[PATCH] audit: add ppc64 mach support

[PATCH] audit: add ppc64 mach support

[Tony Jones]

Add support for ppc64le.   

$ uname -a
Linux cabernet 3.12.26-3-default #1 SMP Mon Aug 18 15:07:30 UTC 2014 (d318f3a) ppc64le ppc64le ppc64le GNU/Linux

Without this,  perf trace and auditctl fail.   There is no 32 bit (ppcle).

Signed-off-by: Tony Jones <tonyj@suse.de>
---

Index: trunk/lib/libaudit.c
===================================================================
--- trunk/lib/libaudit.c	(revision 1011)
+++ trunk/lib/libaudit.c	(working copy)
@@ -1195,6 +1195,11 @@
 				return -6;
 			break;
 #endif
+		case MACH_PPC64LE:
+			if (bits != __AUDIT_ARCH_64BIT)
+				return -6;
+			break;
+
 		case MACH_86_64: /* fallthrough */
 		case MACH_PPC64: /* fallthrough */
 		case MACH_S390X: /* fallthrough */
Index: trunk/lib/libaudit.h
===================================================================
--- trunk/lib/libaudit.h	(revision 1011)
+++ trunk/lib/libaudit.h	(working copy)
@@ -356,6 +356,9 @@
 #define AUDIT_ARCH_AARCH64	(EM_AARCH64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
 #endif
 
+#ifndef AUDIT_ARCH_PPC64LE
+#define AUDIT_ARCH_PPC64LE	(EM_PPC64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
+#endif
 
 //////////////////////////////////////////////////////
 // This is an external ABI. Any changes in here will
@@ -438,7 +441,8 @@
 	MACH_S390,
 	MACH_ALPHA,
 	MACH_ARM,
-	MACH_AARCH64
+	MACH_AARCH64,
+	MACH_PPC64LE
 } machine_t;
 
 /* These are the valid audit failure tunable enum values */
Index: trunk/lib/lookup_table.c
===================================================================
--- trunk/lib/lookup_table.c	(revision 1011)
+++ trunk/lib/lookup_table.c	(working copy)
@@ -70,6 +70,7 @@
     { MACH_86_64,   AUDIT_ARCH_X86_64 },
     { MACH_IA64,    AUDIT_ARCH_IA64   },
     { MACH_PPC64,   AUDIT_ARCH_PPC64  },
+    { MACH_PPC64LE, AUDIT_ARCH_PPC64LE},
     { MACH_PPC,     AUDIT_ARCH_PPC    },
     { MACH_S390X,   AUDIT_ARCH_S390X  },
     { MACH_S390,    AUDIT_ARCH_S390   },
@@ -123,6 +124,7 @@
 			found = ia64_syscall_s2i(sc, &res);
 			break;
 		case MACH_PPC64:
+		case MACH_PPC64LE:
 		case MACH_PPC:
 			found = ppc_syscall_s2i(sc, &res);
 			break;
@@ -169,6 +171,7 @@
 		case MACH_IA64:
 			return ia64_syscall_i2s(sc);
 		case MACH_PPC64:
+		case MACH_PPC64LE:
 		case MACH_PPC:
 			return ppc_syscall_i2s(sc);
 		case MACH_S390X:
Index: trunk/lib/machinetab.h
===================================================================
--- trunk/lib/machinetab.h	(revision 1011)
+++ trunk/lib/machinetab.h	(working copy)
@@ -27,6 +27,7 @@
 _S(MACH_86_64,   "x86_64" )
 _S(MACH_IA64,    "ia64"   )
 _S(MACH_PPC64,   "ppc64"  )
+_S(MACH_PPC64LE, "ppc64le")
 _S(MACH_PPC,     "ppc"    )
 _S(MACH_S390X,   "s390x"  )
 _S(MACH_S390,    "s390"   )

Re: [PATCH] audit: add ppc64 mach support

[Tony Jones]

