On Wed, Apr 18, 2018 at 11:45:09AM -0400, Steven Rostedt wrote: > From: "Steven Rostedt (VMware)" <rost...@goodmis.org> > > Arnaldo noticed that the latest kernel is missing the syscall event system > directory in x86. I bisected it down to d5a00528b58c ("syscalls/core, > syscalls/x86: Rename struct pt_regs-based sys_*() to __x64_sys_*()"). > > The system call trace events are special, as there is only one trace event > for all system calls (the raw_syscalls). But a macro that wraps the system > calls creates meta data for them that copies the name to find the system > call that maps to the system call table (the number). At boot up, it does a > kallsyms lookup of the system call table to find the function that maps to > the meta data of the system call. If it does not find a function, then that > system call is ignored. > > Because the x86 system calls had "__x64_", or "__ia32_" prefixed to the > "sys" for the names, they do not match the default compare algorithm. As > this was a problem for power pc, the algorithm can be overwritten by the > architecture. The solution is to have x86 have its own algorithm to do the > compare and this brings back the system call trace events. > > Link: http://lkml.kernel.org/r/20180417174128.0f345...@gandalf.local.home > > Reported-by: Arnaldo Carvalho de Melo <a...@redhat.com> > Tested-by: Arnaldo Carvalho de Melo <a...@redhat.com> > Fixes: d5a00528b58c ("syscalls/core, syscalls/x86: Rename struct > pt_regs-based sys_*() to __x64_sys_*()") > Signed-off-by: Steven Rostedt (VMware) <rost...@goodmis.org>
Acked-by: Dominik Brodowski <li...@dominikbrodowski.net>