Re: System call number cached with help from SyscallObserver

[Yao Qi <qiyaoltc at cn dot ibm dot com>]

On Fri, Sep 15, 2006 at 01:47:57PM +0200, Mark Wielaard wrote:
> Hi Yao,
> 
> On Fri, 2006-09-15 at 15:05 +0800, Yao Qi wrote:
> > It is not *always* right to get system call number from a certain
> > register when exit from a system call, such as rt_sigreturn.  This
> > problem has been discussed in this thread,
> > 
> > http://sources.redhat.com/ml/frysk/2006-q3/msg00305.html
> > 
> > Andrew explained that *all* the registers have been flushed to restore
> > the state of that thread, so "orig_eax"(ia32), "orig_rax"(x86_64) or
> > "gpr0"(ppc) does not contain the value of system call number any more.
> > 
> > [...]
> >
> > The only thing I could figure out to fix this problem is to add a
> > SyscallObserver to update system call number cached in
> > SyscallEventInfo, or some where else, when enter in a system call, and
> > return system call numbers to other objects that want to know system
> > call information. (Any other solutions, free to tell me)
> 
> What is precisely the use case? When does a SyscallObserver want to get
> at the syscall number (or arguments) on exit? Can we assume that a
Here is an example,

  class SyscallObserver implements TaskObserver.Syscall
  {
  ......
  public Action updateSyscallExit(Task task)
    {
      SyscallEventInfo syscallEventInfo = getSyscallEventInfo(task);
      int syscallNum = syscallEventInfo.number (task);
      if (syscallNum == SyscallNum.SYSopen
          || syscallNum == SyscallNum.SYSclose)
        {
          exited++;
        }
      return Action.CONTINUE;
    }
  ......
  }

System call number is needed in updateSyscall{Enter|Exit}.

The problem is that system call number is needed in
updateSyscall{Enter|Exit}, but the method to get system call number,
when enter and exit syscall, should be different.(get number from a
register when enter, and get number from a cached value when exit),
but SyscallEventInfo.number does not know it is called in 
updateSyscallEnter or updateSyscallExit.

> SyscallObserver will record Enter/Exit pairs themselves? If so then a
> SyscallObserver should probably have saved the syscall number and any
> arguments it is interested in on updateSyscallEnter() so it can use them
> in updateSyscallExit(). Then when updateSyscallExit() is called the only
> "valid" thing to query is the return value.

There are two methods for interface TaskObserver.Syscall,
updateSyscallEnter and updateSyscallExit, and they are invoked when
enter and exit a system call.

Yes, SyscallObserver *should* have saved the syscall number in
updateSyscallEnter(), but updateSyscallEnter() does not save syscall
number now.

If syscall number is saved in updateSyscallEnter() in SyscallObserver,
all the classes that implement updateSyscallEnter() should be aware of
this details, and save the syscall number by themselves.  It is not
good, since every time, when we implement updateSyscallEnter(), we
should save the syscall number by ourselves.(Correct me if I am wrong)

IMO, SyscallEventInfo is the good place to cache system call number,
and provides a method number(Task task, Boolean enterSyscall), which
return the system call number and cache it when enterSyscall is true,
while return the cached syscall number when enterSyscall is false.
The current number(Task) return system call number *always* from a
certain register.

-- 
Yao Qi