The history of a linux kernel design flaw
summary
A design flaw lets 64-bit processes invoke both native and compat 32-bit syscalls and userland had no reliable way to tell which one ran; the fix adds a new ptrace API that reports syscall bitness and context. The result is PTRACE_GET_SYSCALL_INFO implemented across about 19 architectures via 29 patches over roughly 9 months, merged into kernel 5.3 and supported by strace 4.26, eliminating the register and opcode races that previously fooled tracers.
AI-written summary · about
chapters (9)
- 0:00The design flaw history
- 2:17Tracing limitations
- 5:00The kaleidoscope bug
- 8:47Early proposed solutions
- 12:20Development of the API
- 16:47Implementing the fix
- 22:51Refining the patch set
- 28:34Upstreaming and merge
- 34:58Final results and impact
related talks
01h 26mLinux User/Kernel ABI: the realities of how C and C++ programs really talk to the OS
46mKernel Hardening for 32-bit Arm Processors
19mSeecomp
35mLinux Tracing updates
49mBypassing KPTI Using the Speculative Behavior of the SWAPGS Instruction
20mpt_regs - the good the bad and the ugly
26mDesigning Syscalls for Extensibility
30mSpectre, Meltdown, & Linux