Sorry, typo in the Subject: 

Should have been "[PATCH] audit: add ppc64le mach support"

Re: [PATCH] audit: add ppc64 mach support

[Steve Grubb]

On Friday, August 29, 2014 01:16:00 PM Tony Jones wrote:
> Add support for ppc64le.   
> 
> $ uname -a
> Linux cabernet 3.12.26-3-default #1 SMP Mon Aug 18 15:07:30 UTC 2014
> (d318f3a) ppc64le ppc64le ppc64le GNU/Linux
> 
> Without this,  perf trace and auditctl fail.   There is no 32 bit (ppcle).
> 
> Signed-off-by: Tony Jones <tonyj@suse.de>
> ---

Thanks! Applied in commit 1013.

-Steve

Re: [PATCH] audit: add ppc64 mach support

[Steve Grubb]

Hi Tony,

On Friday, August 29, 2014 01:16:00 PM Tony Jones wrote:
> Add support for ppc64le.
> 
> $ uname -a
> Linux cabernet 3.12.26-3-default #1 SMP Mon Aug 18 15:07:30 UTC 2014
> (d318f3a) ppc64le ppc64le ppc64le GNU/Linux
> 
> Without this,  perf trace and auditctl fail.   There is no 32 bit (ppcle).
> 
> Signed-off-by: Tony Jones <tonyj@suse.de>
> ---
> 
> Index: trunk/lib/libaudit.c
> ===================================================================
> --- trunk/lib/libaudit.c	(revision 1011)
> +++ trunk/lib/libaudit.c	(working copy)
> @@ -1195,6 +1195,11 @@
>  				return -6;
>  			break;
>  #endif
> +		case MACH_PPC64LE:
> +			if (bits != __AUDIT_ARCH_64BIT)
> +				return -6;
> +			break;
> +
>  		case MACH_86_64: /* fallthrough */
>  		case MACH_PPC64: /* fallthrough */
>  		case MACH_S390X: /* fallthrough */
> Index: trunk/lib/libaudit.h
> ===================================================================
> --- trunk/lib/libaudit.h	(revision 1011)
> +++ trunk/lib/libaudit.h	(working copy)
> @@ -356,6 +356,9 @@
>  #define AUDIT_ARCH_AARCH64	(EM_AARCH64|__AUDIT_ARCH_64BIT|
__AUDIT_ARCH_LE)
>  #endif
> 
> +#ifndef AUDIT_ARCH_PPC64LE
> +#define AUDIT_ARCH_PPC64LE	(EM_PPC64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
> +#endif

Is this ^^^ define upstream or in some public branch?

-Steve

Re: [PATCH] audit: add ppc64 mach support

[Tony Jones]

On 12/01/2014 02:09 PM, Steve Grubb wrote:
> Hi Tony,
> 
> On Friday, August 29, 2014 01:16:00 PM Tony Jones wrote:
>> Add support for ppc64le.
>>
>> $ uname -a
>> Linux cabernet 3.12.26-3-default #1 SMP Mon Aug 18 15:07:30 UTC 2014
>> (d318f3a) ppc64le ppc64le ppc64le GNU/Linux
>>
>> Without this,  perf trace and auditctl fail.   There is no 32 bit (ppcle).
>>
>> Signed-off-by: Tony Jones <tonyj@suse.de>
>> ---
>>
>> Index: trunk/lib/libaudit.c
>> ===================================================================
>> --- trunk/lib/libaudit.c	(revision 1011)
>> +++ trunk/lib/libaudit.c	(working copy)
>> @@ -1195,6 +1195,11 @@
>>  				return -6;
>>  			break;
>>  #endif
>> +		case MACH_PPC64LE:
>> +			if (bits != __AUDIT_ARCH_64BIT)
>> +				return -6;
>> +			break;
>> +
>>  		case MACH_86_64: /* fallthrough */
>>  		case MACH_PPC64: /* fallthrough */
>>  		case MACH_S390X: /* fallthrough */
>> Index: trunk/lib/libaudit.h
>> ===================================================================
>> --- trunk/lib/libaudit.h	(revision 1011)
>> +++ trunk/lib/libaudit.h	(working copy)
>> @@ -356,6 +356,9 @@
>>  #define AUDIT_ARCH_AARCH64	(EM_AARCH64|__AUDIT_ARCH_64BIT|
> __AUDIT_ARCH_LE)
>>  #endif
>>
>> +#ifndef AUDIT_ARCH_PPC64LE
>> +#define AUDIT_ARCH_PPC64LE	(EM_PPC64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
>> +#endif
> 
> Is this ^^^ define upstream or in some public branch?
> 
> -Steve


