Currently, rcx is read as the fourth parameter of syscall on x86_64. But x86_64 Linux System Call convention uses r10 actually. This commit adds the wrapper for users who want to access to syscall params to analyze the user space. Changelog: ---------- v1 -> v2: - Rebase to current bpf-next https://lore.kernel.org/bpf/20211222213924.1869758-1-andrii@xxxxxxxxxx/ v2 -> v3: - Modify the definition of SYSCALL macros for only targeted archs. - Define __BPF_TARGET_MISSING variants for completeness. - Remove CORE variants. These macros will not be used. - Add a selftest. v3 -> v4: - Modify a selftest not to use serial tests. - Modify a selftest to use ASSERT_EQ(). - Extract syscall wrapper for all the other tests. - Add CORE variants. Kenta Tada (3): libbpf: Extract syscall wrapper libbpf: Fix the incorrect register read for syscalls on x86_64 libbpf: Add a test to confirm PT_REGS_PARM4_SYSCALL tools/lib/bpf/bpf_tracing.h | 34 +++++++++++++ .../bpf/prog_tests/test_bpf_syscall_macro.c | 49 ++++++++++++++++++ tools/testing/selftests/bpf/progs/bpf_misc.h | 19 +++++++ .../selftests/bpf/progs/bpf_syscall_macro.c | 51 +++++++++++++++++++ .../selftests/bpf/progs/test_probe_user.c | 15 +----- 5 files changed, 154 insertions(+), 14 deletions(-) create mode 100644 tools/testing/selftests/bpf/prog_tests/test_bpf_syscall_macro.c create mode 100644 tools/testing/selftests/bpf/progs/bpf_misc.h create mode 100644 tools/testing/selftests/bpf/progs/bpf_syscall_macro.c -- 2.32.0
