The events like PTRACE_EVENT_SYSCALL_ENTRY should not be reported to the tracer, that is why ptrace_report_syscall_entry() puts this code into ->ev_name only. And this is the only reason for ->ev_name.
Introduce PTRACE_EVENT_MASK which can filter out internal codes and change their users to put this code into ->ev_code too. --- kernel/ptrace.c | 28 ++++++++++++++++------------ 1 file changed, 16 insertions(+), 12 deletions(-) --- PU/kernel/ptrace.c~68_PUT_EVENT_IN_CODE 2009-10-06 01:23:21.000000000 +0200 +++ PU/kernel/ptrace.c 2009-10-06 02:00:51.000000000 +0200 @@ -37,10 +37,12 @@ struct ptrace_context { enum utrace_resume_action resume; }; -#define PTRACE_EVENT_SYSCALL_ENTRY 100 -#define PTRACE_EVENT_SYSCALL_EXIT 101 -#define PTRACE_EVENT_SIGTRAP 102 -#define PTRACE_EVENT_SIGNAL 103 +#define PTRACE_EVENT_SYSCALL_ENTRY (1 << 16) +#define PTRACE_EVENT_SYSCALL_EXIT (2 << 16) +#define PTRACE_EVENT_SIGTRAP (3 << 16) +#define PTRACE_EVENT_SIGNAL (4 << 16) +/* events visible to user-space */ +#define PTRACE_EVENT_MASK 0xFFFF static inline bool ev_pending(struct ptrace_context *context) { @@ -228,7 +230,8 @@ static u32 ptrace_report_syscall_entry(u WARN_ON(ev_pending(context)); context->ev_name = PTRACE_EVENT_SYSCALL_ENTRY; - context->ev_code = syscall_code(context); + context->ev_code = (PTRACE_EVENT_SYSCALL_ENTRY << 8) | + syscall_code(context); return UTRACE_SYSCALL_RUN | UTRACE_STOP; } @@ -244,7 +247,8 @@ static u32 ptrace_report_syscall_exit(en return UTRACE_STOP; context->ev_name = PTRACE_EVENT_SYSCALL_EXIT; - context->ev_code = syscall_code(context); + context->ev_code = (PTRACE_EVENT_SYSCALL_EXIT << 8) | + syscall_code(context); return UTRACE_STOP; } @@ -331,7 +335,7 @@ static u32 ptrace_report_signal(u32 acti if (resume != UTRACE_RESUME) { context->ev_name = PTRACE_EVENT_SIGTRAP; - context->ev_code = SIGTRAP; + context->ev_code = (PTRACE_EVENT_SIGTRAP << 8) | SIGTRAP; return UTRACE_STOP | UTRACE_SIGNAL_IGN; } @@ -357,7 +361,7 @@ static u32 ptrace_report_signal(u32 acti utrace_control(task, engine, UTRACE_INTERRUPT); context->ev_name = PTRACE_EVENT_SIGNAL; - context->ev_code = info->si_signo; + context->ev_code = (PTRACE_EVENT_SIGNAL << 8) | info->si_signo; context->signr = info->si_signo; return UTRACE_STOP | UTRACE_SIGNAL_IGN; @@ -821,7 +825,7 @@ static int ptrace_getsiginfo(struct ptra memset(info, 0, sizeof(*info)); info->si_signo = SIGTRAP; - info->si_code = context->ev_code; + info->si_code = context->ev_code & PTRACE_EVENT_MASK; info->si_pid = task_pid_vnr(tracee); info->si_uid = task_uid(tracee); @@ -864,7 +868,7 @@ static int ptrace_setsiginfo(struct ptra static void do_ptrace_notify_stop(struct ptrace_context *context, struct task_struct *tracee) { - tracee->exit_code = context->ev_code; + tracee->exit_code = context->ev_code & PTRACE_EVENT_MASK; read_lock(&tasklist_lock); /* @@ -942,8 +946,8 @@ static void do_ptrace_resume(struct utra case PTRACE_EVENT_CLONE: case PTRACE_EVENT_VFORK_DONE: context->ev_name = PTRACE_EVENT_SYSCALL_EXIT; - context->ev_code = syscall_code(context); - + context->ev_code = (PTRACE_EVENT_SYSCALL_EXIT << 8) | + syscall_code(context); do_ptrace_notify_stop(context, tracee); return; }