1

When I analysis sgx process by using strace, ioctl function is called so many times after mmap function like below.

1424  11:18:56 mmap(NULL, 4194304, PROT_NONE, MAP_SHARED, 4, 0) = 0x7f7e6a800000
1424  11:18:56 ioctl(4, _IOC(_IOC_WRITE, 0xa4, 0x00, 0x08), 0x7ffdadb760b0) = 0
1424  11:18:56 ioctl(4, _IOC(_IOC_WRITE, 0xa4, 0x01, 0x1a), 0x7ffdadb76f00) = 0
1424  11:18:56 ioctl(4, _IOC(_IOC_WRITE, 0xa4, 0x01, 0x1a), 0x7ffdadb76f00) = 0
1424  11:18:56 ioctl(4, _IOC(_IOC_WRITE, 0xa4, 0x01, 0x1a), 0x7ffdadb76f00) = 0
1424  11:18:56 ioctl(4, _IOC(_IOC_WRITE, 0xa4, 0x01, 0x1a), 0x7ffdadb76f00) = 0

Is there anyone who knows why this function is called so many times?

What means this function?

karoha
  • 73
  • 3

1 Answers1

0

Instead of adding a custom system call, a lot of things use ioctl on a "device" FD as a way for user-space to communicate with the kernel. Think of it as a device-specific system call.

In this specific case of SGX I don't know specifically what it's doing, but it's not rare to see lots of ioctls. e.g. sound card drivers use a lot of ioctl, too.

Originally ioctl was mostly for terminal I/O settings on TTY file descriptors, like canonical vs. raw, and which special characters did what, and serial port speeds. But as I said, other kinds of device drivers have used it as an alternative to adding new system calls.

Peter Cordes
  • 328,167
  • 45
  • 605
  • 847