Fix PR15913 by handling nd_syscall.execve's 'filename' argument on s390x.

* tapset/linux/nd_syscalls.stp: On s390x, use register r2 for the filename
  argument.

diff --git a/tapset/linux/nd_syscalls.stp b/tapset/linux/nd_syscalls.stp
index c1a5a5ca400f7a3a71f9d0dffff62759361d653e..be87c67c18c01975a94eb38156ce5d42ac6d9ebc 100644 (file)
--- a/tapset/linux/nd_syscalls.stp
+++ b/tapset/linux/nd_syscalls.stp
@@ -965,10 +965,14 @@ probe __nd_syscall.eventfd.return = kprobe.function("sys_eventfd").return
 probe nd_syscall.execve = kprobe.function("sys_execve")
 {
        name = "execve"
-       // filename = kernel_string($filename)
+       // filename = user_string($filename)
        // args = __get_argv($argv, 0)
        // argstr = sprintf("%s %s", filename, __get_argv($argv, 1))
-       filename = user_string(pointer_arg(1))
+       //
+       // Why use u_register("r2") on s390? The odd s390 argument
+       // passing (PR15913).
+       filename = user_string(%( arch == "s390" %? u_register("r2")
+                              %: pointer_arg(1) %))
        args = __get_argv(pointer_arg(2), 0)
        argstr = sprintf("%s %s", filename, __get_argv(pointer_arg(2), 1))
 }