Re: [PATCH 1/4] 'catch syscall' feature -- Architecture-independent part

[Daniel Jacobowitz <drow@false.org>]

On Fri, Nov 07, 2008 at 12:06:31PM +0000, Pedro Alves wrote:
> If there any other way to distinguish entry/exit other than a toggle?
> Toggles are prone to be fallible.  E.g., if you *attach* to a program that
> is doing a long syscall, and then start tracing that syscall,
> is it possible that you hit the syscall exit first, so your toggle will
> be inverted?  That is, you'll report a syscall entry, when in fact, it
> was a syscall exit, and so on for the following syscalls of the same lwp.

There's code in strace to sort this out, though I do not remember
precisely how it works.  Yes, in current kernels we are limited to a
toggle.  There's PTRACE_O_TRACESYSGOOD (which I presume the patch
uses); that marks syscall traps specially, but does not differentiate
entry and exit.

-- 
Daniel Jacobowitz
CodeSourcery