1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
|
diff -Naur linux-3.1.5/include/linux/ptrace.h linux-3.1.5.vm1/include/linux/ptrace.h
--- linux-3.1.5/include/linux/ptrace.h 2011-12-09 17:57:05.000000000 +0100
+++ linux-3.1.5.vm1/include/linux/ptrace.h 2011-12-16 18:39:55.000000000 +0100
@@ -74,6 +74,11 @@
#define PTRACE_EVENT_EXIT 6
#define PTRACE_EVENT_STOP 7
+/* options for new PTRACE_SYSCALL syntax*/
+#define PTRACE_SYSCALL_SKIPEXIT 0x2
+#define PTRACE_SYSCALL_SKIPCALL 0x6
+#define PTRACE_SYSCALL_MASK 0x00000006
+
#include <asm/ptrace.h>
#ifdef __KERNEL__
@@ -102,6 +107,11 @@
#define PT_TRACE_VFORK_DONE PT_EVENT_FLAG(PTRACE_EVENT_VFORK_DONE)
#define PT_TRACE_EXIT PT_EVENT_FLAG(PTRACE_EVENT_EXIT)
+#define PT_SYSCALL_SKIPEXIT 0x60000000
+#define PT_SYSCALL_SKIPCALL 0x40000000
+#define PT_SYSCALL_MASK 0x60000000
+#define PTRACE2PT_SYSCALL(X) (((X) & PTRACE_SYSCALL_MASK) << 28)
+
#define PT_TRACE_MASK 0x000003f4
/* single stepping state bits (used on ARM and PA-RISC) */
diff -Naur linux-3.1.5/include/linux/tracehook.h linux-3.1.5.vm1/include/linux/tracehook.h
--- linux-3.1.5/include/linux/tracehook.h 2011-12-09 17:57:05.000000000 +0100
+++ linux-3.1.5.vm1/include/linux/tracehook.h 2011-12-16 18:39:55.000000000 +0100
@@ -97,7 +97,7 @@
struct pt_regs *regs)
{
ptrace_report_syscall(regs);
- return 0;
+ return (current->ptrace & PT_SYSCALL_SKIPCALL) ? 1 : 0;
}
/**
@@ -126,7 +126,8 @@
return;
}
- ptrace_report_syscall(regs);
+ if (!(current->ptrace & PT_SYSCALL_SKIPEXIT))
+ ptrace_report_syscall(regs);
}
/**
diff -Naur linux-3.1.5/kernel/ptrace.c linux-3.1.5.vm1/kernel/ptrace.c
--- linux-3.1.5/kernel/ptrace.c 2011-12-09 17:57:05.000000000 +0100
+++ linux-3.1.5.vm1/kernel/ptrace.c 2011-12-16 18:39:55.000000000 +0100
@@ -587,7 +587,7 @@
#endif
static int ptrace_resume(struct task_struct *child, long request,
- unsigned long data)
+ unsigned long addr, unsigned long data)
{
if (!valid_signal(data))
return -EIO;
@@ -616,6 +616,9 @@
user_disable_single_step(child);
}
+ child->ptrace &= ~PT_SYSCALL_MASK;
+ child->ptrace |= PTRACE2PT_SYSCALL(addr);
+
child->exit_code = data;
wake_up_state(child, __TASK_TRACED);
@@ -799,12 +802,12 @@
#endif
case PTRACE_SYSCALL:
case PTRACE_CONT:
- return ptrace_resume(child, request, data);
+ return ptrace_resume(child, request, addr, data);
case PTRACE_KILL:
if (child->exit_state) /* already dead */
return 0;
- return ptrace_resume(child, request, SIGKILL);
+ return ptrace_resume(child, request, addr, SIGKILL);
#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
case PTRACE_GETREGSET:
|
