Messages in this thread | | | From | Andy Lutomirski <> | Date | Mon, 30 Jun 2014 08:12:47 -0700 | Subject | Re: [PATCH] x86_64,entry: Fix RCX for traced syscalls |
| |
On Sat, Jun 28, 2014 at 10:07 AM, Pavel Machek <pavel@ucw.cz> wrote: > On Thu 2014-06-26 13:47:32, Andy Lutomirski wrote: >> On Thu, Jun 26, 2014 at 1:12 PM, H. Peter Anvin <hpa@zytor.com> wrote: >> > The real question is if we care that sysret and iter don't match. On 32 bits the situation is even more complex. >> >> At least for 64 bits, iret vs sysret is purely a kernel implementation >> detail (except where a tracer modifies things that are inaccessible to >> sysret), so ISTM it's worth one instruction to make them match. >> >> I noticed this thing while fiddling with moving some of the syscall >> tracing logic to C. This isn't a real problem, but it at least made >> me scratch my head. > > If possible, we'd like to trace programs without programs being noticed they are > being traced. See subterfugue utility, for example. > > It is certainly worth one extra instruction.
I tend to agree.
FWIW, I haven't looked at the ia32 stuff, but it should be possible to do something similar if it's not there already. The iret path can set any user state it wants.
--Andy
| |