Sorry, sent previous reply too early. On Wed 28-11-18 16:33:12, Jan Kara wrote: > @@ -38,6 +50,21 @@ struct fanotify_event { > struct pid *pid; > }; > > +/* > + * Bit 0 of info.flags is set when event has fid information. > + * event->info shares the same union address with event->path, so this helps > + * us tell if event has fid or path. > + */ > +#define __FANOTIFY_FID 1UL > +#define FANOTIFY_HAS_FID(event) ((event)->info.flags & __FANOTIFY_FID) Why isn't this an inline function? And then the name wouldn't have to be all caps... Also I'd prefer if we just enlarged struct fanotify_event by 8 bytes to allow simple 'flags' field and info about possible embedded fid, rather than playing these bit tricks. They save space but make code more subtle and I don't file struct fanotify_event size so critical. Honza -- Jan Kara <jack@xxxxxxxx> SUSE Labs, CR