Re: [PATCH] arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates

[Will Deacon]

On Thu, Jul 16, 2026 at 10:09:55AM +0800, Jinjie Ruan wrote:
> On 7/15/2026 9:16 PM, Will Deacon wrote:
> >> /*
> >>  * Ensure tracer changes to x0 during SECCOMP_RET_TRACE processing
> >>  * are visible to later trace and audit.
> >> */
> > 
> > I'll tweak that, as I don't think the tracing part matters (it doesn't
> > see orig_x0 afaict) and I'd like to be very clear that this is down
> > to the secure_computing() call. So it becomes:
> 
> I do not think so, I think the trace part also matters, because the
> tracepoint also reads orig_x0 through syscall_get_arguments().
> 
>  18 TRACE_EVENT_SYSCALL(sys_enter,
>  19
>  20 >-------TP_PROTO(struct pt_regs *regs, long id),
>  21
>  22 >-------TP_ARGS(regs, id),
>  23
>  24 >-------TP_STRUCT__entry(
>  25 >------->-------__field(>-------long,>-->-------id>----->-------)
>  26 >------->-------__array(>-------unsigned long,>-args,>--6>------)
>  27 >-------),
>  28
>  29 >-------TP_fast_assign(
>  30 >------->-------__entry->id>----= id;
>  31 >------->-------syscall_get_arguments(current, regs, __entry->args);
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> 
>  32 >-------),
>  33
>  34 >-------TP_printk("NR %ld (%lx, %lx, %lx, %lx, %lx, %lx)",
>  35 >------->-------  __entry->id,
>  36 >------->-------  __entry->args[0], __entry->args[1], __entry->args[2],
>  37 >------->-------  __entry->args[3], __entry->args[4], __entry->args[5]),
>  38
>  39 >-------syscall_regfunc, syscall_unregfunc
>  40 );

Well spotted, I was looking for "orig_x0" when I initially looked at the
tracing code but it's hidden behind that call to syscall_get_arguments().

Will