On Mon, Jun 29, 2020 at 06:25:38PM -0700, Andrii Nakryiko wrote: > > > + > > +SEC("fentry.s/__x64_sys_setdomainname") > > +int BPF_PROG(test_sys_setdomainname, struct pt_regs *regs) > > +{ > > + int buf = 0; > > + long ret; > > + > > + ret = bpf_copy_from_user(&buf, sizeof(buf), (void *)regs->di); > > + if (regs->si == -2 && ret == 0 && buf == 1234) > > + copy_test++; > > + if (regs->si == -3 && ret == -EFAULT) > > + copy_test++; > > + if (regs->si == -4 && ret == -EFAULT) > > + copy_test++; > > regs->si and regs->di won't compile on non-x86 arches, better to use > PT_REGS_PARM1() and PT_REGS_PARM2() from bpf_tracing.h. the test is x86 only due to: +SEC("fentry.s/__x64_sys_setdomainname") I guess we can move samples/bpf/trace_common.h into libbpf as well to clean the whole thing up. Something for later patches.