On Sun, 2026-07-12 at 23:25 +0200, Thomas Gleixner wrote: > Move it out of line and let it reread the syscall number on it's own. That > makes the low level entry code denser and allows to move the reread to the > call site of syscall_trace_enter() once the tracer is fixed up. > > Signed-off-by: Thomas Gleixner <[email protected]> > --- > include/linux/entry-common.h | 14 +++----------- > kernel/entry/syscall-common.c | 10 ++++++++++ > 2 files changed, 13 insertions(+), 11 deletions(-) > > --- a/include/linux/entry-common.h > +++ b/include/linux/entry-common.h > @@ -60,16 +60,7 @@ static __always_inline bool arch_ptrace_ > > long trace_syscall_enter(struct pt_regs *regs, long syscall); > void trace_syscall_exit(struct pt_regs *regs, long ret); > - > -static inline void syscall_enter_audit(struct pt_regs *regs, long syscall) > -{ > - if (unlikely(audit_context())) { > - unsigned long args[6]; > - > - syscall_get_arguments(current, regs, args); > - audit_syscall_entry(syscall, args[0], args[1], args[2], > args[3]); > - } > -} > +void syscall_enter_audit(struct pt_regs *regs); > > static __always_inline long syscall_trace_enter(struct pt_regs *regs, > unsigned long work, > long syscall) > @@ -111,7 +102,8 @@ static __always_inline long syscall_trac > if (unlikely(work & SYSCALL_WORK_SYSCALL_TRACEPOINT)) > syscall = trace_syscall_enter(regs, syscall); > > - syscall_enter_audit(regs, syscall); > + if (unlikely(audit_context())) > + syscall_enter_audit(regs); > > return syscall; > } > --- a/kernel/entry/syscall-common.c > +++ b/kernel/entry/syscall-common.c > @@ -1,5 +1,6 @@ > // SPDX-License-Identifier: GPL-2.0 > > +#include <linux/audit.h> > #include <linux/entry-common.h> > > #define CREATE_TRACE_POINTS > @@ -21,3 +22,12 @@ void trace_syscall_exit(struct pt_regs * > { > trace_sys_exit(regs, ret); > } > + > +void syscall_enter_audit(struct pt_regs *regs) > +{ > + long syscall = syscall_get_nr(current, regs); > + unsigned long args[6]; > + > + syscall_get_arguments(current, regs, args); > + __audit_syscall_entry(syscall, args[0], args[1], args[2], args[3]); > +}
Reviewed-by: Radu Rendec <[email protected]>
