wrote:

On Tue, 30 Aug 2016 16:09:04 -0700
Andy Lutomirski [off-list ref] wrote:

quoted

But none of this should be a problem at all for MIPS, right?  AFAICT
the only problem for MIPS is that there *is* a mapping from metadata
to nr.  If that mapping got removed, MIPS should just work, right?

Wait, where's the mapping of metadata to nr. I don't see that, nor do I
see a need for that. The issue is that we have metadata that expresses
how to record a syscall, and we map syscall nr to metadata, because
when tracing is active, the only thing we have to find that metadata is
the syscall nr.

It's in init_ftrace_syscalls():

        meta->syscall_nr = i;

and everything that uses that.  I think that this is the main problem
that the patch that started this thread changes, and I think that
deleting it would be cleaner than this patch.

Now if a syscall nr has more than one way to record (a single nr for
multiple syscalls), then we get into trouble. That's why we have
trouble with compat syscalls. The same number maps to different
syscalls, and we don't know how to differentiate that.

quoted

For x86 compat, I think that adding arch should be sufficient.
Specifically, rather than having just one enter_syscall_files array,
have one per audit arch.  Then call syscall_get_arch() as well as
syscall_get_nr() and use both to lookup the metadata.  AFAIK this
should work on all architectures, although you might need some arch
helpers to enumerate all the arches and their respective syscall
tables (and max syscall nrs).

OK, if the regs can get us to the arch, then this might work.

That is, perhaps we can have multiple tables (not really sure how to
make that happen in an arch agnostic way), and then have two functions:

trace_get_syscall_nr(current, regs)
trace_get_syscall_arch(current, regs)

Sadly, syscall_get_arch() doesn't take a regs parameter -- it looks at
current.  If it were made more general, it would need a task pointer,
not a regs pointer, but would just looking at current be okay for
tracing?

syscall_get_arch() does work on all archs that support seccomp filters, though.