Mainline kernel reports ppc64le (per a0588015deab1844261b27a67ae6f5b910fe2830) but there is no matching AUDIT_ARCH_PPC64LE.  Eric just pinged me on irc about it.   Fix to add it to include/uapi/linux/audit.h shoudld probably go upstream.

Re: [PATCH] audit: add ppc64 mach support

[Paul Moore]

On Monday, December 01, 2014 03:58:09 PM Tony Jones wrote:
> Mainline kernel reports ppc64le (per
> a0588015deab1844261b27a67ae6f5b910fe2830) but there is no matching
> AUDIT_ARCH_PPC64LE.  Eric just pinged me on irc about it.   Fix to add it
> to include/uapi/linux/audit.h shoudld probably go upstream.

Untested, uncompiled too, but beyond the patch below, is there anything else 
we would need in the kernel to enable proper ppc64le support?

commit 853ff573b5e5d9d09d1dff579a4a8d6fe8ca698c
Author: Paul Moore <pmoore@redhat.com>
Date:   Tue Dec 2 14:50:28 2014 -0500

    audit: add basic support for PPC64LE
    
    Signed-off-by: Paul Moore <pmoore@redhat.com>

diff --git a/arch/powerpc/include/asm/syscall.h 
b/arch/powerpc/include/asm/syscall.h
index b54b2ad..b9d65c3 100644
--- a/arch/powerpc/include/asm/syscall.h
+++ b/arch/powerpc/include/asm/syscall.h
@@ -86,4 +86,16 @@ static inline void syscall_set_arguments(struct task_struct 
*task,
 	memcpy(&regs->gpr[3 + i], args, n * sizeof(args[0]));
 }
 
+static inline int syscall_get_arch(void)
+{
+#ifdef CONFIG_PPC64
+#ifdef __LITTLE_ENDIAN__
+	return AUDIT_ARCH_PPC64LE;
+#else
+	return AUDIT_ARCH_PPC64;
+#endif /* __LITTLE_ENDIAN__ */
+#endif /* CONFIG_PPC64 */
+	return AUDIT_ARCH_PPC;
+}
+
 #endif	/* _ASM_SYSCALL_H */
diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
index 2e3d2bf..6797a83 100644
--- a/arch/powerpc/kernel/ptrace.c
+++ b/arch/powerpc/kernel/ptrace.c
@@ -1788,13 +1788,13 @@ long do_syscall_trace_enter(struct pt_regs *regs)
 
