From: Siddhartha Chhabra on
I am trying to probe the read and write system calls using jprobe and
kretprobes. In the first place, sys_read was not exported, so I have
exported the symbol and I am successfully able to register the probes.
Next I have a small piece of code that just invokes the read system
call. Now after I insert the module with the probes and run the
program with the read system call, it does not show the system call
called with the size parameter that I pass. For e.g. I call ./read
1234, the debug messages have a lot of prints but for sizes like 1,
4096, but never 1234. Since the debug message are getting printed, it
tells me that the probe has been registered successfully, however, I
was wondering why it never gives a message with the size i passed. Is
there something I am missing on probing the system call, or is there a
fundamental limitation on probing system calls...

I appreciate any comments/suggestion...

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)
More majordomo info at
Please read the FAQ at