Re: [PATCH] perf trace: Increase syscall handler map size to 1024

[Namhyung Kim <namhyung@kernel.org>]

Hi Ian,

On Tue, May 20, 2025 at 08:05:37AM -0700, Ian Rogers wrote:
> On Mon, May 19, 2025 at 4:36 PM Howard Chu <howardchu95@gmail.com> wrote:
> >
> > Hello Namhyung,
> >
> > On Mon, May 19, 2025 at 4:25 PM Namhyung Kim <namhyung@kernel.org> wrote:
> > >
> > > The syscalls_sys_{enter,exit} map in augmented_raw_syscalls.bpf.c has
> > > max entries of 512.  Usually syscall numbers are smaller than this but
> > > x86 has x32 ABI where syscalls start from 512.
> > >
> > > That makes trace__init_syscalls_bpf_prog_array_maps() fail in the middle
> > > of the loop when it accesses those keys.  As the loop iteration is not
> > > ordered by syscall numbers anymore, the failure can affect non-x32
> > > syscalls.
> > >
> > > Let's increase the map size to 1024 so that it can handle those ABIs
> > > too.  While most systems won't need this, increasing the size will be
> > > safer for potential future changes.
> 
> Do we need to worry about MIPS where syscalls can be offset by 1000s?
> https://lore.kernel.org/lkml/8ed7dfb2-1e4d-4aa4-a04b-0397a89365d1@app.fastmail.com/

Argh..

> We could do with a map that combines BPF_MAP_TYPE_HASH with the tails
> calls of BPF_MAP_TYPE_PROG_ARRAY.

Right, it'd complicate things but I think it's doable.

Thanks,
Namhyung