Skip to content

Clarify grammar and typos in syscall section and syscall-steal.c #381

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
frank0988 wants to merge 1 commit into
base: master
Choose a base branch
from
+8 −8
Open

Clarify grammar and typos in syscall section and syscall-steal.c #381

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 7 additions & 7 deletions examples/syscall-steal.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,30 +98,30 @@ static struct kprobe syscall_kprobe = {

static unsigned long **sys_call_table_stolen;

/* A pointer to the original system call. The reason we keep this, rather
* than call the original function (sys_openat), is because somebody else
* might have replaced the system call before us. Note that this is not
/* A pointer to the original system call. We retain this instead of
* calling the original function (sys_openat), because another
* module might have replaced the system call before us. Note that this is not
* 100% safe, because if another module replaced sys_openat before us,
* then when we are inserted, we will call the function in that module -
* and it might be removed before we are.
*
* Another reason for this is that we can not get sys_openat.
* It is a static variable, so it is not exported.
* It is a static function, so it is not exported.
*/
#ifdef CONFIG_ARCH_HAS_SYSCALL_WRAPPER
static asmlinkage long (*original_call)(const struct pt_regs *);
#else
static asmlinkage long (*original_call)(int, const char __user *, int, umode_t);
#endif

/* The function we will replace sys_openat (the function called when you
* call the open system call) with. To find the exact prototype, with
/* Our replacement function for sys_openat (the function called when you
* call the open system call) . To find the exact prototype, with
* the number and type of arguments, we find the original function first
* (it is at fs/open.c).
*
* In theory, this means that we are tied to the current version of the
* kernel. In practice, the system calls almost never change (it would
* wreck havoc and require programs to be recompiled, since the system
* wreak havoc and require programs to be recompiled, since the system
* calls are the interface between the kernel and the processes).
*/
#ifdef CONFIG_ARCH_HAS_SYSCALL_WRAPPER
Expand Down
2 changes: 1 addition & 1 deletion lkmpg.tex
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1915,7 +1915,7 @@ \section{System Calls}
Then, you are mostly on your own.

Notice that this example has been unavailable since Linux v6.9.
Specifically, after this \href{https://github.com/torvalds/linux/commit/1e3ad78334a69b36e107232e337f9d693dcc9df2#diff-4a16bf89a09b4f49669a30d54540f0b936ea0224dc6ee9edfa7700deb16c3e11R52}{commit}, due to the system call table changing the implementation from an indirect function call table to a switch statement for security issues, such as Branch History Injection (BHI) attack.
Specifically, after this \href{https://github.com/torvalds/linux/commit/1e3ad78334a69b36e107232e337f9d693dcc9df2#diff-4a16bf89a09b4f49669a30d54540f0b936ea0224dc6ee9edfa7700deb16c3e11R52}{commit}, the system call table changed from an indirect function call table to a switch statement for security issues, such as mitigating Branch History Injection (BHI) attacks.

@cubic-dev-ai cubic-dev-ai Bot Jul 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: The revised sentence conflates the sys_call_table[] data structure with the syscall dispatch mechanism. Commit 1e3ad78 changed the x86 dispatch path to use switch-based functions rather than indirect table lookups on vulnerable CPUs, but sys_call_table[] still exists (it is kept for tracing purposes). Saying the table itself "changed to a switch statement" mixes a data structure with a control-flow construct, which can mislead readers about kernel internals.

Consider rephrasing to clarify the distinction, for example: "the system call dispatch mechanism changed from using an indirect function call table to a switch statement."

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At lkmpg.tex, line 1918:

<comment>The revised sentence conflates the `sys_call_table[]` data structure with the syscall dispatch mechanism. Commit 1e3ad78 changed the x86 dispatch path to use switch-based functions rather than indirect table lookups on vulnerable CPUs, but `sys_call_table[]` still exists (it is kept for tracing purposes). Saying the table itself "changed to a switch statement" mixes a data structure with a control-flow construct, which can mislead readers about kernel internals.

Consider rephrasing to clarify the distinction, for example: "the system call dispatch mechanism changed from using an indirect function call table to a switch statement."</comment>

<file context>
@@ -1915,7 +1915,7 @@ \section{System Calls}
 
 Notice that this example has been unavailable since Linux v6.9.
-Specifically, after this \href{https://github.com/torvalds/linux/commit/1e3ad78334a69b36e107232e337f9d693dcc9df2#diff-4a16bf89a09b4f49669a30d54540f0b936ea0224dc6ee9edfa7700deb16c3e11R52}{commit}, due to the system call table changing the implementation from an indirect function call table to a switch statement for security issues, such as Branch History Injection (BHI) attack.
+Specifically, after this \href{https://github.com/torvalds/linux/commit/1e3ad78334a69b36e107232e337f9d693dcc9df2#diff-4a16bf89a09b4f49669a30d54540f0b936ea0224dc6ee9edfa7700deb16c3e11R52}{commit}, the system call table changed from an indirect function call table to a switch statement for security issues, such as mitigating Branch History Injection (BHI) attacks.
 See more information \href{https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2060909}{here}.
 
</file context>
Suggested change
Specifically, after this \href{https://github.com/torvalds/linux/commit/1e3ad78334a69b36e107232e337f9d693dcc9df2#diff-4a16bf89a09b4f49669a30d54540f0b936ea0224dc6ee9edfa7700deb16c3e11R52}{commit}, the system call table changed from an indirect function call table to a switch statement for security issues, such as mitigating Branch History Injection (BHI) attacks.
+Specifically, after this \href{https://github.com/torvalds/linux/commit/1e3ad78334a69b36e107232e337f9d693dcc9df2#diff-4a16bf89a09b4f49669a30d54540f0b936ea0224dc6ee9edfa7700deb16c3e11R52}{commit}, the system call dispatch mechanism changed from using an indirect function call table to a switch statement for security issues, such as mitigating Branch History Injection (BHI) attacks.

See more information \href{https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2060909}{here}.

Should one choose not to use a virtual machine, kernel programming can become risky.
Expand Down