/usr/share/systemtap/tapset/bpf
NameSizeModeActions
aux_syscalls.stp9090644editdlrm
compatdefs.stp2030644editdlrm
context.stp60390644editdlrm
conversions.stp47270644editdlrm
exit.stp25830644editdlrm
logging.stp14630644editdlrm
syscalls.stpm2130644editdlrm
syscall_any.stp15690644editdlrm
syscall_num_arm.stp385880644editdlrm
syscall_num_arm64.stp865960644editdlrm
syscall_num_mips.stp1105340644editdlrm
syscall_num_powerpc.stp710860644editdlrm
syscall_num_riscv.stp484220644editdlrm
syscall_num_s390.stp680680644editdlrm
syscall_num_x86_64.stp656580644editdlrm
syscall_table.stp14910644editdlrm
target.stp14030644editdlrm
task.stp5830644editdlrm
time.stp5390644editdlrm
timestamp_gtod.stp21780644editdlrm
uconversions.stp80140644editdlrm
Edit: /usr/share/systemtap/tapset/bpf/aux_syscalls.stp (909B)
function _stp_bpf_syscall_get_nr:long(regs:long) { return @choose_defined( @cast(regs, "struct pt_regs", "kernel")->orig_ax, // STAPCONF_X86_UNIREGS @choose_defined(@cast(regs, "struct pt_regs", "kernel")->orig_rax, // __x86_64__ @choose_defined(@cast(regs, "struct pt_regs", "kernel")->orig_eax, // __i386__ @choose_defined(@cast(regs, "struct pt_regs", "kernel")->ARM_r7, // __arm__ @choose_defined(@cast(regs, "struct pt_regs", "kernel")->regs[2], //__mips__ @choose_defined(@cast(regs, "struct pt_regs", "kernel")->gpr[0], //__powerpc__ @choose_defined(@cast(regs, "struct pt_regs", "kernel")->gprs[2], // __s390__ || __s390x__ @choose_defined(@cast(regs, "struct pt_regs", "kernel")->syscallno, // __aarch64__ @cast(regs, "struct pt_regs", "kernel")->a7)))))))); // __riscv__ }