 #ifdef CONFIG_PPC64
 	if (!is_32bit_task())
-		audit_syscall_entry(AUDIT_ARCH_PPC64,
+		audit_syscall_entry(syscall_get_arch(),
 				    regs->gpr[0],
 				    regs->gpr[3], regs->gpr[4],
 				    regs->gpr[5], regs->gpr[6]);
 	else
 #endif
-		audit_syscall_entry(AUDIT_ARCH_PPC,
+		audit_syscall_entry(syscall_get_arch(),
 				    regs->gpr[0],
 				    regs->gpr[3] & 0xffffffff,
 				    regs->gpr[4] & 0xffffffff,
diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
index cf67147..c3997f4 100644
--- a/include/uapi/linux/audit.h
+++ b/include/uapi/linux/audit.h
@@ -364,6 +364,7 @@ enum {
 #define AUDIT_ARCH_PARISC64	(EM_PARISC|__AUDIT_ARCH_64BIT)
 #define AUDIT_ARCH_PPC		(EM_PPC)
 #define AUDIT_ARCH_PPC64	(EM_PPC64|__AUDIT_ARCH_64BIT)
+#define AUDIT_ARCH_PPC64LE	(EM_PPC64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
 #define AUDIT_ARCH_S390		(EM_S390)
 #define AUDIT_ARCH_S390X	(EM_S390|__AUDIT_ARCH_64BIT)
 #define AUDIT_ARCH_SH		(EM_SH)

-- 
paul moore
www.paul-moore.com

Re: [PATCH] audit: add ppc64 mach support

[Steve Grubb]

On Tuesday, December 02, 2014 03:18:35 PM Paul Moore wrote:
> On Monday, December 01, 2014 03:58:09 PM Tony Jones wrote:
> > Mainline kernel reports ppc64le (per
> > a0588015deab1844261b27a67ae6f5b910fe2830) but there is no matching
> > AUDIT_ARCH_PPC64LE.  Eric just pinged me on irc about it.   Fix to add it
> > to include/uapi/linux/audit.h shoudld probably go upstream.
> 
> Untested, uncompiled too, but beyond the patch below, is there anything else
> we would need in the kernel to enable proper ppc64le support?

The only question I have is whether or not PPC LE is just 64 bit or if it has 
a 32 bit ABI also. The uname patch referenced above seems to show a ppcle and 
ppc64le return. The original patch accepted was only for 64 bit ABI.

Thanks,
-Steve


> commit 853ff573b5e5d9d09d1dff579a4a8d6fe8ca698c
> Author: Paul Moore <pmoore@redhat.com>
> Date:   Tue Dec 2 14:50:28 2014 -0500
> 
>     audit: add basic support for PPC64LE
> 
>     Signed-off-by: Paul Moore <pmoore@redhat.com>
> 
> diff --git a/arch/powerpc/include/asm/syscall.h
> b/arch/powerpc/include/asm/syscall.h
> index b54b2ad..b9d65c3 100644
> --- a/arch/powerpc/include/asm/syscall.h
> +++ b/arch/powerpc/include/asm/syscall.h
> @@ -86,4 +86,16 @@ static inline void syscall_set_arguments(struct
> task_struct *task,
>  	memcpy(&regs->gpr[3 + i], args, n * sizeof(args[0]));
>  }
> 
> +static inline int syscall_get_arch(void)
> +{
> +#ifdef CONFIG_PPC64
> +#ifdef __LITTLE_ENDIAN__
> +	return AUDIT_ARCH_PPC64LE;
> +#else
> +	return AUDIT_ARCH_PPC64;
> +#endif /* __LITTLE_ENDIAN__ */
> +#endif /* CONFIG_PPC64 */
> +	return AUDIT_ARCH_PPC;
> +}
> +
>  #endif	/* _ASM_SYSCALL_H */
> diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
> index 2e3d2bf..6797a83 100644
> --- a/arch/powerpc/kernel/ptrace.c
> +++ b/arch/powerpc/kernel/ptrace.c
> @@ -1788,13 +1788,13 @@ long do_syscall_trace_enter(struct pt_regs *regs)
> 
>  #ifdef CONFIG_PPC64
>  	if (!is_32bit_task())
> -		audit_syscall_entry(AUDIT_ARCH_PPC64,
> +		audit_syscall_entry(syscall_get_arch(),
>  				    regs->gpr[0],
>  				    regs->gpr[3], regs->gpr[4],
>  				    regs->gpr[5], regs->gpr[6]);
>  	else
>  #endif
> -		audit_syscall_entry(AUDIT_ARCH_PPC,
> +		audit_syscall_entry(syscall_get_arch(),
>  				    regs->gpr[0],
>  				    regs->gpr[3] & 0xffffffff,
>  				    regs->gpr[4] & 0xffffffff,
> diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
> index cf67147..c3997f4 100644
> --- a/include/uapi/linux/audit.h
> +++ b/include/uapi/linux/audit.h
> @@ -364,6 +364,7 @@ enum {
>  #define AUDIT_ARCH_PARISC64	(EM_PARISC|__AUDIT_ARCH_64BIT)
>  #define AUDIT_ARCH_PPC		(EM_PPC)
>  #define AUDIT_ARCH_PPC64	(EM_PPC64|__AUDIT_ARCH_64BIT)
> +#define AUDIT_ARCH_PPC64LE	(EM_PPC64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
>  #define AUDIT_ARCH_S390		(EM_S390)
>  #define AUDIT_ARCH_S390X	(EM_S390|__AUDIT_ARCH_64BIT)
>  #define AUDIT_ARCH_SH		(EM_SH)

