Hi. First, I hope you are fine and the same for your relatives. With this contribution, I enabled using syscalls:sys_exit_execve and syscalls:sys_exit_execveat as tracepoints on arm64. Indeed, before this contribution, the above tracepoint would not print their information as syscall number was set to -1 by calling forget_syscall(). Now, forget_syscall() is called only if previous syscall number was different than __NR_execve and __NR_execveat. I tested it by compiling a kernel for arm64 and running it within a VM: # Perf was compiled with linux kernel source. root@vm-arm64:~# perf record -ag -e 'syscalls:sys_exit_execve' -e 'syscalls:sys_enter_execve' & [1] 263 root@vm-arm64:~# ls perf.data share root@vm-arm64:~# fg perf record -ag -e 'syscalls:sys_exit_execve' -e 'syscalls:sys_enter_execve' ^C[ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.061 MB perf.data (2 samples) ] root@vm-arm64:~# perf script bash 264 [000] 66.220187: syscalls:sys_enter_execve: filename: 0xaaab05d9d ... # Below line does not appear with this patch. ls 264 [000] 66.226848: syscalls:sys_exit_execve: 0x0 ... Nonetheless, this contribution is not perfect, hence I marked it as RFC. First, I am not really sure if this is safe to not call forget_syscall() all the time, even though I did not have problem while testing it. Then, by including <asm-generic/unistd.h> to the modified file I ended with some warnings at compile time: So, if you see any way to improve this contribution, feel free to share! Francis Laniel (1): arm64: Forget syscall if different from execve*() arch/arm64/include/asm/processor.h | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) Best regards and thank you in advance. -- 2.25.1
|