[lkml]   [2004]   [Oct]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRE: Getting a process' EIP address (and other registers)

-----Original Message-----
From: Hua Zhong []
Sent: Tuesday, October 12, 2004 9:20 PM
To: Hanson, Jonathan M;
Subject: RE: Getting a process' EIP address (and other registers)

The EIP is not on the user space stack. It's a system call, not a
call, and the EIP is where the system call is made.

Upon entering kernel all registeres are saved on the kernel stack. You
get it by the following:

struct pt_regs *regs = *(((struct pt_regs *)(THREAD_SIZE + (unsigned
long)current)) - 1);

> I have written a 2.4 kernel module that is triggered upon an
> IOCTL from a user application. Once triggered the kernel module dumps
> out the contents of the system memory and the x86 CPU
> architecture state
> to separate files.
> I'm writing to the list because my method for getting registers
> from the user process before it entered the kernel is producing
> incorrect results. I've looked all through the kernel code
> and searched
> all over the web for an answer to this specific question and found
> nothing relevant.
> In my research how to do this I've found that the stack pointer
> for the user process before it entered the kernel is stored in
> current->thread.esp0. From there the registers for the user
> process are
> stored at offsets from that location (for example, EIP is
> supposed to be
> 0x28 unsigned char bytes from esp0). I have code to get the EIP as
> follows:
> unsigned char *stack_address, *eip;
> stack_address = (unsigned char *)(current->thread.esp0);
> eip = stack_address + 0x28;
> printk("eip = %08lx\n", *(unsigned long *)eip);
> Like I mentioned this is producing incorrect results. How do I access
> the user process' general purpose registers contents as they
> were before
> the kernel was entered (or correct my code above if I'm accessing
> something wrong)?
> Thanks in advance for any help offered.

Thanks for the help. I think it's working now. I did have to
drop the pointer dereference at the front of the statement to get it to
compile, but my register values are now more consistent and believable.

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-03-22 14:07    [W:0.037 / U:6.328 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site