On Mon, 22 Jun 2026 12:58:15 +0900 Masami Hiramatsu (Google) <[email protected]> wrote:
> The problem is that the event does not provide the information that > the string is in user space or not. But actually, for syscall events > all data pointed by syscall parameter should be in the user space. I think we should make this work then: echo 'e:open syscalls.sys_enter_openat file=+u0($filename):ustring' > dynamic_events That is, to have +u0() say "this is going to be dereferencing user space". I'll add Martin's patch and see if it makes the above work. -- Steve
