Re: sys_enter tracepoint ctx structure

[Yauheni Kaliuta <ykaliuta@redhat.com>]

Hi, Alexei!

>>>>> On Fri, 21 Apr 2023 09:02:34 -0700, Alexei Starovoitov  wrote:
 > On Fri, Apr 21, 2023 at 4:17 AM Yauheni Kaliuta <ykaliuta@redhat.com> wrote:
 >> >>>>> On Thu, 20 Apr 2023 16:12:49 -0700, Alexei Starovoitov  wrote:
 >> > On Thu, Apr 20, 2023 at 2:40 PM Yauheni Kaliuta <ykaliuta@redhat.com> wrote:
 >> >> >>>>> On Thu, 20 Apr 2023 13:54:26 -0700, Alexei Starovoitov  wrote:
 >> >> > On Thu, Apr 20, 2023 at 1:37 PM Yauheni Kaliuta <ykaliuta@redhat.com> wrote:
 >> >> >> >>>>> On Thu, 20 Apr 2023 08:59:09 -0700, Alexei Starovoitov  wrote:

[...]

 >> > Let's fix the kernel side too. Something like this should do it:
 >> 
 >> > diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c
 >> > index 942ddbdace4a..7aa1f4299486 100644
 >> > --- a/kernel/trace/trace_syscalls.c
 >> > +++ b/kernel/trace/trace_syscalls.c
 >> > @@ -555,7 +555,7 @@ static int perf_call_bpf_enter(struct
 >> > trace_event_call *call, struct pt_regs *re
 >> >                                struct syscall_trace_enter *rec)
 >> >  {
 >> >         struct syscall_tp_t {
 >> > -               unsigned long long regs;
 >> > +               struct trace_entry ent;
 >> >                 unsigned long syscall_nr;
 >> >                 unsigned long args[SYSCALL_DEFINE_MAXARGS];
 >> >         } param;
 >> > @@ -657,7 +657,7 @@ static int perf_call_bpf_exit(struct
 >> > trace_event_call *call, struct pt_regs *reg
 >> >                               struct syscall_trace_exit *rec)
 >> >  {
 >> >         struct syscall_tp_t {
 >> > -               unsigned long long regs;
 >> > +               struct trace_entry ent;
 >> 
 >> 
 >> > pls add build_bug_on that sizeof(ent) >= sizeof(void*).
 >> 
 >> Ok. Should the line *(struct pt_regs **)&param = regs; be commented somehow?

 > commented out?

No, no :)

 > No. It's mandatory.
 > And the reason for build_bug_on existence... to make sure that there
 > is enough space there.

Yes, it's clear for sure.

It can be not obvious why basically 'ent' is inited with
'regs'. Before it was called 'regs' at least.

-- 
WBR,
Yauheni Kaliuta