Re: [PATCH] audit: add ppc64 mach support

[Tony Jones]

On 12/02/2014 12:29 PM, Steve Grubb wrote:
> On Tuesday, December 02, 2014 03:18:35 PM Paul Moore wrote:
>> On Monday, December 01, 2014 03:58:09 PM Tony Jones wrote:
>>> Mainline kernel reports ppc64le (per
>>> a0588015deab1844261b27a67ae6f5b910fe2830) but there is no matching
>>> AUDIT_ARCH_PPC64LE.  Eric just pinged me on irc about it.   Fix to add it
>>> to include/uapi/linux/audit.h shoudld probably go upstream.
>>
>> Untested, uncompiled too, but beyond the patch below, is there anything else
>> we would need in the kernel to enable proper ppc64le support?
> 
> The only question I have is whether or not PPC LE is just 64 bit or if it has 
> a 32 bit ABI also. The uname patch referenced above seems to show a ppcle and 
> ppc64le return. The original patch accepted was only for 64 bit ABI.
> 
> Thanks,
> -Steve

Hmmn, initially when I ran into the problem it was due to perf trace (which uses the audit libs) failing.  I didn't notice any other kernel issues,  I'll have to look closer (wrt Pauls patch).    As far as 32bit,
I was told by our IBM liason that LE is 64 bit only.

Tony

Re: [PATCH] audit: add ppc64 mach support

[Richard Guy Briggs]

On 14/12/02, Paul Moore wrote:
> On Monday, December 01, 2014 03:58:09 PM Tony Jones wrote:
> > Mainline kernel reports ppc64le (per
> > a0588015deab1844261b27a67ae6f5b910fe2830) but there is no matching
> > AUDIT_ARCH_PPC64LE.  Eric just pinged me on irc about it.   Fix to add it
> > to include/uapi/linux/audit.h shoudld probably go upstream.
> 
> Untested, uncompiled too, but beyond the patch below, is there anything else 
> we would need in the kernel to enable proper ppc64le support?

Which kernel are you using?  syscall_get_arch() already exists on
powerpc.  audit_syscall_entry() lost its first argument recently...

What if it is in compatibility mode?

