On 7/13/2026 5:25 AM, Thomas Gleixner wrote:
> Move it out of line and let it reread the syscall number on it's own. That
> makes the low level entry code denser and allows to move the reread to the
> call site of syscall_trace_enter() once the tracer is fixed up.
>
> Signed-off-by: Thomas Gleixner <[email protected]>
> ---
> include/linux/entry-common.h | 14 +++-----------
> kernel/entry/syscall-common.c | 10 ++++++++++
> 2 files changed, 13 insertions(+), 11 deletions(-)
>
> --- a/include/linux/entry-common.h
> +++ b/include/linux/entry-common.h
> @@ -60,16 +60,7 @@ static __always_inline bool arch_ptrace_
>
> long trace_syscall_enter(struct pt_regs *regs, long syscall);
> void trace_syscall_exit(struct pt_regs *regs, long ret);
> -
> -static inline void syscall_enter_audit(struct pt_regs *regs, long syscall)
> -{
> - if (unlikely(audit_context())) {
> - unsigned long args[6];
> -
> - syscall_get_arguments(current, regs, args);
> - audit_syscall_entry(syscall, args[0], args[1], args[2],
> args[3]);
> - }
> -}
> +void syscall_enter_audit(struct pt_regs *regs);
>
> static __always_inline long syscall_trace_enter(struct pt_regs *regs,
> unsigned long work,
> long syscall)
> @@ -111,7 +102,8 @@ static __always_inline long syscall_trac
> if (unlikely(work & SYSCALL_WORK_SYSCALL_TRACEPOINT))
> syscall = trace_syscall_enter(regs, syscall);
>
> - syscall_enter_audit(regs, syscall);
> + if (unlikely(audit_context()))
> + syscall_enter_audit(regs);
Reviewed-by: Jinjie Ruan <[email protected]>
>
> return syscall;
> }
> --- a/kernel/entry/syscall-common.c
> +++ b/kernel/entry/syscall-common.c
> @@ -1,5 +1,6 @@
> // SPDX-License-Identifier: GPL-2.0
>
> +#include <linux/audit.h>
> #include <linux/entry-common.h>
>
> #define CREATE_TRACE_POINTS
> @@ -21,3 +22,12 @@ void trace_syscall_exit(struct pt_regs *
> {
> trace_sys_exit(regs, ret);
> }
> +
> +void syscall_enter_audit(struct pt_regs *regs)
> +{
> + long syscall = syscall_get_nr(current, regs);
> + unsigned long args[6];
> +
> + syscall_get_arguments(current, regs, args);
> + __audit_syscall_entry(syscall, args[0], args[1], args[2], args[3]);
> +}
>
