Lines Matching refs:syscall

30 syscall-stop and so on. They are described in detail later.
50 kills even within syscalls (syscall-exit-stop is not generated prior to
61 When tracee executes exit syscall, it reports its death to its tracer.
64 When any thread executes exit_group syscall, every tracee in its thread
68 before actual death. This applies to exits on exit syscall, group_exit
69 syscall, signal deaths (except SIGKILL), and when threads are torn down
123 group-stop, PTRACE_EVENT stops, syscall-stops [, SINGLESTEP, SYSEMU,
168 prematurely. Kernel should always restart the syscall in this case:
169 tracer would observe a new syscall-enter-stop for the same syscall,
171 tracer would observe a syscall-enter-stop for restart_syscall(2)
172 syscall. There may still be bugs in this area which cause some syscalls
282 syscall-enter-stop just prior to entering any syscall. If tracer
283 restarts it with PTRACE_SYSCALL, tracee enters syscall-exit-stop when
284 syscall is finished, or if it is interrupted by a signal. (That is,
285 signal-delivery-stop never happens between syscall-enter-stop and
286 syscall-exit-stop, it happens *after* syscall-exit-stop).
289 exit (if it entered exit or exit_group syscall), be killed by SIGKILL,
290 or die silently (if execve syscall happened in another thread).
292 Syscall-enter-stop and syscall-exit-stop are observed by tracer as
300 kernel, whereas syscall-stops have si_code = SIGTRAP or (SIGTRAP |
301 0x80). However, syscall-stops happen very often (twice per syscall),
302 and performing PTRACE_GETSIGINFO for every syscall-stop may be somewhat
306 For example, on x86 rax = -ENOSYS in syscall-enter-stop. Since SIGTRAP
307 (like any other signal) always happens *after* syscall-exit-stop, and
309 "syscall-stop which is not syscall-enter-stop", IOW: it looks like a
310 "stray syscall-exit-stop" and can be detected this way. But such
316 Syscall-enter-stop and syscall-exit-stop are indistinguishable from
318 ptrace-stops in order to not misinterpret syscall-enter-stop as
319 syscall-exit-stop or vice versa. The rule is that syscall-enter-stop is
320 always followed by syscall-exit-stop, PTRACE_EVENT stop or tracee's
323 If after syscall-enter-stop tracer uses restarting command other than
324 PTRACE_SYSCALL, syscall-exit-stop is not generated.
326 PTRACE_GETSIGINFO on syscall-stops returns si_signo = SIGTRAP, si_code
385 may cause stray EINTR return from the currently executing syscall in
399 signal-delivery-stop after they exit syscall which created them.
434 death as if they exited via exit syscall with exit code 0. Then
438 The execve-ing tracee changes its pid while it is in execve syscall.
446 group leader returns from a different syscall than it entered, or even
447 "returned from syscall even though it was not in any syscall". If
455 syscall return.
475   ** we get syscall-entry-stop in thread 1: **
478   ** we get syscall-entry-stop in thread 2: **
482   ** we get syscall-exit-stop for PID0: **
488 tracee, kernel delivers an extra SIGTRAP to tracee after execve syscall
527 If thread group leader is traced and exits by calling exit syscall,