Skip to content

Libbpf eBPF macro PT_REGS_RC

v0.0.6

The PT_REGS_RC macro make it easy to extract the return value from struct pt_regs style contexts in an architecture-independent way.

Usage

Since the struct pt_regs type represents the state of the CPU registers, it is different for every architecture. The PT_REGS_RC macro picks the correct register in the struct pt_regs type depending on the calling convention of the architecture.

This macro is typically only used with kretprobes, since the return value will not be yet be assigned when entering a function.

The architecture for which the eBPF program is compiled is determined by setting one of the __TARGET_ARCH_{arch} macros. These are typically set by passing a flag to the compiler, such as -D__TARGET_ARCH_x86 for x86. This allows for easy cross-compilation of eBPF programs for different architectures by changing the compiler invocation.

Example

Docs could be improved

This part of the docs is incomplete, contributions are very welcome