Re: Kernel module that catches a syscall (i/o event)

[Arjan van de Ven <arjan@xxxxxxxxxxxxx>]

On Mon, 2007-02-26 at 14:01 +0200, Ramagudi Naziir wrote:
> Hi Arjan,
> 
> On 2/26/07, Arjan van de Ven <arjan@xxxxxxxxxxxxx> wrote:
> > On Sat, 2007-02-24 at 20:33 +0000, Liran wrote:
> > > I want to develop a kernel module that will be used to account for the
> > > input/output of files on the system
> > > and was wondering about doing it by intercepting the open() / read() / write()
> > > system calls with their size attributes
> > > and using that as a counter. (Later on, I wish to attach to a specific pid or
> > > account for all i/o for a specific user but that's later).
> >
> > I think your first misconception is that all IO starts with a syscall...
> > that's actually very much not the case (hint: mmap'd areas).
> 
> Can you please elaborate ? whare / what apps make use of mmap'd areas ?


glibc can for stdio
all databases do
all database libraries tend to do this
... the list goes on. it can be everywhere


-- 
if you want to mail me at work (you don't), use arjan (at) linux.intel.com
Test the interaction between Linux and your BIOS via http://www.linuxfirmwarekit.org


--
To unsubscribe from this list: send an email with
"unsubscribe kernelnewbies" to ecartis@xxxxxxxxxxxx
Please read the FAQ at http://kernelnewbies.org/FAQ