On Friday 10 February 2012 04:37, Indan Zupancic wrote: > > I read somewhere about a bug report where syscall-exit was seen after > > attach, but I don't remember where now. > > Well, if you attach at a random moment you can get a syscall-exit first, > I guess. I suppose you have to wait till you get the SIGSTOP notification > before you can be sure that the next syscall event will be an entry one. No. After PTRACE_ATTACH, next reported waitpid result will be either a ptrace-stop of signal-delivery-stop variety, or death (WIFEXITED/WIFSIGNALED). Syscall exit notification is not possible (modulo kernel bugs). For one, syscall entry/exit notifications must be explicitly requested by PTRACE_SYSCALL, which wasn't yet done! -- vda -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
