Re: sys_enter tracepoint ctx structure

[Yauheni Kaliuta <ykaliuta@redhat.com>]

Hi, Alexei!

>>>>> On Thu, 20 Apr 2023 13:54:26 -0700, Alexei Starovoitov  wrote:
 > On Thu, Apr 20, 2023 at 1:37 PM Yauheni Kaliuta <ykaliuta@redhat.com> wrote:
 >> >>>>> On Thu, 20 Apr 2023 08:59:09 -0700, Alexei Starovoitov  wrote:
 >> >>
 >> >> Should perf_call_bpf_enter/exit (kernel/trace/trace_syscalls.c)
 >> >> use struct trace_event_raw_sys_enter/exit instead of locally
 >> >> crafted struct syscall_tp_t nowadays?
 >> 
 >> 
 >> > No. It needs syscall_tp_t.
 >> 
 >> > test_progs's vmlinux test
 >> >> expects it as the context.
 >> >>
 >> 
 >> > what do you mean? Pls share a code pointer?
 >> 
 >> https://github.com/torvalds/linux/blob/master/tools/testing/selftests/bpf/progs/test_vmlinux.c#L19
 >> 
 >> SEC("tp/syscalls/sys_enter_nanosleep")
 >> int handle__tp(struct trace_event_raw_sys_enter *args)

 > I see. That bit is correct and that's what bpftrace is doing
 > when attaching to syscalls.
 > What do you see in your patched RT kernel when you do:
 > cat /sys/kernel/debug/tracing/events/syscalls/sys_enter_nanosleep/format
 > ?
 > Depending on the answer we might need to fix
 > the kernel side that has to use struct trace_entry
 > in syscall_tp_t instead of plain long long.

 # cat /sys/kernel/debug/tracing/events/syscalls/sys_enter_nanosleep/format
name: sys_enter_nanosleep
ID: 374
format:
        field:unsigned short common_type;       offset:0;       size:2; signed:0;
        field:unsigned char common_flags;       offset:2;       size:1; signed:0;
        field:unsigned char common_preempt_count;       offset:3;       size:1; signed:0;
        field:int common_pid;   offset:4;       size:4; signed:1;
        field:unsigned char common_preempt_lazy_count;  offset:8;       size:1; signed:0;

        field:int __syscall_nr; offset:12;      size:4; signed:1;
        field:struct __kernel_timespec * rqtp;  offset:16;      size:8; signed:0;
        field:struct __kernel_timespec * rmtp;  offset:24;      size:8; signed:0;

print fmt: "rqtp: 0x%08lx, rmtp: 0x%08lx", ((unsigned long)(REC->rqtp)), ((unsigned long)(REC->rmtp))



-- 
WBR,
Yauheni Kaliuta