> commit 853ff573b5e5d9d09d1dff579a4a8d6fe8ca698c
> Author: Paul Moore <pmoore@redhat.com>
> Date:   Tue Dec 2 14:50:28 2014 -0500
> 
>     audit: add basic support for PPC64LE
>     
>     Signed-off-by: Paul Moore <pmoore@redhat.com>
> 
> diff --git a/arch/powerpc/include/asm/syscall.h 
> b/arch/powerpc/include/asm/syscall.h
> index b54b2ad..b9d65c3 100644
> --- a/arch/powerpc/include/asm/syscall.h
> +++ b/arch/powerpc/include/asm/syscall.h
> @@ -86,4 +86,16 @@ static inline void syscall_set_arguments(struct task_struct 
> *task,
>  	memcpy(&regs->gpr[3 + i], args, n * sizeof(args[0]));
>  }
>  
> +static inline int syscall_get_arch(void)
> +{
> +#ifdef CONFIG_PPC64
> +#ifdef __LITTLE_ENDIAN__
> +	return AUDIT_ARCH_PPC64LE;
> +#else
> +	return AUDIT_ARCH_PPC64;
> +#endif /* __LITTLE_ENDIAN__ */
> +#endif /* CONFIG_PPC64 */
> +	return AUDIT_ARCH_PPC;
> +}
> +
>  #endif	/* _ASM_SYSCALL_H */
> diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
> index 2e3d2bf..6797a83 100644
> --- a/arch/powerpc/kernel/ptrace.c
> +++ b/arch/powerpc/kernel/ptrace.c
> @@ -1788,13 +1788,13 @@ long do_syscall_trace_enter(struct pt_regs *regs)
>  
>  #ifdef CONFIG_PPC64
>  	if (!is_32bit_task())
> -		audit_syscall_entry(AUDIT_ARCH_PPC64,
> +		audit_syscall_entry(syscall_get_arch(),
>  				    regs->gpr[0],
>  				    regs->gpr[3], regs->gpr[4],
>  				    regs->gpr[5], regs->gpr[6]);
>  	else
>  #endif
> -		audit_syscall_entry(AUDIT_ARCH_PPC,
> +		audit_syscall_entry(syscall_get_arch(),
>  				    regs->gpr[0],
>  				    regs->gpr[3] & 0xffffffff,
>  				    regs->gpr[4] & 0xffffffff,
> diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
> index cf67147..c3997f4 100644
> --- a/include/uapi/linux/audit.h
> +++ b/include/uapi/linux/audit.h
> @@ -364,6 +364,7 @@ enum {
>  #define AUDIT_ARCH_PARISC64	(EM_PARISC|__AUDIT_ARCH_64BIT)
>  #define AUDIT_ARCH_PPC		(EM_PPC)
>  #define AUDIT_ARCH_PPC64	(EM_PPC64|__AUDIT_ARCH_64BIT)
> +#define AUDIT_ARCH_PPC64LE	(EM_PPC64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
>  #define AUDIT_ARCH_S390		(EM_S390)
>  #define AUDIT_ARCH_S390X	(EM_S390|__AUDIT_ARCH_64BIT)
>  #define AUDIT_ARCH_SH		(EM_SH)
> 
> -- 
> paul moore
> www.paul-moore.com
> 
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit

- RGB

--
Richard Guy Briggs <rbriggs@redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545

Re: [PATCH] audit: add ppc64 mach support

[Paul Moore]

On Tuesday, December 02, 2014 04:27:24 PM Richard Guy Briggs wrote:
> On 14/12/02, Paul Moore wrote:
> > On Monday, December 01, 2014 03:58:09 PM Tony Jones wrote:
> > > Mainline kernel reports ppc64le (per
> > > a0588015deab1844261b27a67ae6f5b910fe2830) but there is no matching
> > > AUDIT_ARCH_PPC64LE.  Eric just pinged me on irc about it.   Fix to add
> > > it
> > > to include/uapi/linux/audit.h shoudld probably go upstream.
> > 
> > Untested, uncompiled too, but beyond the patch below, is there anything
> > else we would need in the kernel to enable proper ppc64le support?
> 
> Which kernel are you using?  syscall_get_arch() already exists on
> powerpc.  audit_syscall_entry() lost its first argument recently...

That patch was on top of the linux-audit tree, it's based on v3.16 so I 
imagine there have been some changes upstream over the past few months.

> What if it is in compatibility mode?

/me shrugs ... that's why I posted it asking for feedback ;)  I just wanted to 
get the ball rolling on a fix.

-- 
paul moore
www.paul-moore.com