I am trying to run examples from man fanotify.7 but fanotify_mark always
fail with errno = EFAULT.

fanotify_mark declaration is

SYSCALL_DEFINE5(fanotify_mark, int, fanotify_fd, unsigned int, flags,
			      __u64, mask, int, dfd,
			      const char  __user *, pathname)

When 

fanotify_mark(4, FAN_MARK_ADD | FAN_MARK_ONLYDIR,
              FAN_CREATE | FAN_ONDIR, AT_FDCWD, 0xdeadc0de)

is called on kernel side I can see in do_syscall_32_irqs_on that CPU
context is
    bx = 0x4        = 4
    cx = 0x9        = FAN_MARK_ADD | FAN_MARK_ONLYDIR,
    dx = 0x40000100 = FAN_CREATE | FAN_ONDIR
    si = 0x0
    di = 0xffffff9c = AT_FDCWD
    bp = 0xdeadc0de
    ax = 0xffffffda
    orix_ax = 0x153

I am not sure if it is ok because third argument is uint64_t so if I
understand correctly mask should be divided into two registers (dx and
si).

But in fanotify_mark we get
    fanotify_fd = 4          = bx
    flags       = 0x9        = cx
    mask        = 0x40000100 = dx
    dfd         = 0          = si
    pathname    = 0xffffff9c = di

I believe that correct order is
    fanotify_fd = 4          = bx
    flags       = 0x9        = cx
    mask        = 0x40000100 = (si << 32) | dx
    dfd         = 0xffffff9c = di
    pathname    = 0xdeadc0de = bp

I think that we should call COMPAT version of fanotify_mark here

COMPAT_SYSCALL_DEFINE6(fanotify_mark,
				int, fanotify_fd, unsigned int, flags,
				__u32, mask0, __u32, mask1, int, dfd,
				const char  __user *, pathname)

or something wrong is with 64-bits arguments.

I am running Linux 5.9.2 i686 on Pentium III (Coppermine).
For tests I am using Debian sid on qemu with 5.9.2 and default kernel
from repositories.

Everything works fine on 5.5 and 5.4.

-- 

Paweł Jasiak