manual SyS_foo management is unnecessary?
Ananth N Mavinakayanahalli
ananth@in.ibm.com
Tue Jun 15 14:21:00 GMT 2010
On Mon, Jun 14, 2010 at 12:52:54PM -0700, Josh Stone wrote:
...
> probe nd_syscall.open = kprobe.function("compat_sys_open") ?,
> kprobe.function("sys32_open") ?,
> kprobe.function("SyS_open") ?,
> kprobe.function("sys_open") ?
>
> The kprobe.function is resolved only at runtime, where kprobes uses
> kallsyms to map the symbol name to an address. It turns out, at least
> on recent kernels, that kallsyms also resolves aliased names. So again
> SyS_open and sys_open create duplicate probe addresses.
For the normal case (kernel.function) case, when SYSCALL_WRAPPERS were
introduced, every one of the syscall tests would fail with 'no match for
probe point sys_open' and the like. This was because the sys_ variants
would be inlined and stap wouldn't find them. Has this changed?
Ananth
More information about the Systemtap
mailing list