Re: ptrace: gpf in syscall_trace_enter

Steven Rostedt
2014-05-07T16:00:28Z

On Wed, 07 May 2014 11:52:35 -0400
Sasha Levin <sasha.levin@oracle.com> wrote:

> > As the objdump is just of the object files and not the vmlinux, I would
> > need the offset from syscall_trace_leave of the RIP.
>
> 2803: 41 ff 14 24 callq *(%r12) <=== Here
> 2807: 49 83 c4 10 add $0x10,%r12
> 280b: 49 83 3c 24 00 cmpq $0x0,(%r12)

Yeah, after I sent the email, I figured it out from the

24 08 4c 89 ea 48 89 de <41> ff 14 24 49 83 c4 10 49

Thanks,

-- Steve