bpf on ia32

perform a command on an extended BPF map or program

sys_bpf(int cmd, union bpf_attr *attr, unsigned int size, struct bpf_common_attr *attr_common, unsigned int size_common)
number357 (0x165)
abii386
entry pointsys_bpf
sinceLinux 3.18
man pagebpf(2)
sourceelixir.bootlin.com

Registers

registervalue
eax357, the syscall number
ebxint cmd
ecxunion bpf_attr *attr
edxunsigned int size
esistruct bpf_common_attr *attr_common
ediunsigned int size_common
eaxthe return value

Then run int 0x80 to enter the kernel.

This compat ABI is only available when the kernel is built with CONFIG_IA32_EMULATION.

Same syscall on other architectures

Get this as JSON: https://api.syscall.sh/v2/syscalls/ia32/bpf