Hi, Alexei! >>>>> On Thu, 20 Apr 2023 13:54:26 -0700, Alexei Starovoitov wrote: > On Thu, Apr 20, 2023 at 1:37 PM Yauheni Kaliuta <ykaliuta@xxxxxxxxxx> wrote: >> >>>>> On Thu, 20 Apr 2023 08:59:09 -0700, Alexei Starovoitov wrote: >> >> >> >> Should perf_call_bpf_enter/exit (kernel/trace/trace_syscalls.c) >> >> use struct trace_event_raw_sys_enter/exit instead of locally >> >> crafted struct syscall_tp_t nowadays? >> >> >> > No. It needs syscall_tp_t. >> >> > test_progs's vmlinux test >> >> expects it as the context. >> >> >> >> > what do you mean? Pls share a code pointer? >> >> https://github.com/torvalds/linux/blob/master/tools/testing/selftests/bpf/progs/test_vmlinux.c#L19 >> >> SEC("tp/syscalls/sys_enter_nanosleep") >> int handle__tp(struct trace_event_raw_sys_enter *args) > I see. That bit is correct and that's what bpftrace is doing > when attaching to syscalls. > What do you see in your patched RT kernel when you do: > cat /sys/kernel/debug/tracing/events/syscalls/sys_enter_nanosleep/format > ? > Depending on the answer we might need to fix > the kernel side that has to use struct trace_entry > in syscall_tp_t instead of plain long long. # cat /sys/kernel/debug/tracing/events/syscalls/sys_enter_nanosleep/format name: sys_enter_nanosleep ID: 374 format: field:unsigned short common_type; offset:0; size:2; signed:0; field:unsigned char common_flags; offset:2; size:1; signed:0; field:unsigned char common_preempt_count; offset:3; size:1; signed:0; field:int common_pid; offset:4; size:4; signed:1; field:unsigned char common_preempt_lazy_count; offset:8; size:1; signed:0; field:int __syscall_nr; offset:12; size:4; signed:1; field:struct __kernel_timespec * rqtp; offset:16; size:8; signed:0; field:struct __kernel_timespec * rmtp; offset:24; size:8; signed:0; print fmt: "rqtp: 0x%08lx, rmtp: 0x%08lx", ((unsigned long)(REC->rqtp)), ((unsigned long)(REC->rmtp)) -- WBR, Yauheni Kaliuta
