<html><body><div style="font-family: times new roman, new york, times, serif; font-size: 12pt; color: #000000"><div>Please reply to the list.</div><div><br></div><div>I don't know, this is _your_ research :)<br></div><div><br></div><div>Thanks,<br></div><div><br></div><div>Mathieu<br></div><div><br></div><hr id="zwchr"><blockquote style="border-left:2px solid #1010FF;margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><b>From: </b>"tarek slaymia" <tarek.slaymia@gmail.com><br><b>To: </b>"Mathieu Desnoyers" <mathieu.desnoyers@efficios.com><br><b>Sent: </b>Thursday, June 5, 2014 2:50:50 PM<br><b>Subject: </b>Re: [lttng-dev] lttng kretprobe issue<br><div><br></div><div dir="ltr"><div><div>thanks Mathiew.<br>what i'm trying to do exacltly is changing the address of sys_write in the sys_call_table by a new function. <br>i wanna check if the sys_call_table[__NR_write] contains the address of my new function instead of the address of sys_write after loading my module.<br>
</div>How can i check this change using lttng ?<br></div>Thanks in advance !<br></div><div class="gmail_extra"><br><div><br></div><div class="gmail_quote">2014-06-05 13:08 GMT-04:00 Mathieu Desnoyers <span dir="ltr"><<a href="mailto:mathieu.desnoyers@efficios.com" target="_blank">mathieu.desnoyers@efficios.com</a>></span>:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div style="font-family:times new roman,new york,times,serif;font-size:12pt;color:#000000"><div><br></div><hr><blockquote style="border-left:2px solid #1010ff;margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt">
<b>From: </b>"tarek slaymia" <<a href="mailto:tarek.slaymia@gmail.com" target="_blank">tarek.slaymia@gmail.com</a>><br><b>To: </b><a href="mailto:lttng-dev@lists.lttng.org" target="_blank">lttng-dev@lists.lttng.org</a>, <a href="mailto:lttng-dev-request@lists.lttng.org" target="_blank">lttng-dev-request@lists.lttng.org</a><br>
<b>Sent: </b>Thursday, May 29, 2014 3:53:10 PM<br><b>Subject: </b>[lttng-dev] lttng kretprobe issue<div><div class="h5"><br><div><br></div><div dir="ltr"><div><div><div><div><div>Hi all<br><div><br></div></div>when i replace a syscall function address for example sys_write using this function in my LKM module :<br>
<div><br></div>xchg(&sys_call_table[__NR_write],my_own_write);<br><div><br></div></div>In the normal case the content of sys_call_table[__NR_write]
address changes and it displays the address of my_own_write using debug
technique .<br><div><br></div></div>I have an issue when tracing this change using lttng kretprobe :<br><div><br></div>
lttng enable-event sys_write -k --function sys_write<br><div><br></div> The ip value of sys_write ( the same address of
sys_call_table[__NR_write] ) remains the same even after changing it by
the new function address (address of my_own_write) <br></div>Why the ip value of sys_write syscall displayed in lttng traces remains the same even after changing it ? </div></div></div></div></blockquote><div><br></div>
<div>sys_write is a symbol, and its address does not change. You place the<br></div><div>kretprobe on the symbol.<br></div><div><br></div><div>What you are overwriting is the content of the sys_call_table array, not<br></div>
<div>the address of the sys_write symbol.<br></div><div><br></div><div>So the resulting behavior is very much expected.<br></div><div><br></div><div>Thanks,<br></div><div><br></div><div>Mathieu<br></div><div><br></div><blockquote style="border-left:2px solid #1010ff;margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt">
<div dir="ltr"><div><br></div>Best regards.</div><br>_______________________________________________<br>lttng-dev mailing list<br><a href="mailto:lttng-dev@lists.lttng.org" target="_blank">lttng-dev@lists.lttng.org</a><br>
<a href="http://lists.lttng.org/cgi-bin/mailman/listinfo/lttng-dev" target="_blank">http://lists.lttng.org/cgi-bin/mailman/listinfo/lttng-dev</a><span class="HOEnZb"><span style="color: #888888;" data-mce-style="color: #888888;" color="#888888"><br></span></span></blockquote><span class="HOEnZb"><span style="color: #888888;" data-mce-style="color: #888888;" color="#888888"><div>
<br><div><br></div></div><div><br></div><div>-- <br></div><div><span></span>Mathieu Desnoyers<br>EfficiOS Inc.<br><a href="http://www.efficios.com" target="_blank">http://www.efficios.com</a><span></span><br></div>
</span></span></div></div></blockquote></div><br></div>
</blockquote><div><br><br></div><div><br></div><div>-- <br></div><div><span name="x"></span>Mathieu Desnoyers<br>EfficiOS Inc.<br>http://www.efficios.com<span name="x"></span><br></div></div></body></html>