Messages in this thread | | | From | Denys Vlasenko <> | Date | Thu, 26 Jan 2012 15:02:21 +0100 | Subject | Re: Compat 32-bit syscall entry from 64-bit task!? |
| |
On Thu, Jan 26, 2012 at 12:01 PM, Jamie Lokier <jamie@shareable.org> wrote: > Denys Vlasenko wrote: >> On Thu, Jan 26, 2012 at 11:31 AM, Jamie Lokier <jamie@shareable.org> wrote: >> >> It's still unclear if the PTRACE_EVENT_EXEC comes before or after >> >> or instead of the post-execve ptrace event. >> >> Denis <- confused. >> Was ist das "post-execve ptrace event"? I know no such thing. >> I know about PTRACE_EVENT_EXEC, and "post-execve SIGTRAP". > > Sorry, I meant to write execve-syscall-exit event.
PTRACE_EVENT_EXEC happens before syscall exit. syscall exit is not lost. Basically, the sequence is:
tracer tracee with tid N, tgid M <------------- syscall entry for execve, pid=N PTRACE_SYSCALL---> <------------- PTRACE_EVENT_EXEC, pid=M PTRACE_GETEVENTMSG--> <------------- returns N ("I used to be tid N") PTRACE_SYSCALL---> <------------- syscall exit for execve, pid=M ...
-- vda
| |