On Mon, Apr 03, 2023 at 09:36:52PM -0700, Andrii Nakryiko wrote: > @@ -1407,6 +1407,11 @@ union bpf_attr { > __aligned_u64 fd_array; /* array of FDs */ > __aligned_u64 core_relos; > __u32 core_relo_rec_size; /* sizeof(struct bpf_core_relo) */ > + /* output: actual total log contents size (including termintaing zero). > + * It could be both larger than original log_size (if log was > + * truncated), or smaller (if log buffer wasn't filled completely). > + */ > + __u32 log_size_actual; Naming nit.. In the networking subsystem there is skb->truesize. The concept is exposed to user space through tracepoints and well understood in networking. May be call this field 'log_truesize' ? With or without underscore. Other than this the rest looks good and I believe it addresses Lorenz and Timo concerns. Would be good to hear from them.