From: suthambhara nagaraj <suthambhara@gmail.com>
To: "Hanson, Jonathan M" <jonathan.m.hanson@intel.com>
Cc: main kernel <linux-kernel@vger.kernel.org>
Subject: Re: Getting a process' EIP address (and other registers)
Date: Wed, 13 Oct 2004 10:26:04 +0530 [thread overview]
Message-ID: <46561a7904101221564f0ef523@mail.gmail.com> (raw)
In-Reply-To: <C863B68032DED14E8EBA9F71EB8FE4C204FB456A@azsmsx406>
Why don't you use the pt_regs structure to restore the EIP
value stored during SAVE_ALL. Add a line in sys_ioctl to access the SAVE_ALL
stored values (EIP).This would then be simple pointer arithmetic.
I hope I havae answered you.
Regards
Suthambhara
On Tue, 12 Oct 2004 21:10:13 -0700, Hanson, Jonathan M
<jonathan.m.hanson@intel.com> wrote:
> I have written a 2.4 kernel module that is triggered upon an
> IOCTL from a user application. Once triggered the kernel module dumps
> out the contents of the system memory and the x86 CPU architecture state
> to separate files.
> I'm writing to the list because my method for getting registers
> from the user process before it entered the kernel is producing
> incorrect results. I've looked all through the kernel code and searched
> all over the web for an answer to this specific question and found
> nothing relevant.
> In my research how to do this I've found that the stack pointer
> for the user process before it entered the kernel is stored in
> current->thread.esp0. From there the registers for the user process are
> stored at offsets from that location (for example, EIP is supposed to be
> 0x28 unsigned char bytes from esp0). I have code to get the EIP as
> follows:
>
> unsigned char *stack_address, *eip;
>
> stack_address = (unsigned char *)(current->thread.esp0);
> eip = stack_address + 0x28;
> printk("eip = %08lx\n", *(unsigned long *)eip);
>
> Like I mentioned this is producing incorrect results. How do I access
> the user process' general purpose registers contents as they were before
> the kernel was entered (or correct my code above if I'm accessing
> something wrong)?
> Thanks in advance for any help offered.
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at http://www.tux.org/lkml/
>
next prev parent reply other threads:[~2004-10-13 4:56 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2004-10-13 4:10 Getting a process' EIP address (and other registers) Hanson, Jonathan M
2004-10-13 4:20 ` Hua Zhong
2004-10-13 4:56 ` suthambhara nagaraj [this message]
-- strict thread matches above, loose matches on Subject: below --
2004-10-13 18:15 Hanson, Jonathan M
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=46561a7904101221564f0ef523@mail.gmail.com \
--to=suthambhara@gmail.com \
--cc=jonathan.m.hanson@intel.com \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.