Re: [PATCH 1/5] perf trace: use standard syscall tracepoint structs for augmentation

[Namhyung Kim <namhyung@xxxxxxxxxx>]

On Thu, Aug 14, 2025 at 12:17:50AM -0700, Namhyung Kim wrote:
> From: Jakub Brnak <jbrnak@xxxxxxxxxx>
> 
> Replace custom syscall structs with the standard trace_event_raw_sys_enter
> and trace_event_raw_sys_exit from vmlinux.h.
> This fixes a data structure misalignment issue discovered on RHEL-9, which
> prevented BPF programs from correctly accessing syscall arguments.
> This change also aims to improve compatibility between different version
> of the perf tool and kernel by using CO-RE so BPF code can correclty
> adjust field offsets.
> 
> Signed-off-by: Jakub Brnak <jbrnak@xxxxxxxxxx>
> [ coding style updates and fix a BPF verifier issue ]
> Signed-off-by: Namhyung Kim <namhyung@xxxxxxxxxx>
> ---
[SNIP]
> @@ -489,9 +477,11 @@ static int augment_sys_enter(void *ctx, struct syscall_enter_args *args)
>  			index = -(size + 1);
>  			barrier_var(index); // Prevent clang (noticed with v18) from removing the &= 7 trick.
>  			index &= 7;	    // Satisfy the bounds checking with the verifier in some kernels.
> -			aug_size = args->args[index] > TRACE_AUG_MAX_BUF ? TRACE_AUG_MAX_BUF : args->args[index];
> +			aug_size = args->args[index];
>  
>  			if (aug_size > 0) {
> +				if (aug_size > TRACE_AUG_MAX_BUF)
> +					aug_size = TRACE_AUG_MAX_BUF;
>  				if (!bpf_probe_read_user(((struct augmented_arg *)payload_offset)->value, aug_size, arg))
>  					augmented = true;
>  			}

Does it help if you just revert this hunk?
(But actually my kernel doesn't like this...)


diff --git a/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c b/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c
index 979d60d7dce6565b..c4088bdd4916b0e6 100644
--- a/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c
+++ b/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c
@@ -493,11 +493,9 @@ static int augment_sys_enter(void *ctx, struct trace_event_raw_sys_enter *args)
                        index = -(size + 1);
                        barrier_var(index); // Prevent clang (noticed with v18) from removing the &= 7 trick.
                        index &= 7;         // Satisfy the bounds checking with the verifier in some kernels.
-                       aug_size = args->args[index];
+                       aug_size = args->args[index] > TRACE_AUG_MAX_BUF ? TRACE_AUG_MAX_BUF : args->args[index];
 
                        if (aug_size > 0) {
-                               if (aug_size > TRACE_AUG_MAX_BUF)
-                                       aug_size = TRACE_AUG_MAX_BUF;
                                if (!bpf_probe_read_user(((struct augmented_arg *)payload_offset)->value, aug_size, arg))
                                        augmented = true;
                        }