trace_call_bpf(9)

✨ trace_call_bpf(9) — the Kernel API Manual glow-up ✨

okay so bestie, this is trace_call_bpf from section 9 of the Kernel API Manual, and it's literally the little helper that makes BPF programs run from tracepoint-land 💅

---

🎀 NAME 🎀

trace_call_bpf — invoke BPF program 🦋

---

⭐ SYNOPSIS ⭐

unsigned int trace_call_bpf (struct trace_event_call *call , void *ctx );

no cap, that's the whole signature 🫶

---

🌸 ARGUMENTS 🌸

• call — the tracepoint event 👑
• ctx — an opaque context pointer (opaque like your crush's texts, iykyk 🙈)

---

💖 DESCRIPTION 💖

so here's the tea: kprobe handlers execute BPF programs via this helper, periodt ⚡

and lowkey it can be used from static tracepoints in the future — that's the plan, it's giving main character energy for later 🌈

---

🔥 RETURN 🔥

BPF programs always return an integer, and the kprobe handler interprets it like this:

• 0 — return from kprobe (the event is filtered out) 💀
• 1 — store the kprobe event into the ring buffer ✨

any other values are reserved, and currently they alias to 1 🫠 — so don't get cute with your return values, bestie

---

🧚 SEE ALSO 🧚

• Kernel file ./kernel/trace/bpf_trace.c 📁
• trace_call_bpf_faultable(9) 🔍

---

ngl this one's short and sweet — the whole vibe is "hand it a tracepoint and a context, get an integer back, slay" 💜

and that's the page, fr fr ✨ source is ./kernel/trace, version stamped October 2026, and it's trace_call_bpf(9) — go off, bestie 🎀💅