Hello! Intro / context =============== I'm trying to get a precise list of file names, offsets and byte counts of all read and write operations. I need that information to feed it into a simulator I am working on. I am running qemu-kvm with a slightly patched Linux kernel (additions of calls to printk only) sucking the kernel log from the serial console (kernel option earlyprintk=serial,keep) to a file. The setup itself works okay for me. Question / problem ================== When analyzing the kernel logs I produced I noticed stumbled over the case of a few libraries where only the beginning of the file (maybe its ELF header) was read repeated times, but nothing after: file /lib/ld-2.11.2.so max offset+count 456 total bytes read ever 502840 Especially as libc is among them, I guess some reads pass by me somehow. Any ideas what is shoveling the file bytes around? I found calls to do_mmap_pgoff for these file, though. That's when I thought I may need help understanding how mmap works. Is data read into the mapped region instantly all at once? Or is it feed into it on demand when the kernel gets read requests to a mapped area? In either case, where does the data come from if neither vfs_read nor do_readv_writev are ever called on the rest of the file? Thanks in advance for any help. Sebastian