logo
Expand description

This module implements some built-in syscalls that can be called from within an eBPF program.

These syscalls may originate from several places:

  • Some of them mimic the syscalls available in the Linux kernel.
  • Some of them were proposed as example syscalls in uBPF and they were adapted here.
  • Other syscalls may be specific to rbpf.

The prototype for syscalls is always the same: five u64 as arguments, and a u64 as a return value. Hence some syscalls have unused arguments, or return a 0 value in all cases, in order to respect this convention.

Structs

The idea is to assemble five bytes into a single u64. For compatibility with the syscalls API, each argument must be a u64.

Same as void *memfrob(void *s, size_t n); in string.h in C. See the GNU manual page (in section 3) for memfrob. The memory is directly modified, and the syscall returns 0 in all cases. Arguments 3 to 5 are unused.

C-like strcmp, return 0 if the strings are equal, and a non-null value otherwise.

Prints a NULL-terminated UTF-8 string.

Prints the five arguments formated as u64 in decimal.

Prints its last three arguments to standard output. The first two arguments are unused. Returns the number of bytes written.

Example of a syscall with internal state.

Constants

Index of syscall bpf_trace_printk(), equivalent to bpf_trace_printf, in Linux kernel, see https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/include/uapi/linux/bpf.h.

Type Definitions

Test syscall context

Return type of syscalls