Fix legacy eBPF register definition on ARM64 (#155)

Author: MarioHewardt

src/tracer/ebpf/kern/procmonEBPF_common.h

@@ -52,6 +52,37 @@
 
 #define EBPF_RET_UNUSED     0
 
+#ifdef __BPF_TRACING__
+#ifdef EBPF_CO_RE
+typedef struct pt_regs procmon_pt_regs;
+#else
+typedef struct
+{
+    unsigned long r15;
+    unsigned long r14;
+    unsigned long r13;
+    unsigned long r12;
+    unsigned long rbp;
+    unsigned long rbx;
+    unsigned long r11;
+    unsigned long r10;
+    unsigned long r9;
+    unsigned long r8;
+    unsigned long rax;
+    unsigned long rcx;
+    unsigned long rdx;
+    unsigned long rsi;
+    unsigned long rdi;
+    unsigned long orig_rax;
+    unsigned long rip;
+    unsigned long cs;
+    unsigned long eflags;
+    unsigned long rsp;
+    unsigned long ss;
+} procmon_pt_regs;
+#endif
+#endif
+
 struct SyscallEvent
 {
     pid_t pid;

src/tracer/ebpf/kern/procmonGenericEntry_rawtp.c

@@ -117,7 +117,7 @@ static inline int PopulateArguments(enum ProcmonArgTag type, unsigned long arg,
 // Populates the event with the arguments for the syscall.
 // ------------------------------------------------------------------------------------------
 __attribute__((always_inline))
-static inline bool set_eventArgs(unsigned long *a, const struct pt_regs *regs)
+static inline bool set_eventArgs(unsigned long *a, const procmon_pt_regs *regs)
 {
     int ret = 0;
     ret |= bpf_probe_read(&a[0], sizeof(a[0]), &SYSCALL_PT_REGS_PARM1(regs));
@@ -265,7 +265,7 @@ int genericRawEnter(struct bpf_our_raw_tracepoint_args *ctx)
     uint32_t cpuId = bpf_get_smp_processor_id();
     uint64_t pidTid = bpf_get_current_pid_tgid();
     int pid = pidTid >> 32;
-    struct pt_regs* regs = NULL;
+    procmon_pt_regs* regs = NULL;
 
     //
     // Check all filters
@@ -304,7 +304,7 @@ int genericRawEnter(struct bpf_our_raw_tracepoint_args *ctx)
     sysEntry->userStackCount = bpf_get_stack(ctx, &sysEntry->userStack, MAX_STACK_FRAMES * sizeof(uint64_t), BPF_F_USER_STACK) / sizeof(uint64_t);
     sysEntry->timestamp = bpf_ktime_get_ns();
 
-    regs = (struct pt_regs *)ctx->args[0];
+    regs = (procmon_pt_regs *)ctx->args[0];
     unsigned long a[8];
     if (!set_eventArgs(a, regs))
     {

src/tracer/ebpf/kern/procmonGenericExit_rawtp.c

@@ -34,7 +34,7 @@ __attribute__((flatten))
 int genericRawExit(struct bpf_our_raw_tracepoint_args *ctx)
 {
     uint64_t pidTid = bpf_get_current_pid_tgid();
-    const struct pt_regs *regs = (const struct pt_regs *)ctx->args[0];
+    const procmon_pt_regs *regs = (const procmon_pt_regs *)ctx->args[0];
     int pid = pidTid >> 32;
 
     //