Messages in this thread | | | Date | Sat, 10 Apr 2010 04:43:13 -0400 | Subject | Probing System calls | From | Siddhartha Chhabra <> |
| |
I am trying to probe the read and write system calls using jprobe and kretprobes. In the first place, sys_read was not exported, so I have exported the symbol and I am successfully able to register the probes. Next I have a small piece of code that just invokes the read system call. Now after I insert the module with the probes and run the program with the read system call, it does not show the system call called with the size parameter that I pass. For e.g. I call ./read 1234, the debug messages have a lot of prints but for sizes like 1, 4096, but never 1234. Since the debug message are getting printed, it tells me that the probe has been registered successfully, however, I was wondering why it never gives a message with the size i passed. Is there something I am missing on probing the system call, or is there a fundamental limitation on probing system calls...
I appreciate any comments/suggestion...
Thanks
| |