rseq
Partial in Antinomie 0.7.0 · Syscall list
Synopsis
Section titled “Synopsis”long rseq(struct rseq *rseq, uint32_t rseq_len, int flags, uint32_t sig);| Number (x86-64) | 334 |
| ABI | common |
| Kernel entry point | sys_rseq |
This is the raw kernel prototype from the pinned Linux 6.12.94 schema, not the libc wrapper.
Description
Section titled “Description”Registers a restartable-sequences area shared between the thread and the kernel.
Arguments
Section titled “Arguments”| Name | Type | Meaning |
|---|---|---|
rseq (arg0) |
struct rseq * |
Pointer to the rseq area. |
rseq_len (arg1) |
uint32_t |
Length of the rseq area. |
flags (arg2) |
int |
Option flags that change the behavior of the call. |
sig (arg3) |
uint32_t |
Signal number. |
Return value
Section titled “Return value”On success: 0.
In an Antinomie trace the Return column and the ret filter field show the raw kernel return value. On failure that is the negative errno, for example -2 for ENOENT, not the -1 plus errno that the libc wrapper gives. syscall.errno holds the positive errno and syscall.success is false.
Common errors
Section titled “Common errors”| Raw return | Name | Meaning |
|---|---|---|
-22 |
EINVAL |
An argument is invalid. |
-1 |
EPERM |
The operation is not permitted for this process. |
Man page
Section titled “Man page”Captured by Antinomie
Section titled “Captured by Antinomie”Coverage mark: Partial. After a successful registration the kernel keeps updating the rseq area on every return to user space, which is recorded with the “not observed asynchronously” status.
Every call is recorded as an Entry record (the six argument words and the pointees copied at entry) and an Exit record (the return value and the pointees copied at exit).
Arguments
Section titled “Arguments”| Argument | When | How | Recorded field key | Condition |
|---|---|---|---|---|
rseq (arg0) |
Entry | the pointer itself, as a raw word | args.0, args.raw[0] |
|
| ↳ pointee | Entry | structure rseq, length min(rseq_len, 32) |
arg0.rseq |
always |
| ↳ pointee | Exit | the 32 bytes the kernel reset | arg0.rseq |
result is 0 and RSEQ_FLAG_UNREGISTER is set |
| ↳ pointee | Exit | 32 bytes, status “not observed asynchronously” | arg0.rseq.updates |
result is 0 and the call registered the area |
rseq_len (arg1) |
Entry | raw scalar word | args.1, args.rseq_len |
|
flags (arg2) |
Entry | raw scalar word; Syscall Trace also decodes it into flag names (rseq group), listing unknown bits separately |
args.2, args.flags |
|
sig (arg3) |
Entry | raw scalar word | args.3, args.sig |
Filter fields
Section titled “Filter fields”- Result:
ret,syscall.errno,syscall.success,syscall.duration_ns. - Argument words:
args.rseq(arg0),args.rseq_len(arg1),args.flags(arg2),args.sig(arg3);args.0toargs.5by position. - Structure
rseqbehindrseq(arg0):args.rseq.<member>forcpu_id,cpu_id_start,flags,mm_cid,node_id,rseq_cs.
See Syscall Trace filter for the full syntax.
Known gaps
Section titled “Known gaps”- The kernel writes the cpu, node and mm ids later, on each return to user space.
- See the coverage mark above for the code paths that record a gap.
For what the capture statuses mean, see Capture statuses. For what is never recorded, see Known gaps.