From mboxrd@z Thu Jan  1 00:00:00 1970
From: michel.dagenais@polymtl.ca (Michel Dagenais)
Date: Fri, 19 Nov 2010 16:42:53 -0500 (EST)
Subject: [ltt-dev] Question about instruction pointer and address
 attributes
In-Reply-To: <20101119144305.17237jyflt1dt2o8@www.usherbrooke.ca>
Message-ID: <1803619724.178551290202973690.JavaMail.root@srv12.zimbra.polymtl.ca>

> In the event  
> kernel.syscall_entry sys_access, I got the instruction pointer  
> ip=0x7fa4fba26ee7. I dumped the process memory map from  
> /proc/$PID/maps, and this address doesn't fit in the process memory  
> space. It's somewhat close to libc addresses, that are in the range of

That makes sense, most system calls first go through libc.

> Another example, inside a TRAP, I got two addresses,  
> ip=0xffffffff812c722b and address=0x7fa4fba2cbc0, those two addresses 

> First, what is the difference between ip and address attribute? And  
> wow does the ip can be converted back to the process address space?

The ip is probably in the kernel space. The address could be the data access address causing a trap.