Re: [PATCH 1/3] x86_64,entry: Fix RCX for traced syscalls

2015-01-07 Thread Borislav Petkov
On Tue, Jan 06, 2015 at 08:00:41PM +0100, Borislav Petkov wrote: > I'll redo the whole games tomorrow. Ok I can't reproduce today either. Let's ascribe it to this particular test box being funny or something in 3.19-rcs. We can look at it if it happens again. Thanks. -- Regards/Gruss, Bori

Re: [PATCH 1/3] x86_64,entry: Fix RCX for traced syscalls

2015-01-06 Thread Borislav Petkov
On Tue, Jan 06, 2015 at 10:43:57AM -0800, Andy Lutomirski wrote: > Sure, but the code would be simpler if we shoved that value in the > EFLAGS slot. There probably is some reason for that but it's not like we can change it :-) > Hmm. I added and pushed a test for fork, but that didn't turn > any

Re: [PATCH 1/3] x86_64,entry: Fix RCX for traced syscalls

2015-01-06 Thread Andy Lutomirski
On Jan 6, 2015 7:34 AM, "Borislav Petkov" wrote: > > On Mon, Jan 05, 2015 at 12:31:15PM -0800, Andy Lutomirski wrote: > > Do you have context tracking on? > > Yap, it is enabled for whatever reason: > CONFIG_CONTEXT_TRACKING=y > CONFIG_CONTEXT_TRACKING_FORCE=y > CONFIG_HAVE_CONTEXT_TRACKING=y I'l

Re: [PATCH 1/3] x86_64,entry: Fix RCX for traced syscalls

2015-01-06 Thread Borislav Petkov
On Mon, Jan 05, 2015 at 12:31:15PM -0800, Andy Lutomirski wrote: > Do you have context tracking on? Yap, it is enabled for whatever reason: CONFIG_CONTEXT_TRACKING=y CONFIG_CONTEXT_TRACKING_FORCE=y CONFIG_HAVE_CONTEXT_TRACKING=y > I assume that's in the historical tree? Yeah. > > [ 180.059170]

Re: [PATCH 1/3] x86_64,entry: Fix RCX for traced syscalls

2015-01-05 Thread Andy Lutomirski
On Mon, Jan 5, 2015 at 4:59 AM, Borislav Petkov wrote: > On Fri, Nov 07, 2014 at 03:58:17PM -0800, Andy Lutomirski wrote: >> The int_ret_from_sys_call and syscall tracing code disagrees with >> the sysret path as to the value of RCX. >> >> The Intel SDM, the AMD APM, and my laptop all agree that s

Re: [PATCH 1/3] x86_64,entry: Fix RCX for traced syscalls

2015-01-05 Thread Borislav Petkov
On Fri, Nov 07, 2014 at 03:58:17PM -0800, Andy Lutomirski wrote: > The int_ret_from_sys_call and syscall tracing code disagrees with > the sysret path as to the value of RCX. > > The Intel SDM, the AMD APM, and my laptop all agree that sysret > returns with RCX == RIP. The syscall tracing code do