Re: pt_regs->ax == -ENOSYS

[H. Peter Anvin]

On 4/27/21 5:20 PM, H. Peter Anvin wrote:
> We *used* to truncate the system call number; that was unsigned. It 
> causes massive headache to ptrace if a 32-bit ptrace wants to write -1, 
> which is a bit hacky.
>
> I would personally like to see orig_ax to be the register passed in and 
> for the truncation to happen by syscall_get_nr().
>
> I also note that kernel/seccomp.c and the tracing infrastructure all 
> expect a signed int as the system call number. Yes, orig_ax is a 64-bit 
> field, but so are the other register fields which doesn't necessarily 
> directly reflect the value of an argument -- like, say, %rdi in the case 
> of sys_write - it is an int argument so it gets sign extended; this is 
> *not* reflected in ptrace.
>
>      -hpa

We could even do this, to make it perhaps harder to mess up:

diff --git a/arch/x86/include/asm/ptrace.h b/arch/x86/include/asm/ptrace.h
index 409f661481e1..4e8e5c2e35f4 100644
--- a/arch/x86/include/asm/ptrace.h
+++ b/arch/x86/include/asm/ptrace.h
@@ -41,7 +41,10 @@ struct pt_regs {
 	unsigned short gs;
 	unsigned short __gsh;
 	/* On interrupt, this is the error code. */
-	unsigned long orig_ax;
+	union {
+		unsigned long orig_ax;
+		int syscall_nr;
+	};
 	unsigned long ip;
 	unsigned short cs;
 	unsigned short __csh;
@@ -78,7 +81,10 @@ struct pt_regs {
  * On syscall entry, this is syscall#. On CPU exception, this is error 
code.
  * On hw interrupt, it's IRQ number:
  */
-	unsigned long orig_ax;
+	union {
+		unsigned long orig_ax;
+		int syscall_nr;
+	};
 /* Return frame for iretq */
 	unsigned long ip;
 	unsigned long cs;