Re: Portable syscall inspection

From: Ralf Baechle
Date: Thu May 31 2007 - 06:20:28 EST


On Tue, May 29, 2007 at 08:59:37AM +1000, Trent Waddington wrote:

> Someone finally noticed that my program that uses ptrace only works on
> i386..
> and, by the looks of it, there is no portable way to refer to the
> registers of a
> user_regs_struct when inspecting a system call.

Correct.

> I will probably end up making a header file for each architecture that
> defines where
> in the user_regs_struct things like the syscall number, the return
> value and the first 3 parameters are..

Also consider that some architectures pass parts of the arguments in
registers which on yet others are passed in memory. Sometimes padding
arguments are needed and many more oddities. Similar for results.
Inescapably such a program is a perment maintenance nightmare.

> has anyone done this already? or can otherwise save me a lot of time?

Similar things have been tried before but nothing that would be remotely
sane.

Ralf
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/