linux-kernel - Re: [RFC][PATCH] tracing/syscalls: Have ia32 compat syscalls show raw format

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 12 Feb 2013 13:51:21 -0500
From:	Steven Rostedt <rostedt@...dmis.org>
To:	"H. Peter Anvin" <hpa@...ux.intel.com>
Cc:	LKML <linux-kernel@...r.kernel.org>,
	Ingo Molnar <mingo@...nel.org>,
	Thomas Gleixner <tglx@...utronix.de>,
	Frederic Weisbecker <fweisbec@...il.com>,
	Josh Poimboeuf <jpoimboe@...hat.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Vaibhav Nagarnaik <vnagarnaik@...gle.com>
Subject: Re: [RFC][PATCH] tracing/syscalls: Have ia32 compat syscalls show
 raw format

On Tue, 2013-02-12 at 13:42 -0500, Steven Rostedt wrote:

> Really, I converted:
> 
>              lls-1127  [005] d...   936.409188: sys_recvfrom(fd: 0, ubuf: 4d560fc4, size: 0, flags: 8048034, addr: 8, addr_len: f7700420)
>              lls-1127  [005] d...   936.409190: sys_recvfrom -> 0x8a77000
>              lls-1127  [005] d...   936.409211: sys_lgetxattr(pathname: 0, name: 1000, value: 3, size: 22)
>              lls-1127  [005] d...   936.409215: sys_lgetxattr -> 0xf76ff000
>              lls-1127  [005] d...   936.409223: sys_dup2(oldfd: 4d55ae9b, newfd: 4)
>              lls-1127  [005] d...   936.409228: sys_dup2 -> 0xfffffffffffffffe
> 
> To:
>              lls-1100  [005] d...    97.051616: sys_compat_syscall(NR: 2d, arg1: 0, arg2: 4d560fc4, arg3: 0, arg4: 8048034, arg5: 8, arg6: f77bb420)

0x2d = 45

>              lls-1100  [005] d...    97.051619: sys_compat_syscall -> 0x91fd000
>              lls-1100  [005] d...    97.051640: sys_compat_syscall(NR: c0, arg1: 0, arg2: 1000, arg3: 3, arg4: 22, arg5: ffffffff, arg6: 0)

0xc0 = 192

>              lls-1100  [005] d...    97.051644: sys_compat_syscall -> 0xf77ba000
>              lls-1100  [005] d...    97.051652: sys_compat_syscall(NR: 21, arg1: 4d55ae9b, arg2: 4, arg3: 4d560fc4, arg4: 4d55ae9b, arg5: 0, arg6: fff3ee78)

0x21 = 33

>              lls-1100  [005] d...    97.051658: sys_compat_syscall -> 0xfffffffffffffffe
> 

syscall nr      |   ia32 syscall    | x86_64syscall
----------------+-------------------+--------------
  45            |    sys_brk        | sys_recvfrom
  192           |    sys_mmap2      | sys_lgetxattr
  33            |    sys_access     | sys_dup2

Makes more sense now doesn't it.

-- Steve


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/