On Thu, Apr 20, 2023 at 1:37 PM Yauheni Kaliuta <ykaliuta@xxxxxxxxxx> wrote: > > Hi, Alexei! > > >>>>> On Thu, 20 Apr 2023 08:59:09 -0700, Alexei Starovoitov wrote: > > > On Thu, Apr 20, 2023 at 6:57 AM Yauheni Kaliuta <ykaliuta@xxxxxxxxxx> wrote: > >> Hi! > >> > >> Should perf_call_bpf_enter/exit (kernel/trace/trace_syscalls.c) > >> use struct trace_event_raw_sys_enter/exit instead of locally > >> crafted struct syscall_tp_t nowadays? > > > > No. It needs syscall_tp_t. > > > test_progs's vmlinux test > >> expects it as the context. > >> > > > what do you mean? Pls share a code pointer? > > https://github.com/torvalds/linux/blob/master/tools/testing/selftests/bpf/progs/test_vmlinux.c#L19 > > SEC("tp/syscalls/sys_enter_nanosleep") > int handle__tp(struct trace_event_raw_sys_enter *args) I see. That bit is correct and that's what bpftrace is doing when attaching to syscalls. What do you see in your patched RT kernel when you do: cat /sys/kernel/debug/tracing/events/syscalls/sys_enter_nanosleep/format ? Depending on the answer we might need to fix the kernel side that has to use struct trace_entry in syscall_tp_t instead of plain long long.
