Commit d21fbcee authored by Andrii Nakryiko's avatar Andrii Nakryiko Committed by Daniel Borkmann
Browse files

libbpf: Define x86-64 syscall regs spec in bpf_tracing.h 



Define explicit table of registers used for syscall argument passing.
Remove now unnecessary overrides of PT_REGS_PARM5_[CORE_]SYSCALL macros.

Signed-off-by: default avatarAndrii Nakryiko <andrii@kernel.org>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20230120200914.3008030-14-andrii@kernel.org
parent 8ccabeef

tools/lib/bpf/bpf_tracing.h

+19 −6
Original line number Diff line number Diff line
@@ -90,14 +90,22 @@ 
#define __PT_PARM4_REG cx

#define __PT_PARM5_REG r8

#define __PT_PARM6_REG r9

/*

 * Syscall uses r10 for PARM4. See arch/x86/entry/entry_64.S:entry_SYSCALL_64

 * comments in Linux sources. And refer to syscall(2) manpage.

 */

#define __PT_PARM1_SYSCALL_REG __PT_PARM1_REG

#define __PT_PARM2_SYSCALL_REG __PT_PARM2_REG

#define __PT_PARM3_SYSCALL_REG __PT_PARM3_REG

#define __PT_PARM4_SYSCALL_REG r10

#define __PT_PARM5_SYSCALL_REG __PT_PARM5_REG

#define __PT_PARM6_SYSCALL_REG __PT_PARM6_REG



#define __PT_RET_REG sp

#define __PT_FP_REG bp

#define __PT_RC_REG ax

#define __PT_SP_REG sp

#define __PT_IP_REG ip

/* syscall uses r10 for PARM4 */

#define PT_REGS_PARM4_SYSCALL(x) ((x)->r10)

#define PT_REGS_PARM4_CORE_SYSCALL(x) BPF_CORE_READ(x, r10)



#else
@@ -121,14 +129,19 @@ 
#define __PT_PARM4_REG rcx

#define __PT_PARM5_REG r8

#define __PT_PARM6_REG r9



#define __PT_PARM1_SYSCALL_REG __PT_PARM1_REG

#define __PT_PARM2_SYSCALL_REG __PT_PARM2_REG

#define __PT_PARM3_SYSCALL_REG __PT_PARM3_REG

#define __PT_PARM4_SYSCALL_REG r10

#define __PT_PARM5_SYSCALL_REG __PT_PARM5_REG

#define __PT_PARM6_SYSCALL_REG __PT_PARM6_REG



#define __PT_RET_REG rsp

#define __PT_FP_REG rbp

#define __PT_RC_REG rax

#define __PT_SP_REG rsp

#define __PT_IP_REG rip

/* syscall uses r10 for PARM4 */

#define PT_REGS_PARM4_SYSCALL(x) ((x)->r10)

#define PT_REGS_PARM4_CORE_SYSCALL(x) BPF_CORE_READ(x, r10)



#endif /* __i386__ */