Search code examples
ebpf

ebpf how to check the syscalls available

I am looking at an eBPF sample code it has this

SEC("kprobe/__x64_sys_tcp_connect") Now how does one know such a call exists?

I tried following

  1. bpftrace -l & list all kprobes

  2. list all events under this folder /sys/kernel/debug/tracing/events/syscalls

  3. grep the kernel source code 4.look in /arch/x86/entry/syscalls/syscall_64.tbl

I do not see it In general how would one go about looking for such syscalls for use with eBPF

Solution

  • You can get the symbol names for the kprobe function via:

    • sudo bpftrace -l kprobe:*<keyword>*
    • sudo cat /proc/kallsyms | grep <keyword> |grep T

    If you don't see it, it means you should use another name in the SEC or when attaching the kprobe function:

    $ sudo bpftrace -l kprobe:*tcp_connect
kprobe:tcp_connect
$ sudo cat /proc/kallsyms | grep tcp_connect |grep T
ffffffff8e9e47f0 T tcp_connect


SEC("kprobe/tcp_connect")