<html><body><div style="font-family: times new roman, new york, times, serif; font-size: 12pt; color: #000000"><div><br></div><hr id="zwchr"><blockquote style="border-left:2px solid #1010FF;margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><b>From: </b>"tarek slaymia" <tarek.slaymia@gmail.com><br><b>To: </b>lttng-dev@lists.lttng.org, lttng-dev-request@lists.lttng.org<br><b>Sent: </b>Thursday, May 29, 2014 3:53:10 PM<br><b>Subject: </b>[lttng-dev] lttng kretprobe issue<br><div><br></div><div dir="ltr"><div><div><div><div><div>Hi all<br><div><br></div></div>when i replace a syscall function address for example sys_write using this function in my LKM module :<br><div><br></div>xchg(&sys_call_table[__NR_write],my_own_write);<br><br></div>In the normal case the content of sys_call_table[__NR_write]
address changes and it displays the address of my_own_write using debug
technique .<br><div><br></div></div>I have an issue when tracing this change using lttng kretprobe :<br><br>
lttng enable-event sys_write -k --function sys_write<br><br> The ip value of sys_write ( the same address of
sys_call_table[__NR_write] ) remains the same even after changing it by
the new function address (address of my_own_write) <br></div>Why the ip value of sys_write syscall displayed in lttng traces remains the same even after changing it ? </div></div></blockquote><div><br></div><div>sys_write is a symbol, and its address does not change. You place the<br></div><div>kretprobe on the symbol.<br></div><div><br></div><div>What you are overwriting is the content of the sys_call_table array, not<br></div><div>the address of the sys_write symbol.<br></div><div><br></div><div>So the resulting behavior is very much expected.<br></div><div><br></div><div>Thanks,<br></div><div><br></div><div>Mathieu<br></div><div><br></div><blockquote style="border-left:2px solid #1010FF;margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><div dir="ltr"><div><br></div>Best regards.</div><br>_______________________________________________<br>lttng-dev mailing list<br>lttng-dev@lists.lttng.org<br>http://lists.lttng.org/cgi-bin/mailman/listinfo/lttng-dev<br></blockquote><div><br><br></div><div><br></div><div>-- <br></div><div><span name="x"></span>Mathieu Desnoyers<br>EfficiOS Inc.<br>http://www.efficios.com<span name="x"></span><br></div></div></body></html>