[PATCH] powerpc: Enable execve syscall exit tracepoint

[PATCH] powerpc: Enable execve syscall exit tracepoint

[Naveen N. Rao]

On execve[at], we are zero'ing out most of the thread register state
including gpr[0], which contains the syscall number. Due to this, we
fail to trigger the syscall exit tracepoint properly. Fix this by
retaining gpr[0] in the thread register state.

Before this patch:
  # tail /sys/kernel/debug/tracing/trace
	       cat-123     [000] .....    61.449351: sys_execve(filename:
  7fffa6b23448, argv: 7fffa6b233e0, envp: 7fffa6b233f8)
	       cat-124     [000] .....    62.428481: sys_execve(filename:
  7fffa6b23448, argv: 7fffa6b233e0, envp: 7fffa6b233f8)
	      echo-125     [000] .....    65.813702: sys_execve(filename:
  7fffa6b23378, argv: 7fffa6b233a0, envp: 7fffa6b233b0)
	      echo-125     [000] .....    65.822214: sys_execveat(fd: 0,
  filename: 1009ac48, argv: 7ffff65d0c98, envp: 7ffff65d0ca8, flags: 0)

After this patch:
  # tail /sys/kernel/debug/tracing/trace
	       cat-127     [000] .....   100.416262: sys_execve(filename:
  7fffa41b3448, argv: 7fffa41b33e0, envp: 7fffa41b33f8)
	       cat-127     [000] .....   100.418203: sys_execve -> 0x0
	      echo-128     [000] .....   103.873968: sys_execve(filename:
  7fffa41b3378, argv: 7fffa41b33a0, envp: 7fffa41b33b0)
	      echo-128     [000] .....   103.875102: sys_execve -> 0x0
	      echo-128     [000] .....   103.882097: sys_execveat(fd: 0,
  filename: 1009ac48, argv: 7fffd10d2148, envp: 7fffd10d2158, flags: 0)
	      echo-128     [000] .....   103.883225: sys_execveat -> 0x0

Cc: stable@vger.kernel.org
Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
---
 arch/powerpc/kernel/process.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index d00b20c6596671..bb4da23ecdd7c2 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -1854,7 +1854,7 @@ void start_thread(struct pt_regs *regs, unsigned long start, unsigned long sp)
 		tm_reclaim_current(0);
 #endif
 
-	memset(regs->gpr, 0, sizeof(regs->gpr));
+	memset(&regs->gpr[1], 0, sizeof(regs->gpr) - sizeof(regs->gpr[0]));
 	regs->ctr = 0;
 	regs->link = 0;
 	regs->xer = 0;

base-commit: 16332b7fbbe46581ddac80c6d32834c1269bc450
-- 
2.36.1

Re: [PATCH] powerpc: Enable execve syscall exit tracepoint

[Sumit Dubey2]

[-- Attachment #1: Type: text/plain, Size: 77 bytes --]

Tested-by: Sumit Dubey2 <Sumit.Dubey2@ibm.com<mailto:Sumit.Dubey2@ibm.com>>

[-- Attachment #2: Type: text/html, Size: 1639 bytes --]

Re: [PATCH] powerpc: Enable execve syscall exit tracepoint

[Michael Ellerman]

On Thu, 9 Jun 2022 16:03:28 +0530, Naveen N. Rao wrote:
> On execve[at], we are zero'ing out most of the thread register state
> including gpr[0], which contains the syscall number. Due to this, we
> fail to trigger the syscall exit tracepoint properly. Fix this by
> retaining gpr[0] in the thread register state.
> 
> Before this patch:
>   # tail /sys/kernel/debug/tracing/trace
> 	       cat-123     [000] .....    61.449351: sys_execve(filename:
>   7fffa6b23448, argv: 7fffa6b233e0, envp: 7fffa6b233f8)
> 	       cat-124     [000] .....    62.428481: sys_execve(filename:
>   7fffa6b23448, argv: 7fffa6b233e0, envp: 7fffa6b233f8)
> 	      echo-125     [000] .....    65.813702: sys_execve(filename:
>   7fffa6b23378, argv: 7fffa6b233a0, envp: 7fffa6b233b0)
> 	      echo-125     [000] .....    65.822214: sys_execveat(fd: 0,
>   filename: 1009ac48, argv: 7ffff65d0c98, envp: 7ffff65d0ca8, flags: 0)
> 
> [...]

Applied to powerpc/fixes.

[1/1] powerpc: Enable execve syscall exit tracepoint
      https://git.kernel.org/powerpc/c/ec6d0dde71d760aa60316f8d1c9a1b0d99213529

cheers