who have emitted a syscall ?

[jief]

Hi all !

When I am in kernel mode, is there a way to know which file (vnode) contains the part of code that call the syscall ?
If the prog was statically linked, all will come from the main file, and its vnode is in the 'struct proc'. But in case of dynamic library, if the syscall was emitted from inside the library, I would like to get its vnode...

Someone know how ?

Thanks.

[SirDice]

Never used it myself but I think you can do it with ktrace and/or dtrace.