The generic syscall entry code has the following form, which use
the input syscall work flag and syscall number:
| syscall_trace_enter(struct pt_regs *regs, long syscall,
| unsigned long work)
|
| syscall_exit_work(struct pt_regs *regs, unsigned long work)
In preparation for moving arm64 over to the generic entry code,
refactor syscall_trace_enter/exit() to also pass thread flags, and
get syscall number by syscall_get_nr() helper.
No functional changes.
Reviewed-by: Kevin Brodsky <kevin.brodsky@arm.com>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
---
arch/arm64/include/asm/syscall.h | 4 ++--
arch/arm64/kernel/ptrace.c | 25 ++++++++++++++++---------
arch/arm64/kernel/syscall.c | 5 +++--
3 files changed, 21 insertions(+), 13 deletions(-)
diff --git a/arch/arm64/include/asm/syscall.h b/arch/arm64/include/asm/syscall.h
index 5e4c7fc44f73..cef1d9ce6e1b 100644
--- a/arch/arm64/include/asm/syscall.h
+++ b/arch/arm64/include/asm/syscall.h
@@ -120,7 +120,7 @@ static inline int syscall_get_arch(struct task_struct *task)
return AUDIT_ARCH_AARCH64;
}
-int syscall_trace_enter(struct pt_regs *regs);
-void syscall_trace_exit(struct pt_regs *regs);
+int syscall_trace_enter(struct pt_regs *regs, long syscall, unsigned long flags);
+void syscall_trace_exit(struct pt_regs *regs, unsigned long flags);
#endif /* __ASM_SYSCALL_H */
diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
index f333791ffba6..79762ff33945 100644
--- a/arch/arm64/kernel/ptrace.c
+++ b/arch/arm64/kernel/ptrace.c
@@ -2407,9 +2407,8 @@ static void report_syscall_exit(struct pt_regs *regs)
}
}
-int syscall_trace_enter(struct pt_regs *regs)
+int syscall_trace_enter(struct pt_regs *regs, long syscall, unsigned long flags)
{
- unsigned long flags = read_thread_flags();
int ret;
if (flags & (_TIF_SYSCALL_EMU | _TIF_SYSCALL_TRACE)) {
@@ -2422,19 +2421,27 @@ int syscall_trace_enter(struct pt_regs *regs)
if (secure_computing() == -1)
return NO_SYSCALL;
- if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
- trace_sys_enter(regs, regs->syscallno);
+ /* Either of the above might have changed the syscall number */
+ syscall = syscall_get_nr(current, regs);
- audit_syscall_entry(regs->syscallno, regs->orig_x0, regs->regs[1],
+ if (test_thread_flag(TIF_SYSCALL_TRACEPOINT)) {
+ trace_sys_enter(regs, syscall);
+
+ /*
+ * Probes or BPF hooks in the tracepoint may have changed the
+ * system call number as well.
+ */
+ syscall = syscall_get_nr(current, regs);
+ }
+
+ audit_syscall_entry(syscall, regs->orig_x0, regs->regs[1],
regs->regs[2], regs->regs[3]);
- return regs->syscallno;
+ return syscall;
}
-void syscall_trace_exit(struct pt_regs *regs)
+void syscall_trace_exit(struct pt_regs *regs, unsigned long flags)
{
- unsigned long flags = read_thread_flags();
-
audit_syscall_exit(regs);
if (flags & _TIF_SYSCALL_TRACEPOINT)
diff --git a/arch/arm64/kernel/syscall.c b/arch/arm64/kernel/syscall.c
index c062badd1a56..5a103873de12 100644
--- a/arch/arm64/kernel/syscall.c
+++ b/arch/arm64/kernel/syscall.c
@@ -124,7 +124,7 @@ static void el0_svc_common(struct pt_regs *regs, int scno, int sc_nr,
*/
if (scno == NO_SYSCALL)
syscall_set_return_value(current, regs, -ENOSYS, 0);
- scno = syscall_trace_enter(regs);
+ scno = syscall_trace_enter(regs, scno, flags);
if (scno == NO_SYSCALL)
goto trace_exit;
}
@@ -143,7 +143,8 @@ static void el0_svc_common(struct pt_regs *regs, int scno, int sc_nr,
}
trace_exit:
- syscall_trace_exit(regs);
+ flags = read_thread_flags();
+ syscall_trace_exit(regs, flags);
}
void do_el0_svc(struct pt_regs *regs)
--
2.34.1On Mon, Dec 22, 2025 at 07:47:25PM +0800, Jinjie Ruan wrote:
> The generic syscall entry code has the following form, which use
> the input syscall work flag and syscall number:
>
> | syscall_trace_enter(struct pt_regs *regs, long syscall,
> | unsigned long work)
> |
> | syscall_exit_work(struct pt_regs *regs, unsigned long work)
>
> In preparation for moving arm64 over to the generic entry code,
> refactor syscall_trace_enter/exit() to also pass thread flags, and
> get syscall number by syscall_get_nr() helper.
