The asterisk indicates that the read system call for all processes are to be probed.
星号表示所有进程的read系统调用都应该探测。
Step one: the read system call causes a context switch from user mode to kernel mode.
read() 调用（参见 图 2）引发了一次从用户模式到内核模式的上下文切换。
Step two: data is copied from the kernel buffer into the user buffer, and the read system call returns. The return from the call caused a context switch from kernel back to user mode.
步骤二：数据从内核空间缓冲区复制到用户空间缓冲区，之后系统调用read返回，这导致了从内核空间向用户空间的上下文切换。
应用推荐