Skip to content

Libbpf eBPF macro BPF_PROBE_READ

v0.4.0

The BPF_PROBE_READ macro is the non CO-RE variant of BPF_CORE_READ.

Definition

#define BPF_PROBE_READ(src, a, ...) ({                      \
    ___type((src), a, ##__VA_ARGS__) __r;                   \
    BPF_PROBE_READ_INTO(&__r, (src), a, ##__VA_ARGS__);         \
    __r;                                    \
})

Usage

The BPF_PROBE_READ macro is the non CO-RE variant of BPF_CORE_READ. So it does not emit CO-RE relocations. Its value is mostly in the pointer chasing use cases where this macro can convert one accessor into multiple bpf_probe_read_kernel calls.

Note

Only up to 9 "field accessors" are supported, which should be more than enough for any practical purpose.

Example

Docs could be improved

This part of the docs is incomplete, contributions are very welcome