>
> No functional changes.
>
> Reviewed-by: Kevin Brodsky <kevin.brodsky@arm.com>
> Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
> ---
> arch/arm64/include/asm/syscall.h | 4 ++--
> arch/arm64/kernel/ptrace.c | 25 ++++++++++++++++---------
> arch/arm64/kernel/syscall.c | 5 +++--
> 3 files changed, 21 insertions(+), 13 deletions(-)
>
> diff --git a/arch/arm64/include/asm/syscall.h b/arch/arm64/include/asm/syscall.h
> index 5e4c7fc44f73..cef1d9ce6e1b 100644
> --- a/arch/arm64/include/asm/syscall.h
> +++ b/arch/arm64/include/asm/syscall.h
> @@ -120,7 +120,7 @@ static inline int syscall_get_arch(struct task_struct *task)
> return AUDIT_ARCH_AARCH64;
> }
>
> -int syscall_trace_enter(struct pt_regs *regs);
> -void syscall_trace_exit(struct pt_regs *regs);
> +int syscall_trace_enter(struct pt_regs *regs, long syscall, unsigned long flags);
> +void syscall_trace_exit(struct pt_regs *regs, unsigned long flags);
>
> #endif /* __ASM_SYSCALL_H */
> diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
> index f333791ffba6..79762ff33945 100644
> --- a/arch/arm64/kernel/ptrace.c
> +++ b/arch/arm64/kernel/ptrace.c
> @@ -2407,9 +2407,8 @@ static void report_syscall_exit(struct pt_regs *regs)
> }
> }
>
> -int syscall_trace_enter(struct pt_regs *regs)
> +int syscall_trace_enter(struct pt_regs *regs, long syscall, unsigned long flags)
> {
> - unsigned long flags = read_thread_flags();
> int ret;
>
> if (flags & (_TIF_SYSCALL_EMU | _TIF_SYSCALL_TRACE)) {
> @@ -2422,19 +2421,27 @@ int syscall_trace_enter(struct pt_regs *regs)
> if (secure_computing() == -1)
> return NO_SYSCALL;
>
> - if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
> - trace_sys_enter(regs, regs->syscallno);
> + /* Either of the above might have changed the syscall number */
> + syscall = syscall_get_nr(current, regs);
I understand that you're gradually making the arch code more similar to
the core code so that we can switch over to it, but I'm struggling to
understand why syscall_trace_enter() takes the 'syscall' argument.
Even the core code just seems to use it as a local variable, which it
overrides before it ever uses it. What am I missing?
Will
On 2026/1/27 0:42, Will Deacon wrote:
> On Mon, Dec 22, 2025 at 07:47:25PM +0800, Jinjie Ruan wrote:
>> The generic syscall entry code has the following form, which use
>> the input syscall work flag and syscall number:
>>
>> | syscall_trace_enter(struct pt_regs *regs, long syscall,
>> | unsigned long work)
>> |
>> | syscall_exit_work(struct pt_regs *regs, unsigned long work)
>>
>> In preparation for moving arm64 over to the generic entry code,
>> refactor syscall_trace_enter/exit() to also pass thread flags, and
>> get syscall number by syscall_get_nr() helper.
>>
>> No functional changes.
>>
>> Reviewed-by: Kevin Brodsky <kevin.brodsky@arm.com>
>> Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
>> ---
>> arch/arm64/include/asm/syscall.h | 4 ++--
>> arch/arm64/kernel/ptrace.c | 25 ++++++++++++++++---------
>> arch/arm64/kernel/syscall.c | 5 +++--
>> 3 files changed, 21 insertions(+), 13 deletions(-)
>>
>> diff --git a/arch/arm64/include/asm/syscall.h b/arch/arm64/include/asm/syscall.h
>> index 5e4c7fc44f73..cef1d9ce6e1b 100644
>> --- a/arch/arm64/include/asm/syscall.h
>> +++ b/arch/arm64/include/asm/syscall.h
>> @@ -120,7 +120,7 @@ static inline int syscall_get_arch(struct task_struct *task)
>> return AUDIT_ARCH_AARCH64;
>> }
>>
>> -int syscall_trace_enter(struct pt_regs *regs);
>> -void syscall_trace_exit(struct pt_regs *regs);
>> +int syscall_trace_enter(struct pt_regs *regs, long syscall, unsigned long flags);
>> +void syscall_trace_exit(struct pt_regs *regs, unsigned long flags);
>>
>> #endif /* __ASM_SYSCALL_H */
>> diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
>> index f333791ffba6..79762ff33945 100644
>> --- a/arch/arm64/kernel/ptrace.c
>> +++ b/arch/arm64/kernel/ptrace.c
>> @@ -2407,9 +2407,8 @@ static void report_syscall_exit(struct pt_regs *regs)
>> }
>> }
>>
>> -int syscall_trace_enter(struct pt_regs *regs)
>> +int syscall_trace_enter(struct pt_regs *regs, long syscall, unsigned long flags)
>> {
>> - unsigned long flags = read_thread_flags();
>> int ret;
>>
>> if (flags & (_TIF_SYSCALL_EMU | _TIF_SYSCALL_TRACE)) {
>> @@ -2422,19 +2421,27 @@ int syscall_trace_enter(struct pt_regs *regs)
>> if (secure_computing() == -1)
>> return NO_SYSCALL;
>>
>> - if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
>> - trace_sys_enter(regs, regs->syscallno);
>> + /* Either of the above might have changed the syscall number */
>> + syscall = syscall_get_nr(current, regs);
>
> I understand that you're gradually making the arch code more similar to
> the core code so that we can switch over to it, but I'm struggling to
> understand why syscall_trace_enter() takes the 'syscall' argument.
>
> Even the core code just seems to use it as a local variable, which it
> overrides before it ever uses it. What am I missing?
Hi,
You're absolutely right. The 'syscall' parameter is indeed treated as a
local variable and gets overridden before any real use. Should we
refactor to remove the parameter entirely in generic entry?
Regards,
Jinjie
>
> Will
>
On 27/01/2026 04:01, Jinjie Ruan wrote: >> I understand that you're gradually making the arch code more similar to >> the core code so that we can switch over to it, but I'm struggling to >> understand why syscall_trace_enter() takes the 'syscall' argument. >> >> Even the core code just seems to use it as a local variable, which it >> overrides before it ever uses it. What am I missing? > Hi, > > You're absolutely right. The 'syscall' parameter is indeed treated as a > local variable and gets overridden before any real use. Should we > refactor to remove the parameter entirely in generic entry? I noticed this as well, removing it from the generic function would make sense. AFAICT that removal could be propagated quite far in fact: syscall_enter_from_user_mode_work(), syscall_enter_from_user_mode(), even arch implementation (do_syscall_64() on x86). - Kevin
On 2026/1/27 17:43, Kevin Brodsky wrote:
> On 27/01/2026 04:01, Jinjie Ruan wrote:
>>> I understand that you're gradually making the arch code more similar to
>>> the core code so that we can switch over to it, but I'm struggling to
>>> understand why syscall_trace_enter() takes the 'syscall' argument.
>>>
>>> Even the core code just seems to use it as a local variable, which it
>>> overrides before it ever uses it. What am I missing?
>> Hi,
>>
>> You're absolutely right. The 'syscall' parameter is indeed treated as a
>> local variable and gets overridden before any real use. Should we
>> refactor to remove the parameter entirely in generic entry?
>
> I noticed this as well, removing it from the generic function would make
> sense. AFAICT that removal could be propagated quite far in fact:
> syscall_enter_from_user_mode_work(), syscall_enter_from_user_mode(),
> even arch implementation (do_syscall_64() on x86).
Not really, it is the default return value of
syscall_enter_from_user_mode_work() as below, so we only need to remove
the parameter in syscall_trace_enter().
static __always_inline long syscall_enter_from_user_mode_work(struct
pt_regs *regs, long syscall)
{
unsigned long work = READ_ONCE(current_thread_info()->syscall_work);
if (work & SYSCALL_WORK_ENTER)
syscall = syscall_trace_enter(regs, work);
return syscall;
}
>
> - Kevin
>
On 27/01/2026 12:02, Jinjie Ruan wrote:
>
> On 2026/1/27 17:43, Kevin Brodsky wrote:
>> On 27/01/2026 04:01, Jinjie Ruan wrote:
>>>> I understand that you're gradually making the arch code more similar to
>>>> the core code so that we can switch over to it, but I'm struggling to
>>>> understand why syscall_trace_enter() takes the 'syscall' argument.
>>>>
>>>> Even the core code just seems to use it as a local variable, which it
>>>> overrides before it ever uses it. What am I missing?
>>> Hi,
>>>
>>> You're absolutely right. The 'syscall' parameter is indeed treated as a
>>> local variable and gets overridden before any real use. Should we
>>> refactor to remove the parameter entirely in generic entry?
>> I noticed this as well, removing it from the generic function would make
>> sense. AFAICT that removal could be propagated quite far in fact:
>> syscall_enter_from_user_mode_work(), syscall_enter_from_user_mode(),
>> even arch implementation (do_syscall_64() on x86).
> Not really, it is the default return value of
> syscall_enter_from_user_mode_work() as below, so we only need to remove
> the parameter in syscall_trace_enter().
>
> static __always_inline long syscall_enter_from_user_mode_work(struct
> pt_regs *regs, long syscall)
> {
> unsigned long work = READ_ONCE(current_thread_info()->syscall_work);
>
> if (work & SYSCALL_WORK_ENTER)
> syscall = syscall_trace_enter(regs, work);
>
> return syscall;
> }
You're right, hadn't realised the call to syscall_trace_enter() was
conditional.
- Kevin
© 2016 - 2026 Red Hat, Inc.